add a parameter *datalen to decrypt_krb5_data() so that we can pass back
the length of the decrypted blob back to the caller.
This is useful for when there are "junk" at the end of the blob and thus
the decrypted data is not the same size as the encrypted blob.
GSS CFX is one such example.
(we should have done this earlier since it might have made some other
stuff easier to imlement...)
make the preference setting krb_decrypt a globally visible variable so
we can see its value and act on it from callers of krb decryption from
outside of packet-kerberos.c i.e. from GSS CFX
Make keytype == -1 a wildcard that when passed to decrypt_krb5_data()
will try any/all encryption keys.
This since GSS CFX does not provide the enctype in the GSS layer.
(The GSS CFX enctype is only negotiated during the AP-REQ/REP so we
should later pick this value up and store it in a CFX session variable.
That is for a later enhancement.
)
Enhance the GSS decryption (that for hitorical reasons are implemented
in packet-spnego.c and not packet-gssapi.c :-) )
to also handle decryption of GSS CFX
This should make wireshark able to decrypt any/all GSSAPI RFC4121
packets, if the keytab file is provided.
I have successfully decrypted LDAP using GSS CFX with AES encryption
with this.
svn path=/trunk/; revision=26350
- if offset is 0, tvb_length is the same as tvb_length_remaining, just faster.
Replace
- col_append_fstr() with faster col_append_str()
- col_add_str() with col_set_str()
when it's safe
svn path=/trunk/; revision=23252
some warning fixes
packet-http.c
set headers.content_length = 0 before the first potential use of it.
packet-kink.c
"ifdef kerberos" around one function declaration
packet-nbns.c
set headers.{dgm_length|pkt_offset|error_code} = 0
packet-pflog.c
delete capture_pflog and
capture_old_pflog which aren't used anymore in the code.
svn path=/trunk/; revision=21120
pointers either "void *" or "guint8 *", to reduce the level of compiler
warnings (the data in question is largely binary in those cases).
svn path=/trunk/; revision=14886
parameter to many functions inside the ISAKMP dissector, as well as to
the "isakmp_dissect_payloads()" routine it exports. Get rid of
"isakmp_set_version()", as the version can be passed to
"isakmp_dissect_payloads()" from the KINK dissector.
Put the declaration of "isakmp_dissect_payloads()" into a
"packet-isakmp.h" header, and have "packet-isakmp.c" and "packet-kink.h"
include it rather than declariing "isakmp_dissect_payloads()" itself -
or not doing so at all.
svn path=/trunk/; revision=14648
make kink compile again on non-kerberos builds.
encapsulate a call to decrypt kerberos to only be compiled in when compiling with kerberos.
svn path=/trunk/; revision=14458
Ronnie Sahlberg