diff options
author | Gerald Combs <gerald@wireshark.org> | 2004-10-28 22:06:55 +0000 |
---|---|---|
committer | Gerald Combs <gerald@wireshark.org> | 2004-10-28 22:06:55 +0000 |
commit | 24f30a8850a1f11ae2470fd5124e827f443fa62b (patch) | |
tree | be8e613482626efd38c3c9d08cef55bdfb5d0051 | |
parent | bef8e01fcdfb99155406d7b53500f4764dffbc1a (diff) |
Add support for pkauthdata and pkdhkeydata OIDs.
svn path=/trunk/; revision=12426
-rw-r--r-- | asn1/cms/CryptographicMessageSyntax.asn | 1 | ||||
-rw-r--r-- | asn1/cms/cms.cnf | 1 | ||||
-rw-r--r-- | asn1/cms/packet-cms-template.c | 64 | ||||
-rw-r--r-- | asn1/cms/packet-cms-template.h | 1 | ||||
-rw-r--r-- | asn1/pkinit/PKINIT.asn | 52 | ||||
-rw-r--r-- | asn1/pkinit/packet-pkinit-template.c | 17 | ||||
-rw-r--r-- | asn1/pkinit/pkinit.cnf | 4 | ||||
-rw-r--r-- | epan/dissectors/packet-cms.c | 79 | ||||
-rw-r--r-- | epan/dissectors/packet-cms.h | 1 | ||||
-rw-r--r-- | epan/dissectors/packet-kerberos.c | 4 | ||||
-rw-r--r-- | epan/dissectors/packet-kerberos.h | 6 | ||||
-rw-r--r-- | epan/dissectors/packet-pkinit.c | 218 |
12 files changed, 389 insertions, 59 deletions
diff --git a/asn1/cms/CryptographicMessageSyntax.asn b/asn1/cms/CryptographicMessageSyntax.asn index 03e2c7c809..08a431fbc5 100644 --- a/asn1/cms/CryptographicMessageSyntax.asn +++ b/asn1/cms/CryptographicMessageSyntax.asn @@ -49,6 +49,7 @@ DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier SignerInfos ::= SET OF SignerInfo +-- Implemented by hand in the template EncapsulatedContentInfo ::= SEQUENCE { eContentType ContentType, eContent [0] EXPLICIT OCTET STRING OPTIONAL } diff --git a/asn1/cms/cms.cnf b/asn1/cms/cms.cnf index 44dc20347d..ddf3b742dd 100644 --- a/asn1/cms/cms.cnf +++ b/asn1/cms/cms.cnf @@ -24,6 +24,7 @@ AuthenticatedData B "1.2.840.113549.1.9.16.1.2" "id-ct-authenticatedData" #.NO_EMIT OtherKeyAttribute +EncapsulatedContentInfo #.TYPE_RENAME diff --git a/asn1/cms/packet-cms-template.c b/asn1/cms/packet-cms-template.c index 7be19a3065..600b0b004e 100644 --- a/asn1/cms/packet-cms-template.c +++ b/asn1/cms/packet-cms-template.c @@ -46,6 +46,7 @@ int proto_cms = -1; static int hf_cms_keyAttr_id = -1; static int hf_cms_ci_contentType = -1; +static int hf_cms_eci_eContentType = -1; #include "packet-cms-hf.c" /* Initialize the subtree pointers */ @@ -59,16 +60,16 @@ static int dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tv static char keyAttr_id[64]; /*64 chars should be long enough? */ -static int -dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, hf_cms_keyAttr_id, keyAttr_id); return offset; } -static int -dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=call_ber_oid_callback(keyAttr_id, tvb, offset, pinfo, tree); @@ -93,15 +94,15 @@ dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tvb, int offs /* ContentInfo can not yet be handled by the compiler */ static char ci_contentType[64]; /*64 chars should be long enough? */ -static int -dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, hf_cms_ci_contentType, ci_contentType); return offset; } -static int -dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=call_ber_oid_callback(ci_contentType, tvb, offset, pinfo, tree); @@ -123,6 +124,48 @@ dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet } +/* Do the same thing for EncapsulatedContentInfo */ +static char eci_eContentType[64]; /*64 chars should be long enough? */ +static int +dissect_hf_cms_eContentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +{ + offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, + hf_cms_eci_eContentType, eci_eContentType); + return offset; +} +static int +dissect_hf_cms_eContentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +{ + guint8 class; + gboolean pc, ind; + guint32 tag, len; + int pdu_offset = offset; + + /* XXX Do we care about printing out the octet string? */ + offset = dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_eContent); + + pdu_offset = get_ber_identifier(tvb, pdu_offset, &class, &pc, &tag); + pdu_offset = get_ber_length(tvb, pdu_offset, &len, &ind); + pdu_offset = call_ber_oid_callback(eci_eContentType, tvb, pdu_offset, pinfo, tree); + + return offset; +} + +static const ber_sequence EncapsulatedContentInfo_sequence[] = { + { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_hf_cms_eContentType }, + { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_hf_cms_eContentType_content }, + { 0, 0, 0, NULL } +}; + +int +dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, + EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo); + + return offset; +} + + /*--- proto_register_cms ----------------------------------------------*/ void proto_register_cms(void) { @@ -132,6 +175,10 @@ void proto_register_cms(void) { { "contentType", "cms.contentInfo.contentType", FT_STRING, BASE_NONE, NULL, 0, "ContentType", HFILL }}, + { &hf_cms_eci_eContentType, + { "eContentType", "cms.encapContentInfo.eContentType", + FT_STRING, BASE_NONE, NULL, 0, + "EncapsulatedContentType", HFILL }}, { &hf_cms_keyAttr_id, { "keyAttr_id", "cms.keyAttr_id", FT_STRING, BASE_NONE, NULL, 0, @@ -142,6 +189,7 @@ void proto_register_cms(void) { /* List of subtrees */ static gint *ett[] = { &ett_cms_ContentInfo, + &ett_cms_EncapsulatedContentInfo, #include "packet-cms-ettarr.c" }; diff --git a/asn1/cms/packet-cms-template.h b/asn1/cms/packet-cms-template.h index 37898db9c0..6fdba19a13 100644 --- a/asn1/cms/packet-cms-template.h +++ b/asn1/cms/packet-cms-template.h @@ -26,6 +26,7 @@ #define PACKET_CMS_H int dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index); +int dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index); #include "packet-cms-exp.h" diff --git a/asn1/pkinit/PKINIT.asn b/asn1/pkinit/PKINIT.asn index 12dd24fc67..2a1549d304 100644 --- a/asn1/pkinit/PKINIT.asn +++ b/asn1/pkinit/PKINIT.asn @@ -54,7 +54,7 @@ BEGIN -- kerberosv5 (2) pkinit (3) } -- -- --- id-pkdhkeydata OBJECT IDENTIFIER ::= { id-pkinit 1 } +-- id-pkauthdata OBJECT IDENTIFIER ::= { id-pkinit 1 } -- id-pkdhkeydata OBJECT IDENTIFIER ::= { id-pkinit 2 } -- id-pkrkeydata OBJECT IDENTIFIER ::= { id-pkinit 3 } -- id-pkekuoid OBJECT IDENTIFIER ::= { id-pkinit 4 } @@ -89,24 +89,24 @@ TrustedCA ::= CHOICE { ... } --- --- AuthPack ::= SEQUENCE { --- pkAuthenticator [0] PKAuthenticator, --- clientPublicValue [1] SubjectPublicKeyInfo OPTIONAL, --- supportedCMSTypes [2] SEQUENCE OF AlgorithmIdentifier --- OPTIONAL, --- ... --- } --- --- --- PKAuthenticator ::= SEQUENCE { --- cusec [0] INTEGER, --- ctime [1] KerberosTime, --- nonce [2] INTEGER (0..4294967295), --- paChecksum [3] Checksum, --- ... --- } --- + +AuthPack ::= SEQUENCE { + pkAuthenticator [0] PKAuthenticator, + clientPublicValue [1] SubjectPublicKeyInfo OPTIONAL, + supportedCMSTypes [2] SEQUENCE OF AlgorithmIdentifier + OPTIONAL, + ... +} + + +PKAuthenticator ::= SEQUENCE { + cusec [0] INTEGER, + ctime [1] KerberosTime, + nonce [2] INTEGER (0..4294967295), + paChecksum [3] Checksum, + ... +} + -- -- TrustedCertifiers ::= SEQUENCE OF Name -- @@ -134,13 +134,13 @@ PaPkAsRep ::= CHOICE { } --- KDCDHKeyInfo ::= SEQUENCE { --- subjectPublicKey [0] BIT STRING, --- nonce [1] INTEGER, --- dhKeyExpiration [2] KerberosTime OPTIONAL, --- ... --- } --- +KDCDHKeyInfo ::= SEQUENCE { + subjectPublicKey [0] BIT STRING, + nonce [1] INTEGER, + dhKeyExpiration [2] KerberosTime OPTIONAL, + ... +} + -- -- ReplyKeyPack ::= SEQUENCE { -- replyKey [0] EncryptionKey, diff --git a/asn1/pkinit/packet-pkinit-template.c b/asn1/pkinit/packet-pkinit-template.c index 2dd03e6e09..627f7565ac 100644 --- a/asn1/pkinit/packet-pkinit-template.c +++ b/asn1/pkinit/packet-pkinit-template.c @@ -37,6 +37,7 @@ #include "packet-pkinit.h" #include "packet-cms.h" #include "packet-pkix1explicit.h" +#include "packet-kerberos.h" #define PNAME "PKINIT" #define PSNAME "PKInit" @@ -49,6 +50,8 @@ static int proto_pkinit = -1; /* Initialize the subtree pointers */ #include "packet-pkinit-ett.c" +static int dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_); +static int dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_); #include "packet-pkinit-fn.c" @@ -64,6 +67,18 @@ dissect_pkinit_PA_PK_AS_REP(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, return offset; } +static int +dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) { + offset = dissect_krb5_ctime(pinfo, tree, tvb, offset); + return offset; +} + +static int +dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) { + offset = dissect_krb5_Checksum(pinfo, tree, tvb, offset); + return offset; +} + /*--- proto_register_pkinit ----------------------------------------------*/ void proto_register_pkinit(void) { @@ -90,5 +105,7 @@ void proto_register_pkinit(void) { /*--- proto_reg_handoff_pkinit -------------------------------------------*/ void proto_reg_handoff_pkinit(void) { + register_ber_oid_dissector("1.3.6.1.5.2.3.1", dissect_AuthPack_PDU, proto_pkinit, "id-pkauthdata"); + register_ber_oid_dissector("1.3.6.1.5.2.3.2", dissect_KDCDHKeyInfo_PDU, proto_pkinit, "id-pkdhkeydata"); } diff --git a/asn1/pkinit/pkinit.cnf b/asn1/pkinit/pkinit.cnf index 6fc1ad5536..d893daf6a2 100644 --- a/asn1/pkinit/pkinit.cnf +++ b/asn1/pkinit/pkinit.cnf @@ -12,7 +12,9 @@ CryptographicMessageSyntax cms #.EXPORTS -#.PDU +#.REGISTER +AuthPack B "1.3.6.1.5.2.3.1" "id-pkauthdata" +KDCDHKeyInfo B "1.3.6.1.5.2.3.2" "id-pkdhkeydata" #.NO_EMIT diff --git a/epan/dissectors/packet-cms.c b/epan/dissectors/packet-cms.c index 04585b7799..d3e82289f1 100644 --- a/epan/dissectors/packet-cms.c +++ b/epan/dissectors/packet-cms.c @@ -8,7 +8,7 @@ /* packet-cms.c * Routines for RFC2630 Cryptographic Message Syntax packet dissection * - * $Id: packet-cms-template.c 12245 2004-10-08 20:28:04Z guy $ + * $Id: packet-cms-template.c 12394 2004-10-26 13:54:09Z sahlberg $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@ethereal.com> @@ -53,6 +53,7 @@ int proto_cms = -1; static int hf_cms_keyAttr_id = -1; static int hf_cms_ci_contentType = -1; +static int hf_cms_eci_eContentType = -1; /*--- Included file: packet-cms-hf.c ---*/ @@ -289,19 +290,6 @@ static int dissect_keyIdentifier(packet_info *pinfo, proto_tree *tree, tvbuff_t return dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_keyIdentifier); } -static const ber_sequence EncapsulatedContentInfo_sequence[] = { - { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_eContentType }, - { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_eContent }, - { 0, 0, 0, NULL } -}; - -static int -dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { - offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, - EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo); - - return offset; -} static int dissect_encapContentInfo(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { return dissect_cms_EncapsulatedContentInfo(FALSE, tvb, offset, pinfo, tree, hf_cms_encapContentInfo); } @@ -1181,16 +1169,16 @@ static void dissect_AuthenticatedData_PDU(tvbuff_t *tvb, packet_info *pinfo, pro static char keyAttr_id[64]; /*64 chars should be long enough? */ -static int -dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, hf_cms_keyAttr_id, keyAttr_id); return offset; } -static int -dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=call_ber_oid_callback(keyAttr_id, tvb, offset, pinfo, tree); @@ -1215,15 +1203,15 @@ dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tvb, int offs /* ContentInfo can not yet be handled by the compiler */ static char ci_contentType[64]; /*64 chars should be long enough? */ -static int -dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, hf_cms_ci_contentType, ci_contentType); return offset; } -static int -dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +static int +dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=call_ber_oid_callback(ci_contentType, tvb, offset, pinfo, tree); @@ -1245,6 +1233,48 @@ dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet } +/* Do the same thing for EncapsulatedContentInfo */ +static char eci_eContentType[64]; /*64 chars should be long enough? */ +static int +dissect_hf_cms_eContentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +{ + offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset, + hf_cms_eci_eContentType, eci_eContentType); + return offset; +} +static int +dissect_hf_cms_eContentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) +{ + guint8 class; + gboolean pc, ind; + guint32 tag, len; + int pdu_offset = offset; + + /* XXX Do we care about printing out the octet string? */ + offset = dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_eContent); + + pdu_offset = get_ber_identifier(tvb, pdu_offset, &class, &pc, &tag); + pdu_offset = get_ber_length(tvb, pdu_offset, &len, &ind); + pdu_offset = call_ber_oid_callback(eci_eContentType, tvb, pdu_offset, pinfo, tree); + + return offset; +} + +static const ber_sequence EncapsulatedContentInfo_sequence[] = { + { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_hf_cms_eContentType }, + { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_hf_cms_eContentType_content }, + { 0, 0, 0, NULL } +}; + +int +dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, + EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo); + + return offset; +} + + /*--- proto_register_cms ----------------------------------------------*/ void proto_register_cms(void) { @@ -1254,6 +1284,10 @@ void proto_register_cms(void) { { "contentType", "cms.contentInfo.contentType", FT_STRING, BASE_NONE, NULL, 0, "ContentType", HFILL }}, + { &hf_cms_eci_eContentType, + { "eContentType", "cms.encapContentInfo.eContentType", + FT_STRING, BASE_NONE, NULL, 0, + "EncapsulatedContentType", HFILL }}, { &hf_cms_keyAttr_id, { "keyAttr_id", "cms.keyAttr_id", FT_STRING, BASE_NONE, NULL, 0, @@ -1557,6 +1591,7 @@ void proto_register_cms(void) { /* List of subtrees */ static gint *ett[] = { &ett_cms_ContentInfo, + &ett_cms_EncapsulatedContentInfo, /*--- Included