aboutsummaryrefslogtreecommitdiffstats
path: root/test/captures
diff options
context:
space:
mode:
authorPeter Wu <peter@lekensteyn.nl>2019-04-15 01:30:09 +0100
committerPeter Wu <peter@lekensteyn.nl>2019-04-24 21:02:35 +0000
commitb641febb1ea9ddc18550a4dd4d55a027b7ea9669 (patch)
tree5e642d247ddd772390fbc2f2fbd3cac72f752176 /test/captures
parent1799b24aa397e98f7c894d17b37c087f1ae29d95 (diff)
TLS: Implement reassembly for Handshake messages
Lack of handshake reassembly caused Certificate handshake messages to be reported as "Encrypted Handshake Messages" and broke decryption in some cases. Fix this by properly tracking handshake fragments and delay dissection until all fragments are available. Now when a fragmented Handshake message is found: * The first fragment will have "(fragmented)" appended to the record tree item as well as the "Handshake Protocol" item. * "Reassembled Handshake Message in frame: X" is added for fragments. * The last reassembled handshake message will be displayed together with a fragment list. Note: Previously, handshake records with a message length larger than the available data was assumed to be encrypted. This restriction had to be lifted, but can now cause false positives (reporting encrypted data as unencrypted handshake fragments). The provided capture is not minimal but should be comprehensive as it is generated with randomly sized TLS record and TCP segment lengths using `./tls-handshake-fragments.py hs-frag.pcap --seed=1337 --count=100` and https://git.lekensteyn.nl/peter/wireshark-notes/tree/crafted-pkt/tls-handshake-fragments.py (A copy of this script is attached to bug 3303.) Bug: 3303 Bug: 15537 Bug: 15625 Change-Id: I779925aba30548a76c20e0e37b39d01d2c88a764 Reviewed-on: https://code.wireshark.org/review/32857 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'test/captures')
-rw-r--r--test/captures/tls-fragmented-handshakes.pcap.gzbin0 -> 16911 bytes
1 files changed, 0 insertions, 0 deletions
diff --git a/test/captures/tls-fragmented-handshakes.pcap.gz b/test/captures/tls-fragmented-handshakes.pcap.gz
new file mode 100644
index 0000000000..9f97664ddf
--- /dev/null
+++ b/test/captures/tls-fragmented-handshakes.pcap.gz
Binary files differ