mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
349 lines
14 KiB
Bash
Executable File
349 lines
14 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
#sniffer-testsuite.test
|
|
|
|
# if we can, isolate the network namespace to eliminate port collisions.
|
|
if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
|
|
if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
|
|
export NETWORK_UNSHARE_HELPER_CALLED=yes
|
|
exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
|
|
fi
|
|
elif [ "${AM_BWRAPPED-}" != "yes" ]; then
|
|
bwrap_path="$(command -v bwrap)"
|
|
if [ -n "$bwrap_path" ]; then
|
|
export AM_BWRAPPED=yes
|
|
exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
|
|
fi
|
|
unset AM_BWRAPPED
|
|
fi
|
|
|
|
has_tlsv13=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'tls_v13 '
|
|
if [ $? -eq 0 ]; then
|
|
has_tlsv13=yes
|
|
fi
|
|
has_tlsv12=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'tls_v12 '
|
|
if [ $? -eq 0 ]; then
|
|
has_tlsv12=yes
|
|
fi
|
|
has_rsa=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'rsa '
|
|
if [ $? -eq 0 ]; then
|
|
has_rsa=yes
|
|
fi
|
|
has_ecc=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'ecc '
|
|
if [ $? -eq 0 ]; then
|
|
has_ecc=yes
|
|
fi
|
|
has_x25519=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'x22519 '
|
|
if [ $? -eq 0 ]; then
|
|
has_x25519=yes
|
|
fi
|
|
has_dh=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'dh '
|
|
if [ $? -eq 0 ]; then
|
|
has_dh=yes
|
|
fi
|
|
# ./configure --enable-sniffer [--enable-session-ticket]
|
|
# Resumption tests require "--enable-session-ticket"
|
|
session_ticket=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'session_ticket '
|
|
if [ $? -eq 0 ]; then
|
|
session_ticket=yes
|
|
fi
|
|
has_static_rsa=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'rsa_static '
|
|
if [ $? -eq 0 ]; then
|
|
has_static_rsa=yes
|
|
fi
|
|
# sniffer-tls12-etm.pcap negotiated Encrypt-Then-MAC, so a sniffer built
|
|
# without it cannot decrypt that capture. Every other capture is readable by
|
|
# any build.
|
|
has_etm=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'encrypt_then_mac '
|
|
if [ $? -eq 0 ]; then
|
|
has_etm=yes
|
|
else
|
|
echo -e "\nWARNING: sniffer built without Encrypt-Then-MAC, skipping sniffer-tls12-etm.pcap\n"
|
|
fi
|
|
# A build that cannot read the capture has to say why, rather than failing
|
|
# every record with a generic decrypt error.
|
|
if test $has_etm == no && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
|
|
then
|
|
echo -e "\nChecking the Encrypt-Then-MAC diagnostic on sniffer-tls12-etm.pcap...\n"
|
|
|
|
TMPFILE=$(mktemp)
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest Encrypt-Then-MAC diagnostic failed: unable to create tmpfile\n" && exit 1
|
|
|
|
./sslSniffer/sslSnifferTest/snifftest \
|
|
-pcap ./scripts/sniffer-tls12-etm.pcap -key ./certs/server-key.pem \
|
|
-server 127.0.0.1 -port 11111 > $TMPFILE 2>&1
|
|
|
|
RESULT=$?
|
|
[ $RESULT -eq 0 ] && echo -e "\nsnifftest read an Encrypt-Then-MAC capture it cannot support\n" && rm $TMPFILE && exit 1
|
|
|
|
grep -q "Encrypt-Then-MAC not supported in this build" $TMPFILE
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest did not report the missing Encrypt-Then-MAC support\n" && rm $TMPFILE && exit 1
|
|
|
|
rm $TMPFILE
|
|
RESULT=0
|
|
fi
|
|
# ./configure --enable-sniffer CFLAGS="-DWOLFSSL_SNIFFER_KEYLOGFILE"
|
|
has_keylog=no
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'ssl_keylog_file'
|
|
if [ $? -eq 0 ]; then
|
|
has_keylog=yes
|
|
fi
|
|
|
|
|
|
RESULT=0
|
|
|
|
# TLS v1.2 Static RSA Test
|
|
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-static-rsa.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-static-rsa.pcap -key ./certs/server-key.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest static RSA failed\n" && exit 1
