Method connection_handler

dshell/plugins/ssl/tls.py:875–986

(self, conn)

            self.debug("ja3 capability disabled due to missing python module")

    def connection_handler(self, conn):

        inverted_ssl = False
        info = conn.info()
        client_names = set()  # Agregate list of names specified by client
        server_names = set()  # Agregate list of names specified by server
        certs_cs = []
        certs_sc = []
        server_cipher = None
        client_cipher_list = []

        for blob in conn.blobs:

            blob.reassemble(allow_overlap=True, allow_padding=True)
            data = blob.data
            offset = 0

            while offset < len(data):

                tlsrecord = None
                try:
                    tlsrecord = TLS(data[offset:])
                    offset += tlsrecord.recordbytes

                    if tlsrecord.ContentType == SSL3_RT_HANDSHAKE:
                        for hs in tlsrecord.Handshakes:
                            #
                            # Client hello.  Looking for inversion.
                            #
                            if hs.HandshakeType == SSL3_MT_CLIENT_HELLO:
                                if blob.direction != 'cs':
                                    inverted_ssl = True
                                if 'server_name' in hs.extensions:
                                    for server in hs.extensions['server_name']:
                                        client_names.add(
                                            server.decode('utf-8'))
                                if ja3_available:
                                    info['ja3'] = hs.ja3()
                                    info['ja3_digest'] = hs.ja3_digest()
                                client_cipher_list = hs.cipher_suites

                            elif hs.HandshakeType == SSL3_MT_SERVER_HELLO:
                                server_cipher = hs.cipher_suite

                            #
                            # Certificate.  Looking for first server cert.
                            #
                            elif hs.HandshakeType == SSL3_MT_CERTIFICATE:
                                for cert in hs.Certificates:
                                    cert_info = openSSL_cert_to_info_dictionary(
                                        cert)
                                    if blob.direction == 'cs':
                                        certs_cs.append(cert_info)
                                    else:
                                        certs_sc.append(cert_info)

                except InsufficientData:
                    self.log('Skipping small blob: %s\n' % (sys.exc_info()[1]))