Commit Graph

112 Commits

Author SHA1 Message Date
Pascal Quantin 001dbaf763 ESP: honor enable_null_encryption_decode_heuristic preference when the ESP packet does not match any known SA
Otherwise checking the enable_encryption_decode preference will completely ignore enable_null_encryption_decode_heuristic

Change-Id: I34744ddb2080453dab7cd7d34f47b4984969993c
Reviewed-on: https://code.wireshark.org/review/4897
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-10-23 19:07:09 +00:00
Guy Harris 991743b0b1 Get rid of another toupper() call in favor of g_ascii_toupper().
Change-Id: If527af69ec96a91c4127c95307c3b93b79b53e2f
Reviewed-on: https://code.wireshark.org/review/4865
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-20 08:49:34 +00:00
Guy Harris 0b9eb9f4b7 Get rid of unnecessary includes of ctype.h.
Change-Id: I2cf49f808558147ce77e7d086558966cfb2defca
Reviewed-on: https://code.wireshark.org/review/4850
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-20 06:02:51 +00:00
Pascal Quantin 0a0654a7aa IPSec: fix compilation when building without libgcrypt
Change-Id: Iea3de2f0a54f9c0703afbeb42722d18da99f5c9a
Reviewed-on: https://code.wireshark.org/review/4090
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-09-12 22:06:16 +00:00
Martin Mathieson e485bcd6a6 Fix an incorrect comment
Change-Id: Ic60c67fcc554b5ceb0b359a992fafd0f84521eef
Reviewed-on: https://code.wireshark.org/review/4077
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2014-09-11 16:29:37 +00:00
Martin Mathieson ca044181a5 Do simple sequence analysis on ESP Sequence Number field
Change-Id: I84e204fb7a84eb821f4728a50945f34f4bdba73f
Reviewed-on: https://code.wireshark.org/review/4057
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2014-09-11 09:27:45 +00:00
Evan Huus fde0dbe660 fix warning: 'cipher_hd' may be used uninitialized in this function
I don't think it's an actual issue, but the new compiler on the mac buildbots
isn't smart enough to tell that.

Change-Id: I759e1afe9c4011d5612be0d15282076be6f5a331
Reviewed-on: https://code.wireshark.org/review/3355
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-08-02 14:50:19 +00:00
Michael Mann e8a8d62dc3 proto_tree_add_subtree[_format]
Change-Id: I7e016f10fcfdc0523bf2fe8c11295c0334f7c332
Reviewed-on: https://code.wireshark.org/review/2694
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-29 14:52:33 +00:00
Michael Mann 14824e6adf Revert "Fixup: tvb_* -> tvb_captured"
https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html

This reverts commit 246fe2ca4c.

Change-Id: Ib24bae0198c13a84bd7f731bf4af921212109a8f
Reviewed-on: https://code.wireshark.org/review/2430
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-19 18:25:59 +00:00
Dario Lombardo 246fe2ca4c Fixup: tvb_* -> tvb_captured
Change-Id: I9209c1271967405c34c1b6fa43e1726a4d3a5a3f
Reviewed-on: https://code.wireshark.org/review/2377
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-06-18 14:14:58 +00:00
Michael Mann 73217d9f3f tvb_new_subset -> tvb_new_subset_length when length parameters are equal.
tvb_new_subset -> tvb_new_subset_remaining it appears that's what the intention is.

Change-Id: I2334bbf3f10475b3c22391392fc8b6864454de2d
Reviewed-on: https://code.wireshark.org/review/1999
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-06-07 15:41:07 +00:00
Pascal Quantin 67bc39417c IPsec: fix implicit conversion of pointer warning
Change-Id: Id1b62e2a7ea525cf2d421e41d9f344d24b56506d
Reviewed-on: https://code.wireshark.org/review/1619
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-05-13 05:12:25 +00:00
Martin Mathieson f1c240685d Allow 16 SAs to be added, but allocate on heap to avoid growing stack
Change-Id: I68a4437c35c6e1e629cace06cfea07ae1ec45066
Reviewed-on: https://code.wireshark.org/review/1616
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-05-13 04:17:14 +00:00
Alexis La Goutte 45b6780178 Fix Dead Store (Dead assignement/Dead increment) warning found by Clang
Change-Id: I8727e74d0818f759f3c58c6f156b0b4e36eb7218
Reviewed-on: https://code.wireshark.org/review/1465
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-05-07 00:54:07 +00:00
Bill Meier ca1f87e93c Add '#include "packet-ipsec.h'; Do some cleanup.
Cleanup:
- #include <stdio.h> & <ctype.h> only when needed;
- Add editor modelines;
- Convert tabs to spaces;
- Use a consistent indentation (2 spaces).

