Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLSv1.3 garbage in flow fix and segmentation fault fix #120

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

infokek
Copy link

@infokek infokek commented Feb 22, 2025

Hi! I suggest to change:

  1. ssldecode code because of segmentation fault on this one pcap:
    https://app.any.run/tasks/90ff9de3-440f-4f5a-8f01-edd8d219def8
    image-1
  2. sslprint code because of TLSv1.3 garbage in flow after decryption (TLS and decrypted traffic mix). This problem is caused by possible bug of ct getting. Maybe @lord8266 will correct me.
    https://app.any.run/tasks/db11da7d-817c-4364-a15a-38011f8e5129
    image1

Changes:

  1. Cause of segfault in ssldecode
    image2
    Resolved:
    image3
  2. After decryption TCP stream now not have unnecessary data (like TLS and SSL certificates and bytes that are not related to the original decrypted information):
    image9

I tested these changes on many pcaps and these problems no longer appeared.

@adulau adulau self-requested a review February 24, 2025 05:35
@infokek
Copy link
Author

infokek commented Feb 24, 2025

I also tested these changes for TLSv1.3 decryption on pcaps that have been provided by @lord8266 (samples/).

I assume that the problem with mixing streams after decryption of TLSv1.3 was accidentally left, because in this case, with this small change, the algorithm works more correctly and leaves nothing superfluous after decryption. I would like to note that I also checked these changes on HTTP 2 traffic and got quite a high-quality decryption that can be parsed by Zeek and other DPIs.

If required, I can provide pcaps from the any.run sandbox examples that I had provided in the message above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant