com presentations: Added MongoDB/Wireshark presentation: slides/mongodb/wireshark-3.6.xml slides/mongodb/wireshark-3.8.xml slides/mongodb/wireshark-dissectors-bitmask.xml slides/mongodb/wireshark-dissectors-items.xml slides/mongodb/wireshark-dissectors-op-compressed.xml slides/mongodb/wireshark-dissectors-subtree.xml slides/mongodb/wireshark-dissectors.xml slides/mongodb/wireshark-example-is-master.xml slides/mongodb/wireshark-example-op-compress

diff --git a/slides/mongodb/wireshark-3.6.xml b/slides/mongodb/wireshark-3.6.xml
new file mode 100644
index 0000000..4298ed7
--- /dev/null
+++ b/slides/mongodb/wireshark-3.6.xml
@@ -0,0 +1,14 @@
+<slide background="wireshark-light.jpg">
+<title>MongoDB 3.6</title>
+
+<break lines="2"/>
+<list>
+	<bullet>New *OP_MSG*:<br/>Extensible Message Format</bullet>
+	<bullet>Improved *OP_COMPRESSED*:<br/>Compression on by default (introduced in 3.4)</bullet>
+</list>
+
+<break lines="2"/>
+<div effect="fade-in">
+<blurb class="big-centre">Wireshark did not support either</blurb>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-3.8.xml b/slides/mongodb/wireshark-3.8.xml
new file mode 100644
index 0000000..0bb36b0
--- /dev/null
+++ b/slides/mongodb/wireshark-3.8.xml
@@ -0,0 +1,17 @@
+<slide background="wireshark-light.jpg">
+<title>MongoDB 3.8 and Wireshark?</title>
+
+<break lines="2"/>
+<list>
+	<bullet>*OP_MSG*: Multiple sections</bullet>
+	<bullet>*OP_MSG*: Checksum</bullet>
+</list>
+
+<break lines="2"/>
+<div effect="fade-in">
+<blurb class="big-centre">Wireshark does not support the latter</blurb>
+</div>
+<div effect="fade-in">
+<blurb class="big-centre">yet…</blurb>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-dissectors-bitmask.xml b/slides/mongodb/wireshark-dissectors-bitmask.xml
new file mode 100644
index 0000000..ec820bf
--- /dev/null
+++ b/slides/mongodb/wireshark-dissectors-bitmask.xml
@@ -0,0 +1,39 @@
+<slide background="wireshark-light.jpg">
+<title>Extending the dissector: bitmask</title>
+
+<blurb>Definition:</blurb>
+<example inline="2">
+{ *&amp;hf_mongo_msg_flags,*
+	{ "Message Flags", "mongo.msg.flags",
+	FT_UINT32, BASE_HEX, NULL, 0x0,
+	"Bit vector of msg options.", HFILL }
+},
+{ *&amp;hf_mongo_msg_flags_checksumpresent,*
+	{ "ChecksumPresent", "mongo.msg.flags.checksumpresent",
+	FT_BOOLEAN, 32, *TFS(&amp;tfs_yes_no)*, *0x00000001,*
+	"The message ends with 4 bytes containing a CRC-32C [1] checksum", HFILL }
+},
+</example>
+
+<break/>
+
+<blurb>Add to tree:</blurb>
+<example inline="2">
+static const int * mongo_msg_flags[] = {
+	*&amp;hf_mongo_msg_flags_checksumpresent,*
+	&amp;hf_mongo_msg_flags_moretocome,
+	&amp;hf_mongo_msg_flags_exhaustallowed,
+	NULL
+};
+
+*proto_tree_add_bitmask*(
+	tree,
+	tvb, offset,
+	*hf_mongo_msg_flags,*
+	ett_mongo_msg_flags,
+	*mongo_msg_flags,*
+	ENC_LITTLE_ENDIAN
+);
+</example>
+
+</slide>
diff --git a/slides/mongodb/wireshark-dissectors-items.xml b/slides/mongodb/wireshark-dissectors-items.xml
new file mode 100644
index 0000000..b044cf3
--- /dev/null
+++ b/slides/mongodb/wireshark-dissectors-items.xml
@@ -0,0 +1,24 @@
+<slide background="wireshark-light.jpg">
+<title>Extending the dissector: item</title>
+
+<blurb>Definition:</blurb>
+<example inline="2">
+{ &amp;hf_mongo_msg_sections_section_doc_sequence_id,
+	{ *"SeqID",* "mongo.msg.sections.section.doc_sequence_id",
+	*FT_STRING,* BASE_NONE, NULL, 0x0,
