Commit Graph

290 Commits

Author SHA1 Message Date
Guy Harris 494508f2d0 Clean up REPORT_DISSECTOR_BUG().
Have it take a format and argument list as arguments, and have the
formatting done inside the reporting code.  That way, we're not relying
on any particular wmem scope working.

If WIRESHARK_ABORT_ON_DISSECTOR_BUG is set, try to add the message to
the crash information (currently only supported in macOS), and print it
to the standard error, before crashing.  We won't necessarily have a
usable crash dump to analyze, so we can't rely on that to find the cause
of the crash.

Ping-Bug: 14490
Change-Id: I2b39169c45c84f2ada31efa1d413bd28c140f8f4
Reviewed-on: https://code.wireshark.org/review/26643
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-03-25 23:49:35 +00:00
Dario Lombardo fe219637a6 dissectors: use SPDX identifiers.
Change-Id: I92c94448e6641716d03158a5f332c8b53709423a
Reviewed-on: https://code.wireshark.org/review/25756
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-12 16:49:58 +00:00
Matej Tkac 2acaf0a47a [ISAKMP] Added support for new Notify EMERGENCY_CALL_NUMBERS Payload
In accordance with the latest 3GPP TS 24.302 (Section 8.2.9.8)
                                  3GPP TS 24.008 (Section 10.5.3.13)

Bug: 14273
Change-Id: Ib5a24fa33633764f6bfb034250c309c1f4af9914
Reviewed-on: https://code.wireshark.org/review/24793
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-12-15 20:59:36 +00:00
Michael Mann 23afd9a184 Convert to using find_conversation_pinfo where appropriate
This makes it easier to identify the simpler/common conversations

Change-Id: I7094f23e49156ee27f5f72c8e130308470f3e462
Reviewed-on: https://code.wireshark.org/review/24145
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-10-28 14:33:11 +00:00
Julian Renz 2154cb12a9 ISAKMP: Added support for the accepted Diffie-Hellman group number in the INVALID_KE_PAYLOAD
Notify payload according to RFC 5996.
Also fixed a bug where the dissection of the previously
added support for the SIGNATURE_HASH_ALGORITHMS Notify payload would not work properly.

Change-Id: I54ffe6b0d8b52189af3dc2e879e6665739fc36a4
Reviewed-on: https://code.wireshark.org/review/23439
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-09-10 14:27:42 +00:00
Julian Renz 7b6296ac5a ISAKMP: Added dissection of the RFC7427 Notify Payload "SIGNATURE_HASH_ALGORITHMS" according to
iana IKEv2 parameters

Change-Id: Ie10d0a8a076d65f60590b4fac0b36be7b87dec2a
Reviewed-on: https://code.wireshark.org/review/23396
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2017-09-06 14:58:17 +00:00
Peter Wu 540b555729 Introduce "bytes_string" type, similar to "value_string"
In order to map arbitrary byte buffers to strings, introduce a new
"bytes_string" type. Since "bytes_to_str" is already used for other
purposes, name the generic function "bytesval_to_str" instead similar to
the name( "val_to_str").

Accept "size_t" as length parameter since this is what is returned by
the "sizeof" operator. Do not add a "try_bytesval_to_str_idx" variant
since this pattern is not needed for now. Add a variant to match the
prefix since this is currently expected by the ISAKMP dissector.

Change-Id: I6d790325e85d9fb1384330f28a8c36e2057fdf30
Reviewed-on: https://code.wireshark.org/review/20386
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-03-08 23:04:12 +00:00
Peter Wu 6b84ddee83 Make Libgcrypt a mandatory dependency
Removed all guards for HAVE_LIBGCRYPT, change autotools and CMake to
error out if it is not available. Update release notes, developer
documentation and README with the new status. Clarify relation with
GnuTLS in macosx-setup.sh. Install Libgcrypt via brew script.

Motivation for this change is that many dissectors depend on Libgcrypt
and having it optional increases the maintenance burden (there have been
several compile issues in the past due to the optional status).
Furthermore, wsutil has crypto code that can be replaced by Libgcrypt.

