Age | Commit message (Collapse) | Author | Files | Lines |
|
Match also stuff like DHE-PSK-AES128-CCM8. Improve error message if
cipher is not accepted by OpenSSL.
|
|
The options parser has changed, options now have to precede the
parameters (possible a bug, already reported to rt.openssl.org with
subject "Options after parameters are ignored in OpenSSL 1.1.0").
While at it, use COMPLEMENTOFALL instead of NULL since that possibly
includes more ciphers.
|
|
* generate-wireshark-cs: fix key sizes for export ciphers
* notes, openssl-{connect,listen}: support more cipher suites,
including NULL.
|
|
The CLIENT_RANDOM is applicable to clients only, so remove it from
ServerHello. Also update notes with cmake+gcrypt instructions.
|
|
|
|
ssl_get_keyex_alg.txt contains the current supported list of cipher
suites for key exchange by the ssl_get_keyex_alg() function.
It was generated with:
awk -F '[ :;\t]+' '/^gint ssl_get_keyex_alg/{p=1}
/case/{if(p)a[$3]=0} /return/{for(i in a)print i, $3;delete a} /^}
/{if(p)exit}' packet-ssl-utils.c
This file can then be converted and sorted with:
while read num name; do echo $((num)) $name;
done < ssl_get_keyex_alg.txt | sort -n > /tmp/1
To get the current cipher suites list:
awk -F '[ {,]+' '/,KEX_/{print $2, $3}' packet-ssl-utils.c > /tmp/2
Check which cipher suites are missing or have an incorrect key exchange:
diff -y /tmp/[12]
It turned out that the ECDH cipher suites were incorrectly marked as
DH (tested on top of SVN rev 52320). Therefore adjust the
generate-wireshark-cs file.
|
|
Wireshark already supports these suites, yay :)
|
|
Making assumptions about ClientHello is very fragile, but since we are
controlling the client, it should not be a big deal.
|
|
This makes it easier to see relations in plaintext (if any).
|
|
|
|
This allows for something like:
openssl ciphers -V | grep -v \ SRP- | ./openssl-connect /tmp/test-certs
|
|
|
|
|