aboutsummaryrefslogtreecommitdiffstats
path: root/test/config
AgeCommit message (Collapse)AuthorFilesLines
2021-01-20dot11decrypt: Add partial FT-EAP decryption supportMikael Kanstrup1-0/+1
Add partial support for decrypting captures with connections established using FT-EAP. To support deriving keys for FT-EAP the MSK is needed. This change adds MSK as a valid IEEE 802.11 protocol input key type preference as well. Note that FT-EAP support comes with the following imitations: - Keys can only be derived from the FT 4-way handshake messages. - Roaming is not supported.
2020-10-21dot11decrypt: Fix WEP decryptionMikael Kanstrup1-0/+1
For WPA security association (SA) entries are created on sucessful PTK derivation from 4-way handshake frames. WEP though don't use 4-way handshake frames for key derivation and therefore no SA entry is created. Still WEP decryption implementaton expects to find an SA otherwise the decryption is skipped. Fix broken WEP decryption by removing the check for an existing SA entry and instead form the SA on first successful decryption. Add also a test for WEP decryption. Fixes: v3.3.0rc0-1263-g099d241046 ("dot11decrypt: Avoid allocating SA on packet decryption")
2020-06-01dot11decrypt: Support decryption using TK user inputMikael Kanstrup1-0/+12
Add support for TK user input keys. With this Wireshark can decrypt packet captures where 4WHS frames are missing and packet captures with non-supported AKMS, for example 802.11r / Fast BSS Transitioning. Decryption using user TK works as a backup if the normal decryption flow does not succeed. Having TK decryption keys added will affect general IEEE 802.11 dissector performance as each encrypted packet will be tested with every TK. Worst case scenario is plenty of TKs where none of them matches encrypted frames. On successful user TK decryption an SA is formed based on parameters used to decrypt the frame. This SA is similar to what is formed when Wireshark detects and derive keys from 4WHS messages. With the SA entry in place the decryption performance (success case) should be on par with "normal" decryption flow. Bug: 16579 Change-Id: I72c2c1e2c6693131d3ba07f8ddb8ff772c1b54a9 Reviewed-on: https://code.wireshark.org/review/37217 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-11-14test/suite_decryption: Add WPA3 SuiteB-192 bit testMikael Kanstrup1-0/+1
Add a test to verify that PTK can be derived for WPA3 SuiteB-192 captures and that encrypted keydata field is decrypted so that GTK can be dissected. NOTE: Capture file contains no encrypted data frames as currently Wireshark does not support decrypting GCMP-256 encrypted data. Ping-Bug: 16197 Change-Id: I57fbc14a4b4bca58790c4edcee14f1ef73d73fd5 Reviewed-on: https://code.wireshark.org/review/35068 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-26ieee80211: Support decrypting OWE capturesMikael Kanstrup1-0/+1
Add support for decryping OWE (Opportunistic Wireless Encryption) captures. Ping-Bug: 15621 Change-Id: I223fd0cd96260408bce2b5d7661f216c351da8a8 Reviewed-on: https://code.wireshark.org/review/32524 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-21ieee80211: Support decrypting WPA3-Personal / SAE capturesMikael Kanstrup1-0/+1
Add support for decrypting IEEE 802.11 WPA3-Personal / SAE traffic. SAE uses AES encryption but a different key derivation function (KDF) making Wireshark fail to decrypt such captures. Also both KDF and decryption method is determined based only on EAPOL key description version. This is not enough to figure out that SAE is being used. Implement the alternative KDF needed to derive valid PTK. Also implement a function to parse pairwise + group cipher suites and auth key management type from RSNE tag. Using this new function together with a number of new cipher and AKM lookup functions correct KDF for SAE can be selected. Bug: 15621 Change-Id: I8f6c917af1c9642c276a244943dd35f850ee3757 Reviewed-on: https://code.wireshark.org/review/32485 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-04ssl,http: rename http-over-ssl to http-over-tlsPeter Wu1-2/+2
This name is displayed in the SSL prototcol tree (Application Data Protocol: http-over-tls), rename to avoid possible user confusion. Modify the SSL dissector such that both "http" and "http-over-tls" invoke the same dissector function. Change-Id: I2d52890a8ec8fa88b6390b133a11df607a5ec3dc Reviewed-on: https://code.wireshark.org/review/17481 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-08-23dissector ISAKMP IKEv2: fixed bug with libgcrypt-1.6.x and AEAD ciphersMichał Skalski1-0/+10
IKEv2: Fixed bug with AEAD ciphers with 8- and 12-byte length ICVs and libgcrypt 1.6.x - gcry_cipher_checktag() returned INVALID_LENGTH. Fixed for merged changeset https://code.wireshark.org/review/17078 Added support for verification of encrypted data with HMAC_MD5_128 [RFC4595] and HMAC_SHA1_160 [RFC4595] integrity algorithms Added IKEv2 decryption suite for few combinations of encryption and integrity algorithms: 3DES-CBC/SHA1_160, AES-128-CCM-12, AES-128-CCM-12 (using CTR mode), AES-192-CTR/SHA2-512, AES-256-CBC/SHA2-256, AES-256-CCM-16, AES-256-GCM-16, AES-256-GCM-8 Change-Id: Ic564b25f1fd41e913c605322b7b8aa030cf90ddf Reviewed-on: https://code.wireshark.org/review/17213 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-20ISAKMP: Add regression testsMirko Parthey1-0/+2
Add regression tests for bugs 12610 and 12620 Bug: 12610 Bug: 12620 Change-Id: I6325a3ccb3e27fd4d3be52190e8763737b99fe73 Reviewed-on: https://code.wireshark.org/review/17083 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-07-28Add an ESP decryption test.Gerald Combs1-0/+2
