https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6847
Summary: Patch to fix DTLS decryption
Product: Wireshark
Version: 1.7.x (Experimental)
Platform: All
OS/Version: All
Status: NEW
Severity: Minor
Priority: Low
Component: Wireshark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: piyomaru3141@xxxxxxxxx
Created attachment 7844
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=7844
Patch to fix DTLS decryption
Build Information:
wireshark 1.7.1 (SVN Rev 41030 from /trunk)
Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.20.1, with Cairo 1.8.10, with Pango 1.28.0, with
GLib 2.24.1, with libpcap, with libz 1.2.3.3, with POSIX capabilities (Linux),
with SMI 0.4.8, with c-ares 1.7.0, with Lua 5.1, without Python, with GnuTLS
2.8.5, with Gcrypt 1.4.4, with MIT Kerberos, with GeoIP, with PortAudio
V19-devel (built Feb 18 2010 22:31:30), without AirPcap.
Running on Linux 2.6.32-22-generic, with locale C, with libpcap version 1.0.0,
with libz 1.2.3.3, GnuTLS 2.8.5, Gcrypt 1.4.4.
Built using gcc 4.4.3.
--
Wireshark has DTLS decryption function but currently it doesn't work as
reported in bug#6769.
Through my research it seems that wireshark's decryption code supports old
openssl's non-RFC-4346-compliant DTLS 1.0 only and it has been broken since
some time or other.
This patch will fix it and make some enhancements.
Key modifications are:
* Fix decryption for old openssl's non-RFC-4346-compliant DTLS 1.0.
* Add decryption capability for RFC 4346-compliant DTLS 1.0.
* Enable DTLS record decompression.
I also attach trace and key acquired using net-snmp 5.7.1 and openssl 1.0.0e.
With this trace, you can check decryption for RFC-compliant DTLS and
decompression.
As for non-RFC-compliant DTLS, download sample capture and key from DTLS wiki
page (http://wiki.wireshark.org/DTLS) and use them to check.
Detailed procedure to decrypt is described in bug#6769
(http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6769).
When using my trace and key, pls use the following paremeters in the step4 of
the procedure:
IP address : 127.0.0.1
Port : 10161
Protocol : snmp
Key File : c:\temp_x\snmpd_fixed.key
Password (p12 file): (leave blank)
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.