From e7acb32a5a48d57ffd6dc17f6a9de60630f82c7e Mon Sep 17 00:00:00 2001 From: Alexander Wetzel Date: Mon, 28 Oct 2019 18:19:00 +0100 Subject: [PATCH] ieee80211: Extended Key ID support Support Extended Key ID for Individually Addressed Frames from IEEE 802.11 - 2016. Extended Key ID allows unicast (PTK) keys to also use key ID 1 and has an additional RSN attribute "KeyID" in EAPOL #3. Add the additional attribute KeyID to the RSN parser, stop assuming unicast keys are only using key ID 0 and add a test case to verify Extended Key ID parsing and decoding. Change-Id: I43005c74df561be5524fa3738149781f50dafa14 Reviewed-on: https://code.wireshark.org/review/34883 Petri-Dish: Alexis La Goutte Tested-by: Petri Dish Buildbot Reviewed-by: Jaap Keuter --- epan/crypt/dot11decrypt.c | 7 ++--- epan/dissectors/packet-ieee80211.c | 27 ++++++++++++++++-- test/captures/wpa_ptk_extended_key_id.pcap.gz | Bin 0 -> 20462 bytes test/suite_decryption.py | 25 ++++++++++++++++ 4 files changed, 53 insertions(+), 6 deletions(-) create mode 100644 test/captures/wpa_ptk_extended_key_id.pcap.gz diff --git a/epan/crypt/dot11decrypt.c b/epan/crypt/dot11decrypt.c index 6e028654f8..a9908c1dba 100644 --- a/epan/crypt/dot11decrypt.c +++ b/epan/crypt/dot11decrypt.c @@ -984,13 +984,12 @@ INT Dot11DecryptPacketProcess( } else { DOT11DECRYPT_DEBUG_PRINT_LINE("Dot11DecryptPacketProcess", "TKIP or CCMP encryption", DOT11DECRYPT_DEBUG_LEVEL_3); - /* If index >= 1, then use the group key. This will not work if the AP is using + /* If the destination is a multicast address use the group key. This will not work if the AP is using more than one group key simultaneously. I've not seen this in practice, however. Usually an AP will rotate between the two key index values of 1 and 2 whenever it needs to change the group key to be used. */ - if (DOT11DECRYPT_KEY_INDEX(data[offset+3])>=1){ - - DOT11DECRYPT_DEBUG_PRINT_LINE("Dot11DecryptPacketProcess", "The key index >= 1. This is encrypted with a group key.", DOT11DECRYPT_DEBUG_LEVEL_3); + if (((const DOT11DECRYPT_MAC_FRAME_ADDR4 *)(data))->addr1[0] & 0x01) { + DOT11DECRYPT_DEBUG_PRINT_LINE("Dot11DecryptPacketProcess", "Broadcast/Multicast address. This is encrypted with a group key.", DOT11DECRYPT_DEBUG_LEVEL_3); /* force STA address to broadcast MAC so we load the SA for the groupkey */ memcpy(id.sta, broadcast_mac, DOT11DECRYPT_MAC_LEN); diff --git a/epan/dissectors/packet-ieee80211.c b/epan/dissectors/packet-ieee80211.c index e234a0f7c3..a72063e714 100644 --- a/epan/dissectors/packet-ieee80211.c +++ b/epan/dissectors/packet-ieee80211.c @@ -4671,6 +4671,7 @@ static int hf_ieee80211_rsn_cap_mfpr = -1; static int hf_ieee80211_rsn_cap_mfpc = -1; static int hf_ieee80211_rsn_cap_jmr = -1; static int hf_ieee80211_rsn_cap_peerkey = -1; +static int hf_ieee80211_rsn_cap_extended_key_id_iaf = -1; static int hf_ieee80211_rsn_pmkid_count = -1; static int hf_ieee80211_rsn_pmkid_list = -1; static int hf_ieee80211_rsn_pmkid = -1; @@ -4798,6 +4799,8 @@ static int hf_ieee80211_vs_aerohive_data = -1; static int