SSL Lua dissector - how?

I have a protocol that is over SSL that I'd like to dissect. I'm having a hard time just conceptually figuring out how one goes about doing this. I've created a dissector for the right port that gets a reference to the ssl dissector and then calls it. I've also tried registering it as a post-dissector. In both cases the SSL dissector seems to work a-ok (I have a client-random/master key file set up in the SSL protocol preferences) and I can see my protocol's raw data in the Follow SSL Stream window. But I'd like to dissect that protocol and get at the decrypted data.

I'm guessing that what I'm supposed to do is get a reference to one of the fields populated by the SSL dissector like ssl.segment, ssl.segment.data, ssl.reassembled.data, etc and then work with that. But whether I call the ssl dissector explicitly or use a post-dissector, those variables are always nil.

protocol_foo = Proto("foo", "Foo protocol")
port = 4172
g_field_segment = Field.new("ssl.segment")
g_field_segment_data = Field.new("ssl.segment.data")
g_field_segments = Field.new("ssl.segments")
g_field_reassembled_data = Field.new("ssl.reassembled.data")
function protocol_foo.dissector(tvb, pinfo, root)
print("====== protocol_foo")

for k,v in pairs({ g_field_segment, g_field_segment_data, g_field_segments, g_field_reassembled_data }) do
    if v() ~= nil then
        print("Field " .. v.name .. " is NOT nil")
    else
        print("Field " .. v.name .. " is nil")
    end
end

end
– post-dissector registration
local ssl_dissector = Dissector.get("ssl")
local dissector_table_tcp = DissectorTable.get("tcp.port")
dissector_table_tcp:add(port, ssl_dissector)
register_postdissector(protocol_foo)

or calling explicitly …

protocol_foo = Proto("foo", "Foo protocol")
port = 4172

g_field_segment = Field.new("ssl.segment")
g_field_segment_data = Field.new("ssl.segment.data")
g_field_segments = Field.new("ssl.segments")
g_field_reassembled_data = Field.new("ssl.reassembled.data")
function protocol_foo.dissector(tvb, pinfo, root)
print("====== protocol_foo")

local ssl_dissector = Dissector.get("ssl")
ssl_dissector:call(tvb, pinfo, root)

for k,v in pairs({ g_field_segment, g_field_segment_data, g_field_segments, g_field_reassembled_data }) do
    if v() ~= nil then
        print("Field " .. v.name .. " is NOT nil")
    else
        print("Field " .. v.name .. " is nil")
    end
end

end
– dissector registration
local dissector_table_tcp = DissectorTable.get("tcp.port")
dissector_table_tcp:add(port, protocol_foo)

Other fields, like ssl.handshake.* seem to be populated well enough, but not the ones I want. Am I just going about this the wrong way?

Update: I can appreciate that this seems like an elementary question, but I can’t find any examples on the wireshark site, on the web, or in any of the questions and answers in this forum or on SO that do this - I can’t find an example of how to dissect the decrypted output of the ssl dissector (although I’ve read many questions on this forum that seem to indicate that people are in fact doing this successfully).