summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-10-23sslkeylog.c: fix OpenSSL 1.1.1 support when library is not loadedPeter Wu1-17/+21
When libssl.so.1.1.1 was not yet loaded, it would assume that an older library was already loaded and avoid the new API. That assumption is not correct, it is also possible that no library was loaded at all as is the case with Python. Test: ./sslkeylog.sh python -c \ 'import requests;print(requests.head("https://wireshark.org"))' Before this fix it would output all zeroes as secret (a sign that something is wrong).
2018-10-23sslkeylog.c: support TLS 1.3 and OpenSSL 1.1.1Peter Wu1-4/+99
OpenSSL 1.1.1 adds TLS 1.3 support which uses a new secrets format. Previously it resulted in garbage keylog files, this has been fixed now. OpenSSL 1.1.1 also introduces a new API for secrets extraction. Consumers can use it like this (curl uses this code for example): static void keylog_callback(const SSL *ssl, const char *line) { /* write line and terminating '\n' */ } { SSL_CTX *ctx; ... SSL_CTX_set_keylog_callback(ctx, keylog_callback); SSL *ssl = SSL_new(ctx); } In case you cannot change the source code for an application, you can use sslkeylog.c again. This will basically perform the above step, set the key log callback before calling SSL_new. Since the new OpenSSL 1.1.1 API requires no further interception of SSL_read and other functions, a new NO_OPENSSL_110_SUPPORT macro was to avoid intercepting these. Additionally, a NO_OPENSSL_102_SUPPORT macro avoids the need for OpenSSL development headers. Caveat: when building with OpenSSL <= 1.0.2, libsslkeylog.so will not be compatible with runtime OpenSSL 1.1.0. OpenSSL 1.1.1 still works though. Use of SSL_new and interception via SSL_CTX_set_keylog_callback was initially proposed by Derick Rethans, thanks for the suggestion!
2018-10-21appveyor-clear.py: implement paginationPeter Wu1-17/+36
Apparently the undocumented pagination limit is 100.
2018-10-20appveyor-clear.py: script to delete old buildsPeter Wu1-0/+57
Large artifacts may be accumulated and at the moment hits the 50GB limit. Deleting them one by one is cumbersome, so here is a way to automate it. Motivation: https://code.wireshark.org/review/30268
2018-09-21tls13scan: allow SNI overridePeter Wu1-0/+5
2018-08-11tls13/scan: advertise draft versions even with final TLS 1.3Peter Wu1-6/+13
If the final 1.3 version is not supported, negotiation could fail if TLS 1.2 is not allowed. This is the case with tls13.crypto.mozilla.org.
2018-08-11tls13/scan: poke for the final TLS 1.3 versionPeter Wu1-4/+14
2018-08-11tls13/scan: add tool to scan for supported TLS 1.3 draftsPeter Wu1-0/+312
Source is from April 3rd, 2018 or before.
2018-08-04make-libs: ensure directory prefixPeter Wu1-20/+21
Ensure that files are put within a subdirectory within the zip. Remove extra info (timestamps/uid/gid) and sort the URLs while at it.
2018-08-02windows-libs: add script to build gcrypt libs packagePeter Wu1-0/+80
Tested with MSVC 2015 (Win64) and the WireGuard patches on top of v2.9.0rc0-1338-g9b9a0d0f88. The decryption suite (43 tests) passes. README.Wireshark is based on Pascal's instructions from libgcrypt-1.7.6-win64ws.zip
2018-07-31sync-build.sh: drop obsolete cmake options, ignore some changesPeter Wu1-5/+2
Do not wake up on running tests (which might touch __pycache__ and pytest files).
