/* packet-bitcoin.c

 * Routines for bitcoin dissection

 * Copyright 2011, Christian Svensson <blue@cmd.nu>

 * Bitcoin address: 15Y2EN5mLnsTt3CZBfgpnZR5SeLwu7WEHz

 *

 * See https://en.bitcoin.it/wiki/Protocol_specification

 *

 * Updated 2015, Laurenz Kamp <laurenz.kamp@gmx.de>

 * Changes made:

 *   Updated dissectors:

 *     -> ping: ping packets now have a nonce.

 *     -> version: If version >= 70002, version messages have a relay flag.

 *     -> Messages with no payload: Added mempool and filterclear messages.

 *   Added dissectors:

 *     -> pong message

 *     -> notfound message

 *     -> reject message

 *     -> filterload

 *     -> filteradd

 *     -> merkleblock

 *     -> headers

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include "packet-tcp.h"

#define BITCOIN_MAIN_MAGIC_NUMBER       0xD9B4BEF9

#define BITCOIN_TESTNET_MAGIC_NUMBER    0xDAB5BFFA

#define BITCOIN_TESTNET3_MAGIC_NUMBER   0x0709110B

#define BITCOIN_TESTNET4_MAGIC_NUMBER   0x283F161C

static const value_string inv_types[] =

{

  { 0, "ERROR" },

  { 1, "MSG_TX" },

  { 2, "MSG_BLOCK" },

  { 3, "MSG_FILTERED_BLOCK" },

  { 4, "MSG_CMPCT_BLOCK" },

  { 5, "MSG_WTX" },

  { 0x40000001, "MSG_WITNESS_TX" },

  { 0x40000002, "MSG_WITNESS_BLOCK" },

  { 0, NULL }

};

static const value_string network_ids[] =

{

  { 0x01, "IPv4" },

  { 0x02, "IPv6" },

  { 0x03, "Tor v2" },

  { 0x04, "Tor v3" },

  { 0x05, "I2P" },

  { 0x06, "Cjdns" },

  { 0, NULL }

};

static const value_string reject_ccode[] =

{

  { 0x01, "REJECT_MALFORMED" },

  { 0x10, "REJECT_INVALID" },

  { 0x11, "REJECT_OBSOLETE" },

  { 0x12, "REJECT_DUPLICATE" },

  { 0x40, "REJECT_NONSTANDARD" },

  { 0x41, "REJECT_DUST" },

  { 0x42, "REJECT_INSUFFICIENTFEE" },

  { 0x43, "REJECT_CHECKPOINT" },

  { 0, NULL }

};

static const value_string filterload_nflags[] =

{

  { 0, "BLOOM_UPDATE_NONE" },

  { 1, "BLOOM_UPDATE_ALL" },

  { 2, "BLOOM_UPDATE_P2PUBKEY_ONLY" },

  { 0, NULL }

};

/*

 * Minimum bitcoin identification header.

 * - Magic - 4 bytes

 * - Command - 12 bytes

 * - Payload length - 4 bytes

 * - Checksum - 4 bytes

 */

#define BITCOIN_HEADER_LENGTH 4+12+4+4

void proto_register_bitcoin(void);

void proto_reg_handoff_bitcoin(void);

static dissector_handle_t bitcoin_handle;

static dissector_table_t bitcoin_command_table;

static int proto_bitcoin;

static int hf_address_address;

static int hf_address_port;

static int hf_address_services;

static int hf_bitcoin_checksum;

static int hf_bitcoin_command;

static int hf_bitcoin_length;

static int hf_bitcoin_magic;

static int hf_bitcoin_msg_addr;

static int hf_bitcoin_msg_addrv2;

static int hf_bitcoin_msg_block;

static int hf_bitcoin_msg_feefilter;

static int hf_bitcoin_msg_filteradd;

static int hf_bitcoin_msg_filterload;

static int hf_bitcoin_msg_getblocks;

static int hf_bitcoin_msg_getdata;

static int hf_bitcoin_msg_getheaders;

static int hf_bitcoin_msg_headers;

static int hf_bitcoin_msg_inv;

static int hf_bitcoin_msg_merkleblock;

static int hf_bitcoin_msg_notfound;

static int hf_bitcoin_msg_ping;

static int hf_bitcoin_msg_pong;

static int hf_bitcoin_msg_reject;

