Commit graph

77941 commits

Author SHA1 Message Date
Dario Lombardo
16ef9b6735 kerberos: fix compilation on FreeBSD.
FreeBSD shows a combination of define cases that make the function
missing_encryption_key unused. Put it in the right define scope.

Change-Id: Icf226f134ffa7624a7daf709c302c29acfffe95e
Reviewed-on: https://code.wireshark.org/review/37360
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-06-02 21:57:22 +00:00
Guy Harris
f4e977ebac kerberos: add some comments to #else/#endif.
You are in a twisty little maze of #ifdefs, all different.

Change-Id: I4c82efe27e840919c7bf19a035abe90cd84e0fbd
Reviewed-on: https://code.wireshark.org/review/37367
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-06-02 20:57:48 +00:00
Dario Lombardo
21dc133147 kerberos: set some parameters unused.
Change-Id: If813820ff96a73f68244bf195767c7dbc8df496f
Reviewed-on: https://code.wireshark.org/review/37359
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-06-02 19:56:41 +00:00
469b0b2765 GSM RR: Fix wrong expert warning about missing P1 Rest Octets
3GPP TS 04.08 sec 9.1.22 "Paging request type 1" states that "P1 Rest
Octets" is (M)andatory, but then in the same table states its length
ranges from 0 to 17, which means it can actually be missing on some
cases:
"The sum of the length of this IE and the L2 Pseudo Length of the
message equals 22."

So that happens (l2 plen = 22) for instance when 2 IMSIs are provided in
a Paging Request Type 1 message. In that case, we shouldn't be warning
about the packet being malformed having the IE missing, since it's
actually expected.

The l2 Pseudo Length is shifter 2 bits because that's how it's defined
in the spec (sec 10.5.2.19).

Change-Id: I3dcb1d23c7d6fd2f1e370462481086516f24c7bb
Reviewed-on: https://code.wireshark.org/review/37361
Reviewed-by: Vadim Yanitskiy <axilirator@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Harald Welte <laforge@gnumonks.org>
Reviewed-by: Pascal Quantin <pascal@wireshark.org>
2020-06-02 19:33:04 +00:00
Martin Mathieson
e0eefe186a Fix some cppcheck issues:
- Some redundant assignments or tests.
- Some declarations were changed to match definitions in terms of
including _U_ for the same parameters
- Some parenthesis added/changed to made precedence more obvious

epan/color_filters.c:533: style: Variable 'name' is reassigned a value before the old one has been used.
epan/color_filters.c:534: style: Variable 'filter_exp' is reassigned a value before the old one has been used.
asn1/tcap/packet-tcap-template.c:2199: warning: Function 'dissect_tcap_ITU_ComponentPDU' argument order different: declaration '_U_, tvb, offset, _U_, tree, _U_' definition '_U_, tvb, offset, actx, tree, _U_'
epan/dissectors/packet-aim.c:2546: warning: Function 'dissect_aim_tlv_value_icq' argument order different: declaration 'ti, subtype, tvb, _U_' definition 'ti, _U_, tvb, pinfo'
epan/dissectors/packet-arp.c:1133: style: Clarify calculation precedence for '&' and '?'.
epan/dissectors/packet-arp.c:1143: style: Clarify calculation precedence for '&' and '?'.
epan/dissectors/packet-arp.c:1158: style: Clarify calculation precedence for '&' and '?'.
epan/dissectors/packet-arp.c:1168: style: Clarify calculation precedence for '&' and '?'.
epan/dissectors/packet-gtpv2.c:5997: warning: Function 'dissect_gtpv2_mbms_service_area' argument order different: declaration 'tvb, _U_, tree, _U_, _U_, _U_, _U_, _U_' definition 'tvb, _U_, tree, item, _U_, _U_, _U_, _U_'
epan/dissectors/packet-gtpv2.c:6291: warning: Function 'dissect_gtpv2_mbms_time_to_data_xfer' argument order different: declaration 'tvb, _U_, tree, _U_, _U_, _U_, _U_, _U_' definition 'tvb, _U_, tree, item, _U_, _U_, _U_, _U_'
epan/dissectors/packet-gtpv2.c:6369: warning: Function 'dissect_gtpv2_epc_timer' argument order different: declaration 'tvb, _U_, tree, _U_, _U_, _U_, _U_, _U_' definition 'tvb, _U_, tree, item, _U_, message_type, _U_, _U_'
epan/dissectors/packet-knxip.c:2939: style: Condition 'mac_error' is always false  (just added comment)
epan/dissectors/packet-mac-lte.c:4386: style: Clarify calculation precedence for '&' and '?'.
epan/dissectors/packet-nas_5gs.c:1828: style: Variable 'nas5gs_data->payload_container_type' is reassigned a value before the old one has been used. (noted confusing recursion)
epan/dissectors/packet-rpcrdma.c:587: warning: Identical condition 'offset>max_offset', second condition is always false
epan/dissectors/packet-rsl.c:2098: style: Assignment of function parameter has no effect outside the function.