+	*"Document sequence identifier",* HFILL }
+},
+</example>
+
+<break/>
+
+<blurb>Add to tree:</blurb>
+<example inline="2">
+proto_tree_add_item(
+	section_tree,
+	*hf_mongo_msg_sections_section_doc_sequence_id,*
+	tvb, offset, dsi_length,
+	*ENC_ASCII|ENC_NA*
+);
+</example>
+</slide>
diff --git a/slides/mongodb/wireshark-dissectors-op-compressed.xml b/slides/mongodb/wireshark-dissectors-op-compressed.xml
new file mode 100644
index 0000000..a499cb6
--- /dev/null
+++ b/slides/mongodb/wireshark-dissectors-op-compressed.xml
@@ -0,0 +1,26 @@
+<slide background="wireshark-light.jpg">
+<title>Extending the dissector: OP_COMPRESSED</title>
+
+<list>
+	<bullet>*zlib* available by default, and has helper API</bullet>
+	<bullet>*snappy* is optional, and needs manual deflating:
+<example>
+#ifdef HAVE_SNAPPY
+  case MONGO_COMPRESSOR_SNAPPY: {
+..
+  } break;
+#endif</example>
+	</bullet>
+	<bullet>Decompression creates a new *data source*:
+<example inline="2">
+if (ret == SNAPPY_OK) {
+    compressed_tvb = tvb_new_child_real_data(tvb, decomp_buf, orig_size, orig_size);
+    *add_new_data_source* (pinfo, compressed_tvb, "Decompressed Data");
+</example></bullet>
+	<bullet>Re-run dissector on decompressed data:
+<example inline="2">
+dissect_opcode_types(compressed_tvb, pinfo, 0, tree, opcode, *effective_opcode*);
+</example></bullet>
+</list>
+
+</slide>
diff --git a/slides/mongodb/wireshark-dissectors-subtree.xml b/slides/mongodb/wireshark-dissectors-subtree.xml
new file mode 100644
index 0000000..bfbfbd1
--- /dev/null
+++ b/slides/mongodb/wireshark-dissectors-subtree.xml
@@ -0,0 +1,26 @@
+<slide background="wireshark-light.jpg">
+<title>Extending the dissector: subtree</title>
+
+<blurb>Definition:</blurb>
+<example inline="2">
+{ &amp;hf_mongo_msg_sections_section,
+	{ "Section", *"mongo.msg.sections.section",*
+	*FT_NONE,* BASE_NONE, NULL, 0x0,
+	NULL, HFILL }
+},
+</example>
+
+<break/>
+
+<blurb>Add to tree:</blurb>
+<example inline="2">
+ti = proto_tree_add_item(
+	tree,
+	*hf_mongo_msg_sections_section,*
+	tvb, offset, 1 + section_len,
+	ENC_NA
+);
+
+*section_tree* = proto_item_add_subtree(ti, ett_mongo_section);
+</example>
+</slide>
diff --git a/slides/mongodb/wireshark-dissectors.xml b/slides/mongodb/wireshark-dissectors.xml
new file mode 100644
index 0000000..9304415
--- /dev/null
+++ b/slides/mongodb/wireshark-dissectors.xml
@@ -0,0 +1,46 @@
+<slide background="wireshark-light.jpg">
+<title>Extending the dissector: OP_MSG</title>
+
+<list>
+	<bullet>Add new function for dissecting OP_MSG:
+<example>
+case OP_MSG:
+    offset = dissect_mongo_op_msg(tvb, pinfo, offset, mongo_tree);
+</example></bullet>
+	<bullet>Consume bytes, and build tree with information</bullet>
+	<bullet>Items, Subtrees and Bitmasks</bullet>
+	<bullet>Wireshark API and tooling makes it hard to make undetected mistakes</bullet>
+	<bullet>They have a nicer workflow with Gerrit than the server project</bullet>
+</list>
+<![CDATA[
+
+OP_COMPRESSED:
+
+static const value_string compressor_vals[] = {
+  { MONGO_COMPRESSOR_NOOP,   "Noop (Uncompressed)" },
+  { MONGO_COMPRESSOR_SNAPPY, "Snappy" },
+  { MONGO_COMPRESSOR_ZLIB,   "Zlib" },
+  { 0,  NULL }
+};
+
+
+  - zlib available by default (hard-dependency)
+  - snappy is optional, and needs more work
+
+#ifdef HAVE_SNAPPY
+  case MONGO_COMPRESSOR_SNAPPY: {
+..