hf_ieee80211_vs_mist_ap_name = -1; static int hf_ieee80211_vs_mist_data = -1; +static int hf_ieee80211_rsn_ie_ptk_keyid = -1; + static int hf_ieee80211_rsn_ie_gtk_keyid = -1; static int hf_ieee80211_rsn_ie_gtk_tx = -1; static int hf_ieee80211_rsn_ie_gtk_reserved1 = -1; @@ -13808,6 +13811,15 @@ dissect_vendor_ie_rsn(proto_item * item, proto_tree * tree, tvbuff_t * tvb, int proto_item_append_text(item, ": RSN IGTK"); break; } + case 10: + { + /* IEEE 802.11 - 2016 / Key Data Encapsulation / Data Type=10 - KeyID + * This is only used within EAPOL-Key frame Key Data when using Extended Key ID */ + offset += 1; + proto_tree_add_item(tree, hf_ieee80211_rsn_ie_ptk_keyid, tvb, offset, 1, ENC_LITTLE_ENDIAN); + proto_item_append_text(item, ": RSN PTK"); + break; + } default: proto_tree_add_item(tree, hf_ieee80211_rsn_ie_unknown, tvb, offset, tag_len, ENC_NA); proto_item_append_text(item, ": RSN UNKNOWN"); @@ -14522,6 +14534,7 @@ dissect_rsn_ie(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, &hf_ieee80211_rsn_cap_mfpc, &hf_ieee80211_rsn_cap_jmr, &hf_ieee80211_rsn_cap_peerkey, + &hf_ieee80211_rsn_cap_extended_key_id_iaf, NULL }; @@ -24945,7 +24958,7 @@ dissect_ieee80211_common(tvbuff_t *tvb, packet_info *pinfo, bytes_to_hexstr(out_buff, used_key.KeyData.Wpa.Ptk+32, DOT11DECRYPT_TK_LEN); /* TK is stored in PTK at offset 32 bytes and 16 bytes long */ out_buff[2*DOT11DECRYPT_TK_LEN] = '\0'; - if (key == 0) { /* encrypted with pairwise key */ + if (!tvb_get_bits8(tvb, 39, 1)) { /* RA is unicast, encrypted with pairwise key */ ti = proto_tree_add_string(wep_tree, hf_ieee80211_fc_analysis_tk, tvb, 0, 0, out_buff); proto_item_set_generated(ti); @@ -30714,6 +30727,11 @@ proto_register_ieee80211(void) FT_BOOLEAN, 16, NULL, 0x0200, NULL, HFILL }}, + {&hf_ieee80211_rsn_cap_extended_key_id_iaf, + {"Extended Key ID for Individually Addressed Frames", + "wlan.rsn.capabilities.extended_key_id_iaf", + FT_BOOLEAN, 16, TFS(&tfs_supported_not_supported), 0x2000, NULL, HFILL }}, + {&hf_ieee80211_rsn_pmkid_count, {"PMKID Count", "wlan.rsn.pmkid.count", FT_UINT16, BASE_DEC, NULL, 0, @@ -33701,6 +33719,11 @@ proto_register_ieee80211(void) FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + {&hf_ieee80211_rsn_ie_ptk_keyid, + {"KeyID", "wlan.rsn.ie.ptk.keyid", + FT_UINT8, BASE_DEC, NULL, 0x03, + NULL, HFILL }}, + {&hf_ieee80211_rsn_ie_gtk_key, {"GTK", "wlan.rsn.ie.gtk.key", FT_BYTES, BASE_NONE, NULL, 0, @@ -35289,7 +35312,7 @@ proto_register_ieee80211(void) {&hf_ieee80211_osen_extended_key_id_iaf, {"Extended Key ID for Individually Addressed Frames", - "wlan.osn.rsn.extended_key_id_iaf", + "wlan.osn.rsn.extended_key_id_iaf", FT_BOOLEAN, 16, TFS(&tfs_supported_not_supported), 0x2000, NULL, HFILL }}, {&hf_ieee80211_osen_reserved, diff --git a/test/captures/wpa_ptk_extended_key_id.pcap.gz b/test/captures/wpa_ptk_extended_key_id.pcap.gz new file mode 100644 index 0000000000000000000000000000000000000000..c093018f61dbd4bad03cd6745bacdedc95d9c251 GIT binary patch literal 20462 zcmV(d#-6cDLM5_iNeq>plI%MnBw3y$l$|0Wk2R#mI+ZA7jjW-PiYPrXjHM{aR#~#V zXDm;rW}cVN^ZxPsbv~at=Q`Ki*O}}4y_WmF&(P4*({KR*psgUx2?MW7s|Qg>yk`MF zfy??883lf%iC=)nVj>b?Sd7ClgZIqKIyQg-JU?HE!x6s&;4akZfa2dzg)dvJ$OXjb zQ^6@{+31)!