| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Useful to build just tshark if I want to test a dissector.
|
|
Switch to bash as there is no readable / easy way to make it compatible
for all shells in the world.
|
|
Avoids the need to manually touch /tmp/sync-build-* to trigger a build
on startup. Can be overridden with the NOTRIGGER=1 env.
|
|
Master keys are available in the capture file comments.
This contains a HTTP request and a HTML response without Content-Length
over SSL. It is also
attached to https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9154
|
|
Master keys are available in the capture file comments.
This contains a HTTP request and chunked response over SSL. It is also
attached to https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11079
|
|
Let 'localhost' bypass SSH so I can still use its watch functionality,
but build locally.
Use -fno-common to workaround bug
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65285
Disable verbose warnings and disable werror to reduce the huge trace of
warnings which make me overlook real issues.
|
|
Master keys are available in the capture file comments.
Installed rabbitmq-server on Ubuntu 14.04 (upgraded halfway to 14.10)
and wrote /etc/rabbitmq/rabbitmq.config with appriopriate certs:
[
{rabbit,
[
{ssl_listeners, [5671]},
{ssl_options, [{cacertfile, "/etc/rabbitmq/cert.pem"},
{certfile, "/etc/rabbitmq/cert.pem"},
{keyfile, "/etc/rabbitmq/key.pem"},
{verify, verify_peer},
{fail_if_no_peer_cert, false}]}
]}
].
amqp-tools (amqp-publish, etc.) did not work, so a quick Celery script
was used (install python-celery):
from celery import Celery
app = Celery('tasks', broker='amqp://guest@localhost:5671/')
app.conf.update(BROKER_USE_SSL=True)
@app.task
def add(x, y):
return x + y
print(add.delay(3, 4))
|
|
Consists of a single TCP stream with SIP over Websockets (port 10080).
Created with http://tryit.jssip.net/ and Chromium.
|
|
Master keys (for TCP[port=8082]/SSL/WebSocket/JSON and for DTLS-SRTP)
are present in the capture file comments.
Created by starting Chromium 40.0.2214.111 with a new profile, disabling
any settings that could cause network interference (also set
about:blank as home page). Visit
https://webrtc.freeswitch.org/verto/index.html to load everything in
cache.
Then restart with the sandbox disabled to avoid the suid sandbox (which
interferes with getting SSL keys from DTLS-SRTP) and start the actual
capture.
Command to launch the browser:
SSLKEYLOGFILE=premaster.txt \
chromium --user-data-dir=/tmp/cr \
--disable-component-extensions-with-background-pages \
--disable-web-resource --disable-background-networking \
--disable-sandbox --single-process
Analyse with:
capinfos -k webrtc-freeswitch.pcapng |
grep -Po 'CLIENT_RANDOM \S+ \S+' > premaster.txt
wireshark -r webrtc-freeswitch.pcapng \
-o ssl.keylog_file:premaster.txt \
-o dtls.keylog_file:premaster.txt \
-o http.ssl.port:8082
|
|
|
|
Ninja can strip colors if needed, but otherwise it needs to be forced on
https://github.com/martine/ninja/issues/174
|
|
Ninja is awesome, it is faster than Unix Makefiles!
|
|
Useful to find regressions in the GUI by manual inspection.
|
|
Saves myself from typing another gdb wrapper that sets ASAN_OPTIONS and
G_SLICE.
https://code.google.com/p/address-sanitizer/wiki/Flags
https://developer.gnome.org/glib/unstable/glib-running.html
|
|
Default CXXFLAGS to CFLAGS (previously it would always use CFLAGS
anyway due to a typo), do not require schroot, use 2*nproc instead of
hardcoded 16 jobs. Document envvars.
|
|
Software versions, pre-master keys are available in the capture file
comments. For convenience, the versions are:
nghttp2/v0.7.3-74-g795a22a
spdylay/v1.3.1-16-gf4bcaee
openssl/1.0.2
Commands:
openssl req -newkey rsa:2048 -x509 -nodes -keyout server.pem -new \
-out server.pem -subj /CN=localhost
socat TCP-LISTEN:4433,reuseaddr,fork TCP-CONNECT:127.0.0.1:4433
./nghttpd 4433 server.pem server.pem
./nghttp https://localhost/
|
|
There is packaging/macosx/native-gtk/config.h
|
|
Pre-master keys are available in the capture file comments.
This selects something from a table and queries 'SHOW VARIABLES' over
ethernet (mtu 1500). It demonstrates a TLS record spanning multiple TCP
segments.
|
|
Pre-master keys are available in the capture file comments.
Install slapd 2.4.31-1+nmu2ubuntu8 ldap-utils 2.4.31-1+nmu2ubuntu8
cd /etc/ldap/ssl
openssl req -newkey rsa:1024 -x509 -nodes -out slapd.pem -keyout \
slapd.pem -days 3650 -subj /CN='LDAP SSL test/'
chown openldap: slapd.pem && chmod 600 slapd.pem
cat <<EOF | ldapmodify -Y EXTERNAL -H ldapi:///
dn: cn=config
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/slapd.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd.pem
EOF
/etc/init.d/slapd restart
Client:
gdb -q -ex break\ gnutls_handshake -ex r --args \
ldapsearch -ZZ ldap://127.0.0.1:389
p session
p/x ((gnutls_session_t)$1)->security_parameters->client_random
p/x ((gnutls_session_t)$1)->security_parameters->master_secret
c
|
|
Pre-master keys are available in the capture file comments.
Ubuntu 14.04 server with postgresql-9.3 (assume snakeoil certificates,
change listen_addresses='0.0.0.0' and restart). Then create user and db:
createuser -P test
createdb -O test testdb
Client:
psql postgresql://test:pass@127.0.0.1/testdb?sslmode=require
Capture file contains queries (create table, insert, select).
|
|
premaster secrets is available in capture file comments.