Change-Id: Ib5c9a04cfb6e6233972bc041434601c8ef09c969
Reviewed-on: https://code.wireshark.org/review/37343
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2020-06-01 20:44:27 +00:00
Martin Mathieson
75cc8d7691 PCNFSD: Add missing proto_item for tree.
From a recent cppcheck scan:
epan/dissectors/packet-pcnfsd.c:222: style: Condition 'password_item' is always false

Change-Id: I90a210899bd1e7a6de350322577e5e1598e078d5
Reviewed-on: https://code.wireshark.org/review/37353
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2020-06-01 17:57:13 +00:00
Martin Mathieson
060f876f97 HTTP2: check return code of a strcmp() call
From a recent cppcheck scan:
epan/dissectors/packet-http2.c:1604: warning: The expression 'strcmp(header_name,"<unknown>") != 0' is suspicious. It overlaps 'strcmp(header_name,":method") == 0'.
epan/dissectors/packet-http2.c:1604: warning: The expression 'strcmp(header_name,"<unknown>") != 0' is suspicious. It overlaps 'strcmp(header_name,":status") == 0'.

Change-Id: I373398112ca9e44d848da4a2b21bd7d059fa049c
Reviewed-on: https://code.wireshark.org/review/37352
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2020-06-01 17:56:28 +00:00
Gerald Combs
2ca5a14513 Qt: Fix some Qt 5.15 deprecation warnings.
Use Qt::ItemFlags() instead of 0.

Use QFileDialog::Options() instead of 0.

Use QComboBox::textActivated instead of QComboBox::activated.

Switch to just using Qt::WindowFlags() in GeometryStateDialog. This
*should* work for Qt 5.5 and earlier, but if it doesn't we can switch
back.

Change-Id: Iaf4e7efa1a11fc7f3325b449eef1be308cd21b45
Reviewed-on: https://code.wireshark.org/review/37349
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 08:20:01 +00:00
Mikael Kanstrup
42544c8c44 dot11decrypt: Support decryption using TK user input
Add support for TK user input keys. With this Wireshark can
decrypt packet captures where 4WHS frames are missing and
packet captures with non-supported AKMS, for example
802.11r / Fast BSS Transitioning.

Decryption using user TK works as a backup if the normal
decryption flow does not succeed. Having TK decryption keys
added will affect general IEEE 802.11 dissector performance
as each encrypted packet will be tested with every TK.
Worst case scenario is plenty of TKs where none of them
matches encrypted frames.

On successful user TK decryption an SA is formed based on
parameters used to decrypt the frame. This SA is similar to
what is formed when Wireshark detects and derive keys from
4WHS messages. With the SA entry in place the decryption
performance (success case) should be on par with "normal"
decryption flow.

Bug: 16579
Change-Id: I72c2c1e2c6693131d3ba07f8ddb8ff772c1b54a9
Reviewed-on: https://code.wireshark.org/review/37217
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 07:23:56 +00:00
Filipe Laíns
f1bc8ad34b USB HID: annotate usbhid.data
Change-Id: I283bab1ecdadc17589e2fbe944a457f5b5211970
Signed-off-by: Filipe Laíns <lains@archlinux.org>
Reviewed-on: https://code.wireshark.org/review/37317
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 07:23:46 +00:00
Minh Phan
88aec0ecd9 editcap: fix time adjustment for ERF
The erf_dump function in erf.c keeps the header intact and
ignores the adjusted time.
This adds a section for checking if the timestamp is changed
and updating the header accordingly.

Bug: 16578
Change-Id: I14468a302e746c7a84cf5619b73b94850142d930
Reviewed-on: https://code.wireshark.org/review/37301
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 06:51:55 +00:00
Peter Wu
0b179d901e composite_tvb: fix memory leak when tvb_composite_finalize is not called
There is a window where the memory for the composite TVB can be leaked,
namely between calling tvb_composite_new and tvb_composite_finalize.
This can occur due to complex dissector logic (bug 16375) or due to
exceptions preventing tvb_composite_finalize from being called.

