summaryrefslogtreecommitdiff
path: root/epan/dissectors/packet-dtls.c
AgeCommit message (Collapse)AuthorFilesLines
2017-06-02Fix Decode As for protocols that may use tunneling.Irene Ruengeler1-5/+43
Dissectors that rely on pinfo structure information may have the data overwritten if the data is tunneled. Address it by using proto data that is based on pinfo->curr_layer_num. Bug: 13746 Change-Id: I1c29f26a3c49f368876f0e96908705bc9c099ce1 Reviewed-on: https://code.wireshark.org/review/21559 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-29Fix up dissector tables' UI names.Jeff Morriss1-1/+1
This was inspired by using the Decode-As UI to decode Field "SSL TCP Dissector" Value (port) XXX as YYY. "SSL Port" makes more sense as the UI name. Change-Id: Id6398a5dc79e32bddc4f1bfcf0a468ae1364808f Reviewed-on: https://code.wireshark.org/review/19573 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-14ssl,dtls: fix message hash for extended_master_secretPeter Wu1-2/+36
The handshake_messages for extended master secret start at Client Hello and end at ClientKeyExchange. Previously all handshake messages in a record would be hashed, possibly covering those after CKE. Now it will hash each handshake message separately. For DTLS, the CH and HVR messages must also be ignored. Additionally, DTLS needs special treatment to merge multiple fragments. Bug: 13704 Change-Id: I0c8f19b4c352c0195848ded319b6991d76542720 Reviewed-on: https://code.wireshark.org/review/21625 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-04-17Qt: Provide both file save and open preferencesAhmad Fatoum1-1/+1
This is a breaking change. prefs_register_filename_preference hasn't been differentiating between files to be saved and ones to be opened. On GTK, a neutral dialog is used, so no problems there. On Qt, a save dialog has been always used, even in dissectors that were reading configuration files without modification. prefs_register_filename_preference now takes an argument to indicate whether UI could be a save dialog with a warning on overwriting a file, or whether it's a general purpose open file dialog. Qt now does this. Previously no warning was shown on overwriting a file, so it may be used for opening files too without irritating the user. This has been changed, as non-destructive reads should now use the open dialog. Dissectors were changed accordingly. Change-Id: I9087fefa5ee7ca58de0775d4fe2c0fdcfa3a3018 Reviewed-on: https://code.wireshark.org/review/21086 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-03-18TLS13: update end_of_early_data to draft -19Peter Wu1-0/+1
It changed from an alert to a handshake message. Change-Id: Ic24776e612a291153290543ba1ec8680d9d74264 Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/20586 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-14DTLS: Cookie formatting fix for HVRRobert Cragie1-21/+17
Cookie format for HelloVerifyRequest inconsistent with that in ClientHello. Changed to be consistent. Change-Id: I79809ebc4bd4a1c5b43b44a21f58ad5b5d5a1bcf Reviewed-on: https://code.wireshark.org/review/20544 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-16ssl-utils: refactor DigitallySignedPeter Wu1-2/+2
Refactor DigitallySigned dissection to return the length and make it accept a version integer instead of Session pointer. Hopefully this makes it easier to use the routine for SCT dissection in X.509 certs. While at it, convert it to use ssl_add_vector. Change-Id: I64afecc65ff597fda50d208d8f96ca0b97bfcbde Reviewed-on: https://code.wireshark.org/review/20111 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-02-15TLS13: dissect NewSessionTicket and CertificateRequest extensionsPeter Wu1-3/+3
Process NewSessionTicket and CertificateRequest extensions for TLS 1.3. CertificateExtension in draft -18 is replaced by Extension in the next draft, so anticipate for that and start decoding this extensions vector. Rename ssl_dissect_hnd_hello_ext to reflect extended functionality. (Certificate Extensions SCT is still not dissected though, but at least OCSP (status_request(_v2)) is supported now.) Change-Id: I3cae58dbde600e82598b3c2f8e29e92e38cd1db1 Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/20104 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-15ssl,dtls: fix wrong expert info for overly large recordsPeter Wu1-5/+3
The plaintext length is limited to 2^14, but the actual record length (TLSCiphertext) may be larger due to expansion from compression and the cipher (like AEAD auth tags). The wrong check led to false expert infos. Change-Id: I3a56f1b0af05ecc1d97c4f1f0bcf35ff4d0fad42 Fixes: v2.3.0rc0-1584-gff0371e898 ("ssl,dtls: add expert info for overly large record lengths") Reviewed-on: https://code.wireshark.org/review/20099 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-13Make Libgcrypt a mandatory dependencyPeter Wu1-7/+3
