diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2017-06-02 22:05:10 +0200 |
|---|---|---|
| committer | Peter Wu <peter@lekensteyn.nl> | 2017-06-02 22:04:21 +0000 |
| commit | 57b0527821b69dc8aa0786a3b5a425192795aff2 (patch) | |
| tree | 4f01e3f4ac81d19d8ca3afa9a85a96f99c7c73bd /test | |
| parent | a86f6603fc8b66a46ce21d18990f2058110acf27 (diff) | |
Add ChaCha20-Poly1305 decryption support for TLS 1.2 and 1.3
Implements all seven AEAD_CHACHA20_POLY1305 cipher suites from RFC 7905
(for TLS 1.2) and the final missing one for TLS 1.3 (draft -20).
New test captures (created using OpenSSL_1_1_0-pre6-2528-g042597b0a)
also serve as tests for TLS 1.3 decryption support.
Change-Id: Ice6d639c9c7b7bc23a6ff5fb4832d02694abd8c4
Ping-Bug: 12779
Reviewed-on: https://code.wireshark.org/review/21902
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'test')
| -rw-r--r-- | test/captures/tls12-chacha20poly1305.pcap | bin | 0 -> 43693 bytes | |||
| -rw-r--r-- | test/captures/tls13-20-chacha20poly1305.pcap | bin | 0 -> 10336 bytes | |||
| -rwxr-xr-x | test/config.sh | 18 | ||||
| -rw-r--r-- | test/keys/tls12-chacha20poly1305.keys | 9 | ||||
| -rw-r--r-- | test/keys/tls13-20-chacha20poly1305.keys | 9 | ||||
| -rwxr-xr-x | test/suite-decryption.sh | 61 |
6 files changed, 94 insertions, 3 deletions
diff --git a/test/captures/tls12-chacha20poly1305.pcap b/test/captures/tls12-chacha20poly1305.pcap Binary files differnew file mode 100644 index 0000000000..1eaa85427f --- /dev/null +++ b/test/captures/tls12-chacha20poly1305.pcap diff --git a/test/captures/tls13-20-chacha20poly1305.pcap b/test/captures/tls13-20-chacha20poly1305.pcap Binary files differnew file mode 100644 index 0000000000..da2246d69d --- /dev/null +++ b/test/captures/tls13-20-chacha20poly1305.pcap diff --git a/test/config.sh b/test/config.sh index 7a59ecdeec..6b9d8f339d 100755 --- a/test/config.sh +++ b/test/config.sh @@ -106,20 +106,32 @@ export WIRESHARK_QUIT_AFTER_CAPTURE="True" CAPTURE_DIR="$TESTS_DIR/captures/" +TSHARK_VERSION=$($TSHARK -v | tr '\n' ' ') + # Figure out if we were built with lua or not so we can skip the lua tests if we # don't have it. -$TSHARK -v | grep -q "with Lua" +echo "$TSHARK_VERSION" | grep -q "with Lua" HAVE_LUA=$? # Check whether we need to skip the HTTP2/HPACK decryption test. -$TSHARK -v | tr '\n' ' '| grep -q "with nghttp2" +echo "$TSHARK_VERSION" | grep -q "with nghttp2" HAVE_NGHTTP2=$? # Check whether we need to skip a certain decryption test. # XXX What do we print for Nettle? -$TSHARK -v | tr '\n' ' '| egrep -q "with MIT Kerberos|with Heimdal Kerberos" +echo "$TSHARK_VERSION" | egrep -q "with MIT Kerberos|with Heimdal Kerberos" HAVE_KERBEROS=$? +# first version is "compiled with", second is "running on" version. +GCRY_VERSION=$(echo "$TSHARK_VERSION" | grep -oE 'Gcrypt [1-9]+(\.[1-9]+)?' | sed -n '1s/Gcrypt //p') +if [ -n "$GCRY_VERSION" ] && ! echo "$GCRY_VERSION" | grep -q '1\.[456]'; then + # Current minimum Gcrypt version is 1.4.2, + # assume 1.7 or newer if not 1,4, 1.5 or 1.6. + HAVE_LIBGCRYPT17=true +else + HAVE_LIBGCRYPT17=false +fi + HAVE_ICONV="False" hash iconv 2>/dev/null && HAVE_ICONV="True" diff --git a/test/keys/tls12-chacha20poly1305.keys b/test/keys/tls12-chacha20poly1305.keys new file mode 100644 index 0000000000..cbdbcad7de --- /dev/null +++ b/test/keys/tls12-chacha20poly1305.keys @@ -0,0 +1,9 @@ +# SSL/TLS secrets log file, generated by OpenSSL +CLIENT_RANDOM ab85fc5f6db67c9cf825cd8a1f34cf6c5e89ec09656a4944ec5536a36aed5728 aee53fb112659bc2b3801db7d230c25100dfb79ffb00f086256885dfc1f8fc545e526fc92fe884348a84964bb7b4bbc0 +CLIENT_RANDOM 59ee68728af906f3fb825bf306f7f40ae1fb68fc13d769a00843d3f2ba5dac45 7b126413d8876316b67a35fc3d530bca6574070a5a4b829868b3f94c36b0b1f673ab0a18f213ee7a5fb47ba50676acb3 +CLIENT_RANDOM 1c73db9d11c0c4fb8acf3f62ec0a50a1559eeaded9a9a54e829f9f291d592069 f38dbcf8c3eb3c30514fbcfe2208efab88b3593468b8695e8c1f55662ffe5ab4151ed4ead5fb207c8707ea073e8aaaba +RSA 3e2ffbd86d10f694 0303f4d5b30f42e5df09d7d3fe363b4ff104b469bcade9e4506bf6cc621441d577cc5fbe448979fdd9be53556881058a +CLIENT_RANDOM 121cdd2ae0f9f089b48897272e37c89cf41f4eb8262ac1272cc02a73fd23fa0b 2a169a4a71b6b988d525546ca3f56d185f16490eecc19659963f796bf8c6b4cf10f8739aeb0f2162451c1e46718c137d +CLIENT_RANDOM db9350951d7ace9c91422b44b526a549fa3ca97b9e0d5c421c08ee3223b3d74a bd0c489a9d428510d937ae09038a0cc84bc3ed72dfe136712d94fcc001d46f54b33992dd3f2f897625cad07f7f9caeb2 +CLIENT_RANDOM 55a097b1bf4bf3c0f7161a81f15be86a78f2ca05f9784b07e0af761c1f9f1d65 bdf97a381c55c50421757a63227717b6a5c840ef8fc61975e0c495cff55f4dde41080b63c896f94639351697810bfcd9 +CLIENT_RANDOM f6fb54f9367adab3128073734d14e7230e6fe3c5c494caa15e130b5a955dbcb6 8409faa69c4c6ebf56cbad7b9ace4f41815de444410c2c595f409b54a80014e0acf944b8ee6f62eb0ef873714514a19f diff --git a/test/keys/tls13-20-chacha20poly1305.keys b/test/keys/tls13-20-chacha20poly1305.keys new file mode 100644 index 0000000000..e858b9a56b --- /dev/null +++ b/test/keys/tls13-20-chacha20poly1305.keys @@ -0,0 +1,9 @@ +# SSL/TLS secrets log file, generated by OpenSSL +SERVER_HANDSHAKE_TRAFFIC_SECRET 3d89529eeebe176375ef29bd146a49e02c375771628244948f6e9408457fdbc1 4e1fbe0594634161e1af3f8b6e940561ba3fc2174b6cefb5b0da3e040cfb23e4 +SERVER_TRAFFIC_SECRET_0 3d89529eeebe176375ef29bd146a49e02c375771628244948f6e9408457fdbc1 1e519f7e8d3e8d45d7cf13038f50a50e1a2f6f0a9f918b9ae856f3269068ef8f +CLIENT_HANDSHAKE_TRAFFIC_SECRET 3d89529eeebe176375ef29bd146a49e02c375771628244948f6e9408457fdbc1 69c6f71caf5031fc55671bf88c70a77acac0d81de20d3cf5e6b4dd7fac4ffe4d +CLIENT_TRAFFIC_SECRET_0 3d89529eeebe176375ef29bd146a49e02c375771628244948f6e9408457fdbc1 292497c163345eaa5b16b0b7907faa31dbb7ce76ac9a1c35ca99ba9dafeae72c +SERVER_HANDSHAKE_TRAFFIC_SECRET 4cfd639e633b0ccdedab543dd333639d2bacd023b2f12a94724eb1c20f5b8e11 976e0b13800a6c2335ed9bb124f38fb2f654c6585dfc14db72eb09cd30148a1c +SERVER_TRAFFIC_SECRET_0 4cfd639e633b0ccdedab543dd333639d2bacd023b2f12a94724eb1c20f5b8e11 f7e0e34d554b2431353dadb226d9fbf248dd15e76944234bfb13b1102af43aaf +CLIENT_HANDSHAKE_TRAFFIC_SECRET 4cfd639e633b0ccdedab543dd333639d2bacd023b2f12a94724eb1c20f5b8e11 d46820a69b572a15d2ef8778d32f1e00300725ab42bc9f3e8f6ede598a1ab532 +CLIENT_TRAFFIC_SECRET_0 4cfd639e633b0ccdedab543dd333639d2bacd023b2f12a94724eb1c20f5b8e11 69bf451e01db2af6924af9b78759a9f3e84affab23300238dbf94c54709cdda1 diff --git a/test/suite-decryption.sh b/test/suite-decryption.sh index 7545b47ed0..a5774708a8 100755 --- a/test/suite-decryption.sh +++ b/test/suite-decryption.sh @@ -302,6 +302,65 @@ decryption_step_tls_psk_aes256gcm() { test_step_ok } +# TLS 1.2 with ChaCha20-Poly1305 +decryption_step_tls12_chacha20poly1305() { + if ! $HAVE_LIBGCRYPT17; then + test_step_skipped + return + fi + TEST_KEYS_FILE="$TESTS_DIR/keys/tls12-chacha20poly1305.keys" + if [ "$WS_SYSTEM" == "Windows" ] ; then + TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`" + fi + ciphers=' + ECDHE-ECDSA-CHACHA20-POLY1305 + ECDHE-RSA-CHACHA20-POLY1305 + DHE-RSA-CHACHA20-POLY1305 + RSA-PSK-CHACHA20-POLY1305 + DHE-PSK-CHACHA20-POLY1305 + ECDHE-PSK-CHACHA20-POLY1305 + PSK-CHACHA20-POLY1305 + ' + local stream=0 + for cipher in $ciphers; do + $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \ + -r "$CAPTURE_DIR/tls12-chacha20poly1305.pcap" \ + -o "ssl.keylog_file: $TEST_KEYS_FILE" \ + -z follow,ssl,ascii,$stream \ + | grep -q "$cipher" + RETURNVALUE=$? + if [ ! $RETURNVALUE -eq $EXIT_OK ]; then + test_step_failed "Failed to decrypt TLS 1.2 ($cipher)" + return + fi + ((stream++)) + done + test_step_ok +} + +# TLS 1.3 with ChaCha20-Poly1305 +decryption_step_tls13_chacha20poly1305() { + if ! $HAVE_LIBGCRYPT17; then + test_step_skipped + return + fi + TEST_KEYS_FILE="$TESTS_DIR/keys/tls13-20-chacha20poly1305.keys" + if [ "$WS_SYSTEM" == "Windows" ] ; then + TEST_KEYS_FILE="`cygpath -w $TEST_KEYS_FILE`" + fi + $TESTS_DIR/run_and_catch_crashes env $TS_DC_ENV $TSHARK $TS_DC_ARGS -q \ + -r "$CAPTURE_DIR/tls13-20-chacha20poly1305.pcap" \ + -o "ssl.keylog_file: $TEST_KEYS_FILE" \ + -z follow,ssl,ascii,0 \ + | grep -q TLS13-CHACHA20-POLY1305-SHA256 + RETURNVALUE=$? + if [ ! $RETURNVALUE -eq $EXIT_OK ]; then + test_step_failed "Failed to decrypt TLS 1.3 (ChaCha20-Poly1305)" + return + fi + test_step_ok +} + # ZigBee # https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7022 decryption_step_zigbee() { @@ -582,6 +641,8 @@ tshark_decryption_suite() { test_step_add "SSL Decryption (renegotiation)" decryption_step_ssl_renegotiation test_step_add "TLS 1.2 Decryption (PSK AES-128-CCM)" decryption_step_tls_psk_aes128ccm test_step_add "TLS 1.2 Decryption (PSK AES-256-GCM)" decryption_step_tls_psk_aes256gcm + test_step_add "TLS 1.2 Decryption (ChaCha20-Poly1305)" decryption_step_tls12_chacha20poly1305 + test_step_add "TLS 1.3 Decryption (ChaCha20-Poly1305)" decryption_step_tls13_chacha20poly1305 test_step_add "ZigBee Decryption" decryption_step_zigbee test_step_add "ANSI C12.22 Decryption" decryption_step_c1222 test_step_add "DVB-CI Decryption" decryption_step_dvb_ci |