static int hf_bitcoin_msg_sendcmpct;

static int hf_bitcoin_msg_tx;

static int hf_bitcoin_msg_version;

static int hf_data_value;

static int hf_data_varint_count16;

static int hf_data_varint_count32;

static int hf_data_varint_count64;

static int hf_data_varint_count8;

static int hf_msg_addr_address;

static int hf_msg_addr_count16;

static int hf_msg_addr_count32;

static int hf_msg_addr_count64;

static int hf_msg_addr_count8;

static int hf_msg_addr_timestamp;

static int hf_msg_addrv2_count16;

static int hf_msg_addrv2_count32;

static int hf_msg_addrv2_count64;

static int hf_msg_addrv2_count8;

static int hf_msg_addrv2_item;

static int hf_msg_addrv2_timestamp;

static int hf_msg_addrv2_services;

static int hf_msg_addrv2_network;

static int hf_msg_addrv2_address_ipv4;

static int hf_msg_addrv2_address_ipv6;

static int hf_msg_addrv2_address_other;

static int hf_msg_addrv2_port;

static int hf_msg_block_bits;

static int hf_msg_block_merkle_root;

static int hf_msg_block_nonce;

static int hf_msg_block_prev_block;

static int hf_msg_block_time;

static int hf_msg_block_transactions16;

static int hf_msg_block_transactions32;

static int hf_msg_block_transactions64;

static int hf_msg_block_transactions8;

static int hf_msg_block_version;

static int hf_msg_feefilter_value;

static int hf_msg_filteradd_data;

static int hf_msg_filterload_filter;

static int hf_msg_filterload_nflags;

static int hf_msg_filterload_nhashfunc;

static int hf_msg_filterload_ntweak;

static int hf_msg_getblocks_count16;

static int hf_msg_getblocks_count32;

static int hf_msg_getblocks_count64;

static int hf_msg_getblocks_count8;

static int hf_msg_getblocks_start;

static int hf_msg_getblocks_stop;

static int hf_msg_getdata_count16;

static int hf_msg_getdata_count32;

static int hf_msg_getdata_count64;

static int hf_msg_getdata_count8;

static int hf_msg_getdata_hash;

static int hf_msg_getdata_type;

static int hf_msg_getheaders_count16;

static int hf_msg_getheaders_count32;

static int hf_msg_getheaders_count64;

static int hf_msg_getheaders_count8;

static int hf_msg_getheaders_start;

static int hf_msg_getheaders_stop;

static int hf_msg_getheaders_version;

static int hf_msg_headers_bits;

static int hf_msg_headers_count16;

static int hf_msg_headers_count32;

static int hf_msg_headers_count64;

static int hf_msg_headers_count8;

static int hf_msg_headers_merkle_root;

static int hf_msg_headers_nonce;

static int hf_msg_headers_prev_block;

static int hf_msg_headers_time;

static int hf_msg_headers_version;

static int hf_msg_inv_count16;

static int hf_msg_inv_count32;

static int hf_msg_inv_count64;

static int hf_msg_inv_count8;

static int hf_msg_inv_hash;

static int hf_msg_inv_type;

static int hf_msg_merkleblock_bits;

static int hf_msg_merkleblock_flags_data;

static int hf_msg_merkleblock_flags_size16;

static int hf_msg_merkleblock_flags_size32;

static int hf_msg_merkleblock_flags_size64;

static int hf_msg_merkleblock_flags_size8;

static int hf_msg_merkleblock_hashes_count16;

static int hf_msg_merkleblock_hashes_count32;

static int hf_msg_merkleblock_hashes_count64;

static int hf_msg_merkleblock_hashes_count8;

static int hf_msg_merkleblock_hashes_hash;

static int hf_msg_merkleblock_merkle_root;

static int hf_msg_merkleblock_nonce;

static int hf_msg_merkleblock_prev_block;

static int hf_msg_merkleblock_time;

static int hf_msg_merkleblock_transactions;

static int hf_msg_merkleblock_version;

static int hf_msg_notfound_count16;

static int hf_msg_notfound_count32;

static int hf_msg_notfound_count64;

static int hf_msg_notfound_count8;

static int hf_msg_notfound_hash;

static int hf_msg_notfound_type;

static int hf_msg_ping_nonce;

static int hf_msg_pong_nonce;

