JA4+ beta wireshark plugin errors when CommunityID protocol is enabled

[TheRealPancakes]

Environment:

arm wireshark v4.2.2-0-g404592842786 on macOS Sonoma 14.3 ad7e956b32d9397f215caf84e9470d2e96946f2b57ef39a6449d55c61627d059 ja4.so

Issue:

The JA4+ plugin fails with a dissector bug if the CommunityID protocol is enabled

[Dissector bug, protocol JA4: "JA4 Fingerprint" - "ja4" tfi->tree_type: -1 invalid (epan/proto.c:6222)] [Expert Info (Error/Malformed): "JA4 Fingerprint" - "ja4" tfi->tree_type: -1 invalid (epan/proto.c:6222)] ["JA4 Fingerprint" - "ja4" tfi->tree_type: -1 invalid (epan/proto.c:6222)] [Severity level: Error] [Group: Malformed]

Expected behavior:

The JA4+ plugin should work regardless of which protocols are enabled in wireshark.

Steps to reproduce:

• Place a copy of ja4.so into /Applications/Wireshark.app/Contents/PlugIns/wireshark/4-2/epan/
• Start wireshark
• Enable "Community ID Flow Hashing" protocol (disabled by default)
• Observe the plugin failing when analyzing a TLS packet

The failure also happens when doing analysis via tshark, e.g. :

tshark --enable-protocol communityid -Tfields -e communityid -e tls.handshake.ja4 -r /path/to/foo.pcap 'tls.handshake.type == 1'