summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-01-31Add mysql-ssl-larger.pcapngPeter Wu1-0/+0
Pre-master keys are available in the capture file comments. This selects something from a table and queries 'SHOW VARIABLES' over ethernet (mtu 1500). It demonstrates a TLS record spanning multiple TCP segments.
2015-01-31Add ldap-ssl.pcapngPeter Wu1-0/+0
Pre-master keys are available in the capture file comments. Install slapd 2.4.31-1+nmu2ubuntu8 ldap-utils 2.4.31-1+nmu2ubuntu8 cd /etc/ldap/ssl openssl req -newkey rsa:1024 -x509 -nodes -out slapd.pem -keyout \ slapd.pem -days 3650 -subj /CN='LDAP SSL test/' chown openldap: slapd.pem && chmod 600 slapd.pem cat <<EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: cn=config add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/slapd.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd.pem EOF /etc/init.d/slapd restart Client: gdb -q -ex break\ gnutls_handshake -ex r --args \ ldapsearch -ZZ ldap://127.0.0.1:389 p session p/x ((gnutls_session_t)$1)->security_parameters->client_random p/x ((gnutls_session_t)$1)->security_parameters->master_secret c
2015-01-31Add pgsql-ssl.pcapngPeter Wu1-0/+0
Pre-master keys are available in the capture file comments. Ubuntu 14.04 server with postgresql-9.3 (assume snakeoil certificates, change listen_addresses='0.0.0.0' and restart). Then create user and db: createuser -P test createdb -O test testdb Client: psql postgresql://test:pass@127.0.0.1/testdb?sslmode=require Capture file contains queries (create table, insert, select).
2015-01-30Add smtp2525-ssl.pcapng (SMTP over port 2525)Peter Wu1-0/+0
premaster secrets is available in capture file comments. Similar to smtp-ssl.pcapng, but running over non-standard port 2525 to exercise "Decode As" functionality.
2015-01-30Add sslkeylog.sh wrapper scriptPeter Wu1-0/+22
2015-01-30Add imap-ssl.pcapngPeter Wu1-0/+0
Pre-master keys are available in the capture file comments. Server is Ubuntu 14.04 with dovecot-imapd and port 143 enabled in /etc/dovecot/conf.d/10-master.conf. Client: openssl s_client -starttls imap -connect localhost:143 Contains "a001 CAPABILITY" followed by renegotiation, "a002 CAPABILITY" and "QUIT".
2015-01-30Add pop-ssl.pcapng (POP3)Peter Wu1-0/+0
Pre-master keys are available in the capture file comments. Server is Ubuntu 14.04 with dovecot-pop3d and port 110 enabled in /etc/dovecot/conf.d/10-master.conf. Client: openssl s_client -starttls pop3 -connect localhost:110 Contains "POPA" followed by renegotiation, "POPA" and "QUIT".
2015-01-30Add xmpp-ssl.pcapngPeter Wu1-0/+0
Premaster secret is available in capture file comments. Capture file generated with an invalid authentication attempt using TLSv1.2: git clone https://github.com/fritzy/SleekXMPP.git cd SleekXMPP PYTHONPATH=. \ python examples/ping.py -d -j wireshark-test@jabber.org -p none
2015-01-30sslkeylog: load libssl.so if not alreadyPeter Wu1-5/+35
This solves a null deref in python ssl module in SSL_do_handshake.
2015-01-30Add smtp-ssl.pcapngPeter Wu1-0/+0
premaster secrets is available in capture file comments. Server is Ubuntu 14.04 running Exim 4.82-3ubuntu2 (using GnuTLS) and configured with: /usr/share/doc/exim4-base/examples/exim-gencert echo MAIN_TLS_ENABLE=1 >/etc/exim4/exim4.conf.localmacros Client: sudo socat TCP-LISTEN:25 TCP-CONNECT:... # (port forward) openssl s_client -starttls smtp -connect localhost:25 After handshake, I typed "EHLO lekensteyn" and triggered a renegiotation with "R" (which somehow resulted in an error).
2015-01-30Add mysql-ssl.pcapng over TLSv1Peter Wu1-0/+0
pre-master secrets is in capture file comments, certificate is snakeoil. Server is Ubuntu 14.04 VM with MariaDB 5.5.40-0ubuntu0.14.04.1, snakeoil certificate and these my.cnf configs: bind-address=0.0.0.0 ssl-ca=/etc/ssl/certs/ssl-cert-snakeoil.pem ssl-cert=/etc/ssl/certs/ssl-cert-snakeoil.pem ssl-key=/etc/mysql/ssl-cert-snakeoil.key Pre-processing: CREATE USER testuser@'%' IDENTIFIED BY 'pass'; CREATE DATABASE testdb; GRANT ALL ON testdb.* TO test@'%'; Client started with: mysql -utest -ppass -h127.0.0.1 --ssl-ca=ssl-cert-snakeoil.pem The capture contains queries (INSERT, SELECT, deliberate disallowed `USE mysql` and more).