_#`QIYudOVU@%e60Q45(Z>=4$A7UU41#k!sQv{y~TVmS*JNuXke0I(A zweRPa=9ciM0NqIn^dSI-Mq@x@G!+1s&_rthXc^IBUmQj+HvGGx>HV;KgJ?s5YRwX@ z0KgDvH~>0`rd~cXEuXgmFkbWy;)#!VVg#sE9lV_E9C($`2SFzG3V~WYqwXJ9so`*7 zCxAi%rlu5nsM7$R5>&DwV2EX|h@5=^esDIu6o+dA34XH`p3&U66`Y=tf28L@g! zhxq~V%cJZ8MhbxbjDyD+QSVc>lA@f>Eqcx|;?3eTF;=$Qe$@ zD-YKLL^n}OJw>&D|cLAevc6^Cv-gsY&R@@tJN0C=st zF|LplM3etZ#%5M=8$xiagvH~eL0KAtdn6Q!yI?g(RuHdoSi9<%A(@RY>B6OCHQ@PJC&cuX1~ zc3U&!aT%bT0pX!M1Ih!MY)oolU^M`++8-sb0{wqWZgT`54EV1-p@9r`-OP>WzypZg zp}crpDk!Hyuvg|nv4_LSVFv(8;P!3eH9Q)Q0IcCa1jy1VT>B=8v568b79rnqxr6Fo zH|vB-)XO!d^3ErrVV)P~^~f^t-;W1mFgxaL9CHW6?$Nz?Tp=hILNE*5`w26QT;4-5 zgVT{G97glEf3Sgy8}6R__j+>6;%rC4xd?QJ?nE1yeN5-^??*Ev+1joLFfY&ADwh53 zO|6eNO$fqUd;m7`6|{=wS1tzbZ9MnqA$Ek)cw84KcR{!?E?qzV=%3@C24`;mJO1$h zHU5<^b*BzSSR^46%fyeej7R{A4LKnisbzjwcaAqRUvSoD|FkgC(s%xO6ia}>P=7%1 zph2+G^gs+--;R1Wbx*;JykisZW*b?3r}z+lo|w~bxt1~i%GqM+zpI(32c$KFc(8u{ zpnuLEYdGRZ{=nDcWWB?pGxr%_*}(tO`tnSB;F3B(zGiYB{JVMUPIWv^0+b~nn2oBT zm|MyA$W|ETa>FAxZ#}QxIRC{EyD{bjTmmR3KzykHb<4i6E%UDg^#TB-q?QK)%dOak zc)fhd9$$2gs=q{zVd$7B>nk^0?0!q<&)Z;u1)u88?Wp$IELuO?$tWjO-0HPYQ?Gm} z5ifTu%!J1OmULsc;*;}I?8O)9b;Sv$1Vz}uSM-oaMBQXM;*p4=3!=Z64Aw0y2^;1e zid7A?iv#622-a_FSeJRHQeMLcMNELLA;o?j|B~SFsDfiUwl40XTT(8j`fF8HPM&F?<`)W)f31mX*ti#txb40!gH)%`9!KXqo-f0T2u0S z6K)oV3`rR-)mmFZsxilkufMJ{9S8{|>r6gE!UooveXFC^UuVMppR6-YA-E$CC*t;k z@?HpTMo>puBR}^A0{8*!c1p-| ztozh7dbVQtM4J+7Vt@-}j9Wmo?y5PB`9QmwpXLvdxEl`gX8j`m8bcu#Div-X`H7PY zWfmv*H5^IG@i<~!IvT7uLcj)_`Q21lM8&~ePYX4bWT9}OQXK15gMynK8#m~;qSE< zZ7p__>sH~MF=#eiqPR`}(!)8t&-2rcq0YF+u5}>~u zts^K-eb6o%l%pXydDTc`vjqH%mKRR3iqg4q)ctksNweGr!#C4&p?SbnosRSlyBSx` z);ej8#;U|i%8eql!gH2?PKjM&;)1zZys3(=VweB+Zr)9G?2hi?i?J!elvnS5-z+ek zl-6?KZW*$>OUb!$#m`@BC@Cg|q=v*|QZ`US!>glypWY6|-N&0sg8KxhTOaqfZK=Om z?||Y?D7Z$t#shWh<0h<*`aR=KP{fkpb^vwjka65RW9~ zzy$dd2g>C3xkL`u-jX;F3a1$M%y66p_TJ5lt4Z4wUO49Gs^BjBOJLf;+g=Fc?Y;ac|ooJ`$u*xuwS6wjUy4a(rq`1u>!bSnh$y!(?rFSl+Dk>(G`_C2!i(n+&Dpa`XmO-e=1v znKn4iOXk+l9kH=v&V6Qf-Y>4VidF*Ht5hsG{z0b?ZYL@sRanTFV5z=}?N@GI(QG_F z=pg^Ax1qCeBcMD2;U*Qmetrjka#RK6hjAHxiJdmsV-(>o`1q2B+r3Xr z*3G$NgR0_`K}S_JEXxMGZ~^fp%AK<&4R7;gV$z ze&vvkapU;~egC_UHH+kb%Q=>;b>D4`0|+=kwUg}oUlZ1USMM@xr1cJCTR+zo!FZxp z<7vUaD*(2uU6&3ORpn!pcKz_6fKPSyzWsbtMS?0guTE1Hed$*3b3!b>BlF6khm2%8Z+`zL+Ws+8)DwNPn zGjd3UPv%j-)HbB#?7lX#^=`qoaSovKU4BqD$$TdO>eip{`d3H&KJ&aR>Id#XBOHzm zyk|rGz^w%8mT@z=P}h>||JQ1H*)LwAhP%gV)L3UWad=L(>Em7Ia)Rh97oMj#>nFb6 zM{Q-?V-rnle+Pl-zKrRc##-A^urzjgE*#)BsPr1&Rn4Er0DrS}fP1rrtJ;+8J%XcZ zo<*!?=wHLp0xtUBC+31aD@t^po<3CCimlh8D3h>2wRkO@Pm4wfbsp-xhxhE=WCPeX zIlO;`r>>?(bepK!+^MDOx{>z%}R{<&1;kpdrdeAF?>0ou+B?b)v?gn-1MJ_^K0=$pOA zZ)}R&VRlq;9v3V#d-0m{pqGzWkn;D&iN;5=6YLi!gwE|S9bhUH){T7hobp|d!zT2B z64vXt(5GXn6Y4MS(H|IMQVp9+-24eU^|sukbJ!>D&vcm?uI<2gWBj5~mwW7BmDN-zt?@gB|C&%hb4nby z>#SyT9_zFpOzIv@c`Xs6FJtD)YIWDAovoB6IR55TrEGI&$f$vt`SID-JP$*seXVA6 zOgX+=wl_|-chw9kb{5X@>V>1al|uf^R!2qa)>KE?*|S}%*J&7cc%{1YDZDYty8gry zol6lyIT^Z-m$ooAani-5xxZoN-c)UG!