When we force ssl to negotiate the cipher-suite GCM mode such as AES128-GCM-SHA256
“openssl s_client -connect 10.10.30.20:443 -cipher AES128-GCM-SHA256”
and capture the packet at serverside, then use the ssldump to decode it.
then ssldump will crash.
Looking at code, it looks like the ssl_decode_rec_data() algoritm is wrong when decoding the FINISHED messgae with GCM mode.
Below is the output of relevant data in the ssl_decode_rec_data():
ssl_decode_rec_data(): inl = 40, pad = 106, d->cs->dig_len = 32, d->cs->block = 4