test/suite-decryption.sh

   1 #!/bin/bash
   2 #
   3 # Test decryption capabilities of the Wireshark tools
   4 #
   5 # Wireshark - Network traffic analyzer
   6 # By Gerald Combs <gerald@wireshark.org>
   7 # Copyright 2005 Ulf Lamping
   8 #
   9 # SPDX-License-Identifier: GPL-2.0-or-later
  10 #
  11
  12 # To do:
  13 #   IEEE 802.15.4
  14 #   ISAKMP / IKEv2
  15 #   PKCS#12
  16 #   SNMP
  17 #   DCERPC NETLOGON
  18 #   KINK
  19 #   LDAP
  20 #   NTLMSSP
  21 #   SPNEGO
  22
  23 # common exit status values
  24 EXIT_OK=0
  25 EXIT_COMMAND_LINE=1
  26 EXIT_ERROR=2
  27
  28 UAT_FILES="
  29         80211_keys
  30         dtlsdecrypttablefile
  31         esp_sa
  32         ssl_keys
  33         c1222_decryption_table
  34         ikev1_decryption_table
  35         ikev2_decryption_table
  36 "
  37
  38 TEST_KEYS_DIR="$TESTS_DIR/keys/"
  39 if [ "$WS_SYSTEM" == "Windows" ] ; then
  40         TEST_KEYS_DIR="`cygpath -w $TEST_KEYS_DIR`"
  41 fi
  42
  43 #TS_ARGS="-Tfields -e frame.number -e frame.time_epoch -e frame.time_delta"
  44 TS_DC_ARGS=""
  45
  46 DIFF_OUT=./diff-output.txt
  47
  48 # WPA PSK
  49 # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=wpa-Induction.pcap
  50 decryption_step_80211_wpa_psk() {
  51         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
  52                 -o "wlan.enable_decryption: TRUE" \
  53                 -Tfields -e http.request.uri \
  54                 -r "$CAPTURE_DIR/wpa-Induction.pcap.gz" \
  55                 -Y http \
  56                 | grep favicon.ico > /dev/null 2>&1
  57         RETURNVALUE=$?
  58         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  59                 test_step_failed "Failed to decrypt IEEE 802.11 WPA PSK"
  60                 return
  61         fi
  62         test_step_ok
  63 }
  64
  65 # WPA EAP (EAPOL Rekey)
  66 # Included in git sources test/captures/wpa-eap-tls.pcap.gz
  67 decryption_step_80211_wpa_eap() {
  68         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
  69                 -o "wlan.enable_decryption: TRUE" \
  70                 -r "$CAPTURE_DIR/wpa-eap-tls.pcap.gz" \
  71                 -Y "wlan.analysis.tk==7d9987daf5876249b6c773bf454a0da7" \
  72                 | grep "Group Message" > /dev/null 2>&1
  73         RETURNVALUE=$?
  74         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  75                 test_step_failed "Failed to decrypt IEEE 802.11 WPA EAP"
  76                 return
  77         fi
  78         test_step_ok
  79 }
  80 # WPA decode with message1+2 only and secure bit set on message 2
  81 # Included in git sources test/captures/wpa-test-decode.pcap.gz
  82 decryption_step_80211_wpa_eapol_incomplete_rekeys() {
  83         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
  84                 -o "wlan.enable_decryption: TRUE" \
  85                 -r "$CAPTURE_DIR/wpa-test-decode.pcap.gz" \
  86                 -Y "icmp.resp_to == 4263" \
  87                 | grep "Echo"  > /dev/null 2>&1
  88         RETURNVALUE=$?
  89         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  90                 test_step_failed "Not able to follow rekey with missing eapol frames"
  91                 return
  92         fi
  93         test_step_ok
  94 }
  95
  96 # WPA decode management frames with MFP enabled (802.11w)
  97 # Included in git sources test/captures/wpa-test-decode-mgmt.pcap.gz
  98 decryption_step_80211_wpa_psk_mfp() {
  99         local out frames
 100         out=$($TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 101                 -o "wlan.enable_decryption: TRUE" \
 102                 -r "$CAPTURE_DIR/wpa-test-decode-mgmt.pcap.gz" \
 103                 -Y "wlan.fixed.reason_code == 2 || wlan.fixed.category_code == 3" \
 104                 2>&1)
 105         RETURNVALUE=$?
 106         frames=$(echo "$out" | wc -l)
 107         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 108                 test_step_failed "Error during test execution: $out"
 109                 return
 110         elif [ $frames -ne 3 ]; then
 111                 test_step_failed "Not able to decode All Management frames ($frames/3)"
 112                 return
 113         fi
 114         test_step_ok
 115 }
 116
 117 # WPA decode traffic in a TDLS (Tunneled Direct-Link Setup) session (802.11z)
 118 # Included in git sources test/captures/wpa-test-decode-tdls.pcap.gz
 119 decryption_step_80211_wpa_tdls() {
 120         local out frames
 121         out=$($TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 122                 -o "wlan.enable_decryption: TRUE" \
 123                 -r "$CAPTURE_DIR/wpa-test-decode-tdls.pcap.gz" \
 124                 -Y "icmp" \
 125                 2>&1)
 126         RETURNVALUE=$?
 127         frames=$(echo "$out" | wc -l)
 128         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 129                 test_step_failed "Error during test execution: $out"
 130                 return
 131         elif [ $frames -ne 2 ]; then
 132                 test_step_failed "Not able to decode all TDLS traffic ($frames/2)"
 133                 return
 134         fi
 135         test_step_ok
 136 }
 137
 138 # DTLS
 139 # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil.tgz
 140 decryption_step_dtls() {
 141         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 142                 -Tfields -e data.data \
 143                 -r "$CAPTURE_DIR/snakeoil-dtls.pcap" -Y data \
 144                 | grep "69:74:20:77:6f:72:6b:20:21:0a" > /dev/null 2>&1
 145         RETURNVALUE=$?
 146         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 147                 test_step_failed "Failed to decrypt DTLS"
 148                 return
 149         fi
 150         test_step_ok
 151 }
 152
 153 # DTLS 1.2 with PSK, AES-128-CCM-8
 154 decryption_step_dtls_psk_aes128ccm8() {
 155         output=$($TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 156                 -odtls.psk:ca19e028a8a372ad2d325f950fcaceed \
 157                 -r "$CAPTURE_DIR/dtls12-aes128ccm8.pcap" -x)
 158         one='DTLS1.2 test usi*ng GnuTLS 3.5.8.'
 159         two='Works for me!.'
 160         if [[ "$output" != *${one}*${one}*${two}*${two}* ]]; then
 161                 test_step_failed "Failed to decrypt DTLS 1.2 (PSK AES-128-CCM-8)"
 162                 return
 163         fi
 164         test_step_ok
 165 }
 166
 167 # UDT over DTLS 1.2 with RSA key
 168 decryption_step_udt_dtls() {
 169         TEST_KEYS_FILE="$TESTS_DIR/keys/udt-dtls.key"
 170         if [ "$WS_SYSTEM" == "Windows" ] ; then
 171                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 172         fi
 173         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 174                 -o dtls.keys_list:"0.0.0.0,0,data,$TEST_KEYS_FILE" \
 175                 -Y "dtls && udt.type==ack" \
 176                 -r "$CAPTURE_DIR/udt-dtls.pcapng.gz" \
 177                 | grep UDT > /dev/null
 178         RETURNVALUE=$?
 179         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 180                 test_step_failed "Failed to decrypt UDT/DTLS using the server's RSA private key"
 181                 return
 182         fi
 183         test_step_ok
 184 }
 185
 186 # IPsec ESP
 187 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12671
 188 decryption_step_ipsec_esp() {
 189         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 190                 -o "esp.enable_encryption_decode: TRUE" \
 191                 -Tfields -e data.data \
 192                 -r "$CAPTURE_DIR/esp-bug-12671.pcapng.gz" -Y data \
 193                 | grep "08:09:0a:0b:0c:0d:0e:0f:10:11:12:13:14:15:16:17" > /dev/null 2>&1
 194         RETURNVALUE=$?
 195         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 196                 test_step_failed "Failed to decrypt DTLS"
