osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/test
History
Aurelien Aptel 0db39ae59a smb2: add support for decompression 
The latest iteration of Microsoft updates to SMB3 added compression to
the protocol. This commit implements decompressing and dissecting
compressed payloads.

The compression algorithms that can be used are "Plain LZ77",
"LZ77+Huffman" and "LZNT1" which you can read more about in the
[MS-XCA] documentation. This set of algorithm is sometimes referred to
as XPRESS.

This commit reuses the existing uncompression API scheme already in
place with zlib and brotli and adds 3 tvb_uncompress_*() function
implemented in:
* epan/tvbuff_lz77.c
* epan/tvbuff_lz77huff.c
* epan/tvbuff_lznt1.c

A new function wmem_array_try_index() was added to the wmem_array API
to make bound checked reads that fail gracefully. New tests for it
have been added as well.

Since both reads (tvb) and writes (wmem_array) are bound checked the
risk for buffer overruns is drastically reduced. LZ77+Huffman has
decoding tables and special care was taken to bound check these.

Simplified versions of the implementations were succesfully tested
against AFL (American Fuzzy Lop) for ~150 millions executions each.

The SMB2/3 dissector was changed to deal with the new transform header
for compressed packets (new protocol_id value) and READ request
flags (COMPRESSED). Badly compressed or encrypted packets are now
reported as such, and the decryption test suite was changed to reflect
that.

This commit also adds a test capture with 1 packet compressed with
each algorithm as returned by Windows Server 2019, along with 3
matching tests in test/suite_dissection.py

Change-Id: I2b84f56541f2f4ee7d886152794b993987dd10e7
Reviewed-on: https://code.wireshark.org/review/33855
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
 		2019-07-15 21:00:14 +00:00
..
baseline IP: Make dissection of ip.frag_offset RFC 791 compliant 2019-05-30 21:47:19 +00:00
captures smb2: add support for decompression 2019-07-15 21:00:14 +00:00
config ieee80211: Support decrypting OWE captures 2019-03-26 08:56:03 +00:00
keys Add support for RSA decryption using PKCS #11 tokens 2018-12-29 10:40:16 +00:00
lua Clean up IPMB/I2C link-layer header types. 2019-03-23 20:30:00 +00:00
suite_dfilter dfilter: fix memory leaks on dfilter compile errors involving a set 2019-01-28 11:09:35 +00:00
suite_dissectors Unit tests for ASTERIX I048 2019-01-11 18:35:29 +00:00
README.test Test: enable capture tests by default using the Loopback interface 2019-01-24 00:26:17 +00:00
conftest.py Test: enable capture tests by default using the Loopback interface 2019-01-24 00:26:17 +00:00
fixtures.py test: convert capture tests to use fixtures, fix tests without dumpcap 2018-11-16 13:55:28 +00:00
fixtures_ws.py Add brotli decompression support for HTTP and HTTP2 dissectors. 2019-04-22 15:24:46 +00:00
hosts.custom Continue to remove $Id$ from top of file 2014-03-31 18:48:06 +00:00
hosts.global Continue to remove $Id$ from top of file 2014-03-31 18:48:06 +00:00
hosts.personal Continue to remove $Id$ from top of file 2014-03-31 18:48:06 +00:00
matchers.py test: extend sharkd tests to cover all requests 2018-11-21 04:36:20 +00:00
sampleif.py test: fix sampleif.py on weird systems using Python 3.6 and older 2019-04-16 03:28:43 +00:00
subprocesstest.py test: split SubprocessTestCase.run into setUp/tearDown 2019-01-04 04:58:25 +00:00
suite_capture.py test,travis: dump a screenshot for hanging GUI tests 2019-01-24 00:26:22 +00:00
suite_clopts.py elastic: make fields all the same. 2019-05-14 16:16:57 +00:00
suite_decryption.py smb2: add support for decompression 2019-07-15 21:00:14 +00:00
suite_dissection.py smb2: add support for decompression 2019-07-15 21:00:14 +00:00
suite_fileformats.py editcap: warn when --inject-secrets is given a RSA private key 2019-02-05 15:36:40 +00:00
suite_follow.py test: use assertRun instead of runProcess where possible 2018-11-30 06:11:06 +00:00
suite_io.py test: use assertRun instead of runProcess where possible 2018-11-30 06:11:06 +00:00
suite_mergecap.py test: use assertRun instead of runProcess where possible 2018-11-30 06:11:06 +00:00
suite_nameres.py test: use assertRun instead of runProcess where possible 2018-11-30 06:11:06 +00:00
suite_outputformats.py elastic: change 'pcap_file' into 'doc' in the mapping. 2019-05-13 17:25:15 +00:00
suite_sharkd.py json_dumper: increase JSON_DUMPER_MAX_DEPTH to 1100. 2019-01-20 21:58:39 +00:00
suite_text2pcap.py text2pcap: allow to set interface name 2018-12-13 23:33:32 +00:00
suite_unittests.py test: convert capture tests to use fixtures, fix tests without dumpcap 2018-11-16 13:55:28 +00:00
suite_wslua.py tests: Skip Lua related tests when Lua is not present 2019-01-28 21:03:04 +00:00
test.py Test: enable capture tests by default using the Loopback interface 2019-01-24 00:26:17 +00:00
travis-upload-artifacts.sh test,travis: dump a screenshot for hanging GUI tests 2019-01-24 00:26:22 +00:00
util_dump_dhcp_pcap.py Dumpcap+Qt: Add support for `-a packets:NUM` and `-b packets:NUM`. 2018-11-09 05:55:11 +00:00

README.test 

Wireshark Tests

The recommended steps to prepare for and to run tests:

* Install two Python packages, pytest: `pip install pytest pytest-xdist`
* Build programs (“wireshark”, “tshark”, etc.): `ninja`
* Build additional programs for the “unittests” suite: `ninja test-programs`
* Run tests in the build directory: `pytest`

Replace `ninja test-programs` by `make test-programs` as needed.

See the “Wireshark Tests” chapter of the Developer's Guide for details:
https://www.wireshark.org/docs/wsdg_html_chunked/ChapterTests.html