Skip to content

Commit f67ae2b

Browse files
ryandoyleryandoyle
committed
TLS: Initial support for printing TLS PDUs
Supports printing plain text parts of TLS. Basic record layer printing is supported as well as more complex printing of handshake and alert protocols, specifically ClientHello and ServerHello - these will print interesting parts of TLS extensions like ALPN, SNI and the underlying TLS version negotiated. As we don't keep state and TLS is stateful, this printer does assume/ is limited by this, specifically: * TLS version is printed as per record layer version. In the case of TLS 1.3, the record layer is set to TLS 1.2, and the supported_versions extension is used to negotiate the actual version used. * Alert and Handshake protocol messages can be plain text or encrypted, depending on if a crypto context is established. This printer doesn't know this, so we try to detect it and print "(likely encrypted)".
1 parent 857656d commit f67ae2b

15 files changed

+2063
-0
lines changed

‎CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -1125,6 +1125,7 @@ set(NETDISSECT_SOURCE_LIST_C
11251125
print-tftp.c
11261126
print-timed.c
11271127
print-tipc.c
1128+
print-tls.c
11281129
print-token.c
11291130
print-udld.c
11301131
print-udp.c

‎Makefile.in

+1
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,7 @@ LIBNETDISSECT_SRC=\
234234
print-tftp.c \
235235
print-timed.c \
236236
print-tipc.c \
237+
print-tls.c \
237238
print-token.c \
238239
print-udld.c \
239240
print-udp.c \

‎netdissect.h

+1
Original file line numberDiff line numberDiff line change
@@ -746,6 +746,7 @@ extern void telnet_print(netdissect_options *, const u_char *, u_int);
746746
extern void tftp_print(netdissect_options *, const u_char *, u_int);
747747
extern void timed_print(netdissect_options *, const u_char *);
748748
extern void tipc_print(netdissect_options *, const u_char *, u_int, u_int);
749+
extern void tls_print(netdissect_options *, const u_char *, u_int);
749750
extern u_int token_print(netdissect_options *, const u_char *, u_int, u_int);
750751
extern void udld_print(netdissect_options *, const u_char *, u_int);
751752
extern void udp_print(netdissect_options *, const u_char *, u_int, const u_char *, int, u_int);

‎print-tcp.c

+3
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,9 @@ tcp_print(netdissect_options *ndo,
778778
} else if (IS_SRC_OR_DST_PORT(HTTP_PORT) || IS_SRC_OR_DST_PORT(HTTP_PORT_ALT)) {
779779
ND_PRINT(": ");
780780
http_print(ndo, bp, length);
781+
} else if (IS_SRC_OR_DST_PORT(HTTPS_PORT)) {
782+
ND_PRINT(": ");
783+
tls_print(ndo, bp, length);
781784
} else if (IS_SRC_OR_DST_PORT(RTSP_PORT) || IS_SRC_OR_DST_PORT(RTSP_PORT_ALT)) {
782785
ND_PRINT(": ");
783786
rtsp_print(ndo, bp, length);

‎print-tls.c

+1,433
Large diffs are not rendered by default.

‎tcp.h

+3
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,9 @@ extern const struct tok tcp_flag_values[];
122122
#ifndef RPKI_RTR_PORT
123123
#define RPKI_RTR_PORT 323
124124
#endif
125+
#ifndef HTTPS_PORT
126+
#define HTTPS_PORT 443
127+
#endif
125128
#ifndef SMB_PORT
126129
#define SMB_PORT 445
127130
#endif

‎tests/TESTLIST

+7
Original file line numberDiff line numberDiff line change
@@ -897,3 +897,10 @@ quic_handshake quic_handshake.pcap quic_handshake.out -v
897897
quic_handshake_truncated quic_handshake_truncated.pcap quic_handshake_truncated.out -v
898898
quic_retry quic_retry.pcap quic_retry.out -v
899899
gquic gquic.pcap gquic.out -v
900+
901+
# TLS Tests
902+
tls-13-https tls-1.3-https.pcap tls-1.3-https.out
903+
tls-13-https-v tls-1.3-https.pcap tls-1.3-https-v.out -v
904+
tls-13-https-vv tls-1.3-https.pcap tls-1.3-https-vv.out -vv
905+
tls-trunc tls-trunc.pcap tls-trunc.out -vv
906+
tls-10-unencrypted-alert tls-v1.0-alert.pcap tls-v1.0-alert.out -vv

