path: root/epan/dissectors/packet-rdpudp.c

/* packet-rdpudp.c
 * Routines for UDP RDP packet dissection
 * Copyright 2021, David Fort
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

#include "config.h"

#include <epan/packet.h>
#include <epan/prefs.h>
#include <epan/expert.h>
#include <epan/conversation.h>
#include <epan/proto_data.h>

#include "packet-rdp.h"
#include "packet-rdpudp.h"

#define PNAME  "UDP Remote Desktop Protocol"
#define PSNAME "RDPUDP"
#define PFNAME "rdpudp"

void proto_register_rdpudp(void);
void proto_reg_handoff_rdpudp(void);

static dissector_handle_t rdpudp_handle;
int proto_rdpudp;

static int ett_rdpudp;
static int ett_rdpudp_flags;
static int ett_rdpudp_synex;
static int ett_rdpudp_ack;
static int ett_rdpudp_fec;
static int ett_rdpudp_data;
static int ett_rdpudp2_packetType;
static int ett_rdpudp2_flags;
static int ett_rdpudp2_ack;
static int ett_rdpudp2_overhead;
static int ett_rdpudp2_delayack;
static int ett_rdpudp2_aoa;
static int ett_rdpudp2_data;
static int ett_rdpudp2_ackvec;
static int ett_rdpudp2_ackvec_vecs;
static int ett_rdpudp2_ackvec_vec;


static int hf_rdpudp_snSourceAck;
static int hf_rdpudp_ReceiveWindowSize;
static int hf_rdpudp_flags;
static int hf_rdpudp_flag_syn;
static int hf_rdpudp_flag_fin;
static int hf_rdpudp_flag_ack;
static int hf_rdpudp_flag_data;
static int hf_rdpudp_flag_fec;
static int hf_rdpudp_flag_cn;
static int hf_rdpudp_flag_cwr;
static int hf_rdpudp_flag_aoa;
static int hf_rdpudp_flag_synlossy;
static int hf_rdpudp_flag_ackdelayed;
static int hf_rdpudp_flag_correlationId;
static int hf_rdpudp_flag_synex;
static int hf_rdpudp_snInitialSequenceNumber;
static int hf_rdpudp_upstreamMtu;
static int hf_rdpudp_downstreamMtu;
static int hf_rdpudp_correlationId;
static int hf_rdpudp_synex_flags;
static int hf_rdpudp_synex_flag_version;
static int hf_rdpudp_synex_version;
static int hf_rdpudp_synex_cookiehash;
static int hf_rdpudp_ack_vectorsize;
static int hf_rdpudp_ack_item;
static int hf_rdpudp_ack_item_state;
static int hf_rdpudp_ack_item_rle;
static int hf_rdpudp_fec_coded;
static int hf_rdpudp_fec_sourcestart;
static int hf_rdpudp_fec_range;
static int hf_rdpudp_fec_fecindex;
static int hf_rdpudp_resetseqenum;
static int hf_rdpudp_source_sncoded;
static int hf_rdpudp_source_snSourceStart;
static int hf_rdpudp_data;

static int * const rdpudp_flags[] = {
		&hf_rdpudp_flag_syn,
		&hf_rdpudp_flag_fin,
		&hf_rdpudp_flag_ack,
		&hf_rdpudp_flag_data,
		&hf_rdpudp_flag_fec,
		&hf_rdpudp_flag_cn,
		&hf_rdpudp_flag_cwr,
		&hf_rdpudp_flag_aoa,
		&hf_rdpudp_flag_synlossy,
		&hf_rdpudp_flag_ackdelayed,
		&hf_rdpudp_flag_correlationId,
		&hf_rdpudp_flag_synex,
		NULL
};

static int hf_rdpudp2_PacketPrefixByte;
static int hf_rdpudp2_packetType;
static int hf_rdpudp2_shortPacketLength;
static int hf_rdpudp2_flags;
static int hf_rdpudp2_flag_ack;
static int hf_rdpudp2_flag_data;
static int hf_rdpudp2_flag_ackvec;
static int hf_rdpudp2_flag_aoa;
static int hf_rdpudp2_flag_overhead;
static int hf_rdpudp2_flag_delayackinfo;
static int hf_rdpudp2_logWindow;
static int hf_rdpudp2_AckSeq;
static int hf_rdpudp2_AckTs;
static int hf_rdpudp2_AckSendTimeGap;
static int hf_rdpudp2_ndelayedAcks;
static int hf_rdpudp2_delayedTimeScale;
static int hf_rdpudp2_delayedAcks;
static int hf_rdpudp2_delayedAck;
static int hf_rdpudp2_OverHeadSize;
static int hf_rdpudp2_DelayAckMax;
static int hf_rdpudp2_DelayAckTimeout;
static int hf_rdpudp2_AckOfAcksSeqNum;
static int hf_rdpudp2_DataSeqNumber;
static int hf_rdpudp2_DataFullSeqNumber;
static int hf_rdpudp2_DataChannelSeqNumber;
static int hf_rdpudp2_DataChannelFullSeqNumber;
static int hf_rdpudp2_Data;
static int hf_rdpudp2_AckvecBaseSeq;
static int hf_rdpudp2_AckvecCodecAckVecSize;
static int hf_rdpudp2_AckvecHaveTs;
static int hf_rdpudp2_AckvecTimeStamp;
static int hf_rdpudp2_SendAckTimeGapInMs;
static int hf_rdpudp2_AckvecCodedAck;
static int hf_rdpudp2_AckvecCodedAckMode;
static int hf_rdpudp2_AckvecCodedAckRleState;
static int hf_rdpudp2_AckvecCodedAckRleLen;