file: packet-cms-ettarr.c ---*/ diff --git a/epan/dissectors/packet-cms.h b/epan/dissectors/packet-cms.h index 9bb4746f93..e55dfd5369 100644 --- a/epan/dissectors/packet-cms.h +++ b/epan/dissectors/packet-cms.h @@ -33,6 +33,7 @@ #define PACKET_CMS_H int dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index); +int dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index); /*--- Included file: packet-cms-exp.h ---*/ diff --git a/epan/dissectors/packet-kerberos.c b/epan/dissectors/packet-kerberos.c index d2fd03824c..09ad53d4cf 100644 --- a/epan/dissectors/packet-kerberos.c +++ b/epan/dissectors/packet-kerberos.c @@ -1462,7 +1462,7 @@ dissect_krb5_rtime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offs return offset; } -static int +int dissect_krb5_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=dissect_ber_generalized_time(pinfo, tree, tvb, offset, hf_krb_ctime); @@ -2805,7 +2805,7 @@ static ber_sequence Checksum_sequence[] = { dissect_krb5_checksum_checksum }, { 0, 0, 0, NULL } }; -static int +int dissect_krb5_Checksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { offset=dissect_ber_sequence(FALSE, pinfo, tree, tvb, offset, Checksum_sequence, hf_krb_Checksum, ett_krb_Checksum); diff --git a/epan/dissectors/packet-kerberos.h b/epan/dissectors/packet-kerberos.h index 9e915e5618..08c0173f2c 100644 --- a/epan/dissectors/packet-kerberos.h +++ b/epan/dissectors/packet-kerberos.h @@ -43,4 +43,10 @@ typedef struct _kerberos_callbacks { gint dissect_kerberos_main(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int do_col_info, kerberos_callbacks *cb); +int +dissect_krb5_Checksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset); + +int +dissect_krb5_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset); + #endif /* __PACKET_KERBEROS_H */ diff --git a/epan/dissectors/packet-pkinit.c b/epan/dissectors/packet-pkinit.c index 750283a46b..bb720b139d 100644 --- a/epan/dissectors/packet-pkinit.c +++ b/epan/dissectors/packet-pkinit.c @@ -44,6 +44,7 @@ #include "packet-pkinit.h" #include "packet-cms.h" #include "packet-pkix1explicit.h" +#include "packet-kerberos.h" #define PNAME "PKINIT" #define PSNAME "PKInit" @@ -54,14 +55,27 @@ static int proto_pkinit = -1; /*--- Included file: packet-pkinit-hf.c ---*/ +static int hf_pkinit_AuthPack_PDU = -1; /* AuthPack */ +static int hf_pkinit_KDCDHKeyInfo_PDU = -1; /* KDCDHKeyInfo */ static int hf_pkinit_signedAuthPack = -1; /* ContentInfo */ static int hf_pkinit_trustedCertifiers = -1; /* SEQUNCE_OF_TrustedCA */ static int hf_pkinit_trustedCertifiers_item = -1; /* TrustedCA */ static int hf_pkinit_kdcCert = -1; /* IssuerAndSerialNumber */ static int hf_pkinit_caName = -1; /* Name */ static int hf_pkinit_issuerAndSerial = -1; /* IssuerAndSerialNumber */ +static int hf_pkinit_pkAuthenticator = -1; /* PKAuthenticator */ +static int hf_pkinit_clientPublicValue = -1; /* SubjectPublicKeyInfo */ +static int hf_pkinit_supportedCMSTypes = -1; /* SEQUNCE_OF_AlgorithmIdentifier */ +static int hf_pkinit_supportedCMSTypes_item = -1; /* AlgorithmIdentifier */ +static int hf_pkinit_cusec = -1; /* INTEGER */ +static int hf_pkinit_ctime = -1; /* KerberosTime */ +static int hf_pkinit_nonce = -1; /* INTEGER_0_4294967295 */ +static int hf_pkinit_paChecksum = -1; /* Checksum */ static int hf_pkinit_dhSignedData = -1; /* ContentInfo */ static int hf_pkinit_encKeyPack = -1; /* ContentInfo */ +static int hf_pkinit_subjectPublicKey = -1; /* BIT_STRING */ +static