‎tests/tls-1.3-https-v.out

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
1 08:46:29.784434 IP (tos 0x0, ttl 64, id 51353, offset 0, flags [DF], proto TCP (6), length 60)
2+
172.16.10.62.42836 > 93.184.216.34.443: Flags [S], cksum 0xfde5 (correct), seq 4032104602, win 64240, options [mss 1460,sackOK,TS val 349023283 ecr 0,nop,wscale 7], length 0
3+
2 08:46:30.067408 IP (tos 0x0, ttl 54, id 30546, offset 0, flags [none], proto TCP (6), length 60)
4+
93.184.216.34.443 > 172.16.10.62.42836: Flags [S.], cksum 0xf796 (correct), seq 1112285027, ack 4032104603, win 65535, options [mss 1460,sackOK,TS val 2452491599 ecr 349023283,nop,wscale 9], length 0
5+
3 08:46:30.067546 IP (tos 0x0, ttl 64, id 51354, offset 0, flags [DF], proto TCP (6), length 52)
6+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x2354 (correct), ack 1, win 502, options [nop,nop,TS val 349023566 ecr 2452491599], length 0
7+
4 08:46:30.078638 IP (tos 0x0, ttl 64, id 51355, offset 0, flags [DF], proto TCP (6), length 569)
8+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0xb803 (correct), seq 1:518, ack 1, win 502, options [nop,nop,TS val 349023577 ecr 2452491599], length 517: TLS
9+
Handshake TLSv1.0, length: 512
10+
ClientHello client version: TLSv1.2 random: 0xf32bab8e...94c2e6f4, session id: 0x33a54bb5...33e5a0da, 36 cipher suites, name: example.com [h2,http/1.1], versions: TLSv1.3,TLSv1.2
11+
5 08:46:30.272139 IP (tos 0x0, ttl 54, id 30570, offset 0, flags [none], proto TCP (6), length 52)
12+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x2197 (correct), ack 518, win 131, options [nop,nop,TS val 2452491887 ecr 349023577], length 0
13+
6 08:46:30.272202 IP (tos 0x0, ttl 54, id 30571, offset 0, flags [none], proto TCP (6), length 151)
14+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x3f2e (correct), seq 1:100, ack 518, win 131, options [nop,nop,TS val 2452491887 ecr 349023577], length 99: TLS
15+
Handshake TLSv1.2, length: 88
16+
ServerHello server version: TLSv1.2 random: 0xcf21ad74...c8a8339c, session id: 0x33a54bb5...33e5a0da, cipher TLS_AES_256_GCM_SHA384, version: TLSv1.3
17+
ChangeCipherSpec TLSv1.2, length: 1
18+
7 08:46:30.272271 IP (tos 0x0, ttl 64, id 51356, offset 0, flags [DF], proto TCP (6), length 52)
19+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x1eff (correct), ack 100, win 502, options [nop,nop,TS val 349023771 ecr 2452491887], length 0
20+
8 08:46:30.272922 IP (tos 0x0, ttl 64, id 51357, offset 0, flags [DF], proto TCP (6), length 575)
21+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0x601a (correct), seq 518:1041, ack 100, win 502, options [nop,nop,TS val 349023772 ecr 2452491887], length 523: TLS
22+
ChangeCipherSpec TLSv1.2, length: 1
23+
Handshake TLSv1.2, length: 512
24+
ClientHello client version: TLSv1.2 random: 0xf32bab8e...94c2e6f4, session id: 0x33a54bb5...33e5a0da, 36 cipher suites, name: example.com [h2,http/1.1], versions: TLSv1.3,TLSv1.2
25+
9 08:46:30.477422 IP (tos 0x0, ttl 54, id 30618, offset 0, flags [none], proto TCP (6), length 52)
26+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x1da0 (correct), ack 1041, win 133, options [nop,nop,TS val 2452492083 ecr 349023772], length 0
27+
10 08:46:30.477486 IP (tos 0x0, ttl 54, id 30619, offset 0, flags [none], proto TCP (6), length 52)
28+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x1da0 (correct), ack 1041, win 133, options [nop,nop,TS val 2452492083 ecr 349023772], length 0
29+
11 08:46:30.477497 IP (tos 0x0, ttl 54, id 30620, offset 0, flags [none], proto TCP (6), length 2948)
30+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x707b (correct), seq 100:2996, ack 1041, win 133, options [nop,nop,TS val 2452492084 ecr 349023772], length 2896: TLS
31+
Handshake TLSv1.2, length: 155
32+
ServerHello server version: TLSv1.2 random: 0xb46c4b7c...15efc18f, session id: 0x33a54bb5...33e5a0da, cipher TLS_AES_256_GCM_SHA384, version: TLSv1.3
33+
ApplicationData TLSv1.2, length: 32
34+
ApplicationData TLSv1.2, length: 3120
35+