Change-Id: Idf0021b8c4cd5db70b8766f7dcc2a8b3acbf042f
Link: https://www.wireshark.org/lists/wireshark-dev/201702/msg00011.html
Reviewed-on: https://code.wireshark.org/review/20030
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-02-13 18:35:47 +00:00
AndersBroman b5610a0436 [ISAKMP] Dissect 3GPP private error and status messages in NOTIFY.
Change-Id: Iaa65c1cf9f358e36e77b4a5cad2543dcbb98072e
Reviewed-on: https://code.wireshark.org/review/20090
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-02-13 17:36:52 +00:00
Alexis La Goutte 60a877167f ISAKMP: Add Forticlient (connect License and EndPoint Control) from Fortinet Vendor ID
Change-Id: Idf40de8bfa76cbe4437a157fc90bd994d4b2233e
Reviewed-on: https://code.wireshark.org/review/19872
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-31 00:24:58 +00:00
Michael Mann af54b292e6 Register reassembly tables
Register all reassembly tables with a central unit, allowing the
central unit to have the callback that initializes and destroys
the reassembly tables, rather than have dissectors do it individually.

Change-Id: Ic92619c06fb5ba6f1c3012f613cae14982e101d4
Reviewed-on: https://code.wireshark.org/review/19834
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-29 13:29:04 +00:00
Alexis La Goutte 936ebfe2ed ISAKMP: Add Fortigate (Fortinet) Vendor ID
Display also release (and build)

Change-Id: Ib97f47a0b0179712a82f0aee0ca079a05b8b590c
Reviewed-on: https://code.wireshark.org/review/19730
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-22 20:48:27 +00:00
Dario Lombardo 805ddd1add uat: add a reset callback.
This function will free the resources allocated by the caller.

Change-Id: Ib486c14e4fd3c321662fb71f7fd06733ce9a64a4
Reviewed-on: https://code.wireshark.org/review/19375
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-12 12:39:15 +00:00
Mirko Parthey 13851f331c ISAKMP: add Reserved fields
Add Reserved fields as defined by:
* RFC 7296 for IKEv2
* RFC 2408 for IKEv1
* draft-ietf-ipsec-isakmp-mode-cfg-05 for the IKEv1 Attributes Payload

Change-Id: I0c25de6e543aa5461650fb4cd2c103a6a3a8c392
Reviewed-on: https://code.wireshark.org/review/19480
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-01-03 12:38:38 +00:00
Mirko Parthey 6f9c4c807e ISAKMP: Fix size of ID in IKEv1 Attributes Payload
Fix the size of the Identifier field in the IKEv1 Attributes Payload.
Reference: draft-ietf-ipsec-isakmp-mode-cfg-05, section 3.2

Change-Id: I30bfde9caa6750b342f7dfbad39e63341614a45b
Reviewed-on: https://code.wireshark.org/review/19502
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2017-01-02 20:23:46 +00:00
Mirko Parthey 6af7425cee ISAKMP: fix dissection of IKEv2 ID Payload
Fix dissection of the IKEv2 Identification Payload.
Unlike IKEv1, it does not have Protocol and Port fields.

References:
* RFC 2407, section 4.6.2
* RFC 7296, section 3.5

Change-Id: I968e378abd49363785dd7308a4f27908c1c05a8a
Reviewed-on: https://code.wireshark.org/review/19497
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-01-02 13:17:08 +00:00
Michael Mann f4b0abc729 Dissectors don't need a journey of self discovery.
They already know who they are when they register themselves.  Saving the
handle then to avoid finding it later.
Not sure if this will increase unnecessary register_dissector functions
(instead of using create_dissector_handle in proto_reg_handoff function)
when other dissectors copy/paste, but it should make startup time
a few microseconds better.

Change-Id: I3839be791b32b84887ac51a6a65fb5733e9f1f43
Reviewed-on: https://code.wireshark.org/review/19481
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-31 07:31:42 +00:00
Mirko Parthey 9bcf111b7d ISAKMP: add Reserved fields for Fibre Channel
Add Reserved fields for Fibre Channel Traffic Selectors.
Reference: RFC 4595, section 4.4

Change-Id: Iba0b3d9a4d3d96918971a9a597fa313b022b5ca2
Reviewed-on: https://code.wireshark.org/review/19444
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-29 07:01:01 +00:00
Mirko Parthey 0e3841c3dd ISAKMP: add traffic selector subtree
Create a new subtree for each traffic selector.