 197                 return
 198         fi
 199         test_step_ok
 200 }
 201
 202 # SSL, using the server's private key
 203 # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil2_070531.tgz
 204 decryption_step_ssl() {
 205         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.request.uri \
 206                 -r "$CAPTURE_DIR/rsasnakeoil2.pcap" -Y http \
 207                 | grep favicon.ico > /dev/null 2>&1
 208         RETURNVALUE=$?
 209         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 210                 test_step_failed "Failed to decrypt SSL using the server's private key"
 211                 return
 212         fi
 213         test_step_ok
 214 }
 215
 216 # SSL, using the server's private key with p < q
 217 # (test whether libgcrypt is correctly called)
 218 decryption_step_ssl_rsa_pq() {
 219         TEST_KEYS_FILE="$TESTS_DIR/keys/rsa-p-lt-q.key"
 220         if [ "$WS_SYSTEM" == "Windows" ] ; then
 221                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 222         fi
 223         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.request.uri \
 224                 -o ssl.keys_list:"0.0.0.0,443,http,$TEST_KEYS_FILE" \
 225                 -r "$CAPTURE_DIR/rsa-p-lt-q.pcap" -Y http \
 226                 | grep / > /dev/null 2>&1
 227         RETURNVALUE=$?
 228         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 229                 test_step_failed "Failed to decrypt SSL using the server's RSA private key"
 230                 return
 231         fi
 232         test_step_ok
 233 }
 234
 235 # SSL, using the server's private key with password
 236 decryption_step_ssl_with_password() {
 237         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.request.uri \
 238                 -r "$CAPTURE_DIR/dmgr.pcapng" -Y http \
 239                 | grep unsecureLogon.jsp > /dev/null 2>&1
 240         RETURNVALUE=$?
 241         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 242                 test_step_failed "Failed to decrypt SSL using the server's private key with password"
 243                 return
 244         fi
 245         test_step_ok
 246 }
 247
 248 # SSL, using the master secret
 249 decryption_step_ssl_master_secret() {
 250         TEST_KEYS_FILE="$TESTS_DIR/keys/dhe1_keylog.dat"
 251         if [ "$WS_SYSTEM" == "Windows" ] ; then
 252                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 253         fi
 254         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.request.uri \
 255                 -o "ssl.keylog_file: $TEST_KEYS_FILE" \
 256                 -o "ssl.desegment_ssl_application_data: FALSE" \
 257                 -o "http.ssl.port: 443" \
 258                 -r "$CAPTURE_DIR/dhe1.pcapng.gz" -Y http \
 259                 | grep test > /dev/null 2>&1
 260         RETURNVALUE=$?
 261         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 262                 test_step_failed "Failed to decrypt SSL using the master secret"
 263                 return
 264         fi
 265         test_step_ok
 266 }
 267
 268 # TLS 1.2 with renegotiation
 269 decryption_step_ssl_renegotiation() {
 270         TEST_KEYS_FILE="$TESTS_DIR/keys/rsasnakeoil2.key"
 271         if [ "$WS_SYSTEM" == "Windows" ] ; then
 272                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 273         fi
 274         output=$($TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.content_length \
 275                 -o ssl.keys_list:"0.0.0.0,4433,http,$TEST_KEYS_FILE" \
 276                 -r "$CAPTURE_DIR/tls-renegotiation.pcap" -Y http)
 277         if [[ "$output" != 0*2151* ]]; then
 278                 test_step_failed "Failed to decrypt SSL with renegotiation"
 279                 return
 280         fi
 281         test_step_ok
 282 }
 283
 284 # TLS 1.2 with PSK, AES-128-CCM
 285 decryption_step_tls_psk_aes128ccm() {
 286         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \
 287                 -ossl.psk:ca19e028a8a372ad2d325f950fcaceed \
 288                 -r "$CAPTURE_DIR/tls12-aes128ccm.pcap" -z follow,ssl,ascii,0 \
 289                 | grep -q http://www.gnu.org/software/gnutls
 290         RETURNVALUE=$?
 291         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 292                 test_step_failed "Failed to decrypt TLS 1.2 (PSK AES-128-CCM)"
 293                 return
 294         fi
 295         test_step_ok
 296 }
 297
 298 # TLS 1.2 with PSK, AES-256-GCM
 299 decryption_step_tls_psk_aes256gcm() {
 300         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \
 301                 -ossl.psk:ca19e028a8a372ad2d325f950fcaceed \
 302                 -r "$CAPTURE_DIR/tls12-aes256gcm.pcap" -z follow,ssl,ascii,0 \