12 08:46:30.477525 IP (tos 0x0, ttl 64, id 51358, offset 0, flags [DF], proto TCP (6), length 52)
36+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x1028 (correct), ack 2996, win 480, options [nop,nop,TS val 349023976 ecr 2452492084], length 0
37+
13 08:46:30.477582 IP (tos 0x0, ttl 54, id 30622, offset 0, flags [none], proto TCP (6), length 838)
38+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x174a (correct), seq 2996:3782, ack 1041, win 133, options [nop,nop,TS val 2452492084 ecr 349023772], length 786: TLS
39+
TLS Fragment or unknown record type(231)
40+
14 08:46:30.477611 IP (tos 0x0, ttl 64, id 51359, offset 0, flags [DF], proto TCP (6), length 52)
41+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x0d1c (correct), ack 3782, win 474, options [nop,nop,TS val 349023976 ecr 2452492084], length 0
42+
15 08:46:30.480046 IP (tos 0x0, ttl 64, id 51360, offset 0, flags [DF], proto TCP (6), length 126)
43+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0xab78 (correct), seq 1041:1115, ack 3782, win 501, options [nop,nop,TS val 349023979 ecr 2452492084], length 74: TLS
44+
ApplicationData TLSv1.2, length: 69
45+
16 08:46:30.480350 IP (tos 0x0, ttl 64, id 51361, offset 0, flags [DF], proto TCP (6), length 147)
46+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0x7cda (correct), seq 1115:1210, ack 3782, win 501, options [nop,nop,TS val 349023979 ecr 2452492084], length 95: TLS
47+
ApplicationData TLSv1.2, length: 41
48+
ApplicationData TLSv1.2, length: 44
49+
17 08:46:30.480450 IP (tos 0x0, ttl 64, id 51362, offset 0, flags [DF], proto TCP (6), length 87)
50+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0xdd52 (correct), seq 1210:1245, ack 3782, win 501, options [nop,nop,TS val 349023979 ecr 2452492084], length 35: TLS
51+
ApplicationData TLSv1.2, length: 30
52+
18 08:46:30.480775 IP (tos 0x0, ttl 64, id 51363, offset 0, flags [DF], proto TCP (6), length 111)
53+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0xf6ed (correct), seq 1245:1304, ack 3782, win 501, options [nop,nop,TS val 349023979 ecr 2452492084], length 59: TLS
54+
ApplicationData TLSv1.2, length: 54
55+
19 08:46:30.681894 IP (tos 0x0, ttl 54, id 30658, offset 0, flags [none], proto TCP (6), length 52)
56+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x0d55 (correct), ack 1115, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 0
57+
20 08:46:30.681957 IP (tos 0x0, ttl 54, id 30659, offset 0, flags [none], proto TCP (6), length 52)
58+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x0cf6 (correct), ack 1210, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 0
59+
21 08:46:30.681968 IP (tos 0x0, ttl 54, id 30660, offset 0, flags [none], proto TCP (6), length 52)
60+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x0cd3 (correct), ack 1245, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 0
61+
22 08:46:30.681976 IP (tos 0x0, ttl 54, id 30661, offset 0, flags [none], proto TCP (6), length 52)
62+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x0c98 (correct), ack 1304, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 0
63+
23 08:46:30.681985 IP (tos 0x0, ttl 54, id 30662, offset 0, flags [none], proto TCP (6), length 307)
64+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x86cc (correct), seq 3782:4037, ack 1304, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 255: TLS
65+
ApplicationData TLSv1.2, length: 250
66+
24 08:46:30.682014 IP (tos 0x0, ttl 64, id 51364, offset 0, flags [DF], proto TCP (6), length 52)
67+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x0960 (correct), ack 4037, win 500, options [nop,nop,TS val 349024181 ecr 2452492291], length 0
68+
25 08:46:30.682072 IP (tos 0x0, ttl 54, id 30663, offset 0, flags [none], proto TCP (6), length 307)
69+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x8399 (correct), seq 4037:4292, ack 1304, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 255: TLS
70+
ApplicationData TLSv1.2, length: 250
71+