Use the length field to find the next traffic selector
rather than accumulating the individual TS field sizes.

Split dissect_ts() to introduce separate offset variables.
After adding the final field, do not advance offset again
to avoid unused variable warnings.

Change-Id: I9951662c1bb3958994162b25b70b43ec1da103a7
Reviewed-on: https://code.wireshark.org/review/19440
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-28 07:31:48 +00:00
Michael Mann b7f4e25059 Adjust proto_tree_add_uint_format_value calls to use unit string
Several calls to proto_tree_add_uint_format_value could be better served
using BASE_UNIT_STRING with a "unit string" in hf_ field.  There also
a few cases where proto_tree_add_uint_format_value could just be
proto_tree_add_uint.

Added a few more "common" unit string values to unit_strings.[ch]

Change-Id: Iaedff82c515269c9c31ab9100dff19f5563c932d
Reviewed-on: https://code.wireshark.org/review/19242
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-13 22:56:50 +00:00
Mirko Parthey 183856f724 ISAKMP: Rename identifiers for readability
Rename attribute dissecting functions and their local variables to
improve code readability, and adjust white space.

old                               new
------------------------------------------------------------------
dissect_rohc_supported            dissect_rohc_attribute
dissect_transform_ike2_attribute  dissect_ike2_transform_attribute
option                            attribute
optlen                            value_len

rohc                              attr_type
transform_attr_type               attr_type
cfg_attr_type                     attr_type

rohc_tree                         tree
transform_attr_type_tree          tree
cfg_attr_type_tree                tree

sub_rohc_tree                     attr_tree
sub_transform_attr_type_tree      attr_tree
sub_cfg_attr_type_tree            attr_tree

rohc_item                         attr_item
transform_attr_type_item          attr_item
cfg_attr_type_item                attr_item
------------------------------------------------------------------

Change-Id: I135e5deb802edc575e7fddd1bb397272aac0888c
Reviewed-on: https://code.wireshark.org/review/18553
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-28 22:00:07 +00:00
Mirko Parthey b3363fbbde ISAKMP: update protocol parameters
Update IKE authentication methods and config attributes.

Change-Id: I103beaf79eebaa0704424ad89f4d38a2701ae50b
Reviewed-on: https://code.wireshark.org/review/18357
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-21 23:13:04 +00:00
Mirko Parthey 10a1e8d261 ISAKMP: fix typos and whitespace
Change-Id: I8fd34acac2562ffea6f1e726b71d63f9f631bb54
Reviewed-on: https://code.wireshark.org/review/18355
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-10-21 15:41:12 +00:00
Mirko Parthey 3756c0e24d ISAKMP: Fix defragmentation of EAP-TLS in IKEv2
Remove NULL check to ensure IKEv2 encrypted payloads are dissected
during first pass, which is required for EAP-TLS fragment reassembly.

Change-Id: I7fd46ee2163188c1a8dd256a43f1457441b1b95a
Reviewed-on: https://code.wireshark.org/review/18348
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-21 05:06:30 +00:00
Michael Mann 2eb7b05b8c Convert most UDP dissectors to use "auto" preferences.
Similar to the "tcp.port" changes in I99604f95d426ad345f4b494598d94178b886eb67,
convert dissectors that use "udp.port".

More cleanup done on dissectors that use both TCP and UDP dissector
tables, so that less preference callbacks exist.

Change-Id: If07be9b9e850c244336a7069599cd554ce312dd3
Reviewed-on: https://code.wireshark.org/review/18120
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-13 02:51:18 +00:00
Michael Mann 268841f3e0 Combine Decode As and port preferences for tcp.port dissector table.
This patch introduces new APIs to allow dissectors to have a preference for
a (TCP) port, but the underlying data is actually part of Decode As functionality.
For now the APIs are intentionally separate from the regular APIs that register a
dissector within a dissector table.  It may be possible to eventually combine the
two so that all dissectors that register with a dissector table have an opportunity
to "automatically" have a preference to adjust the "table value" through the
preferences dialog.

