ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] SSL decryption

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 19 Jan 2006 15:21:16 +0100 (CET)
Hi,

The patch uses fopen() i.s.o. eth_fopen() in ssl_init() in packet_ssl.c
I guess this neesds to be replaced in all dissectors? A quick grep
reveils:
me@host:~/src/ethereal/ethereal$ grep fopen epan/dissectors/packet*.c
epan/dissectors/packet-dcerpc-srvsvc.c:static int hf_srvsvc_server_stat_fopens = -1;
epan/dissectors/packet-dcerpc-srvsvc.c: * IDL   long fopens;
epan/dissectors/packet-dcerpc-srvsvc.c:         hf_srvsvc_server_stat_fopens, NULL);
epan/dissectors/packet-dcerpc-srvsvc.c:   { &hf_srvsvc_server_stat_fopens,
epan/dissectors/packet-dcerpc-srvsvc.c:     { "Fopens", "srvsvc.server_stat.fopens", FT_UINT32,
epan/dissectors/packet-dcerpc-srvsvc.c:       BASE_DEC, NULL, 0x0, "Number of fopens", HFILL}},
epan/dissectors/packet-diameter.c:  f = fopen(filename, "r");
epan/dissectors/packet-giop.c:  fp = fopen(name,"r");   /* open read only */
epan/dissectors/packet-k12.c:   if (( fp = fopen(filename,"r") )) {
epan/dissectors/packet-kerberos.c:              skf = eth_fopen(service_key_file, "rb");

Is kerberos the only one adapted so far?

Thanx,
Jaap


On Thu, 19 Jan 2006 paolo.abeni@xxxxxxxx wrote:

> Hi,
>
> > Is there any reason it shouldn't be checked in?
>
> I would be very plased to see the patch checked in. I tested it on Mandriva
> 2006 and on Fedora core 4 and it work quite well (for me at least).
> Anyway I suppose some more testing is required: at least I [re]introduced a
> bug regarding ssl session dissection. TCP packets in ssl sessions get wrong
> checksum.
>
> As pointed out by others, the last version of the patch can be found here:
>
> http://ssl-decrypt.sourceforge.net/
>
> Regards,
>
> Paolo Abeni
>  --
>  Email.it, the professional e-mail, gratis per te: http://www.email.it/f
>
>  Sponsor:
>  Ascolta le migliori suonerie per il tuo cellulare
>  Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3113&d=20060119
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>