2015-01-29sync-build.sh: use GTK3, allow cmake regenerate forcePeter Wu1-3/+10
2015-01-29sslkeylog: interpose SSL_read and SSL_writePeter Wu1-0/+24
These functions can trigger a renegotiation which changes the key material (detected by using `curl` and `openssl s_server` and pressing `R` in `openssl s_server`).
2015-01-29sslkeylog: skip writing duplicate entriesPeter Wu1-4/+35
SSL_connect is somehow called multiple times on the same connection by curl, this may result in duplicate keylog file entries. Detect when the state changes, and only print the keys if it has changed.
2015-01-29sslkeylog: intercept server functionsPeter Wu1-6/+33
Also intercept SSL_do_handshake (nginx) and SSL_accept (s_server).
2015-01-29sslkeylog: continue after failed handshake, reject SSLv2Peter Wu1-1/+4
Try to dump as many keys as possible, even if a fatal alert occurred. Wireshark does not support SSLv2, so check that a successful connection does not use SSLv2 before dumping keys (this fixes a crash).
2015-01-28sslkeylog: rename key_logfile to keylog_filePeter Wu1-9/+9
This follows the preference name ssl.keylog_file.
2015-01-28Add SSLv2 capture filePeter Wu1-0/+0
Master-Key, Key-Arg (from curl output) and 512-bit RSA keys are available in the capture file comments. Key and certificates are generated with: openssl req -newkey rsa:384 -x509 -nodes -keyout server.pem -new \ -out server.pem -subj /CN='Very Secure' -md5 Server (openssl 1.0.2) was started with: openssl s_server -ssl2 -www Client (curl 7.40.0-DEV with `!defined(HAVE_SSLV2_CLIENT_METHOD)` removed): curl -vk --sslv2 https://127.0.0.1:4433
2015-01-28sslkeylog.c: utility to intercept OpenSSL keysPeter Wu2-0/+94
For a gdb function, see http://security.stackexchange.com/a/80174/2630 To generate the line assuming you have a context with a SSL structure (named "s") run this: python def read_as_hex(name, size): addr = gdb.parse_and_eval(name).address data = gdb.selected_inferior().read_memory(addr, size) return ''.join('%02X' % ord(x) for x in data) def pm(ssl='s'): mk = read_as_hex('%s->session->master_key' % ssl, 48) cr = read_as_hex('%s->s3->client_random' % ssl, 32) print('CLIENT_RANDOM %s %s' % (cr, mk)) end python pm()
2014-12-10doc/dissector: added my understanding of desegmentationPeter Wu1-0/+67
Last modified on 29 July 2014, but it should still apply.
2014-12-10sync-build.sh: enable extra warnings, ignore filesPeter Wu1-0/+3
2014-10-01sync-build.sh: add -fsanitize=undefined, NOCOPYPeter Wu1-3/+12
2014-09-29tshark-http2urls.awk: helper to retrieve HTTP infoPeter Wu1-0/+62
Prints Last-Modified, Content-Length and URL for tshark -O http output. Used for analyzing a vc_web install capture.
2014-09-26sync-build.sh: 32-bit on 64-bit supportPeter Wu1-14/+47
Also allows you to override CC/CXX (for Clang support), fix /tmp/wireshark/ symlink and /tmp/wsbuild/run/ sync, enable some additional modules (but disable SBC which would be used for Bluetooth audio support), pass -DCMAKE_EXPORT_COMPILE_COMMANDS (for clang-check iirc).
2014-07-07notes: random blurpPeter Wu1-7/+20
2014-07-07sync-build.sh: remote compilation after editingPeter Wu1-0/+109
This script helps me in syncing sources with a remote build machine and building changes once I have made a local change. It also syncs back generated binaries.
2014-07-04replay-chunks: fallback to localhost on failurePeter Wu1-2/+9
2014-07-03replay-chunks.py: fix missing dataPeter Wu1-1/+3
Not all bytes were captured, it turns out that data was never read (and thus the send buffer becames full) which leads to data loss when the connection is closed.
2014-07-03replay-chunk: accept capture as arg, py2 compatPeter Wu1-10/+45
The common case is replaying a capture, so avoid all tshark boilerplate and run the command in the script. Fix the mixup of server and client sockets ("if reply, then write from the server socket"). Allow chunk size to be customized.
