aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-isakmp.c
AgeCommit message (Collapse)AuthorFilesLines
2017-12-15[ISAKMP] Added support for new Notify EMERGENCY_CALL_NUMBERS PayloadMatej Tkac1-7/+144
In accordance with the latest 3GPP TS 24.302 (Section 8.2.9.8) 3GPP TS 24.008 (Section 10.5.3.13) Bug: 14273 Change-Id: Ib5a24fa33633764f6bfb034250c309c1f4af9914 Reviewed-on: https://code.wireshark.org/review/24793 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-10-28Convert to using find_conversation_pinfo where appropriateMichael Mann1-3/+1
This makes it easier to identify the simpler/common conversations Change-Id: I7094f23e49156ee27f5f72c8e130308470f3e462 Reviewed-on: https://code.wireshark.org/review/24145 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-10ISAKMP: Added support for the accepted Diffie-Hellman group number in the ↵Julian Renz1-3/+11
INVALID_KE_PAYLOAD Notify payload according to RFC 5996. Also fixed a bug where the dissection of the previously added support for the SIGNATURE_HASH_ALGORITHMS Notify payload would not work properly. Change-Id: I54ffe6b0d8b52189af3dc2e879e6665739fc36a4 Reviewed-on: https://code.wireshark.org/review/23439 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-09-06ISAKMP: Added dissection of the RFC7427 Notify Payload ↵Julian Renz1-0/+24
"SIGNATURE_HASH_ALGORITHMS" according to iana IKEv2 parameters Change-Id: Ie10d0a8a076d65f60590b4fac0b36be7b87dec2a Reviewed-on: https://code.wireshark.org/review/23396 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2017-03-08Introduce "bytes_string" type, similar to "value_string"Peter Wu1-55/+2
In order to map arbitrary byte buffers to strings, introduce a new "bytes_string" type. Since "bytes_to_str" is already used for other purposes, name the generic function "bytesval_to_str" instead similar to the name( "val_to_str"). Accept "size_t" as length parameter since this is what is returned by the "sizeof" operator. Do not add a "try_bytesval_to_str_idx" variant since this pattern is not needed for now. Add a variant to match the prefix since this is currently expected by the ISAKMP dissector. Change-Id: I6d790325e85d9fb1384330f28a8c36e2057fdf30 Reviewed-on: https://code.wireshark.org/review/20386 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-13Make Libgcrypt a mandatory dependencyPeter Wu1-99/+6
Removed all guards for HAVE_LIBGCRYPT, change autotools and CMake to error out if it is not available. Update release notes, developer documentation and README with the new status. Clarify relation with GnuTLS in macosx-setup.sh. Install Libgcrypt via brew script. Motivation for this change is that many dissectors depend on Libgcrypt and having it optional increases the maintenance burden (there have been several compile issues in the past due to the optional status). Furthermore, wsutil has crypto code that can be replaced by Libgcrypt. Change-Id: Idf0021b8c4cd5db70b8766f7dcc2a8b3acbf042f Link: https://www.wireshark.org/lists/wireshark-dev/201702/msg00011.html Reviewed-on: https://code.wireshark.org/review/20030 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-13[ISAKMP] Dissect 3GPP private error and status messages in NOTIFY.AndersBroman1-7/+74
Change-Id: Iaa65c1cf9f358e36e77b4a5cad2543dcbb98072e Reviewed-on: https://code.wireshark.org/review/20090 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-01-31ISAKMP: Add Forticlient (connect License and EndPoint Control) from Fortinet ↵Alexis La Goutte1-0/+13
Vendor ID Change-Id: Idf40de8bfa76cbe4437a157fc90bd994d4b2233e Reviewed-on: https://code.wireshark.org/review/19872 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-29Register reassembly tablesMichael Mann1-7/+4
Register all reassembly tables with a central unit, allowing the central unit to have the callback that initializes and destroys the reassembly tables, rather than have dissectors do it individually. Change-Id: Ic92619c06fb5ba6f1c3012f613cae14982e101d4 Reviewed-on: https://code.wireshark.org/review/19834 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-22ISAKMP: Add Fortigate (Fortinet) Vendor IDAlexis La Goutte1-0/+27
Display also release (and build) Change-Id: Ib97f47a0b0179712a82f0aee0ca079a05b8b590c Reviewed-on: https://code.wireshark.org/review/19730 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-12uat: add a reset callback.Dario Lombardo1-0/+2
This function will free the resources allocated by the caller. Change-Id: Ib486c14e4fd3c321662fb71f7fd06733ce9a64a4 Reviewed-on: https://code.wireshark.org/review/19375 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-03ISAKMP: add Reserved fieldsMirko Parthey1-17/+43
