feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Sniffer Watch Cert Chain

Browse Source 
Modifed the sniffer watch callback so it provides a SHA-256 hash of the
peer certificate, as before, and the entire certificate chain sent by
the server in the Certificate handshake message. The chain is taken
directly from the message payload, unprocessed. It'll be a list of pairs
of 24-bit certificate length and a DER encoded certificate, all in
network byte order.
This commit is contained in:
John Safranek
2019-07-15 14:07:22 -07:00
parent 5743a1c80f
commit 3cdb4f8bf0
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/sniffer.c
View File

@@ -2314,6 +2314,8 @@ static int ProcessCertificate(const byte* input, int* sslBytes,
SnifferSession* session, char* error) SnifferSession* session, char* error)
{ {
Sha256 sha; Sha256 sha;
const byte* certChain;
word32 certChainSz;
word32 certSz; word32 certSz;
int ret; int ret;
byte digest[SHA256_DIGEST_SIZE]; byte digest[SHA256_DIGEST_SIZE];
@@ -2330,7 +2332,9 @@ static int ProcessCertificate(const byte* input, int* sslBytes,
return -1; return -1;
} }
ato24(input, &certChainSz);
input += CERT_HEADER_SZ; input += CERT_HEADER_SZ;
certChain = input;
ato24(input, &certSz); ato24(input, &certSz);
input += OPAQUE24_LEN; input += OPAQUE24_LEN;
@@ -2344,8 +2348,8 @@ static int ProcessCertificate(const byte* input, int* sslBytes,
return -1; return -1;
} }
ret = WatchCb((void*)session, digest, sizeof(digest), input, certSz, ret = WatchCb((void*)session, digest, sizeof(digest),
WatchCbCtx, error); certChain, certChainSz, WatchCbCtx, error);
if (ret != 0) { if (ret != 0) {
#ifdef WOLFSSL_SNIFFER_STATS #ifdef WOLFSSL_SNIFFER_STATS
INC_STAT(SnifferStats.sslKeysUnmatched); INC_STAT(SnifferStats.sslKeysUnmatched);

6
wolfssl/sniffer.h
View File

@@ -168,8 +168,10 @@ SSL_SNIFFER_API int ssl_ReadResetStatistics(SSLStats* stats);
typedef int (*SSLWatchCb)(void* vSniffer, typedef int (*SSLWatchCb)(void* vSniffer,
const unsigned char* certHash, unsigned int certHashSz, const unsigned char* certHash,
const unsigned char* cert, unsigned int certSz, unsigned int certHashSz,
const unsigned char* certChain,
unsigned int certChainSz,
void* ctx, char* error); void* ctx, char* error);
WOLFSSL_API WOLFSSL_API