This is the actual content of the TLS record. As a TLS record may pack multiple sublayer messages (notably, several handshake messages), we inherit from PacketListField.
| 59 | |
| 60 | |
| 61 | class _TLSMsgListField(PacketListField): |
| 62 | """ |
| 63 | This is the actual content of the TLS record. As a TLS record may pack |
| 64 | multiple sublayer messages (notably, several handshake messages), |
| 65 | we inherit from PacketListField. |
| 66 | """ |
| 67 | |
| 68 | def __init__(self, name, default, length_from=None): |
| 69 | if not length_from: |
| 70 | length_from = self._get_length |
| 71 | super(_TLSMsgListField, self).__init__(name, default, None, |
| 72 | length_from=length_from) |
| 73 | |
| 74 | def _get_length(self, pkt): |
| 75 | if pkt.deciphered_len is None: |
| 76 | return pkt.len |
| 77 | return pkt.deciphered_len |
| 78 | |
| 79 | def m2i(self, pkt, m): |
| 80 | """ |
| 81 | Try to parse one of the TLS subprotocols (ccs, alert, handshake or |
| 82 | application_data). This is used inside a loop managed by .getfield(). |
| 83 | """ |
| 84 | cls = Raw |
| 85 | if pkt.type == 22: |
| 86 | if len(m) >= 1: |
| 87 | msgtype = orb(m[0]) |
| 88 | # If a version was agreed on by both client and server, |
| 89 | # we use it (tls_session.tls_version) |
| 90 | # Otherwise, if the client advertised for TLS 1.3, we try to |
| 91 | # dissect the following packets (most likely, server hello) |
| 92 | # using TLS 1.3. The serverhello is able to fallback on |
| 93 | # TLS 1.2 if necessary. In any case, this will set the agreed |
| 94 | # version so that all future packets are correct. |
| 95 | if ((pkt.tls_session.advertised_tls_version == 0x0304 and |
| 96 | pkt.tls_session.tls_version is None) or |
| 97 | pkt.tls_session.tls_version == 0x0304): |
| 98 | cls = _tls13_handshake_cls.get(msgtype, Raw) |
| 99 | else: |
| 100 | cls = _tls_handshake_cls.get(msgtype, Raw) |
| 101 | |
| 102 | elif pkt.type == 20: |
| 103 | cls = TLSChangeCipherSpec |
| 104 | elif pkt.type == 21: |
| 105 | cls = TLSAlert |
| 106 | elif pkt.type == 23: |
| 107 | cls = TLSApplicationData |
| 108 | |
| 109 | if cls is Raw: |
| 110 | return Raw(m) |
| 111 | else: |
| 112 | try: |
| 113 | return cls(m, tls_session=pkt.tls_session) |
| 114 | except Exception: |
| 115 | if conf.debug_dissector: |
| 116 | raise |
| 117 | return Raw(m) |
| 118 |
no outgoing calls
no test coverage detected
searching dependent graphs…