201139 - SSLTap should display plain text for NULL cipher suites

Status: RESOLVED FIXED

(NSS :: Tools, enhancement, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

When SSLTAP receives an SSL/TLS "Finished" message from either end, it stops
attempting to decode/display the record contents after that and instead 
displays the message "(encrypted)".  

It should not do this for the "NULL" cipher suites, since they do not encrypt
the data.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

taking bug

Comment 2

[Saul Edwards]

Attachment: View application data in hex and ASCII with NULL ciphers

Compiled and tested on Solaris.  Does not work for SSL v2.

Comment 3

[Saul Edwards]

Attachment: Sample output with the first patch

Comment 4

[Julien Pierre]

Comment on attachment 149221 [details] [diff] [review]
View application data in hex and ASCII with NULL ciphers

The patch looks good, but I think you should include sslproto.h and use the
macros for the cipher suites, rather than typing the values again, which is
error prone. I know that's not the existing usage elsewhere in ssltap, but I
think it makes more sense, and should at least be done for the new code, if not
also for the existing.

In order to get the names of all the cipher suites, you may need to #ifdef
NSS_ENABLE_ECC . You will also need to add NSS_ENABLE_ECC support to the
manifest.mn for ssltap.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

reassigning to Alexei.

Comment 6

[Alexei Volkov]

Attachment: new output when NULL cipher is used

Comment 7

[Alexei Volkov]

Attachment: patch

Use sslproto.h macro definition for cipher suite instead on hex numbers.
Removes obsolite ECC cipher definitions.
Prints MAC separetely from content. Calculates MAC size based on remaining
number of bytes in "finished" record. Check attached output.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 239367 [details] [diff] [review]
patch

I've asked Alexei to add some comments and also to fix print_hex to properly align the ASCII text output.

Comment 9

[Alexei Volkov]

Attachment: comments and fix for ASCII string alignment

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 239424 [details] [diff] [review]
comments and fix for ASCII string alignment

r=nelson, with one small suggested change to a comment.

>+      if (!isNULLmac(currentcipher) && !hMACsize) {
>+          /* To calculate the size of MAC, we will sum the size
>+           * of verify_data(sslh.length) and 4(type + length
>+           * of finished handshake message) and subtract the
>+           * result from the total number of bytes in handshake
>+           * message(alloclen) */

This should say "from the total number of bytes in the handshake record",
the crucial difference being that the MAC comes at the end of a record,
and is not part of the message.  (records contain messages and MACs).

Comment 11

[Alexei Volkov]

Integrated into 3.12 with corrected comment.

/cvsroot/mozilla/security/nss/cmd/ssltap/ssltap.c,v  <--  ssltap.c
new revision: 1.10; previous revision: 1.9