summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-12-02Added SIPp scenario and list of codecs supported by FSPeter Wu2-0/+149
Requires appropriately configured FreeSWITCH server that responds to a call to sip:test@host by playing a fragment, then hanging up. SIPp scenario was used to create a bunch of captures, uploaded to https://wiki.wireshark.org/SampleCaptures#SIP_and_RTP
2016-09-24extcap/ssh-tcpdump: example remote tcpdumpPeter Wu1-0/+124
Requires Python 3.4, but it can be adapted for older versions. It demonstrates how "easy" it is to capture remotely over SSH when only tcpdump is installed without dumpcap (in that case you could use sshdump). Note that on stopping/restarting captures, you still get some stderr messages ("Dropped privileges", but that can be ignored). See also https://ask.wireshark.org/questions/55768/remote-interface-linux
2016-09-17openssl-connect: fix support for more PSK ciphersPeter Wu1-1/+7
Match also stuff like DHE-PSK-AES128-CCM8. Improve error message if cipher is not accepted by OpenSSL.
2016-09-17openssl-{connect,listen}: OpenSSL 1.1.0 compatPeter Wu2-6/+6
The options parser has changed, options now have to precede the parameters (possible a bug, already reported to rt.openssl.org with subject "Options after parameters are ignored in OpenSSL 1.1.0"). While at it, use COMPLEMENTOFALL instead of NULL since that possibly includes more ciphers.
2016-09-17make-tcp.py: use HTTP (which activates reassembly)Peter Wu1-14/+12
2016-09-17make-tcp.py: create a crafted packet with TCP issuesPeter Wu1-0/+56
Prompted by https://code.wireshark.org/review/17749
2016-08-16src/sslkeylog.c: OpenSSL 1.1.0 compatibilityPeter Wu1-18/+48
OpenSSL 1.1.0 makes some structures opaque, but luckily it provides new functions to extract the client random and master secret which is all we need from the structures. Tested with OpenSSL 1.1.0-pre6 using openssl s_client and OpenSSL 1.0.2.h using curl.
2016-07-27lua/r8152.lua: add basic USB dissector for Realtek Ethernet adapterPeter Wu1-0/+73
Last modified at 2015-12-08
2016-07-06lua/gelf: add very basic GELF dissectorPeter Wu1-0/+27
GELF is a simple UDP protocol, every datagram is a gzipped JSON message. This dissector demonstrates how one could decompress it and parse it as JSON. Does not support chunked format.
2016-05-12sync-build.sh: fix PKG_CONFIG_LIBDIR, enable gold linkerPeter Wu1-1/+2
Gold linker seems marginally faster.
2016-02-10replay-tcp-as-ssl.py: pass cipherlist to server tooPeter Wu1-3/+3
Avoids handshake failure when a cipher suite is used which is disabled by default (e.g. NULL-SHA).
2016-01-25Add tls-null.pcapngPeter Wu1-0/+0
Master secret is available in capture file comments. Note that this capture uses NULL encryption, so these secrets *should* not be necessary, but as of Wireshark 2.0.1. they are needed. Created with: curl --ciphers NULL-SHA256 https://10.9.0.1/ -k openssl s_server -www -cipher NULL-SHA256 Created for investigating https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4652
2016-01-11replay-tcp-as-ssl.py: wrap TCP payload in SSLPeter Wu1-0/+120
Useful for wrapping existing protocols in SSL for testing.
2016-01-11notes.txt: random update for cmake-buildPeter Wu1-0/+9
2016-01-11one-off/find-assignments-handle: find create_dissector_handlePeter Wu1-0/+68
Found 393 results, see https://lekensteyn.nl/files/wireshark/wireshark-v2.1.0rc0-1421-g515502f-create_dissector_handle.txt
2015-12-05sync-build.sh: allow BUILDDIR and cmake options overridePeter Wu1-4/+23
For testing other build types (-DCMAKE_BUILD_TYPE=RelWithDebInfo) and compilers (BUILDDIR=/tmp/wsbuild-gcc).
