jerboa-wafter

Safe packet dissection and Wireshark-style analysis in Jerboa Scheme

jerboa-wafter is a Jerboa implementation of the useful parts of Wireshark's epan model: capture readers, safe tvb-style field parsing, dissector tables, heuristics, display filters, export formats, stream analysis, and generated field inventories. Protocol decoding is Jerboa data and Jerboa code, not C dissectors.

Quick Start

cd ~/mine/jerboa-wafter
make help
make build
make check
make test
make verify
make release-evidence

./wafter -r test-packets.pcap -T json -c 5

Important

Dissectors should be Jerboa. Native code is limited to packaging, optional live capture FFI, the Qt UI shim, and Jerboa's guaranteed-linear regex backend. Do not add C protocol dissectors.

Production Wafter contains neither a network eval REPL nor runtime dissector source evaluation. New dissectors are reviewed, compiled release inputs. Display-filter matches expressions use the locked native linear-time engine; unsupported backtracking-only syntax fails closed.

Capture materialization is bounded cumulatively across file/compressed bytes, expanded bytes and ratio, packets, payload, pcapng blocks, interfaces, options, name records, secret metadata, and parsing time. Budget exhaustion is an explicit error rather than a silent partial result.

Structure

• docs/ARCHITECTURE.md - current epan-equivalent runtime design.
• docs/threat-model.md - hostile-input parser threat model.
• docs/security-hardening.md - parser, FFI, generated-source, and REPL policy.
• docs/release-evidence.md - production release gate and remaining blockers.
• docs/PORTING.md - Wireshark-to-Jerboa porting workflow.
• docs/API.md - stable module API reference for contributors.
• conversion-dashboard.md - generated readiness and coverage report.
• lib/epan/ - active epan-equivalent runtime.
• tools/wafter.ss - Wireshark/tshark-style CLI and TUI behavior.
• generated/epan/ - tracked generated field inventories for all top-level Wireshark packet-*.c files.
• dissectors/ - older/generated Jerboa dissector corpus and compatibility material.

Philosophy

1. Safe by default: All buffer access is bounds-checked. No unsafe code, ever.
2. Declarative: Define protocols as Scheme s-expressions, not imperative C.
3. Composable: Protocols nest naturally; dissectors chain automatically.
4. Honest about TLS: No plaintext inspection of encrypted traffic; extract metadata instead.
5. High performance: Leverage Chez Scheme's native compilation.

Current Status

The project has working pcap/pcapng reading, a Jerboa epan runtime, generated forms for the Wireshark dissector tree, semantic core protocols, many shallow classifiers, parity/corpus smoke tests, deterministic fuzz smoke, static build scripts, and TUI/export commands. See STATUS.md and conversion-dashboard.md for the current coverage picture.

make verify currently covers the exact Jerboa runtime lock, cumulative-budget and regex/eval adversarial regressions, static security checks, import checks, module build checks, corpus/parity/golden/fuzz smoke tests, and both native Rust lock audits. make release-evidence records those results, SBOM metadata, repeated-build reproducibility status, and explicit parser soak status under dist/release-evidence/.

Contributing

Start with docs/PORTING.md. New semantic protocol work should include capture coverage, parity expectations where possible, and make conversion-status.

References

• Wireshark source: ~/mine/wireshark/
• libepan protocol definitions: ~/mine/wireshark/epan/dissectors/
• Original Fournier work: See git history in ~/mine/wireshark