Add Reserved fields as defined by: * RFC 7296 for IKEv2 * RFC 2408 for IKEv1 * draft-ietf-ipsec-isakmp-mode-cfg-05 for the IKEv1 Attributes Payload Change-Id: I0c25de6e543aa5461650fb4cd2c103a6a3a8c392 Reviewed-on: https://code.wireshark.org/review/19480 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-01-02ISAKMP: Fix size of ID in IKEv1 Attributes PayloadMirko Parthey1-1/+1
Fix the size of the Identifier field in the IKEv1 Attributes Payload. Reference: draft-ietf-ipsec-isakmp-mode-cfg-05, section 3.2 Change-Id: I30bfde9caa6750b342f7dfbad39e63341614a45b Reviewed-on: https://code.wireshark.org/review/19502 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2017-01-02ISAKMP: fix dissection of IKEv2 ID PayloadMirko Parthey1-16/+22
Fix dissection of the IKEv2 Identification Payload. Unlike IKEv1, it does not have Protocol and Port fields. References: * RFC 2407, section 4.6.2 * RFC 7296, section 3.5 Change-Id: I968e378abd49363785dd7308a4f27908c1c05a8a Reviewed-on: https://code.wireshark.org/review/19497 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-12-31Dissectors don't need a journey of self discovery.Michael Mann1-4/+3
They already know who they are when they register themselves. Saving the handle then to avoid finding it later. Not sure if this will increase unnecessary register_dissector functions (instead of using create_dissector_handle in proto_reg_handoff function) when other dissectors copy/paste, but it should make startup time a few microseconds better. Change-Id: I3839be791b32b84887ac51a6a65fb5733e9f1f43 Reviewed-on: https://code.wireshark.org/review/19481 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-29ISAKMP: add Reserved fields for Fibre ChannelMirko Parthey1-3/+11
Add Reserved fields for Fibre Channel Traffic Selectors. Reference: RFC 4595, section 4.4 Change-Id: Iba0b3d9a4d3d96918971a9a597fa313b022b5ca2 Reviewed-on: https://code.wireshark.org/review/19444 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-28ISAKMP: add traffic selector subtreeMirko Parthey1-105/+100
Create a new subtree for each traffic selector. Use the length field to find the next traffic selector rather than accumulating the individual TS field sizes. Split dissect_ts() to introduce separate offset variables. After adding the final field, do not advance offset again to avoid unused variable warnings. Change-Id: I9951662c1bb3958994162b25b70b43ec1da103a7 Reviewed-on: https://code.wireshark.org/review/19440 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-13Adjust proto_tree_add_uint_format_value calls to use unit stringMichael Mann1-4/+4
Several calls to proto_tree_add_uint_format_value could be better served using BASE_UNIT_STRING with a "unit string" in hf_ field. There also a few cases where proto_tree_add_uint_format_value could just be proto_tree_add_uint. Added a few more "common" unit string values to unit_strings.[ch] Change-Id: Iaedff82c515269c9c31ab9100dff19f5563c932d Reviewed-on: https://code.wireshark.org/review/19242 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-28ISAKMP: Rename identifiers for readabilityMirko Parthey1-237/+237
Rename attribute dissecting functions and their local variables to improve code readability, and adjust white space. old new ------------------------------------------------------------------ dissect_rohc_supported dissect_rohc_attribute dissect_transform_ike2_attribute dissect_ike2_transform_attribute option attribute optlen value_len rohc attr_type transform_attr_type attr_type cfg_attr_type attr_type rohc_tree tree transform_attr_type_tree tree cfg_attr_type_tree tree sub_rohc_tree attr_tree sub_transform_attr_type_tree attr_tree sub_cfg_attr_type_tree attr_tree rohc_item attr_item transform_attr_type_item attr_item cfg_attr_type_item attr_item ------------------------------------------------------------------ Change-Id: I135e5deb802edc575e7fddd1bb397272aac0888c Reviewed-on: https://code.wireshark.org/review/18553 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-21ISAKMP: update protocol parametersMirko Parthey1-27/+34
Update IKE authentication methods and config attributes. Change-Id: I103beaf79eebaa0704424ad89f4d38a2701ae50b Reviewed-on: https://code.wireshark.org/review/18357 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-21ISAKMP: fix typos and whitespaceMirko Parthey1-22/+22
Change-Id: I8fd34acac2562ffea6f1e726b71d63f9f631bb54 Reviewed-on: https://code.wireshark.org/review/18355 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-10-21ISAKMP: Fix defragmentation of EAP-TLS in IKEv2Mirko Parthey1-1/+1
