diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2017-02-08 00:48:28 +0100 |
|---|---|---|
| committer | Peter Wu <peter@lekensteyn.nl> | 2017-02-11 00:10:14 +0000 |
| commit | b659c76c320de2d66c369f88d400a98aeb56d2d7 (patch) | |
| tree | 7b8c4517e65c0b6e6bd8653d5957e9c02e84dcef /epan | |
| parent | 813625883c109cd0fce3257872faa4a87dcfae55 (diff) | |
| download | wireshark-b659c76c320de2d66c369f88d400a98aeb56d2d7.tar.gz | |
TLS13: fix length of Finished message
Select the full message instead of just the first 12 bytes (as was the
case in previous TLS versions. No check is added since it is too much
work for little gain (it would require looking up the hash length for
the cipher suite).
Change-Id: Iea13d5abe6a7e55b04fabacfa8919a02acd8517d
Reviewed-on: https://code.wireshark.org/review/20011
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-dtls.c | 2 | ||||
| -rw-r--r-- | epan/dissectors/packet-ssl-utils.c | 10 | ||||
| -rw-r--r-- | epan/dissectors/packet-ssl-utils.h | 2 | ||||
| -rw-r--r-- | epan/dissectors/packet-ssl.c | 2 |
4 files changed, 11 insertions, 5 deletions
diff --git a/epan/dissectors/packet-dtls.c b/epan/dissectors/packet-dtls.c index ea4e0eea69..871ae1e01e 100644 --- a/epan/dissectors/packet-dtls.c +++ b/epan/dissectors/packet-dtls.c @@ -1328,7 +1328,7 @@ dissect_dtls_handshake(tvbuff_t *tvb, packet_info *pinfo, case SSL_HND_FINISHED: ssl_dissect_hnd_finished(&dissect_dtls_hf, sub_tvb, ssl_hand_tree, - 0, session, NULL); + 0, length, session, NULL); break; case SSL_HND_CERT_URL: diff --git a/epan/dissectors/packet-ssl-utils.c b/epan/dissectors/packet-ssl-utils.c index 86d23ca9e9..94cd19f53f 100644 --- a/epan/dissectors/packet-ssl-utils.c +++ b/epan/dissectors/packet-ssl-utils.c @@ -7340,7 +7340,7 @@ ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, /* Finished dissection. {{{ */ void ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb, - proto_tree *tree, guint32 offset, + proto_tree *tree, guint32 offset, guint32 offset_end, const SslSession *session, ssl_hfs_t *ssl_hfs) { /* For SSLv3: @@ -7353,6 +7353,11 @@ ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb, * struct { * opaque verify_data[12]; * } Finished; + * + * For TLS 1.3: + * struct { + * opaque verify_data[Hash.length]; + * } */ if (!tree) return; @@ -7365,8 +7370,9 @@ ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb, tvb, offset + 16, 20, ENC_NA); } } else { + /* Length should be 12 for TLS before 1.3, assume this is the case. */ proto_tree_add_item(tree, hf->hf.hs_finished, - tvb, offset, 12, ENC_NA); + tvb, offset, offset_end - offset, ENC_NA); } } /* }}} */ diff --git a/epan/dissectors/packet-ssl-utils.h b/epan/dissectors/packet-ssl-utils.h index fb51455d8f..61a5790b65 100644 --- a/epan/dissectors/packet-ssl-utils.h +++ b/epan/dissectors/packet-ssl-utils.h @@ -933,7 +933,7 @@ ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, extern void ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb, - proto_tree *tree, guint32 offset, + proto_tree *tree, guint32 offset, guint32 offset_end, const SslSession *session, ssl_hfs_t *ssl_hfs); extern void diff --git a/epan/dissectors/packet-ssl.c b/epan/dissectors/packet-ssl.c index 96d6dec2f1..e9eaba3fe2 100644 --- a/epan/dissectors/packet-ssl.c +++ b/epan/dissectors/packet-ssl.c @@ -2169,7 +2169,7 @@ dissect_ssl3_handshake(tvbuff_t *tvb, packet_info *pinfo, case SSL_HND_FINISHED: ssl_dissect_hnd_finished(&dissect_ssl3_hf, tvb, ssl_hand_tree, - offset, session, &ssl_hfs); + offset, offset + length, session, &ssl_hfs); if (ssl) { ssl_load_keyfile(ssl_options.keylog_filename, &ssl_keylog_file, &ssl_master_key_map); tls13_change_key(ssl, &ssl_master_key_map, is_from_server, TLS_SECRET_APP); |