The tcp.port dissector table was used as the guinea pig.  This will eventually be
expanded to other dissector tables as well (most notably UDP ports).  Some
dissectors that "shared" a TCP/UDP port preference were also converted. It also
removed the need for some preference callback functions (mostly when the callback
function was the proto_reg_handoff function) so there is cleanup around that.

Dissectors that has a port preference whose default was 0 were switched to using
the dissector_add_for_decode_as_with_preference API rather than dissector_add_uint_with_preference

Also added comments for TCP ports used that aren't IANA registered.

Change-Id: I99604f95d426ad345f4b494598d94178b886eb67
Reviewed-on: https://code.wireshark.org/review/17724
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-08 02:44:53 +00:00
Mirko Parthey bff2f93c7d isakmp: Add dissection of Responder Lifetime notification
Derive the dissection functions from
dissect_ike_attribute() and dissect_ipsec_attribute():
* Add dedicated header fields.
* Remove attribute types not applicable in Responder Lifetime context.

Clean up the field name "isakmp.ipsec.attr.type".

Bug: 12963
Change-Id: I486380836d915255812098be2190bcc77ec13c00
Reviewed-on: https://code.wireshark.org/review/17970
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-10-05 04:17:05 +00:00
Mirko Parthey e239f72585 ISAKMP: Rename identifiers and change item labels
Rename identifiers and change item labels to reflect their purpose:
* ISAKMP Phase 1 = IKE
* ISAKMP Phase 2 = IPsec
* IKEv2 Attribute = Transform Attribute
Remove "transform" and "type" where they do not apply.

External users of isakmp.tf.* field names, such as display filters,
have to be updated after this commit to use isakmp.ipsec.* instead.

old                                     new
--------------------------------------------------------------------
dissect_transform_attribute()           dissect_ipsec_attribute()
dissect_transform_ike_attribute()       dissect_ike_attribute()

ISAKMP_                                 IPSEC_

hf_isakmp_tf_attr                       hf_isakmp_ipsec_attr
isakmp.tf.                              isakmp.ipsec.

transform_ike_attr_type                 ike_attr_type
transform_isakmp_attr_type              ipsec_attr_type
transform_attr_sa_life_type             attr_life_type
transform_dh_group_type                 dh_group
transform_attr_encap_type               ipsec_attr_encap_mode
transform_attr_auth_type                ipsec_attr_auth_algo
transform_attr_ecn_type                 ipsec_attr_ecn_tunnel
transform_attr_ext_seq_nbr_type         ipsec_attr_ext_seq_nbr
transform_attr_addr_preservation_type   ipsec_attr_addr_preservation
transform_attr_sa_direction_type        ipsec_attr_sa_direction
transform_attr_enc_type                 ike_attr_enc_algo
transform_attr_hash_type                ike_attr_hash_algo
transform_attr_authmeth_type            ike_attr_authmeth
transform_attr_grp_type                 ike_attr_grp_type

Type Payload                            Payload
Transform IKE Attribute Type            IKE Attribute
Transform Attribute Type                IPsec Attribute
Transform IKE2 Attribute Type           Transform Attribute
Config Attribute Type                   Config Attribute
ISAKMP (v1)                             IKEv1
ISAKMP (v2)                             IKEv2
--------------------------------------------------------------------

Change-Id: Ib02a0bad100f932a290cae35ea4bd75b191f797b
Reviewed-on: https://code.wireshark.org/review/17914
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-27 03:44:17 +00:00
Alexis La Goutte 68dbc6431f ISAKMP: fix Argument with 'nonnull' attribute passed null found by Clang Analyzer
Change-Id: I8d7ebc6dd46e0d6494d412653ec423b8c0fde9c8
Reviewed-on: https://code.wireshark.org/review/17203
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-23 03:00:27 +00:00
Mirko Parthey 553e119672 ISAKMP: Reduce code duplication
Equalize attribute dissecting functions:
* Convert all attribute type names to range_string.
  Add "Unassigned" and "Private use" ranges while we are at it.
* Swap the order of format and type fields for config attributes.