Remove NULL check to ensure IKEv2 encrypted payloads are dissected during first pass, which is required for EAP-TLS fragment reassembly. Change-Id: I7fd46ee2163188c1a8dd256a43f1457441b1b95a Reviewed-on: https://code.wireshark.org/review/18348 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-13Convert most UDP dissectors to use "auto" preferences.Michael Mann1-1/+1
Similar to the "tcp.port" changes in I99604f95d426ad345f4b494598d94178b886eb67, convert dissectors that use "udp.port". More cleanup done on dissectors that use both TCP and UDP dissector tables, so that less preference callbacks exist. Change-Id: If07be9b9e850c244336a7069599cd554ce312dd3 Reviewed-on: https://code.wireshark.org/review/18120 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-08Combine Decode As and port preferences for tcp.port dissector table.Michael Mann1-1/+1
This patch introduces new APIs to allow dissectors to have a preference for a (TCP) port, but the underlying data is actually part of Decode As functionality. For now the APIs are intentionally separate from the regular APIs that register a dissector within a dissector table. It may be possible to eventually combine the two so that all dissectors that register with a dissector table have an opportunity to "automatically" have a preference to adjust the "table value" through the preferences dialog. The tcp.port dissector table was used as the guinea pig. This will eventually be expanded to other dissector tables as well (most notably UDP ports). Some dissectors that "shared" a TCP/UDP port preference were also converted. It also removed the need for some preference callback functions (mostly when the callback function was the proto_reg_handoff function) so there is cleanup around that. Dissectors that has a port preference whose default was 0 were switched to using the dissector_add_for_decode_as_with_preference API rather than dissector_add_uint_with_preference Also added comments for TCP ports used that aren't IANA registered. Change-Id: I99604f95d426ad345f4b494598d94178b886eb67 Reviewed-on: https://code.wireshark.org/review/17724 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-05isakmp: Add dissection of Responder Lifetime notificationMirko Parthey1-2/+188
Derive the dissection functions from dissect_ike_attribute() and dissect_ipsec_attribute(): * Add dedicated header fields. * Remove attribute types not applicable in Responder Lifetime context. Clean up the field name "isakmp.ipsec.attr.type". Bug: 12963 Change-Id: I486380836d915255812098be2190bcc77ec13c00 Reviewed-on: https://code.wireshark.org/review/17970 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-27ISAKMP: Rename identifiers and change item labelsMirko Parthey1-202/+208
Rename identifiers and change item labels to reflect their purpose: * ISAKMP Phase 1 = IKE * ISAKMP Phase 2 = IPsec * IKEv2 Attribute = Transform Attribute Remove "transform" and "type" where they do not apply. External users of isakmp.tf.* field names, such as display filters, have to be updated after this commit to use isakmp.ipsec.* instead. old new -------------------------------------------------------------------- dissect_transform_attribute() dissect_ipsec_attribute() dissect_transform_ike_attribute() dissect_ike_attribute() ISAKMP_ IPSEC_ hf_isakmp_tf_attr hf_isakmp_ipsec_attr isakmp.tf. isakmp.ipsec. transform_ike_attr_type ike_attr_type transform_isakmp_attr_type ipsec_attr_type transform_attr_sa_life_type attr_life_type transform_dh_group_type dh_group transform_attr_encap_type ipsec_attr_encap_mode transform_attr_auth_type ipsec_attr_auth_algo transform_attr_ecn_type ipsec_attr_ecn_tunnel transform_attr_ext_seq_nbr_type ipsec_attr_ext_seq_nbr transform_attr_addr_preservation_type ipsec_attr_addr_preservation transform_attr_sa_direction_type ipsec_attr_sa_direction transform_attr_enc_type ike_attr_enc_algo transform_attr_hash_type ike_attr_hash_algo transform_attr_authmeth_type ike_attr_authmeth transform_attr_grp_type ike_attr_grp_type Type Payload Payload Transform IKE Attribute Type IKE Attribute Transform Attribute Type IPsec Attribute Transform IKE2 Attribute Type Transform Attribute Config Attribute Type Config Attribute ISAKMP (v1) IKEv1 ISAKMP (v2) IKEv2 -------------------------------------------------------------------- Change-Id: Ib02a0bad100f932a290cae35ea4bd75b191f797b Reviewed-on: https://code.wireshark.org/review/17914 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-23ISAKMP: fix Argument with 'nonnull' attribute passed null found by Clang ↵Alexis La Goutte1-1/+3
Analyzer Change-Id: I8d7ebc6dd46e0d6494d412653ec423b8c0fde9c8 Reviewed-on: https://code.wireshark.org/review/17203 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-18ISAKMP: Reduce code duplicationMirko Parthey1-248/+221