Change-Id: I5ef67b5c6aff99bf5dc1655b20760f862cd14d7f
Reviewed-on: https://code.wireshark.org/review/1445
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-04-30 17:36:28 +00:00
Pascal Quantin 45f381daa6 IPsec: fix compilation when building without libgcrypt
Change-Id: If525fb27ec607201efceb3ab9207305c3a4953dc
Reviewed-on: https://code.wireshark.org/review/1439
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-04-30 14:51:51 +00:00
Alexis La Goutte 035f6f2fdc Try to make Mac OS X Buildbot Happy
packet-ipsec.c:1905: warning: implicit conversion shortens 64-bit value into a 32-bit value

Change-Id: Ic293e6b297f8f52aef7a102ab5ca0e0e98b9d7a7
Reviewed-on: https://code.wireshark.org/review/1436
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-04-30 08:54:46 +00:00
Martin Mathieson 266e0a9275 Add an API for programmatically adding ESP SAs (most likely from a private
dissector).

Also, speed up ESP decryption in several ways:
- store gcrypt_cipher_hd in the SA struct, rather than continually
open, setkey and close for each PDU
- don't convert the key string from ascii to hex each time - do it upon
during update callback and keep
- do the decryption in-place, avoiding the need to allocate, memcpy and
free a separate buffer for encrypted data
- when matching addresses, avoid doing a strlen until after we check
whether or not we're matching against "*"

Change-Id: Ibb66663ec21326351abc761be78a0d57f7797fa5
Reviewed-on: https://code.wireshark.org/review/1421
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-04-30 05:01:12 +00:00
Michael Mann 65700bd2e0 Make a dissector table out of IPv6 Next header.
This cleans up the implementation of the extension header, but also allows Decode As functionality for Next Header fields. This allows "old" SHIM6 IP protocol number (not IANA registered) to still be dissected.

bug:9995
Change-Id: I6f29a1f7db144478c5b6416d27da2c9c5a7a1de1
Reviewed-on: https://code.wireshark.org/review/1378
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-04-28 23:50:15 +00:00
Pascal Quantin ad33357e62 Exported PDU: add support for more than 32 tags
Change-Id: Idc9f105164919827a8a81c88b5a56de4fa25df0b
Reviewed-on: https://code.wireshark.org/review/1197
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-04-18 20:15:04 +00:00
Michael Mann fdeed480bf Convert ep_address_to_str -> address_to_str(wmem_packet_scope, ...) for all dissectors
Change-Id: I7489e2fb3a1f2630ca17b0a5fe1aa873992f1061
Reviewed-on: https://code.wireshark.org/review/975
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-04-06 01:31:28 +00:00
Pascal Quantin 488f2a0974 Exported PDU: add support for data length on the wire
Change-Id: Iff14ec4d0297ec85f3597b33871fb0ab5256a597
Reviewed-on: https://code.wireshark.org/review/728
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-19 05:13:30 +00:00
Alexis La Goutte 296591399f Remove all $Id$ from top of file
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04 14:27:33 +00:00
Gilbert Ramirez 4cc694839d Fix all -fstrict-alias warnings found by gcc 4.1.2
The majority of the fixes are for calls to uat_new(). Instead of
having each caller cast its private data to (void**), we use void*
in the uat_new() API itself. Inside uat_new(), we cast the void*
to void**.

Some dissectors use val64_string arrays, so a VALS64() macro was
added for those, to avoid using VALS(), which is useful only for
value_string arrays.

packet-mq.c was changed because dissect_nt_sid() requires
a char**, not a guint**. All other callers of dissect_nt_sid() use
char*'s (and take the address of it) for their local storage. So,
this was changed to follow the other practices.