static int * const rdpudp2_flags[] = {
	&hf_rdpudp2_flag_ack,
	&hf_rdpudp2_flag_data,
	&hf_rdpudp2_flag_ackvec,
	&hf_rdpudp2_flag_aoa,
	&hf_rdpudp2_flag_overhead,
	&hf_rdpudp2_flag_delayackinfo,
	&hf_rdpudp2_logWindow,
	NULL
};

static dissector_handle_t tls_handle;
static dissector_handle_t dtls_handle;

enum {
	RDPUDP_FULL_DATA_SEQ_KEY = 1,
	RDPUDP_FULL_CHANNEL_SEQ_KEY = 2
};

enum {
	RDPUDP_SYN = 0x0001,
	RDPUDP_FIN = 0x0002,
	RDPUDP_ACK = 0x0004,
	RDPUDP_DATA = 0x0008,
	RDPUDP_FEC = 0x0010,
	RDPUDP_CN = 0x0020,
	RDPUDP_CWR = 0x0040,
	RDPUDP_AOA = 0x0100,
	RDPUDP_SYNLOSSY = 0x0200,
	RDPUDP_ACKDELAYED = 0x0400,
	RDPUDP_CORRELATIONID = 0x0800,
	RDPUDP_SYNEX = 0x1000
};

#define RDPUDP_VERSION_INFO_VALID 0x0001

enum {
	RDPUDP2_ACK = 0x0001,
	RDPUDP2_DATA = 0x0004,
	RDPUDP2_ACKVEC = 0x0008,
	RDPUDP2_AOA = 0x0010,
	RDPUDP2_OVERHEAD = 0x0040,
	RDPUDP2_DELAYACK = 0x00100
};

static const value_string rdpudp_version_vals[] = {
	{ 0x0001, "UDPv1-1" },
	{ 0x0002, "UDPv1-2" },
	{ 0x0101, "UDPv2" },
	{ 0x0, NULL}
};

static const value_string rdpudp_ack_states_vals[] = {
	{ 0, "Received" },
	{ 1, "Reserved 1" },
	{ 2, "Reserved 2" },
	{ 3, "Pending" },
	{ 0x0, NULL }
};

static const value_string rdpudp2_packetType_vals[] = {
	{ 0, "Data" },
	{ 8, "Dummy"},
	{ 0x0, NULL }
};

static const value_string rdpudp2_ackvec_mode_vals[] = {
	{ 0x00, "Bitmap"},
	{ 0x01, "Run length"},
	{ 0x00, NULL }
};

static const value_string rdpudp2_ackvec_rlestates_vals[] = {
	{ 0x00, "lost" },
	{ 0x01, "received" },
	{ 0x0, NULL }
};

static bool
rdpudp_chunk_free_cb(const void *key _U_, void *value, void *userdata _U_)
{
	tvbuff_t *tvb = (tvbuff_t*)value;

	tvb_free(tvb);
	return false;
}

static bool
rdpudp_info_free_cb(wmem_allocator_t *allocator _U_, wmem_cb_event_t event _U_,
		void *user_data)
{
	rdpudp_conv_info_t *rdpudp_info = (rdpudp_conv_info_t*)user_data;

	wmem_tree_foreach(rdpudp_info->client_chunks, rdpudp_chunk_free_cb, NULL);
	wmem_tree_foreach(rdpudp_info->server_chunks, rdpudp_chunk_free_cb, NULL);

	return false;
}

gboolean
rdp_isServerAddressTarget(packet_info *pinfo)
{
	conversation_t *conv;
	rdp_conv_info_t *rdp_info;
	rdpudp_conv_info_t *rdpudp_info;

	conv = find_conversation_pinfo(pinfo, 0);
	if (!conv)
		return FALSE;

	rdp_info = (rdp_conv_info_t *)conversation_get_proto_data(conv, proto_rdp);
	if (rdp_info) {
		rdp_server_address_t *server = &rdp_info->serverAddr;
		return addresses_equal(&server->addr, &pinfo->dst) && (pinfo->destport == server->port);
	}

	rdpudp_info = (rdpudp_conv_info_t *)conversation_get_proto_data(conv, proto_rdpudp);
	if (!rdpudp_info)
		return FALSE;

	return addresses_equal(&rdpudp_info->server_addr, &pinfo->dst) && (rdpudp_info->server_port == pinfo->destport);
}

gboolean
rdpudp_is_reliable_transport(packet_info *pinfo)
{
	conversation_t *conv;
	rdpudp_conv_info_t *rdpudp_info;

	conv = find_conversation_pinfo(pinfo, 0);
	if (!conv)
		return FALSE;

	rdpudp_info = (rdpudp_conv_info_t *)conversation_get_proto_data(conv, proto_rdpudp);
	if (!rdpudp_info)
		return FALSE;

	return !rdpudp_info->is_lossy;
}

static int
dissect_rdpudp_v1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rdpudp_conv_info_t *conv)
{
	gint offset = 0;
	guint16 flags;

	col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDPUDP");
	col_clear(pinfo->cinfo, COL_INFO);

	proto_tree_add_item(tree, hf_rdpudp_snSourceAck, tvb, offset, 4, ENC_BIG_ENDIAN);
	offset += 4;

	proto_tree_add_item(tree, hf_rdpudp_ReceiveWindowSize, tvb, offset, 2, ENC_BIG_ENDIAN);
	offset += 2;

	proto_tree_add_bitmask(tree, tvb, offset, hf_rdpudp_flags, ett_rdpudp_flags, rdpudp_flags, ENC_BIG_ENDIAN);
	flags = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN);
	offset += 2;

	if (flags & RDPUDP_SYN) {
		conv->is_lossy = (flags & RDPUDP_SYNLOSSY);
		if (!(flags & RDPUDP_ACK)) {
			/* set the server address only on the first SYN packet */
			copy_address_wmem(wmem_file_scope(), &conv->server_addr, &pinfo->dst);
			conv->server_port = pinfo->destport;
		}
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "SYN");
	}

	if (flags & RDPUDP_SYN) {
		proto_tree_add_item(tree, hf_rdpudp_snInitialSequenceNumber, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;
		proto_tree_add_item(tree, hf_rdpudp_upstreamMtu, tvb, offset, 2, ENC_BIG_ENDIAN);
		offset += 2;
		proto_tree_add_item(tree, hf_rdpudp_downstreamMtu, tvb, offset, 2, ENC_BIG_ENDIAN);
		offset += 2;
	}

	if (flags & RDPUDP_CORRELATIONID) {
		proto_tree_add_item(tree, hf_rdpudp_correlationId, tvb, offset, 16, ENC_NA);
		offset += 32;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "CORRELATIONID");
	}

	if (flags & RDPUDP_SYNEX) {
		guint16 synex_flags;
		proto_tree *synex_tree;
		guint synex_sz = 2;
		guint16 version_val;

		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "SYNEX");

		synex_flags = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN);
		if (synex_flags & RDPUDP_VERSION_INFO_VALID) {
			synex_sz += 2; /* version */

			version_val = tvb_get_guint16(tvb, offset+2, ENC_BIG_ENDIAN);

			if (version_val == 0x101)
				synex_sz += 32; /* cookie hash */
		}

		synex_tree = proto_tree_add_subtree(tree, tvb, offset, synex_sz, ett_rdpudp_synex, NULL, "SynEx");
		proto_tree_add_item(synex_tree, hf_rdpudp_synex_flags, tvb, offset, 2, ENC_BIG_ENDIAN);
		proto_tree_add_item(synex_tree, hf_rdpudp_synex_flag_version, tvb, offset, 2, ENC_BIG_ENDIAN);

		offset += 2;

		if (synex_flags & RDPUDP_VERSION_INFO_VALID) {
			proto_tree_add_item(synex_tree, hf_rdpudp_synex_version, tvb, offset, 2, ENC_BIG_ENDIAN);

			offset += 2;
			if (version_val == 0x101) {
				proto_tree_add_item(synex_tree, hf_rdpudp_synex_cookiehash, tvb, offset, 32, ENC_NA);
				offset += 32;

				if (flags & RDPUDP_ACK)
					conv->start_v2_at = pinfo->num + 1;
			}
		}
	}

	if ((flags & RDPUDP_ACK) && !(flags & RDPUDP_SYN)) {
		proto_tree *ack_tree;
		guint16 uAckVectorSize = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN);

		ack_tree = proto_tree_add_subtree(tree, tvb, offset, 2 + uAckVectorSize, ett_rdpudp_ack, NULL, "Ack");
		offset += 2;
		for ( ; uAckVectorSize; uAckVectorSize--, offset++) {
			proto_tree_add_item(ack_tree, hf_rdpudp_ack_item, tvb, offset, 1, ENC_BIG_ENDIAN);
			proto_tree_add_item(ack_tree, hf_rdpudp_ack_item_rle, tvb, offset, 1, ENC_BIG_ENDIAN);
		}
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACK");
	}

	if (flags & RDPUDP_FEC) {
		proto_tree *fec_tree = proto_tree_add_subtree(tree, tvb, offset, 4 * 3, ett_rdpudp_fec, NULL, "FEC");

		proto_tree_add_item(fec_tree, hf_rdpudp_fec_coded, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;
		proto_tree_add_item(fec_tree, hf_rdpudp_fec_sourcestart, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;
		proto_tree_add_item(fec_tree, hf_rdpudp_fec_range, tvb, offset, 1, ENC_BIG_ENDIAN);
		offset += 1;
		proto_tree_add_item(fec_tree, hf_rdpudp_fec_fecindex, tvb, offset, 1, ENC_BIG_ENDIAN);
		offset += 1;