+  } break;
+#endif
+
+  - decompression creates a new "data source":
+
+      if (ret == SNAPPY_OK) {
+        compressed_tvb = tvb_new_child_real_data(tvb, decompressed_buffer, (guint32)orig_size, (guint32)orig_size);
+        add_new_data_source(pinfo, compressed_tvb, "Decompressed Data");
+
+  - decompressed data source runs the dissector again, with the embedded (effective) opcode:
+
+        dissect_opcode_types(compressed_tvb, pinfo, 0, tree, opcode, effective_opcode);
+]]>
+</slide>
diff --git a/slides/mongodb/wireshark-example-is-master.xml b/slides/mongodb/wireshark-example-is-master.xml
new file mode 100644
index 0000000..156970d
--- /dev/null
+++ b/slides/mongodb/wireshark-example-is-master.xml
@@ -0,0 +1,11 @@
+<slide background="wireshark-light.jpg">
+<title>is_master</title>
+
+<div effect="fade-out">
+<image filename="wireshark-is-master.png"/>
+</div>
+
+<div effect="fade-in">
+<image filename="wireshark-is-master-reply.png"/>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-example-op-compressed.xml b/slides/mongodb/wireshark-example-op-compressed.xml
new file mode 100644
index 0000000..8f5b378
--- /dev/null
+++ b/slides/mongodb/wireshark-example-op-compressed.xml
@@ -0,0 +1,11 @@
+<slide background="wireshark-light.jpg">
+<title>OP_COMPRESSED</title>
+
+<div effect="fade-out">
+<image filename="wireshark-query-reply-compressed1.png"/>
+</div>
+
+<div effect="fade-in">
+<image filename="wireshark-query-reply-compressed2.png"/>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-example-op-msg.xml b/slides/mongodb/wireshark-example-op-msg.xml
new file mode 100644
index 0000000..afae7c6
--- /dev/null
+++ b/slides/mongodb/wireshark-example-op-msg.xml
@@ -0,0 +1,11 @@
+<slide background="wireshark-light.jpg">
+<title>OP_MSG: Request, and Reply</title>
+
+<div effect="fade-out">
+<image filename="wireshark-query.png"/>
+</div>
+
+<div effect="fade-in">
+<image filename="wireshark-query-reply.png"/>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-example-ssl.xml b/slides/mongodb/wireshark-example-ssl.xml
new file mode 100644
index 0000000..40d02c7
--- /dev/null
+++ b/slides/mongodb/wireshark-example-ssl.xml
@@ -0,0 +1,15 @@
+<slide background="wireshark-light.jpg">
+<title>The SSL/OP_COMPRESSED rabbit hole</title>
+
+<div effect="fade-out">
+<image filename="wireshark-ssl-SSL.png"/>
+</div>
+
+<div effect="fade-in-out">
+<image filename="wireshark-ssl-MONGO.png"/>
+</div>
+
+<div effect="fade-in">
+<image filename="wireshark-ssl-OP_COMPRESSED.png"/>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-example-start.xml b/slides/mongodb/wireshark-example-start.xml
new file mode 100644
index 0000000..d5911a4
--- /dev/null
+++ b/slides/mongodb/wireshark-example-start.xml
@@ -0,0 +1,5 @@
+<slide background="wireshark-light.jpg">
+<title>Starting the Capture</title>
+
+<image filename="wireshark-start.png"/>
+</slide>
diff --git a/slides/mongodb/wireshark-is-master-reply.png b/slides/mongodb/wireshark-is-master-reply.png
new file mode 100644
index 0000000..f753314
Binary files /dev/null and b/slides/mongodb/wireshark-is-master-reply.png differ
diff --git a/slides/mongodb/wireshark-is-master.png b/slides/mongodb/wireshark-is-master.png
new file mode 100644
index 0000000..4f3ed95
Binary files /dev/null and b/slides/mongodb/wireshark-is-master.png differ
diff --git a/slides/mongodb/wireshark-light.jpg b/slides/mongodb/wireshark-light.jpg
new file mode 100644
index 0000000..ffb53b2
Binary files /dev/null and b/slides/mongodb/wireshark-light.jpg differ