Removed all guards for HAVE_LIBGCRYPT, change autotools and CMake to error out if it is not available. Update release notes, developer documentation and README with the new status. Clarify relation with GnuTLS in macosx-setup.sh. Install Libgcrypt via brew script. Motivation for this change is that many dissectors depend on Libgcrypt and having it optional increases the maintenance burden (there have been several compile issues in the past due to the optional status). Furthermore, wsutil has crypto code that can be replaced by Libgcrypt. Change-Id: Idf0021b8c4cd5db70b8766f7dcc2a8b3acbf042f Link: https://www.wireshark.org/lists/wireshark-dev/201702/msg00011.html Reviewed-on: https://code.wireshark.org/review/20030 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-11TLS13: add Key Update dissectionPeter Wu1-0/+1
Actual decryption support will be added later. Ping-Bug: 12779 Change-Id: I3ff1f243fd0bd1467e84d8a6a5433c1fe71bbebf Reviewed-on: https://code.wireshark.org/review/20012 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-11ssl-utils: add length validation for Certificate handshake messagePeter Wu1-1/+1
This also introduces a new macro, "G_MAXUINT24" as symbol for 2^24-1 (this name does not exist in GLib and uncommon in Google). Change-Id: If000f41f6286161e3a7697357fc33ae16c1e11db Reviewed-on: https://code.wireshark.org/review/20003 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-11TLS13: fix length of Finished messagePeter Wu1-1/+1
Select the full message instead of just the first 12 bytes (as was the case in previous TLS versions. No check is added since it is too much work for little gain (it would require looking up the hash length for the cipher suite). Change-Id: Iea13d5abe6a7e55b04fabacfa8919a02acd8517d Reviewed-on: https://code.wireshark.org/review/20011 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-07TLS13: update NewSessionTicket dissectionPeter Wu1-2/+2
The new ticket_age_add field resulted in a dissector exception. With this fixed, the tls13-18-picotls-earlydata.pcap capture can now be fully decrypted. Also add validation for the ticket length (using ssl_add_vector). Change-Id: I167038f682b47b2d1da020a8f241daaf7af22017 Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/19992 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-02-06(D)TLS: simplify SignatureAndHashAlgorithm dissectionPeter Wu1-1/+1
Merge the length parsing into the SignatureAndHashAlgorithm vector parsing. Remove extra expert info which are replaced by the generic ones. Tested with a mutated pcap where the signature length field is off by one (too large = expert error, too small = expert warning, as expected). Change-Id: I43350352ae00eb42bbe5c2ee81289fb592b88f86 Reviewed-on: https://code.wireshark.org/review/19933 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-02-02dtls: Support Decode As for selecting appdata dissectorPeter Wu1-1/+41
Being able to override (set) the application data dissector without hacks (RSA keys dialog) would be nice. Modelled after v2.3.0rc0-481-gafa2605e43 ("Support Decode As for {SSL,TLS}-over-TCP.") Change-Id: Ic4c5ca55e8f20ad599c41c1df58b24f3bced2281 Reviewed-on: https://code.wireshark.org/review/19869 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-01dtls: avoid possible NULL derefPeter Wu1-9/+3
"decoder->flow" could result in a NULL pointer dereference if a null cipher was in use (caught by Clang static analyzer). Answering the questions: - DTLS records fragments do not need to be reassembled, thus there is no flow. The Handshake messages have their own fragment_offset field and thus there is no need to maintain an extra flow. - Actually one datagram can contain multiple records (RFC 6347, 4.1.1), but this is not implemented yet. The key can however not be "0" though, it must match the offsets from ssl_get_record_info. Fixes: v2.3.0rc0-2152-g77404250d5 ("(D)TLS: consolidate and simplify decrypted records handling") Change-Id: Iac367a68a2936559cd5d557f877c5598114cadca Reviewed-on: https://code.wireshark.org/review/19892 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-01-31TLS13: add Encrypted ExtensionsPeter Wu1-0/+1
See https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.3.1 Change-Id: I35e049d991be4c242ef2b84db3a322c6a13d2f96 Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/19860 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-31ssl-utils: refactor AEAD decryption handlingPeter Wu1-4/+5
The current ssl_decrypt_record is hard to understand due to mixing CBC concepts (MAC, padding) with AEAD. Extract the AEAD functionality and use better variable naming. The "Plaintext" debug print now includes just the plaintext (the auth tag is stripped). A write_iv.data_len check is added just to be sure and more prep work is done for auth tag validation and TLS 1.3 support. Tested against the (D)TLS AEAD tests on Libgcrypt 1.4.5 (CentOS 6), 1.6.5 (Ubuntu 14.04), 1.7.6 (Arch Linux). Compile-tested w/o Libgcrypt. Change-Id: I94dd2fd70e1281d85c954abfe523f7483d9ac68b Reviewed-on: https://code.wireshark.org/review/19852 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-01-31dtls: fallback to data dissector if nothing took care of itPeter Wu1-5/+6
Also unconditionally show the encrypted appdata record, matching the SSL dissector. Now the bytes are always linked to a field. Change-Id: Ie65cd5fc6620d53da46a94cdb1972863702b452c Reviewed-on: https://code.wireshark.org/review/19868 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-01-29(D)TLS: fix type of record sequence numberPeter Wu1-2/+2
The record sequence number is 64-bit, not 32-bit. This applies to all SSLv3/TLS/DTLS versions. Without this fix, after about four million records, the wrong MAC is calculated (for TLS 1.2) or decryption will fail (for TLS 1.3). Change-Id: I05e5e8bc4229ac443a1b06c5fe984fb885eab1ca Reviewed-on: https://code.wireshark.org/review/19824 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-01-29Register reassembly tablesMichael Mann1-2/+2
Register all reassembly tables with a central unit, allowing the central unit to have the callback that initializes and destroys the reassembly tables, rather than have dissectors do it individually. Change-Id: Ic92619c06fb5ba6f1c3012f613cae14982e101d4 Reviewed-on: https://code.wireshark.org/review/19834 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-28TLS: fix decryption of renegotiated sessionsPeter Wu1-3/+0
Renegotiated sessions may interleave application data with handshake records. These handshake records should however not be included in the flow associated with the application data. This fixes a regression in the previous patch, now the "1.12 Step: SSL Decryption (renegotiation)" test passes again. Also remove duplicate DTLS data sources for decrypted records. Change-Id: I46d416ffba11a7c25c5a682b3b53f06d10d4ab79 Fixes: v2.3.0rc0-2152-g77404250d5 ("(D)TLS: consolidate and simplify decrypted records handling") Reviewed-on: https://code.wireshark.org/review/19822 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-01-28(D)TLS: consolidate and simplify decrypted records handlingPeter Wu1-74/+44
Previously there was a distinction between decrypted handshake Application Data records ("Decrypted SSL data") and some others (like Alerts, Handshake and Heartbeat, "Decrypted SSL record"). Remove this distinction and always decrypt the payload before passing it on and always display a data sources for decrypted contents ("Decrypted SSL"). This is prepatory work for TLS 1.3 support where the content type is located in the encrypted record, having the record decryption in one place makes it easier to adapt. Change-Id: I92c51c7f9e87e5c93231d28c39a8e896f5afd1ef Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/19789 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-01-12uat: fix build error without libgcrypt/gnutlsDario Lombardo1-0/+2
Change-Id: I00fea4d2e8c4d7fc8fc54627ced21796d40b854a Reviewed-on: https://code.wireshark.org/review/19616 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-12uat: add a reset callback.Dario Lombardo1-0/+8
This function will free the resources allocated by the caller. Change-Id: Ib486c14e4fd3c321662fb71f7fd06733ce9a64a4 Reviewed-on: https://code.wireshark.org/review/19375 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-31Dissectors don't need a journey of self discovery.Michael Mann1-3/+2
They already know who they are when they register themselves. Saving the handle then to avoid finding it later. Not sure if this will increase unnecessary register_dissector functions (instead of using create_dissector_handle in proto_reg_handoff function) when other dissectors copy/paste, but it should make startup time a few microseconds better. Change-Id: I3839be791b32b84887ac51a6a65fb5733e9f1f43 Reviewed-on: https://code.wireshark.org/review/19481 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-06DTLS: add support for use_srtp extension (RFC 5764)Peter Wu1-1/+86
Decryption support will be added later. Tested with dtls-srtp-ws-sip.pcapng from the linked bug. Change-Id: Ida1a2da754ef9aef16ad15ff64455b6f8e703ffd Ping-Bug: 13193 Reviewed-on: https://code.wireshark.org/review/18996 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-11-30ssl,dtls: add expert info for overly large record lengthsPeter Wu1-1/+5
