test/suite-decryption.sh

   1 #!/bin/bash
   2 #
   3 # Test decryption capabilities of the Wireshark tools
   4 #
   5 # $Id$
   6 #
   7 # Wireshark - Network traffic analyzer
   8 # By Gerald Combs <gerald@wireshark.org>
   9 # Copyright 2005 Ulf Lamping
  10 #
  11 # This program is free software; you can redistribute it and/or
  12 # modify it under the terms of the GNU General Public License
  13 # as published by the Free Software Foundation; either version 2
  14 # of the License, or (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program; if not, write to the Free Software
  23 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24 #
  25
  26 # To do:
  27 #   DVB-CI
  28 #   IEEE 802.15.4
  29 #   IPsec / ESP
  30 #   ISAKMP / IKEv2
  31 #   PKCS#12
  32 #   SNMP
  33 #   DCERPC NETLOGON
  34 #   Kerberos
  35 #   KINK
  36 #   LDAP
  37 #   NTLMSSP
  38 #   SPNEGO
  39
  40 # common exit status values
  41 EXIT_OK=0
  42 EXIT_COMMAND_LINE=1
  43 EXIT_ERROR=2
  44
  45 UAT_FILES="
  46         80211_keys
  47         dtlsdecrypttablefile
  48         ssl_keys
  49         c1222_decryption_table
  50 "
  51
  52 TEST_KEYS_DIR="$TESTS_DIR/keys/"
  53 if [ "$WS_SYSTEM" == "Windows" ] ; then
  54         TEST_KEYS_DIR="`cygpath -w $TEST_KEYS_DIR`"
  55 fi
  56
  57 #TS_ARGS="-Tfields -e frame.number -e frame.time_epoch -e frame.time_delta"
  58 TS_DC_ARGS=""
  59
  60 DIFF_OUT=./diff-output.txt
  61
  62 # WPA PSK
  63 # http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=wpa-Induction.pcap
  64 decryption_step_80211_wpa_psk() {
  65         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
  66                 -o "wlan.enable_decryption: TRUE" \
  67                 -Tfields -e http.request.uri \
  68                 -r "$CAPTURE_DIR/wpa-Induction.pcap.gz" \
  69                 -Y http \
  70                 | grep favicon.ico > /dev/null 2>&1
  71         RETURNVALUE=$?
  72         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  73                 test_step_failed "Failed to decrypt IEEE 802.11 WPA PSK"
  74                 return
  75         fi
  76         test_step_ok
  77 }
  78
  79 # DTLS
  80 # http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil.tgz
  81 decryption_step_dtls() {
  82         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
  83                 -Tfields -e data.data \
  84                 -r "$CAPTURE_DIR/snakeoil-dtls.pcap" -Y http \
  85                 | grep "69:74:20:77:6f:72:6b:20:21:0a" > /dev/null 2>&1
  86         RETURNVALUE=$?
  87         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  88                 test_step_failed "Failed to decrypt DTLS"
  89                 return
  90         fi
  91         test_step_ok
  92 }
  93
  94 # SSL
  95 # http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil2_070531.tgz
  96 decryption_step_ssl() {
  97         env $TS_DC_ENV $TSHARK $TS_DC_ARGS -Tfields -e http.request.uri \
  98                 -r "$CAPTURE_DIR/rsasnakeoil2.pcap" -Y http \
  99                 | grep favicon.ico > /dev/null 2>&1
 100         RETURNVALUE=$?
 101         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 102                 test_step_failed "Failed to decrypt SSL"
 103                 return
 104         fi
 105         test_step_ok
 106 }
 107
 108 # ZigBee
 109 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7022
 110 decryption_step_zigbee() {
 111         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 112                 -r "$CAPTURE_DIR/sample_control4_2012-03-24.pcap" \
 113                 -Tfields -e data.data \
 114                 -Y zbee_aps \
 115                 | grep "30:67:63:63:38:65:20:63:34:2e:64:6d:2e:74:76:20" > /dev/null 2>&1
 116         RETURNVALUE=$?
 117         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 118                 test_step_failed "Failed to decrypt ZigBee"
 119                 return
 120         fi
 121         test_step_ok
 122 }
 123
 124 # ANSI C12.22
 125 # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9196
 126 decryption_step_c1222() {
 127         env $TS_DC_ENV $TSHARK $TS_DC_ARGS \
 128                 -o "c1222.decrypt: TRUE" \
 129                 -o "c1222.baseoid:2.16.124.113620.1.22.0" \
 130                 -r "$CAPTURE_DIR/c1222_std_example8.pcap" \
 131                 -Tfields -e c1222.data \
 132                 | grep "00:10:4d:41:4e:55:46:41:43:54:55:52:45:52:20:53:4e:20:92" >  /dev/null 2>&1
 133         RETURNVALUE=$?
 134         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 135                 test_step_failed "Failed to decrypt C12.22 $RETURNVALUE"
 136                 return
 137         fi
 138         test_step_ok
 139 }
 140
 141 tshark_decryption_suite() {
 142         test_step_add "IEEE 802.11 WPA PSK Decryption" decryption_step_80211_wpa_psk
 143         test_step_add "DTLS Decryption" decryption_step_dtls
 144         test_step_add "SSL Decryption" decryption_step_ssl
 145         test_step_add "ZigBee Decryption" decryption_step_zigbee
 146         test_step_add "ANSI C12.22 Decryption" decryption_step_c1222
 147 }
 148
 149 decryption_cleanup_step() {
 150         rm -rf "$TEST_HOME"
 151 }
 152
 153 decryption_prep_step() {
 154         decryption_cleanup_step
 155
 156         TS_DC_ENV="${HOME_ENV}=${HOME_PATH}"
 157
 158         for UAT in $UAT_FILES ; do
 159                 sed -e "s|TEST_KEYS_DIR|${TEST_KEYS_DIR//\\/\\\\x5c}|" \
 160                         < "$TESTS_DIR/config/$UAT.tmpl" \
 161                         > "$CONF_PATH/$UAT"
 162         done
 163 }
 164
 165 decryption_suite() {
 166         test_step_set_pre decryption_prep_step
 167         test_step_set_post decryption_cleanup_step
 168         test_suite_add "TShark decryption" tshark_decryption_suite
 169 }
 170
 171 #
 172 # Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 173 #
 174 # Local variables:
 175 # c-basic-offset: 8
 176 # tab-width: 8
 177 # indent-tabs-mode: t
 178 # End:
 179 #
 180 # vi: set shiftwidth=8 tabstop=8 noexpandtab:
 181 # :indentSize=8:tabSize=8:noTabs=false:
 182 #
 183