From 57b95cd955b442617cda9dc065aba484d2a49770 Mon Sep 17 00:00:00 2001 From: Vincae Date: Sun, 4 Nov 2018 20:02:01 +0100 Subject: [PATCH 1/3] handle the case if in TLS, extension 'supported_versions' is malformed --- scapy/fields.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scapy/fields.py b/scapy/fields.py index 841572e8cad..a75643881cf 100644 --- a/scapy/fields.py +++ b/scapy/fields.py @@ -1284,6 +1284,12 @@ def getfield(self, pkt, s): ret = b"" if len_pkt is not None: s, ret = s[:len_pkt], s[len_pkt:] + if len_pkt > len(s): # len_pkt is bigger than s, so we truncate + return b'' + ret, [b'Error/Malformed: Vector length ' + + str(len_pkt).encode() + + b' is too large, truncating it to ' + + str(len(s)).encode() + + b'original is : "' + s + b'"'] while s: if c is not None: From ab6229222b75df5c5925ea19ec3b23fc2d3ec0e8 Mon Sep 17 00:00:00 2001 From: Vincae Date: Sun, 4 Nov 2018 21:01:10 +0100 Subject: [PATCH 2/3] handle the case if in TLS, extension 'supported_versions' is malformed --- scapy/fields.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scapy/fields.py b/scapy/fields.py index a75643881cf..73eb305603b 100644 --- a/scapy/fields.py +++ b/scapy/fields.py @@ -1285,11 +1285,11 @@ def getfield(self, pkt, s): if len_pkt is not None: s, ret = s[:len_pkt], s[len_pkt:] if len_pkt > len(s): # len_pkt is bigger than s, so we truncate - return b'' + ret, [b'Error/Malformed: Vector length ' + return b'' + ret, [b"Error/Malformed: Vector length " + str(len_pkt).encode() - + b' is too large, truncating it to ' + + b" is too large, truncating it to " + str(len(s)).encode() - + b'original is : "' + s + b'"'] + + b" original is : \"" + s + b"\""] while s: if c is not None: From 93935919c54b1cf62af74f57db7f8d56af07e75f Mon Sep 17 00:00:00 2001 From: Vincae Date: Tue, 13 Nov 2018 19:47:19 +0100 Subject: [PATCH 3/3] Added extension supported_versions for the handshake helloserver of the TLS1.3 --- scapy/fields.py | 6 ------ scapy/layers/tls/extensions.py | 13 +++++++++++++ 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/scapy/fields.py b/scapy/fields.py index 73eb305603b..841572e8cad 100644 --- a/scapy/fields.py +++ b/scapy/fields.py @@ -1284,12 +1284,6 @@ def getfield(self, pkt, s): ret = b"" if len_pkt is not None: s, ret = s[:len_pkt], s[len_pkt:] - if len_pkt > len(s): # len_pkt is bigger than s, so we truncate - return b'' + ret, [b"Error/Malformed: Vector length " - + str(len_pkt).encode() - + b" is too large, truncating it to " - + str(len(s)).encode() - + b" original is : \"" + s + b"\""] while s: if c is not None: diff --git a/scapy/layers/tls/extensions.py b/scapy/layers/tls/extensions.py index ffec02aa1ea..47eeb487a0a 100644 --- a/scapy/layers/tls/extensions.py +++ b/scapy/layers/tls/extensions.py @@ -525,6 +525,16 @@ class TLS_Ext_SupportedVersions(TLS_Ext_Unknown): length_from=lambda pkt: pkt.versionslen)] +class TLS_Ext_SupportedVersions_Server(TLS_Ext_Unknown): + name = "TLS Extension - Supported Versions" + fields_desc = [ShortEnumField("type", 0x2b, _tls_ext), + ShortField("len", None), + FieldListField("versions", [], + ShortEnumField("version", None, + _tls_version), + length_from=lambda pkt: 2)] + + class TLS_Ext_Cookie(TLS_Ext_Unknown): name = "TLS Extension - Cookie" fields_desc = [ShortEnumField("type", 0x2c, _tls_ext), @@ -688,12 +698,15 @@ def m2i(self, pkt, m): t = struct.unpack("!H", m[:2])[0] tmp_len = struct.unpack("!H", m[2:4])[0] cls = _tls_ext_cls.get(t, TLS_Ext_Unknown) + from scapy.layers.tls.handshake import TLSServerHello if cls is TLS_Ext_KeyShare: from scapy.layers.tls.keyexchange_tls13 import _tls_ext_keyshare_cls # noqa: E501 cls = _tls_ext_keyshare_cls.get(pkt.msgtype, TLS_Ext_Unknown) elif cls is TLS_Ext_PreSharedKey: from scapy.layers.tls.keyexchange_tls13 import _tls_ext_presharedkey_cls # noqa: E501 cls = _tls_ext_presharedkey_cls.get(pkt.msgtype, TLS_Ext_Unknown) # noqa: E501 + elif self.owners[0] is TLSServerHello and cls is TLS_Ext_SupportedVersions: # noqa: E501 + cls = TLS_Ext_SupportedVersions_Server res.append(cls(m[:tmp_len + 4], tls_session=pkt.tls_session)) m = m[tmp_len + 4:] return res