All TLS and DTLS RFCs (and SSLv3) limit the record length to 2^14, so add expert info if this is exceeded. Spotted in the wild via https://ask.wireshark.org/questions/57641/tls12-record-length-gt-16k-valid Tested with a synthetic pcap having length 2^14+1 using Python: from scapy.all import IP, TCP, UDP, wrpcap len_plus_frag = b'\x40\x01' + 0x4001 * b'\0' wrpcap('bad-record-length.pcap', [ IP()/TCP(sport=2000, dport=443)/(b'\x17\x03\x03' + len_plus_frag), IP()/UDP(sport=2000, dport=853)/(b'\x17\xfe\xfd' + 8*b'\0' + len_plus_frag) ]) Change-Id: I5eac48775333d8d222e013a24a6d06da79892b77 Reviewed-on: https://code.wireshark.org/review/18959 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com> Petri-Dish: Graham Bloice <graham.bloice@trihedral.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-10-23dtls: use ws_strtoi function.Dario Lombardo1-2/+3
Change-Id: I4feacfa8e4739faf555c05e3c4823ad8487a994c Reviewed-on: https://code.wireshark.org/review/18392 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-07TLS(1.3): Add Hello Retry Request (6) extensionAlexis La Goutte1-0/+5
Add also special case on hello key_share extension Ping-Bug: 12779 Change-Id: Ib8e2dd060f322c2404a8afa9b8cb70de7c2c65b7 Reviewed-on: https://code.wireshark.org/review/18093 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-06ssl: really fix session resumption expert infoPeter Wu1-2/+7
In a two-pass dissection with renegotiated sessions, the is_session_resumed flag is not updated according to the current protocol flow. Fix this by performing detection of abbreviated handshakes in all cases, do not limit it to the decryption stage (where ssl != NULL). Reset the resumption assumption after the first ChangeCipherSpec (normally from the server side, but explicitly add this in case client packets somehow arrive earlier in the capture). This should not have a functional effect on normal TLS captures with Session Tickets. Bug: 12793 Change-Id: I1eb2a8262b4e359b8c1d3d0a1e004a9e856bec8c Reviewed-on: https://code.wireshark.org/review/17483 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-08-31Don't do any Decode As stuff for dissector tables not used with Decode As.Guy Harris1-1/+1
Have all dissector tables have a "supports Decode As" flag, which defaults to FALSE, and which is set to TRUE if a register_decode_as() refers to it. When adding a dissector to a dissector table with a given key, only add it for Decode As if the dissector table supports it. For non-FT_STRING dissector tables, always check for multiple entries for the same protocol with different dissectors, and report an error if we found them. This means there's no need for the creator of a dissector table to specify whether duplicates of that sort should be allowed - we always do the check when registering something for "Decode As" (in a non-FT_STRING dissector table), and just don't bother registering anything for "Decode As" if the dissector table doesn't support "Decode As", so there's no check done for those dissector tables. Change-Id: I4a1fdea3bddc2af27a65cfbca23edc99b26c0eed Reviewed-on: https://code.wireshark.org/review/17402 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-24dtls: remove unneeded checks (CID 1158712 & 1158716).Dario Lombardo1-13/+11
Change-Id: Id463f7746880f71f317bb52b40dc8b298965b4ec Reviewed-on: https://code.wireshark.org/review/17300 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-29Provide new interface for Export PDU.Michael Mann1-6/+2
Rather than have a bitmask for each desired field, have a dissector provide a list of structures that represent data that goes into the PDU. Change-Id: I125190cbaee489ebffb7d9f5d8bc6f3be2d06353 Reviewed-on: https://code.wireshark.org/review/16122 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-06-05Resolve false positive ERROR: NO ARRAY found in ei array entriesJim Young1-1/+1
The enhanced checkhf.pl in https://code.wireshark.org/review/#/c/15717/ validates ei items in addition to href items. This patch addresses the false positive ERRORS reported by the enhanced checkhf.pl for a "cosmetic" issue (missing space after { in ei array entries). Change-Id: I87876ce2cfa4b0e11cb22f457bd9ab025d939e5c Reviewed-on: https://code.wireshark.org/review/15739 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-04-18dtls: fix 'data' was marked unused but was used ↵Alexis La Goutte1-1/+1
[-Werror,-Wused-but-marked-unused] Change-Id: I919192b14159fd70bb7bf182507f1e42c3167721 Reviewed-on: https://code.wireshark.org/review/14983 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-03-31dtls: Fix ClientCertificateVerify dissectionPeter Wu1-1/+1
Pass the reassembled fragment instead of the current record. Bug: 11477 Change-Id: Id49fac8fa3f9e1b1904a75ab6c7512306f2071b0 Reviewed-on: https://code.wireshark.org/review/14727 Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-03-20Fix incorrect table being used to store Session TicketsAdam Schwalm1-1/+1
A regression was introduced at f4580ac9edc8b5351 where an additional hash table was introduced to store TLS Session Tickets separately from Session IDs. However, the New Session Ticket dissector was still storing the the Session Ticket in the ID table, causing lookups to fail. Change-Id: Iff49202f50afb8cb6ef62c774f6155682b8e48a6 Reviewed-on: https://code.wireshark.org/review/14499 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-03-17Associate dissector tables and heuristic subdissector lists with a protocol.Michael Mann1-2/+2