int hf_pkinit_nonce1 = -1; /* INTEGER */ +static int hf_pkinit_dhKeyExpiration = -1; /* KerberosTime */ /*--- End of included file: packet-pkinit-hf.c ---*/ @@ -73,11 +87,17 @@ static int hf_pkinit_encKeyPack = -1; /* ContentInfo */ static gint ett_pkinit_PaPkAsReq = -1; static gint ett_pkinit_SEQUNCE_OF_TrustedCA = -1; static gint ett_pkinit_TrustedCA = -1; +static gint ett_pkinit_AuthPack = -1; +static gint ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier = -1; +static gint ett_pkinit_PKAuthenticator = -1; static gint ett_pkinit_PaPkAsRep = -1; +static gint ett_pkinit_KDCDHKeyInfo = -1; /*--- End of included file: packet-pkinit-ett.c ---*/ +static int dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_); +static int dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_); /*--- Included file: packet-pkinit-fn.c ---*/ @@ -96,12 +116,27 @@ static int dissect_caName(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, i static int dissect_issuerAndSerial(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { return dissect_cms_IssuerAndSerialNumber(FALSE, tvb, offset, pinfo, tree, hf_pkinit_issuerAndSerial); } +static int dissect_clientPublicValue(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkix1explicit_SubjectPublicKeyInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_clientPublicValue); +} +static int dissect_supportedCMSTypes_item(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkix1explicit_AlgorithmIdentifier(FALSE, tvb, offset, pinfo, tree, hf_pkinit_supportedCMSTypes_item); +} +static int dissect_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_KerberosV5Spec2_KerberosTime(FALSE, tvb, offset, pinfo, tree, hf_pkinit_ctime); +} +static int dissect_paChecksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_KerberosV5Spec2_Checksum(FALSE, tvb, offset, pinfo, tree, hf_pkinit_paChecksum); +} static int dissect_dhSignedData(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { return dissect_cms_ContentInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_dhSignedData); } static int dissect_encKeyPack(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { return dissect_cms_ContentInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_encKeyPack); } +static int dissect_dhKeyExpiration(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_KerberosV5Spec2_KerberosTime(FALSE, tvb, offset, pinfo, tree, hf_pkinit_dhKeyExpiration); +} static const value_string TrustedCA_vals[] = { @@ -158,6 +193,82 @@ dissect_pkinit_PaPkAsReq(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, p } + +static int +dissect_pkinit_INTEGER(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_integer(pinfo, tree, tvb, offset, hf_index, NULL); + + return offset; +} +static int dissect_cusec(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_INTEGER(FALSE, tvb, offset, pinfo, tree, hf_pkinit_cusec); +} +static int dissect_nonce1(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_INTEGER(FALSE, tvb, offset, pinfo, tree, hf_pkinit_nonce1); +} + + + +static int +dissect_pkinit_INTEGER_0_4294967295(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_integer(pinfo, tree, tvb, offset, hf_index, NULL); + + return offset; +} +static int dissect_nonce(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_INTEGER_0_4294967295(FALSE, tvb, offset, pinfo, tree, hf_pkinit_nonce); +} + +static const ber_sequence PKAuthenticator_sequence[] = { + { BER_CLASS_CON, 0, 0, dissect_cusec }, + { BER_CLASS_CON, 