Equalize attribute dissecting functions: * Convert all attribute type names to range_string. Add "Unassigned" and "Private use" ranges while we are at it. * Swap the order of format and type fields for config attributes. Move common code into the new function dissect_attribute_header(). Try to keep the parameter list short: * Group the hfindex values for attribute details into a struct. * Merge attribute subtree types. Add a colon in the main attribute item label for visual separation. Skip dissection of config attributes for unknown IKE versions. Change-Id: I6e6286f3d4cf16f3cd16a23aca540c4af72f3442 Reviewed-on: https://code.wireshark.org/review/17663 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-09-05ISAKMP: Fix handling of cert requests without CAMirko Parthey1-0/+3
Check IKEv1 Certificate Request Payloads for an empty Certificate Authority field, which is allowed by RFC 2408. Suppress dissection of this field if it is indeed empty. Change-Id: Ifb997e460a4c12003215fde86c374cfc769c5d72 Reviewed-on: https://code.wireshark.org/review/17501 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-08-28ISAKMP: fix # of SPIs field name in Delete payloadMirko Parthey1-1/+1
Fix the "Number of SPIs" field name in the Delete payload. References: RFC 2408, RFC 7296 Change-Id: I205fb830275fc011e6605fdae53c6b9141e1628b Reviewed-on: https://code.wireshark.org/review/17353 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-24ISAKMP: remove useless callbackPascal Quantin1-9/+1
isakmp_cleanup_protocol() and isakmp_init_protocol() are already registered as cleanup and init routines Change-Id: I4fd2348dc507c8bc933aebd5abfb2522b57da0b4 Reviewed-on: https://code.wireshark.org/review/17284 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-24ISAKMP: fix DOI field read sizeMirko Parthey1-2/+2
Read 4 bytes from the packet instead of 1 because that is the correct size of the DOI field. Reference: RFC 2408 Change-Id: I5745363811bb46af307a925d688ec36cfb29984b Reviewed-on: https://code.wireshark.org/review/17271 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-23isakmp Fix IKEv2 modification UAT crashMichał Skalski1-2/+5
Problem is that not all fields of UAT are updated on change (only those defined in UAT definition with ikev2_uat_flds, specifically pointers to encr_spec and auth_spec in ike2_decr_data_t were set to NULL. Fixed by re-setting pointers after update table callback was called. Also fixed memory leaks after UAT modification. Bug was partially resolved with change Ibdab979b5959eb561635cbcb446e17138baca87b https://code.wireshark.org/review/17078 which eliminated crash, but decryption still didn't work after UAT modification (DISSECTOR BUG was displayed). Bug: 12748 Change-Id: I8209edd8e214d62e34b641fdd2e046b9ff4c95eb Reviewed-on: https://code.wireshark.org/review/17249 Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl> Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23dissector ISAKMP IKEv2: fixed bug with libgcrypt-1.6.x and AEAD ciphersMichał Skalski1-9/+42
IKEv2: Fixed bug with AEAD ciphers with 8- and 12-byte length ICVs and libgcrypt 1.6.x - gcry_cipher_checktag() returned INVALID_LENGTH. Fixed for merged changeset https://code.wireshark.org/review/17078 Added support for verification of encrypted data with HMAC_MD5_128 [RFC4595] and HMAC_SHA1_160 [RFC4595] integrity algorithms Added IKEv2 decryption suite for few combinations of encryption and integrity algorithms: 3DES-CBC/SHA1_160, AES-128-CCM-12, AES-128-CCM-12 (using CTR mode), AES-192-CTR/SHA2-512, AES-256-CBC/SHA2-256, AES-256-CCM-16, AES-256-GCM-16, AES-256-GCM-8 Change-Id: Ic564b25f1fd41e913c605322b7b8aa030cf90ddf Reviewed-on: https://code.wireshark.org/review/17213 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23isakmp: fix type confusionPeter Wu1-12/+12
Caught by ASAN with WIRESHARK_DEBUG_WMEM_OVERRIDE=simple set. Manually inspection of all type casts to decrypt_data_t and ikev2_decrypt_data_t showed no other users that do not check isakmp_version first. Change-Id: If889afff85a20e31222d33cbea8db3a91a77f389 Reviewed-on: https://code.wireshark.org/review/17246 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michał Skalski <mskalski13@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22IKEv2: Add D-H Transform IDs for Brainpool CurvesMirko Parthey1-0/+4
Add Diffie-Hellman Group Transform IDs for the ECC Brainpool Curves. References: RFC 6932, RFC 6954 Change-Id: I1ca0da8e5e06abbd1c53a591d01c1f05aa60c35a Reviewed-on: https://code.wireshark.org/review/17231 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-19dissector ISAKMP: Added decryption using AES-GCM, AES-CCM and AES-CTRMichał Skalski1-14/+275