{Kt*Pl@{KqD}pdQwo&(Gn%m`ru@NgoMkPI zc`d7qWVqCaOjO2N_Ol+J)aZHZ%bU&LyqDg6)*LJHp}d7P3m_s$MA!rAsk$JCtSQMd)Q=Mn2UDt zdR`aO;M&BYMJMAD>n=FsPN%SAb7=G29-%vVm$MeMrLgs}ArBdE+%!A@SUhfmZiu+kIW?tU@u|LDnq4i@` z>^9i5Q$gcao{^Z{Z$*##GhX=`sN2R zJ#~WYk5eV}pJ~QE$tf!vqtQHDpj;g_8Gv-u&&B$`$B(D=%=flT_H46}dofiyge- z_QkW@HI!fC`AO4HZLh~eKSxww$iq0mXZmVxZjZ%pSLNI-o__aG$LKsVBnB|Z4$%7w zv)6q5pX$CcDy${h8h3YxpaBxxJ-EBOySqCCcXxMp3GVI$3GVK0U+$YbYci9(m;24X z%P;8F=d9h;-KVO0*KT0!?HvIYc-7RZ7JUtZ#@a5z7*0c!eNOpN!W$J?7rZ~*^VLKS z)k2_)(+_J+ALGuK6&Mj++ia}!B5;FJ4eB9<2?Yt z?|=WnW%B%*J6!+%j{k>;KASa&Z0*&%ff~AL9_&@6Y{b z9CG_lJjuV}A^x#Oc>eKLfq#LBShxz$K+z4Hmj@aI0r@|PKDac<&TI`Ti|%4J*W7sKtxnf2nJvqfyx^6q-*dW~ z9gC#ina4>svJTmBd#2q%MxCX7wP`+9id?=k1p_f>-rHvt$Vx+lV=J7|^mxZMxJ&!= zDwJ~qPtoY2F~qXPhCrmmzPrd=v0b;}E-J22AR;OzkzB2Tl^=*BSJ2r;ywNW%qvy$A z%+E&QDa5cLz;&C_s4W7Ba5s2W!ckwlLWj#WmLv*z7!2?xC^8N0U7VlPfJuWz_c(Ly zJuwO_q99TAlF@1qZ0sfvxc6mmg3@a4#nhT|9aq)6-{<2)qDl^KF(Shw-`zN!0HI{E z(}_64fX0cOLH>xhP0$y%jK?t4S&tBGZ6rKwWEYd`=TH0I?|ELW5`9z7bB(NO45NsK zwDcyu@Zk5JP*3jsdo!q2T5a&(B(mG*n_1k+*thd}Pw$uzg%`c0BrZY1L1tV@^YAHv z*5^xabnk3fc8%6zFqd3?h=f|hTnw?ZLofPMCrpOZs`M|qAP7x#7H$RaD39bH1VJaL z40!|G!e_WPxM+Ks_eX{YP##QmB)L(Im_sla$sz@c8dcB6i}5kN3GVnJsCNRidh`Uq zUxQL8U01d!wMHFqJoWlBVAk0U-K|*TH5+Kasud)d{nXnv@IT4GRIyLEK9)e?ZzLD# z=&3mE18XwjU&tm%OoZn=!qjx#pnzCXW#F0Wt;{060ee$J%O{F5;@*vuE3QM4`d&cb z&3%UK*(j%1(BkOM04TtQ!Mer8s|<$wU?QVi#*NjNpF86$PbA9KQoI<9LPOUhp{2_}xz`88N@S;Ozv z#-;cJ;~w5g7{R1@m^7=gdBhy&IoTJJV<~MNHf8NdcdIGTE|dO|-j8+60(RHmXsa8z zRSiQfED8_5Vq@KdE8T*z%<@;P7C84yPEJ52FTQvk1A?ARMO6cSD(u!)zh0@N0Fmng zsFv68MeNnevTJ1mFF!y18dY*8U>FAZjCB%SKP0$GZkKfqe|~E zw$k$JB889oL7G>*69+QcdZhImLT4tycA`uv!fKcaDsy`=F5Q-S?BP2D$k5Kph5`f`=M;ax7rZ z%tc*|Zy}#RT1bJzo1C<5jvw*Zsdeqq%od?-_**o0wLwk`EPG@J+%q&l3uc&LlOAHG zr~%wXvj?-@x}=e#?m4jG=MwydO|~B!T$;)OhWA}TU9md-1g&9NjcS3|$#`Vri{(S2 zX{du?mko}@-9o>;c72*_tA?B$M0=zjo^!3kIEsrgK`4v@LRl-Y>vtJh_Oj%ZR;`Gp zoTAQkH7wI&<^wDbdAqJ(BAS?ossc`yKS(gN>S^ar7e$Q!29^zAicQ$;D{m`@Q*$>u zG|{Ix=2H;`q4v)5P!(o$(uigG0^$MPu_fFv8iX$&%CE+}567tB6?MH)S+dO=I5m#> z@{FlzGjizmezF`F9Wf3Ds3VyL3(S~!5NT&!)HdW!4qZiJ>qHuHP~vVR2F#$Qe;QuD z;@rTp3T~gD#boh|m--b2{IBDXu;2QdfB8R#AN)=3_vcW)|Bdp4zv1I7_z(W&KjRPp z0BN9qo_GwS=Jh>!%`eqHdX9+<@}F+-RwlGwlA|1)Mt;b4)Q9x*VmuLeP-fv0tGM-e%OlYh_eL;TRgn z?%=h(H#K)nd>~v-`DL==%Z4{RZC$^z^y>u+t_-xHXWMSlvUNE!l}j<(#ya!12h2R~ zbirDBgOd*8=||gmI%j7`(IGB|gElc__BJXh{*w~Ip=dWB;RS&kT7VM1>A@+JzSp^W znEPpuo1RZq{Z%EZN^sp#YK(z_O-?g)#9Z`?#3ws6@ZG&bWoali=-WlI(Fu*g{z1fhX`RQ5WoJ_KnWcqMv%;L$qc=2ff+56BKyh1Ab zfOeO< zyqqebvwGr7+%>a0?Yn`-`Yenr&CLjW1^)9krO>bzfe=V4FBR54oo~!1iHJCEE`*V` z>`&V}c%q9Ek+k8KwQ!gAI=vpduPl zG8*+MLS_&lWLD1*ksuAmUDKQaV=*$cl+S=?j99=c+mET+Ad7v<4$T5|Ss`;Fw+7_~ zPAG@iCIs)RE#H>30jM0zdMsd=1+2(t2VQ+Xk;hF51mfe;A;tDVnl<~i<6i$X4)<{K zLC2!hsgQ@O7@=9VmZb9PZHSf-cEM?uYX#+L;;7=-4b!;~LsmqGH^ zGr$T0h;_q}-%}iJ9-(T$WA3g#L0s|}+dQ!(QtMBl4n94ozepq^a~p*AR*pk)9vDh1 zRRSOioVtzOQgb1-n#Tyd2w@)`$F14E`XW-3rU_WlWXL;M*p?hB=%odeGTX4O)h7O- z!4#4u{bP~BS^5m(1@N%`HjB_$PHA5Bd7|K}#k46+|GE>a>q8dD-YX0Oup%?