Move common code into the new function dissect_attribute_header().
Try to keep the parameter list short:
* Group the hfindex values for attribute details into a struct.
* Merge attribute subtree types.

Add a colon in the main attribute item label for visual separation.

Skip dissection of config attributes for unknown IKE versions.

Change-Id: I6e6286f3d4cf16f3cd16a23aca540c4af72f3442
Reviewed-on: https://code.wireshark.org/review/17663
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-09-18 13:58:22 +00:00
Mirko Parthey 70f3737c3e ISAKMP: Fix handling of cert requests without CA
Check IKEv1 Certificate Request Payloads for an empty
Certificate Authority field, which is allowed by RFC 2408.
Suppress dissection of this field if it is indeed empty.

Change-Id: Ifb997e460a4c12003215fde86c374cfc769c5d72
Reviewed-on: https://code.wireshark.org/review/17501
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-09-05 18:56:13 +00:00
Mirko Parthey 294fcd11bf ISAKMP: fix # of SPIs field name in Delete payload
Fix the "Number of SPIs" field name in the Delete payload.
References: RFC 2408, RFC 7296

Change-Id: I205fb830275fc011e6605fdae53c6b9141e1628b
Reviewed-on: https://code.wireshark.org/review/17353
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-28 14:41:06 +00:00
Pascal Quantin 8915bb2a4e ISAKMP: remove useless callback
isakmp_cleanup_protocol() and isakmp_init_protocol() are already registered
as cleanup and init routines

Change-Id: I4fd2348dc507c8bc933aebd5abfb2522b57da0b4
Reviewed-on: https://code.wireshark.org/review/17284
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-24 05:54:32 +00:00
Mirko Parthey 0fcca6f0c8 ISAKMP: fix DOI field read size
Read 4 bytes from the packet instead of 1 because that is the
correct size of the DOI field.
Reference: RFC 2408

Change-Id: I5745363811bb46af307a925d688ec36cfb29984b
Reviewed-on: https://code.wireshark.org/review/17271
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-24 04:38:26 +00:00
Michał Skalski 505bcefd20 isakmp Fix IKEv2 modification UAT crash
Problem is that not all fields of UAT are updated on change (only those
defined in UAT definition with ikev2_uat_flds, specifically pointers to
encr_spec and auth_spec in ike2_decr_data_t were set to NULL.

Fixed by re-setting pointers after update table callback was called.

Also fixed memory leaks after UAT modification.

Bug was partially resolved with change
Ibdab979b5959eb561635cbcb446e17138baca87b
https://code.wireshark.org/review/17078

which eliminated crash, but decryption still didn't work after UAT
modification (DISSECTOR BUG was displayed).

Bug: 12748
Change-Id: I8209edd8e214d62e34b641fdd2e046b9ff4c95eb
Reviewed-on: https://code.wireshark.org/review/17249
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23 21:31:37 +00:00
Michał Skalski c7ca0e88df dissector ISAKMP IKEv2: fixed bug with libgcrypt-1.6.x and AEAD ciphers
IKEv2: 
Fixed bug with AEAD ciphers with 8- and 12-byte length ICVs and
libgcrypt 1.6.x - gcry_cipher_checktag() returned INVALID_LENGTH.
Fixed for merged changeset https://code.wireshark.org/review/17078


Added support for verification of encrypted data with HMAC_MD5_128
[RFC4595] and HMAC_SHA1_160 [RFC4595] integrity algorithms

Added IKEv2 decryption suite for few combinations of encryption and
integrity algorithms: 3DES-CBC/SHA1_160, AES-128-CCM-12, AES-128-CCM-12
(using CTR mode), AES-192-CTR/SHA2-512, AES-256-CBC/SHA2-256,
AES-256-CCM-16, AES-256-GCM-16, AES-256-GCM-8


Change-Id: Ic564b25f1fd41e913c605322b7b8aa030cf90ddf
Reviewed-on: https://code.wireshark.org/review/17213
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23 10:07:38 +00:00
Peter Wu 52910f4e3f isakmp: fix type confusion
Caught by ASAN with WIRESHARK_DEBUG_WMEM_OVERRIDE=simple set.