26 08:46:30.682095 IP (tos 0x0, ttl 64, id 51365, offset 0, flags [DF], proto TCP (6), length 52)
72+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x0862 (correct), ack 4292, win 499, options [nop,nop,TS val 349024181 ecr 2452492291], length 0
73+
27 08:46:30.682109 IP (tos 0x0, ttl 54, id 30664, offset 0, flags [none], proto TCP (6), length 179)
74+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x79ee (correct), seq 4292:4419, ack 1304, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 127: TLS
75+
ApplicationData TLSv1.2, length: 56
76+
ApplicationData TLSv1.2, length: 26
77+
ApplicationData TLSv1.2, length: 30
78+
28 08:46:30.682128 IP (tos 0x0, ttl 64, id 51366, offset 0, flags [DF], proto TCP (6), length 52)
79+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x07e3 (correct), ack 4419, win 499, options [nop,nop,TS val 349024181 ecr 2452492291], length 0
80+
29 08:46:30.682139 IP (tos 0x0, ttl 54, id 30665, offset 0, flags [none], proto TCP (6), length 1567)
81+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0x91ad (correct), seq 4419:5934, ack 1304, win 133, options [nop,nop,TS val 2452492291 ecr 349023979], length 1515: TLS
82+
ApplicationData TLSv1.2, length: 201
83+
ApplicationData TLSv1.2, length: 26
84+
ApplicationData TLSv1.2, length: 1273
85+
30 08:46:30.682156 IP (tos 0x0, ttl 64, id 51367, offset 0, flags [DF], proto TCP (6), length 52)
86+
172.16.10.62.42836 > 93.184.216.34.443: Flags [.], cksum 0x0203 (correct), ack 5934, win 488, options [nop,nop,TS val 349024181 ecr 2452492291], length 0
87+
31 08:46:30.682608 IP (tos 0x0, ttl 64, id 51368, offset 0, flags [DF], proto TCP (6), length 83)
88+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0xb77e (correct), seq 1304:1335, ack 5934, win 488, options [nop,nop,TS val 349024181 ecr 2452492291], length 31: TLS
89+
ApplicationData TLSv1.2, length: 26
90+
32 08:46:30.683272 IP (tos 0x0, ttl 64, id 51369, offset 0, flags [DF], proto TCP (6), length 76)
91+
172.16.10.62.42836 > 93.184.216.34.443: Flags [P.], cksum 0x3d21 (correct), seq 1335:1359, ack 5934, win 501, options [nop,nop,TS val 349024182 ecr 2452492291], length 24: TLS
92+
ApplicationData TLSv1.2, length: 19
93+
33 08:46:30.685033 IP (tos 0x0, ttl 64, id 51370, offset 0, flags [DF], proto TCP (6), length 52)
94+
172.16.10.62.42836 > 93.184.216.34.443: Flags [F.], cksum 0x01bb (correct), seq 1359, ack 5934, win 501, options [nop,nop,TS val 349024184 ecr 2452492291], length 0
95+
34 08:46:30.886272 IP (tos 0x0, ttl 54, id 30713, offset 0, flags [none], proto TCP (6), length 64)
96+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0xcfe1 (correct), ack 1335, win 133, options [nop,nop,TS val 2452492498 ecr 349024181,nop,nop,sack 1 {1359:1360}], length 0
97+
35 08:46:30.886345 IP (tos 0x0, ttl 54, id 30714, offset 0, flags [none], proto TCP (6), length 52)
98+
93.184.216.34.443 > 172.16.10.62.42836: Flags [.], cksum 0x025e (correct), ack 1360, win 133, options [nop,nop,TS val 2452492498 ecr 349024182], length 0
99+
36 08:46:30.886407 IP (tos 0x0, ttl 54, id 30715, offset 0, flags [none], proto TCP (6), length 76)
100+
93.184.216.34.443 > 172.16.10.62.42836: Flags [P.], cksum 0xfa6b (correct), seq 5934:5958, ack 1360, win 133, options [nop,nop,TS val 2452492498 ecr 349024182], length 24: TLS
101+
ApplicationData TLSv1.2, length: 19
102+
37 08:46:30.886452 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
103+
172.16.10.62.42836 > 93.184.216.34.443: Flags [R], cksum 0x1c68 (correct), seq 4032105962, win 0, length 0
104+
38 08:46:30.886494 IP (tos 0x0, ttl 54, id 30716, offset 0, flags [none], proto TCP (6), length 52)
105+
93.184.216.34.443 > 172.16.10.62.42836: Flags [F.], cksum 0x0245 (correct), seq 5958, ack 1360, win 133, options [nop,nop,TS val 2452492498 ecr 349024182], length 0
106+
39 08:46:30.886512 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
107+
172.16.10.62.42836 > 93.184.216.34.443: Flags [R], cksum 0x1c68 (correct), seq 4032105962, win 0, length 0

0 commit comments

Comments
 (0)