2018-07-31tcp-reassembly.py: relative sequence numbersPeter Wu1-1/+2
Change from 2018-07-19 13:03 +0200
2018-07-19tcp-reassembly.py: report frame and overlap for retransmissionPeter Wu1-8/+28
2018-07-19tcp-reassembly.py: fix handling of packets with ip.len==0Peter Wu1-2/+2
As present in frame 3 of 25.pcap from https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13523
2018-07-19tcp-reassembly.py: add utility to investigate TCP reassembly issuesPeter Wu1-0/+252
While working on improving handling of reassembly in presence of retransmissions, it would be very helpful to have a tool that tells the correct interpretation. This tool does that. It can probably not directly be implemented in Wireshark due to the additional memory requirements. Used to investigate bugs such as https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13523 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13061
2018-07-12crafted-pkt/retransmit-overlap.py: test for bug 13523Peter Wu1-0/+43
Used for crafting the capture in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13523#c1
2018-07-06crafted-pkt/badsegments.py: test Follow TCP Stream edge casesPeter Wu1-0/+110
For testing various issues such as https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14944 Code coverage checked with Clang 6.0.0 by building packet-tcp.c with options from https://clang.llvm.org/docs/SourceBasedCodeCoverage.html # link.sh is the command to link libwireshark.so with the two profiling options eval $(jq -r '.[] | select(.file | contains("packet-tcp.c")) | .command' compile_commands.json | sed 's/^[^ ]\+/clang -fprofile-instr-generate -fcoverage-mapping/') && time bash link.sh llvm-profdata merge -sparse tcp.profraw -o tcp.profdata && llvm-cov show epan/dissectors/CMakeFiles/dissectors.dir/packet-tcp.c.o -instr-profile=tcp.profdata /tmp/wireshark/epan/dissectors/packet-tcp.c -name-regex='check_follow_fragments|follow_tcp_tap_listener' Tested against https://code.wireshark.org/review/#/c/28614/4 with log: 1c6dc6d31f (master) Some fixes. 777dac163a Follow Stream: ensure linear performance with many packets b853858e84 tcp: remove repetitive "follow_record->is_server" 98c33f532e tcp: fix Follow TCP Stream with missing (but ACKed) segments 8f4abb0346 tcp: fix Follow TCP Stream for overlapping data 9219c4b1b6 tcp: ignore zero-length payloads for Follow TCP Stream 9499a15a4a Qt: fix wrong Follow Stream text position after changing mode All cases are covered, except for one: 1122| 1| data_offset = follow_info->seq[is_server] - sequence; 1123| 1| if (data_length <= data_offset) { 1124| 0| data_length = 0; 1125| 1| } else { To reach that situation, the IP header probably needs to be modified, or the pcap snaplen/caplen fields. Too much work for now and a visual inspection shows that the case does not hurt, so just go for it.
2017-11-09Add exportpdy.py, a layer for ScapyPeter Wu1-0/+121
Can be imported as Python module or used separately. Created at 2017-04-23 for converting oss-fuzz reproducers into an actual pcap.
2017-11-07sync-build: enable ASAN/UBSAN via option, remove gcrypt optionPeter Wu1-1/+2
GCRYPT is enabled by default, the option is gone since 2.4. Enable the ASAN option via CMake to ensure that building lemon does not fail if detect_leaks is not set.
2017-11-07lua/trivial: add some more commentsPeter Wu1-7/+23
And remove the unnecessary nothing() function, it was there to test a crash issue.
2017-11-07lua/trivial: trivial protocol examplePeter Wu1-0/+23
Added in 2015-09-27, contains a minimal dissector that does not use fields.
2017-02-25src/sslkeylog.c: fix post-interception tapping for OpenSSL 1.1.0Peter Wu1-27/+40
Lookup SSL_SESSION_get_master_key and SSL_get_client_random at runtime too after intercepting a call instead of a link-time dependency.
2017-02-24src/sslkeylog.c: avoid linker errorsPeter Wu1-25/+42
Since the previous OpenSSL 1.1.0 compatibility patch, addition of the SSL_get_session and SSL_SESSION_get_master_key required them to be available at load time. Since applications are not necessarily linked with -lssl, this can fail. Avoid this dependency by looking up the symbols at runtime. Tested with OpenSSL 1.0.2.k (using python+requests) and OpenSSL_1_1_0-pre6-1439-g0e2c7b3ee (openssl s_client).
2017-01-29notes.txt: add GnuTLS usage for generating pcapsPeter Wu1-0/+12
These steps were used for creating the tests for https://code.wireshark.org/review/19850 ("test: add (D)TLS test for AEAD ciphers")
2016-12-22file-zip: remove "._" from field namesPeter Wu1-1/+1
These were not supposed to be exposed in the actual filters, but are used internally because a table value could not act as both a ProtoField and a table of other ProtoFields.
2016-12-22file-zip: further speed up DD searchPeter Wu1-14/+13
The previous implementation took 8.9 seconds with this command: tshark -Xlua_script:file-zip.lua -r TechnicLauncher.jar -Vx -ozip_archive.decompress:FALSE If the signature was not optional, we could optimize and avoid a linear search, using string.find with steps of four bytes on negative match. This would take 5.6 seconds (but does not handle a missing signature). The combined approach that first scans with string.find (assuming a signature) and then falling back to a linear search (assuming no signature) would take 14.4 seconds (terrible in the worst case). So try another approach, doing a byte for byte search (as before), but then delaying the signature check until the length is valid. This improves the running time to 7.5 seconds.
2016-12-22file-zip: speed up data descriptor scanningPeter Wu1-7/+7
Reduce time to process TechnicLauncher.jar from 20 to 9 seconds (ASAN build with tshark -Vx) by reducing TvbRange allocations.
2016-12-22file-zip: allow decompression to be disabledPeter Wu1-2/+4
Allow decompression to be disabled for performance reasons.