		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "FEC");
	}

	if (flags & RDPUDP_AOA) {
		proto_tree_add_item(tree, hf_rdpudp_resetseqenum, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "AOA");
	}

	if (flags & RDPUDP_DATA)
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "DATA");

	if (flags & RDPUDP_DATA) {
		proto_tree *data_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_rdpudp_data, NULL, "Data");
		dissector_handle_t target_dissector;

		proto_tree_add_item(data_tree, hf_rdpudp_source_sncoded, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;

		proto_tree_add_item(data_tree, hf_rdpudp_source_snSourceStart, tvb, offset, 4, ENC_BIG_ENDIAN);
		offset += 4;

		target_dissector = conv->is_lossy ? dtls_handle : tls_handle;

		call_dissector(target_dissector, tvb_new_subset_remaining(tvb, offset), pinfo, data_tree);

		offset = tvb_reported_length(tvb);
	}

	return offset;
}

static tvbuff_t *
unwrap_udp_v2(tvbuff_t *tvb, packet_info *pinfo)
{
	gint len = tvb_captured_length_remaining(tvb, 0);
	guchar *buffer = (guchar*)wmem_alloc(pinfo->pool, len);

	/* copy and do the swap of byte 0 and 7*/
	tvb_memcpy(tvb, buffer, 0, len);
	buffer[0] = tvb_get_guint8(tvb, 7);
	buffer[7] = tvb_get_guint8(tvb, 0);

	return tvb_new_child_real_data(tvb, buffer, len, len);
}

static guint64
computeAndUpdateSeqContext(rdpudp_seq_context_t *context, guint16 seq)
{
	guint16 diff = (context->last_received > seq) ? (context->last_received - seq) : (seq - context->last_received);


	if (diff < 8000) {
		/* not too much difference between last and seq, so we keep the same base
		 *         seq   seq
		 *          |     |
		 *  [0 ...................... 0xffff]
		 *             |
		 *           last
		 */
		if (seq > context->last_received)
			context->last_received = seq;
		return (context->current_base + seq);
	}

	/* when diff is bigger than 8000 that means that either we've just switched
	 * the base, or that it is a sequence number from the previous base
	 */
	if (seq < context->last_received) {
		/* in this case we have
		 *  [0 ...................... 0xffff]
		 *     |                    |
		 *    seq                 last
		 *
		 * so the new sequence number is in fact after last_received: we've just
		 * switched the base
		 */
		context->last_received = seq;
		context->current_base += 0x10000;
		return (context->current_base + seq);
	}

	/* this is a sequence number from the previous base
	 *
	 *  [0 ........................ 0xffff]
	 *      |                   |
	 *     last                seq
	 */
	return (context->current_base + seq - 0x10000);
}

static int
dissect_rdpudp_v2(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rdpudp_conv_info_t *rdpudp)
{
	proto_item *item;
	proto_tree *subtree, *data_tree = NULL;
	guint16 flags;
	guint8 packet_type;
	tvbuff_t *subtvb;
	gint offset = 0;
	tvbuff_t *tvb2 = unwrap_udp_v2(tvb, pinfo);

	col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDPUDP2");
	col_clear(pinfo->cinfo, COL_INFO);

	add_new_data_source(pinfo, tvb2, "Unwrapped RDPUDP2 packet");

	packet_type = (tvb_get_guint8(tvb2, 0) >> 1) & 0xf;
	item = proto_tree_add_item(tree, hf_rdpudp2_PacketPrefixByte, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
	subtree = proto_item_add_subtree(item, ett_rdpudp2_packetType);
	proto_tree_add_item(subtree, hf_rdpudp2_packetType, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
	proto_tree_add_item(subtree, hf_rdpudp2_shortPacketLength, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
	offset++;

	proto_tree_add_bitmask(tree, tvb2, offset, hf_rdpudp2_flags, ett_rdpudp2_flags, rdpudp2_flags, ENC_LITTLE_ENDIAN);

	flags = tvb_get_guint16(tvb2, offset, ENC_LITTLE_ENDIAN);
	offset += 2;

	if (flags & RDPUDP2_ACK) {
		guint8 nacks = tvb_get_guint8(tvb, offset + 6) & 0xf;
		subtree = proto_tree_add_subtree(tree, tvb2, offset, 7 + nacks, ett_rdpudp2_ack, NULL, "Ack");
		proto_tree_add_item(subtree, hf_rdpudp2_AckSeq, tvb2, offset, 2, ENC_LITTLE_ENDIAN); offset += 2;
		proto_tree_add_item(subtree, hf_rdpudp2_AckTs, tvb2, offset, 3, ENC_LITTLE_ENDIAN); offset += 3;
		proto_tree_add_item(subtree, hf_rdpudp2_AckSendTimeGap, tvb2, offset, 1, ENC_LITTLE_ENDIAN); offset++;

		proto_tree_add_item(subtree, hf_rdpudp2_ndelayedAcks, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		proto_tree_add_item(subtree, hf_rdpudp2_delayedTimeScale, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		offset++;

		offset += nacks;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACK");
	}

	if (flags & RDPUDP2_OVERHEAD) {
		subtree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_overhead, NULL, "Overhead");
		proto_tree_add_item(subtree, hf_rdpudp2_OverHeadSize, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		offset++;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "OVERHEAD");
	}


	if (flags & RDPUDP2_DELAYACK) {
		subtree = proto_tree_add_subtree(tree, tvb2, offset, 3, ett_rdpudp2_delayack, NULL, "DelayAck");
		proto_tree_add_item(subtree, hf_rdpudp2_DelayAckMax, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		offset++;
		proto_tree_add_item(subtree, hf_rdpudp2_DelayAckTimeout, tvb2, offset, 2, ENC_LITTLE_ENDIAN);
		offset += 2;

		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "DELAYACK");
	}

	if (flags & RDPUDP2_AOA) {
		subtree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_aoa, NULL, "Ack of Acks");
		proto_tree_add_item(subtree, hf_rdpudp2_AckOfAcksSeqNum, tvb2, offset, 2, ENC_LITTLE_ENDIAN);
		offset += 2;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "AOA");
	}

	if (flags & RDPUDP2_DATA) {
		guint32 rawSeq;
		guint64 *seqPtr;
		gboolean is_server_target = rdp_isServerAddressTarget(pinfo);
		rdpudp_seq_context_t *target_seq_context = is_server_target ? &rdpudp->client_data_seq : &rdpudp->server_data_seq;

		gboolean isDummy = !!(packet_type == 0x8);
		data_tree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_data, NULL, isDummy ? "Dummy data" : "Data");
		proto_tree_add_item_ret_uint(data_tree, hf_rdpudp2_DataSeqNumber, tvb2, offset, 2, ENC_LITTLE_ENDIAN, &rawSeq);

		if (!PINFO_FD_VISITED(pinfo)) {
			seqPtr = wmem_alloc(wmem_file_scope(), sizeof(*seqPtr));
			*seqPtr = computeAndUpdateSeqContext(target_seq_context, rawSeq);

			p_set_proto_data(wmem_file_scope(), pinfo, proto_rdpudp, RDPUDP_FULL_DATA_SEQ_KEY, seqPtr);
		} else {
			seqPtr = (guint64 *)p_get_proto_data(wmem_file_scope(), pinfo, proto_rdpudp, RDPUDP_FULL_DATA_SEQ_KEY);
		}
		proto_item_set_generated(
				proto_tree_add_uint(data_tree, hf_rdpudp2_DataFullSeqNumber, tvb2, offset, 2, (guint32)*seqPtr)
		);

		offset += 2;

		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", isDummy ? "DUMMY" : "DATA");
	}

	if (flags & RDPUDP2_ACKVEC) {
		proto_tree *acks_tree;
		guint8 i;
		guint32 base_seq;
		gint ackvecSz = 3;
		guint8 codedAckVecSizeA = tvb_get_guint8(tvb2, offset + 2);
		guint8 codedAckVecSize = codedAckVecSizeA & 0x7f;
		gboolean haveTs = !!(codedAckVecSizeA & 0x80);

		ackvecSz += codedAckVecSize;
		if (haveTs)
			ackvecSz += 3;

		subtree = proto_tree_add_subtree(tree, tvb2, offset, ackvecSz, ett_rdpudp2_ackvec, NULL, "AckVec");
		proto_tree_add_item_ret_uint(subtree, hf_rdpudp2_AckvecBaseSeq, tvb2, offset, 2, ENC_LITTLE_ENDIAN, &base_seq);
		offset += 2;

		proto_tree_add_item(subtree, hf_rdpudp2_AckvecCodecAckVecSize, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		proto_tree_add_item(subtree, hf_rdpudp2_AckvecHaveTs, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
		offset++;

		if (haveTs) {
			proto_tree_add_item(subtree, hf_rdpudp2_AckvecTimeStamp, tvb2, offset, 3, ENC_LITTLE_ENDIAN);
			offset += 3;

			proto_tree_add_item(subtree, hf_rdpudp2_SendAckTimeGapInMs, tvb2, offset, 1, ENC_LITTLE_ENDIAN);
			offset += 1;
		}

		acks_tree = proto_tree_add_subtree(subtree, tvb2, offset, codedAckVecSize, ett_rdpudp2_ackvec_vecs, NULL, "Acks");
		for (i = 0; i < codedAckVecSize; i++) {
			proto_tree *ack_tree;

			guint8 b = tvb_get_guint8(tvb2, offset + i);

			if (b & 0x80) {
				/* run length mode */
				guint8 rle_len = (b & 0x3f);
				ack_tree = proto_tree_add_subtree_format(acks_tree, tvb2, offset + i, 1, ett_rdpudp2_ackvec_vec, NULL,
						"RLE %s %04x -> %04x", (b & 0x40) ? "received" : "lost",
						base_seq, base_seq + rle_len);

				base_seq += rle_len;
			} else {
				/* bitmap mode */
				ack_tree = proto_tree_add_subtree_format(acks_tree, tvb2, offset + i, 1, ett_rdpudp2_ackvec_vec, NULL,
						"bitmap %s%04x %s%04x %s%04x %s%04x %s%04x %s%04x %s%04x",
						(b & 0x01) ? "" : "!", base_seq,
						(b & 0x02) ? "" : "!", base_seq + 1,
						(b & 0x04) ? "" : "!", base_seq + 2,
						(b & 0x08) ? "" : "!", base_seq + 3,
						(b & 0x10) ? "" : "!", base_seq + 4,
						(b & 0x20) ? "" : "!", base_seq + 5,
						(b & 0x40) ? "" : "!", base_seq + 6
				);
				base_seq += 7;
			}

			proto_tree_add_item(ack_tree, hf_rdpudp2_AckvecCodedAckMode, tvb2, offset + i, 1, ENC_LITTLE_ENDIAN);
			if (b & 0x80) {
				proto_tree_add_item(ack_tree, hf_rdpudp2_AckvecCodedAckRleState, tvb2, offset + i, 1, ENC_LITTLE_ENDIAN);
				proto_tree_add_item(ack_tree, hf_rdpudp2_AckvecCodedAckRleLen, tvb2, offset + i, 1, ENC_LITTLE_ENDIAN);
			}
		}

		offset += codedAckVecSize;
		col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACKVEC");
	}

	if ((flags & RDPUDP2_DATA) && (packet_type != 0x8)) {
		tvbuff_t *data_tvb;
		tvbuff_t *chunk;
		guint32 rawSeq;
		guint64 *seqPtr;
		gboolean is_server_target = rdp_isServerAddressTarget(pinfo);
		wmem_tree_t *targetTree = is_server_target ? rdpudp->client_chunks : rdpudp->server_chunks;
		rdpudp_seq_context_t *target_seq_context = is_server_target ? &rdpudp->client_channel_seq : &rdpudp->server_channel_seq;

		proto_tree_add_item_ret_uint(data_tree, hf_rdpudp2_DataChannelSeqNumber, tvb2, offset, 2, ENC_LITTLE_ENDIAN, &rawSeq);
		if (!PINFO_FD_VISITED(pinfo)) {
			seqPtr = wmem_alloc(wmem_file_scope(), sizeof(*seqPtr));
			*seqPtr = computeAndUpdateSeqContext(target_seq_context, rawSeq);

			p_set_proto_data(wmem_file_scope(), pinfo, proto_rdpudp, RDPUDP_FULL_CHANNEL_SEQ_KEY, seqPtr);
		} else {
			seqPtr = (guint64 *)p_get_proto_data(wmem_file_scope(), pinfo, proto_rdpudp, RDPUDP_FULL_CHANNEL_SEQ_KEY);
		}
		proto_item_set_generated(
				proto_tree_add_uint(data_tree, hf_rdpudp2_DataChannelFullSeqNumber, tvb2, offset, 2, (guint32)*seqPtr)
		);
		offset += 2;

		chunk = wmem_tree_lookup32(targetTree, (guint32)*seqPtr);
		data_tvb = tvb_new_composite();

		if (chunk)
			tvb_composite_prepend(data_tvb, chunk);

		subtvb = tvb_new_subset_length(tvb2, offset, tvb_captured_length_remaining(tvb2, offset));
		tvb_composite_append(data_tvb, subtvb);
		tvb_composite_finalize(data_tvb);

		add_new_data_source(pinfo, data_tvb, "SSL fragment");
		pinfo->can_desegment = 2;

		call_dissector(tls_handle, data_tvb, pinfo, data_tree);

		if (!PINFO_FD_VISITED(pinfo) && pinfo->desegment_len) {
			gint remaining = tvb_captured_length_remaining(subtvb, pinfo->desegment_offset);
			/* Something went wrong if seqPtr didn't advance.
			 * XXX: Should we ignore this or free the old chunk and
			 * use the new one?
			 */
			chunk = (tvbuff_t*)wmem_tree_lookup32(targetTree, (guint32)(*seqPtr + 1));
			if (chunk) {
				tvb_free(chunk);
			}
			chunk = tvb_clone_offset_len(data_tvb, pinfo->desegment_offset, remaining);
			wmem_tree_insert32(targetTree, (guint32)(*seqPtr + 1), chunk);
		}

		offset = tvb_captured_length(tvb2);
	}

	return offset;
}

static int
dissect_rdpudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void *data _U_)
{
	proto_item *item;
	proto_tree *tree;
	conversation_t  *conversation;
	rdpudp_conv_info_t *rdpudp_info;

	conversation = find_or_create_conversation(pinfo);

	rdpudp_info = (rdpudp_conv_info_t *)conversation_get_proto_data(conversation, proto_rdpudp);
	if (rdpudp_info == NULL) {
		rdpudp_info = wmem_new0(wmem_file_scope(), rdpudp_conv_info_t);
		rdpudp_info->start_v2_at = G_MAXUINT32;
		rdpudp_info->is_lossy = FALSE;
		rdpudp_info->client_chunks = wmem_tree_new(wmem_file_scope());
		rdpudp_info->server_chunks = wmem_tree_new(wmem_file_scope());
		wmem_register_callback(wmem_file_scope(), rdpudp_info_free_cb, rdpudp_info);

		conversation_add_proto_data(conversation, proto_rdpudp, rdpudp_info);
	}

	item = proto_tree_add_item(parent_tree, proto_rdpudp, tvb, 0, -1, ENC_NA);
	tree = proto_item_add_subtree(item, ett_rdpudp);

	if (rdpudp_info->start_v2_at > pinfo->num)
		return dissect_rdpudp_v1(tvb, pinfo, tree, rdpudp_info);
	else
		return dissect_rdpudp_v2(tvb, pinfo, tree, rdpudp_info);
}

