add support to decrypt and dissect sign-and-sealed traffic.

(cifs: dc's talking to eachother   and when longhorn comes out: anyone wanting to talk dce to a dc!)

((this is an incredibly advanced feature well worthy of mentioning in NEWS))


svn path=/trunk/; revision=13690

1 files changed, 32 insertions, 0 deletions

diff --git a/epan/dissectors/packet-gssapi.c b/epan/dissectors/packet-gssapi.c
index 85d456edb3..38df659cb8 100644
--- a/epan/dissectors/packet-gssapi.c
+++ b/epan/dissectors/packet-gssapi.c
@@ -202,6 +202,7 @@ dissect_gssapi_work(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 			goto done;
 		}
 
+
 		if (!(cls == ASN1_APL && con == ASN1_CON && tag == 0)) {
 		  /* 
 		   * If we do not recognise an Application class,
@@ -458,6 +459,37 @@ int wrap_dissect_gssapi_verf(tvbuff_t *tvb, int offset,
 	return dissect_gssapi_verf(auth_tvb, pinfo, tree);
 }
 
+tvbuff_t *
+wrap_dissect_gssapi_payload(tvbuff_t *data_tvb, 
+			tvbuff_t *auth_tvb,
+			int offset,
+			packet_info *pinfo, 
+			dcerpc_auth_info *auth_info)
+{
+	tvbuff_t *result;
+
+	/* we need a full auth and a full data tvb or else we cant
+	   decrypt anything 
+	*/
+	if((!auth_tvb)||(!data_tvb)){
+		return NULL;
+	}
+
+	pinfo->decrypt_gssapi_tvb=DECRYPT_GSSAPI_DCE;
+	pinfo->gssapi_wrap_tvb=NULL;
+	pinfo->gssapi_encrypted_tvb=data_tvb;
+	pinfo->gssapi_decrypted_tvb=NULL;
+	dissect_gssapi_verf(auth_tvb, pinfo, NULL);
+	result=pinfo->gssapi_decrypted_tvb;
+
+	pinfo->decrypt_gssapi_tvb=0;
+	pinfo->gssapi_wrap_tvb=NULL;
+	pinfo->gssapi_encrypted_tvb=NULL;
+	pinfo->gssapi_decrypted_tvb=NULL;
+
+	return result;
+}
+
 static dcerpc_auth_subdissector_fns gssapi_auth_fns = {
 	wrap_dissect_gssapi,		        /* Bind */
 	wrap_dissect_gssapi,	 	        /* Bind ACK */