&{rSld zo4(3;k%xu_*Ho#geLnk4|3n7uIk0u0XK-OU3iAA0a!nZ${45=6a?KemqCaBDCM+4< zgsMtro83H*e9O(?aPE1S*G^?tx$sU`Sh=!2uIsq^bN&{(8bM1krNOhG8@j`sZq<~g z=B&Vg$cy`Ph*4nR5`$xYc6!iKqmkNr48lcJkL}KIu_Mf`p+XOW#F^wv92_7x_Y^_@Pk** zYjW7AtOrR$`Q#R?AFkX8ca`2EnZv<@L4LhXYXCl2_`6NgORL5KLtLY>Rru328cy~- zCBcwddyKEJ69k8t-XR_-YuoIygDGcD0YrLm9O5eP?UaZmj*J$a_Ntj=)`QT%CbKN; zFbPkWF=x_B1MFUnAy1t0y##e$d@sB~-!(6(F%9nD^dMQi7u*ia&g~x4tU;j_118uH zZ&ZSfb*j$mbaMC_5stGa!PUk@sK9?QgUNEUc2$4X9fB;7{G#1^p-^6OV$+W=_2JWp zYCLTscIC{DKq$sQICaKL@F*97IS@@kf1Syjwyvetgfz@&MVOLqhMcPiLENx1h?1U< z_GcShw(;Bi1vxehf+Us>*XM6-J*W5cnn?h2vA6fPVpSQUz;CJ#*K%S0?khfo8d#}UphFkTm{_zJZOX_o3X4d&v!^Hi7(iBSL+lQ8Fa9NBVqBxf1vLtq||ecZlvjYf9~-y^a3_;#FN!$u74myHk`W~(9f zh1z0bs==^=Tnu5*dHr@F_KCi%IB+Skr&Z2bzRwTC!?_Oqplj;9fk#yVh`7Y5=p+Nn zIHfLukD|D~MrIy1T)_P(?%Txzf;y5p-)%U#;cmi)hXXeTpEwAEOeX&Vlp(pBl)}Bh z{*YJehO8wd!*ut99H1R&Bgk0P8k+65z|HsXV0((7rTl_1OXknW@-rHpfvUfNr7B_8 zTSK$q*PlYVYG6AM@sw_78BAuoN0rbKTmWJ+oxcxMyrT8=2}vU{lc)TUP`{iix@k1_ zq{o2d?XC$IJ5c41Mnw?opscs(+pesD#8BazXmK7-i@-Fa1)o3rC59nwNev$-Fb{uc zfyslX4QPe68PNmb~=iY>Lp5KSsHJ;8RHC^`uD6Iv9lf@jyZ)Dw`En zpE`3brh#dkCgTM_(zah5tq>nifmqZs-^Zm&E&UNKg&IQjl}3eh`Pdcg=vKf(CMNpm zhGRyIqF`5>8%_@W$tZou(Fx#3$VlGg#l0*!Z@&yT`LJp+U4W)dhM|i_@`rP{)|R#j z#|r01lVP^PY8oqj93&X>mcDDA!rekvDh+9N-8%^QSIBHv=CGhg_yAy=SDUM<4^ePm z9?iI>eH&7{Mw#Q0VaKq_(t6-K6*uI=Wr@OD7MxwL@n$N5&9?apogPR|A@Hr_EITe!>PKJ09ZVzpw%twX39g#Ciuo;`YnKQ)g{b_ZF|XX9of@NcX~4&FBX8sLGaCl( zRmV6J0Kd(j2VA9DblVjzG-x%3`1n`6exrq`MA2+eF~TBserkyW)=Nu+{qZ-j#yt%A!7Sz?uYcVCPN(x3$MCWV>L zhN-4sJ&Oxlia@*PLcwFXAYH>3=fe$=fakQc=3?a=?;QUnQo&|omI@FPr4qXDnSBRgKCmHJA${_sxXd$5Q0tFA|7Pe-vYf^8y@eIAz_mo|iig!6LVF{Pi?c2>e5A zV&yVhMwj?`k~C1IE`sQhN+AMfK88>nsZ;dfeqK*yO=F4x z5cCRRnlu1891Yt+CP<1VZq#j(0UU!hJrk4foJ~|<{l+hY6cD+|-o9pYxAv4)M5$;t zT0*cU8{OIg8tj_@z&21_+sa(bS6sARJhX$NLbae@SK-@&r(HE}O}tKrM22kzXOKHJ z#q*5`r>(YJY_jV`@7C5~#*R)8=v*u#>-n&>-0bnWD!q9H{sg~Ur(0sBpm)VCsZa&2)G~rH= zZ!ggMIIJ#lM;#N~4tKKinc!ovhJ`Dj#rh>VEUd7^?%u*UH^9+a2s1Xpx)F;)#na2X z@|ZKTmMO%I*T>m@cpYM?yAF?>tY_VMQX+1(7d#(+A8(pH&B@w4s;V4quCTa}VvD20 zqC7^IW_Ult(@l~dH`J&&zLrHLfcQjQjpkxn6Ogo3(MpG1cf~qjmB>bC!qtd4>dPWP z7)jNr?oq0}sM-!J+1%%JC%K(2?{f{#D8CK3Joz1=?xnX&@y_EJ8u`ct@Iqqm@jV3K zi`=YcS&gej(>j+??_`T;PQ>I?Tc2%wa%>?#CNz4rG}v$T?M#s%TaL9z3vb~d}AQcoQ+32 z1f=TE68PSuJ~tJ>!>3?*tjksvzDyX&xO4q{Q)}1JD*fxw`fV(5Rh1n8VWcAt@3{05t-5FN^+q(npzoZ%huzR&P0I$p5pi+Cf*O8ZGx;A(8hp|qA-#__ z-ST8H3f|oLR`~?XO3!C$s%}GBb?H7G z#Vzr~7~UNq3a_%XUQHmji`?SGuOV6WNyp`MM!_eyqU#VoA3|VJ2n--vEp36`j4&3#S1Dr@- zQJ%}skpz^YILQv9`*LmLDHbEZn2^pfzkcZJ)1R7mt$TKf#1y?B$;I*K#6P#Q)SK*H z+E)Ub^=j3^lR4f^O(+J$F}sYcWrt!4%BhtNnsnU}qfhHOcr0!a$c~({bKBQTi^)S! z+7`#BdQI6nhP@BvHm%s#ddcj;iRbpmB+#rQ)0o`+T<`oC0%UJ}dy9Phap9vX*-~EW zHxvZd6W!p&*9jcE;tc)MY&TNp+m?37(vX@CEJO#(uvU(C%Fv^hi%6TW=30tw<#YZ$ zhF%g_Gx}ym#Q1#7jeWIMfvMJS-iBU#uJ0@4+5ofzaP5TbR(+p z?ID37A68AojS6nl4Pc}mn~=jl5z%^dV2tPa@(GQ&uUrf(wTqE1b`sAGrIMoE%fZae zm*uOY&6iH0n=ljw@k|uL+*Z{1bPA!)Mz($$wA_E2V)>joT`$$gCsf{e2~2nB${*yGDjr8u5;F<44klH;fy;oVTB)W`CQCS8 zk^?i(z5Dp-pE=5pyw3Q-&%BQP!tZ$_++DY`%Zg z9!6zX{G>hP{NDCE?V&di#GknWVC1$?y=^PcCX(CTo0UCwCtrE%BKlRalF7v~lcA79 ztM@xXr2;if^M*@TxR&5B6>%5BSG2U$^p3CC>uc_N|D`?5`T_IQcYL1TfA{OqRb%$)4`qv2GoygtLyouZtufPbk<~Mgdv_PBP}Ov3&l)TPo65iO9=ZUi{`uSSz3nf2I{>Ty#(PMEwfd($ z^u$vA+dY&81oh{7v?A#?Kfyl#)?Of!9OmHxq|en#yTc=?2z+W=<9CWt{XvT31f7MU?t;IY;QYBtB$6p1Kues42ghNja z>R)^4$J%Wv^_rh*xA)X)ep|aO4FLYfj1m0Ng1hRXUks>|={C>Kj7vLVbK6U~ile9% znd*R29L9GEDz!xDb|!7~Y_N+4N*u|NDbR1lPwW-^ZWTdi@SFJ#4sr}{Kum#Xs;w!