Added support for decryption of IKEv2 packets encrypted with PAED or CTR cipher mode. Verification of integrity requires libgcrypt 1.6.0 or later. If it is not the case, only decryption is performed Can easily be extended to other ciphers supported by libgcrypt. NOTE: There is long-term bug in handling UAT for IKEv2 - any change resulting in change count of IKEv2 UAT entries causes crash when matching key from UAT is found. Crash does not occur when UAT is read from user prefs file. I observed this bug also on stock 1.10.6 version from Ubuntu 14.04 LTS I have no knowledge, how to fix it. Change-Id: Ibdab979b5959eb561635cbcb446e17138baca87b Reviewed-on: https://code.wireshark.org/review/17078 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-18ISAKMP: Fix Result of operation is garbage or undefined found by Clang AnalyzerPascal Quantin1-3/+9
Change-Id: I47233968dfc87494b3c959896622db5cd31244a7 Reviewed-on: https://code.wireshark.org/review/17065 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Mirko Parthey <mirko.parthey@web.de> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-11Fix IKEv1 decryption and initialization vectorsMirko Parthey1-163/+241
Generate initialization vectors during Wireshark's first pass, in order to improve reliability and efficiency. (bug #12699) Remove a dissection shortcut in first pass to allow early analysis of the transform payloads, which is needed to find out the crypto algorithms. Introduce a hash table to store an IV per message ID. (bug #12610) Fix handling of the initial phase 1 IV. (bug #12620) Cache IVs as per-packet data instead of a list. Use the wmem allocator to avoid memory leaks. Ensure libgcrypt resource cleanup on error paths. Rely only on IKE attributes to find the decryption algorithm, do not consider the length of the user-configured secret at this point. Split code into small functions. Ping-Bug: 12610 Ping-Bug: 12620 Ping-Bug: 12699 Change-Id: I7137943da42d54816808312cd1716a7e05478cbb Reviewed-on: https://code.wireshark.org/review/16846 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-07-20Convert uses of g_alloced data with tvb_new_child_real_data to use ↵Michael Mann1-9/+2
pinfo->pool instead. Aldo update documentation to suggest using wmem pinfo->pool instead of glib memory Change-Id: I5d34cc6c1515aa9f0d57784b38da501ffcb95ccc Reviewed-on: https://code.wireshark.org/review/16551 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Evan Huus <eapache@gmail.com>
2016-06-27tvb_get_string_enc + proto_tree_add_item = proto_tree_add_item_ret_stringMichael Mann1-26/+28
Also some other tricks to remove unnecessary tvb_get_string_enc calls. Change-Id: I2f40d9175b6c0bb0b1364b4089bfaa287edf0914 Reviewed-on: https://code.wireshark.org/review/16158 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-03-20Manually add protocol dependencies derived from find_dissector.Michael Mann1-1/+1
Started by grepping call_dissector_with_data, call_dissector_only and call_dissector and traced the handles passed into them to a find_dissector within the dissector. Then replaced find_dissector with find_dissector_add_dependency and added the protocol id from the dissector. "data" dissector was not considered to be a dependency. Change-Id: I15d0d77301306587ef8e7af5876e74231816890d Reviewed-on: https://code.wireshark.org/review/14509 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-26Add free_address_wmem(), fix warnings [-Wcast-qual]João Valverde1-2/+2
Try to improve address API and also fix some constness warnings by not overloading the 'data' pointer to store malloc'ed buffers (use private pointer for that instead). Second try, now passing test suite. Change-Id: Idc101cd866b6d4f13500c9d59da5c7a38847fb7f Reviewed-on: https://code.wireshark.org/review/13946 Petri-Dish: João Valverde <j@v6e.pt> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: João Valverde <j@v6e.pt>
2016-02-22Separate hf_ fields that share filter names with FT_UINT32 and FT_UINT64 ↵Michael Mann1-4/+4
datatypes. 'bitcoin.addr.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.inv.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.getdata.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.notfound.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.getblocks.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.getheaders.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.tx.input_count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.tx.in.script_length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.tx.output_count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.tx.out.script_length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.block.num_transactions' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.headers.