/*--- proto_register_rdpudp -------------------------------------------*/
void
proto_register_rdpudp(void) {
	/* List of fields */
	static hf_register_info hf[] = {
	  { &hf_rdpudp_snSourceAck,
		{"snSourceAck", "rdpudp.snsourceack", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL},
	  },
	  { &hf_rdpudp_ReceiveWindowSize,
		{"ReceiveWindowSize", "rdpudp.receivewindowsize", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_flags,
		{"Flags", "rdpudp.flags", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_syn,
		{"Syn", "rdpudp.flags.syn", FT_BOOLEAN, 16, NULL, RDPUDP_SYN, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_fin,
		{"Fin", "rdpudp.flags.fin", FT_BOOLEAN, 16, NULL, RDPUDP_FIN, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_ack,
		{"Ack", "rdpudp.flags.ack", FT_BOOLEAN, 16, NULL, RDPUDP_ACK, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_data,
		{"Data", "rdpudp.flags.data", FT_BOOLEAN, 16, NULL, RDPUDP_DATA, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_fec,
		{"FECData", "rdpudp.flags.fec", FT_BOOLEAN, 16, NULL, RDPUDP_FEC, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_cn,
		{"CN", "rdpudp.flags.cn", FT_BOOLEAN, 16, NULL, RDPUDP_CN, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_cwr,
		{"CWR", "rdpudp.flags.cwr", FT_BOOLEAN, 16, NULL, RDPUDP_CWR, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_aoa,
		{"Ack of Acks", "rdpudp.flags.aoa", FT_BOOLEAN, 16, NULL, RDPUDP_AOA, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_synlossy,
		{"Syn lossy", "rdpudp.flags.synlossy", FT_BOOLEAN, 16, NULL, RDPUDP_SYNLOSSY, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_ackdelayed,
		{"Ack delayed", "rdpudp.flags.ackdelayed", FT_BOOLEAN, 16, NULL, RDPUDP_ACKDELAYED, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_correlationId,
		{"Correlation id", "rdpudp.flags.correlationid", FT_BOOLEAN, 16, NULL, RDPUDP_CORRELATIONID, NULL, HFILL}
	  },
	  { &hf_rdpudp_flag_synex,
		{"SynEx","rdpudp.flags.synex",FT_BOOLEAN,16,NULL,RDPUDP_SYNEX,NULL,HFILL}
	  },
	  { &hf_rdpudp_snInitialSequenceNumber,
		{"Initial SequenceNumber","rdpudp.initialsequencenumber", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_upstreamMtu,
		{"Upstream MTU", "rdpudp.upstreammtu", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_downstreamMtu,
		{"DownStream MTU", "rdpudp.downstreammtu", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_correlationId,
		{"Correlation Id", "rdpudp.correlationid", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_synex_flags,
		{"Flags", "rdpudp.synex.flags", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_synex_flag_version,
		{"Version info", "rdpudp.synex.flags.versioninfo", FT_BOOLEAN, 8, NULL, 0x0001, NULL, HFILL}
	  },
	  { &hf_rdpudp_synex_version,
		{"Version", "rdpudp.synex.version", FT_UINT16, BASE_HEX, VALS(rdpudp_version_vals), 0, NULL, HFILL}
	  },
	  {&hf_rdpudp_synex_cookiehash,
		{"Cookie Hash", "rdpudp.synex.cookiehash", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_ack_vectorsize,
		{"uAckVectorSize", "rdpudp.ack.vectorsize", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_ack_item,
		{"Ack item", "rdpudp.ack.item", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_ack_item_state,
		{"VECTOR_ELEMENT_STATE", "rdpudp.ack.item.state", FT_UINT8, BASE_HEX, VALS(rdpudp_ack_states_vals), 0xc0, NULL, HFILL}
	  },
	  { &hf_rdpudp_ack_item_rle,
		{"Run length", "rdpudp.ack.item.rle", FT_UINT8, BASE_DEC, NULL, 0x3f, NULL, HFILL}
	  },
	  { &hf_rdpudp_fec_coded,
		{"snCoded", "rdpudp.fec.coded", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_fec_sourcestart,
		{"snSourceStart", "rdpudp.fec.sourcestart", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_fec_range,
		{"Range", "rdpudp.fec.range", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_fec_fecindex,
		{"Fec index", "rdpudp.fec.fecindex", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_resetseqenum,
		{"snResetSeqNum", "rdpudp.resetSeqNum", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_source_sncoded,
		{"snCoded", "rdpudp.data.sncoded", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_source_snSourceStart,
		{"snSourceStart", "rdpudp.data.sourceStart", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp_data,
		{"Data", "rdpudp.data", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL}
	  },


