Skip to content

TCP fragmentation caused by \x0a sent to socket #1130

@drwetter

Description

@drwetter

As noted in the discussion of PR #1113 it seems that printf -- "$data" >&5 2>/dev/null does not do what it is intended. $data contains a ClientHello, 5 is the fd of a socket. "$data" is a ClientHello like

\x16\x03\x01\x2\x00\x01\x00\x1\xfc\x03\x03\x54\x51\x1e\x7a\xde\xad\xbe\xef\x31\x33\x07\x00\x00\x00\x00\x00\xcf\xbd\x39\x04\xcc\x16\x0a\...

Each \x0a like the last one causes a new TCP fragment to begin which can be spotted when using wireshark while running e.g.

testssl.sh --assume-http -p testssl.sh

Starting from the SSLv3 ClientHello the first reassembled packet ends with 0a.

This ticket is for continuing the discussion from #1113 (comment) on

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions