Wireshark · Ethereal-dev: [Ethereal-dev] patch to Ethereal 0.8.17 to fix WAP WTLS omission

[Patrick Wolfe <pjw@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>]

Attached is a patch to the "packet-wtls.c" file, which corrects an
omission in the WAP WTLS decode.

The WTLS client hello decode only worked if the client_key_ids and
trusted_key_ids sections used NULL identifier types.  Most phones
we've seen to date are fine with this.  The Siemens S40 handset
uses binary identifiers, causing ethereal to be confused and
mis-decode the frame.  This patch fixes that problem.

I also added code for the three other types of identifiers, but lack
the ability (at this time) to test it, as I have no handsets which
generate those types of identifiers.

--

Patrick Wolfe (patrick.j.wolfe@xxxxxxxxxxxx, pjw@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Sr WAN Engineer, National Platforms Team, Cingular Wireless

Attached is a patch to the "packet-wtls.c" file, which corrects an
omission in the WAP WTLS decode.

The WTLS client hello decode only worked if the client_key_ids and
trusted_key_ids sections used NULL identifier types.   Most phones
we've seen to date are fine with this. The Siemens S40 handset
uses binary identifiers, causing ethereal to be confused and
mis-decode the frame.  This patch fixes that problem.

I also added code for the three other types of identifiers, but lack
the ability (at this time) to test it, as I have no handsets which
generate those types of identifiers.

Patrick Wolfe (patrick.j.wolfe@xxxxxxxxxxxx, pjw@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Sr WAN Engineer, National Platforms Team, Cingular Wireless