Add an ESP decryption test using the capture+keys from bug 12671. Change-Id: I5f7ce477ec74d59c1043345728a1444842912b96 Ping-Bug: 12671 Reviewed-on: https://code.wireshark.org/review/16733 Reviewed-by: Gerald Combs <gerald@wireshark.org> Tested-by: Gerald Combs <gerald@wireshark.org>
2016-04-17The dissector for HTTP-over-SSL is now called "http-over-ssl", not just "http".Guy Harris1-2/+2
The "http" dissector is what's used for protocols other than TCP, SCTP, and SSL/TLS. Change-Id: Ib5138d3a082f1017b7ef190e5128a21eb9a49e92 Reviewed-on: https://code.wireshark.org/review/14947 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-14test: Add test in decryption test suite for 802.11wCedric Izoard1-0/+1
- Add a test to check decryption of management frames Bug: 11995 Change-Id: I588d0f17b9e5efc841266b9dae4764e5e931be3f Reviewed-on: https://code.wireshark.org/review/13259 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-09WPA/WPA2 decoding fixes and improvementsAlexander Wetzel1-0/+1
- start decoding when we have eapol1+2 packets Do not insist on a complete captured handshake, decode what we can. - more robust way to detect eapol #2 packets At least Win 10 is violating the spec on rekey by setting the secure bit in #2. Unpatched version shows and handles #2 as #4, breaking decoding after rekey. - fixed eapol rekey key handling Inital patch (see https://code.wireshark.org/review/8268) is adding redundant keys, since it scans all the time and not only once. - ignore tailing garbage after eapol sections in frame See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9065#c8 Included testcase to test decode for incomplete handshakes and eapol2 packets with secure bit set on rekey. Ping-Bug: 9065 Change-Id: Id775088db9b5aaa80da9efdeed6902d024b5c0cd Reviewed-on: https://code.wireshark.org/review/11484 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-06-04Fix decryption test suite on WindowsPascal Quantin1-0/+1
Change-Id: Ib8207d56a7e064855ce1444c927913c9c9258788 Reviewed-on: https://code.wireshark.org/review/8766 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-05-08IEEE 802.11: 802.1X (WPA-EAP) rekeying supportdeagol1-1/+4
This patch extends the existing decryption support for WPA to also handle rekeys by checking each decrypted packet for a 4-way-handshake. Rekeys can be used for WPA-PSK, but are more common with WPA-Enterprise (WPA-EAP). For decrypting WPA-EAP secured packets the user must provide all used PMK's of the connection (aka PSK's) as WPA-PSK 32 byte hex values to wireshark via the existing interface. (The capture must have all 4-way-handshakes included also, starting with the first unencrypted one.) Every decrypted unicast packet will habe the used PMK and TK shown in the CCMP/TKIP section below the key index in the GUI. Group packets will display the GTK instead. Additionally this fixes a small issue with group rekey handling, so every packet can be selected in the GUI in random order, removing the need to manually find the correct group keying packets prior to that. It was tested primary with WPA-CCMP, but TKIP is also working. One section in the code touch bluetooth 802.1X support. It should do exactly the same, but will now also examine all decypted packets for rekeys. Ping-Bug: 11172 Change-Id: I19d055581fce6268df888da63485a48326046748 Reviewed-on: https://code.wireshark.org/review/8268 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-09-24test: add decryption test for isakmp with certificatesAlex Badea1-0/+2
This was suggested in review 2297. Capture and key are from bug 7951. Bug: 7951 Change-Id: I820c5e839b20ec464cc1be438633d5311f657fb2 Signed-off-by: Alex Badea <abadea@ixiacom.com> Reviewed-on: https://code.wireshark.org/review/4143 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-04-27Revert part of g757db64e484b009c3Evan Huus1-1/+1
It was intended to change the DTLS decryption test, but changed the SSL test file instead, which led to the SSL test mysteriously failing. The SSL capture really is http, so that's the right protocol, and the port is the standard 443, not 4433 (which was perhaps a typo?). Change-Id: I84448c2326d2a4301a4bba9607f8ba90a495531d Reviewed-on: https://code.wireshark.org/review/1401 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-04-26Have DTLS just dissect the test capture as dataEvan Huus1-1/+1
Follow-up to g757db64e484b009c33b67b5fa38e109d7b8f5e78 which changed the filter being tested but didn't change the target protocol, so the test was still failing because it was still trying to use HTTP. Change-Id: I6675cfad3bba63f7a536eb7ae82e4b25132d108e Reviewed-on: https://code.wireshark.org/review/1375 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-04-25Don't use HTTP filter for DTLS decryption test as it's not really HTTP ↵Michael Mann1-1/+1
traffic (and a more discerning HTTP dissector will cause this to fail) Change-Id: I74ea78f541f87000d84c85794d04e9de46d477f2 Reviewed-on: https://code.wireshark.org/review/1333 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2013-10-09From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9238Evan Huus1-0/+2
Add test for ANSI C12.22 decryption. svn path=/trunk/; revision=52469
2012-04-02Add a test for DTLS decryption.Gerald Combs1-0/+1
svn path=/trunk/; revision=41896
2012-03-30Add a missing file.Gerald Combs1-0/+2
svn path=/trunk/; revision=41866
2012-03-30Fix decryption test on Windows.Gerald Combs1-1/+1
svn path=/trunk/; revision=41856
2012-03-30Add a missing file.Gerald Combs1-0/+1
svn path=/trunk/; revision=41855
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 02:28:54 +0000