dot11decrypt: Support decryption using TK user input

Add support for TK user input keys. With this Wireshark can
decrypt packet captures where 4WHS frames are missing and
packet captures with non-supported AKMS, for example
802.11r / Fast BSS Transitioning.

Decryption using user TK works as a backup if the normal
decryption flow does not succeed. Having TK decryption keys
added will affect general IEEE 802.11 dissector performance
as each encrypted packet will be tested with every TK.
Worst case scenario is plenty of TKs where none of them
matches encrypted frames.

On successful user TK decryption an SA is formed based on
parameters used to decrypt the frame. This SA is similar to
what is formed when Wireshark detects and derive keys from
4WHS messages. With the SA entry in place the decryption
performance (success case) should be on par with "normal"
decryption flow.

Bug: 16579
Change-Id: I72c2c1e2c6693131d3ba07f8ddb8ff772c1b54a9
Reviewed-on: https://code.wireshark.org/review/37217
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 38 insertions, 0 deletions

diff --git a/test/fixtures_ws.py b/test/fixtures_ws.py
index e00e65bd49..f03a41fac2 100644
--- a/test/fixtures_ws.py
+++ b/test/fixtures_ws.py
@@ -302,6 +302,44 @@ def test_env(base_env, conf_path, request, dirs):
 
 
 @fixtures.fixture
+def test_env_80211_user_tk(base_env, conf_path, request, dirs):
+    '''A process environment with a populated configuration directory.'''
+    # Populate our UAT files
+    uat_files = [
+        '80211_keys',
+    ]
+    # uat.c replaces backslashes...
+    key_dir_path = os.path.join(dirs.key_dir, '').replace('\\', '\\x5c')
+    for uat in uat_files:
+        template_file = os.path.join(dirs.config_dir, uat + '.user_tk_tmpl')
+        out_file = os.path.join(conf_path, uat)
+        with open(template_file, 'r') as f:
+            template_contents = f.read()
+        cf_contents = template_contents.replace('TEST_KEYS_DIR', key_dir_path)
+        with open(out_file, 'w') as f:
+            f.write(cf_contents)
+
+    env = base_env
+    env['WIRESHARK_RUN_FROM_BUILD_DIRECTORY'] = '1'
+    env['WIRESHARK_QUIT_AFTER_CAPTURE'] = '1'
+
+    # Allow GUI tests to be run without opening windows nor requiring a Xserver.
+    # Set envvar QT_DEBUG_BACKINGSTORE=1 to save the window contents to a file
+    # in the current directory, output0000.png, output0001.png, etc. Note that
+    # this will overwrite existing files.
+    if sys.platform == 'linux':
+        # This option was verified working on Arch Linux with Qt 5.12.0-2 and
+        # Ubuntu 16.04 with libqt5gui5 5.5.1+dfsg-16ubuntu7.5. On macOS and
+        # Windows it unfortunately crashes (Qt 5.12.0).
+        env['QT_QPA_PLATFORM'] = 'minimal'
+
+    # Remove this if test instances no longer inherit from SubprocessTestCase?
+    if isinstance(request.instance, subprocesstest.SubprocessTestCase):
+        # Inject the test environment as default if it was not overridden.
+        request.instance.injected_test_env = env
+    return env
+
+@fixtures.fixture
 def unicode_env(home_path, make_env):
     '''A Wireshark configuration directory with Unicode in its path.'''
     home_env = 'APPDATA' if sys.platform.startswith('win32') else 'HOME'