test/suite_decryption.py

   1 #
   2 # -*- coding: utf-8 -*-
   3 # Wireshark tests
   4 # By Gerald Combs <gerald@wireshark.org>
   5 #
   6 # Ported from a set of Bash scripts which were copyright 2005 Ulf Lamping
   7 #
   8 # SPDX-License-Identifier: GPL-2.0-or-later
   9 #
  10 '''Decryption tests'''
  11
  12 import config
  13 import os.path
  14 import subprocesstest
  15 import unittest
  16
  17 class case_decrypt_80211(subprocesstest.SubprocessTestCase):
  18     def test_80211_wpa_psk(self):
  19         '''IEEE 802.11 WPA PSK'''
  20         # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=wpa-Induction.pcap
  21         capture_file = os.path.join(config.capture_dir, 'wpa-Induction.pcap.gz')
  22         self.runProcess((config.cmd_tshark,
  23                 '-o', 'wlan.enable_decryption: TRUE',
  24                 '-Tfields',
  25                 '-e', 'http.request.uri',
  26                 '-r', capture_file,
  27                 '-Y', 'http',
  28             ),
  29             env=config.test_env)
  30         self.assertTrue(self.grepOutput('favicon.ico'))
  31
  32     def test_80211_wpa_eap(self):
  33         '''IEEE 802.11 WPA EAP (EAPOL Rekey)'''
  34         # Included in git sources test/captures/wpa-eap-tls.pcap.gz
  35         capture_file = os.path.join(config.capture_dir, 'wpa-eap-tls.pcap.gz')
  36         self.runProcess((config.cmd_tshark,
  37                 '-o', 'wlan.enable_decryption: TRUE',
  38                 '-r', capture_file,
  39                 '-Y', 'wlan.analysis.tk==7d9987daf5876249b6c773bf454a0da7',
  40                 ),
  41             env=config.test_env)
  42         self.assertTrue(self.grepOutput('Group Message'))
  43
  44     def test_80211_wpa_eapol_incomplete_rekeys(self):
  45         '''WPA decode with message1+2 only and secure bit set on message 2'''
  46         # Included in git sources test/captures/wpa-test-decode.pcap.gz
  47         capture_file = os.path.join(config.capture_dir, 'wpa-test-decode.pcap.gz')
  48         self.runProcess((config.cmd_tshark,
  49                 '-o', 'wlan.enable_decryption: TRUE',
  50                 '-r', capture_file,
  51                 '-Y', 'icmp.resp_to == 4263',
  52                 ),
  53             env=config.test_env)
  54         self.assertTrue(self.grepOutput('Echo'))
  55
  56     def test_80211_wpa_psk_mfp(self):
  57         '''WPA decode management frames with MFP enabled (802.11w)'''
  58         # Included in git sources test/captures/wpa-test-decode-mgmt.pcap.gz
  59         capture_file = os.path.join(config.capture_dir, 'wpa-test-decode-mgmt.pcap.gz')
  60         self.runProcess((config.cmd_tshark,
  61                 '-o', 'wlan.enable_decryption: TRUE',
  62                 '-r', capture_file,
  63                 '-Y', 'wlan.fixed.reason_code == 2 || wlan.fixed.category_code == 3',
  64                 ),
  65             env=config.test_env)
  66         self.assertEqual(self.countOutput('802.11.*SN=.*FN=.*Flags='), 3)
  67
  68
  69     def test_80211_wpa_tdls(self):
  70         '''WPA decode traffic in a TDLS (Tunneled Direct-Link Setup) session (802.11z)'''
  71         # Included in git sources test/captures/wpa-test-decode-tdls.pcap.gz
  72         capture_file = os.path.join(config.capture_dir, 'wpa-test-decode-tdls.pcap.gz')
  73         self.runProcess((config.cmd_tshark,
  74                 '-o', 'wlan.enable_decryption: TRUE',
  75                 '-r', capture_file,
  76                 '-Y', 'icmp',
  77                 ),
  78             env=config.test_env)
  79         self.assertEqual(self.countOutput('ICMP.*Echo .ping'), 2)
  80
  81 class case_decrypt_dtls(subprocesstest.SubprocessTestCase):
  82     def test_dtls(self):
  83         '''DTLS'''
  84         # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil.tgz
  85         capture_file = os.path.join(config.capture_dir, 'snakeoil-dtls.pcap')
  86         self.runProcess((config.cmd_tshark,
  87                 '-r', capture_file,
  88                 '-Tfields',
  89                 '-e', 'data.data',
  90                 '-Y', 'data',
  91             ),
  92             env=config.test_env)
  93         self.assertTrue(self.grepOutput('69:74:20:77:6f:72:6b:20:21:0a'))
  94
  95     def test_dtls_psk_aes128ccm8(self):
  96         '''DTLS 1.2 with PSK, AES-128-CCM-8'''
  97         capture_file = os.path.join(config.capture_dir, 'dtls12-aes128ccm8.pcap')
  98         self.runProcess((config.cmd_tshark,
  99                 '-r', capture_file,
 100                 '-o', 'dtls.psk:ca19e028a8a372ad2d325f950fcaceed',
 101                 '-x'
 102             ),
 103             env=config.test_env)
 104         dt_count = self.countOutput('Decrypted DTLS')
 105         wfm_count = self.countOutput('Works for me!.')
 106         self.assertTrue(dt_count == 7 and wfm_count == 2)
 107
 108     def test_dtls_udt(self):
 109         '''UDT over DTLS 1.2 with RSA key'''
 110         capture_file = os.path.join(config.capture_dir, 'udt-dtls.pcapng.gz')
 111         key_file = os.path.join(config.key_dir, 'udt-dtls.key')
 112         self.runProcess((config.cmd_tshark,
 113                 '-r', capture_file,
 114                 '-o', 'dtls.keys_list:0.0.0.0,0,data,{}'.format(key_file),
 115                 '-Y', 'dtls && udt.type==ack',
 116             ),
 117             env=config.test_env)
 118         self.assertTrue(self.grepOutput('UDT'))
 119
 120 class case_decrypt_tls(subprocesstest.SubprocessTestCase):
 121     def test_ssl(self):
 122         '''SSL using the server's private key'''
 123         # https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil2_070531.tgz
 124         capture_file = os.path.join(config.capture_dir, 'rsasnakeoil2.pcap')
 125         self.runProcess((config.cmd_tshark,
 126                 '-r', capture_file,
 127                 '-Tfields',
 128                 '-e', 'http.request.uri',
 129                 '-Y', 'http',
 130             ),
 131             env=config.test_env)
 132         self.assertTrue(self.grepOutput('favicon.ico'))
 133
 134     def test_ssl_rsa_pq(self):
 135         '''SSL using the server's private key with p < q
 136         (test whether libgcrypt is correctly called)'''
 137         capture_file = os.path.join(config.capture_dir, 'rsa-p-lt-q.pcap')
 138         key_file = os.path.join(config.key_dir, 'rsa-p-lt-q.key')
 139         self.runProcess((config.cmd_tshark,
 140                 '-r', capture_file,
 141                 '-o', 'ssl.keys_list:0.0.0.0,443,http,{}'.format(key_file),
 142                 '-Tfields',
 143                 '-e', 'http.request.uri',
 144                 '-Y', 'http',
 145             ),
 146             env=config.test_env)
 147         self.assertTrue(self.grepOutput('/'))
 148
 149     def test_ssl_with_password(self):
 150         '''SSL using the server's private key with password'''
 151         capture_file = os.path.join(config.capture_dir, 'dmgr.pcapng')
 152         self.runProcess((config.cmd_tshark,
 153                 '-r', capture_file,
 154                 '-Tfields',
 155                 '-e', 'http.request.uri',
 156                 '-Y', 'http',
 157             ),
 158             env=config.test_env)
 159         self.assertTrue(self.grepOutput('unsecureLogon.jsp'))
 160
 161     def test_ssl_master_secret(self):
 162         '''SSL using the master secret'''
 163         capture_file = os.path.join(config.capture_dir, 'dhe1.pcapng.gz')
 164         key_file = os.path.join(config.key_dir, 'dhe1_keylog.dat')
 165         self.runProcess((config.cmd_tshark,
 166                 '-r', capture_file,
 167                 '-o', 'ssl.keylog_file: {}'.format(key_file),
 168                 '-o', 'ssl.desegment_ssl_application_data: FALSE',
 169                 '-o', 'http.ssl.port: 443',
 170                 '-Tfields',
 171                 '-e', 'http.request.uri',
 172                 '-Y', 'http',
 173             ),
 174             env=config.test_env)
 175         self.assertTrue(self.grepOutput('test'))
 176
 177     def test_tls12_renegotiation(self):
 178         '''TLS 1.2 with renegotiation'''
 179         capture_file = os.path.join(config.capture_dir, 'tls-renegotiation.pcap')
 180         key_file = os.path.join(config.key_dir, 'rsasnakeoil2.key')
 181         self.runProcess((config.cmd_tshark,
 182                 '-r', capture_file,
 183                 '-o', 'ssl.keys_list:0.0.0.0,4433,http,{}'.format(key_file),
 184                 '-Tfields',
 185                 '-e', 'http.content_length',
 186                 '-Y', 'http',
 187             ),
 188             env=config.test_env)
 189         count_0 = self.countOutput('^0$')
 190         count_2151 = self.countOutput('^2151$')
 191         self.assertTrue(count_0 == 1 and count_2151 == 1)
 192
 193     def test_tls12_psk_aes128ccm(self):
 194         '''TLS 1.2 with PSK, AES-128-CCM'''
 195         capture_file = os.path.join(config.capture_dir, 'tls12-aes128ccm.pcap')
 196         self.runProcess((config.cmd_tshark,
 197                 '-r', capture_file,
 198                 '-o', 'ssl.psk:ca19e028a8a372ad2d325f950fcaceed',
 199                 '-q',
 200                 '-z', 'follow,ssl,ascii,0',
 201             ),
 202             env=config.test_env)
 203         self.assertTrue(self.grepOutput('http://www.gnu.org/software/gnutls'))
 204
 205     def test_tls12_psk_aes256gcm(self):
 206         '''TLS 1.2 with PSK, AES-256-GCM'''
 207         capture_file = os.path.join(config.capture_dir, 'tls12-aes256gcm.pcap')
 208         self.runProcess((config.cmd_tshark,
 209                 '-r', capture_file,
 210                 '-o', 'ssl.psk:ca19e028a8a372ad2d325f950fcaceed',
 211                 '-q',
 212                 '-z', 'follow,ssl,ascii,0',
 213             ),
 214             env=config.test_env)
 215         self.assertTrue(self.grepOutput('http://www.gnu.org/software/gnutls'))
 216
 217     def test_tls12_chacha20poly1305(self):
 218         '''TLS 1.2 with ChaCha20-Poly1305'''
 219         if not config.have_libgcrypt17:
 220             self.skipTest('Requires GCrypt 1.7 or later.')
 221         capture_file = os.path.join(config.capture_dir, 'tls12-chacha20poly1305.pcap')
 222         key_file = os.path.join(config.key_dir, 'tls12-chacha20poly1305.keys')
 223         ciphers=[
 224             'ECDHE-ECDSA-CHACHA20-POLY1305',
 225             'ECDHE-RSA-CHACHA20-POLY1305',
 226             'DHE-RSA-CHACHA20-POLY1305',
 227             'RSA-PSK-CHACHA20-POLY1305',
 228             'DHE-PSK-CHACHA20-POLY1305',
 229             'ECDHE-PSK-CHACHA20-POLY1305',
 230             'PSK-CHACHA20-POLY1305',
 231         ]
 232         stream = 0
 233         for cipher in ciphers:
 234             self.runProcess((config.cmd_tshark,
 235                     '-r', capture_file,
 236                     '-o', 'ssl.keylog_file: {}'.format(key_file),
 237                     '-q',
 238                     '-z', 'follow,ssl,ascii,{}'.format(stream),
 239                 ),
 240                 env=config.test_env)
 241             stream += 1
 242             self.assertTrue(self.grepOutput('Cipher is {}'.format(cipher)))
 243
 244     def test_tls13_chacha20poly1305(self):
 245         '''TLS 1.3 with ChaCha20-Poly1305'''
 246         if not config.have_libgcrypt17:
 247             self.skipTest('Requires GCrypt 1.7 or later.')
 248         capture_file = os.path.join(config.capture_dir, 'tls13-20-chacha20poly1305.pcap')
 249         key_file = os.path.join(config.key_dir, 'tls13-20-chacha20poly1305.keys')
 250         self.runProcess((config.cmd_tshark,
 251                 '-r', capture_file,
 252                 '-o', 'ssl.keylog_file: {}'.format(key_file),
 253                 '-q',
 254                 '-z', 'follow,ssl,ascii,0',
 255             ),
 256             env=config.test_env)
 257         self.assertTrue(self.grepOutput('TLS13-CHACHA20-POLY1305-SHA256'))
 258
 259 class case_decrypt_zigbee(subprocesstest.SubprocessTestCase):
 260     def test_zigbee(self):
 261         '''ZigBee'''
 262         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7022
 263         capture_file = os.path.join(config.capture_dir, 'sample_control4_2012-03-24.pcap')
 264         self.runProcess((config.cmd_tshark,
 265                 '-r', capture_file,
 266                 '-Tfields',
 267                 '-e', 'data.data',
 268                 '-Y', 'zbee_aps',
 269             ),
 270             env=config.test_env)
 271         self.assertTrue(self.grepOutput('30:67:63:63:38:65:20:63:34:2e:64:6d:2e:74:76:20'))
 272
 273 class case_decrypt_ansi_c1222(subprocesstest.SubprocessTestCase):
 274     def test_ansi_c1222(self):
 275         '''ANSI C12.22'''
 276         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9196
 277         capture_file = os.path.join(config.capture_dir, 'c1222_std_example8.pcap')
 278         self.runProcess((config.cmd_tshark,
 279                 '-r', capture_file,
 280                 '-o', 'c1222.decrypt: TRUE',
 281                 '-o', 'c1222.baseoid: 2.16.124.113620.1.22.0',
 282                 '-Tfields',
 283                 '-e', 'c1222.data',
 284             ),
 285             env=config.test_env)
 286         self.assertTrue(self.grepOutput('00:10:4d:41:4e:55:46:41:43:54:55:52:45:52:20:53:4e:20:92'))
 287
 288 class case_decrypt_dvb_ci(subprocesstest.SubprocessTestCase):
 289     def test_dvb_ci(self):
 290         '''DVB-CI'''
 291         # simplified version of the sample capture in
 292         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6700
 293         capture_file = os.path.join(config.capture_dir, 'dvb-ci_UV1_0000.pcap')
 294         self.runProcess((config.cmd_tshark,
 295                 '-r', capture_file,
 296                 '-o', 'dvb-ci.sek: 00000000000000000000000000000000',
 297                 '-o', 'dvb-ci.siv: 00000000000000000000000000000000',
 298                 '-Tfields',
 299                 '-e', 'dvb-ci.cc.sac.padding',
 300             ),
 301             env=config.test_env)
 302         self.assertTrue(self.grepOutput('80:00:00:00:00:00:00:00:00:00:00:00'))
 303
 304 class case_decrypt_ipsec(subprocesstest.SubprocessTestCase):
 305     def test_ipsec_esp(self):
 306         '''IPsec ESP'''
 307         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12671
 308         capture_file = os.path.join(config.capture_dir, 'esp-bug-12671.pcapng.gz')
 309         self.runProcess((config.cmd_tshark,
 310                 '-r', capture_file,
 311                 '-o', 'esp.enable_encryption_decode: TRUE',
 312                 '-Tfields',
 313                 '-e', 'data.data',
 314             ),
 315             env=config.test_env)
 316         self.assertTrue(self.grepOutput('08:09:0a:0b:0c:0d:0e:0f:10:11:12:13:14:15:16:17'))
 317
 318 class case_decrypt_ike_isakmp(subprocesstest.SubprocessTestCase):
 319     def test_ikev1_certs(self):
 320         '''IKEv1 (ISAKMP) with certificates'''
 321         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7951
 322         capture_file = os.path.join(config.capture_dir, 'ikev1-certs.pcap')
 323         self.runProcess((config.cmd_tshark,
 324                 '-r', capture_file,
 325                 '-Tfields',
 326                 '-e', 'x509sat.printableString',