======================================================================

*** 1.1	2001/04/17 20:43:19
--- packet-wtls.c	2001/04/17 23:06:23
***************
*** 2,8 ****
   *
   * Routines to dissect WTLS component of WAP traffic.
   * 
!  * $Id: packet-wtls.c,v 1.1 2001/04/17 20:43:19 pjw Exp $
   *
   * Ethereal - Network traffic analyzer
   * By Gerald Combs <gerald@xxxxxxxx>
--- 2,8 ----
   *
   * Routines to dissect WTLS component of WAP traffic.
   * 
!  * $Id: packet-wtls.c,v 1.3 2001/04/17 22:38:38 pjw Exp pjw $
   *
   * Ethereal - Network traffic analyzer
   * By Gerald Combs <gerald@xxxxxxxx>
***************
*** 81,86 ****
--- 81,89 ----
  static int hf_wtls_hands_cli_hello_key_parameter_index                =HF_EMPTY;
  static int hf_wtls_hands_cli_hello_key_parameter_set          =HF_EMPTY;
  static int hf_wtls_hands_cli_hello_key_identifier_type                =HF_EMPTY;
+ static int hf_wtls_hands_cli_hello_key_identifier_charset             =HF_EMPTY;
+ static int hf_wtls_hands_cli_hello_key_identifier_size                =HF_EMPTY;
+ static int hf_wtls_hands_cli_hello_key_identifier                     =HF_EMPTY;
  static int hf_wtls_hands_cli_hello_cipher_suite               =HF_EMPTY;
  static int hf_wtls_hands_cli_hello_cipher_suite_item  =HF_EMPTY;
  static int hf_wtls_hands_cli_hello_cipher_bulk                =HF_EMPTY;
***************
*** 448,453 ****
--- 451,457 ----
  	int client_size = 0;
  	guint value = 0;
  	int size = 0;
+ 	int charset = 0;
  	guint public_key = 0;
  	guint signature = 0;
  	char valStr[1024];
***************
*** 490,495 ****
--- 494,501 ----
  			ti = proto_tree_add_item (wtls_msg_type_item_tree, hf_wtls_hands_cli_hello_session,
  					tvb,offset,count+1,bo_big_endian);
  			offset+=1+count;
+ 
+ 			/* process client_key_ids structure */
  			count = tvb_get_ntohs (tvb, offset);
  			ti = proto_tree_add_item(wtls_msg_type_item_tree, 
  					hf_wtls_hands_cli_hello_cli_key_id, tvb, offset,
***************
*** 497,502 ****
--- 503,509 ----
  			wtls_msg_type_item_sub_tree = proto_item_add_subtree(ti, ett_wtls_msg_type_item_sub);
  			offset+=2;
  			for (;count > 0;count-=client_size) {
+ 				/* get encryption suite id (one byte) */
  				value = tvb_get_guint8 (tvb, offset);
  				cli_key_item = proto_tree_add_uint(wtls_msg_type_item_sub_tree, 
  						hf_wtls_hands_cli_hello_key_exchange, tvb, offset,1,
***************
*** 508,513 ****
--- 515,525 ----
  						hf_wtls_hands_cli_hello_key_exchange_suite,
  						tvb,offset,1,value);
  				offset++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "encryption suite = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* get parameter index (one byte) */
  				value = tvb_get_guint8 (tvb, offset);
  				ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
  					hf_wtls_hands_cli_hello_key_parameter_index,
***************
*** 514,519 ****
--- 526,536 ----
  					tvb,offset,1,bo_big_endian);
  				offset++;
  				client_size++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "parameter index = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* explicit parameters present in next field */
  				if (value == 0xff) {
  					size = tvb_get_ntohs (tvb, offset);
  					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
***************
*** 522,527 ****
--- 539,546 ----
  					offset+=size+2;
  					client_size+=size+2;
  				}
+ 
+ 				/* get identifier type */
  				value = tvb_get_guint8 (tvb, offset);
  				ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
  						hf_wtls_hands_cli_hello_key_identifier_type,
***************
*** 528,535 ****
--- 547,635 ----
  						tvb,offset,1,bo_big_endian);
  				offset++;
  				client_size++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "identifier type = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* identifier present in next field */
+ 				/* note: value 0x0 means no identifier */
+ 				if (value == 0x01) {	/* text identifier */
+ 					/* not tested */
+ 					charset = tvb_get_ntohs (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_charset,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset+=2;
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+3;
+ #ifdef DEBUG
+ 					fprintf(stderr, "text id size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0x02) {	/* binary identifier */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "binary id size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0xfe) {	/* SHA-1 hash of the public key */
+ 					/* not tested */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "SHA-1 hash size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0xff) {	/* X.509 distinguished name */
+ 					/* not tested */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "X.509 name size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 
  				proto_item_set_len(cli_key_item, client_size);
  			}
+ 
+ 			/* process trusted_keys structure */
  			count = tvb_get_ntohs (tvb, offset);
  			ti = proto_tree_add_item(wtls_msg_type_item_tree, 
  					hf_wtls_hands_cli_hello_trust_key_id, tvb, offset,
***************
*** 537,542 ****
--- 637,643 ----
  			wtls_msg_type_item_sub_tree = proto_item_add_subtree(ti, ett_wtls_msg_type_item_sub);
  			offset+=2;
  			for (;count > 0;count-=client_size) {
+ 				/* get encryption suite id (one byte) */
  				value = tvb_get_guint8 (tvb, offset);
  				cli_key_item = proto_tree_add_uint(wtls_msg_type_item_sub_tree, 
  						hf_wtls_hands_cli_hello_key_exchange, tvb, offset,1,
***************
*** 548,553 ****
--- 649,659 ----
  						hf_wtls_hands_cli_hello_key_exchange_suite,
  						tvb,offset,1,value);
  				offset++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "encryption suite = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* get parameter index (one byte) */
  				value = tvb_get_guint8 (tvb, offset);
  				ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
  					hf_wtls_hands_cli_hello_key_parameter_index,
***************
*** 554,559 ****
--- 660,670 ----
  					tvb,offset,1,bo_big_endian);
  				offset++;
  				client_size++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "parameter index = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* explicit parameters present in next field */
  				if (value == 0xff) {
  					size = tvb_get_ntohs (tvb, offset);
  					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
***************
*** 562,567 ****
--- 673,680 ----
  					offset+=size+2;
  					client_size+=size+2;
  				}
+ 
+ 				/* get identifier type */
  				value = tvb_get_guint8 (tvb, offset);
  				ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
  						hf_wtls_hands_cli_hello_key_identifier_type,
***************
*** 568,575 ****
--- 681,769 ----
  						tvb,offset,1,bo_big_endian);
  				offset++;
  				client_size++;
+ #ifdef DEBUG
+ 				fprintf(stderr, "identifier type = %d, client_size = %d\n", value, client_size);
+ #endif /* DEBUG */
+ 
+ 				/* identifier present in next field */
+ 				/* note: value 0x0 means no identifier */
+ 				if (value == 0x01) {	/* text identifier */
+ 					/* not tested */
+ 					charset = tvb_get_ntohs (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_charset,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset+=2;
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+3;
+ #ifdef DEBUG
+ 					fprintf(stderr, "text id size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0x02) {	/* binary identifier */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "binary id size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0xfe) {	/* SHA-1 hash of the public key */
+ 					/* not tested */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "SHA-1 hash size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
+ 				else if (value == 0xff) {	/* X.509 distinguished name */
+ 					/* not tested */
+ 					size = tvb_get_guint8 (tvb, offset);
+ 					/* need to fetch identifier and display it */
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier_size,
+ 							tvb,offset,1,bo_big_endian);
+ 					offset++;
+ 					ti = proto_tree_add_item(wtls_msg_type_item_sub_sub_tree,
+ 							hf_wtls_hands_cli_hello_key_identifier,
+ 							tvb,offset,size,bo_big_endian);
+ 					offset+=size;
+ 					client_size+=size+1;
+ #ifdef DEBUG
+ 					fprintf(stderr, "X.509 name size = %d, client_size = %d\n",
+ 						size, client_size);
+ #endif /* DEBUG */
+ 				}
  				proto_item_set_len(cli_key_item, client_size);
  			}
+ 
+ 			/* process cipher_suites structure */
  			count = tvb_get_guint8 (tvb, offset);
  			ti = proto_tree_add_item(wtls_msg_type_item_tree, 
  					hf_wtls_hands_cli_hello_cipher_suite, tvb, offset,
***************
*** 1006,1011 ****
--- 1200,1226 ----
  				"wsp.wtls.handshake.client_hello.ident_type",
  				 FT_UINT8, BASE_HEX, VALS ( wtls_vals_identifier_type ), 0x00,
  				"Identifier Type" 
+ 			}
+ 		},
+ 		{ &hf_wtls_hands_cli_hello_key_identifier_charset,
+ 			{ 	"Identifier CharSet",           
+ 				"wsp.wtls.handshake.client_hello.ident_charset",
+ 				 FT_NONE, BASE_DEC, NULL, 0x00,
+ 				"Identifier CharSet" 
+ 			}
+ 		},
+ 		{ &hf_wtls_hands_cli_hello_key_identifier_size,
+ 			{ 	"Identifier Size",           
+ 				"wsp.wtls.handshake.client_hello.ident_size",
+ 				 FT_UINT8, BASE_DEC, NULL, 0x00,
+ 				"Identifier Size" 
+ 			}
+ 		},
+ 		{ &hf_wtls_hands_cli_hello_key_identifier,
+ 			{ 	"Identifier",           
+ 				"wsp.wtls.handshake.client_hello.identifier",
+ 				 FT_UINT8, BASE_HEX, NULL, 0x00,
+ 				"Identifier" 
  			}
  		},
  		{ &hf_wtls_hands_cli_hello_cipher_suite,