2016-12-22file-zip: decode External File AttributesPeter Wu1-2/+14
Found also hints via http://unix.stackexchange.com/q/14705/8250 Anslysis of unix/unix.c was done on Info-ZIP 6.0.
2016-12-21file-zip: decode version field, update referencesPeter Wu1-15/+57
System mappings are taken from the APPNOTE.
2016-12-21file-zip: Deflate decompression supportPeter Wu1-0/+9
2016-12-21file-zip.lua: fix data length readoutPeter Wu1-1/+1
Finally parses dex2jar-2.0.zip now :-)
2016-12-21file-zip: compr method and extra attrsPeter Wu1-2/+14
2016-12-21file-zip: recognize Extra data and Jar magicPeter Wu1-4/+22
Jar magic found via https://github.com/openjdk/jdk7-jdk/blob/f977378235c3f9a73b6f90980cbbcb3c78263c30/src/share/classes/java/util/jar/JarOutputStream.java#L103
2016-12-21zip-file: decode more flagsPeter Wu1-12/+37
Based on spec from https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
2016-12-21file-zip: implement heuristics to find DDPeter Wu1-15/+51
To be able to scan linearly, apply heuristics.
2016-12-21file-zip: WIP for data descriptorPeter Wu1-12/+60
Well, this does not work because the actual data size is unknown... And it turns out that you really have to parse the EoCD first, otherwise .jar files cannot be parsed...
2016-12-21file-zip: implement End of Central Directory RecordPeter Wu1-3/+31
And also added missing fields for CD. Both were mostly scripted based on the tables from Wikipedia.
2016-12-21file-zip: implement Central Directory recordPeter Wu1-6/+60
2016-12-21file-zip: decode local file headerPeter Wu1-1/+104
2016-12-21file-zip: start of a Zip Archive file dissector for WiresharkPeter Wu1-0/+95
Implemented a template for opening a file and making it available to dissectors. For this, a FileHandler has been implemented which then links with the MIME encapsulation type. The "seek_read" issue mentioned in the comments should be fixed with https://code.wireshark.org/review/19366
2016-12-21notes,sync-build.sh: notes for MPX, build adjustmentsPeter Wu2-4/+29
Append to PATH to avoid clobbering it when putting ccache in $PATH. Enable SBC codec for testing. Enable debug-prefix-map, should make relocatable debug builds easier (where I build in a different directory and move it).
2016-12-02sipsim/codecs.txt: add g729Peter Wu1-2/+2
Created a sample (sip-rtp-g729a.pcap) using FreeSWITCH 1.6.12 and mod_bcfg729 (https://github.com/xadhoom/mod_bcg729).
2016-12-02Added SIPp scenario and list of codecs supported by FSPeter Wu2-0/+149
Requires appropriately configured FreeSWITCH server that responds to a call to sip:test@host by playing a fragment, then hanging up. SIPp scenario was used to create a bunch of captures, uploaded to https://wiki.wireshark.org/SampleCaptures#SIP_and_RTP
2016-09-24extcap/ssh-tcpdump: example remote tcpdumpPeter Wu1-0/+124
Requires Python 3.4, but it can be adapted for older versions. It demonstrates how "easy" it is to capture remotely over SSH when only tcpdump is installed without dumpcap (in that case you could use sshdump). Note that on stopping/restarting captures, you still get some stderr messages ("Dropped privileges", but that can be ignored). See also https://ask.wireshark.org/questions/55768/remote-interface-linux
2016-09-17openssl-connect: fix support for more PSK ciphersPeter Wu1-1/+7
Match also stuff like DHE-PSK-AES128-CCM8. Improve error message if cipher is not accepted by OpenSSL.
2016-09-17openssl-{connect,listen}: OpenSSL 1.1.0 compatPeter Wu2-6/+6
The options parser has changed, options now have to precede the parameters (possible a bug, already reported to rt.openssl.org with subject "Options after parameters are ignored in OpenSSL 1.1.0"). While at it, use COMPLEMENTOFALL instead of NULL since that possibly includes more ciphers.
2016-09-17make-tcp.py: use HTTP (which activates reassembly)Peter Wu1-14/+12
2016-09-17make-tcp.py: create a crafted packet with TCP issuesPeter Wu1-0/+56
Prompted by https://code.wireshark.org/review/17749
2016-08-16src/sslkeylog.c: OpenSSL 1.1.0 compatibilityPeter Wu1-18/+48
OpenSSL 1.1.0 makes some structures opaque, but luckily it provides new functions to extract the client random and master secret which is all we need from the structures. Tested with OpenSSL 1.1.0-pre6 using openssl s_client and OpenSSL 1.0.2.h using curl.
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-04 19:40:21 +0000