2014-07-02notes update with cmake, random stuffPeter Wu1-0/+31
2014-07-02replay-chunks.py: fragmentize tcp dataPeter Wu1-0/+97
2013-12-13generate-wireshark-cs: Rename SSL_CIPHER_MODE_xxx to MODE_xxxPeter Wu1-1/+1
Since wireshark rev54039
2013-12-10run-ws: support gdb and valgrindPeter Wu1-1/+20
2013-12-10More ciphers supportPeter Wu4-11/+20
* generate-wireshark-cs: fix key sizes for export ciphers * notes, openssl-{connect,listen}: support more cipher suites, including NULL.
2013-12-09generate-wireshark-cs: add missing EXPORT1024 casePeter Wu1-0/+1
Fixes: Unknown kex in 0x0060 TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (tmp=RSA_EXPORT1024) Unknown kex in 0x0061 TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (tmp=RSA_EXPORT1024) Unknown kex in 0x0062 TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (tmp=RSA_EXPORT1024) Unknown kex in 0x0064 TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (tmp=RSA_EXPORT1024) But to be honest, is there any implementation that actually use these cipher suites...?
2013-12-09generate-wireshark-cs: add RC4 and RC2 with 56 bitsHauke Mehrtens1-2/+3
This is used in some export ciphers
2013-12-09suites.txt: add suites already in wiresharkHauke Mehrtens1-0/+7
These are no official cipher suites, but they are used somewhere. Sources: - (96-102) "0x00,0x60-0x66 Reserved to avoid conflicts with widely deployed implementations" [1] - (96-97) Disabled in OpenSSL 0.9.8c, from a commit message on 14 June 2006: "the latter two [0x00,0x61 and 0x00,0x60 cipher suites] were purpotedly from draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really appear there" [3] - (98-102) An (expired) IETF draft on 56-bit cipher suites defines cipher suites 0x00,0x62-66 [2] [1]: http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 [2]: http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 [3]: http://marc.info/?l=openssl-cvs&m=115030750911430 [ Peter: added sources ]
2013-12-09notes: how to generate suites.txtPeter Wu1-1/+3
2013-12-09generate-wireshark-cs: some fixes for CCMHauke Mehrtens1-23/+35
This applies some fixes for CCM to the cipher suite generation script. There are some special cases for CCM ciphers: the iv blocksize is always 4, it does not have a digest and the mode should be CCM or CCM_8. [ Peter: basically restructure (indent+case) and fix CCM block size. I removed the digest as that was already covered and diglen=0; is not meaningful ]
2013-12-06generate-wireshark-cs: use "0" for unavailable block sizePeter Wu1-1/+7
Stream cipher RC4 (and block cipher NULL) do not have a IV. The packet-ssl-utils code needs to be fixed up for this, but this generator can already be created. Revert this patch until the block to iv_size rename is complete.
2013-12-06generate-wireshark-cs: visual alignmentPeter Wu1-3/+18
Previously, everything was concatenated, making it more difficult to spot errors.
2013-12-06generate-wireshark-cs: CCM supportPeter Wu1-2/+9
2013-12-06cyassl-test: test ciphers supported by CyaSSLPeter Wu2-0/+115
2013-12-06run-ws: helper to run wireshark for SSL debuggingPeter Wu1-0/+40
Example usage, assuming 'premaster.txt' in corrent directory: ./run-ws /tmp/wsbuild/tshark dump.pcapng Example, with filtering for SSL record type Application Data (23): ./run-ws /usr/bin/wireshark dump.pcapng.gz \ -Y ssl.record.content_type==23
2013-12-06openssl-{connect,listen}: fix usage, reduce outputPeter Wu3-12/+17
The CLIENT_RANDOM is applicable to clients only, so remove it from ServerHello. Also update notes with cmake+gcrypt instructions.
2013-12-03cyassl patch for AES-CCM testingPeter Wu2-0/+124
See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9499
2013-12-03generate-wireshark-cs: add CCM and CCM_8 modesPeter Wu1-0/+2
2013-12-03generate-wireshark-cs: use hexadecimal IDsPeter Wu1-1/+1
2013-12-03notes: cmake command, SSLKEYLOGFILE, RC2Peter Wu1-1/+7
2013-10-28tshark-iophs-percent.awk: add script to add percentagesPeter Wu1-0/+49
Requested by [aspirin] on #wireshark, this script adds a percentage number to the tshark statistics output. Adding a percentage bar can also be done, but is an exercise for later at the moment.
generated by cgit v1.2.1 (git 2.18.0) at 2024-04-28 20:15:39 +0000