diff options
| author | Aurelien Aptel <aaptel@suse.com> | 2019-07-05 16:08:18 +0200 |
|---|---|---|
| committer | Peter Wu <peter@lekensteyn.nl> | 2019-07-15 21:00:14 +0000 |
| commit | 0db39ae59aaefc13a38ec4e7728da44a647b1a10 (patch) | |
| tree | e82f234b0928c832d23bd6fe128958611131c060 /debian | |
| parent | 1a91aac9747ec3d937dd20ec962c86a149248876 (diff) | |
smb2: add support for decompression
The latest iteration of Microsoft updates to SMB3 added compression to
the protocol. This commit implements decompressing and dissecting
compressed payloads.
The compression algorithms that can be used are "Plain LZ77",
"LZ77+Huffman" and "LZNT1" which you can read more about in the
[MS-XCA] documentation. This set of algorithm is sometimes referred to
as XPRESS.
This commit reuses the existing uncompression API scheme already in
place with zlib and brotli and adds 3 tvb_uncompress_*() function
implemented in:
* epan/tvbuff_lz77.c
* epan/tvbuff_lz77huff.c
* epan/tvbuff_lznt1.c
A new function wmem_array_try_index() was added to the wmem_array API
to make bound checked reads that fail gracefully. New tests for it
have been added as well.
Since both reads (tvb) and writes (wmem_array) are bound checked the
risk for buffer overruns is drastically reduced. LZ77+Huffman has
decoding tables and special care was taken to bound check these.
Simplified versions of the implementations were succesfully tested
against AFL (American Fuzzy Lop) for ~150 millions executions each.
The SMB2/3 dissector was changed to deal with the new transform header
for compressed packets (new protocol_id value) and READ request
flags (COMPRESSED). Badly compressed or encrypted packets are now
reported as such, and the decryption test suite was changed to reflect
that.
This commit also adds a test capture with 1 packet compressed with
each algorithm as returned by Windows Server 2019, along with 3
matching tests in test/suite_dissection.py
Change-Id: I2b84f56541f2f4ee7d886152794b993987dd10e7
Reviewed-on: https://code.wireshark.org/review/33855
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/libwireshark0.symbols | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/debian/libwireshark0.symbols b/debian/libwireshark0.symbols index 99a0d2f431..b4b9c5b2ca 100644 --- a/debian/libwireshark0.symbols +++ b/debian/libwireshark0.symbols @@ -1688,6 +1688,9 @@ libwireshark.so.0 libwireshark0 #MINVER# tvb_captured_length_remaining@Base 1.12.0~rc1 tvb_child_uncompress@Base 1.12.0~rc1 tvb_child_uncompress_brotli@Base 3.1.0 + tvb_child_uncompress_lz77@Base 3.1.0 + tvb_child_uncompress_lz77huff@Base 3.1.0 + tvb_child_uncompress_lznt1@Base 3.1.0 tvb_clone@Base 1.12.0~rc1 tvb_clone_offset_len@Base 1.12.0~rc1 tvb_composite_append@Base 1.9.1 @@ -1810,6 +1813,9 @@ libwireshark.so.0 libwireshark0 #MINVER# tvb_strsize@Base 1.9.1 tvb_uncompress@Base 1.9.1 tvb_uncompress_brotli@Base 3.1.0 + tvb_uncompress_lz77@Base 3.1.0 + tvb_uncompress_lz77huff@Base 3.1.0 + tvb_uncompress_lznt1@Base 3.1.0 tvb_unicode_strsize@Base 1.9.1 tvb_ws_mempbrk_pattern_guint8@Base 1.99.3 tvbparse_casestring@Base 1.9.1 @@ -1959,6 +1965,7 @@ libwireshark.so.0 libwireshark0 #MINVER# wmem_array_set_null_terminator@Base 2.1.0 wmem_array_sized_new@Base 1.12.0~rc1 wmem_array_sort@Base 1.12.0~rc1 + wmem_array_try_index@Base 3.1.0 wmem_ascii_strdown@Base 1.12.0~rc1 wmem_cleanup@Base 1.12.0~rc1 wmem_destroy_allocator@Base 1.9.1 |