static int hf_msg_reject_ccode;

static int hf_msg_reject_data;

static int hf_msg_reject_message;

static int hf_msg_reject_reason;

static int hf_msg_sendcmpct_announce;

static int hf_msg_sendcmpct_version;

static int hf_msg_tx_in;

static int hf_msg_tx_in_count16;

static int hf_msg_tx_in_count32;

static int hf_msg_tx_in_count64;

static int hf_msg_tx_in_count8;

static int hf_msg_tx_in_prev_outp_hash;

static int hf_msg_tx_in_prev_outp_index;

static int hf_msg_tx_in_prev_output;

static int hf_msg_tx_in_script16;

static int hf_msg_tx_in_script32;

static int hf_msg_tx_in_script64;

static int hf_msg_tx_in_script8;

static int hf_msg_tx_in_seq;

static int hf_msg_tx_in_sig_script;

static int hf_msg_tx_lock_time;

static int hf_msg_tx_out;

static int hf_msg_tx_out_count16;

static int hf_msg_tx_out_count32;

static int hf_msg_tx_out_count64;

static int hf_msg_tx_out_count8;

static int hf_msg_tx_out_script;

static int hf_msg_tx_out_script16;

static int hf_msg_tx_out_script32;

static int hf_msg_tx_out_script64;

static int hf_msg_tx_out_script8;

static int hf_msg_tx_out_value;

static int hf_msg_tx_witness;

static int hf_msg_tx_witness_components16;

static int hf_msg_tx_witness_components32;

static int hf_msg_tx_witness_components64;

static int hf_msg_tx_witness_components8;

static int hf_msg_tx_witness_component;

static int hf_msg_tx_witness_component_length16;

static int hf_msg_tx_witness_component_length32;

static int hf_msg_tx_witness_component_length64;

static int hf_msg_tx_witness_component_length8;

static int hf_msg_tx_witness_component_data;

static int hf_msg_tx_version;

static int hf_msg_tx_flag;

static int hf_msg_version_addr_me;

static int hf_msg_version_addr_you;

static int hf_msg_version_nonce;

static int hf_msg_version_relay;

static int hf_msg_version_services;

static int hf_msg_version_start_height;

static int hf_msg_version_timestamp;

static int hf_msg_version_user_agent;

static int hf_msg_version_version;

static int hf_services_network;

static int hf_services_getutxo;

static int hf_services_bloom;

static int hf_services_witness;

static int hf_services_xthin;

static int hf_services_compactfilters;

static int hf_services_networklimited;

static int hf_services_p2pv2;

static int hf_string_value;

static int hf_string_varint_count16;

static int hf_string_varint_count32;

static int hf_string_varint_count64;

static int hf_string_varint_count8;

static int * const services_hf_flags[] = {

  &hf_services_network,

  &hf_services_getutxo,

  &hf_services_bloom,

  &hf_services_witness,

  &hf_services_xthin,

  &hf_services_compactfilters,

  &hf_services_networklimited,

  &hf_services_p2pv2,

  NULL

};

static int ett_bitcoin;

static int ett_bitcoin_msg;

static int ett_services;

static int ett_address;

static int ett_string;

static int ett_addr_list;

static int ett_inv_list;

static int ett_getdata_list;

static int ett_notfound_list;

static int ett_getblocks_list;

static int ett_getheaders_list;

static int ett_tx_in_list;

static int ett_tx_in_outp;

static int ett_tx_out_list;

static int ett_tx_witness_list;

static int ett_tx_witness_component_list;

static expert_field ei_bitcoin_command_unknown;

static expert_field ei_bitcoin_address_length;

static expert_field ei_bitcoin_script_len;

static bool bitcoin_desegment  = true;

static unsigned

get_bitcoin_pdu_length(packet_info *pinfo _U_, tvbuff_t *tvb,

                       int offset, void *data _U_)

{

  uint32_t length;

  length = BITCOIN_HEADER_LENGTH;

  /* add payload length */

  length += tvb_get_letohl(tvb, offset+16);

  return length;

}

static void

format_feefilter_value(char *buf, int64_t value) {

  snprintf(buf, ITEM_LABEL_LENGTH, "%.3f sat/B", ((double) value) / 1000);

}

/**

 * Create a sub-tree and fill it with a net_addr structure

 */

static proto_tree *

create_address_tree(tvbuff_t *tvb, proto_item *ti, uint32_t offset)