 327             ),
 328             env=config.test_env)
 329         self.assertTrue(self.grepOutput('OpenSwan'))
 330
 331     def test_ikev1_simultaneous(self):
 332         '''IKEv1 (ISAKMP) simultaneous exchanges'''
 333         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12610
 334         capture_file = os.path.join(config.capture_dir, 'ikev1-bug-12610.pcapng.gz')
 335         self.runProcess((config.cmd_tshark,
 336                 '-r', capture_file,
 337                 '-Tfields',
 338                 '-e', 'isakmp.hash',
 339             ),
 340             env=config.test_env)
 341         self.assertTrue(self.grepOutput('b5:25:21:f7:74:96:74:02:c9:f6:ce:e9:5f:d1:7e:5b'))
 342
 343     def test_ikev1_unencrypted(self):
 344         '''IKEv1 (ISAKMP) unencrypted phase 1'''
 345         # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12620
 346         capture_file = os.path.join(config.capture_dir, 'ikev1-bug-12620.pcapng.gz')
 347         self.runProcess((config.cmd_tshark,
 348                 '-r', capture_file,
 349                 '-Tfields',
 350                 '-e', 'isakmp.hash',
 351             ),
 352             env=config.test_env)
 353         self.assertTrue(self.grepOutput('40:04:3b:64:0f:43:73:25:0d:5a:c3:a1:fb:63:15:3c'))
 354
 355     def test_ikev2_3des_sha160(self):
 356         '''IKEv2 decryption test (3DES-CBC/SHA1_160)'''
 357         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-3des-sha1_160.pcap')
 358         self.runProcess((config.cmd_tshark,
 359                 '-r', capture_file,
 360                 '-Tfields',
 361                 '-e', 'isakmp.auth.data',
 362             ),
 363             env=config.test_env)
 364         self.assertTrue(self.grepOutput('02:f7:a0:d5:f1:fd:c8:ea:81:03:98:18:c6:5b:b9:bd:09:af:9b:89:17:31:9b:88:7f:f9:ba:30:46:c3:44:c7'))
 365
 366     def test_ikev2_aes128_ccm12(self):
 367         '''IKEv2 decryption test (AES-128-CCM-12) - with CBC-MAC verification'''
 368         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes128ccm12.pcap')
 369         self.runProcess((config.cmd_tshark,
 370                 '-r', capture_file,
 371                 '-Tfields',
 372                 '-e', 'isakmp.auth.data',
 373             ),
 374             env=config.test_env)
 375         self.assertTrue(self.grepOutput('c2:10:43:94:29:9e:1f:fe:79:08:ea:72:0a:d5:d1:37:17:a0:d4:54:e4:fa:0a:21:28:ea:68:94:11:f4:79:c4'))
 376
 377     def test_ikev2_aes128_ccm12_2(self):
 378         '''IKEv2 decryption test (AES-128-CCM-12 using CTR mode, without checksum)'''
 379         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes128ccm12-2.pcap')
 380         self.runProcess((config.cmd_tshark,
 381                 '-r', capture_file,
 382                 '-Tfields',
 383                 '-e', 'isakmp.auth.data',
 384             ),
 385             env=config.test_env)
 386         self.assertTrue(self.grepOutput('aa:a2:81:c8:7b:4a:19:04:6c:57:27:1d:55:74:88:ca:41:3b:57:22:8c:b9:51:f5:fa:96:40:99:2a:02:85:b9'))
 387
 388     def test_ikev2_aes192ctr_sha512(self):
 389         '''IKEv2 decryption test (AES-192-CTR/SHA2-512)'''
 390         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes192ctr.pcap')
 391         self.runProcess((config.cmd_tshark,
 392                 '-r', capture_file,
 393                 '-Tfields',
 394                 '-e', 'isakmp.auth.data',
 395             ),
 396             env=config.test_env)
 397         self.assertTrue(self.grepOutput('3e:c2:3d:cf:93:48:48:56:38:40:7c:75:45:47:ae:b3:08:52:90:08:2c:49:f5:83:fd:ba:e5:92:63:a2:0b:4a'))
 398
 399     def test_ikev2_aes256cbc_sha256(self):
 400         '''IKEv2 decryption test (AES-256-CBC/SHA2-256)'''
 401         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes256cbc.pcapng')
 402         self.runProcess((config.cmd_tshark,
 403                 '-r', capture_file,
 404                 '-Tfields',
