aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-ssh.c
AgeCommit message (Collapse)AuthorFilesLines
2019-01-15ssh: Host key tree selection, fix off by 4Daniel Hirschberger1-2/+3
When selecting the Host key tree 4 bytes of the host key are missing because the subtree has length key_len and does not include the length of key length field itself. Change-Id: I1a1ca2f3a5ea651c9dab4f0edc705df2c98a7ae4 Reviewed-on: https://code.wireshark.org/review/31464 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2018-12-27Try to squeeze some bytes out of the frame_data structure.Guy Harris1-1/+1
Make the time stamp precision a 4-bit bitfield, so, when combined with the other bitfields, we have 32 bits. That means we put the flags at the same structure level as the time stamp precision, so they can be combined; that gets rid of an extra "flags." for references to the flags. Put the two pointers next to each other, and after a multiple of 8 bytes worth of other fields, so that there's no padding before or between them. It's still not down to 64 bytes, which is the next lower power of 2, so there's more work to do. Change-Id: I6f3e9d9f6f48137bbee8f100c152d2c42adb8fbe Reviewed-on: https://code.wireshark.org/review/31213 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-10-25SSH: Display Host Key Type LengthDaniel Hirschberger1-0/+7
Currently the type length of the host key is parsed but not displayed. This commit fixes that. Change-Id: I3db149129609c3ec5cd24e1031c35481ce3d2f81 Reviewed-on: https://code.wireshark.org/review/30375 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-10-25SSH: Display padding value in outermost tree (Binary Packet)Daniel Hirschberger1-1/+1
The SSH dissector currently displays the padding as a member of the Key Exchange Tree. According to the RFC, the padding is a member of the 'Binary Packet'. This commit adjusts the display accordingly. Change-Id: I24ea2b44b8b7253bbdf61057cb7f0b845d6e7f74 Reviewed-on: https://code.wireshark.org/review/30372 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-05-26ssh: change return value from gint to guint (CID: 1417453).Dario Lombardo1-1/+1
Since we're returning the key_len, there is no point in returning a signed int. Change-Id: I8854868ecf5250dca1894fdb8910d9ed48c070db Reviewed-on: https://code.wireshark.org/review/27781 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-12dissectors: use SPDX identifiers.Dario Lombardo1-13/+1
Change-Id: I92c94448e6641716d03158a5f332c8b53709423a Reviewed-on: https://code.wireshark.org/review/25756 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22SSH: Add port 29418 (Gerrit)Gerald Combs1-3/+3
Convert the TCP port preference to a range and add Gerrit's default port. Change-Id: I13460315e9b312673648a37d5f90955134b3ddbc Reviewed-on: https://code.wireshark.org/review/22362 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-10SSH: display protocol without carriage return / newlineUli Heilmeier1-1/+1
Add protocol to tree without carriage return / newline bytes Bug: 13574 Change-Id: I757a0a3b034943da7f42557a96cdb10a45627dc7 Reviewed-on: https://code.wireshark.org/review/20981 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-13ssh: add dissection for Elliptic Curve Diffie-Hellman KEXРоман Донченко1-0/+71
The protocol is actually nearly identical to ordinary Diffie-Hellman, but the names are different, and the ephemeral keys are bytestrings rather than integers. Change-Id: I261b6426137dae12fe53686e74517080abd80bb3 Reviewed-on: https://code.wireshark.org/review/19210 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-11ssh: correct inaccurate field names/abbrevs/id variable namesРоман Донченко1-30/+30
* kex_first_packet_follows -> first_kex_packet_follows That's the name the spec (RFC 4253) uses. * DH H signature -> H signature, DH host key -> host key Neither the host key nor the H signature have much to do with Diffie-Hellman. They're used in the same way in every key exchange method that I know of, so their names should be more generic. * mpint_[ef] -> dh_[ef], mpint_[pg] -> dh_gex_[pg] This is to make all key exchange method-specific fields follow a consistent pattern with all names/abbrevs being prepended by the method name. Change-Id: Ic887fb92d8cbb6042e9b8e553cb5804db0ba4db8 Reviewed-on: https://code.wireshark.org/review/19199 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-11ssh: remove uninformative blurbsРоман Донченко1-45/+45
For most of the fields, the blurb is just the name with "SSH" prepended, which is not particularly useful. Replace a few of them with more informative descriptions and remove the rest. Change-Id: I15e95a42e897d09d3b6334022b32dd36f29e86a4 Reviewed-on: https://code.wireshark.org/review/19198 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-10ssh: organize header field IDsРоман Донченко1-174/+190
The header field ID variables are listed in a somewhat chaotic order, making the list hard to comprehend and update. Group them according to the part of the protocol the corresponding fields occur in, and order the groups and the IDs within groups to roughly match the protocol flow and message formats. Change-Id: I915f508fd78ff89819c96d246c79d335de6a172e Reviewed-on: https://code.wireshark.org/review/19154 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-06ssh: add dissection for ECDSA host keysРоман Донченко1-0/+29
Change-Id: Ic9851976bfa25fc61c708ee08e5a26ad01769f06 Reviewed-on: https://code.wireshark.org/review/19097 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-12-04ssh: fix the heuristic for MAC size determinationРоман Донченко1-2/+1
size_str points to a dash, so the result of calling ws_strtoi32 on it is a negative number, which becomes a huge positive number, because size is a guint32. Parse the number after the dash instead, and use ws_strtou32. Also, check that size is divisible by 8, since otherwise it's unlikely to be a bit length. Change-Id: I531f67d45e9e914574d36a9ffceed9239fd46d64 Reviewed-on: https://code.wireshark.org/review/19006 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com> Petri-Dish: Graham Bloice <graham.bloice@trihedral.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-12-03ssh: dissect the host key when the connection uses DH group exchangeРоман Донченко1-7/+1
After this, hf_ssh_kexdh_host_key is no longer used, so remove it. Change-Id: Ie56a086481bbe087b7ba3b17aea394c05986f63d Reviewed-on: https://code.wireshark.org/review/19052 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-01ssh: add DSA host key dissectionРоман Донченко1-0/+29
Change-Id: Ib1e2b4e57832e94b94d34102c0079f820b18f350 Reviewed-on: https://code.wireshark.org/review/19000 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-10-08Combine Decode As and port preferences for tcp.port dissector table.Michael Mann1-1/+1
This patch introduces new APIs to allow dissectors to have a preference for a (TCP) port, but the underlying data is actually part of Decode As functionality. For now the APIs are intentionally separate from the regular APIs that register a dissector within a dissector table. It may be possible to eventually combine the two so that all dissectors that register with a dissector table have an opportunity to "automatically" have a preference to adjust the "table value" through the preferences dialog. The tcp.port dissector table was used as the guinea pig. This will eventually be expanded to other dissector tables as well (most notably UDP ports). Some dissectors that "shared" a TCP/UDP port preference were also converted. It also removed the need for some preference callback functions (mostly when the callback function was the proto_reg_handoff function) so there is cleanup around that. Dissectors that has a port preference whose default was 0 were switched to using the dissector_add_for_decode_as_with_preference API rather than dissector_add_uint_with_preference Also added comments for TCP ports used that aren't IANA registered. Change-Id: I99604f95d426ad345f4b494598d94178b886eb67 Reviewed-on: https://code.wireshark.org/review/17724 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-25ssh: use ws_strtoi function.Dario Lombardo1-2/+5
Change-Id: Iafcb721eb6081902dd6b5c3a2258ae5c2ccd95e9 Reviewed-on: https://code.wireshark.org/review/17822 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-12ssh: remove unneded check (CID 1215243).Dario Lombardo1-2/+2
Change-Id: I92d5dcf0fb50324d5adfcf0759be694b4037b8e3 Reviewed-on: https://code.wireshark.org/review/17028 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-07-03ssh: wmem_strdup() never returns NULLMartin Kaiser1-2/+4
Change-Id: I2f7b01e5a71f043e49305d0e2a3e78eaa5eae0a8 Reviewed-on: https://code.wireshark.org/review/16262 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-22SSH: Fix Dead Store (Dead assignement/Dead increment) Warning found by ClangAlexis La Goutte1-2/+1