Manually inspection of all type casts to decrypt_data_t and
ikev2_decrypt_data_t showed no other users that do not check
isakmp_version first.

Change-Id: If889afff85a20e31222d33cbea8db3a91a77f389
Reviewed-on: https://code.wireshark.org/review/17246
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michał Skalski <mskalski13@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-23 04:12:32 +00:00
Mirko Parthey 9c80ff0617 IKEv2: Add D-H Transform IDs for Brainpool Curves
Add Diffie-Hellman Group Transform IDs for the ECC Brainpool Curves.

References: RFC 6932, RFC 6954

Change-Id: I1ca0da8e5e06abbd1c53a591d01c1f05aa60c35a
Reviewed-on: https://code.wireshark.org/review/17231
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 19:21:04 +00:00
Michał Skalski d2ee571df2 dissector ISAKMP: Added decryption using AES-GCM, AES-CCM and AES-CTR
Added support for decryption of IKEv2 packets encrypted with PAED or CTR
cipher mode.
Verification of integrity requires libgcrypt 1.6.0 or later. If it is
not the case, only decryption is performed
Can easily be extended to other ciphers supported by libgcrypt.

NOTE: There is long-term bug in handling UAT for IKEv2 - any change
resulting in change count of IKEv2 UAT entries causes crash when
matching key from UAT is found.
Crash does not occur when UAT is read from user prefs file.
I observed this bug also on stock 1.10.6 version from Ubuntu 14.04 LTS

I have no knowledge, how to fix it.

Change-Id: Ibdab979b5959eb561635cbcb446e17138baca87b
Reviewed-on: https://code.wireshark.org/review/17078
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-19 11:13:33 +00:00
Pascal Quantin 3c8f657e01 ISAKMP: Fix Result of operation is garbage or undefined found by Clang Analyzer
Change-Id: I47233968dfc87494b3c959896622db5cd31244a7
Reviewed-on: https://code.wireshark.org/review/17065
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Mirko Parthey <mirko.parthey@web.de>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-18 04:29:12 +00:00
Mirko Parthey 561a2f056b Fix IKEv1 decryption and initialization vectors
Generate initialization vectors during Wireshark's first pass,
in order to improve reliability and efficiency. (bug #12699)
Remove a dissection shortcut in first pass to allow early analysis
of the transform payloads, which is needed to find out the crypto
algorithms.

Introduce a hash table to store an IV per message ID. (bug #12610)
Fix handling of the initial phase 1 IV. (bug #12620)
Cache IVs as per-packet data instead of a list.

Use the wmem allocator to avoid memory leaks.
Ensure libgcrypt resource cleanup on error paths.

Rely only on IKE attributes to find the decryption algorithm,
do not consider the length of the user-configured secret at this point.

Split code into small functions.

Ping-Bug: 12610
Ping-Bug: 12620
Ping-Bug: 12699
Change-Id: I7137943da42d54816808312cd1716a7e05478cbb
Reviewed-on: https://code.wireshark.org/review/16846
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-11 04:16:25 +00:00
Michael Mann be1398c17c Convert uses of g_alloced data with tvb_new_child_real_data to use pinfo->pool instead.
Aldo update documentation to suggest using wmem pinfo->pool instead of glib memory

Change-Id: I5d34cc6c1515aa9f0d57784b38da501ffcb95ccc
Reviewed-on: https://code.wireshark.org/review/16551
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
2016-07-20 22:12:56 +00:00
Michael Mann 2ab4155794 tvb_get_string_enc + proto_tree_add_item = proto_tree_add_item_ret_string
Also some other tricks to remove unnecessary tvb_get_string_enc calls.

Change-Id: I2f40d9175b6c0bb0b1364b4089bfaa287edf0914
Reviewed-on: https://code.wireshark.org/review/16158
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-06-27 15:20:06 +00:00
Michael Mann 57ef06e242 *_stdup_printf -> strdup for "single string only" formatting.
Done for performance improvements.

