Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Packet TCP Layer Decode TLS 1.3 Problem. #1188

Open
Darwin-cpu opened this issue Sep 23, 2024 · 0 comments
Open

Packet TCP Layer Decode TLS 1.3 Problem. #1188

Darwin-cpu opened this issue Sep 23, 2024 · 0 comments

Comments

@Darwin-cpu
Copy link

After decoding the packet layer and retrieving the TLS Version or TLS Handshake Version information from the TCP payload, I can extract details such as TLS 1.0, TLS 1.1, and TLS 1.2 from the payload. However, for TLS 1.3, the value 0x0304 is not present in the payload. What could be the reason for this? (gopacket v1.1.19 release version used)

Here is some examples how to try.

func processHttpsPacket(packet gopacket.Packet, tcp *layers.TCP) (string, string, error) {
    checkPacketIsSSL(tcp.Payload)
}

func checkPacketIsSSL(payload []byte) (bool, uint16, byte, uint16 ) {
    sslSignatures := [][]byte{
        {0x16},
    }
    var tlsVersion uint16
    var tlsHandshakeVersion uint16
    var tlsContentType byte
    for _, signature := range sslSignatures {
        if bytes.HasPrefix(payload, signature) {
            if len(payload) > 0 {
                tlsContentType = payload[0] // 0x16 -> Handshake content type
            }
            if len(payload) > 2 {
                tlsVersion = binary.BigEndian.Uint16(payload[1:3])
            }
            if len(payload) > 10 {
                tlsHandshakeVersion = binary.BigEndian.Uint16(payload[9:11])
            }
            return true, tlsVersion,tlsContentType, tlsHandshakeVersion
        }
    }
    return false, 0, 0, 0
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant