aboutsummaryrefslogtreecommitdiffstats
path: root/test/captures
AgeCommit message (Collapse)AuthorFilesLines
2017-07-09Add support for dissecting UDT over DTLSSimon Graham1-0/+0
Includes adding per-conversation data to store whether we are over DTLS or UDP and registering as a heuristic sub-dissector for DTLS. Future changes will add more use of the conversation structure. Also included is a capture of UDT over DTLS in test/captures/udt-dtls.pcapng.gz, the associated private key for the session in test/keys/udt-dtls.key and a new test in the decryption suite to check this works. Change-Id: I76826d3b35768d0b58f5335063884616968e5784 Reviewed-on: https://code.wireshark.org/review/22533 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-06-22http2: reassemble entity bodies in data framesRyan Doyle1-0/+0
This commit reassembles data frames to build up the full entity body. It does this for both client/server request and responses. Additionally, it also decompresses bodies if they have the correct content-encoding header provided and are not partial bodies. Bug: 13543 Change-Id: I1661c9ddd09c1f6cf5a08b2b1921f95103aebb52 Reviewed-on: https://code.wireshark.org/review/20737 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-02Add ChaCha20-Poly1305 decryption support for TLS 1.2 and 1.3Peter Wu2-0/+0
Implements all seven AEAD_CHACHA20_POLY1305 cipher suites from RFC 7905 (for TLS 1.2) and the final missing one for TLS 1.3 (draft -20). New test captures (created using OpenSSL_1_1_0-pre6-2528-g042597b0a) also serve as tests for TLS 1.3 decryption support. Change-Id: Ice6d639c9c7b7bc23a6ff5fb4832d02694abd8c4 Ping-Bug: 12779 Reviewed-on: https://code.wireshark.org/review/21902 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-26Remove executable bit, from not executable files.Jakub Zawadzki1-0/+0
Change-Id: I8afa246172cd8d5a86513ade2f482566e3f9957a Reviewed-on: https://code.wireshark.org/review/20272 Petri-Dish: Jakub Zawadzki <darkjames-ws@darkjames.pl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2017-01-31test: add (D)TLS test for AEAD ciphersPeter Wu3-0/+0
TLS and DTLS share the same code for decryption of AEAD ciphers. Add tests for all possible AEAD cipher modes (GCM, CCM, CCM_8). PSK is used to reduce the handshake size (removing certificates). The decryption suite passes these tests on: * Libgcrypt 1.6.5 (Ubuntu 14.04) * Libgcrypt 1.7.6 (Arch Linux) * Libgcrypt 1.4.5 (CentOS 6). Note that the GnuTLS packages are too old, so tests that depend on RSA keys fail here (but the new tests pass). Change-Id: If0dc5b94223fb247062e23960ff66dfdd4f7a902 Reviewed-on: https://code.wireshark.org/review/19850 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-19Add a Kerberos decryption test.Gerald Combs1-0/+0
Test Kerberos decryption using files from krb-816.zip on the SampleCaptures page. Change-Id: Ic1360b637ca6a1f6cb86d09a6aebfd7f5ff89419 Reviewed-on: https://code.wireshark.org/review/18275 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-06ssl: fix TLS renegotiation, add test for thisPeter Wu1-0/+0
A handshake starts a new session, be sure to clear the previous state to avoid creating a decoder with wrong secrets. Renegotiations are also kind of transparant to the application layer, so be sure to re-use an existing SslFlow. This fixes the Follow SSL stream functionality which would previously ignore everything except for the first session. The capture file contains a crafted HTTP request/response over TLS 1.2, interleaved with renegotiations. The HTTP response contains the Python script used to generate the traffic. Surprise! Change-Id: I0110ce76893d4a79330845e53e47e10f1c79e47e Reviewed-on: https://code.wireshark.org/review/17480 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-08-23dissector ISAKMP IKEv2: fixed bug with libgcrypt-1.6.x and AEAD ciphersMichał Skalski8-0/+0
IKEv2: Fixed bug with AEAD ciphers with 8- and 12-byte length ICVs and libgcrypt 1.6.x - gcry_cipher_checktag() returned INVALID_LENGTH. Fixed for merged changeset https://code.wireshark.org/review/17078 Added support for verification of encrypted data with HMAC_MD5_128 [RFC4595] and HMAC_SHA1_160 [RFC4595] integrity algorithms Added IKEv2 decryption suite for few combinations of encryption and integrity algorithms: 3DES-CBC/SHA1_160, AES-128-CCM-12, AES-128-CCM-12 (using CTR mode), AES-192-CTR/SHA2-512, AES-256-CBC/SHA2-256, AES-256-CCM-16, AES-256-GCM-16, AES-256-GCM-8 Change-Id: Ic564b25f1fd41e913c605322b7b8aa030cf90ddf Reviewed-on: https://code.wireshark.org/review/17213 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-20ISAKMP: Add regression testsMirko Parthey2-0/+0
Add regression tests for bugs 12610 and 12620 Bug: 12610 Bug: 12620 Change-Id: I6325a3ccb3e27fd4d3be52190e8763737b99fe73 Reviewed-on: https://code.wireshark.org/review/17083 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-07-28Add an ESP decryption test.Gerald Combs1-0/+0
Add an ESP decryption test using the capture+keys from bug 12671. Change-Id: I5f7ce477ec74d59c1043345728a1444842912b96 Ping-Bug: 12671 Reviewed-on: https://code.wireshark.org/review/16733 Reviewed-by: Gerald Combs <gerald@wireshark.org> Tested-by: Gerald Combs <gerald@wireshark.org>
2016-07-15We no longer add default names to interfaces in an IDB.Guy Harris1-0/+0
The way you say "this interface's name is unknown" is by not giving it an if_name option, not by giving it an if_name option that says "this isn't known". Remove the if_name option from the interfaces in this capture file. Change-Id: Ie3569c81bd065e48278cfa83b82b06ea6b5258af Reviewed-on: https://code.wireshark.org/review/16455 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-04[text2pcap] Fix parsing of hash sign at the end of the lineVasil Velichckov1-0/+10
Change-Id: I4ff1ef28aba353fd7548cb5c0603fc29479aa854 Reviewed-on: https://code.wireshark.org/review/13294 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-02-04[airpdcap] Add support to decrypt TDLS trafficCedric Izoard1-0/+0
- When scanning for keys, check for TDLS action frames (need to have TLDS response or confirm to derive the key) - When deriving PTK, also check MIC to ensure the key has been correctly computed. - As SA is between two STAs (and not STA and AP), store highest MAC address in sa.bssid, and the other one in sa.sta => Add new function (AirPDcapGetSaAddress) that will check for TDLS case. - Add test in decryption suite Bug: 11312 Change-Id: Ieccb6a23a0ffbf3b705dac9b67c856ae2d3eeca9 Reviewed-on: https://code.wireshark.org/review/13664 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-01-14test: Add test in decryption test suite for 802.11wCedric Izoard1-0/+0
- Add a test to check decryption of management frames Bug: 11995 Change-Id: I588d0f17b9e5efc841266b9dae4764e5e931be3f Reviewed-on: https://code.wireshark.org/review/13259 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-09WPA/WPA2 decoding fixes and improvementsAlexander Wetzel1-0/+0
- start decoding when we have eapol1+2 packets Do not insist on a complete captured handshake, decode what we can. - more robust way to detect eapol #2 packets At least Win 10 is violating the spec on rekey by setting the secure bit in #2. Unpatched version shows and handles #2 as #4, breaking decoding after rekey. - fixed eapol rekey key handling Inital patch (see https://code.wireshark.org/review/8268) is adding redundant keys, since it scans all the time and not only once. - ignore tailing garbage after eapol sections in frame See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9065#c8 Included testcase to test decode for incomplete handshakes and eapol2 packets with secure bit set on rekey. Ping-Bug: 9065 Change-Id: Id775088db9b5aaa80da9efdeed6902d024b5c0cd Reviewed-on: https://code.wireshark.org/review/11484 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-08-19Mergecap: add test suite for various merging scenariosHadriel Kaplan3-0/+0
Add a test suite for mergecap (and indirectly capinfos I guess). This is not exhaustive, but it's a start. Change-Id: I9442b4c32e31a74b1673961ad6ab50821441de3e Reviewed-on: https://code.wireshark.org/review/10082 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-07-15ssl-utils: fix failing decryption for some RSA keysPeter Wu1-0/+0
Reported at https://ask.wireshark.org/questions/43788/struggling-to-decrypt-ssl "u" requirement is documented at https://www.gnupg.org/documentation/manuals/gcrypt/RSA-key-parameters.html#RSA-key-parameters Add regression test (key is generated manually with p and q swapped and qInv recalculated). Change-Id: I5505ddcdb54bb47d7a58867b8c3e53fcc0f66dde Reviewed-on: https://code.wireshark.org/review/9573 Tested-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2015-06-04SSL: Add support for private key password when decryptingKevin Grigorenko1-0/+0
SSL traffic from tshark with -o ssl.keys_list. For example, as used in a new test also added in this commit: -o "ssl.keys_list: 127.0.0.1,9131,http,$TEST_KEYS_DIR/key.p12,WebAS" Change-Id: Ia6960fa4ae88182277f6d22d84ec9170ea74d54e Reviewed-on: https://code.wireshark.org/review/8746 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-05-08IEEE 802.11: 802.1X (WPA-EAP) rekeying supportdeagol1-0/+0
This patch extends the existing decryption support for WPA to also handle rekeys by checking each decrypted packet for a 4-way-handshake. Rekeys can be used for WPA-PSK, but are more common with WPA-Enterprise (WPA-EAP). For decrypting WPA-EAP secured packets the user must provide all used PMK's of the connection (aka PSK's) as WPA-PSK 32 byte hex values to wireshark via the existing interface. (The capture must have all 4-way-handshakes included also, starting with the first unencrypted one.) Every decrypted unicast packet will habe the used PMK and TK shown in the CCMP/TKIP section below the key index in the GUI. Group packets will display the GTK instead. Additionally this fixes a small issue with group rekey handling, so every packet can be selected in the GUI in random order, removing the need to manually find the correct group keying packets prior to that. It was tested primary with WPA-CCMP, but TKIP is also working. One section in the code touch bluetooth 802.1X support. It should do exactly the same, but will now also examine all decypted packets for rekeys. Ping-Bug: 11172 Change-Id: I19d055581fce6268df888da63485a48326046748 Reviewed-on: https://code.wireshark.org/review/8268 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-01-27Lua: Expose tcp_dissect_pdus() to LuaHadriel Kaplan1-0/+0
Provide a way for Lua-based dissectors to invoke tcp_dissect_pdus() to make TCP-based dissection easier. Bug: 9851 Change-Id: I91630ebf1f1fc1964118b6750cc34238e18a8ad3 Reviewed-on: https://code.wireshark.org/review/6778 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-01-20HTTP2: Add HPACK decode to test suiteAlexis La Goutte1-0/+0
Change-Id: Ic84942b78a795974d6e2023751245ad98b8f1142 Reviewed-on: https://code.wireshark.org/review/6415 Reviewed-by: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-09-24test: add decryption test for isakmp with certificatesAlex Badea1-0/+0
This was suggested in review 2297. Capture and key are from bug 7951. Bug: 7951 Change-Id: I820c5e839b20ec464cc1be438633d5311f657fb2 Signed-off-by: Alex Badea <abadea@ixiacom.com> Reviewed-on: https://code.wireshark.org/review/4143 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-03-26Add filterable expert info for LuaHadriel Kaplan1-0/+0
This adds the ability for a Lua script to register expert info fields, similar to C-code dissectors. This change also removes the need for the expert_add_info_format_internal() function. Existing Lua scripts do not have to change, because the existing expert info function uses the internal "_ws.lua" protocol instead of nothing; but using the new functionality provides more benefits since it correctly registers the expert info fields to the dissector's protocol. The test suite was amended to generate both old and new forms. Change-Id: Ib5ae74e927cfa81312baf7b04ff4104b0b4f936e Reviewed-on: https://code.wireshark.org/review/830 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-19Fix lua file testsuite not working and weak heuristic readers not being ↵Hadriel Kaplan1-0/+0
registered The testsuite for Lua file reader/writer uses the acme_file.lua script to generate a pcapng file from an Acme sipmsg.log file. It then compares the tshark verbose output of this new pcapng file to a sip.pcapng file in the test/captures directory that was previously made. Unfortunately, the acme_file.lua script generates a timestamp based on local system timezone, rather than UTC, so the testsuite fails if not run in the EST timezone where the sip.pcapng file was originally made. This has now been fixed. Also, trying to register new weak heuristic readers fails because the GArray is terminated with a NULL-based row without Glib knowing about that. So this commit changes it to let Glib handle the NULL-terminated row, so that appending takes it into account automatically. Change-Id: I037ce1cfbda03585b3a1e159df78ff8ebb41fc32 Reviewed-on: https://code.wireshark.org/review/741 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-03-19Add capture file reader/writer support for Lua so scripts can implement new ↵Michael Mann2-0/+136
capture file formats. This enables a Lua script to implement a brand new capture file format reader/writer, so that for example one could write a script to read from vendor-specific "logs" of packets, and show them as normal packets in wireshark. Change-Id: Id394edfffa94529f39789844c382b7ab6cc2d814 Reviewed-on: https://code.wireshark.org/review/431 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-14Add Lua heuristic dissector supportHadriel Kaplan1-0/+0
This adds the ability for Lua scripts to register heuristic dissectors for any protocol that has registered a heuristic dissector list, such as UDP, TCP, and ~50 others. The Lua function can also establish a conversation tied to its Proto dissector, to avoid having to check the heuristics for the same flow. The example dissector in the testsuite has also been enhanced to include a heuristic dissector, to verify the functionality and provide an example implementation. Change-Id: Ie232602779f43d3418fe8db09c61d5fc0b59597a Reviewed-on: https://code.wireshark.org/review/576 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-13add a test for SSL/TLS decryption using the master secretMartin Kaiser1-0/+0
rename the existing SSL test to clarify that it uses the server's private key for decryption Change-Id: I13598fc4cf724b144a8f27bfa7a3316acfc78728 Reviewed-on: https://code.wireshark.org/review/640 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx> Tested-by: Martin Kaiser <wireshark@kaiser.cx>
2014-02-21Add test suite for verifying Lua global variables/tables of previous ↵Hadriel Kaplan1-0/+0
releases have not disappeared. Several bugs have been introduced due to changing of perl scripts or #define names, such that things exported into Lua have dissapeared or changed unintentionally. This commit adds a test suite which compares the Lua global table with the ones from previous releases (1.8 and 1.10), to verify nothing has gone missing. New items can be added, but old ones cannot go away. The added script to verify these things, called 'verify_globals.lua', also has the ability to display what's new - i.e., what was not in the olrder releases. Lastly, this commit also fixes a bug: MENU_STAT_ENDPOINT became MENU_STAT_ENDPOINT_LIST due to a change in the make-init-lua.pl perl script in this 1.11 release. Change-Id: Iba143d1a436e706970635a5f8cc2b317955392bf Reviewed-on: https://code.wireshark.org/review/284 Reviewed-by: Evan Huus <eapache@gmail.com> Tested-by: Evan Huus <eapache@gmail.com>
2014-02-21Revert "Add test suite for verifying Lua global variables/tables of previous ↵Evan Huus1-0/+0
releases have not disappeared." This reverts commit 5b7f00178f45149ecdce204f1c71c1598ceedac1. Change-Id: Idf09d25270847970713b67d02bcd7cbc411a4e9c Reviewed-on: https://code.wireshark.org/review/280 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-02-21Add test suite for verifying Lua global variables/tables of previous ↵Hadriel Kaplan1-0/+0
releases have not disappeared. Several bugs have been introduced due to changing of perl scripts or #define names, such that things exported into Lua have dissapeared or changed unintentionally. This commit adds a test suite which compares the Lua global table with the ones from previous releases (1.8 and 1.10), to verify nothing has gone missing. New items can be added, but old ones cannot go away. The added script to verify these things, called 'verify_globals.lua', also has the ability to display what's new - i.e., what was not in the olrder releases. Lastly, this commit also fixes a bug: MENU_STAT_ENDPOINT became MENU_STAT_ENDPOINT_LIST due to a change in the make-init-lua.pl perl script in this 1.11 release. Change-Id: Ic46172904256dc535b0fe4543237c07dddb3b9b5 Reviewed-on: https://code.wireshark.org/review/242 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-02-09Add test suite for Lua dissector-related functionsHadriel Kaplan1-0/+0
This isn't super-fancy, but it runs a simple protocol dissector and verifies the tshark output matches what it expects. Things like Proto, ProtoField, Field, Tvb, TvbRange, etc., are used in an example dissector script - it dissects DNS... partially. Enough to make sure things aren't fundamentally broken. This provides something to add on top of later as well. Change-Id: Icf3c8e9534944bcf4c4f6150f02a9a43f999cd75 Reviewed-on: https://code.wireshark.org/review/126 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2013-12-07add a decryption test for DVB-CI to the testsuiteMartin Kaiser1-0/+0
svn path=/trunk/; revision=53830
2013-10-09From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9238Evan Huus1-0/+0
Add test for ANSI C12.22 decryption. svn path=/trunk/; revision=52469
2013-05-31nameres.hosts_file_handling shouldn't affect loading the profile "hosts"Gerald Combs1-0/+0
file. That should be loaded no matter what if we have name resolution enabled. Add a name resolution test suite. Currently disabled until I can test it on Windows. svn path=/trunk/; revision=49657
2012-04-02Add a test for Zigbee. Compress the 802.11 capture. Fix an error message.Gerald Combs3-0/+0
svn path=/trunk/; revision=41898
2012-04-02Add a test for DTLS decryption.Gerald Combs1-0/+0
svn path=/trunk/; revision=41896
2012-03-30Add a WPA PSK decryption test.Gerald Combs1-0/+0
svn path=/trunk/; revision=41865
2012-03-30rsasnakeoil2 is a PCAP file; name it .pcap for consistency. Set SVN ↵Jeff Morriss1-0/+0
properties appropriately. svn path=/trunk/; revision=41858
2012-03-30Add a decryption test suite along with an SSL decryption test. Move ourGerald Combs5-0/+0
growing collection of capture files to a subdirectory. svn path=/trunk/; revision=41852
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-12 09:29:11 +0000