From 1927a4fa8d871188842cddde7755f4d34f804dd2 Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Tue, 1 Oct 2013 23:02:53 +0200 Subject: generate-wireshark-cs: fix ECDH, add PSK, drop SIG_ ssl_get_keyex_alg.txt contains the current supported list of cipher suites for key exchange by the ssl_get_keyex_alg() function. It was generated with: awk -F '[ :;\t]+' '/^gint ssl_get_keyex_alg/{p=1} /case/{if(p)a[$3]=0} /return/{for(i in a)print i, $3;delete a} /^} /{if(p)exit}' packet-ssl-utils.c This file can then be converted and sorted with: while read num name; do echo $((num)) $name; done < ssl_get_keyex_alg.txt | sort -n > /tmp/1 To get the current cipher suites list: awk -F '[ {,]+' '/,KEX_/{print $2, $3}' packet-ssl-utils.c > /tmp/2 Check which cipher suites are missing or have an incorrect key exchange: diff -y /tmp/[12] It turned out that the ECDH cipher suites were incorrectly marked as DH (tested on top of SVN rev 52320). Therefore adjust the generate-wireshark-cs file. --- generate-wireshark-cs | 24 +---- kex-fix/ssl_get_keyex_alg.txt | 210 +++++++++++++++++++++++++++++++++++++ kex-fix/ssl_get_keyex_alg.txt.diff | 210 +++++++++++++++++++++++++++++++++++++ notes.txt | 16 +++ openssl-connect | 1 + openssl-listen | 1 + 6 files changed, 443 insertions(+), 19 deletions(-) create mode 100644 kex-fix/ssl_get_keyex_alg.txt create mode 100644 kex-fix/ssl_get_keyex_alg.txt.diff diff --git a/generate-wireshark-cs b/generate-wireshark-cs index 4bc1fa1..1d1d885 100755 --- a/generate-wireshark-cs +++ b/generate-wireshark-cs @@ -17,7 +17,7 @@ warn() { } p() { - local tmp kex sig keysize exp_keysize=0 dig diglen mode us_export blocksize hexid + local tmp kex keysize exp_keysize=0 dig diglen mode us_export blocksize hexid [ $# -gt 0 ] || return num=$(($2*0x100 + $3)) hexid=000$(echo "obase=16;$num" | bc) @@ -32,31 +32,17 @@ p() { tmp=${tmp%_EXPORT} tmp=${tmp#TLS_} case $tmp in + PSK) kex=PSK ;; + RSA_PSK) kex=RSA_PSK ;; RSA) kex=RSA ;; DH_*|DHE_*) kex=DH ;; - ECDH_*|ECDHE_*) kex=DH ;; + ECDH_*|ECDHE_*) kex=ECDH ;; *) warn "Unknown kex in $hexid $1 (tmp=$tmp)" return ;; esac - tmp=${1%%_WITH_*} - tmp=${tmp%_EXPORT} - tmp=${tmp#TLS_} - tmp=${tmp#EC} - tmp=${tmp#DH_} - tmp=${tmp#DHE_} - case $tmp in - RSA|DSS) sig=$tmp ;; - ECDSA) sig=DSS ;; - anon) sig=NONE ;; - *) - warn "Unknown sig in $hexid $1 (tmp=$tmp)" - return - ;; - esac - # HACK HACK HACK tmp=${1#*WITH_} cipher=${tmp%%_*} @@ -151,7 +137,7 @@ p() { esac cat <