Menu

#70 ssldump will crash when decrypt ssl packet negotiated with AES128_GCM_SHA256

v1.0 (example)
open
nobody
None
5
2016-09-02
2016-09-02
No

When we force ssl to negotiate the cipher-suite GCM mode such as AES128-GCM-SHA256
“openssl s_client -connect 10.10.30.20:443 -cipher AES128-GCM-SHA256”

and capture the packet at serverside, then use the ssldump to decode it.

then ssldump will crash.

Looking at code, it looks like the ssl_decode_rec_data() algoritm is wrong when decoding the FINISHED messgae with GCM mode.

Below is the output of relevant data in the ssl_decode_rec_data():


ssl_decode_rec_data(): inl = 40, pad = 106, d->cs->dig_len = 32, d->cs->block = 4

Discussion


Log in to post a comment.

MongoDB Logo MongoDB