Class _TLSIVField

scapy/layers/tls/basefields.py:109–151

As stated in Section 6.2.3.2. RFC 4346, TLS 1.1 implements an explicit IV mechanism. For that reason, the behavior of the field is dependent on the TLS version found in the packet if available or otherwise (on build, if not overloaded, it is provided by the session). The size of the

class _TLSIVField(StrField):
    """
    As stated in Section 6.2.3.2. RFC 4346, TLS 1.1 implements an explicit IV
    mechanism. For that reason, the behavior of the field is dependent on the
    TLS version found in the packet if available or otherwise (on build, if
    not overloaded, it is provided by the session). The size of the IV and
    its value are obviously provided by the session. As a side note, for the
    first packets exchanged by peers, NULL being the default enc alg, it is
    empty (except if forced to a specific value). Also note that the field is
    kept empty (unless forced to a specific value) when the cipher is a stream
    cipher (and NULL is considered a stream cipher).
    """

    def i2len(self, pkt, i):
        if i is not None:
            return len(i)
        tmp_len = 0
        cipher_type = pkt.tls_session.rcs.cipher.type
        if cipher_type == "block":
            if pkt.tls_session.tls_version >= 0x0302:
                tmp_len = pkt.tls_session.rcs.cipher.block_size
        elif cipher_type == "aead":
            tmp_len = pkt.tls_session.rcs.cipher.nonce_explicit_len
        return tmp_len

    def i2m(self, pkt, x):
        return x or b""

    def addfield(self, pkt, s, val):
        return s + self.i2m(pkt, val)

    def getfield(self, pkt, s):
        tmp_len = 0
        cipher_type = pkt.tls_session.rcs.cipher.type
        if cipher_type == "block":
            if pkt.tls_session.tls_version >= 0x0302:
                tmp_len = pkt.tls_session.rcs.cipher.block_size
        elif cipher_type == "aead":
            tmp_len = pkt.tls_session.rcs.cipher.nonce_explicit_len
        return s[tmp_len:], self.m2i(pkt, s[:tmp_len])

    def i2repr(self, pkt, x):
        return repr(self.i2m(pkt, x))


class _TLSMACField(StrField):