A confusion between gint and absolute_time_display_e in packet-time.c
was cleared up.

The ugliest fix is the addition of ip6_guint8_to_str(), for exactly
one caller. The caller uses one type of ip6 address byte array,
while ip6_to_str() expects another. This new function is in place
until the various address implementations can be consolidated.

Add VALS64() to the developer documentation.

Change-Id: If93ff5c6c8c7cc3c9510d7fb78fa9108e4552805
Reviewed-on: https://code.wireshark.org/review/48
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-03 09:26:10 +00:00
Jakub Zawadzki 1053e722ed Fix warnings
svn path=/trunk/; revision=54089
2013-12-14 12:45:57 +00:00
Jakub Zawadzki f91eba752b Fix some warnings: cast discards `__attribute__((const))' qualifier from pointer target type
svn path=/trunk/; revision=53875
2013-12-08 23:16:06 +00:00
Michael Mann 30b49ceb50 IPsec ESP: add AES-GCM decryption. Bug 8395 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8395)
Insert Any 64bit authnetication option so AES-GCM with 8 byte ICV

From Alexandru Juncu

svn path=/trunk/; revision=53844
2013-12-08 02:27:52 +00:00
Bill Meier 2ac134b3c5 whitespace fixes; mostly: remove trailing blanks
svn path=/trunk/; revision=52591
2013-10-13 19:56:52 +00:00
Pascal Quantin d09ffee44e Add ability to export decrypted IPsec PDUs
svn path=/trunk/; revision=50022
2013-06-18 23:01:46 +00:00
Michael Mann 0f0c111119 Remove check_col() and the occasional tree.
svn path=/trunk/; revision=49920
2013-06-14 01:02:11 +00:00
Evan Huus 37600a157b Rename value string (and similar) functions to use a consistent pattern. This
was done using textual search+replace, not anything syntax-aware, so presumably
it got most comments as well (except where there were typos).

Use a consistent coding style, and make proper use of the WS_DLL_* defines.

Group the functions appropriately in the header.

I ended up getting rid of most of the explanatory comments since many of them
duplicated what was in the value_string.c file (and were out of sync with the
recent updates I made to those in r48633). Presumably most of the comments
should be in the .h file not the .c file, but there's enough churn ahead that
it's not worth fixing yet.

Part of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8467

svn path=/trunk/; revision=48634
2013-03-29 00:26:23 +00:00
Anders Broman 6bde918078 From beroset:
remove C++ incompatibilities 
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416

svn path=/trunk/; revision=48426
2013-03-19 20:00:52 +00:00
Anders Broman d0efafbcb1 From beroset:
remove C++ incompatibilities from UAT_VS_DEF macro and all uses

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416

svn path=/trunk/; revision=48259
2013-03-12 06:40:13 +00:00
Evan Huus bdca315497 From Alex Badea via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8395
Support AES-GCM ipsec encryption using CTR (since libgcrypt doesn't support
GCM). Using CTR instead gets us decryption, but does not verify authentication.

svn path=/trunk/; revision=47886
2013-02-25 22:19:15 +00:00
Martin Kaiser 38a73a32f3 include the wsutil/wsgcrypt.h instead of including gcrypt.h directly
svn path=/trunk/; revision=47802
2013-02-21 18:23:29 +00:00
Guy Harris 29715ccc8f How can I get a new tvbuff that starts at an offset within a given
tvbuff and runs to the end of the tvbuff?  Let me count the ways....

Replace a bunch of different ways of doing that (some incorrect, in that
they're not properly handling tvbuffs where the captured and reported
lengths are different) with tvb_new_subset_remaining().

svn path=/trunk/; revision=47751
2013-02-19 23:17:07 +00:00
Guy Harris 8ed7a73e22 Fix a bunch of warnings.
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
sizeof.

Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
strtol() and strtoul().

Change some data types to avoid those implicit conversion warnings.

When assigning a constant to a float, make sure the constant isn't a
double, by appending "f" to the constant.

Constify a bunch of variables, parameters, and return values to
eliminate warnings due to strings being given const qualifiers.  Cast
away those warnings in some cases where an API we don't control forces
us to do so.

Enable a bunch of additional warnings by default.  Note why at least
some of the other warnings aren't enabled.

randpkt.c and text2pcap.c are used to build programs, so they don't need
to be in EXTRA_DIST.