diff --git a/slides/mongodb/wireshark-preferences.png b/slides/mongodb/wireshark-preferences.png
new file mode 100644
index 0000000..15e9d9f
Binary files /dev/null and b/slides/mongodb/wireshark-preferences.png differ
diff --git a/slides/mongodb/wireshark-query-reply-compressed1.png b/slides/mongodb/wireshark-query-reply-compressed1.png
new file mode 100644
index 0000000..52016b3
Binary files /dev/null and b/slides/mongodb/wireshark-query-reply-compressed1.png differ
diff --git a/slides/mongodb/wireshark-query-reply-compressed2.png b/slides/mongodb/wireshark-query-reply-compressed2.png
new file mode 100644
index 0000000..3fdedf5
Binary files /dev/null and b/slides/mongodb/wireshark-query-reply-compressed2.png differ
diff --git a/slides/mongodb/wireshark-query-reply.png b/slides/mongodb/wireshark-query-reply.png
new file mode 100644
index 0000000..0d5ff2d
Binary files /dev/null and b/slides/mongodb/wireshark-query-reply.png differ
diff --git a/slides/mongodb/wireshark-query.png b/slides/mongodb/wireshark-query.png
new file mode 100644
index 0000000..b20a3ea
Binary files /dev/null and b/slides/mongodb/wireshark-query.png differ
diff --git a/slides/mongodb/wireshark-ssl-MONGO.png b/slides/mongodb/wireshark-ssl-MONGO.png
new file mode 100644
index 0000000..3f41857
Binary files /dev/null and b/slides/mongodb/wireshark-ssl-MONGO.png differ
diff --git a/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png b/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png
new file mode 100644
index 0000000..fa7a4a7
Binary files /dev/null and b/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png differ
diff --git a/slides/mongodb/wireshark-ssl-SSL.png b/slides/mongodb/wireshark-ssl-SSL.png
new file mode 100644
index 0000000..7346837
Binary files /dev/null and b/slides/mongodb/wireshark-ssl-SSL.png differ
diff --git a/slides/mongodb/wireshark-ssl-keys.xml b/slides/mongodb/wireshark-ssl-keys.xml
new file mode 100644
index 0000000..99de36a
--- /dev/null
+++ b/slides/mongodb/wireshark-ssl-keys.xml
@@ -0,0 +1,27 @@
+<slide background="wireshark-light.jpg">
+<title>SSL: Reading secrets</title>
+
+<blurb>Wireshark:</blurb>
+<list>
+	<bullet>Can decrypt SSL if it has the private key</bullet>
+	<bullet>Can not decrypt SSL if the key exchange is DH</bullet>
+</list>
+
+<div effect="fade-in">
+<break lines="1"/>
+<blurb>But we can hack around it with %LD_PRELOAD%:</blurb>
+<blurb>Download:</blurb>
+<example>https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.c</example>
+
+<blurb>Compile:</blurb>
+<example>
+cc sslkeylog.c -shared -o libsslkeylog.so -fPIC -ldl
+</example>
+
+<blurb>Use:</blurb>
+<example>
+SSLKEYLOGFILE=/tmp/premaster.txt LD_PRELOAD=./libsslkeylog.so \
+  ./mongo --ssl --sslPEMKeyFile=/tmp/ssl/ssl/client.pem --sslCAFile=/tmp/ssl/ssl/ca.pem
+</example>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-ssl-wireshark-config.xml b/slides/mongodb/wireshark-ssl-wireshark-config.xml
new file mode 100644
index 0000000..5cb5007
--- /dev/null
+++ b/slides/mongodb/wireshark-ssl-wireshark-config.xml
@@ -0,0 +1,17 @@
+<slide>
+<title>Configuring Wireshark</title>
+
+<image filename="wireshark-preferences.png"/>
+
+<div effect="fade-in">
+<break/>
+<blurb>%/tmp/ssl-debug.txt%</blurb>
+
+<example>
+ssl_decrypt_pre_master_secret:
+   session uses Diffie-Hellman key exchange
+   (cipher suite 0xC030 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
+   and cannot be decrypted using a RSA private key file.