|
|
fi
|
|
|
|
# A Certificate message can span many records in one TCP packet. Keep the
|
|
# later TCP sequence numbers consistent with the original capture.
|
|
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && \
|
|
test $has_static_rsa == yes && command -v python3 >/dev/null 2>&1 && \
|
|
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -q 'max fragment'
|
|
then
|
|
echo -e "\nStarting snifftest on a fragmented Certificate...\n"
|
|
SPLIT_PCAP=$(mktemp "${TMPDIR:-/tmp}/wolfssl-sniffer.XXXXXX") || exit 1
|
|
python3 - ./scripts/sniffer-static-rsa.pcap "$SPLIT_PCAP" <<'PY'
|
|
import struct
|
|
import sys
|
|
|
|
source = open(sys.argv[1], 'rb').read()
|
|
result = bytearray(source[:24])
|
|
offset = 24
|
|
packet_num = 0
|
|
while offset < len(source):
|
|
seconds, micros, caplen, origlen = struct.unpack_from('<IIII', source, offset)
|
|
packet = bytearray(source[offset + 16:offset + 16 + caplen])
|
|
ip = 4
|
|
tcp = ip + (packet[ip] & 15) * 4
|
|
payload = tcp + (packet[tcp + 12] >> 4) * 4
|
|
source_port = struct.unpack_from('!H', packet, tcp)[0]
|
|
if packet_num == 8:
|
|
assert packet[payload] == 22
|
|
length = struct.unpack_from('!H', packet, payload + 3)[0]
|
|
body = packet[payload + 5:payload + 5 + length]
|
|
header = packet[payload:payload + 3]
|
|
fragments = [body[:4]] + [body[j:j + 1]
|
|
for j in range(4, len(body))]
|
|
packet[payload:] = b''.join(header + struct.pack('!H', len(part)) + part
|
|
for part in fragments)
|
|
added = 5 * (len(fragments) - 1)
|
|
struct.pack_into('!H', packet, ip + 2, len(packet) - ip)
|
|
caplen = origlen = len(packet)
|
|
elif packet_num > 8:
|
|
field = tcp + (4 if source_port == 11111 else 8)
|
|
value = struct.unpack_from('!I', packet, field)[0]
|
|
struct.pack_into('!I', packet, field, (value + added) & 0xffffffff)
|
|
result.extend(struct.pack('<IIII', seconds, micros, caplen, origlen))
|
|
result.extend(packet)
|
|
offset += 16 + struct.unpack_from('<I', source, offset + 8)[0]
|
|
packet_num += 1
|
|
open(sys.argv[2], 'wb').write(result)
|
|
PY
|
|
RESULT=$?
|
|
if test $RESULT -eq 0; then
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap "$SPLIT_PCAP" \
|
|
-key ./certs/server-key.pem -server 127.0.0.1 -port 11111
|
|
RESULT=$?
|
|
fi
|
|
rm -f "$SPLIT_PCAP"
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest fragmented Certificate failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.2 CBC Encrypt-Then-MAC Test (RFC 7366). The decrypted lengths are