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.merkleblock.flags.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.merkleblock.hashes.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.string.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'bitcoin.data.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'dcerpc.referent_id' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'dmp.body.id' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'edonkey.start_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'edonkey.end_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.entry' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.phoff' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.shoff' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_vaddr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_paddr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_filesz' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_memsz' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.p_align' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.sh_addr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.sh_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.sh_size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.sh_addralign' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.sh_entsize' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.symbol_table.value' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.symbol_table.size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.dynamic.tag' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.dynamic.value' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.dynamic.pointer' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.dynamic.ignored' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'elf.dynamic.unspecified' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'h248.contextId' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'hcrt.data32' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'wlan_mgt.fixed.psmp.stainfo.reserved' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'isakmp.tf.attr.life_duration' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'isakmp.ike.attr.life_duration' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'jxta.message.element.content.length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'rmt-lct.tsi' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'rmt-lct.toi' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'smb.alloc_size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 'trmac.response_code' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32 Change-Id: I903933e6448bac3d3374eef1a6a0bc4771c1a9f4 Reviewed-on: https://code.wireshark.org/review/14060 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-08Revert "Add free_address_wmem() and other extensions to address API"João Valverde1-2/+2
This reverts commit 13ec77a9fc3af3b0b502820d0b55796c89997896. This commit introduces a segmentation fault for Lua code (uncovered by the test suite). Change-Id: Ibc273d1915cda9632697b9f138f0ae104d3fb65e Reviewed-on: https://code.wireshark.org/review/13813 Reviewed-by: João Valverde <j@v6e.pt>
2016-02-07Add free_address_wmem() and other extensions to address APIJoão Valverde1-2/+2
Try to improve 'address' API (to be easier/safer) and also avoid some constness warnings by not overloading the 'data' pointer to store malloc'ed buffers (use private pointer for that instead). Change-Id: I7456516b12c67620ceadac447907c12f5905bd49 Reviewed-on: https://code.wireshark.org/review/13463 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: João Valverde <j@v6e.pt>
2016-01-31Fixed Cisco Vendor IDs in IKEv2 dissector.Xavier Brouckaert1-2/+34
Change-Id: Idb8fce8fae1b2b580f9ca7a9c71e430bfa7dfb44 Reviewed-on: https://code.wireshark.org/review/13606 Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl> Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-24Add the packet number to the packet_info structure, and use it.Guy Harris1-6/+6
That removes most of the uses of the frame number field in the frame_data structure. Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22 Reviewed-on: https://code.wireshark.org/review/13509 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-22That warning is bogus; squelch it with an otherwise-unnecessary cast.Guy Harris1-3/+10
The compiler being used for the 64-bit OS X build is buggy; throw in an otherwise-unnecessary cast to squelch its bogus warning. Change-Id: Ie2104ba861493870191530ca391a089ca3951929 Reviewed-on: https://code.wireshark.org/review/13489 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 13:50:52 +0000