mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2025-07-31 19:24:42 +02:00
Initial sniffer keylog file support for TLS 1.2
This commit is contained in:
Brett Nicholas
@@ -46,7 +46,7 @@ run_sequence() {
|
||||
run_test "TLS13-AES128-GCM-SHA256" "-v 4" "-v 4"
|
||||
run_test "TLS13-AES256-GCM-SHA384" "-v 4" "-v 4"
|
||||
run_test "TLS13-CHACHA20-POLY1305-SHA256" "-v 4" "-v 4"
|
||||
elif [ "$1" == "tls12" ]; then # TLS v1.2
|
||||
elif [ "$1" == "tls12" ] || [ "$1" == "tls12-keylog" ]; then # TLS v1.2
|
||||
run_test "ECDHE-ECDSA-AES128-GCM-SHA256" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-key.pem -c ./certs/intermediate/server-chain-ecc.pem -V" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-client-key.pem -c ./certs/intermediate/client-chain-ecc.pem -C"
|
||||
run_test "ECDHE-ECDSA-AES256-GCM-SHA384" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-key.pem -c ./certs/intermediate/server-chain-ecc.pem -V" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-client-key.pem -c ./certs/intermediate/client-chain-ecc.pem -C"
|
||||
elif [ "$1" == "tls13-dh-resume" ] || [ "$1" == "tls13-ecc-resume" ]; then # TLS v1.3 Resumption
|
||||
@@ -69,19 +69,37 @@ run_sequence() {
|
||||
fi
|
||||
}
|
||||
|
||||
run_capture(){
|
||||
|
||||
run_capture() {
|
||||
local config_flags=()
|
||||
echo -e "\nconfiguring and building wolfssl ($1)..."
|
||||
./configure --enable-sniffer $2 1>/dev/null || exit $?
|
||||
|
||||
# Add default flags
|
||||
config_flags+=(--enable-sniffer)
|
||||
|
||||
# If additional arguments are provided, add them to the array
|
||||
if [ -n "$2" ]; then
|
||||
# Convert string into an array, respecting quoted strings as a single element
|
||||
eval "config_flags+=($2)"
|
||||
fi
|
||||
|
||||
./configure "${config_flags[@]}" 1>/dev/null || exit $?
|
||||
make 1>/dev/null || exit $?
|
||||
|
||||
echo "starting capture"
|
||||
tcpdump -i lo -n port 11111 -w ./scripts/sniffer-${1}.pcap -U &
|
||||
tcpdump_pid=$!
|
||||
run_sequence $1
|
||||
sleep 1
|
||||
kill -15 $tcpdump_pid; tcpdump_pid=0
|
||||
|
||||
if [ "$1" == "tls12-keylog" ]; then
|
||||
cp ./sslkeylog.log ./scripts/sniffer-${1}.sslkeylog
|
||||
fi
|
||||
}
|
||||
|
||||
run_capture "tls12" ""
|
||||
run_capture "tls12-keylog" "--enable-enc-then-mac=no --enable-keylog-export CFLAGS='-Wno-cpp -DWOLFSSL_SNIFFER_KEYLOGFILE'"
|
||||
run_capture "tls13-ecc" ""
|
||||
run_capture "tls13-ecc-resume" "--enable-session-ticket"
|
||||
run_capture "tls13-dh" "--disable-ecc"
|
||||
|
||||
@@ -59,6 +59,12 @@ has_static_rsa=no
|
||||
if [ $? -eq 0 ]; then
|
||||
has_static_rsa=yes
|
||||
fi
|
||||
# ./configure --enable-sniffer CFLAGS="-DWOLFSSL_SNIFFER_KEYLOGFILE"
|
||||
has_keylog=no
|
||||
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'ssl_keylog_file'
|
||||
if [ $? -eq 0 ]; then
|
||||
has_keylog=yes
|
||||
fi
|
||||
|
||||
|
||||
RESULT=0
|
||||
@@ -67,7 +73,7 @@ RESULT=0
|
||||
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
|
||||
then
|
||||
echo -e "\nStaring snifftest on testsuite.pcap...\n"
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-static-rsa.pcap ./certs/server-key.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-static-rsa.pcap -key ./certs/server-key.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest static RSA failed\n" && exit 1
|
||||
@@ -77,16 +83,42 @@ fi
|
||||
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
|
||||
then
|
||||
echo -e "\nStaring snifftest on sniffer-ipv6.pcap...\n"
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-ipv6.pcap ./certs/server-key.pem ::1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-ipv6.pcap -key ./certs/server-key.pem -server ::1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest (ipv6) failed\n" && exit 1
|
||||
fi
|
||||
|
||||
# TLS v1.2 sniffer keylog file test: runs sniffer on pcap and associated keylog file and compares decrypted traffic with known good output.