 303                 | grep -q http://www.gnu.org/software/gnutls
 304         RETURNVALUE=$?
 305         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 306                 test_step_failed "Failed to decrypt TLS 1.2 (PSK AES-256-GCM)"
 307                 return
 308         fi
 309         test_step_ok
 310 }
 311
 312 # TLS 1.2 with ChaCha20-Poly1305
 313 decryption_step_tls12_chacha20poly1305() {
 314         if ! $HAVE_LIBGCRYPT17; then
 315                 test_step_skipped
 316                 return
 317         fi
 318         TEST_KEYS_FILE="$TESTS_DIR/keys/tls12-chacha20poly1305.keys"
 319         if [ "$WS_SYSTEM" == "Windows" ] ; then
 320                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 321         fi
 322         ciphers='
 323                 ECDHE-ECDSA-CHACHA20-POLY1305
 324                 ECDHE-RSA-CHACHA20-POLY1305
 325                 DHE-RSA-CHACHA20-POLY1305
 326                 RSA-PSK-CHACHA20-POLY1305
 327                 DHE-PSK-CHACHA20-POLY1305
 328                 ECDHE-PSK-CHACHA20-POLY1305
 329                 PSK-CHACHA20-POLY1305
 330         '
 331         local stream=0
 332         for cipher in $ciphers; do
 333                 $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \
 334                         -r "$CAPTURE_DIR/tls12-chacha20poly1305.pcap" \
 335                         -o "ssl.keylog_file: $TEST_KEYS_FILE" \
 336                         -z follow,ssl,ascii,$stream \
 337                         | grep -q "$cipher"
 338                 RETURNVALUE=$?
 339                 if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 340                         test_step_failed "Failed to decrypt TLS 1.2 ($cipher)"
 341                         return
 342                 fi
 343                 ((stream++))
 344         done
 345         test_step_ok
 346 }
 347
 348 # TLS 1.3 with ChaCha20-Poly1305
 349 decryption_step_tls13_chacha20poly1305() {
 350         if ! $HAVE_LIBGCRYPT17; then
 351                 test_step_skipped
 352                 return
 353         fi
 354         TEST_KEYS_FILE="$TESTS_DIR/keys/tls13-20-chacha20poly1305.keys"
 355         if [ "$WS_SYSTEM" == "Windows" ] ; then
 356                 TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`"
 357         fi
 358         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \
 359                 -r "$CAPTURE_DIR/tls13-20-chacha20poly1305.pcap" \
 360                 -o "ssl.keylog_file: $TEST_KEYS_FILE" \
 361                 -z follow,ssl,ascii,0 \
 362                 | grep -q TLS13-CHACHA20-POLY1305-SHA256
 363         RETURNVALUE=$?
 364         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 365                 test_step_failed "Failed to decrypt TLS 1.3 (ChaCha20-Poly1305)"
 366                 return
 367         fi
 368         test_step_ok
 369 }
 370
 371 # ZigBee
 372 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7022
 373 decryption_step_zigbee() {
 374         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 375                 -r "$CAPTURE_DIR/sample_control4_2012-03-24.pcap" \
 376                 -Tfields -e data.data \
 377                 -Y zbee_aps \
 378                 | grep "30:67:63:63:38:65:20:63:34:2e:64:6d:2e:74:76:20" > /dev/null 2>&1
 379         RETURNVALUE=$?
 380         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 381                 test_step_failed "Failed to decrypt ZigBee"
 382                 return
 383         fi
 384         test_step_ok
 385 }
 386
 387 # ANSI C12.22
 388 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9196
 389 decryption_step_c1222() {
 390         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 391                 -o "c1222.decrypt: TRUE" \
 392                 -o "c1222.baseoid:2.16.124.113620.1.22.0" \
 393                 -r "$CAPTURE_DIR/c1222_std_example8.pcap" \
 394                 -Tfields -e c1222.data \
 395                 | grep "00:10:4d:41:4e:55:46:41:43:54:55:52:45:52:20:53:4e:20:92" > /dev/null 2>&1