This could probably be done in checkAPIs.pl, but this was just
a quick manual check with grepping.

Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d
Reviewed-on: https://code.wireshark.org/review/15751
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-06-06 06:03:58 +00:00
Michael Mann 9bcac48403 Manually add protocol dependencies derived from find_dissector.
Started by grepping call_dissector_with_data, call_dissector_only and call_dissector and traced the handles passed into them to a find_dissector within the dissector.  Then replaced find_dissector with find_dissector_add_dependency and added the protocol id from the dissector.
"data" dissector was not considered to be a dependency.

Change-Id: I15d0d77301306587ef8e7af5876e74231816890d
Reviewed-on: https://code.wireshark.org/review/14509
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-03-20 12:48:48 +00:00
João Valverde e4c059f67f Add free_address_wmem(), fix warnings [-Wcast-qual]
Try to improve address API and also fix some constness warnings
by not overloading the 'data' pointer to store malloc'ed buffers
(use private pointer for that instead).

Second try, now passing test suite.

Change-Id: Idc101cd866b6d4f13500c9d59da5c7a38847fb7f
Reviewed-on: https://code.wireshark.org/review/13946
Petri-Dish: João Valverde <j@v6e.pt>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2016-02-26 23:09:43 +00:00
Michael Mann 5aa3a88f1a Separate hf_ fields that share filter names with FT_UINT32 and FT_UINT64 datatypes.
'bitcoin.addr.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.inv.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.getdata.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.notfound.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.getblocks.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.getheaders.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.tx.input_count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.tx.in.script_length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.tx.output_count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.tx.out.script_length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.block.num_transactions' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.headers.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.merkleblock.flags.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.merkleblock.hashes.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.string.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'bitcoin.data.count' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'dcerpc.referent_id' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'dmp.body.id' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'edonkey.start_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'edonkey.end_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.entry' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.phoff' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.shoff' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_vaddr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_paddr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_filesz' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_memsz' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.p_align' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.sh_addr' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.sh_offset' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.sh_size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.sh_addralign' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.sh_entsize' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.symbol_table.value' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.symbol_table.size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.dynamic.tag' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.dynamic.value' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.dynamic.pointer' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.dynamic.ignored' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'elf.dynamic.unspecified' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'h248.contextId' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'hcrt.data32' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'wlan_mgt.fixed.psmp.stainfo.reserved' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'isakmp.tf.attr.life_duration' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'isakmp.ike.attr.life_duration' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'jxta.message.element.content.length' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'rmt-lct.tsi' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'rmt-lct.toi' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'smb.alloc_size' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32
'trmac.response_code' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT32

Change-Id: I903933e6448bac3d3374eef1a6a0bc4771c1a9f4
Reviewed-on: https://code.wireshark.org/review/14060
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-22 13:40:27 +00:00
João Valverde ef929dc8eb Revert "Add free_address_wmem() and other extensions to address API"
This reverts commit 13ec77a9fc.

This commit introduces a segmentation fault for Lua code (uncovered by the test suite).

Change-Id: Ibc273d1915cda9632697b9f138f0ae104d3fb65e
Reviewed-on: https://code.wireshark.org/review/13813
Reviewed-by: João Valverde <j@v6e.pt>
2016-02-08 00:44:22 +00:00
João Valverde 13ec77a9fc Add free_address_wmem() and other extensions to address API
Try to improve 'address' API (to be easier/safer) and also avoid
some constness warnings by not overloading the 'data' pointer to
store malloc'ed buffers (use private pointer for that instead).

Change-Id: I7456516b12c67620ceadac447907c12f5905bd49
Reviewed-on: https://code.wireshark.org/review/13463
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2016-02-07 23:22:30 +00:00
Xavier Brouckaert 1b481f31b1 Fixed Cisco Vendor IDs in IKEv2 dissector.
Change-Id: Idb8fce8fae1b2b580f9ca7a9c71e430bfa7dfb44
Reviewed-on: https://code.wireshark.org/review/13606
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-31 01:19:04 +00:00