{

  proto_tree *tree;

  tree = proto_item_add_subtree(ti, ett_address);

  /* services */

  proto_tree_add_bitmask(tree, tvb, offset, hf_address_services,

                         ett_services, services_hf_flags, ENC_LITTLE_ENDIAN);

  offset += 8;

  /* IPv6 address */

  proto_tree_add_item(tree, hf_address_address, tvb, offset, 16, ENC_NA);

  offset += 16;

  /* port */

  proto_tree_add_item(tree, hf_address_port, tvb, offset, 2, ENC_BIG_ENDIAN);

  return tree;

}

/**

 * Extract a variable length integer from a tvbuff

 */

static void

get_varint(tvbuff_t *tvb, const int offset, int *length, uint64_t *ret)

{

  unsigned value;

  /* Note: just throw an exception if not enough  bytes are available in the tvbuff */

  /* calculate variable length */

  value = tvb_get_uint8(tvb, offset);

  if (value < 0xfd)

  {

    *length = 1;

    *ret = value;

    return;

  }

  if (value == 0xfd)

  {

    *length = 3;

    *ret = tvb_get_letohs(tvb, offset+1);

    return;

  }

  if (value == 0xfe)

  {

    *length = 5;

    *ret = tvb_get_letohl(tvb, offset+1);

    return;

  }

  *length = 9;

  *ret = tvb_get_letoh64(tvb, offset+1);

  return;

}

static void add_varint_item(proto_tree *tree, tvbuff_t *tvb, const int offset, int length,

                            int hfi8, int hfi16, int hfi32, int hfi64)

{

  switch (length)

  {

  case 1:

    proto_tree_add_item(tree, hfi8,  tvb, offset, 1, ENC_LITTLE_ENDIAN);

    break;

  case 3:

    proto_tree_add_item(tree, hfi16, tvb, offset+1, 2, ENC_LITTLE_ENDIAN);

    break;

  case 5:

    proto_tree_add_item(tree, hfi32, tvb, offset+1, 4, ENC_LITTLE_ENDIAN);

    break;

  case 9:

    proto_tree_add_item(tree, hfi64, tvb, offset+1, 8, ENC_LITTLE_ENDIAN);

    break;

  }

}

static proto_tree *

create_string_tree(proto_tree *tree, int hfindex, tvbuff_t *tvb, uint32_t* offset)

{

  proto_tree *subtree;

  proto_item *ti;

  int         varint_length;

  uint64_t    varint;

  int         string_length;

  /* First is the length of the following string as a varint  */

  get_varint(tvb, *offset, &varint_length, &varint);

  string_length = (int) varint;

  ti = proto_tree_add_item(tree, hfindex, tvb, *offset, varint_length + string_length, ENC_NA);

  subtree = proto_item_add_subtree(ti, ett_string);

  /* length */

  add_varint_item(subtree, tvb, *offset, varint_length, hf_string_varint_count8,

                  hf_string_varint_count16, hf_string_varint_count32,

                  hf_string_varint_count64);

  *offset += varint_length;

  /* string */

  proto_tree_add_item(subtree, hf_string_value, tvb, *offset, string_length,

                      ENC_ASCII);

  *offset += string_length;

  return subtree;

}

static proto_tree *

create_data_tree(proto_tree *tree, int hfindex, tvbuff_t *tvb, uint32_t* offset)

{

  proto_tree *subtree;

  proto_item *ti;

  int         varint_length;

  uint64_t    varint;

  int         data_length;

  /* First is the length of the following string as a varint  */

  get_varint(tvb, *offset, &varint_length, &varint);

  data_length = (int) varint;

  ti = proto_tree_add_item(tree, hfindex, tvb, *offset, varint_length + data_length, ENC_NA);

  subtree = proto_item_add_subtree(ti, ett_string);

  /* length */

  add_varint_item(subtree, tvb, *offset, varint_length, hf_data_varint_count8,

                  hf_data_varint_count16, hf_data_varint_count32,

                  hf_data_varint_count64);

  *offset += varint_length;

  /* data */

  proto_tree_add_item(subtree, hf_data_value, tvb, *offset, data_length,

                      BASE_SHOW_UTF_8_PRINTABLE);

  *offset += data_length;

  return subtree;

}

/* Note: A number of the following message handlers include code of the form:

 *          ...

