packet-spnego: fix decryption of DCERPC packets in decrypt_gssapi_krb_cfx_wrap()

[metze/wireshark/wip.git] / asn1 / spnego / packet-spnego-template.c

diff --git a/asn1/spnego/packet-spnego-template.c b/asn1/spnego/packet-spnego-template.c
index d88e58a41ecae179d7b76037205327768a3e118e..71e942bfe334280b68456a02e3baf9030ad23eb8 100644 (file)
--- a/asn1/spnego/packet-spnego-template.c
+++ b/asn1/spnego/packet-spnego-template.c
@@ -692,7 +692,15 @@ rrc_rotate(void *data, int len, guint16 rrc, int unrotate)
 #define KRB5_KU_USAGE_INITIATOR_SIGN   25
 
 static void
-decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff_t *tvb _U_, guint16 ec _U_, guint16 rrc _U_, int keytype, unsigned int usage)
+decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_,
+                           packet_info *pinfo,
+                           tvbuff_t *checksum_tvb,
+                           tvbuff_t *encrypted_tvb,
+                           guint16 ec,
+                           guint16 rrc,
+                           gboolean is_dce,
+                           int keytype,
+                           unsigned int usage)
 {
        int res;
        char *rotated;
@@ -705,12 +713,22 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
                return;
        }
 
-       rotated = ep_alloc(tvb_length(tvb));
+       datalen = tvb_length(checksum_tvb) + tvb_length(encrypted_tvb);
+       rotated = ep_alloc(datalen);
 
-       tvb_memcpy(tvb, rotated, 0, tvb_length(tvb));
-       res = rrc_rotate(rotated, tvb_length(tvb), rrc, TRUE);
+       tvb_memcpy(checksum_tvb, rotated,
+                  0, tvb_length(checksum_tvb));
+       tvb_memcpy(encrypted_tvb, rotated + tvb_length(checksum_tvb),
+                  0, tvb_length(encrypted_tvb));
 
-       next_tvb=tvb_new_child_real_data(tvb, rotated, tvb_length(tvb), tvb_reported_length(tvb));
+       if (is_dce) {
+               rrc += ec;
+       }
+
+       res = rrc_rotate(rotated, datalen, rrc, TRUE);
+
+       next_tvb=tvb_new_child_real_data(encrypted_tvb, rotated,
+                                        datalen, datalen);
        add_new_data_source(pinfo, next_tvb, "GSSAPI CFX");
 
        output = decrypt_krb5_data(tree, pinfo, usage, next_tvb,
@@ -719,14 +737,14 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
        if (output) {
                char *outdata;
 
-               outdata = ep_alloc(tvb_length(tvb));
-               memcpy(outdata, output, tvb_length(tvb));
+               outdata = ep_alloc(tvb_length(encrypted_tvb));
+               memcpy(outdata, output, tvb_length(encrypted_tvb));
                g_free(output);
 
-               pinfo->gssapi_decrypted_tvb=tvb_new_child_real_data(tvb,
+               pinfo->gssapi_decrypted_tvb=tvb_new_child_real_data(encrypted_tvb,
                        outdata,
-                       datalen-16,
-                       datalen-16);
+                       tvb_length(encrypted_tvb),
+                       tvb_length(encrypted_tvb));
                add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
                return;
        }
@@ -1063,21 +1081,25 @@ dissect_spnego_krb5_cfx_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
        }
 
 #if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
-       pinfo->gssapi_encrypted_tvb = tvb_new_subset_remaining(tvb, 16);
+{
+       tvbuff_t *checksum_tvb = tvb_new_subset(tvb, 16, checksum_size, checksum_size);
 
-       if (flags & 0x0002) {
+       if (pinfo->gssapi_data_encrypted) {
                if(pinfo->gssapi_encrypted_tvb){
                        decrypt_gssapi_krb_cfx_wrap(tree,
                                pinfo,
+                               checksum_tvb,
                                pinfo->gssapi_encrypted_tvb,
                                ec,
                                rrc,
+                               (pinfo->decrypt_gssapi_tvb==DECRYPT_GSSAPI_DCE)?TRUE:FALSE,
                                -1,
                                (flags & 0x0001)?
                                KRB5_KU_USAGE_ACCEPTOR_SEAL:
                                KRB5_KU_USAGE_INITIATOR_SEAL);
                }
        }
+}
 #endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
 
        /*