OpenSSL 1.1.1-pre2
This commit is contained in:
Hakase
+120
-12
@@ -1,4 +1,4 @@
|
||||
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -17,6 +17,7 @@ use constant {
|
||||
MT_CLIENT_HELLO => 1,
|
||||
MT_SERVER_HELLO => 2,
|
||||
MT_NEW_SESSION_TICKET => 4,
|
||||
MT_ENCRYPTED_EXTENSIONS => 8,
|
||||
MT_CERTIFICATE => 11,
|
||||
MT_SERVER_KEY_EXCHANGE => 12,
|
||||
MT_CERTIFICATE_REQUEST => 13,
|
||||
@@ -46,6 +47,7 @@ my %message_type = (
|
||||
MT_CLIENT_HELLO, "ClientHello",
|
||||
MT_SERVER_HELLO, "ServerHello",
|
||||
MT_NEW_SESSION_TICKET, "NewSessionTicket",
|
||||
MT_ENCRYPTED_EXTENSIONS, "EncryptedExtensions",
|
||||
MT_CERTIFICATE, "Certificate",
|
||||
MT_SERVER_KEY_EXCHANGE, "ServerKeyExchange",
|
||||
MT_CERTIFICATE_REQUEST, "CertificateRequest",
|
||||
@@ -58,13 +60,70 @@ my %message_type = (
|
||||
);
|
||||
|
||||
use constant {
|
||||
EXT_SERVER_NAME => 0,
|
||||
EXT_MAX_FRAGMENT_LENGTH => 1,
|
||||
EXT_STATUS_REQUEST => 5,
|
||||
EXT_SUPPORTED_GROUPS => 10,
|
||||
EXT_EC_POINT_FORMATS => 11,
|
||||
EXT_SRP => 12,
|
||||
EXT_SIG_ALGS => 13,
|
||||
EXT_USE_SRTP => 14,
|
||||
EXT_ALPN => 16,
|
||||
EXT_SCT => 18,
|
||||
EXT_PADDING => 21,
|
||||
EXT_ENCRYPT_THEN_MAC => 22,
|
||||
EXT_EXTENDED_MASTER_SECRET => 23,
|
||||
EXT_SESSION_TICKET => 35,
|
||||
# This extension does not exist and isn't recognised by OpenSSL.
|
||||
# We use it to test handling of duplicate extensions.
|
||||
EXT_DUPLICATE_EXTENSION => 1234
|
||||
EXT_KEY_SHARE => 51,
|
||||
EXT_PSK => 41,
|
||||
EXT_SUPPORTED_VERSIONS => 43,
|
||||
EXT_COOKIE => 44,
|
||||
EXT_PSK_KEX_MODES => 45,
|
||||
EXT_POST_HANDSHAKE_AUTH => 49,
|
||||
EXT_SIG_ALGS_CERT => 50,
|
||||
EXT_RENEGOTIATE => 65281,
|
||||
EXT_NPN => 13172,
|
||||
# This extension is an unofficial extension only ever written by OpenSSL
|
||||
# (i.e. not read), and even then only when enabled. We use it to test
|
||||
# handling of duplicate extensions.
|
||||
EXT_DUPLICATE_EXTENSION => 0xfde8,
|
||||
EXT_UNKNOWN => 0xfffe,
|
||||
#Unknown extension that should appear last
|
||||
EXT_FORCE_LAST => 0xffff
|
||||
};
|
||||
|
||||
# SignatureScheme of TLS 1.3, from
|
||||
# https://tools.ietf.org/html/draft-ietf-tls-tls13-20#appendix-B.3.1.3
|
||||
# TODO(TLS1.3) update link to IANA registry after publication
|
||||
# We have to manually grab the SHA224 equivalents from the old registry
|
||||
use constant {
|
||||
SIG_ALG_RSA_PKCS1_SHA256 => 0x0401,
|
||||
SIG_ALG_RSA_PKCS1_SHA384 => 0x0501,
|
||||
SIG_ALG_RSA_PKCS1_SHA512 => 0x0601,
|
||||
SIG_ALG_ECDSA_SECP256R1_SHA256 => 0x0403,
|
||||
SIG_ALG_ECDSA_SECP384R1_SHA384 => 0x0503,
|
||||
SIG_ALG_ECDSA_SECP521R1_SHA512 => 0x0603,
|
||||
SIG_ALG_RSA_PSS_SHA256 => 0x0804,
|
||||
SIG_ALG_RSA_PSS_SHA384 => 0x0805,
|
||||
SIG_ALG_RSA_PSS_SHA512 => 0x0806,
|
||||
SIG_ALG_ED25519 => 0x0807,
|
||||
SIG_ALG_ED448 => 0x0808,
|
||||
SIG_ALG_RSA_PKCS1_SHA1 => 0x0201,
|
||||
SIG_ALG_ECDSA_SHA1 => 0x0203,
|
||||
SIG_ALG_DSA_SHA1 => 0x0202,
|
||||
SIG_ALG_DSA_SHA256 => 0x0402,
|
||||
SIG_ALG_DSA_SHA384 => 0x0502,
|
||||
SIG_ALG_DSA_SHA512 => 0x0602,
|
||||
OSSL_SIG_ALG_RSA_PKCS1_SHA224 => 0x0301,
|
||||
OSSL_SIG_ALG_DSA_SHA224 => 0x0302,
|
||||
OSSL_SIG_ALG_ECDSA_SHA224 => 0x0303
|
||||
};
|
||||
|
||||
use constant {
|
||||
CIPHER_DHE_RSA_AES_128_SHA => 0x0033,
|
||||
CIPHER_ADH_AES_128_SHA => 0x0034,
|
||||
CIPHER_TLS13_AES_128_GCM_SHA256 => 0x1301,
|
||||
CIPHER_TLS13_AES_256_GCM_SHA384 => 0x1302
|
||||
};
|
||||
|
||||
my $payload = "";
|
||||
@@ -77,6 +136,7 @@ my $end = 0;
|
||||
my @message_rec_list = ();
|
||||
my @message_frag_lens = ();
|
||||
my $ciphersuite = 0;
|
||||
my $successondata = 0;
|
||||
|
||||
sub clear
|
||||
{
|
||||
@@ -86,6 +146,7 @@ sub clear
|
||||
$server = 0;
|
||||
$success = 0;
|
||||
$end = 0;
|
||||
$successondata = 0;
|
||||
@message_rec_list = ();
|
||||
@message_frag_lens = ();
|
||||
}
|
||||
@@ -111,10 +172,12 @@ sub get_messages
|
||||
#We can't handle this yet
|
||||
die "CCS received before message data complete\n";
|
||||
}
|
||||
if ($server) {
|
||||
TLSProxy::Record->server_ccs_seen(1);
|
||||
} else {
|
||||
TLSProxy::Record->client_ccs_seen(1);
|
||||
if (!TLSProxy::Proxy->is_tls13()) {
|
||||
if ($server) {
|
||||
TLSProxy::Record->server_encrypting(1);
|
||||
} else {
|
||||
TLSProxy::Record->client_encrypting(1);
|
||||
}
|
||||
}
|
||||
} elsif ($record->content_type == TLSProxy::Record::RT_HANDSHAKE) {
|
||||
if ($record->len == 0 || $record->len_real == 0) {
|
||||
@@ -197,6 +260,11 @@ sub get_messages
|
||||
} elsif ($record->content_type == TLSProxy::Record::RT_APPLICATION_DATA) {
|
||||
print " [ENCRYPTED APPLICATION DATA]\n";
|
||||
print " [".$record->decrypt_data."]\n";
|
||||
|
||||
if ($successondata) {
|
||||
$success = 1;
|
||||
$end = 1;
|
||||
}
|
||||
} elsif ($record->content_type == TLSProxy::Record::RT_ALERT) {
|
||||
my ($alertlev, $alertdesc) = unpack('CC', $record->decrypt_data);
|
||||
#A CloseNotify from the client indicates we have finished successfully
|
||||
@@ -239,6 +307,33 @@ sub create_message
|
||||
[@message_frag_lens]
|
||||
);
|
||||
$message->parse();
|
||||
} elsif ($mt == MT_ENCRYPTED_EXTENSIONS) {
|
||||
$message = TLSProxy::EncryptedExtensions->new(
|
||||
$server,
|
||||
$data,
|
||||
[@message_rec_list],
|
||||
$startoffset,
|
||||
[@message_frag_lens]
|
||||
);
|
||||
$message->parse();
|
||||
} elsif ($mt == MT_CERTIFICATE) {
|
||||
$message = TLSProxy::Certificate->new(
|
||||
$server,
|
||||
$data,
|
||||
[@message_rec_list],
|
||||
$startoffset,
|
||||
[@message_frag_lens]
|
||||
);
|
||||
$message->parse();
|
||||
} elsif ($mt == MT_CERTIFICATE_VERIFY) {
|
||||
$message = TLSProxy::CertificateVerify->new(
|
||||
$server,
|
||||
$data,
|
||||
[@message_rec_list],
|
||||
$startoffset,
|
||||
[@message_frag_lens]
|
||||
);
|
||||
$message->parse();
|
||||
} elsif ($mt == MT_SERVER_KEY_EXCHANGE) {
|
||||
$message = TLSProxy::ServerKeyExchange->new(
|
||||
$server,
|
||||
@@ -319,7 +414,7 @@ sub ciphersuite
|
||||
}
|
||||
|
||||
#Update all the underlying records with the modified data from this message
|
||||
#Note: Does not currently support re-encrypting
|
||||
#Note: Only supports re-encrypting for TLSv1.3
|
||||
sub repack
|
||||
{
|
||||
my $self = shift;
|
||||
@@ -362,8 +457,14 @@ sub repack
|
||||
# use an explicit override field instead.)
|
||||
$rec->decrypt_len(length($rec->decrypt_data));
|
||||
$rec->len($rec->len + length($msgdata) - $old_length);
|
||||
# Don't support re-encryption.
|
||||
$rec->data($rec->decrypt_data);
|
||||
# Only support re-encryption for TLSv1.3.
|
||||
if (TLSProxy::Proxy->is_tls13() && $rec->encrypted()) {
|
||||
#Add content type (1 byte) and 16 tag bytes
|
||||
$rec->data($rec->decrypt_data
|
||||
.pack("C", TLSProxy::Record::RT_HANDSHAKE).("\0"x16));
|
||||
} else {
|
||||
$rec->data($rec->decrypt_data);
|
||||
}
|
||||
|
||||
#Update the fragment len in case we changed it above
|
||||
${$self->message_frag_lens}[0] = length($msgdata)
|
||||
@@ -452,5 +553,12 @@ sub encoded_length
|
||||
my $self = shift;
|
||||
return TLS_MESSAGE_HEADER_LENGTH + length($self->data);
|
||||
}
|
||||
|
||||
sub successondata
|
||||
{
|
||||
my $class = shift;
|
||||
if (@_) {
|
||||
$successondata = shift;
|
||||
}
|
||||
return $successondata;
|
||||
}
|
||||
1;
|
||||
Reference in New Issue
Block a user