 *          uint64_t    count;

 *          ...

 *          for (; count > 0; count--)

 *          {

 *            proto_tree_add_item9...);

 *            offset += ...;

 *            proto_tree_add_item9...);

 *            offset += ...;

 *            ...

 *          }

 *          ...

 *

 * Issue if 'count' is a very large number:

 *    If 'tree' is NULL, then the result will be effectively (but not really)

 *    an infinite loop. This is true because if 'tree' is NULL then

 *    proto_tree_add_item(tree, ...) is effectively a no-op and will not throw

 *    an exception.

 *    So: the loop should be executed only when 'tree' is defined so that the

 *        proto_ calls will throw an exception when the tvb is used up;

 *        This should only take a few-hundred loops at most.

 *           https://gitlab.com/wireshark/wireshark/-/issues/8312

 */

/**

 * Handler for version messages

 */

static int

dissect_bitcoin_msg_version(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  uint32_t    version;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_version, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  version = tvb_get_letohl(tvb, offset);

  proto_tree_add_item(tree, hf_msg_version_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  proto_tree_add_bitmask(tree, tvb, offset, hf_msg_version_services,

                         ett_services, services_hf_flags, ENC_LITTLE_ENDIAN);

  offset += 8;

  proto_tree_add_item(tree, hf_msg_version_timestamp, tvb, offset, 8, ENC_TIME_SECS_NSECS|ENC_LITTLE_ENDIAN);

  offset += 8;

  ti = proto_tree_add_item(tree, hf_msg_version_addr_you, tvb, offset, 26, ENC_NA);

  create_address_tree(tvb, ti, offset);

  offset += 26;

  if (version >= 106)

  {

    ti = proto_tree_add_item(tree, hf_msg_version_addr_me, tvb, offset, 26, ENC_NA);

    create_address_tree(tvb, ti, offset);

    offset += 26;

    proto_tree_add_item(tree, hf_msg_version_nonce, tvb, offset, 8, ENC_LITTLE_ENDIAN);

    offset += 8;

    create_string_tree(tree, hf_msg_version_user_agent, tvb, &offset);

  }

  if (version >= 209)

  {

    proto_tree_add_item(tree, hf_msg_version_start_height, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

  }

  if (version >= 70002)

  {

    proto_tree_add_item(tree, hf_msg_version_relay, tvb, offset, 1, ENC_LITTLE_ENDIAN);

    offset += 1;

  }

  return offset;

}

/**

 * Handler for address messages

 */

static int

dissect_bitcoin_msg_addr(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_addr, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_addr_count8, hf_msg_addr_count16,

                  hf_msg_addr_count32, hf_msg_addr_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree *subtree;

    ti = proto_tree_add_item(tree, hf_msg_addr_address, tvb, offset, 30, ENC_NA);

    subtree = create_address_tree(tvb, ti, offset+4);

    proto_tree_add_item(subtree, hf_msg_addr_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);

    offset += 26;

    offset += 4;

  }

  return offset;

}

/**

 * Handler for addrv2 messages

 */

static int

dissect_bitcoin_msg_addrv2(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  int         offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_addrv2, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_addrv2_count8, hf_msg_addrv2_count16,

                  hf_msg_addrv2_count32, hf_msg_addrv2_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_item *sti;

    proto_item *sti_services;

    proto_tree *subtree;

    uint64_t    services;

    uint8_t     network;

    uint64_t    address_length;

    sti = proto_tree_add_item(tree, hf_msg_addrv2_item, tvb, offset, -1, ENC_NA);

    subtree = proto_item_add_subtree(sti, ett_addr_list);

    proto_tree_add_item(subtree, hf_msg_addrv2_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);

    offset += 4;

    get_varint(tvb, offset, &length, &services);

    sti_services = proto_tree_add_bitmask_value(subtree, tvb, offset, hf_msg_addrv2_services,

                                                ett_services, services_hf_flags, services);

    proto_item_set_len(sti_services, length);

    offset += length;

    network = tvb_get_uint8(tvb, offset);

    proto_tree_add_item(subtree, hf_msg_addrv2_network, tvb, offset, 1, ENC_LITTLE_ENDIAN);

    offset += 1;

    get_varint(tvb, offset, &length, &address_length);

    offset += length;

    switch (network)

