Adding tree items according to bitmask

Do I have to wrap an if statement around each and every tree:add??

Nope, you do not have to wrap each and every tree:add call (or in your case, tree:add_le).

Really, a statement like tree:add(foo) is Lua short-hand for TreeItem.add(tree, foo), which is short-hand for "in a table named 'TreeItem', get the entry of index 'add', and call its value as a function, passing it the arguments 'tree' and 'foo'".

So what you can do is create a proxy function that will decide whether to actually call TreeItem.add() or not, based on your bit mask value. For example:

local myproto = Proto("myproto","My Protocol")
– my protocol's fields
local fds =
{
bitmask =
{
– this field doesn't have a match entry, since it's the bitmask
– field in the packet that decides matches
pfield = ProtoField.new("The bitmask for fields", "my_proto.bitmask",
ftypes.UINT24, nil, base.HEX)
}
myfield =
{
match = 0x000001, – the bit in the bitmask that represents this field
pfield = ProtoField.new("My field", "my_proto.my_field",
ftypes.UINT32, nil, base.DEC)
},
myotherfield =
{
match = 0x000010,
pfield = ProtoField.new("My other field", "my_proto.my_other_field",
ftypes.UINT16, nil, base.DEC)
},
– more fields here
}
– a flat table to hold the above but only as ProtoFields
local flat_fds = {}
– fill that flat table
for _,v in pairs(fds) do
flat_fds[#flat_fds + 1] = v.pfield
end
– register all the fields using the flat table
myproto.fields = flat_fds
– a proxy function that decides when to add a ProtField to the tree or not
local function addMaskedField(tree, mask, field, …)
– only add it if it's set in the passed-in mask
if bit.band(mask, field.match) == field.match then
TreeItem.add_le(tree, field.pfield, …)
end
end
function myproto.dissector(buf,pinfo,root)
– add my protocol to the tree root
local tree = root:add(myproto, buf(0, buf:len()))
-- add the bitmask to the tree, at byte 0 for 3 bytes
tree:add_le(fds.bitmask.pfield, buf(0, 3))

-- now get the 24-bit value into Lua so we can use it
local mask = buf(0, 3):le_uint()

addMaskedField(tree, mask, fds.myfield, buf(3, 4))
addMaskedField(tree, mask, fds.myotherfield, buf(7, 2))

-- etc., etc.

end

Note that the above is just an example - I haven’t tried it or even verified it was well-formed code. But it should give you the general idea.