Change-Id: If084278acfeb82ae7c91aefff9035f156e8f4f15 Reviewed-on: https://code.wireshark.org/review/16079 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Kenny Root <kenny@the-b.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-17ssh: add RSA host key printingKenny Root1-3/+20
Adds a dissector for the ssh-rsa type of public key where the modulus and public exponent are extracted out. Change-Id: I10b1f2d6f41878d9f7ffe5d399b9b7d4f69ad96e Reviewed-on: https://code.wireshark.org/review/15975 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-17ssh: add hostkey informationKenny Root1-6/+56
Adds a framework for hostkey to be printed out separately from the rest of the key exchange. This will allow for individual key information to be presented separately in subsequent changes. Change-Id: I27433772ef1a9e1c45f388809017ed07cf6e41fa Reviewed-on: https://code.wireshark.org/review/15974 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-16ssh: set packet lengths correctlyKenny Root1-1/+6
Each SSH packet was being set to be the remaining length of the frame. This change sets the packet lengths correctly for each SSH packet. Change-Id: Id9c2331d875465cd5e6bb788d420e0025f5d496e Reviewed-on: https://code.wireshark.org/review/15966 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-06-16ssh: packets after SSH_MSG_NEWKEYS are encryptedKenny Root1-1/+4
According to RFC 4253 section 7.3, once the SSH_MSG_NEWKEYS is received all packets after that will be encrypted using the negotiated keys. This can happen in the middle of a frame, so account for the offset in the frame where this happens. Change-Id: Ibc3b06a4bdfe38ae15b0e65afac6f5d3646cb58d Reviewed-on: https://code.wireshark.org/review/15965 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-01-24Add the packet number to the packet_info structure, and use it.Guy Harris1-12/+12
That removes most of the uses of the frame number field in the frame_data structure. Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22 Reviewed-on: https://code.wireshark.org/review/13509 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-09new_register_dissector -> register_dissector for dissector directory.Michael Mann1-1/+1
Change-Id: Ie39ef054a4a942687bd079f3a4d8c2cc55d5f22c Reviewed-on: https://code.wireshark.org/review/12485 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-23register_dissector -> new_register_dissectorMichael Mann1-5/+5
Change-Id: Ifc8208e1b96e2a3bf297912500a5f252bfa8eed9 Reviewed-on: https://code.wireshark.org/review/12073 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-31[ssh] don't THROW() an exception from a dissectorMartin Kaiser1-2/+5
Change-Id: Ibdbdcf59d7d7d28a812e31c7d7b2123b035f80fa Reviewed-on: https://code.wireshark.org/review/11461 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2015-10-31[ssh] remove some unnecessary if(tree) checksMartin Kaiser1-20/+8
Change-Id: Id335830e70a944dd5c26e66d7515d168725acf3f Reviewed-on: https://code.wireshark.org/review/11460 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2015-08-27Remove calls of tvb_ensure_length_remaining.Michael Mann1-6/+6
The remaining calls seem to fall into 3 categories: 1. passing it to tvb_find_line_end when -1 (for length) will do. 2. duplicating the checking of tvb_reported_length_remaining, which is already in use near the tvb_ensure_length_remaining call. 3. Those that (probably) need tvb_ensure_capture_length_remaining Change-Id: I1e77695251e055644bcbbb89f3c181c65d1671ca Reviewed-on: https://code.wireshark.org/review/10268 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-25Deleting unnecessary #includes from dissectors.Martin Mathieson1-1/+0
Fifth batch (packet-rtp.c -> end). Will look at cleaning up and committing script afterwards. Change-Id: I8ed61dc941d98d3f7259a9d1f74e214eb7b4bfa2 Reviewed-on: https://code.wireshark.org/review/6052 Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2014-12-21Cleanup use of #includes in non-generated epan/dissector/*.cBill Meier1-3/+0
Specifically: - Set packet.h to be the first wireshark #include after config.h and "system" #includes. packet.h added as an #include in some cases when missing. - Remove some #includes included (directly/indirectly) in packet.h. E.g., glib.h. (Done only for those files including packet.h). - As needed, move "system" #includes to be after config.h and before wireshark #includes. - Rework various #include file specifications for consistency. - Misc. Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95 Reviewed-on: https://code.wireshark.org/review/5923 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-13Use ENC_BIG_ENDIAN when fetching FT_U?INT8 fields ...Bill Meier1-4/+4
(for some dissectors which fetch all other integral fields using ENC_BIG_ENDIAN). Change-Id: Ic18e3172aad76af12b12d6732c88497be22aed56 Reviewed-on: https://code.wireshark.org/review/5748 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-10-06Convert (what appear to be) "4 space tabs"; Adjust editor-modelines; Do some ↵Bill Meier1-1117/+1117
minor reformatting. Change-Id: Ie078c826ed38a0d682f61fb3e95450b47a9d2c31 Reviewed-on: https://code.wireshark.org/review/4499 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-08-10ssh.dh_gex.nbits: there's only one numberРоман Донченко1-1/+1
Change-Id: Ia3bd392b2223cf666828d65a61e069c465d3894a Reviewed-on: https://code.wireshark.org/review/3536 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-08-10SSH: don't display "Payload" if it's emptyРоман Донченко1-1/+3
The "Payload" field only makes sense for packets that have unknown type or are unexpectedly long. For normal traces, it will always be empty, so hide it. Note: this length check used to be implicitly performed by ssh_proto_tree_add_item before 2aa66aa2b2daf0693e405371a5f9037a43896441, so this just restores the former behaviour. Change-Id: I948935bce660018377a004c661b829a19eb0a53b Reviewed-on: https://code.wireshark.org/review/3535 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-07-09convert to proto_tree_add_subtree[_format]Michael Mann1-19/+9
Change-Id: I8d66b1bc7dbdfee3d4bf6fd3b3c21c6323b66f44 Reviewed-on: https://code.wireshark.org/review/2946 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-19Revert "Fixup: tvb_ensure_length_remaining -> ↵Michael Mann1-6/+6
tvb_ensure_captured_length_remaining" See https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html This reverts commit 021e7afc9fcba09094d0e2143cc434a34e3b09dc. Change-Id: I0640eabce5ce8c4ff3a88ebf848b499f8bb8ed2f Reviewed-on: https://code.wireshark.org/review/2429 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-18Fixup: tvb_ensure_length_remaining -> tvb_ensure_captured_length_remainingDario Lombardo1-6/+6
Change-Id: I0228f3b6b7067bc0ce51f9d359f99fd18feb2b66 Reviewed-on: https://code.wireshark.org/review/2378 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-06-18Fixup: tvb_get_string(z) -> tvb_get_string(z)_encDario Lombardo1-1/+1
Change-Id: I63a3704effe3fcab01a193dc39b6a22e9f1cf3fe Reviewed-on: https://code.wireshark.org/review/2376 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-05-05SSH Dissector : Remove ssh_proto_tree_add_item (No longer needed)Alexis La Goutte1-27/+16
Change-Id: I6d227ad7a4ddfab9d2cf18a3148700a6bd6dd321 Reviewed-on: https://code.wireshark.org/review/1512 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-05-05SSH dissector: fix MAC length calculation for recent OpenSSH featuresJan Seda1-9/+61
Also, show the packet length part of the encrypted packet. The length may be encrypted (typical) or not (-etm modes and GCM mode). When not encrypted, show as a number. Bug:10066 Change-Id: I8c3a943b1b527b326b662e71f07ac6157684d5d9 Reviewed-on: https://code.wireshark.org/review/1462 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Evan Huus <eapache@gmail.com>
2014-05-02Add modelines infoAlexis La Goutte1-0/+13
Change-Id: I82f841e0ee9e00c69894d8c4c67f581278c87546 Reviewed-on: https://code.wireshark.org/review/1469 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-07Register SSH dissector by namePascal Quantin1-4/+4
Change-Id: Ia9ad45ce9196486129897cd616707d622778e9dd Reviewed-on: https://code.wireshark.org/review/137 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2013-12-10- Forward declaration of register functions.Anders Broman1-0/+3
svn path=/trunk/; revision=53918
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53230
2013-09-22emem -> wmem conversion:Pascal Quantin1-1/+1
- ep_tvb_get_bits() -> wmem_packet_tvb_get_bits() - tvb_g_memdup()/ep_tvb_memdup() -> tvb_memdup() - tvb_fake_unicode()/tvb_get_ephemeral_faked_unicode() -> tvb_get_faked_unicode() - tvb_get_g_string()/tvb_get_ephemeral_string()/tvb_get_seasonal_string() -> tvb_get_string() - tvb_get_g_unicode_string()/tvb_get_ephemeral_unicode_string() -> tvb_get_unicode_string() - tvb_get_ephemeral_string_enc() -> tvb_get_string_enc() - update docs accordingly svn path=/trunk/; revision=52172
2013-09-14emem -> wmemJörg Mayer1-10/+10
svn path=/trunk/; revision=52038
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 07:20:03 +0000