    {

      case 1:

        proto_tree_add_item(subtree, hf_msg_addrv2_address_ipv4, tvb, offset, (unsigned) address_length, ENC_BIG_ENDIAN);

        if (address_length != 4) {

          proto_tree_add_expert(subtree, pinfo, &ei_bitcoin_address_length,

                                tvb, offset, (unsigned) address_length);

        }

        break;

      case 2:

        proto_tree_add_item(subtree, hf_msg_addrv2_address_ipv6, tvb, offset, (unsigned) address_length, ENC_NA);

        if (address_length != 16) {

          proto_tree_add_expert(subtree, pinfo, &ei_bitcoin_address_length,

                                tvb, offset, (unsigned) address_length);

        }

        break;

      default:

        proto_tree_add_item(subtree, hf_msg_addrv2_address_other, tvb, offset, (unsigned) address_length, ENC_NA);

        break;

    }

    /*

     * The above should make sure that the addition won't overflow.

     * XXX - but what if address length fits in an unsigned int but

     * not a signed int?

     */

    offset += (int)address_length;

    proto_tree_add_item(subtree, hf_msg_addrv2_port, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    proto_item_set_end(sti, tvb, offset);

  }

  return offset;

}

/**

 * Handler for inventory messages

 */

static int

dissect_bitcoin_msg_inv(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_inv, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_inv_count8, hf_msg_inv_count16,

                  hf_msg_inv_count32, hf_msg_inv_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree *subtree;

    subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_inv_list, NULL, "Inventory vector");

    proto_tree_add_item(subtree, hf_msg_inv_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(subtree, hf_msg_inv_hash, tvb, offset, 32, ENC_NA);

    offset += 32;

  }

  return offset;

}

/**

 * Handler for getdata messages

 */

static int

dissect_bitcoin_msg_getdata(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_getdata, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_getdata_count8, hf_msg_getdata_count16,

                  hf_msg_getdata_count32, hf_msg_getdata_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree *subtree;

    subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_getdata_list, NULL, "Inventory vector");

    proto_tree_add_item(subtree, hf_msg_getdata_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(subtree, hf_msg_getdata_hash, tvb, offset, 32, ENC_NA);

    offset += 32;

  }

  return offset;

}

/**

 * Handler for notfound messages

 */

static int

dissect_bitcoin_msg_notfound(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_notfound, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_notfound_count8, hf_msg_notfound_count16,

                  hf_msg_notfound_count32, hf_msg_notfound_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree *subtree;

    subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_notfound_list, NULL, "Inventory vector");

    proto_tree_add_item(subtree, hf_msg_notfound_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(subtree, hf_msg_notfound_hash, tvb, offset, 32, ENC_NA);

    offset += 32;

  }

  return offset;

}

/**

 * Handler for getblocks messages

 */

static int

dissect_bitcoin_msg_getblocks(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_getblocks, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  /* why the protocol version is sent here nobody knows */

  proto_tree_add_item(tree, hf_msg_version_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_getblocks_count8, hf_msg_getblocks_count16,

                  hf_msg_getblocks_count32, hf_msg_getblocks_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree_add_item(tree, hf_msg_getblocks_start, tvb, offset, 32, ENC_NA);

    offset += 32;

  }

  proto_tree_add_item(tree, hf_msg_getblocks_stop, tvb, offset, 32, ENC_NA);

  offset += 32;

  return offset;

}

/**

 * Handler for getheaders messages

 * UNTESTED

 */

static int

dissect_bitcoin_msg_getheaders(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)

{

  proto_item *ti;

  int         length;

  uint64_t    count;

  uint32_t    offset = 0;

  ti   = proto_tree_add_item(tree, hf_bitcoin_msg_getheaders, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree(ti, ett_bitcoin_msg);

  proto_tree_add_item(tree, hf_msg_headers_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  get_varint(tvb, offset, &length, &count);

  add_varint_item(tree, tvb, offset, length, hf_msg_getheaders_count8, hf_msg_getheaders_count16,

                  hf_msg_getheaders_count32, hf_msg_getheaders_count64);

  offset += length;

  for (; count > 0; count--)

  {

    proto_tree_add_item(tree, hf_msg_getheaders_start, tvb, offset, 32, ENC_NA);

    offset += 32;