If the user specifies --enable-warnings-as-errors, add -Werror *even if
the user specified --enable-extra-gcc-flags; assume they know what
they're doing and are willing to have the compile fail due to the extra
GCC warnings being treated as errors.

svn path=/trunk/; revision=46748
2012-12-26 05:57:06 +00:00
Anders Broman 007a0b28ae From Matthias St. Pierre:
Add full rfc4868 support to both dissectors.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7873

svn path=/trunk/; revision=45708
2012-10-22 12:34:01 +00:00
Alexis La Goutte 2ce9037866 Fix some Dead Store (Dead assignement/Dead increment) Warning found by Clang
svn path=/trunk/; revision=45681
2012-10-21 14:53:20 +00:00
Anders Broman 13c9bcad82 From "msp":
'*' wildcard in the 'Src IP' or 'Dest IP' field of the ESP SA dialog does not work

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7866

svn path=/trunk/; revision=45585
2012-10-16 14:31:14 +00:00
Alexis La Goutte b34abdc943 From Alex Badea via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7849
IPsec ESP: allow filtering by ICV verification result

Add hf_esp_icv_good and hf_esp_icv_bad (similar to IP checksums), to allow
filtering based on the ICV check results.

svn path=/trunk/; revision=45483
2012-10-11 20:38:39 +00:00
Jeff Morriss 2552c750e5 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45017
2012-09-20 02:03:38 +00:00
Guy Harris 659cf0527a UATs could be put into "categories". The categories were defined only
implicitly by the #define name and string they were defined to; not all
UATs neatly fit into any of the categories, so some of them were put
into categories that weren't obviously correct for them, and one - the
display filter macro UAT - wasn't put into any category at all (which
caused crashes when editing them, as the GUI code that handled UAT
changes from a dialog assumed the category field was non-null).

The category was, in practice, used only to decide, in the
aforementioned GUI code, whether the packet summary pane needed to be
updated or not.  It also offered no option of "don't update the packet
summary pane *and* don't redissect anything", which is what would be
appropriate for the display filter macro UAT.

Replace the category with a set of fields indicating what the UAT
affects; we currently offer "dissection", which applies to most UATs
(any UAT in libwireshark presumably affects dissection at a minimum) and
"the set of named fields that exist".  Changing any UAT that affects
dissection requires a redissection; changing any UAT that affects the
set of named fields that exist requires a redissection *and* rebuilding
the packet summary pane.

Perhaps we also need "filtering", so that if you change a display filter
macro, we re-filter, in case the display is currently filtered with a
display filter that uses a macro that changed.

svn path=/trunk/; revision=43603
2012-07-08 01:00:46 +00:00
Jakub Zawadzki bf81b42e1e Update Free Software Foundation address.
(COPYING will be updated in next commit)

svn path=/trunk/; revision=43536
2012-06-28 22:56:06 +00:00
Bill Meier d53320919a Remove unneeded #includes (stdlib, stdio, ctypes, time);
In a few cases: do some whitespace, indentation cleanup & reformatting.

svn path=/trunk/; revision=42632
2012-05-15 19:23:35 +00:00
Jeff Morriss 0b52b73a46 dissect_esp(): 'i' is only (really) used if we HAVE_LIBGCRYPT.
svn path=/trunk/; revision=40383
2012-01-05 02:06:08 +00:00
Bill Meier 199da73e21 Prevent memory leakage of uncompress tvb and associated data buffer (step 1).
(tvb memory leak will actually remain until a bug in tvbuff.c is also fixed).

svn path=/trunk/; revision=40171
2011-12-13 02:56:44 +00:00
Anders Broman 443fe1e7f8 Use to display ESP SPI BASE_HEX_DEC as it is in decimal in SIP.
svn path=/trunk/; revision=40118
2011-12-08 19:34:04 +00:00
Anders Broman 1b75d2a3f3 ..Filter is not used any more.
svn path=/trunk/; revision=39639
2011-10-27 19:20:39 +00:00
Anders Broman e595aec776 Fix comparison with UAT keys.
svn path=/trunk/; revision=39637
2011-10-27 16:49:53 +00:00