2015-10-24find-expert-in-tree: add usagePeter Wu1-1/+10
2015-10-12find-expert-in-tree: fix formattingPeter Wu1-1/+1
2015-10-11sync-build.sh: enable relocatable folder, copy more filesPeter Wu1-9/+19
Copy compile_commands.json, config.h. (ab)use CMAKE_INSTALL_RPATH to enable relocatable executables. Note that this is only safe for development, if you install the generated binaries without stripping/modifying rpath, then insecure situations may occur in an hostile environment (wrong libraries may be loaded).
2015-10-11run-ws: fix ASAN_OPTIONSPeter Wu1-1/+1
2015-10-11one-off/find-experts-in-tree: addedPeter Wu1-0/+99
Add tool that leverages clang-query to find expert info callers which are behind an if(tree).
2015-07-16sslkeylog.py: fix writing headerPeter Wu1-1/+1
2015-07-10sslkeylog.py: document batch modePeter Wu1-1/+16
Found in gdb source code that 'all' implies everything except SIGTRAP and SIGINT. SIGINT is normally used for interactive debugging (so can be disabled) but SIGTRAP is used for breakpoints (and can therefore not be disabled without killing the program on such signals).
2015-07-10sslkeylog.py: fix older gdb and python compatPeter Wu1-5/+14
Older gdb is upset by appending to a pipe, so fallback to writing instead in such cases. Older python do not allow interpolation in bytes, so use strings and encode it to bytes before writing. Previously tested with GDB 7.9.1 and Python 2.7.10. Now tested with GDB 7.7.1 and Python 2.7.6 on Ubuntu 14.04.
2015-07-10sslkeylog.py: initial check-inPeter Wu1-0/+198
Tool to extract SSL keys on-the-fly from existing OpenSSL programs. Servers included!
2015-07-10sync-build.sh: enable compression for rsyncPeter Wu1-0/+2
Advantages: lower transmission size, faster completion for slow WAN links. Disadvantage: slight delays in compile output reporting.
2015-07-10cleanup: notes on LSANPeter Wu1-0/+11
2015-06-28cleanup: make it possible to force code generationPeter Wu1-3/+13
Useful to put remaining dissectors into a template which can further be filled in.
2015-06-28cleanup: add more FIXMEs and print queued changesPeter Wu1-7/+12
2015-06-28cleanup: modify unknown lines and append FIXMEsPeter Wu1-1/+8
Affects 13 dissectors.
2015-06-28cleanup: add FIXME for unknown assignmentsPeter Wu1-0/+4
2015-06-28cleanup: detect bracket on new line, try else handlingPeter Wu1-8/+33
Note: else heuristics is weak... g_hash_table_for_each has an unchecked parameter which needs manual handling.
2015-06-28cleanup: support prototypesPeter Wu1-3/+37
Needed for zigbee dissectors.
2015-06-28Add cleanup routine script and notesPeter Wu2-0/+534
For tracking purposes and in case I need to do something similar again.
2015-06-28sync-build.sh: allow to specify targetPeter Wu1-2/+7
Useful to build just tshark if I want to test a dissector.
2015-03-27sslkeylog.sh: allow it to be sourcedPeter Wu1-4/+6
Switch to bash as there is no readable / easy way to make it compatible for all shells in the world.
2015-03-24sync-build.sh: immediatelly trigger build on execPeter Wu1-0/+5
Avoids the need to manually touch /tmp/sync-build-* to trigger a build on startup. Can be overridden with the NOTRIGGER=1 env.
2015-03-24Add http-chunked-ssl.pcapngPeter Wu1-0/+0
Master keys are available in the capture file comments. This contains a HTTP request and a HTML response without Content-Length over SSL. It is also attached to https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9154
2015-03-24Add http-chunked-ssl.pcapngPeter Wu1-0/+0
Master keys are available in the capture file comments. This contains a HTTP request and chunked response over SSL. It is also attached to https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11079
2015-03-06sync-build.sh: allow running it locallyPeter Wu1-10/+17
Let 'localhost' bypass SSH so I can still use its watch functionality, but build locally. Use -fno-common to workaround bug https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65285 Disable verbose warnings and disable werror to reduce the huge trace of warnings which make me overlook real issues.