	  { &hf_rdpudp2_PacketPrefixByte,
		{"PacketPrefixByte", "rdpudp.prefixbyte", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_packetType,
		{"PacketType", "rdpudp.packetType", FT_UINT8, BASE_HEX, VALS(rdpudp2_packetType_vals), 0x1e, NULL, HFILL}
	  },
	  { &hf_rdpudp2_shortPacketLength,
		{"Short packet length", "rdpudp.shortpacketlen", FT_UINT8, BASE_DEC, NULL, 0x7, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flags,
		 {"Flags", "rdpudp.flags", FT_UINT16, BASE_HEX, NULL, 0xfff, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_ack,
		{"Ack", "rdpudp.flags.ack", FT_BOOLEAN, 16, NULL, RDPUDP2_ACK, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_data,
		{"Data", "rdpudp.flags.data", FT_BOOLEAN, 16, NULL, RDPUDP2_DATA, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_ackvec,
		{"AckVec", "rdpudp.flags.ackvec", FT_UINT16, BASE_HEX, NULL, RDPUDP2_ACKVEC, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_aoa,
		{"AckOfAcks", "rdpudp.flags.ackofacks", FT_UINT16, BASE_HEX, NULL, RDPUDP2_AOA, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_overhead,
		{"OverheadSize", "rdpudp.flags.overheadsize", FT_UINT16, BASE_HEX, NULL, RDPUDP2_OVERHEAD, NULL, HFILL}
	  },
	  { &hf_rdpudp2_flag_delayackinfo,
		{"DelayedAckInfo", "rdpudp.flags.delayackinfo", FT_UINT16, BASE_HEX, NULL, RDPUDP2_DELAYACK, NULL, HFILL}
	  },
	  { &hf_rdpudp2_logWindow,
		{"LogWindow", "rdpudp.logWindow", FT_UINT16, BASE_DEC, NULL, 0xf000, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckSeq,
		{"Base Seq", "rdpudp.ack.seqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckTs,
		{"receivedTS", "rdpudp.ack.ts", FT_UINT24, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckSendTimeGap,
		{"sendTimeGap", "rdpudp.ack.sendTimeGap", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_ndelayedAcks,
		{"NumDelayedAcks", "rdpudp.ack.numDelayedAcks", FT_UINT8, BASE_DEC, NULL, 0x0F, NULL, HFILL}
	  },
	  { &hf_rdpudp2_delayedTimeScale,
		{"delayedTimeScale", "rdpudp.ack.delayedTimeScale", FT_UINT8, BASE_DEC, NULL, 0xF0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_delayedAcks,
		{"Delayed acks", "rdpudp.ack.delayedAcks", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_delayedAck,
		{"Delayed ack", "rdpudp.ack.delayedAck", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_OverHeadSize,
		{"Overhead size", "rdpudp.overheadsize", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DelayAckMax,
		{"MaxDelayedAcks", "rdpudp.delayackinfo.max", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DelayAckTimeout,
		{"DelayedAckTimeoutInMs", "rdpudp.delayackinfo.timeout", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckOfAcksSeqNum,
		{"Sequence number", "rdpudp.ackofacksseqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DataSeqNumber,
		{"Sequence number", "rdpudp.data.seqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DataFullSeqNumber,
		{"Full sequence number", "rdpudp.data.fullseqnum", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DataChannelSeqNumber,
		{"Channel sequence number", "rdpudp.data.channelseqnumber", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_DataChannelFullSeqNumber,
		{"Channel full sequence number", "rdpudp.data.channelfullseqnumber", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_Data,
		{"Data", "rdpudp.data", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecBaseSeq,
		{"Base sequence number", "rdpudp.ackvec.baseseqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecCodecAckVecSize,
		{"Coded ackvec size","rdpudp.ackvec.codedackvecsize", FT_UINT16, BASE_DEC, NULL, 0x7f, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecHaveTs,
		{"Have timestamp", "rdpudp.ackvec.havets", FT_BOOLEAN, 8, NULL, 0x80, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecTimeStamp,
		{"Timestamp", "rdpudp.ackvec.timestamp", FT_UINT24, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_SendAckTimeGapInMs,
		{"SendAckTimeGap", "rdpudp.ackvec.sendacktimegap", FT_UINT8, BASE_DEC, NULL, 0x00, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecCodedAck,
		{"Coded Ack", "rdpudp.ackvec.codedAck", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecCodedAckMode,
		{"Mode", "rdpudp.ackvec.codecAckMode", FT_UINT8, BASE_HEX, VALS(rdpudp2_ackvec_mode_vals), 0x80, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecCodedAckRleState,
		{"State", "rdpudp.ackvec.codecAckRleState", FT_UINT8, BASE_DEC, VALS(rdpudp2_ackvec_rlestates_vals), 0x40, NULL, HFILL}
	  },
	  { &hf_rdpudp2_AckvecCodedAckRleLen,
		{"Length", "rdpudp.ackvec.codecAckRleLen", FT_UINT8, BASE_DEC, NULL, 0x3f, NULL, HFILL}
	  }
	};

	/* List of subtrees */
	static gint *ett[] = {
		&ett_rdpudp,
		&ett_rdpudp_flags,
		&ett_rdpudp_synex,
		&ett_rdpudp_ack,
		&ett_rdpudp_fec,
		&ett_rdpudp_data,
		&ett_rdpudp2_packetType,
		&ett_rdpudp2_flags,
		&ett_rdpudp2_ack,
		&ett_rdpudp2_overhead,
		&ett_rdpudp2_delayack,
		&ett_rdpudp2_aoa,
		&ett_rdpudp2_data,
		&ett_rdpudp2_ackvec,
		&ett_rdpudp2_ackvec_vecs,
		&ett_rdpudp2_ackvec_vec,
	};

	/* Register protocol */
	proto_rdpudp = proto_register_protocol(PNAME, PSNAME, PFNAME);
	/* Register fields and subtrees */
	proto_register_field_array(proto_rdpudp, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));

	rdpudp_handle = register_dissector("rdpudp", dissect_rdpudp, proto_rdpudp);
}

void
proto_reg_handoff_rdpudp(void)
{
	tls_handle = find_dissector("tls");
	dtls_handle = find_dissector("dtls");
	dissector_add_uint("udp.port", 3389, rdpudp_handle);
}

/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local Variables:
 * c-basic-offset: 2
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * ex: set shiftwidth=2 tabstop=8 expandtab:
 * :indentSize=2:tabSize=8:noTabs=true:
 */