Similar to smtp-ssl.pcapng, but running over non-standard port 2525 to
exercise "Decode As" functionality.
|
|
|
|
Pre-master keys are available in the capture file comments.
Server is Ubuntu 14.04 with dovecot-imapd and port 143 enabled in
/etc/dovecot/conf.d/10-master.conf.
Client:
openssl s_client -starttls imap -connect localhost:143
Contains "a001 CAPABILITY" followed by renegotiation, "a002 CAPABILITY"
and "QUIT".
|
|
Pre-master keys are available in the capture file comments.
Server is Ubuntu 14.04 with dovecot-pop3d and port 110 enabled in
/etc/dovecot/conf.d/10-master.conf.
Client:
openssl s_client -starttls pop3 -connect localhost:110
Contains "POPA" followed by renegotiation, "POPA" and "QUIT".
|
|
Premaster secret is available in capture file comments.
Capture file generated with an invalid authentication attempt using
TLSv1.2:
git clone https://github.com/fritzy/SleekXMPP.git
cd SleekXMPP
PYTHONPATH=. \
python examples/ping.py -d -j wireshark-test@jabber.org -p none
|
|
This solves a null deref in python ssl module in SSL_do_handshake.
|
|
premaster secrets is available in capture file comments.
Server is Ubuntu 14.04 running Exim 4.82-3ubuntu2 (using GnuTLS) and
configured with:
/usr/share/doc/exim4-base/examples/exim-gencert
echo MAIN_TLS_ENABLE=1 >/etc/exim4/exim4.conf.localmacros
Client:
sudo socat TCP-LISTEN:25 TCP-CONNECT:... # (port forward)
openssl s_client -starttls smtp -connect localhost:25
After handshake, I typed "EHLO lekensteyn" and triggered a renegiotation
with "R" (which somehow resulted in an error).
|
|
pre-master secrets is in capture file comments, certificate is snakeoil.
Server is Ubuntu 14.04 VM with MariaDB 5.5.40-0ubuntu0.14.04.1, snakeoil
certificate and these my.cnf configs:
bind-address=0.0.0.0
ssl-ca=/etc/ssl/certs/ssl-cert-snakeoil.pem
ssl-cert=/etc/ssl/certs/ssl-cert-snakeoil.pem
ssl-key=/etc/mysql/ssl-cert-snakeoil.key
Pre-processing:
CREATE USER testuser@'%' IDENTIFIED BY 'pass';
CREATE DATABASE testdb;
GRANT ALL ON testdb.* TO test@'%';
Client started with:
mysql -utest -ppass -h127.0.0.1 --ssl-ca=ssl-cert-snakeoil.pem
The capture contains queries (INSERT, SELECT, deliberate disallowed `USE
mysql` and more).
|
|
|
|
These functions can trigger a renegotiation which changes the key
material (detected by using `curl` and `openssl s_server` and pressing
`R` in `openssl s_server`).
|
|
SSL_connect is somehow called multiple times on the same connection
by curl, this may result in duplicate keylog file entries. Detect when
the state changes, and only print the keys if it has changed.
|
|
Also intercept SSL_do_handshake (nginx) and SSL_accept (s_server).
|
|
Try to dump as many keys as possible, even if a fatal alert occurred.
Wireshark does not support SSLv2, so check that a successful connection
does not use SSLv2 before dumping keys (this fixes a crash).
|
|
This follows the preference name ssl.keylog_file.
|
|
Master-Key, Key-Arg (from curl output) and 512-bit RSA keys are
available in the capture file comments.
Key and certificates are generated with:
openssl req -newkey rsa:384 -x509 -nodes -keyout server.pem -new \
-out server.pem -subj /CN='Very Secure' -md5
Server (openssl 1.0.2) was started with:
openssl s_server -ssl2 -www
Client (curl 7.40.0-DEV with `!defined(HAVE_SSLV2_CLIENT_METHOD)`
removed):
curl -vk --sslv2 https://127.0.0.1:4433
|
|
For a gdb function, see http://security.stackexchange.com/a/80174/2630
To generate the line assuming you have a context with a SSL structure
(named "s") run this:
python
def read_as_hex(name, size):
addr = gdb.parse_and_eval(name).address
data = gdb.selected_inferior().read_memory(addr, size)
return ''.join('%02X' % ord(x) for x in data)
def pm(ssl='s'):
mk = read_as_hex('%s->session->master_key' % ssl, 48)
cr = read_as_hex('%s->s3->client_random' % ssl, 32)
print('CLIENT_RANDOM %s %s' % (cr, mk))
end
python pm()
|
|
Last modified on 29 July 2014, but it should still apply.
|
|
|
|
|
|
Prints Last-Modified, Content-Length and URL for tshark -O http output.
Used for analyzing a vc_web install capture.
|
|
Also allows you to override CC/CXX (for Clang support), fix
/tmp/wireshark/ symlink and /tmp/wsbuild/run/ sync, enable some
additional modules (but disable SBC which would be used for Bluetooth
audio support), pass -DCMAKE_EXPORT_COMPILE_COMMANDS (for clang-check
iirc).
|
|
|
|
This script helps me in syncing sources with a remote build machine and
building changes once I have made a local change. It also syncs back
generated binaries.
|
|
|
|
Not all bytes were captured, it turns out that data was never read (and
thus the send buffer becames full) which leads to data loss when the
connection is closed.
|
|
The common case is replaying a capture, so avoid all tshark boilerplate
and run the command in the script. Fix the mixup of server and client
sockets ("if reply, then write from the server socket"). Allow
chunk size to be customized.
|
|
|
|
|
|
Since wireshark rev54039
|
|
|