% zrU8eDh`!d=Cd#Es5+nd-Xje{91P4A*&#YxEJ{^=VtbN@WTS8pOFKf4bzK`X2ba=cj)UN~Me~Jf zJ_a{a3(|?U>h!S#Nx(;z?R8JeJ;d5mh7X2}cZq62c{cE-@ab1xn38B>gZ%A!JGVO|xGF0d+e$N5?Q&Np<0*U%Zxpoafm#xGC#U;PC z0bR*bNK>s0mqg3{?A|#w7(lPfXsRr>oW~ZP<5@6A>U4Tm0~XrGEB1oG%;8UxiWez! z2%_hi2@UR)LW-&s)pl7Q`X$}Q%@LEis#fZ(kwVQ(AEt^i%rGQP0e-DlA<+Np>*GhQ z#j;V&Pg)Bfqnh95L{&ilyVe5G_^;2?kJ_0mlbWBjGlnL=U#mavSAYL#dEK{E%h_ym z>PJsxq|kzSrNO?kO?uiS+fX0ro8iZEDnjY2FhVnrx0*?WZdd`0GHCz2u?xEKz6_+e z>5E!dr&>6u(Up<{qB5||{&(-qO44*m+AdbURk~N*NPukdk!CH6O?(;2OsVP6dr$cV2b9 zaRFfZAL%0W*yTt7Hh-y|={Nc7HvDluAuNBM&nAms&F6n;^Z@_&`J}S^@4h{6RzH7x zhOB4X zxxdH8W<_K0{ay@5QgvZ5s$8L1x%37hD}z2#DI5%qxY98?6cto=Ji*#|4S3lKgvZD# z#{r&8AwwIj8tNfSNmO&^K>!so(@t;KFTXv+)_>gwKgJ7ZQ8ho`_Yqa|7vcrH=$gNA zoMb~#_tUu1zPJ5;+%tdn`uoI5Kl0$tVs$_9;6!3|zts#$1N`g0uuv0y$he6Md9Xaw zn|wH>RX~0ezaEIYp=rk{4{_436^xG5pm__MGhLG3=#E5yxFzf0Lk{mt|E_ ziKgYLG*41`uX~JKomBX0x*!L@!Wiio*6N&XmcB16RO>d(ag)p;o$Csq{AD2-4Nc_8 zd8@R}&U?Fu7oXD;yrw(Y=(OEd@~b+#?XxXs(G#62PR&G=ToERDN1l6%IP$+#h9-rt zWQn6DC9H~WhqTu}YeEnf6U*&y?}TC{AJ5TkA`}i9dvFgYiP?cYvAgH@7*k1$?oDBR zea)F8*%fD{W`S_^yH8Sxy7LxqxSYjo$vBuk00#mMG79hN3A}~L6xDC&Q?a%|!4GyW zaMYR}6pjKo*m(9A9&iM;7sGxR&N{18bn=OpO99W8T0MUp7fptx$41OH4CYEQN(c$c z$^(eACC5_HSC?REE0SptkmABBqknj0v+zvhv+_1@iYasR_N#{0q7OBFX6lQGdw!ZQ z$pnh&BQq3iaG%oZ<@w%udo6ozWG~A>6i7$6f*jgM+|Nsq;Ptoe7-2jV>4OcW=;Ke` zQ2j+}Zj8=>6RLaAyUc+2kt_i1&dLG{=iOVXh=;Q79m`jgH^XX6&KAA7N=_MahsAya zsD4yp*q>>EW`%l4oG}7H3bZAbAQVM~8Un?pzSysxgIvI6l;6-{xwo90VBgeB(wrcX zH^SR=94+NZx?666GETmypL1|xMqAShS)<7=-N}=2c;51fjx?N5C6%sV9)AxwMtQQC zrM(cs{K4t50Y-a4;ybW>!V_H@M-)^S3b6Au?=Y~qYERXG_cCa}sWxm6 zV^AMf{ng9^$0*?U0WDx+Hm20&u7@lmoP>u?nZ1iXas`>Q730i0u3I6L#287_`ycY5 zl42&`k;a%3ZThv(uA1<&SifU>-*Yc(9P&Y-MpevQH#Vvs#B|*lryU=~lb(f^A#_!; z8kib^gQnr)DdNPX=bYijii4Z9_<_7k&GBE%x+DoVfAm+# zQUTFI1kcY1i= z3xro11r3wRmML2XDo5l7XWSUP(rU7DbD3=RsA-G1#LP*JI`m!dW;&xr!Lp8TKjM-N z(jzTZ63>qChUG4S*4N~cvlQ~zX1L)8;VI$>MIm?qcweU94mKCqWUveNt675OpaR@} zqOLhLqi-;fZn&C+?G!8+kkrIGlVjc-Yogt3)HA~G?a8@WsJ|TeH4onN-ADX4S`|jx z`ky$2Xqx)p#(Ok?zyQF1a2ndb<`68uzxThvll}`l*tEaG^Y1ZyC(s|auK(|xM$K>W z{8~FR^!>U2^vCZ1#Pdsk{EwJK8{l8};UQpt2yq!69i{ApN+ox{D>WO}oAmtn@e4t} zM}pSmv0d-RUV|1{4qO%nB_E5{fLK@ndV98`wbtd!AqShYD6W)`xF>u9=?p)qSFW{# zv|iaa6&PsQuI`;X#Ob=pwnO=nZ>9So5l}frS66QnOV+K^vc2 z3}s30j!>%K@ZK4*${fAn@(BY;FglHCbsw{_#dOhNBOQ4-ub*Qjmh*fmu_Fx+rkrz< z<+Oi9vO+i5#;<)Iym7Mf^U?2f%-X)-&L#&xt}zRMu%Ljv$Kai*Oq*^q`vk!=ywXpW zMxA3B+OihvsNW}fC%^02ANp!H)lnqeoFK5z_!ey0y{r4Ab{502Lv@G2rB|(R114WB z9-9%7IMkD6v}Vug5JED)De1ZKzL0*)E=iTjOIqwD>D!}INyqsID8Q4deSDdPrY|UU zA}9Uu8t=BsaDCs99Z)syO31#Pd!uy-wGofK(h1>44>TBW`%`O4_A9)9^G_wp)9L^A z6hU9d|2RuC0nn)s!yY^BihCu#4BhGe4!-?WGuR?-u;-cP=m;elZb;^|K1naNBw5yM z=Ai&fotu>Nnd7F`x$@r5EVbbXa>j483R@ zeOcJyWTU!hYxgl!w`H$pv+Ib6b}l@*;q9DG4ewRzI>T0; z{2Z{YU)bQhhe$v_i#&${Y3P`<4W^3Z5oLlenHX2jBw(vh^-`~9#-z{zMWj9!9m z1lE>5i*XxB55$)>jQwTAdGl=MZ1sMJE2&<=Dk|#;UL`BKP7FP&4>C9GG1n!aR76sh z^QP`4vl?