|
||||
# To regenerate the known good output, run `scripts/sniffer-gen.sh` to regenerate the pcap and keylog file, then run the sniffer on it
|
||||
# with the same arguments as in the test belowl, but redirect output to `./scripts/sniffer-tls12-keylog.out`.
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_keylog == yes
|
||||
then
|
||||
TMPFILE=$(mktemp)
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: unable to create tmpfile\n" && rm $TMPFILE && exit 1
|
||||
|
||||
./sslSniffer/sslSnifferTest/snifftest \
|
||||
-pcap scripts/sniffer-tls12-keylog.pcap \
|
||||
-keylogfile scripts/sniffer-tls12-keylog.sslkeylog \
|
||||
-server 127.0.0.1 -port 11111 > $TMPFILE
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: snifftest returned $RESULT\n" && rm $TMPFILE && exit 1
|
||||
|
||||
# sed '1d' strips out first line, which contains wolfSSL version
|
||||
sed '1d' $TMPFILE | diff - <(sed '1d' scripts/sniffer-tls12-keylog.out)
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: snifftest diff returned $RESULT\n" && rm $TMPFILE && exit 1
|
||||
|
||||
rm $TMPFILE
|
||||
fi
|
||||
|
||||
# TLS v1.3 sniffer test ECC
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-ecc.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-ecc.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
|
||||
@@ -95,7 +127,7 @@ fi
|
||||
# TLS v1.3 sniffer test DH
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-dh.pcap ./certs/statickeys/dh-ffdhe2048.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-dh.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
|
||||
@@ -104,7 +136,7 @@ fi
|
||||
# TLS v1.3 sniffer test X25519
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-x25519.pcap ./certs/statickeys/x25519.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-x25519.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
|
||||
@@ -113,7 +145,7 @@ fi
|
||||
# TLS v1.3 sniffer test ECC resumption
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes && test $session_ticket == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-ecc-resume.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-ecc-resume.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
|
||||
@@ -122,7 +154,7 @@ fi
|
||||
# TLS v1.3 sniffer test DH
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes && test $session_ticket == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-dh-resume.pcap ./certs/statickeys/dh-ffdhe2048.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-dh-resume.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
|
||||
@@ -131,7 +163,7 @@ fi
|
||||
# TLS v1.3 sniffer test X25519
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes && test $session_ticket == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-x25519-resume.pcap ./certs/statickeys/x25519.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-x25519-resume.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
|
||||
@@ -140,12 +172,11 @@ fi
|
||||
# TLS v1.3 sniffer test hello_retry_request (HRR) with ECDHE
|
||||
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
|
||||
then
|
||||
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-hrr.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
|
||||
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-hrr.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
||||
|
||||
RESULT=$?
|
||||
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 HRR failed\n" && exit 1
|
||||
fi
|
||||
|
||||
echo -e "\nSuccess!\n"
|
||||
|
||||
exit 0
|
||||
|
||||
7
scripts/sniffer-tls12-keylog.out
Normal file
7
scripts/sniffer-tls12-keylog.out
Normal file
@@ -0,0 +1,7 @@
|
||||
snifftest 5.6.3
|
||||
sniffer features: key_callback tls_v13 tls_v12 static_ephemeral sni extended_master rsa dh ecc rsa_static dh_static ssl_keylog_file
|
||||
|
||||
SSL App Data(26:14):hello wolfssl!
|
||||
SSL App Data(27:22):I hear you fa shizzle!
|
||||
SSL App Data(57:14):hello wolfssl!
|
||||
SSL App Data(58:22):I hear you fa shizzle!
|
||||
BIN
scripts/sniffer-tls12-keylog.pcap
Normal file
BIN
scripts/sniffer-tls12-keylog.pcap
Normal file
Binary file not shown.
12
scripts/sniffer-tls12-keylog.sslkeylog
Normal file
12
scripts/sniffer-tls12-keylog.sslkeylog
Normal file
@@ -0,0 +1,12 @@
|
||||
CLIENT_RANDOM 3827fef5d4172f3753d81661dbc228b41adcb2357e04e493f8d9d4d4a85777d3 5240740265eaa6a8622805728bf53fd88b546b1523e4b9c3d4b6573471bc081ce9f074520df99873c0c447d3a37ebdc6
|
||||
CLIENT_RANDOM 3827fef5d4172f3753d81661dbc228b41adcb2357e04e493f8d9d4d4a85777d3 5240740265eaa6a8622805728bf53fd88b546b1523e4b9c3d4b6573471bc081ce9f074520df99873c0c447d3a37ebdc6
|
||||
CLIENT_RANDOM 8d793a1160661700dc686746be0e77a01dcf94472971bfbb517c6d7d179b7bcd ac612c7b9292ad6bc5304176b9dcde81ee488b6adb63bb6917cbf38a0775e9e334766839e091506972450e77ba6ce977
|
||||
CLIENT_RANDOM 8d793a1160661700dc686746be0e77a01dcf94472971bfbb517c6d7d179b7bcd ac612c7b9292ad6bc5304176b9dcde81ee488b6adb63bb6917cbf38a0775e9e334766839e091506972450e77ba6ce977
|
||||
CLIENT_RANDOM 4a1d3695145e5136a2914756962f848f033b62d3a9b714f7e659ae3f133d2527 118442e0edd05696d1566eb73693a9a1316d24ac62e024f92e685c540eaec31a463e19091d45b63cfc8539d3bd11915b
|
||||
CLIENT_RANDOM 4a1d3695145e5136a2914756962f848f033b62d3a9b714f7e659ae3f133d2527 118442e0edd05696d1566eb73693a9a1316d24ac62e024f92e685c540eaec31a463e19091d45b63cfc8539d3bd11915b
|
||||
CLIENT_RANDOM 307abe19ea84d9b45621df5b89fee8d2f9ac66eb4303cf9303cf6e957ad1d75d dfb9bb0d29579a0b2f35be65982954f33268c30ea8709985a45c95633c1c6e94cbfdebe625bda975572921b4462d5153
|
||||
CLIENT_RANDOM 307abe19ea84d9b45621df5b89fee8d2f9ac66eb4303cf9303cf6e957ad1d75d dfb9bb0d29579a0b2f35be65982954f33268c30ea8709985a45c95633c1c6e94cbfdebe625bda975572921b4462d5153
|
||||
CLIENT_RANDOM 41ad4bceb3b900ffbc77f9b0c67d69a62f2b1d490f91b2af496cf6e78371900d 9752ea66a193ac04e4a20aca3c7160faa2637efb927d00c2a2d90b77e2e7875a760ee76f9ce509e549f8303625a2fd59
|
||||
CLIENT_RANDOM 41ad4bceb3b900ffbc77f9b0c67d69a62f2b1d490f91b2af496cf6e78371900d 9752ea66a193ac04e4a20aca3c7160faa2637efb927d00c2a2d90b77e2e7875a760ee76f9ce509e549f8303625a2fd59
|
||||
CLIENT_RANDOM 596ffcdec477ac0b24e0958ecd7c1fc7cc5b37337bac90803b864e3edbad8780 2f86705d0c4fb7e92c7cb1ef2f104955724d5a0b5abd18478d39c1dd96222b4462e4382982bec26e9a231ec970c2d509
|
||||
CLIENT_RANDOM 596ffcdec477ac0b24e0958ecd7c1fc7cc5b37337bac90803b864e3edbad8780 2f86705d0c4fb7e92c7cb1ef2f104955724d5a0b5abd18478d39c1dd96222b4462e4382982bec26e9a231ec970c2d509
|
||||
Reference in New Issue
Block a user