Fix this by attaching the composite TVB sooner to another TVB. Ideally
tvb_composite_new is changed to receive the initial TVB as parameter,
but that would change its API.

While at it, remove a redundant NULL-pointer check and comment. The
comment referring to a union was likely about avoiding the const-cast.

Bug: 16375
Change-Id: Ic8c6d1da6fbd5ff9f16b1280af3aab23f9ed470d
Reviewed-on: https://code.wireshark.org/review/37345
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 03:40:57 +00:00
Peter Wu
43cfa9c1fa http2: fix build error with nghttp2 before 1.11
nghttp2_hd_inflate_hd has only been deprecated because its "in" argument
is non-const, aside from this aspect the implementation is equivalent.
For inflate_http2_header_block there is no difference since the buffer
is already non-const. However in fix_partial_header_dissection_support,
the given buffer is const. To avoid new -Wcast-qual warnings while
keeping the buffer read-only, just add a simple wrapper function.

This fixes a build failure reported for libnghttp2-devel
1.7.1-1.15.x86_64 on openSUSE Leap 42.3.

Change-Id: I9ab9305ffc5920f5e3f4866c2f0378d45008b57a
Reviewed-on: https://code.wireshark.org/review/37346
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01 03:40:33 +00:00
Pascal Quantin
507285a534 GTPv2: add dissection of Monitoring Event Extension Information IE
Bug: 16596
Change-Id: I3467ea41d0686338d1c4aa085ebbafa18b1062f7
Reviewed-on: https://code.wireshark.org/review/37348
Petri-Dish: Pascal Quantin <pascal@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal@wireshark.org>
2020-05-31 16:42:58 +00:00
Pascal Quantin
9888a4c742 GTPv2: fix display of spare bits in Monitoring Event Information IE
Bug: 16596
Change-Id: I82a8b5cdb341138d3a4928d2fe3a9df2f885ce51
Reviewed-on: https://code.wireshark.org/review/37347
Reviewed-by: Pascal Quantin <pascal@wireshark.org>
2020-05-31 16:42:41 +00:00
Gerald Combs
5e0ebc9fc0 [Automatic update for 2020-05-31]
Update manuf, services enterprise numbers, translations, and other items.

Change-Id: I85f6df38480057cab59cf3edc6b6fb12dd116afc
Reviewed-on: https://code.wireshark.org/review/37339
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2020-05-31 08:17:44 +00:00
Nardi Ivan
c416e2ff37 Qt: improve performance of related packet delegate
Use proper functions to lookup/iterate elements in QHash
Avoid useless lookup

Change-Id: I7a115ae5ed35b31599f33050e36bf68007167a96
Reviewed-on: https://code.wireshark.org/review/37304
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
2020-05-30 07:50:12 +00:00
Gerald Combs
0708fadb33 WSDG: Mention CMAKE_OSX_DEPLOYMENT_TARGET.
Add an entry for CMAKE_OSX_DEPLOYMENT_TARGET to the CMake section.

Change-Id: I6b15d0e3dfeb501b61049b09a0cb94f6a9297353
Reviewed-on: https://code.wireshark.org/review/37337
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-30 06:46:19 +00:00
Gerald Combs
4e6f47fa62 Qt: Make our exported and saved line endings consistent.
Make sure we set QIODevice::Text on our QTextStreams when saving and
exporting text so that we get native line endings on Windows.

Change-Id: I4602157d2d170eb9a2c79032254ea5be236c7589
Reviewed-on: https://code.wireshark.org/review/37336
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-30 06:46:01 +00:00
Gerald Combs
76d92ba7e7 Qt: Updates for 5.15.
Fix the following deprecation issues for Qt 5.15:

Use Qt::WindowFlags() instead of 0 in Qt >= 5.6.

Pass Qt::SkipEmptyParts instead of QString::SkipEmptyParts to QString::split() in Qt >= 5.15.

Use QMultiMap instead of QMap where we were using QMap::uniqeKeys().

Use QCP::Interactions() instead of 0.

Use '\n' instead of QTextStream::endl.

Use QWheelEvent::angleDelta() instead of QWheelEvent::angle().

Change-Id: Ie2d69d3a396c0821c2c34f506ddad6f8e22f7049
Reviewed-on: https://code.wireshark.org/review/37334
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-30 06:45:07 +00:00
Jaap Keuter
3605bdc323 WSUG: Remove expression button from filter toolbar
Since Wireshark 3.2 the filter toolbar no longer has an Expression button.
Remove this from the Users Guide as well.

Change-Id: I54d0356c42ff599296fa800e7d730e6098f35976
Reviewed-on: https://code.wireshark.org/review/37338
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2020-05-29 23:01:30 +00:00
Gerald Combs
029051d7e9 CMake: Add a MIN_MACOS_VERSION check for Qt 5.15.
According to https://doc.qt.io/qt-5/supported-platforms.html, Qt 5.15
supports macOS 10.13 - 10.15.

Change-Id: Iecd9b6f10d6b968ad145d247e934fddec25658f7
Reviewed-on: https://code.wireshark.org/review/37330
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-05-28 04:59:56 +00:00
Glenden Lee
a584fd9fb6 ieee80211: Add datarate for 802.11AX packets
Bug: 16255 - support HE MCS to rate conversion
Change-Id: I4a4a6c3d62c167b654d150c397047a55f287e6c8
Reviewed-on: https://code.wireshark.org/review/37255
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-05-27 21:45:43 +00:00
Jaap Keuter
d02ea543b7 WSDG: Fix example
Fix example header field map for proto_tree_add_bitmask() adding missing
terminator.

Bug: 16582
Change-Id: Ia4fe5e9ce8bbab74ad0e17f14609568ee03c88f5
Reviewed-on: https://code.wireshark.org/review/37329
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2020-05-27 21:28:56 +00:00
Tomasz Moń
b036c0742e USB: Set address after creating interface conversation
Both bus id and device address are already known when creating interface
info on the first pass. Set the values early to prevent passing zero
initialized data to dissectors.

Change-Id: I50c748eb16e0ab39fdc84f2d7503c87ae48eeae9
Reviewed-on: https://code.wireshark.org/review/37328
Petri-Dish: Tomasz Moń <desowin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Filipe Laíns <lains@archlinux.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 19:14:21 +00:00
Filipe Laíns
c3e2f3cf9c USB HID: introduce report_descriptors data structure
Change-Id: I2914f715860b7ae2eba311cd067a50b044b42928
Signed-off-by: Filipe Laíns <lains@archlinux.org>
Reviewed-on: https://code.wireshark.org/review/37315
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 19:14:05 +00:00
Dario Lombardo
fc35d51089 Fix compilation without kerberos.
Error:
./asn1/kerberos/packet-kerberos-template.c:109:2: error: unknown type name ‘enc_key_t’
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_EncryptionKey’:
./asn1/kerberos/kerberos.cnf:386:7: error: unused variable ‘start_offset’ [-Werror=unused-variable]
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_T_authenticator_subkey’:
./asn1/kerberos/kerberos.cnf:406:42: error: ‘save_Authenticator_subkey’ undeclared (first use in this function); did you mean ‘hf_kerberos_authenticator_subkey’?
./asn1/kerberos/kerberos.cnf:406:42: note: each undeclared identifier is reported only once for each function it appears in
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_T_encTicketPart_key’:
./asn1/kerberos/kerberos.cnf:445:42: error: ‘save_EncTicketPart_key’ undeclared (first use in this function); did you mean ‘hf_kerberos_encTicketPart_key’?
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_T_encKDCRepPart_key’:
./asn1/kerberos/kerberos.cnf:435:42: error: ‘save_EncKDCRepPart_key’ undeclared (first use in this function); did you mean ‘hf_kerberos_encKDCRepPart_key’?
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_T_encAPRepPart_subkey’:
./asn1/kerberos/kerberos.cnf:416:42: error: ‘save_EncAPRepPart_subkey’ undeclared (first use in this function); did you mean ‘hf_kerberos_encAPRepPart_subkey’?
./asn1/kerberos/kerberos.cnf: In function ‘dissect_kerberos_T_krbCredInfo_key’:
./asn1/kerberos/kerberos.cnf:455:42: error: ‘save_KrbCredInfo_key’ undeclared (first use in this function); did you mean ‘hf_kerberos_krbCredInfo_key’?
cc1: all warnings being treated as errors

Change-Id: Ib9e38c3d745dd8a12ac8e4691918770a8b876727
Reviewed-on: https://code.wireshark.org/review/37313
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 19:12:03 +00:00
Pascal Quantin
64d99d6662 NAS 5GS: do not stop dissection if the messages are integrity protected only
We should explicitly check that the security header indicates the use of
ciphering.

Change-Id: I0e6f50e180f95e03d6e1dd96db39a03543490be4
Reviewed-on: https://code.wireshark.org/review/37326
Petri-Dish: Pascal Quantin <pascal@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal@wireshark.org>
2020-05-27 16:51:54 +00:00
Tomas Kukosa
5233a37c93 GeoNW: add support for psid-traffic-light-control-status-service ::= 637
Change-Id: Ic4b7617714645fd9471a18c719d1d56c3f2bf6eb
Reviewed-on: https://code.wireshark.org/review/37324
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 12:37:09 +00:00
Stefan Metzmacher
f5858299a9 packet-kerberos: maintain EncAPRepPart_subkey in a kerberos_app_session_keys map
This improves the performance a lot if you have a keytab with a lot of
entries (e.g. for a whole domain).

GSSKRB5 decryption should only try the subkey of the AP-Rep.

We could further optimize this and remember the key
on the cenversation after the first success, but
that's for another day.

Change-Id: I405e41e7d90073d569fcbeec4b4188453a251000
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37323
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 12:07:51 +00:00
Stefan Metzmacher
8b35c401dc packet-{kerberos,spnego}: move KRB5_KU_USAGE_* defined to packet-kerberos.h
Change-Id: I4d4014c6def44144461497ad4d92b9f32b4d3140
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37322
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 11:08:07 +00:00
Mališa Vučinić
5aaec7f16d oscore: Update to RFC8613.
-Update dissection of the OSCORE option.
-Enable zero-length Sender and Recipient ID.
-Add ID Context field in preferences.
-Update context derivation to rfc8613.
-Extend context lookup to include ID context.
-Fix Observe responses.

Bug: 16585
Change-Id: Ib9823a54cf535be3559e1c41a19b8b612458777f
Reviewed-on: https://code.wireshark.org/review/37314
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 06:59:47 +00:00
Guy Harris
53a24787b8 kerberos: fix build without krb5_c_fx_cf2_simple().
Have completely separate definitions of krb5_fast_key(); the one used if
we don't have krb5_c_fx_cf2_simple() declares *all* parameters as
unused, as it's a stub routine.

Change-Id: I828c8d8f60634fcf537c2822f1a1c5db33ea2798
Reviewed-on: https://code.wireshark.org/review/37321
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-05-27 06:56:57 +00:00
Filipe Laíns
60571acacc USB HID: make usbhid.data bytes
Change-Id: Ib8544956a4138aca2b2157bf29cbde414ee3b388
Signed-off-by: Filipe Laíns <lains@archlinux.org>
Reviewed-on: https://code.wireshark.org/review/37316
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 06:03:37 +00:00
Gerald Combs
7d3881ddc5 WSDG: Mention winget and scoop.
Note that Windows Package Manager (winget) and Scoop exist, but don't
currently provide all of the packages we require.

Change-Id: I69f6958faec3454f37eda79e5b76d3e70d399555
Reviewed-on: https://code.wireshark.org/review/37320
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-27 05:09:44 +00:00
Stefan Metzmacher
daf8b802d8 packet-kerberos: avoid guessing the KDC_REP keyusage were possible
We already know about the top level message type.

So we only need an autodetection for the TGS-REP.
We could also avoid that, but that would need state to
match TGS-REQ with TGS-REP.

But if we client used FAST and we got a strengthen_key,
we're sure an authenticator subkey was used.

Windows don't use an authenticator subkey without FAST,
but heimdal does.

For now try 8 before 9 in order to avoid overhead and false
positives for the 'kerberos.missing_keytype' filter in pure
windows captures.

Change-Id: If974dda735cd2aa5b1920c26309e5e2081723e4f
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37299
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 13:58:45 +00:00
Stefan Metzmacher
fd9ed550c3 packet-kerberos: avoid guessing the authorization_data keyusage
Change-Id: I28bdf176818401c1e4e6ef15cf808e502fcf4989
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37300
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 12:38:16 +00:00
Stefan Metzmacher
d89565e0c0 packet-kerberos: avoid guessing the authenticator key usage
We already know a few details in order to avoid the autodetection.

This avoids overhead and false positives for the
'kerberos.missing_keytype' filter.

Change-Id: I8a15fa41d2a56df3fb26de046a401bf43a876b79
Reviewed-on: https://code.wireshark.org/review/37298
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 12:20:10 +00:00
Stefan Metzmacher
fa60a8c5f5 packet-kerberos: provide details about missing keys
It's useful to see which decryption keys are missing!
The "kerberos.missing_keytype" filter can be used to find all of them.

It's also useful to see which key_map was is in used
and how many decryption attempts were tried.