This will make it easier to determine protocol dependencies. Some LLC OUI dissector tables didn't have an associated protocol, so they were left without one (-1 used) Change-Id: I6339f16476510ef3f393d6fb5d8946419bfb4b7d Reviewed-on: https://code.wireshark.org/review/14446 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-24Add the packet number to the packet_info structure, and use it.Guy Harris1-1/+1
That removes most of the uses of the frame number field in the frame_data structure. Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22 Reviewed-on: https://code.wireshark.org/review/13509 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-09new_register_dissector -> register_dissector for dissector directory.Michael Mann1-1/+1
Change-Id: Ie39ef054a4a942687bd079f3a4d8c2cc55d5f22c Reviewed-on: https://code.wireshark.org/review/12485 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-23register_dissector -> new_register_dissectorMichael Mann1-10/+10
Change-Id: Ic368dd8e83cf39e0c934da0ae2744778e2d54ce6 Reviewed-on: https://code.wireshark.org/review/12050 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-16ssl,dtls: use ProtocolVersion from Server HelloPeter Wu1-42/+12
A DTLS capture from Jitsi Videobridge for Windows x64 (v519) using a (patched?) BouncyCastle 1.51.0 exposed the odd behavior where the ProtocolVersion from the record layer was always fixed to DTLSv1.2 while the server agrees to use DTLSv1.0. This resulted in a Malformed packet dissection of the ServerKeyExchange message which mistakenly expects a SignatureAndHash field. Fix this by using the protocol version from the ServerHello. Keep the fallback in case a capture starts in the middle of a SSL conversation. (Also display "DTLS" instead of "SSL" when the version is not yet determined for DTLS packets.) Bug: 11709 Change-Id: I0719977e3b2208da1960121b01dc109fa76bfcb6 Reviewed-on: https://code.wireshark.org/review/11821 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2015-11-16ssl,dtls: use a single field to track ProtocolVersionPeter Wu1-68/+14
The SslSession struct contains a "version" field for displaying purposes in the protocol column while the SslDecryptSession struct has a "version_netorder" field for use in TLS hash functions (for secrets calculations). As these are strongly associated with each other, remove the version_netorder field and its associated constants, let the SslSession version field store this value instead. All SSL_VER_* are renamed to appropriate *_VERSION macros (via search & replace), SSL_VER_UNKNOWN is kept though. The PCT and SSLv2 protocols had no wire value (*_VERSION), so SSL_VER_PCT and SSL_VER_SSLv2 are assigned with some arbitrary values. Warning: external plugins using the ssl_set_master_secret function must now pass the wire version (TLSV1_VERSION) instead of the (now removed) internal macros (SSL_VER_TLSv1). Change-Id: Icd8ef15adae9c62eb21eab1c3b812166e451936f Reviewed-on: https://code.wireshark.org/review/11820 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2015-11-09DTLS: fix no previous prototype for 'dtls_dissector_add/delete' ↵Alexis La Goutte1-0/+1
[-Wmissing-prototypes] Change-Id: Ib2be8c4ebbaf8492fe76632fae2b5076a44f74ce Reviewed-on: https://code.wireshark.org/review/11653 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-07Add support for registering protocols (dissectors) over DTLS.Michael Mann1-0/+12
This is intentionally broken off of SSL to avoid confusion when UDP is involved. Change-Id: Icfd3054be6aed2ebbd850a608efbc24f1a8f3831 Reviewed-on: https://code.wireshark.org/review/11612 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-07Create real dissector tables for SSL and DTLS to use.Michael Mann1-16/+53
Since ssl_dissector_[add|delete] only take TCP dissectors, remove the parameter and just use it within the "internal" ssl_association_add call. Change-Id: I0fdf941389934c20cbacf910250e17520614e706 Reviewed-on: https://code.wireshark.org/review/11591 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-07ssl: add expert info for session resumptionPeter Wu1-38/+5
Add expert info to the Change Cipher Spec tree when session resumption is detected. This can be used as hint that decryption using a RSA key file will not succeed because of missing key material. The name of this expert info is "ssl.resumed" or "dtls.resumed" and the expert info message is "This session reuses previously negotiated keys (Session resumption)". Change-Id: I4a83edb13417631c97d6cfc4a57e2086bd217878 Reviewed-on: https://code.wireshark.org/review/11583 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-07 08:52:56 +0000