 396         RETURNVALUE=$?
 397         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 398                 test_step_failed "Failed to decrypt C12.22 $RETURNVALUE"
 399                 return
 400         fi
 401         test_step_ok
 402 }
 403
 404 # DVB-CI
 405 # simplified version of the sample capture in
 406 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6700
 407 decryption_step_dvb_ci() {
 408         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 409                  -o "dvb-ci.sek: 00000000000000000000000000000000" \
 410                  -o "dvb-ci.siv: 00000000000000000000000000000000" \
 411                 -Tfields -e dvb-ci.cc.sac.padding \
 412                 -r "$CAPTURE_DIR/dvb-ci_UV1_0000.pcap" \
 413                 | grep "80:00:00:00:00:00:00:00:00:00:00:00" > /dev/null 2>&1
 414         RETURNVALUE=$?
 415         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 416                 test_step_failed "Failed to decrypt DVB_CI"
 417                 return
 418         fi
 419         test_step_ok
 420 }
 421
 422 # IKEv1 (ISAKMP) with certificates
 423 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7951
 424 decryption_step_ikev1_certs() {
 425         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 426                 -Tfields -e x509sat.printableString \
 427                 -r "$CAPTURE_DIR/ikev1-certs.pcap" \
 428                 | grep "OpenSwan" > /dev/null 2>&1
 429         RETURNVALUE=$?
 430         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 431                 test_step_failed "Failed to decrypt IKEv1"
 432                 return
 433         fi
 434         test_step_ok
 435 }
 436
 437 # IKEv1 (ISAKMP) simultaneous exchanges
 438 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12610
 439 decryption_step_ikev1_simultaneous() {
 440         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 441                 -Tfields -e isakmp.hash \
 442                 -r "$CAPTURE_DIR/ikev1-bug-12610.pcapng.gz" \
 443                 | grep "b5:25:21:f7:74:96:74:02:c9:f6:ce:e9:5f:d1:7e:5b" > /dev/null 2>&1
 444         RETURNVALUE=$?
 445         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 446                 test_step_failed "Failed to decrypt simultaneous IKEv1 exchanges"
 447                 return
 448         fi
 449         test_step_ok
 450 }
 451
 452 # IKEv1 (ISAKMP) unencrypted phase 1
 453 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12620
 454 decryption_step_ikev1_unencrypted() {
 455         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 456                 -Tfields -e isakmp.hash \
 457                 -r "$CAPTURE_DIR/ikev1-bug-12620.pcapng.gz" \
 458                 | grep "40:04:3b:64:0f:43:73:25:0d:5a:c3:a1:fb:63:15:3c" > /dev/null 2>&1
 459         RETURNVALUE=$?
 460         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 461                 test_step_failed "Failed to decrypt the first packet of a post-phase1 IKEv1 exchange"
 462                 return
 463         fi
 464         test_step_ok
 465 }
 466
 467 # IKEv2 decryption test (3DES-CBC/SHA1_160)
 468 decryption_step_ikev2_3des_sha160() {
 469         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 470                 -Tfields -e isakmp.auth.data \
 471                 -r "$CAPTURE_DIR/ikev2-decrypt-3des-sha1_160.pcap" \
 472                 | grep "02:f7:a0:d5:f1:fd:c8:ea:81:03:98:18:c6:5b:b9:bd:09:af:9b:89:17:31:9b:88:7f:f9:ba:30:46:c3:44:c7" > /dev/null 2>&1
 473         RETURNVALUE=$?
 474         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 475                 test_step_failed "Failed to decrypt encrypted with 3_DES_CBC/SHA1_160 packet of IKEv2 exchange"
 476                 return
 477         fi
 478         test_step_ok
 479 }
 480
 481 # IKEv2 decryption test (AES-128-CCM-12) - with CBC-MAC verification
 482 decryption_step_ikev2_aes128_ccm12() {
 483         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 484                 -Tfields -e isakmp.auth.data \
 485                 -r "$CAPTURE_DIR/ikev2-decrypt-aes128ccm12.pcap" \
 486                 | grep "c2:10:43:94:29:9e:1f:fe:79:08:ea:72:0a:d5:d1:37:17:a0:d4:54:e4:fa:0a:21:28:ea:68:94:11:f4:79:c4" > /dev/null 2>&1
