google / gopacket

Provides packet processing capabilities for Go
BSD 3-Clause "New" or "Revised" License
6.36k stars 1.14k forks source link

Packet TCP Layer Decode TLS 1.3 Problem. #1188

Open Darwin-cpu opened 2 months ago

Darwin-cpu commented 2 months ago

After decoding the packet layer and retrieving the TLS Version or TLS Handshake Version information from the TCP payload, I can extract details such as TLS 1.0, TLS 1.1, and TLS 1.2 from the payload. However, for TLS 1.3, the value 0x0304 is not present in the payload. What could be the reason for this? (gopacket v1.1.19 release version used)

Here is some examples how to try.

func processHttpsPacket(packet gopacket.Packet, tcp *layers.TCP) (string, string, error) {
    checkPacketIsSSL(tcp.Payload)
}

func checkPacketIsSSL(payload []byte) (bool, uint16, byte, uint16 ) {
    sslSignatures := [][]byte{
        {0x16},
    }
    var tlsVersion uint16
    var tlsHandshakeVersion uint16
    var tlsContentType byte
    for _, signature := range sslSignatures {
        if bytes.HasPrefix(payload, signature) {
            if len(payload) > 0 {
                tlsContentType = payload[0] // 0x16 -> Handshake content type
            }
            if len(payload) > 2 {
                tlsVersion = binary.BigEndian.Uint16(payload[1:3])
            }
            if len(payload) > 10 {
                tlsHandshakeVersion = binary.BigEndian.Uint16(payload[9:11])
            }
            return true, tlsVersion,tlsContentType, tlsHandshakeVersion
        }
    }
    return false, 0, 0, 0
}