1, 0, dissect_ctime }, + { BER_CLASS_CON, 2, 0, dissect_nonce }, + { BER_CLASS_CON, 3, 0, dissect_paChecksum }, + { 0, 0, 0, NULL } +}; + +static int +dissect_pkinit_PKAuthenticator(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, + PKAuthenticator_sequence, hf_index, ett_pkinit_PKAuthenticator); + + return offset; +} +static int dissect_pkAuthenticator(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_PKAuthenticator(FALSE, tvb, offset, pinfo, tree, hf_pkinit_pkAuthenticator); +} + +static const ber_sequence SEQUNCE_OF_AlgorithmIdentifier_sequence_of[1] = { + { BER_CLASS_UNI, BER_UNI_TAG_SEQUENCE, BER_FLAGS_NOOWNTAG, dissect_supportedCMSTypes_item }, +}; + +static int +dissect_pkinit_SEQUNCE_OF_AlgorithmIdentifier(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence_of(implicit_tag, pinfo, tree, tvb, offset, + SEQUNCE_OF_AlgorithmIdentifier_sequence_of, hf_index, ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier); + + return offset; +} +static int dissect_supportedCMSTypes(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_SEQUNCE_OF_AlgorithmIdentifier(FALSE, tvb, offset, pinfo, tree, hf_pkinit_supportedCMSTypes); +} + +static const ber_sequence AuthPack_sequence[] = { + { BER_CLASS_CON, 0, 0, dissect_pkAuthenticator }, + { BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL, dissect_clientPublicValue }, + { BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_supportedCMSTypes }, + { 0, 0, 0, NULL } +}; + +static int +dissect_pkinit_AuthPack(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, + AuthPack_sequence, hf_index, ett_pkinit_AuthPack); + + return offset; +} + + static const value_string PaPkAsRep_vals[] = { { 0, "dhSignedData" }, { 1, "encKeyPack" }, @@ -179,6 +290,43 @@ dissect_pkinit_PaPkAsRep(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, p } +static int +dissect_pkinit_BIT_STRING(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_bitstring(implicit_tag, pinfo, tree, tvb, offset, + NULL, hf_index, -1, + NULL); + + return offset; +} +static int dissect_subjectPublicKey(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) { + return dissect_pkinit_BIT_STRING(FALSE, tvb, offset, pinfo, tree, hf_pkinit_subjectPublicKey); +} + +static const ber_sequence KDCDHKeyInfo_sequence[] = { + { BER_CLASS_CON, 0, 0, dissect_subjectPublicKey }, + { BER_CLASS_CON, 1, 0, dissect_nonce1 }, + { BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_dhKeyExpiration }, + { 0, 0, 0, NULL } +}; + +static int +dissect_pkinit_KDCDHKeyInfo(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) { + offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset, + KDCDHKeyInfo_sequence, hf_index, ett_pkinit_KDCDHKeyInfo); + + return offset; +} + +/*--- PDUs ---*/ + +static void dissect_AuthPack_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { + dissect_pkinit_AuthPack(FALSE, tvb, 0, pinfo, tree, hf_pkinit_AuthPack_PDU); +} +static void dissect_KDCDHKeyInfo_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { + dissect_pkinit_KDCDHKeyInfo(FALSE, tvb, 0, pinfo, tree, hf_pkinit_KDCDHKeyInfo_PDU); +} + + /*--- End of included file: packet-pkinit-fn.c ---*/ @@ -194,6 +342,18 @@ dissect_pkinit_PA_PK_AS_REP(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, return offset; } +static int +dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) { + offset = dissect_krb5_ctime(pinfo, tree, tvb, offset); + return offset; +} + +static int +dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) { + offset = dissect_krb5_Checksum(pinfo, tree, tvb, offset); + return offset; +} + /*--- proto_register_pkinit ----------------------------------------------*/ void proto_register_pkinit(void) { @@ -203,6 +363,14 @@ void proto_register_pkinit(void) { /*--- Included file: packet-pkinit-hfarr.c ---*/ + { &hf_pkinit_AuthPack_PDU, + { "AuthPack", "pkinit.AuthPack", + FT_NONE, BASE_NONE, NULL, 0, + "AuthPack", HFILL }}, + { &hf_pkinit_KDCDHKeyInfo_PDU, + { "KDCDHKeyInfo", "pkinit.KDCDHKeyInfo", + FT_NONE, BASE_NONE, NULL, 0, + "KDCDHKeyInfo", HFILL }}, { &hf_pkinit_signedAuthPack, { "signedAuthPack", "pkinit.signedAuthPack", FT_NONE, BASE_NONE, NULL, 0, @@ -227,6 +395,38 @@ void proto_register_pkinit(void) { { "issuerAndSerial", "pkinit.issuerAndSerial", FT_NONE, BASE_NONE, NULL, 0, "TrustedCA/issuerAndSerial", HFILL }}, + { &hf_pkinit_pkAuthenticator, + { "pkAuthenticator", "pkinit.pkAuthenticator", + FT_NONE, BASE_NONE, NULL, 0, + "AuthPack/pkAuthenticator", HFILL }}, + { &hf_pkinit_clientPublicValue, + { "clientPublicValue", "pkinit.clientPublicValue", + FT_NONE, BASE_NONE, NULL, 0, + "AuthPack/clientPublicValue", HFILL }}, + { &hf_pkinit_supportedCMSTypes, + { "supportedCMSTypes", "pkinit.supportedCMSTypes", + FT_UINT32, BASE_DEC, NULL, 0, + "AuthPack/supportedCMSTypes", HFILL }}, + { &hf_pkinit_supportedCMSTypes_item, + { "Item", "pkinit.supportedCMSTypes_item", + FT_NONE, BASE_NONE, NULL, 0, + "AuthPack/supportedCMSTypes/_item", HFILL }}, + { &hf_pkinit_cusec, + { "cusec", "pkinit.cusec", + FT_INT32, BASE_DEC, NULL, 0, + "PKAuthenticator/cusec", HFILL }}, + { &hf_pkinit_ctime, + { "ctime", "pkinit.ctime", + FT_NONE, BASE_NONE, NULL, 0, + "PKAuthenticator/ctime", HFILL }}, + { &hf_pkinit_nonce, + { "nonce", "pkinit.nonce", + FT_UINT32, BASE_DEC, NULL, 0, + "PKAuthenticator/nonce", HFILL }}, + { &hf_pkinit_paChecksum, + { "paChecksum", "pkinit.paChecksum", + FT_NONE, BASE_NONE, NULL, 0, + "PKAuthenticator/paChecksum", HFILL }}, { &hf_pkinit_dhSignedData, { "dhSignedData", "pkinit.dhSignedData", FT_NONE, BASE_NONE, NULL, 0, @@ -235,6 +435,18 @@ void proto_register_pkinit(void) { { "encKeyPack", "pkinit.encKeyPack", FT_NONE, BASE_NONE, NULL, 0, "PaPkAsRep/encKeyPack", HFILL }}, + { &hf_pkinit_subjectPublicKey, + { "subjectPublicKey", "pkinit.subjectPublicKey", + FT_BYTES, BASE_HEX, NULL, 0, + "KDCDHKeyInfo/subjectPublicKey", HFILL }}, + { &hf_pkinit_nonce1, + { "nonce", "pkinit.nonce", + FT_INT32, BASE_DEC, NULL, 0, + "KDCDHKeyInfo/nonce", HFILL }}, + { &hf_pkinit_dhKeyExpiration, + { "dhKeyExpiration", "pkinit.dhKeyExpiration", + FT_NONE, BASE_NONE, NULL, 0, + "KDCDHKeyInfo/dhKeyExpiration", HFILL }}, /*--- End of included file: packet-pkinit-hfarr.c ---*/ @@ -248,7 +460,11 @@ void proto_register_pkinit(void) { &ett_pkinit_PaPkAsReq, &ett_pkinit_SEQUNCE_OF_TrustedCA, &ett_pkinit_TrustedCA, + &ett_pkinit_AuthPack, + &ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier, + &ett_pkinit_PKAuthenticator, &ett_pkinit_PaPkAsRep, + &ett_pkinit_KDCDHKeyInfo, /*--- End of included file: packet-pkinit-ettarr.c ---*/ @@ -266,5 +482,7 @@ void proto_register_pkinit(void) { /*--- proto_reg_handoff_pkinit -------------------------------------------*/ void proto_reg_handoff_pkinit(void) { + register_ber_oid_dissector("1.3.6.1.5.2.3.1", dissect_AuthPack_PDU, proto_pkinit, "id-pkauthdata"); + register_ber_oid_dissector("1.3.6.1.5.2.3.2", dissect_KDCDHKeyInfo_PDU, proto_pkinit, "id-pkdhkeydata"); } |