 487         RETURNVALUE=$?
 488         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 489                 test_step_failed "Failed to decrypt encrypted with AES_128_CCM_12 packet of IKEv2 exchange"
 490                 return
 491         fi
 492         test_step_ok
 493 }
 494
 495 # IKEv2 decryption test (AES-128-CCM-12 using CTR mode, without checksum)
 496 decryption_step_ikev2_aes128_ccm12_2() {
 497         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 498                 -Tfields -e isakmp.auth.data \
 499                 -r "$CAPTURE_DIR/ikev2-decrypt-aes128ccm12-2.pcap" \
 500                 | grep "aa:a2:81:c8:7b:4a:19:04:6c:57:27:1d:55:74:88:ca:41:3b:57:22:8c:b9:51:f5:fa:96:40:99:2a:02:85:b9" > /dev/null 2>&1
 501         RETURNVALUE=$?
 502         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 503                 test_step_failed "Failed to decrypt (using CTR mode) encrypted with AES_128_CCM_12  packet of IKEv2 exchange"
 504                 return
 505         fi
 506         test_step_ok
 507 }
 508
 509 # IKEv2 decryption test (AES-192-CTR/SHA2-512)
 510 decryption_step_ikev2_aes192ctr_sha512() {
 511         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 512                 -Tfields -e isakmp.auth.data \
 513                 -r "$CAPTURE_DIR/ikev2-decrypt-aes192ctr.pcap" \
 514                 | grep "3e:c2:3d:cf:93:48:48:56:38:40:7c:75:45:47:ae:b3:08:52:90:08:2c:49:f5:83:fd:ba:e5:92:63:a2:0b:4a" > /dev/null 2>&1
 515         RETURNVALUE=$?
 516         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 517                 test_step_failed "Failed to decrypt encrypted with AES-192-CTR/SHA2_512 packet of IKEv2 exchange"
 518                 return
 519         fi
 520         test_step_ok
 521 }
 522
 523 # IKEv2 decryption test (AES-256-CBC/SHA2-256)
 524 decryption_step_ikev2_aes256cbc_sha256() {
 525         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 526                 -Tfields -e isakmp.auth.data \
 527                 -r "$CAPTURE_DIR/ikev2-decrypt-aes256cbc.pcapng" \
 528                 | grep "e1:a8:d5:50:06:42:01:a7:ec:02:4a:85:75:8d:06:73:c6:1c:5c:51:0a:c1:3b:cd:22:5d:63:27:f5:0d:a3:d3" > /dev/null 2>&1
 529         RETURNVALUE=$?
 530         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 531                 test_step_failed "Failed to decrypt encrypted with AES-256-CBC/SHA2-256 packet of IKEv2 exchange"
 532                 return
 533         fi
 534         test_step_ok
 535 }
 536
 537 # IKEv2 decryption test (AES-256-CCM-16)
 538 decryption_step_ikev2_aes256ccm16() {
 539         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 540                 -Tfields -e isakmp.auth.data \
 541                 -r "$CAPTURE_DIR/ikev2-decrypt-aes256ccm16.pcapng" \
 542                 | grep "fa:2e:74:bd:c0:1e:30:fb:0b:3d:dc:97:23:c9:44:90:95:96:9d:a5:1f:69:e5:60:20:9d:2c:2b:79:40:21:0a" > /dev/null 2>&1
 543         RETURNVALUE=$?
 544         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 545                 test_step_failed "Failed to decrypt encrypted with AES-256-CCM-16 packet of IKEv2 exchange"
 546                 return
 547         fi
 548         test_step_ok
 549 }
 550
 551 # IKEv2 decryption test (AES-256-GCM-16)
 552 decryption_step_ikev2_aes256gcm16() {
 553         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 554                 -Tfields -e isakmp.auth.data \
 555                 -r "$CAPTURE_DIR/ikev2-decrypt-aes256gcm16.pcap" \
 556                 | grep "9a:b7:1f:14:ab:55:3c:ad:87:3a:1a:a7:0b:99:df:15:5d:ee:77:cd:cf:36:94:b3:b7:52:7a:cb:b9:71:2d:ed" > /dev/null 2>&1