This should also allow future optimizations in
order to avoid decryption attempts based on the usage
and more detailed key maps.

Change-Id: Ie0302454e29a65aa00ddac79839aac8ec63fa290
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37297
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 12:10:30 +00:00
Stefan Metzmacher
738e73a50e packet-kerberos: add support for decrypting KRB5 FAST messages
Currently this is only available for MIT Kerberos, but it
should be possible to implement the same using
krb5_crypto_fx_cf2() from Heimdal.

Change-Id: Ic3327dfde770f9345485bf97e2ac6045b909b64e
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/36472
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 11:42:42 +00:00
Anders Broman
a97956fa20 gtpv2: Use ENC_TIME_MSEC_NT for "Origination time stamp".
Change-Id: Ia993f61058907e75487f6a1a718b34dccfd1437e
Reviewed-on: https://code.wireshark.org/review/37312
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 10:34:00 +00:00
Stefan Metzmacher
d2ad1a42d6 packet-kerberos: show learnt and used decryption keys on the top level tree
This gives a useful overview.

Change-Id: I39aaa8cf5de6fa3788c674355675873f2212b78f
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37292
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:26:16 +00:00
Stefan Metzmacher
94f0842f8b packet-kerberos: split out kerberos_new_private_data()
This way we can avoid zero_private on the stack.

Change-Id: Iea7ed7e1cd6d0616b0e72aeff489549efd13e4f4
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37291
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:25:29 +00:00
Stefan Metzmacher
975e8531a7 packet-kerberos: improve displaying used decryption keys
Change-Id: Ia2d8a0aa34ad1503477c0b8f3aa382a666067e24
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37290
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:24:20 +00:00
Stefan Metzmacher
b95a1b652f packet-kerberos: display details of learnt keys
That makes it easier to match them.

Change-Id: I29b9d69415d82a1ea7df275a89a413c2fd460b1f
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37289
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:23:48 +00:00
Anders Broman
e2f43f4cfa nghttp2: Assume we have a method header if we find <unknown>
In incomplete streams the http2 dissector fails to display the content of
a data packet following a header with unknown fields as
reassembly_info->data_initiated_in is not set.

Change-Id: I754bdc92049124bcc722a25f8cf791e36f8f523a
Reviewed-on: https://code.wireshark.org/review/37311
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:16:56 +00:00
Stefan Metzmacher
8edf1cf549 packet-kerberos: let decrypt_krb5_with_cb() use kerberos_all_keys
For now we use kerberos_all_keys, but in future we may select the
map based on passed usage.

Change-Id: I1f29e97aa60a41be3694b75bc4353b3a5dae0eae
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37288
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 09:16:45 +00:00
Stefan Metzmacher
3a289703ef packet-kerberos: maintain a kerberos_all_keys map
This will be used temporary in order to replace
enc_key_list until we maintain/use separate lists.

Note that this will use wmem_file_scope(), but it
will get the longterm keys filled in when needed.

In the long run, we'll use more detailed lists
and use optimizations depending on the key usage.

Change-Id: If654dcfbc9ec8742eadbbb82b97a23fe8403022d
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/37287
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 08:55:14 +00:00
Lorand Jakab
acbcfefa7e LISP: add support for Distinguished Name AFI in LCAFs
Distinguished Name (AFI 17) is not a widely used address family, but
there is ongoing work in the LISP IETF working group to standardize its
use within the LISP control plane protocol. The encoding is quite
simple, it's just a zero-terminated ASCII string. Details can be found
in the following IETF draft:

https://tools.ietf.org/html/draft-farinacci-lisp-name-encoding

A previous patch (https://code.wireshark.org/review/36892) added support
for DN in simple AFI usages. This patch add support for DN within the
LISP Canonical Address Format (LCAF) usage.

Change-Id: Ic2dbbd1e36e2eabb91202c04eb86fdf151fe9928
Reviewed-on: https://code.wireshark.org/review/37275
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 08:33:49 +00:00
Peter Wu
677fc33d5c NSIS: remove unused DisableSection and EnableSection macros
These macros were added in commit 6e9e773a85 for GTK1-related stuff
and removed in commit 12ac5d6859 and serve no other purpose. Note that
documentation for section flags can be found in
https://nsis.sourceforge.io/Docs/Chapter4.html#sectionsetflags

Change-Id: I6a24de8836e40e94c9a55706bdce6a64e1adb553
Reviewed-on: https://code.wireshark.org/review/37309
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-26 08:31:52 +00:00