 405                 '-e', 'isakmp.auth.data',
 406             ),
 407             env=config.test_env)
 408         self.assertTrue(self.grepOutput('e1:a8:d5:50:06:42:01:a7:ec:02:4a:85:75:8d:06:73:c6:1c:5c:51:0a:c1:3b:cd:22:5d:63:27:f5:0d:a3:d3'))
 409
 410     def test_ikev2_aes256ccm16(self):
 411         '''IKEv2 decryption test (AES-256-CCM-16)'''
 412         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes256ccm16.pcapng')
 413         self.runProcess((config.cmd_tshark,
 414                 '-r', capture_file,
 415                 '-Tfields',
 416                 '-e', 'isakmp.auth.data',
 417             ),
 418             env=config.test_env)
 419         self.assertTrue(self.grepOutput('fa:2e:74:bd:c0:1e:30:fb:0b:3d:dc:97:23:c9:44:90:95:96:9d:a5:1f:69:e5:60:20:9d:2c:2b:79:40:21:0a'))
 420
 421     def test_ikev2_aes256gcm16(self):
 422         '''IKEv2 decryption test (AES-256-GCM-16)'''
 423         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes256gcm16.pcap')
 424         self.runProcess((config.cmd_tshark,
 425                 '-r', capture_file,
 426                 '-Tfields',
 427                 '-e', 'isakmp.auth.data',
 428             ),
 429             env=config.test_env)
 430         self.assertTrue(self.grepOutput('9a:b7:1f:14:ab:55:3c:ad:87:3a:1a:a7:0b:99:df:15:5d:ee:77:cd:cf:36:94:b3:b7:52:7a:cb:b9:71:2d:ed'))
 431
 432     def test_ikev2_aes256gcm8(self):
 433         '''IKEv2 decryption test (AES-256-GCM-8)'''
 434         capture_file = os.path.join(config.capture_dir, 'ikev2-decrypt-aes256gcm8.pcap')
 435         self.runProcess((config.cmd_tshark,
 436                 '-r', capture_file,
 437                 '-Tfields',
 438                 '-e', 'isakmp.auth.data',
 439             ),
 440             env=config.test_env)
 441         self.assertTrue(self.grepOutput('4a:66:d8:22:d0:af:bc:22:ad:9a:92:a2:cf:42:87:c9:20:ad:8a:c3:b0:69:a4:a7:e7:5f:e0:a5:d4:99:f9:14'))
 442
 443 class case_decrypt_http2(subprocesstest.SubprocessTestCase):
 444     def test_http2(self):
 445         '''HTTP2 (HPACK)'''
 446         if not config.have_nghttp2:
 447             self.skipTest('Requires nghttp2.')
 448         capture_file = os.path.join(config.capture_dir, 'packet-h2-14_headers.pcapng')
 449         self.runProcess((config.cmd_tshark,
 450                 '-r', capture_file,
 451                 '-Tfields',
 452                 '-e', 'http2.header.value',
 453                 '-d', 'tcp.port==3000,http2',
 454             ),
 455             env=config.test_env)
 456         test_passed = self.grepOutput('nghttp2')
 457         if not test_passed:
 458             self.log_fd.write(u'\n\n-- Verbose output --\n\n')
 459             self.runProcess((config.cmd_tshark,
 460                     '-r', capture_file,
 461                     '-V',
 462                     '-d', 'tcp.port==3000,http2',
 463                 ),
 464                 env=config.test_env)
 465         self.assertTrue(test_passed)
 466
 467 class case_decrypt_kerberos(subprocesstest.SubprocessTestCase):
 468     def test_kerberos(self):
 469         '''Kerberos'''
 470         # Files are from krb-816.zip on the SampleCaptures page.
 471         if not config.have_kerberos:
 472             self.skipTest('Requires nghttp2.')
 473         capture_file = os.path.join(config.capture_dir, 'krb-816.pcap.gz')
 474         keytab_file = os.path.join(config.key_dir, 'krb-816.keytab')
 475         self.runProcess((config.cmd_tshark,
 476                 '-r', capture_file,
 477                 '-o', 'kerberos.decrypt: TRUE',
 478                 '-o', 'kerberos.file: {}'.format(keytab_file),
 479                 '-Tfields',
 480                 '-e', 'kerberos.keyvalue',
 481             ),
 482             env=config.test_env)
 483         # keyvalue: ccda7d48219f73c3b28311c4ba7242b3
 484         self.assertTrue(self.grepOutput('cc:da:7d:48:21:9f:73:c3:b2:83:11:c4:ba:72:42:b3'))