|
|
# compared against known good output, since Encrypt-Then-MAC changes how much
|
|
# of a record is payload and a wrong length still decrypts.
|
|
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes && test $has_etm == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls12-etm.pcap...\n"
|
|
|
|
TMPFILE=$(mktemp)
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest Encrypt-Then-MAC failed: unable to create tmpfile\n" && exit 1
|
|
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata \
|
|
-pcap ./scripts/sniffer-tls12-etm.pcap \
|
|
-key ./certs/server-key.pem \
|
|
-server 127.0.0.1 -port 11111 | tee $TMPFILE
|
|
|
|
RESULT=${PIPESTATUS[0]}
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest Encrypt-Then-MAC failed: snifftest returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
# use grep to only compare against decrypted output
|
|
SEARCH_STRING="SSL App Data"
|
|
grep "$SEARCH_STRING" $TMPFILE | sort \
|
|
| diff - <(grep "$SEARCH_STRING" scripts/sniffer-tls12-etm.out | sort)
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest Encrypt-Then-MAC failed: snifftest diff returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
rm $TMPFILE
|
|
fi
|
|
|
|
# TLS v1.2 Static RSA Test (IPv6)
|
|
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-ipv6.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-ipv6.pcap -key ./certs/server-key.pem -server ::1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest (ipv6) failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.2 ECDHE CBC Encrypt-Then-MAC Test (RFC 7366)
|
|
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_ecc == yes && test $has_etm == yes && test $has_keylog == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls12-etm-keylog.pcap...\n"
|
|
|
|
TMPFILE=$(mktemp)
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest ECDHE Encrypt-Then-MAC failed: unable to create tmpfile\n" && exit 1
|
|
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata \
|
|
-pcap ./scripts/sniffer-tls12-etm-keylog.pcap \
|
|
-keylogfile ./scripts/sniffer-tls12-etm-keylog.sslkeylog \
|
|
-server 127.0.0.1 -port 11111 | tee $TMPFILE
|
|
|
|
RESULT=${PIPESTATUS[0]}
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest ECDHE Encrypt-Then-MAC failed: snifftest returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
# use grep to only compare against decrypted output
|
|
SEARCH_STRING="SSL App Data"
|
|
grep "$SEARCH_STRING" $TMPFILE | sort \
|
|
| diff - <(grep "$SEARCH_STRING" scripts/sniffer-tls12-etm-keylog.out | sort)
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest ECDHE Encrypt-Then-MAC failed: snifftest diff returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
rm $TMPFILE
|
|
fi
|
|
|
|
# TLS v1.2 and v1.3 sniffer keylog file test: runs sniffer on pcap and associated keylog file and compares decrypted traffic with known good output.
|
|
# To regenerate the known good output, run `scripts/sniffer-gen.sh` to regenerate the pcap and keylog file, then run the sniffer on it
|
|
# with the same arguments as in the test below, but redirect output to `./scripts/sniffer-tls12-keylog.out`.
|
|
if test $RESULT -eq 0 && test $has_keylog == yes
|
|
then
|
|
for tlsver in tls12 tls13
|
|
do
|
|
# skip tls versions we don't have compiled-in support for
|
|
[[ $tlsver == "tls12" && $has_tlsv12 == "no" ]] && continue
|
|
[[ $tlsver == "tls13" && $has_tlsv13 == "no" ]] && continue
|
|
|
|
echo -e "\nStarting snifftest on sniffer-$tlsver-keylog.pcap...\n"
|
|
|
|
TMPFILE=$(mktemp)
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n$tlsver snifftest keylog test failed: unable to create tmpfile\n" && rm $TMPFILE && exit 1
|
|
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata \
|
|
-pcap scripts/sniffer-$tlsver-keylog.pcap \
|
|
-keylogfile scripts/sniffer-$tlsver-keylog.sslkeylog \
|
|
-server 127.0.0.1 -port 11111 | tee $TMPFILE
|
|
|
|
RESULT=${PIPESTATUS[0]}
|
|
[ $RESULT -ne 0 ] && echo -e "\n$tlsver snifftest keylog test failed: snifftest returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
# use grep to only compare against decrypted output
|
|
SEARCH_STRING="SSL App Data"
|
|
grep "$SEARCH_STRING" $TMPFILE | sort \
|
|
| diff - <(grep "$SEARCH_STRING" scripts/sniffer-$tlsver-keylog.out | sort)
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n$tlsver snifftest keylog test failed: snifftest diff returned $RESULT\n" && rm $TMPFILE && exit 1
|
|
|
|
rm $TMPFILE
|
|
done
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test ECC
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-ecc.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-ecc.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test DH
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-dh.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-dh.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test X25519
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-x25519.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-x25519.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test ECC resumption
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes && test $session_ticket == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-ecc-resume.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-ecc-resume.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test DH
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes && test $session_ticket == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-dh-resume.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-dh-resume.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test X25519
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes && test $session_ticket == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-x25519-resume.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-x25519-resume.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
|
|
fi
|
|
|
|
# TLS v1.3 sniffer test hello_retry_request (HRR) with ECDHE
|
|
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
|
|
then
|
|
echo -e "\nStarting snifftest on sniffer-tls13-hrr.pcap...\n"
|
|
./sslSniffer/sslSnifferTest/snifftest -expectdata -pcap ./scripts/sniffer-tls13-hrr.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
|
|
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 HRR failed\n" && exit 1
|
|
fi
|
|
|
|
echo -e "\nSuccess!\n"
|
|
exit 0
|