 557         RETURNVALUE=$?
 558         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 559                 test_step_failed "Failed to decrypt encrypted with AES-256-GCM-16 packet of IKEv2 exchange"
 560                 return
 561         fi
 562         test_step_ok
 563 }
 564
 565 # IKEv2 decryption test (AES-256-GCM-8)
 566 decryption_step_ikev2_aes256gcm8() {
 567         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 568                 -Tfields -e isakmp.auth.data \
 569                 -r "$CAPTURE_DIR/ikev2-decrypt-aes256gcm8.pcap" \
 570                 | grep "4a:66:d8:22:d0:af:bc:22:ad:9a:92:a2:cf:42:87:c9:20:ad:8a:c3:b0:69:a4:a7:e7:5f:e0:a5:d4:99:f9:14" > /dev/null 2>&1
 571         RETURNVALUE=$?
 572         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 573                 test_step_failed "Failed to decrypt encrypted with AES-256-GCM-8 packet of IKEv2 exchange"
 574                 return
 575         fi
 576         test_step_ok
 577 }
 578
 579 # HTTP2 (HPACK)
 580 decryption_step_http2() {
 581         if [ $HAVE_NGHTTP2 -ne 0 ]; then
 582                 test_step_skipped
 583                 return
 584         fi
 585         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 586                 -Tfields -e http2.header.value \
 587                 -d tcp.port==3000,http2 \
 588                 -r "$CAPTURE_DIR/packet-h2-14_headers.pcapng" \
 589         > ./testout.txt
 590         grep "nghttp2" ./testout.txt > /dev/null 2>&1
 591         RETURNVALUE=$?
 592         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 593         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 594                 -V \
 595                 -d tcp.port==3000,http2 \
 596                 -r "$CAPTURE_DIR/packet-h2-14_headers.pcapng" \
 597                 > ./testout2.txt
 598         echo
 599         echo "Test output:"
 600         cat ./testout.txt
 601         echo "Verbose output:"
 602         cat ./testout2.txt
 603                 test_step_failed "Failed to decode HTTP2 HPACK"
 604                 return
 605         fi
 606         test_step_ok
 607 }
 608
 609 # Kerberos
 610 # Files are from krb-816.zip on the SampleCaptures page.
 611 KEYTAB_FILE="$TESTS_DIR/keys/krb-816.keytab"
 612 if [ "$WS_SYSTEM" == "Windows" ] ; then
 613         KEYTAB_FILE="`cygpath -w $KEYTAB_FILE`"
 614 fi
 615 decryption_step_kerberos() {
 616         if [ $HAVE_KERBEROS -ne 0 ]; then
 617                 test_step_skipped
 618                 return
 619         fi
 620         # keyvalue: ccda7d48219f73c3b28311c4ba7242b3
 621         $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 622                 -Tfields -e kerberos.keyvalue \
 623                 -o "kerberos.decrypt: TRUE" \
 624                 -o "kerberos.file: $KEYTAB_FILE" \
 625                 -r "$CAPTURE_DIR/krb-816.pcap.gz" \
 626                 | grep "cc:da:7d:48:21:9f:73:c3:b2:83:11:c4:ba:72:42:b3" > /dev/null 2>&1