+</example>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-ssl1.png b/slides/mongodb/wireshark-ssl1.png
new file mode 100644
index 0000000..5784a5b
Binary files /dev/null and b/slides/mongodb/wireshark-ssl1.png differ
diff --git a/slides/mongodb/wireshark-start.png b/slides/mongodb/wireshark-start.png
new file mode 100644
index 0000000..e53948b
Binary files /dev/null and b/slides/mongodb/wireshark-start.png differ
diff --git a/slides/mongodb/wireshark-title.xml b/slides/mongodb/wireshark-title.xml
new file mode 100644
index 0000000..24fa109
--- /dev/null
+++ b/slides/mongodb/wireshark-title.xml
@@ -0,0 +1,3 @@
+<slide style="title" background="wireshark.jpg">
+<title>Wireshark</title>
+</slide>
diff --git a/slides/mongodb/wireshark-what.xml b/slides/mongodb/wireshark-what.xml
new file mode 100644
index 0000000..08d0b99
--- /dev/null
+++ b/slides/mongodb/wireshark-what.xml
@@ -0,0 +1,11 @@
+<slide background="wireshark-light.jpg">
+<title>Wireshark</title>
+
+<div class="center-blurb-wide">
+<list>
+	<bullet>A tool for analysing network traffic</bullet>
+	<bullet>*Dissectors* for specific protocols<br/>e.g. MongoDB wire protocol</bullet>
+	<bullet>Save and share</bullet>
+</list>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark.jpg b/slides/mongodb/wireshark.jpg
new file mode 100644
index 0000000..bb741e6
Binary files /dev/null and b/slides/mongodb/wireshark.jpg differ
diff --git a/wireshark-mongo.xml b/wireshark-mongo.xml
new file mode 100644
index 0000000..9f92210
--- /dev/null
+++ b/wireshark-mongo.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<presentation css="10gen-strict.css">
+<topic>MongoDB</topic>
+<title>Wireshark and MongoDB 3.6</title>
+<event>WIP</event>
+<location>Online</location>
+<date>January 18th, 2018</date>
+<speaker>Derick Rethans</speaker>
+<email>[email protected]</email>
+<twitter>derickr</twitter>
+<url>https://derickrethans.nl/talks.html</url>
+<joindin>https://derickrethans.nl/talks/wireshark-mongo</joindin>
+<slide>slides/mongodb/title.xml</slide>
+
+<slide>slides/mongodb/wireshark-title.xml</slide>
+<slide>slides/mongodb/wireshark-what.xml</slide>
+
+<slide>slides/mongodb/wireshark-example-start.xml</slide>
+<slide>slides/mongodb/wireshark-example-is-master.xml</slide>
+
+<slide>slides/mongodb/wireshark-3.6.xml</slide>
+
+<slide>slides/mongodb/wireshark-dissectors.xml</slide>
+<slide>slides/mongodb/wireshark-dissectors-subtree.xml</slide>
+<slide>slides/mongodb/wireshark-dissectors-items.xml</slide>
+<slide>slides/mongodb/wireshark-dissectors-bitmask.xml</slide>
+<slide>slides/mongodb/wireshark-example-op-msg.xml</slide>
+
+<slide>slides/mongodb/wireshark-dissectors-op-compressed.xml</slide>
+<slide>slides/mongodb/wireshark-example-op-compressed.xml</slide>
+
+<slide>slides/mongodb/wireshark-ssl-keys.xml</slide>
+<slide>slides/mongodb/wireshark-ssl-wireshark-config.xml</slide>
+<slide>slides/mongodb/wireshark-example-ssl.xml</slide>
+
+<slide>slides/mongodb/wireshark-3.8.xml</slide>
+
+<slide>slides/mongodb/questions.xml</slide>
+<slide>slides/mongodb/resources.xml</slide>
+
+</presentation>