>khp7@@u{T#bQ#pVcoU& zl+GN=M}lD~crFWp=!YNXuXw>Q)Xd{>Cpyna*7kiAL&!?8U+pdLVCuB1fr>hSdzk5ny0betLUL^r*yXjCK8zMOX z8uLl1bF~Se%Q_$32xB#b>ZxWC{ewq#w6+N+$dJyLg{h324hyAf#XFK2sO zE<@tm{D>%l47#-Y;sLTw&v#;^_BqLYHP3`PMsKr$Fi5ikdfI9HHhFr68=%LKHej(I zy(>*I{lLEDt3`5B$AFhsafP9xtz(C!rWz_4)%aDx>K_hK(9o8fvX<&{zBc07fuE~C zmTQb2<_b4mLutP{(jAg?ejH-Sp$}*x#qwkJEwrwK(+W|{3cA8h!FJWrNf^#E2-KfA z_aksT#Tf>{r-`*K-rAUai>4Bbbw*^-<oRTL;4rPC z-*9r#2ntX3vBbqQ_9V3_vV_{vkyhSN?dY?@=ALz!mHlXK2*F?Q4ZoKe&u6PVCza)D z3*$W`ir0=`>`$!fv*0iy0nRZ^MAkA&P)P9 z|LJXol5RJ+QdE8*;hp*RaQe##7Itkr!!{#*Phmj?!3jl*zdN5{8M)ilOO^ z;VgQ+czLm%cQ(^>bN6@zo=wx=aY?ArdYD}VmcUkzV0E-Kk4GViU`^PuwfGQDTlC^HHa6pq#XsAVXXz zK8H=6bJxNSYSFWN9q7$q=ytJ=Qh~|lYJS1|whkJab8*OG9r1pa&Xf{7RZd#Eecm-p zJ6%V!rV=^uwfhW#z>ciR0{0x}h00w1U@7p}nhnUeK7WR7ay}ei(uC_3Q4+h!62WN6 zk0kjy?aOTXd{<;K;2D)unz6%u$ZMu>*EeS@vG3{BK-`qH?d zY|{`u-#{J5^lgtjgm}VoPKePNMV!~6$GEV2m|Bh>yE~f%9JK3H#p>A)iDF0x_5muZN}$tiNozK{ zrsz6lG4n2XC0v9G$;f`1irh5>EmnmP`)q}74g$k5&?1zYIndb{f}TpIOelMog`Xmd zUaCIr+;l9i5}hd$EHQ}Sw2@c-l{o`IfY0c~3YSV^@FIknmtL;f+`h$!rhSc`S05`M za>}-xI4*?#a}6hy5<4WR{<#i{E^_hiB=dY3mh5m?6zrgAaiFv<;~^2heUX%bOn2P3 z7TL)V=An4aj}QIpQvtW*CkWSuy?_D~k<`c59!?3Y?x@y- z2xVl;xPB;xf=+e5St#?ByDZepsKqFu^7Y>Bz^a~*c&mdMO^X0Z+vsGWANHX2>4Fu66$m&Xm{dx z+`NTiDERjC9?xaK(z`?mNEI}!0%AIYC3OmFSw7-sw5}(by~jRhu$IbD_9tn*+u>Q6 zOkhj51OWMb_%__Nu!99^={N~ei=?k7ST%m<2aSX|%uK>qU=r}Hm@DU^Gm#nQ#v*(K zx`@VY^_0ZR-6i(}EBB@0r%$!QM_&QV$W`Pii!iO%ZhcQNrwlplBUL@{$JNKi>}ZQ> z=?^6UgSI@ld`00S#A-%Rb@&KG)L?cZ$?y8Cf`RnSXen`$(c{KNH-*Z7rJeC-{5eMvWvu`4&hB4oXa2~Q{&{8?JLhP*db(-b(pGI{*legV$G^wd zXBmdo#CS(#OskD}hnJfF)|As*vBQwhk()@wE{S|5;R~T!6UWdzQfV;O`Yc%F_;}a8 z!QZY&ZOR%0e$e*`1(1AmFE(4@bK~|UvvCE^>R28!xZI&Wd|+VHu+z}m*cSd8Mn1jf zg>qrt7x$>%NwE~*wg`|*<+(ysGW=Q#mU!vS25gG%p^c2&VY6H#fCLLKtq>n_yYCRPwBWnu zt^r=LLA76s1-%K*mGiH&f^6H`7hrlHai==nMpYi@+tw^S6EKdG%)t10l!+yAnhK%m zvRalT^j(x70Axibv!9G~%(4*E<2*lYrj75C6rcH$wUrYOcC}n#l7f$=0~+_;1f~OV z+#Iy367Qvi7=uvJ*%F53xTlv8zH2R>Cg?>Sr`BSlLh-Jj32aPIc0y1M6q=nHO3%b>UbpZV2tTRDT3*cVq+88tdw%5i_(d7L z&bleAwpC#uxm-y@BKg8(^2xbiTy*21hFXf|5%QvDsV~C!d|oY@Hc~xb3Ub1nyd@sr z!I}C|NQ_hLmTzMg*H`MjFM|CtG(rqz=pbw6$v4ahoYZA_VSsm;^Lp0qc0Ao*5463O~cgX*4U|g_5g73v^SID;tA!a6iu+N8fzy>fy*`4Md zkBU(EVy!98IfhP!N$>{MSRAZPic<-x zOD*42T3!t4I8sJDeh`fQDj0`+lgW4c+Lxw13n9%K1G4nplm+U=SEKDyh|9U=7Vu!B z-ebsN&&^X_@3~SX4e?5%!Wg-2Ube_2ULLaYcbC7;QN|em`kB~|IZ7wX&pApM%kOd& zV1RWXm_NPEQOuhG=k_2U4qVL>m%uTMoWGUE$$rNOn$0=G`8mpUNyNLxVxN&bquD60 z_SJXew2o#Trw)@xX9S`OxLH7GUM^`p9cDX0&gaIStFI=XE7E(SDrHxi>;i{NY@XfX zm>{Uy97C1y%XB$IWt`}uBg%XD&gD`j7ojXz`6DTqKj_FnmxAvwDfY7MY_t~iTjX3h zF{YJ=(4yrQhH&&SGkzNjlk{oc^XQ#MD2Tk}ba+F&E* ziW@@rVtpp3#i=F(-{x(ho;nzF>dC435K$`a>+Jls!wa}G;%?wQdk<68NOC_WY!JWD zlOwX3b0l9*F75^U3)nzu@<+-RZ@8TY+(?=a0NR7#Es?QO_aDbU>W85Q4m9{WZJqDi z;8N>QwCZ@GPgGFQx#shX)Jrfbv$9(9k5?=SgR~yQ&_>B?P3Lo2J@KB^a}rh{+jy7; z1hYd5bW*!z`-%k*V4;DTxnwpA3fLfgwGseN6YX#(Mvv~I|;+^YO zWLkeCj^vjG1SZK>H>&4^xWSI%PM`7CA~7j)HbQ08St_2Fn$pYlQM_!5(#2M9dynmm z!#iP~j&-4wqzQKR2{>tJ5A1bEm%TCqZe``OR((!PEv{f$S3H2Nl#mHbW-s5I=XS`}Cc$;c;k=N^(A)v2=}qb_4}TFLQ% zwCi-Cc_>n)%utN_$+`yDNYl7PFt#H_13S%EOB7;OO_Wr(N$h?IK*`>Xu($%QIYl|0 zD;zZ)bt^o5JFBWV=;SBR@GY6La}HXjbdj9IJdOwlKEV^vFwYA4Z1^@75#|rV6zpo+ zS*T}vHx-`&#r4g67h24DsZo`^qAjYyw|E-gofqHAkCDh*16ZYkHdM6?<;gnx0I=h- z%9Cud_YkJQH4zlBq0=QOt@z`83H4P%173GpNN1&fX+Hb*wy~ky*@}(NSJvAfDuN6Y z)RTngiQy=HEvdiSYS8{-N~-VaUx}1o4)8H$gN}2JC>e~iNicFX zXRjyCJujpIds}JJMv<%V>F#u2be$(ctfdIMn#(hUi`;<* z2W`eghe+3%LAklCQ>o?wd;=qj=4Ow~6uPczTTR*M^%V3D>g^tKxX)a(8Q`<_&93At zdUf<}E-ShjL@$zO?+xfUP(m2DnabRC9)zF>heNg7y;Esypak^10$(Jqq!x=Xrp{n$ z46sL*vGqJ&%bICbW$Z3S62I#)a|`4Wwry7?Vc4X2t($KGGz!KQ2V9ID9OiCN7=IV? zE;n_tBQb`q%83Nlfg2{S){-OCJn|-(>veH{k1f5dV9lo#{6HIuc=wjxY|cYsDrvEo zghh+{MzEVFLx;*!3bH%hGH0Sz7ke%WwD+MAR}r11WJlSg4GG+b#RI(F?#yLV0NYn# z!p+}v!aasbo8TM(&^Pq$2st&_phEvmxCSZ~-EK9(FR8Jq0M1Yv&tGMA;Q_G?m_ib4 z>8ak(GvEs>J9VV1YV;7PGerHl6@m;Rz7rig%&}iK`_wo&WAlq5OD|nEgysaPHc}rF z^$l|a+3_mApK4{{zUaGXxXGO_*Cep047vlFc72vSh*Wy0ICde2NRtwTHB(x^T5!MGb7lvzDU-@KMX7_hUGf_DX6Ve$VY0$9tFR!q=U?ZY(my<>!_b)j$9=anKj68c zZ~OsI=P&U{1OB7t<)=E=@9+C>>a2u$8h=`!2t18{WqtnH>+e%<^rQV95`VToTjIal p|Ci$i{+IoKv}4<3(@%DM_r2{eXu$sL_4nB4{|_4eUcNwm003HtGJOC5 literal 0 HcmV?d00001 diff --git a/test/suite_decryption.py b/test/suite_decryption.py index e87358ee86..62735c250e 100644 --- a/test/suite_decryption.py +++ b/test/suite_decryption.py @@ -112,6 +112,31 @@ class case_decrypt_80211(subprocesstest.SubprocessTestCase): self.assertTrue(self.grepOutput('DHCP Discover')) self.assertEqual(self.countOutput('ICMP.*Echo .ping'), 8) + def test_80211_wpa_extended_key_id_rekey(self, cmd_tshark, capture_file): + '''WPA decode for Extended Key ID''' + # Included in git sources test/captures/wpa_ptk_extended_key_id.pcap.gz + self.assertRun((cmd_tshark, + '-o', 'wlan.enable_decryption: TRUE', + '-r', capture_file('wpa_ptk_extended_key_id.pcap.gz'), + '-Tfields', + '-e' 'wlan.fc.type_subtype', + '-e' 'wlan.ra', + '-e' 'wlan.analysis.tk', + '-e' 'wlan.analysis.gtk', + '-e' 'wlan.rsn.ie.ptk.keyid', + )) + # Verify frames are decoded with the correct key + self.assertEqual(self.countOutput('^32\t33:33:00:00:00:16\t\t234a9a6ddcca3cb728751cea49d01bb0\t$'), 5) + self.assertEqual(self.countOutput('^32\t33:33:ff:00:00:00\t\t234a9a6ddcca3cb728751cea49d01bb0\t$'), 1) + self.assertEqual(self.countOutput('^32\t33:33:ff:00:03:00\t\t234a9a6ddcca3cb728751cea49d01bb0\t$'), 1) + self.assertEqual(self.countOutput('^32\tff:ff:ff:ff:ff:ff\t\t234a9a6ddcca3cb728751cea49d01bb0\t$'), 4) + self.assertEqual(self.countOutput('^40\t02:00:00:00:03:00\t618b4d1829e2a496d7fd8c034a6d024d\t\t$'), 2) + self.assertEqual(self.countOutput('^40\t02:00:00:00:00:00\t618b4d1829e2a496d7fd8c034a6d024d\t\t$'), 1) + # Verify RSN PTK KeyID parsing + self.assertEqual(self.countOutput('^40\t02:00:00:00:00:00\t\t\t1$'), 1) + self.assertEqual(self.countOutput('^40\t02:00:00:00:00:00\tf31ecff5452f4c286cf66ef50d10dabe\t\t0$'), 1) + self.assertEqual(self.countOutput('^40\t02:00:00:00:00:00\t28dd851decf3f1c2a35df8bcc22fa1d2\t\t1$'), 1) + @fixtures.mark_usefixtures('test_env') @fixtures.uses_fixtures class case_decrypt_dtls(subprocesstest.SubprocessTestCase):