2015-03-03Add amqps.pcapng (AMQP over SSL)Peter Wu1-0/+0
Master keys are available in the capture file comments. Installed rabbitmq-server on Ubuntu 14.04 (upgraded halfway to 14.10) and wrote /etc/rabbitmq/rabbitmq.config with appriopriate certs: [ {rabbit, [ {ssl_listeners, [5671]}, {ssl_options, [{cacertfile, "/etc/rabbitmq/cert.pem"}, {certfile, "/etc/rabbitmq/cert.pem"}, {keyfile, "/etc/rabbitmq/key.pem"}, {verify, verify_peer}, {fail_if_no_peer_cert, false}]} ]} ]. amqp-tools (amqp-publish, etc.) did not work, so a quick Celery script was used (install python-celery): from celery import Celery app = Celery('tasks', broker='amqp://guest@localhost:5671/') app.conf.update(BROKER_USE_SSL=True) @app.task def add(x, y): return x + y print(add.delay(3, 4))
2015-02-22captures/voip: add websocket-sip.pcapngPeter Wu1-0/+0
Consists of a single TCP stream with SIP over Websockets (port 10080). Created with http://tryit.jssip.net/ and Chromium.
2015-02-22captures/voip: add webrtc-freeswitch.pcapngPeter Wu1-0/+0
Master keys (for TCP[port=8082]/SSL/WebSocket/JSON and for DTLS-SRTP) are present in the capture file comments. Created by starting Chromium 40.0.2214.111 with a new profile, disabling any settings that could cause network interference (also set about:blank as home page). Visit https://webrtc.freeswitch.org/verto/index.html to load everything in cache. Then restart with the sandbox disabled to avoid the suid sandbox (which interferes with getting SSL keys from DTLS-SRTP) and start the actual capture. Command to launch the browser: SSLKEYLOGFILE=premaster.txt \ chromium --user-data-dir=/tmp/cr \ --disable-component-extensions-with-background-pages \ --disable-web-resource --disable-background-networking \ --disable-sandbox --single-process Analyse with: capinfos -k webrtc-freeswitch.pcapng | grep -Po 'CLIENT_RANDOM \S+ \S+' > premaster.txt wireshark -r webrtc-freeswitch.pcapng \ -o ssl.keylog_file:premaster.txt \ -o dtls.keylog_file:premaster.txt \ -o http.ssl.port:8082
2015-02-22run-ws: support DTLSPeter Wu1-0/+1
2015-02-20sync-build: force colorPeter Wu1-1/+1
Ninja can strip colors if needed, but otherwise it needs to be forced on https://github.com/martine/ninja/issues/174
2015-02-20Switch to ninjaPeter Wu2-1/+10
Ninja is awesome, it is faster than Unix Makefiles!
2015-02-20bisect-wireshark: interactive git-bisect scriptPeter Wu1-0/+92
Useful to find regressions in the GUI by manual inspection.
2015-02-17run-ws: set ASAN optionsPeter Wu1-0/+14
Saves myself from typing another gdb wrapper that sets ASAN_OPTIONS and G_SLICE. https://code.google.com/p/address-sanitizer/wiki/Flags https://developer.gnome.org/glib/unstable/glib-running.html
2015-02-14sync-build.sh: cflags envvar tweaksPeter Wu1-5/+19
Default CXXFLAGS to CFLAGS (previously it would always use CFLAGS anyway due to a typo), do not require schroot, use 2*nproc instead of hardcoded 16 jobs. Document envvars.
2015-02-07Add http2-16-ssl.pcapngPeter Wu1-0/+0
Software versions, pre-master keys are available in the capture file comments. For convenience, the versions are: nghttp2/v0.7.3-74-g795a22a spdylay/v1.3.1-16-gf4bcaee openssl/1.0.2 Commands: openssl req -newkey rsa:2048 -x509 -nodes -keyout server.pem -new \ -out server.pem -subj /CN=localhost socat TCP-LISTEN:4433,reuseaddr,fork TCP-CONNECT:127.0.0.1:4433 ./nghttpd 4433 server.pem server.pem ./nghttp https://localhost/
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-08 23:14:42 +0000