/* packet-thrift.c

 * Routines for thrift protocol dissection.

 * Based on work by John Song <jsong@facebook.com> and

 * Bill Fumerola <bill@facebook.com>

 *

 * https://github.com/andrewcox/wireshark-with-thrift-plugin/blob/wireshark-1.8.6-with-thrift-plugin/plugins/thrift/packet-thrift.cpp

 *

 * Copyright 2015, Anders Broman <anders.broman[at]ericsson.com>

 * Copyright 2021, Richard van der Hoff <richard[at]matrix.org>

 * Copyright 2019-2024, Triton Circonflexe <triton[at]kumal.info>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/* Ref https://thrift.apache.org/developers

 *     https://thrift.apache.org/docs/idl.html

 *     https://diwakergupta.github.io/thrift-missing-guide/

 *     https://erikvanoosten.github.io/thrift-missing-specification/

 *     https://github.com/apache/thrift/blob/master/doc/specs/thrift-compact-protocol.md

 */

#include "config.h"

#include <stdint.h>

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/proto_data.h>

#include <wsutil/array.h>

#include "packet-tcp.h"

#include "packet-tls.h"

#include "packet-thrift.h"

/* Line   40: Constants and macros declarations. */

/* Line  200: Protocol data structure and early declarations. */

/* Line  340: Generic helper functions for various purposes. */

/* Line  900: Helper functions to use within custom sub-dissectors (with some mutualization function). */

/* Line 2100: Generic functions to dissect TBinaryProtocol message content. */

/* Line 2420: Generic functions to dissect TCompactProtocol message content. */

/* Line 2900: Generic functions to dissect Thrift message header. */

/* ==== Note about the use of THRIFT_REQUEST_REASSEMBLY and THRIFT_SUBDISSECTOR_ERROR. ==== */

/* From the sub-dissection code, only the return value gives an information about the type of error.

 * In this case, THRIFT_REQUEST_REASSEMBLY is used for reassembly and THRIFT_SUBDISSECTOR_ERROR for everything else.

 *

 * From the generic dissection code (dissect_thrift_binary_* and dissect_thrift_compact_*) the functions also update

 * the offset passed as a reference. In this case, THRIFT_REQUEST_REASSEMBLY is the only error code used in order to

 * simplify propagation and the reference offset indicates the type of issue:

 * - THRIFT_REQUEST_REASSEMBLY indicates reassembly is required.

 * - Any positive value indicates where the non-reassembly error happened

 *   and the Thrift dissector consumes all the data available until now.

 */

void proto_register_thrift(void);

void proto_reg_handoff_thrift(void);

#define THRIFT_BINARY_VERSION_VALUE_MASK   0x7fff

#define THRIFT_BINARY_VERSION_MASK     0xffff00f8

#define THRIFT_BINARY_MESSAGE_MASK     0x00000007

#define THRIFT_BINARY_VERSION_1        0x80010000

#define THRIFT_COMPACT_VERSION_VALUE_MASK   0x001f

#define THRIFT_COMPACT_VERSION_MASK         0xff1f

#define THRIFT_COMPACT_MESSAGE_MASK         0x00e0

#define THRIFT_COMPACT_VERSION_1            0x8201

#define THRIFT_COMPACT_MESSAGE_SHIFT             5

#define NOT_A_VALID_PDU (0)

#define ABORT_SUBDISSECTION_ON_ISSUE(offset) do { if (offset < 0) return offset; } while (0)

#define ABORT_ON_INCOMPLETE_PDU(len) do {\

    if (tvb_reported_length_remaining(tvb, *offset) < (len)) {\

        /* Do not indicate the incomplete data if we know the above dissector is able to reassemble. */\

        if (pinfo->can_desegment <= 0) \

            expert_add_info(pinfo, NULL, &ei_thrift_not_enough_data);\

        /* Do not consume more than available for the reassembly to work. */\

        thrift_opt->reassembly_offset = *offset;\

        thrift_opt->reassembly_length = len;\

        *offset = THRIFT_REQUEST_REASSEMBLY;\

        return THRIFT_REQUEST_REASSEMBLY;\

    } } while (0)

static dissector_handle_t thrift_handle;

static dissector_handle_t thrift_http_handle;

static bool framed_desegment = true;

static unsigned thrift_tls_port;

static bool show_internal_thrift_fields;

static bool try_generic_if_sub_dissector_fails;

static unsigned nested_type_depth = 25;

static dissector_table_t thrift_method_name_dissector_table;

/* TBinaryProtocol elements length. */

static const int TBP_THRIFT_TYPE_LEN = 1;

static const int TBP_THRIFT_FID_LEN = 2;

static const int TBP_THRIFT_BOOL_LEN = 1;

static const int TBP_THRIFT_I8_LEN = 1;

static const int TBP_THRIFT_DOUBLE_LEN = 8;

static const int TBP_THRIFT_I16_LEN = 2;

static const int TBP_THRIFT_I32_LEN = 4;

static const int TBP_THRIFT_I64_LEN = 8;

static const int TBP_THRIFT_UUID_LEN = 16;

static const int TBP_THRIFT_MTYPE_OFFSET = 3;

static const int TBP_THRIFT_MTYPE_LEN = 1;

static const unsigned TBP_THRIFT_VERSION_LEN = 4; /* (Version + method type) is explicitly passed as an int32 in libthrift */

static const int TBP_THRIFT_LENGTH_LEN = 4;

static const int TBP_THRIFT_SEQ_ID_LEN = 4;

static const int TBP_THRIFT_STRICT_HEADER_LEN = 8; /* (Protocol id + Version + Method type) + Name length = (4) + 4. */

                                    /* Old encoding: Name length [ + Name] + Message type      + Sequence Identifier   + T_STOP */

static const unsigned TBP_THRIFT_MIN_MESSAGE_LEN = 10; /* TBP_THRIFT_LENGTH_LEN + TBP_THRIFT_I8_LEN + TBP_THRIFT_SEQ_ID_LEN + TBP_THRIFT_TYPE_LEN; */

static const unsigned TBP_THRIFT_STRICT_MIN_MESSAGE_LEN = 13; /* TBP_THRIFT_STRICT_HEADER_LEN       + TBP_THRIFT_SEQ_ID_LEN + TBP_THRIFT_TYPE_LEN; */

static const int TBP_THRIFT_BINARY_LEN = 4; /* Length (even with empty content). */

static const int TBP_THRIFT_STRUCT_LEN = 1; /* Empty struct still contains T_STOP. */

static const int TBP_THRIFT_LINEAR_LEN = 5; /* Elements type + number of elements for list & set. */

/* TCompactProtocol elements length when different from TBinaryProtocol.

 * Are identical:

 * - Field Type (although Compact squeezes in the high nibble the field id delta or list/set length).

 * - T_BOOL (in linear containers, not structs)

 * - T_I8

 * - T_DOUBLE (endianness is inverted, though)

 */

static const int TCP_THRIFT_DELTA_NOT_SET;

static const int TCP_THRIFT_LENGTH_LARGER = 0xf;

static const int TCP_THRIFT_MAP_TYPES_LEN = 1;      /* High nibble = key type, low nibble = value type. */

static const int TCP_THRIFT_NIBBLE_SHIFT = 4;

static const int TCP_THRIFT_VERSION_LEN = 2;     /* Protocol id + (Method type + Version) */

static const int TCP_THRIFT_MIN_VARINT_LEN = 1;

/* Those cannot be define as static const int since they are used within a switch. */

/* Maximum length in bytes for 16, 32, and 64 bits integers encoded as varint. */

#define TCP_THRIFT_MAX_I16_LEN (3)

#define TCP_THRIFT_MAX_I32_LEN (5)

#define TCP_THRIFT_MAX_I64_LEN (10)

static const int TCP_THRIFT_STRUCT_LEN = 1; /* Empty struct still contains T_STOP. */

static const unsigned TCP_THRIFT_MIN_MESSAGE_LEN = 5; /* Protocol id + (Method type + Version) + Name length [+ Name] + Sequence Identifier + T_STOP */

static const uint32_t TCP_THRIFT_NIBBLE_MASK = 0xf;

static const int OCTETS_TO_BITS_SHIFT = 3;   /* 8 bits per octets = 3 shifts left. */

static const int DISABLE_SUBTREE = -1;

static int proto_thrift;

static int hf_thrift_frame_length;

static int hf_thrift_protocol_id;

static int hf_thrift_version;

static int hf_thrift_mtype;

static int hf_thrift_str_len;

static int hf_thrift_method;

static int hf_thrift_seq_id;

static int hf_thrift_type;

static int hf_thrift_key_type;

static int hf_thrift_value_type;

static int hf_thrift_compact_struct_type;

static int hf_thrift_fid;

static int hf_thrift_fid_delta;

static int hf_thrift_bool;

static int hf_thrift_i8;

static int hf_thrift_i16;

static int hf_thrift_i32;

static int hf_thrift_i64;

static int hf_thrift_u64;

static int hf_thrift_uuid;

static int hf_thrift_binary;

static int hf_thrift_string;

static int hf_thrift_struct;

static int hf_thrift_list;

static int hf_thrift_set;

static int hf_thrift_map;

static int hf_thrift_num_list_item;

static int hf_thrift_num_list_pos;

static int hf_thrift_num_set_item;

static int hf_thrift_num_set_pos;

static int hf_thrift_num_map_item;

static int hf_thrift_large_container;

static int hf_thrift_double;

static int hf_thrift_exception;

static int hf_thrift_exception_message;

static int hf_thrift_exception_type;

static int ett_thrift;

static int ett_thrift_header;

static int ett_thrift_params;

static int ett_thrift_field;

static int ett_thrift_struct;

static int ett_thrift_list;

static int ett_thrift_set;

static int ett_thrift_map;

static int ett_thrift_error; /* Error while reading the header. */

static int ett_thrift_exception; /* ME_THRIFT_T_EXCEPTION */

static expert_field ei_thrift_wrong_type;

static expert_field ei_thrift_wrong_field_id;

static expert_field ei_thrift_negative_length;

static expert_field ei_thrift_wrong_proto_version;

static expert_field ei_thrift_struct_fid_not_in_seq;

static expert_field ei_thrift_frame_too_short;

static expert_field ei_thrift_not_enough_data;

static expert_field ei_thrift_frame_too_long;

static expert_field ei_thrift_varint_too_large;

static expert_field ei_thrift_undefined_field_id;

static expert_field ei_thrift_negative_field_id;

static expert_field ei_thrift_unordered_field_id;

static expert_field ei_thrift_application_exception;

static expert_field ei_thrift_protocol_exception;

static expert_field ei_thrift_too_many_subtypes;

static const thrift_member_t thrift_exception[] = {

    { &hf_thrift_exception_message, 1, true, DE_THRIFT_T_BINARY, NULL, { .encoding = ENC_UTF_8 }, NULL },

    { &hf_thrift_exception_type, 2, false, DE_THRIFT_T_I32, TMFILL },

    { NULL, 0, false, DE_THRIFT_T_STOP, TMFILL }

};

typedef enum {

    DE_THRIFT_C_STOP = DE_THRIFT_T_STOP,

    DE_THRIFT_C_BOOL_TRUE,

    DE_THRIFT_C_BOOL_FALSE,

    DE_THRIFT_C_I8,

    DE_THRIFT_C_I16,

    DE_THRIFT_C_I32,

    DE_THRIFT_C_I64,

    DE_THRIFT_C_DOUBLE,

    DE_THRIFT_C_BINARY,

    DE_THRIFT_C_LIST,

    DE_THRIFT_C_SET,

    DE_THRIFT_C_MAP,

    DE_THRIFT_C_STRUCT,

    DE_THRIFT_C_UUID,

} thrift_compact_type_enum_t;

typedef struct _thrift_field_header_t {

    union {

        thrift_type_enum_t binary;

        thrift_compact_type_enum_t compact;

    } type;

    int type_offset;

    int64_t field_id;

    int fid_offset;

    int fid_length;

    proto_item *type_pi;

    proto_item *fid_pi;

    proto_tree *fh_tree;

} thrift_field_header_t;

static const value_string thrift_type_vals[] = {

    { DE_THRIFT_T_STOP, "T_STOP" },

    { DE_THRIFT_T_VOID, "T_VOID" },

    { DE_THRIFT_T_BOOL, "T_BOOL" },

    { DE_THRIFT_T_I8, "T_I8" },

    { DE_THRIFT_T_DOUBLE, "T_DOUBLE" },

    { DE_THRIFT_T_I16, "T_I16" },

    { DE_THRIFT_T_I32, "T_I32" },

    { DE_THRIFT_T_I64, "T_I64" },

    { DE_THRIFT_T_BINARY, "T_BINARY" },

    { DE_THRIFT_T_STRUCT, "T_STRUCT" },

    { DE_THRIFT_T_MAP, "T_MAP" },

    { DE_THRIFT_T_SET, "T_SET" },

    { DE_THRIFT_T_LIST, "T_LIST" },

    { DE_THRIFT_T_UUID, "T_UUID" },

    { 0, NULL }

};

/* type values used within structs in the compact protocol */

static const value_string thrift_compact_type_vals[] = {

    { DE_THRIFT_C_BOOL_TRUE, "BOOLEAN_TRUE" },

    { DE_THRIFT_C_BOOL_FALSE, "BOOLEAN_FALSE" },

    { DE_THRIFT_C_I8, "T_I8" },

    { DE_THRIFT_C_I16, "T_I16" },

    { DE_THRIFT_C_I32, "T_I32" },

    { DE_THRIFT_C_I64, "T_I64" },

    { DE_THRIFT_C_DOUBLE, "T_DOUBLE" },

    { DE_THRIFT_C_BINARY, "T_BINARY" },

    { DE_THRIFT_C_LIST, "T_LIST" },

    { DE_THRIFT_C_SET, "T_SET" },

    { DE_THRIFT_C_MAP, "T_MAP" },

    { DE_THRIFT_C_STRUCT, "T_STRUCT" },

    { DE_THRIFT_C_UUID, "T_UUID" },

    { 0, NULL }

};

static const value_string thrift_exception_type_vals[] = {

    {  0, "Unknown (type of peer)" },

    {  1, "Unknown Method" },

    {  2, "Invalid Message Type" },

    {  3, "Wrong Method Name" },

    {  4, "Bad Sequence Id" },

    {  5, "Missing Result" },

    {  6, "Internal Error" },

    {  7, "Protocol Error (something went wrong during decoding)" },

    {  8, "Invalid Transform" },

    {  9, "Invalid Protocol" },

    { 10, "Unsupported Client Type" },

    { 0, NULL }

};

static const value_string thrift_proto_vals[] = {

    { 0x80, "Strict Binary Protocol" },

    { 0x82, "Compact Protocol" },

    { 0, NULL }

};

static const value_string thrift_mtype_vals[] = {

    { ME_THRIFT_T_CALL,      "CALL" },

    { ME_THRIFT_T_REPLY,     "REPLY" },

    { ME_THRIFT_T_EXCEPTION, "EXCEPTION" },

    { ME_THRIFT_T_ONEWAY,    "ONEWAY" },

    { 0, NULL }

};

/* Options */

#define DECODE_BINARY_AS_AUTO_UTF8      0

#define DECODE_BINARY_AS_BINARY         1

#define DECODE_BINARY_AS_ASCII          2

#define DECODE_BINARY_AS_UTF8           3

#define DECODE_BINARY_AS_UTF16BE        4

#define DECODE_BINARY_AS_UTF16LE        5

#define DECODE_BINARY_AS_UTF32BE        6

#define DECODE_BINARY_AS_UTF32LE        7

static int32_t  binary_decode = DECODE_BINARY_AS_AUTO_UTF8;

static const enum_val_t binary_display_options[] = {

    { "auto", "UTF-8 if printable", DECODE_BINARY_AS_AUTO_UTF8 },

    { "hexadecimal", "Binary (hexadecimal string)", DECODE_BINARY_AS_BINARY },

    { "ascii", "ASCII String", DECODE_BINARY_AS_ASCII },

    { "utf8", "UTF-8 String", DECODE_BINARY_AS_UTF8 },

    { "utf16be", "UTF-16 Big Endian", DECODE_BINARY_AS_UTF16BE },

    { "utf16le", "UTF-16 Little Endian", DECODE_BINARY_AS_UTF16LE },

    { "utf32be", "UTF-32 Big Endian", DECODE_BINARY_AS_UTF32BE },

    { "utf32le", "UTF-32 Little Endian", DECODE_BINARY_AS_UTF32LE },

    { NULL, NULL, -1 }

};

static int dissect_thrift_binary_type(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int *offset, thrift_option_data_t *thrift_opt, proto_tree *header_tree, int type, proto_item *type_pi);

static int dissect_thrift_compact_type(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int *offset, thrift_option_data_t *thrift_opt, proto_tree *header_tree, int type, proto_item *type_pi);

static int dissect_thrift_t_struct_expert(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, thrift_option_data_t *thrift_opt, bool is_field, int field_id, int hf_id, int ett_id, const thrift_member_t *seq, expert_field* ei);

/*=====BEGIN GENERIC HELPERS=====*/

/* Check that the 4-byte value match a Thrift Strict TBinaryProtocol version

 * - 0x8001 The version itself

 * - 0x??   An undetermined byte (not used)

 * - 0x0m   The method type between 1 and 4.

 *          Values above 4 will be accepted if ignore_msg_type is true.

 */

static bool

is_thrift_strict_version(uint32_t header, bool ignore_msg_type)

{

    int msg_type;

    if ((header & THRIFT_BINARY_VERSION_MASK) == THRIFT_BINARY_VERSION_1) {

        if (ignore_msg_type) {

            return true;

        }

        msg_type = (header & THRIFT_BINARY_MESSAGE_MASK);

        if ((ME_THRIFT_T_CALL <= msg_type) && (msg_type <= ME_THRIFT_T_ONEWAY)) {

            return true;

        }

    }

    return false;

}

/* Check that the 2-byte value match a Thrift TCompactProtocol version

 * - 0x82 The protocol id.

 * - 0bmmmvvvvv The method on the 3 MSbits and version on the 5 LSbits.

 */

static bool

is_thrift_compact_version(uint16_t header, bool ignore_msg_type)

{

    int msg_type;

    if ((header & THRIFT_COMPACT_VERSION_MASK) == THRIFT_COMPACT_VERSION_1) {

        if (ignore_msg_type) {

            return true;

        }

        msg_type = (header & THRIFT_COMPACT_MESSAGE_MASK) >> THRIFT_COMPACT_MESSAGE_SHIFT;

        if ((ME_THRIFT_T_CALL <= msg_type) && (msg_type <= ME_THRIFT_T_ONEWAY)) {

            return true;

        }

    }

    return false;

}

/*

 * Check that the string at the designed position is valid UTF-8.

 * This allows us to fail early if the length of the string seems very long.

 * This /can/ indicate that this packet does not contain a Thrift PDU.

 *

 * This method does /NOT/ check if the data is available, the caller must check that if needed.

 * - Heuristic for method name must check for captured length.

 * - Check UTF-8 vs. binary before adding to tree must check for reported length.

 */

static unsigned

thrift_binary_utf8_isprint(tvbuff_t *tvb, unsigned offset, unsigned max_len, bool accept_crlf)

{

    unsigned check_len = tvb_reported_length_remaining(tvb, offset);

    unsigned pos, remaining = 0; /* position in tvb, remaining bytes for multi-byte characters. */

    uint8_t min_next = 0x80, max_next = 0xBF;

    bool ended = false;

    unsigned printable_len = 0; /* In case the string ends with several NUL bytes. */

    if (max_len < check_len) {

        check_len = max_len;

    }

    for (pos = offset; pos < offset + check_len; pos++) {

        uint8_t current = tvb_get_uint8(tvb, pos);

        if (ended) {

            if (current != 0) {

                return -1;

            }

        } else if (remaining == 0) {

            /* We are at the beginning of a character. */

            if (current == 0) {

                ended = true;

                continue; /* Avoid counting this NUL byte as printable. */

            } else if ((current & 0x80) == 0) {

                if (!g_ascii_isprint(current)) {

                    if (!accept_crlf) {

                        /* New line and chariot return or not valid in the method name */

                        return -1;

                    }

                    if (current != '\r' && current != '\n') {

                        /* But would have been acceptable for data content */

                        return -1;

                    }

                }

            } else if ((current & 0xE0) == 0xC0) {

                /* 2 bytes code 8 to 11 bits */

                if (current >= 0xC2) {

                    remaining = 1;

                    min_next = 0x80;

                } else {

                    /* Overlong encoding of ASCII for C0 and C1. */

                    return -1;

                }

            } else if ((current & 0xF0) == 0xE0) {

                /* 3 bytes code 12 to 16 bits */

                remaining = 2;

                if (current == 0xE0) {

                    min_next = 0xA0; /* 0b101x xxxx to code at least 12 bits. */

                } else {

                    if (current == 0xED) {

                        /* Reject reserved UTF-16 surrogates as specified for UTF-8. */

                        max_next = 0x9F;

                    }

                    min_next = 0x80;

                }

            } else if ((current & 0xF8) == 0xF0) {

                /* 4 bytes code 17 to 21 bits */

                remaining = 3;

                if (current == 0xF0) {

                    min_next = 0x90; /* 0b1001 xxxx to code at least 17 bits. */

                } else if (current > 0xF4) {

                    /* Invalid leading byte (above U+10FFFF). */

                    return -1;

                } else {

                    min_next = 0x80;

                }

            } else {

                /* Not the beginning of an UTF-8 character. */

                return -1;

            }

            ++printable_len;

        } else {

            if ((current < min_next) || (max_next < current)) {

                /* Not a canonical UTF-8 character continuation. */

                return -1;

            }

            min_next = 0x80;

            max_next = 0xBF;

            --remaining;

            ++printable_len;

        }

    }

    return printable_len;

}

/** Simple wrapper around tvb_get_varint to handle reassembly.

 *

 * @param[in] tvb        Pointer to the tvbuff_t holding the captured data.

 * @param[in] pinfo      Pointer to the packet_info holding information about the currently dissected packet.

 * @param[in] tree       Pointer to the proto_tree used to hold the display tree in Wireshark's interface.

 * @param[in] offset     Offset from the beginning of the tvbuff_t where the Thrift field is. Function will dissect type, id, & data.

 * @param[in] max_length The expected maximum encoding length of the integer.

 * @param[in] value      If parsing succeeds, parsed varint will be stored here.

 * @param[in] encoding   The ENC_* that defines the format (e.g., ENC_VARINT_PROTOBUF or ENC_VARINT_ZIGZAG).

 *

 * @return THRIFT_REQUEST_REASSEMBLY(-1) if reassembly is necessary,

 *                                    0  in case of error,

 *         a positive value indicating the length of the varint otherwise.

 */

static int

thrift_get_varint_enc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, int max_length, uint64_t *value, const unsigned encoding)

{

    unsigned length;

    int readable = tvb_reported_length_remaining(tvb, offset);

    if (readable <= 0) {

        return THRIFT_REQUEST_REASSEMBLY;

    }

    if (readable > max_length) {

        readable = max_length;

    }

    length = tvb_get_varint(tvb, offset, readable, value, encoding);

    if (length == 0) {

        if (readable < max_length) {

            /* There was not enough data to ensure the varint is complete for the expected size of integer. */

            return THRIFT_REQUEST_REASSEMBLY;

        } else {

            /* Either an error on the wire or a sub-optimal encoding, we always consider it as an error. */

            proto_tree_add_expert(tree, pinfo, &ei_thrift_varint_too_large, tvb, offset, max_length);

        }

    }

    return length;

}

static bool

is_thrift_compact_bool_type(thrift_compact_type_enum_t type)

{

    return type == DE_THRIFT_C_BOOL_TRUE || type == DE_THRIFT_C_BOOL_FALSE;

}

/* Function that reads the field header and return all associated data.

 *

 * @param[in] tvb:          Pointer to the tvbuff_t holding the captured data.

 * @param[in] pinfo:        Pointer to the packet_info holding information about the currently dissected packet.

 * @param[in] tree:         Pointer to the proto_tree used to hold the display tree in Wireshark's interface.

 *                          The caller may set it to NULL to prevent the creation of the field header sub-tree.

 *                          This possibility is used by sub-dissector when show_internal_thrift_fields is false,

 *                          and by dissect_thrift_common to differentiate between successful and exception T_REPLY.

 * @param[in] offset:       Offset from the beginning of the tvbuff_t where the Thrift field is. Function will dissect type, id, & data.

 * @param[in] thrift_opt:   Options from the Thrift dissector that will be necessary for sub-dissection (binary vs. compact, ...)

 * @param[in] gen_bool:     Generate item when one of the boolean types is encountered.

 *

 * @return                  See "GENERIC DISSECTION PARAMETERS DOCUMENTATION".

 */

static int

dissect_thrift_field_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int *offset, thrift_option_data_t *thrift_opt, thrift_field_header_t *header, bool gen_bool)

{

    /*

     *  Binary protocol field header (3 bytes):

     *      +--------+--------+--------+

     *      |0000tttt| field id        |

     *      +--------+--------+--------+

     *

     *  Compact protocol field header (1 byte, short form):

     *      +--------+

     *      |ddddtttt|

     *      +--------+

     *

     *  Compact protocol field header (2 to 4 bytes, long form):

     *      +--------+--------+...+--------+

     *      |0000tttt| field id            |

     *      +--------+--------+...+--------+

     *

     *  Binary & Compact protocol stop field (1 byte):

     *      +--------+

     *      |00000000|

     *      +--------+

     *

     *  Where:

     *      'dddd'      is the field id delta, a strictly positive unsigned 4 bits integer.

     *      'tttt'      is the type of the field value, an unsigned 4 bits strictly positive integer.

     *      field id    is the numerical value of the field in the structure.

     */

    DISSECTOR_ASSERT(header != NULL);

    ABORT_SUBDISSECTION_ON_ISSUE(*offset); /* In case of sub-dissection functions. */

    ABORT_ON_INCOMPLETE_PDU(TBP_THRIFT_TYPE_LEN); /* In all dissection cases. */

    uint8_t dfid_type = tvb_get_uint8(tvb, *offset);

    int32_t delta = TCP_THRIFT_DELTA_NOT_SET;

    int64_t fid = 0;

    memset(header, 0, sizeof(thrift_field_header_t));

    /* Read type (and delta for Compact) */

    header->type_offset = *offset;

    *offset += TBP_THRIFT_TYPE_LEN;

    if (dfid_type == DE_THRIFT_T_STOP) {

        header->type.binary = (thrift_type_enum_t)dfid_type;

        /* No need for sub-tree in this case. */

        header->type_pi = proto_tree_add_item(tree, hf_thrift_type, tvb, header->type_offset, TBP_THRIFT_TYPE_LEN, ENC_BIG_ENDIAN);

        return *offset;

    }

    /* Read the field id */

    if (thrift_opt->tprotocol & PROTO_THRIFT_COMPACT) {

        header->type.compact = (thrift_compact_type_enum_t)(dfid_type & TCP_THRIFT_NIBBLE_MASK);

        delta = (dfid_type >> TCP_THRIFT_NIBBLE_SHIFT) & TCP_THRIFT_NIBBLE_MASK;

        if (delta == TCP_THRIFT_DELTA_NOT_SET) {

            header->fid_offset = *offset;

            header->fid_length = thrift_get_varint_enc(tvb, pinfo, NULL, *offset, TCP_THRIFT_MAX_I16_LEN, (uint64_t*)&fid, ENC_VARINT_ZIGZAG);

            switch (header->fid_length) {

            case THRIFT_REQUEST_REASSEMBLY:

                /* Will always return after setting the expert parts. */

                ABORT_ON_INCOMPLETE_PDU(TCP_THRIFT_MAX_I16_LEN);

                return THRIFT_REQUEST_REASSEMBLY; // Just to avoid a false positive warning.

            case 0: /* In case of error, the offset stay at the error position. */

            default:

                header->field_id = fid;

                *offset += header->fid_length;

                break;

            }

        } else {

            /* The field id data in the tvb is represented by the delta with the type. */

            header->field_id = thrift_opt->previous_field_id + delta;

            header->fid_offset = header->type_offset;

            header->fid_length = TBP_THRIFT_TYPE_LEN;

        }

    } else {

        /* Fixed size field id for Binary protocol. */

        ABORT_ON_INCOMPLETE_PDU(TBP_THRIFT_FID_LEN);

        header->type.binary = (thrift_type_enum_t)dfid_type;

        header->field_id = tvb_get_ntohis(tvb, *offset);

        header->fid_offset = *offset;

        header->fid_length = TBP_THRIFT_FID_LEN;

        *offset += TBP_THRIFT_FID_LEN;

    }

    /* Create the field header sub-tree if requested only. */

    if (tree != NULL) {

        unsigned nested_count = p_get_proto_depth(pinfo, proto_thrift);

        if (nested_count >= thrift_opt->nested_type_depth) {

            expert_add_info(pinfo, proto_tree_get_parent(tree), &ei_thrift_too_many_subtypes);

            return THRIFT_REQUEST_REASSEMBLY;

        }

        header->fh_tree = proto_tree_add_subtree_format(tree, tvb, header->type_offset, *offset - header->type_offset, ett_thrift_field, NULL,

                "Field Header #%" PRId64, header->field_id);

        if (thrift_opt->tprotocol & PROTO_THRIFT_COMPACT) {

            header->type_pi = proto_tree_add_bits_item(header->fh_tree, hf_thrift_compact_struct_type, tvb, (header->type_offset << OCTETS_TO_BITS_SHIFT) + TCP_THRIFT_NIBBLE_SHIFT, TCP_THRIFT_NIBBLE_SHIFT, ENC_BIG_ENDIAN);

            header->fid_pi = proto_tree_add_bits_item(header->fh_tree, hf_thrift_fid_delta, tvb, header->type_offset << OCTETS_TO_BITS_SHIFT, TCP_THRIFT_NIBBLE_SHIFT, ENC_BIG_ENDIAN);

            if (delta == TCP_THRIFT_DELTA_NOT_SET) {

                proto_item_append_text(header->fid_pi, " (Not Set)");

            }

            if (gen_bool && is_thrift_compact_bool_type(header->type.compact)) {

                proto_item *bool_item = proto_tree_add_boolean(tree, hf_thrift_bool, tvb, header->type_offset, TBP_THRIFT_TYPE_LEN, 2 - header->type.compact);

                proto_item_set_generated(bool_item);

            }

        } else {

            header->type_pi = proto_tree_add_item(header->fh_tree, hf_thrift_type, tvb, header->type_offset, TBP_THRIFT_TYPE_LEN, ENC_BIG_ENDIAN);

        }

        if (delta == TCP_THRIFT_DELTA_NOT_SET) {

            if (header->fid_length > 0) {

                header->fid_pi = proto_tree_add_item(header->fh_tree, hf_thrift_fid, tvb, header->fid_offset, header->fid_length, ENC_BIG_ENDIAN);

            } else {

                /* Varint for field id was too long to decode, handle the error in the sub-tree. */

                proto_tree_add_expert(header->fh_tree, pinfo, &ei_thrift_varint_too_large, tvb, header->fid_offset, TCP_THRIFT_MAX_I16_LEN);

                return THRIFT_REQUEST_REASSEMBLY;

            }

        } else {

            if ((int64_t)INT16_MIN > header->field_id || header->field_id > (int64_t)INT16_MAX) {

                header->fid_pi = proto_tree_add_int64(header->fh_tree, hf_thrift_i64, tvb, header->fid_offset, header->fid_length, header->field_id);

                expert_add_info(pinfo, header->fid_pi, &ei_thrift_varint_too_large);

                /* We continue anyway as the field id was displayed successfully. */

            } else {

                header->fid_pi = proto_tree_add_int(header->fh_tree, hf_thrift_fid, tvb, header->fid_offset, header->fid_length, (int16_t)header->field_id);

            }

            proto_item_set_generated(header->fid_pi);

        }

        /* When reading a successful T_REPLY, we always have

         * - previous_field_id == 0 because we are at the beginning of a structure, and

         * - header->field_id == 0 because it is the return value

         * so we need to ignore this case. */

        if (header->field_id < thrift_opt->previous_field_id || (header->field_id == thrift_opt->previous_field_id && thrift_opt->previous_field_id != 0)) {

            if (thrift_opt->previous_field_id == 0) {

                // Maybe an old application from when negative values were authorized.

                expert_add_info(pinfo, header->fid_pi, &ei_thrift_negative_field_id);

            } else {

                // Although not mandated by Thrift protocol, applications should send fields in numerical order.

                expert_add_info(pinfo, header->fid_pi, &ei_thrift_unordered_field_id);

            }

        }

    } else {

        /* The fid_pi value (proto_item for field_id) is required for sub-dissectors.

         * Create it even in the absence of tree. */

        if (delta == TCP_THRIFT_DELTA_NOT_SET) {

            if (header->fid_length > 0) {

                header->fid_pi = proto_tree_add_item(header->fh_tree, hf_thrift_fid, tvb, header->fid_offset, header->fid_length, ENC_BIG_ENDIAN);

            } else {

                /* Varint for field id was too long to decode, handle the error without the sub-tree. */

                proto_tree_add_expert(tree, pinfo, &ei_thrift_varint_too_large, tvb, header->fid_offset, TCP_THRIFT_MAX_I16_LEN);

                return THRIFT_REQUEST_REASSEMBLY;

            }

        } else {

            if ((int64_t)INT16_MIN > header->field_id || header->field_id > (int64_t)INT16_MAX) {

                header->fid_pi = proto_tree_add_int64(header->fh_tree, hf_thrift_i64, tvb, header->fid_offset, header->fid_length, header->field_id);

                expert_add_info(pinfo, header->fid_pi, &ei_thrift_varint_too_large);

                /* We continue anyway as the field id was displayed successfully. */

            } else {

                header->fid_pi = proto_tree_add_int(header->fh_tree, hf_thrift_fid, tvb, header->fid_offset, header->fid_length, (int16_t)header->field_id);

            }

            proto_item_set_generated(header->fid_pi);

        }

    }

    return *offset;

}

/* Dissect a varint and add it to the display tree with the requested hf_id.

 * This function is used by both generic compact dissector and sub-dissector.

 *

 * @param[in] tvb:          Pointer to the tvbuff_t holding the captured data.

 * @param[in] pinfo:        Pointer to the packet_info holding information about the currently dissected packet.

 * @param[in] tree:         Pointer to the proto_tree used to hold the display tree in Wireshark's interface.

 * @param[in,out] offset:   Pointer to the offset from the beginning of the tvbuff_t where the Thrift field is. Function will dissect only the data.

 *                          The offset is modified according to table in "GENERIC DISSECTION PARAMETERS DOCUMENTATION" section.

 * @param[in] thrift_opt:   Options from the Thrift dissector that will be necessary for sub-dissection (binary vs. compact, ...)

 *

 * @param[in] max_length:   Expected maximum length of the data that encodes the integer.

 *                          This is only used to check if reassembly is necessary as with enough data and sub-optimal encoding,

 *                          this function will happily dissect the value anyway.

 * @param[in] hf_id:        The hf_id that needs to be used for the display.

 *                          If the found integer is larger that the expected integer size (driven by max_length parameter),

 *                          the integer will always be displayed as a generic T_I64 and an expert info will be added.

 * @param[in] raw_dissector Dissector for raw integer (we need to create a tvbuff_t with the flatten integer.

 *

 * @return                  See "GENERIC DISSECTION PARAMETERS DOCUMENTATION".

 */

static int

dissect_thrift_varint(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int *offset, thrift_option_data_t *thrift_opt, int max_length, int hf_id, dissector_t raw_dissector)

{

    int64_t varint;

    proto_item *pi;

    int length = thrift_get_varint_enc(tvb, pinfo, tree, *offset, max_length, (uint64_t*)&varint, ENC_VARINT_ZIGZAG);

    switch (length) {

    case THRIFT_REQUEST_REASSEMBLY:

        /* Will always return after setting the expert parts. */

        ABORT_ON_INCOMPLETE_PDU(max_length);

        return THRIFT_REQUEST_REASSEMBLY; // Just to avoid a false positive warning.

    case 0:

        /* In case of error, the offset stay at the error position. */

        return THRIFT_REQUEST_REASSEMBLY;

    default:

        switch (max_length) {

        case TCP_THRIFT_MAX_I16_LEN:

            if ((int64_t)INT16_MIN > varint || varint > (int64_t)INT16_MAX) {

                pi = proto_tree_add_int64(tree, hf_thrift_i64, tvb, *offset, length, varint);

                expert_add_info(pinfo, pi, &ei_thrift_varint_too_large);

                /* We continue anyway as the varint was indeed decoded. */

            } else {

                if (raw_dissector != NULL) {

                    uint8_t *data = wmem_alloc(pinfo->pool, TBP_THRIFT_I16_LEN);

                    data[0] = (varint >> 8) & 0xFF;

                    data[1] =  varint       & 0xFF;

                    tvbuff_t* sub_tvb = tvb_new_child_real_data(tvb, data, TBP_THRIFT_I16_LEN, TBP_THRIFT_I16_LEN);

                    thrift_opt->use_std_dissector = false;

                    raw_dissector(sub_tvb, pinfo, tree, thrift_opt);

                }

                if (thrift_opt->use_std_dissector) {

                    proto_tree_add_int(tree, hf_id, tvb, *offset, length, (int16_t)varint);

                }

            }

            break;

        case TCP_THRIFT_MAX_I32_LEN:

            if ((int64_t)INT32_MIN > varint || varint > (int64_t)INT32_MAX) {

                pi = proto_tree_add_int64(tree, hf_thrift_i64, tvb, *offset, length, varint);

                expert_add_info(pinfo, pi, &ei_thrift_varint_too_large);

                /* We continue anyway as the varint was indeed decoded. */

            } else {

                if (raw_dissector != NULL) {

                    uint8_t *data = wmem_alloc(pinfo->pool, TBP_THRIFT_I32_LEN);

                    data[0] = (varint >> 24) & 0xFF;

                    data[1] = (varint >> 16) & 0xFF;

                    data[2] = (varint >>  8) & 0xFF;

                    data[3] =  varint        & 0xFF;

                    tvbuff_t* sub_tvb = tvb_new_child_real_data(tvb, data, TBP_THRIFT_I32_LEN, TBP_THRIFT_I32_LEN);

                    thrift_opt->use_std_dissector = false;

                    raw_dissector(sub_tvb, pinfo, tree, thrift_opt);

                }

                if (thrift_opt->use_std_dissector) {

                    proto_tree_add_int(tree, hf_id, tvb, *offset, length, (int32_t)varint);

                }

            }

            break;

        case TCP_THRIFT_MAX_I64_LEN:

        default:

            if (raw_dissector != NULL) {

                uint8_t *data = wmem_alloc(pinfo->pool, TBP_THRIFT_I64_LEN);

                data[0] = (varint >> 56) & 0xFF;

                data[1] = (varint >> 48) & 0xFF;

                data[2] = (varint >> 40) & 0xFF;

                data[3] = (varint >> 32) & 0xFF;

                data[4] = (varint >> 24) & 0xFF;

                data[5] = (varint >> 16) & 0xFF;

                data[6] = (varint >>  8) & 0xFF;

                data[7] =  varint        & 0xFF;

                tvbuff_t* sub_tvb = tvb_new_child_real_data(tvb, data, TBP_THRIFT_I64_LEN, TBP_THRIFT_I64_LEN);

                thrift_opt->use_std_dissector = false;

                raw_dissector(sub_tvb, pinfo, tree, thrift_opt);

            }

            if (thrift_opt->use_std_dissector) {

                proto_tree_add_int64(tree, hf_id, tvb, *offset, length, varint);

            }

            break;

        }

        *offset += length;

        break;

    }

    return *offset;

}

/* Common function used by both Binary and Compact generic dissectors to dissect T_BINARY fields

 * as requested in the dissector preferences.

 * This function only dissects the data, not the field header nor the length.

 */

static int

dissect_thrift_string_as_preferred(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int *offset, thrift_option_data_t *thrift_opt, unsigned str_len)

{

    ABORT_ON_INCOMPLETE_PDU((int)str_len); /* Thrift assumes there will never be binary/string >= 2GiB */

    if (tree) {

        switch (binary_decode) {

            case DECODE_BINARY_AS_UTF32LE:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UCS_4 | ENC_LITTLE_ENDIAN);

                break;

            case DECODE_BINARY_AS_UTF32BE:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UCS_4 | ENC_BIG_ENDIAN);

                break;

            case DECODE_BINARY_AS_UTF16LE:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UTF_16 | ENC_LITTLE_ENDIAN);

                break;

            case DECODE_BINARY_AS_UTF16BE:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UTF_16 | ENC_BIG_ENDIAN);

                break;

            case DECODE_BINARY_AS_UTF8:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UTF_8);

                break;

            case DECODE_BINARY_AS_ASCII:

                proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_ASCII);

                break;

            case DECODE_BINARY_AS_AUTO_UTF8:

                /* When there is no data at all, consider it a string

                 * but a buffer containing only NUL bytes is a binary.

                 * If not entirely captured, consider it as a binary. */

                if (tvb_captured_length_remaining(tvb, *offset) >= str_len &&

                    (str_len == 0 || thrift_binary_utf8_isprint(tvb, *offset, str_len, true) > 0)) {

                    proto_tree_add_item(tree, hf_thrift_string, tvb, *offset, str_len, ENC_UTF_8);

                    break;

                }

                /* otherwise, continue with type BINARY */

                /* FALL THROUGH */

            case DECODE_BINARY_AS_BINARY:

            default:

                proto_tree_add_item(tree, hf_thrift_binary, tvb, *offset, str_len, ENC_NA);

                break;

        }

    }

    *offset += str_len;

    return *offset;

}

// Converts the type value in TCompactProtocol to the equivalent standard

// value from TBinaryProtocol.

static thrift_type_enum_t

compact_struct_type_to_generic_type(thrift_compact_type_enum_t compact)

{

    switch (compact) {

    case DE_THRIFT_C_STOP:

        return DE_THRIFT_T_STOP;

    case DE_THRIFT_C_BOOL_TRUE:

    case DE_THRIFT_C_BOOL_FALSE:

        return DE_THRIFT_T_BOOL;

    case DE_THRIFT_C_I8:

        return DE_THRIFT_T_I8;

    case DE_THRIFT_C_I16:

        return DE_THRIFT_T_I16;

    case DE_THRIFT_C_I32:

        return DE_THRIFT_T_I32;

    case DE_THRIFT_C_I64:

        return DE_THRIFT_T_I64;

    case DE_THRIFT_C_DOUBLE:

        return DE_THRIFT_T_DOUBLE;

    case DE_THRIFT_C_BINARY:

        return DE_THRIFT_T_BINARY;

    case DE_THRIFT_C_LIST:

        return DE_THRIFT_T_LIST;

    case DE_THRIFT_C_SET:

        return DE_THRIFT_T_SET;

    case DE_THRIFT_C_MAP:

        return DE_THRIFT_T_MAP;

    case DE_THRIFT_C_STRUCT:

        return DE_THRIFT_T_STRUCT;

    case DE_THRIFT_C_UUID:

        return DE_THRIFT_T_UUID;

    default:

        return DE_THRIFT_T_VOID;

    }

}

/*=====END GENERIC HELPERS=====*/

/*=====BEGIN SUB-DISSECTION=====*/

/*

 * Helper functions to use within custom sub-dissectors.

 *

 * Behavior:

 * 1. If is_field is true, dissect the field header (field type + field id).

 * 1.a. Check the type in the PDU against the expected one according to the call.

 * 2. If requested, add the type and field id to the tree (internal thrift fields).

 * 3. Dissect the value of the field.

 *

 * Return the offset marking the end of the dissected value or a negative error code.

 * See packet-thrift.h for details.

 */

/*

 * See packet-thrift.h for parameters documentation of dissect_thrift_t_<type> functions.

 */

int

dissect_thrift_t_stop(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)

{

    ABORT_SUBDISSECTION_ON_ISSUE(offset);

    if (tvb_reported_length_remaining(tvb, offset) < TBP_THRIFT_TYPE_LEN) {

        return THRIFT_REQUEST_REASSEMBLY;

    }

    if (tvb_get_uint8(tvb, offset) != DE_THRIFT_T_STOP) {

        proto_tree_add_expert(tree, pinfo, &ei_thrift_wrong_type, tvb, offset, TBP_THRIFT_TYPE_LEN);

        return THRIFT_SUBDISSECTOR_ERROR;

    }

    if (show_internal_thrift_fields) {

        proto_tree_add_item(tree, hf_thrift_type, tvb, offset, TBP_THRIFT_TYPE_LEN, ENC_BIG_ENDIAN);

    }

    offset += TBP_THRIFT_TYPE_LEN;

    return offset;

}

/* Common function used by all sub-dissection functions to handle the field header dissection as well as the display.

 *

 * @param[in] tvb:          Pointer to the tvbuff_t holding the captured data.

 * @param[in] pinfo:        Pointer to the packet_info holding information about the currently dissected packet.

 * @param[in] tree:         Pointer to the proto_tree used to hold the display tree in Wireshark's interface.

 * @param[in] offset:       Offset from the beginning of the tvbuff_t where the Thrift field is. Function will dissect type, id, & data.

 * @param[in] thrift_opt:   Options from the Thrift dissector that will be necessary for sub-dissection (binary vs. compact, ...)

 *

 * @param[in] expected:     The type expected by the caller sub-dissector.

 *                          Note: the generic type is used even in case of compact dissection.

 *

 * @param[in] field_id:     Thrift field identifier, to check that the right field is being dissected (in case of optional fields).

 *

 * @param[out] header_tree: Optional pointer to a proto_tree pointer.

 *                          If not NULL, the field header sub-tree will be set in this variable.

 *                          Used by binary/string sub-dissector to put the length in this field header as well.

 *

 * @return                  Offset of the first non-dissected byte in case of success,

 *                          THRIFT_REQUEST_REASSEMBLY (-1) in case reassembly is required, or

 *                          THRIFT_SUBDISSECTOR_ERROR (-2) in case of error.

 */

static int

dissect_thrift_t_field_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, thrift_option_data_t *thrift_opt, thrift_type_enum_t expected, int field_id, proto_tree **header_tree)

{

    thrift_field_header_t field_header;

    proto_tree *internal_tree = NULL;

    thrift_type_enum_t generic_type;

    /* Get the current state of dissection. */

    DISSECTOR_ASSERT(thrift_opt);

    DISSECTOR_ASSERT(thrift_opt->canary == THRIFT_OPTION_DATA_CANARY);

    if (show_internal_thrift_fields) {

        internal_tree = tree;

    }

    /* Read the entire field header using the dedicated function. */

    if (dissect_thrift_field_header(tvb, pinfo, internal_tree, &offset, thrift_opt, &field_header, false) == THRIFT_REQUEST_REASSEMBLY) {

        if (offset == THRIFT_REQUEST_REASSEMBLY) {

            return THRIFT_REQUEST_REASSEMBLY;

        } else {

            return THRIFT_SUBDISSECTOR_ERROR;

        }

    }

    /* Check the type first. */

    if (thrift_opt->tprotocol & PROTO_THRIFT_COMPACT) {

        generic_type = compact_struct_type_to_generic_type(field_header.type.compact);

    } else {

        generic_type = field_header.type.binary;

    }

    if (generic_type != expected) {

        proto_tree_add_expert_format(tree, pinfo, &ei_thrift_wrong_type, tvb, offset, TBP_THRIFT_TYPE_LEN,

                "Sub-dissector expects type = %s, found %s.",

                val_to_str(pinfo->pool, expected, thrift_type_vals, "%02x"),

                val_to_str(pinfo->pool, generic_type, thrift_type_vals, "%02x"));

        return THRIFT_SUBDISSECTOR_ERROR;

    }

    /* Once we know it's the expected type (which is /not/ T_STOP), we can read the field id. */

    if (field_header.field_id != (int64_t)field_id) {

        expert_add_info_format(pinfo, field_header.fid_pi, &ei_thrift_wrong_field_id,

                "Sub-dissector expects field id = %d, found %" PRId64 " instead.", field_id, field_header.field_id);

    }

    /* Expose the field header sub-tree if requested. */

    if (header_tree != NULL) {

        *header_tree = field_header.fh_tree;

    }

    return offset;

}

static int

dissect_thrift_raw_bool(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, thrift_option_data_t *thrift_opt, bool is_field, int field_id, int hf_id, dissector_t raw_dissector)

{

    int dt_offset = offset;

    bool bool_val = false;

    /* Get the current state of dissection. */

    DISSECTOR_ASSERT(thrift_opt);

    DISSECTOR_ASSERT(thrift_opt->canary == THRIFT_OPTION_DATA_CANARY);

    ABORT_SUBDISSECTION_ON_ISSUE(offset);

    thrift_opt->use_std_dissector = true;

    if (is_field) {

        /* In case of Compact protocol struct field (or command parameter / return value),

         * the boolean type also indicates the boolean value. */

        if (thrift_opt->tprotocol & PROTO_THRIFT_COMPACT) {

            /* Read value in type nibble. */

            if (tvb_reported_length_remaining(tvb, offset) < TBP_THRIFT_TYPE_LEN) {

                return THRIFT_REQUEST_REASSEMBLY;

            }

            if (((tvb_get_uint8(tvb, offset) >> TCP_THRIFT_NIBBLE_SHIFT) & TCP_THRIFT_NIBBLE_MASK) == DE_THRIFT_C_BOOL_TRUE) {

                bool_val = true;

            }

            /* If we have neither DE_THRIFT_C_BOOL_TRUE nor DE_THRIFT_C_BOOL_FALSE as the type,

             * dissect_thrift_t_field_header will catch the issue anyway. */

        }

        offset = dissect_thrift_t_field_header(tvb, pinfo, tree, offset, thrift_opt, DE_THRIFT_T_BOOL, field_id, NULL);

        ABORT_SUBDISSECTION_ON_ISSUE(offset);

        if (thrift_opt->tprotocol & PROTO_THRIFT_COMPACT) {

            /* It is the responsibility of the sub-dissector to only use the least significant bit. */

            if (raw_dissector != NULL) {

                tvbuff_t* sub_tvb = tvb_new_subset_length(tvb, offset, TBP_THRIFT_BOOL_LEN);

                thrift_opt->use_std_dissector = false;

                raw_dissector(sub_tvb, pinfo, tree, thrift_opt);

            }

            if (thrift_opt->use_std_dissector) {

                /* The value must be in the top-level tree, /after/ the field header tree. */