  }

  proto_tree_add_item(tree, hf_msg_getheaders_stop, tvb, offset, 32, ENC_NA);

  offset += 32;

  return offset;

}

/**

 * Handler for tx message body

 */

static uint32_t

dissect_bitcoin_msg_tx_common(tvbuff_t *tvb, uint32_t offset, packet_info *pinfo, proto_tree *tree, unsigned msgnum)

{

  proto_item *rti;

  int         count_length;

  uint64_t    in_count;

  uint64_t    out_count;

  if (msgnum == 0) {

    rti  = proto_tree_add_item(tree, hf_bitcoin_msg_tx, tvb, offset, -1, ENC_NA);

  } else {

    rti  = proto_tree_add_none_format(tree, hf_bitcoin_msg_tx, tvb, offset, -1, "Tx message [ %4d ]", msgnum);

  }

  tree = proto_item_add_subtree(rti, ett_bitcoin_msg);

  proto_tree_add_item(tree, hf_msg_tx_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  /* If present, "flag" always starts with 0x00. */

  /* Otherwise we proceed straight to "in_count". */

  uint8_t flag = tvb_get_uint8(tvb, offset);

  if (flag == 0) {

    proto_tree_add_item(tree, hf_msg_tx_flag, tvb, offset, 2, ENC_NA);

    offset += 2;

  }

  /* TxIn[] */

  get_varint(tvb, offset, &count_length, &in_count);

  add_varint_item(tree, tvb, offset, count_length, hf_msg_tx_in_count8, hf_msg_tx_in_count16,

                  hf_msg_tx_in_count32, hf_msg_tx_in_count64);

  offset += count_length;

  /* TxIn

   *   [36]  previous_output    outpoint

   *   [1+]  script length      var_int

   *   [ ?]  signature script   uchar[]

   *   [ 4]  sequence           uint32_t

   *

   * outpoint (aka previous output)

   *   [32]  hash               char[32

   *   [ 4]  index              uint32_t

   *

   */

  for (uint64_t idx = 0; idx < in_count; idx++)

  {

    proto_tree *subtree;

    proto_tree *prevtree;

    proto_item *ti;

    proto_item *pti;

    uint64_t    script_length;

    uint32_t    scr_len_offset;

    scr_len_offset = offset+36;

    get_varint(tvb, scr_len_offset, &count_length, &script_length);

    /* A funny script_length won't cause an exception since the field type is FT_NONE */

    ti = proto_tree_add_item(tree, hf_msg_tx_in, tvb, offset,

        36 + count_length + (unsigned)script_length + 4, ENC_NA);

    subtree = proto_item_add_subtree(ti, ett_tx_in_list);

    /* previous output */

    pti = proto_tree_add_item(subtree, hf_msg_tx_in_prev_output, tvb, offset, 36, ENC_NA);

    prevtree = proto_item_add_subtree(pti, ett_tx_in_outp);

    proto_tree_add_item(prevtree, hf_msg_tx_in_prev_outp_hash, tvb, offset, 32, ENC_NA);

    offset += 32;

    proto_tree_add_item(prevtree, hf_msg_tx_in_prev_outp_index, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    /* end previous output */

    add_varint_item(subtree, tvb, offset, count_length, hf_msg_tx_in_script8, hf_msg_tx_in_script16,

                    hf_msg_tx_in_script32, hf_msg_tx_in_script64);

    offset += count_length;

    if ((offset + script_length) > INT_MAX) {

      proto_tree_add_expert(tree, pinfo, &ei_bitcoin_script_len,

          tvb, scr_len_offset, count_length);

      return INT_MAX;

    }

    proto_tree_add_item(subtree, hf_msg_tx_in_sig_script, tvb, offset, (unsigned)script_length, ENC_NA);

    offset += (unsigned)script_length;

    proto_tree_add_item(subtree, hf_msg_tx_in_seq, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

  }

  /* TxOut[] */

  get_varint(tvb, offset, &count_length, &out_count);

  add_varint_item(tree, tvb, offset, count_length, hf_msg_tx_out_count8, hf_msg_tx_out_count16,

                  hf_msg_tx_out_count32, hf_msg_tx_out_count64);

  offset += count_length;

  /*  TxOut

   *    [ 8] value

   *    [1+] script length [var_int]

   *    [ ?] script

   */

  for (; out_count > 0; out_count--)