 627         RETURNVALUE=$?
 628         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 629                 test_step_failed "Failed to decrypt encrypted with AES-256-GCM-8 packet of IKEv2 exchange"
 630                 return
 631         fi
 632         test_step_ok
 633 }
 634
 635 tshark_decryption_suite() {
 636         test_step_add "IEEE 802.11 WPA PSK Decryption" decryption_step_80211_wpa_psk
 637         test_step_add "IEEE 802.11 WPA PSK Decryption2 (EAPOL frames missing with a Win 10 client)" decryption_step_80211_wpa_eapol_incomplete_rekeys
 638         test_step_add "IEEE 802.11 WPA PSK Decryption of Management frames (802.11w)" decryption_step_80211_wpa_psk_mfp
 639         test_step_add "IEEE 802.11 WPA EAP Decryption" decryption_step_80211_wpa_eap
 640         test_step_add "IEEE 802.11 WPA TDLS Decryption" decryption_step_80211_wpa_tdls
 641         test_step_add "DTLS Decryption" decryption_step_dtls
 642         test_step_add "DTLS 1.2 Decryption (PSK AES-128-CCM-8)" decryption_step_dtls_psk_aes128ccm8
 643         test_step_add "UDT over DTLS 1.2 Decryption" decryption_step_udt_dtls
 644         test_step_add "IPsec ESP Decryption" decryption_step_ipsec_esp
 645         test_step_add "SSL Decryption (private key)" decryption_step_ssl
 646         test_step_add "SSL Decryption (RSA private key with p smaller than q)" decryption_step_ssl_rsa_pq
 647         test_step_add "SSL Decryption (private key with password)" decryption_step_ssl_with_password
 648         test_step_add "SSL Decryption (master secret)" decryption_step_ssl_master_secret
 649         test_step_add "SSL Decryption (renegotiation)" decryption_step_ssl_renegotiation
 650         test_step_add "TLS 1.2 Decryption (PSK AES-128-CCM)" decryption_step_tls_psk_aes128ccm
 651         test_step_add "TLS 1.2 Decryption (PSK AES-256-GCM)" decryption_step_tls_psk_aes256gcm
 652         test_step_add "TLS 1.2 Decryption (ChaCha20-Poly1305)" decryption_step_tls12_chacha20poly1305
 653         test_step_add "TLS 1.3 Decryption (ChaCha20-Poly1305)" decryption_step_tls13_chacha20poly1305
 654         test_step_add "ZigBee Decryption" decryption_step_zigbee
 655         test_step_add "ANSI C12.22 Decryption" decryption_step_c1222
 656         test_step_add "DVB-CI Decryption" decryption_step_dvb_ci
 657
 658         test_step_add "IKEv1 Decryption (certificates)" decryption_step_ikev1_certs
 659         test_step_add "IKEv1 Decryption (simultaneous exchanges)" decryption_step_ikev1_simultaneous
 660         test_step_add "IKEv1 Decryption (unencrypted phase 1)" decryption_step_ikev1_unencrypted
 661
 662         test_step_add "IKEv2 Decryption (3DES-CBC/SHA1_160)" decryption_step_ikev2_3des_sha160
 663         test_step_add "IKEv2 Decryption (AES-128-CCM-12)" decryption_step_ikev2_aes128_ccm12
 664         test_step_add "IKEv2 Decryption (AES-128-CCM-12 using CTR mode)" decryption_step_ikev2_aes128_ccm12_2
 665         test_step_add "IKEv2 Decryption (AES-192-CTR/SHA2-512)" decryption_step_ikev2_aes192ctr_sha512
 666         test_step_add "IKEv2 Decryption (AES-256-CBC/SHA2-256)" decryption_step_ikev2_aes256cbc_sha256
 667         test_step_add "IKEv2 Decryption (AES-256-CCM-16)" decryption_step_ikev2_aes256ccm16
 668         test_step_add "IKEv2 Decryption (AES-256-GCM-16)" decryption_step_ikev2_aes256gcm16
 669         test_step_add "IKEv2 Decryption (AES-256-GCM-8)" decryption_step_ikev2_aes256gcm8
 670
 671         test_step_add "HTTP2 (HPACK)" decryption_step_http2
 672
 673         test_step_add "Kerberos" decryption_step_kerberos
 674 }
 675
 676 decryption_cleanup_step() {
 677         rm -rf "$TEST_HOME"
 678 }
 679
 680 decryption_prep_step() {
 681         decryption_cleanup_step
 682
 683         TS_DC_ENV="${HOME_ENV}=${HOME_PATH}"
 684
 685         for UAT in $UAT_FILES ; do
 686                 sed -e "s|TEST_KEYS_DIR|${TEST_KEYS_DIR//\\/\\\\x5c}|" \
 687                         < "$TESTS_DIR/config/$UAT.tmpl" \
 688                         > "$CONF_PATH/$UAT"
 689         done
 690 }
 691
 692 decryption_suite() {
 693         test_step_set_pre decryption_prep_step
 694         test_step_set_post decryption_cleanup_step
 695         test_suite_add "TShark decryption" tshark_decryption_suite
 696 }
 697
 698 #
 699 # Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 700 #
 701 # Local variables:
 702 # sh-basic-offset: 8
 703 # tab-width: 8
 704 # indent-tabs-mode: t
 705 # End:
 706 #
 707 # vi: set shiftwidth=8 tabstop=8 noexpandtab:
 708 # :indentSize=8:tabSize=8:noTabs=false:
 709 #
 710