Skip to content

Commit 32f0081

Browse files
hynekkarhynekkar
authored
Merge pull request #138 from CESNET/tls_supported_ver_ext
Support of extraction TLS 1.3 version
2 parents 52a7f2b + 946e120 commit 32f0081

File tree

6 files changed

+47
-16
lines changed

6 files changed

+47
-16
lines changed

‎pcaps/tls.pcap‎

46.4 KB
Binary file not shown.

‎process/tls.cpp‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ int TLSPlugin::pre_update(Flow &rec, Packet &pkt)
8383
RecordExtTLS *ext = static_cast<RecordExtTLS *>(rec.get_extension(RecordExtTLS::REGISTERED_ID));
8484

8585
if (ext != nullptr) {
86-
if (ext->alpn[0] == 0) {
86+
if (ext->server_hello_parsed == false) {
8787
// Add ALPN from server packet
8888
parse_tls(pkt.payload, pkt.payload_len, ext);
8989
}
@@ -119,9 +119,14 @@ bool TLSPlugin::obtain_tls_data(TLSData &payload, RecordExtTLS *rec, std::string
119119
ec_point_formats = tls_parser.tls_get_ja3_ec_point_formats(payload);
120120
}
121121
} else if (hs_type == TLS_HANDSHAKE_SERVER_HELLO) {
122+
rec->server_hello_parsed = true;
122123
if (type == TLS_EXT_ALPN) {
123124
tls_parser.tls_get_alpn(payload, rec->alpn, BUFF_SIZE);
124-
return true;
125+
// not sure, but probably don`t return yet, as
126+
// this is not only field we want to parse
127+
//return true;
128+
} else if (type == TLS_EXT_SUPPORTED_VER){
129+
tls_parser.tls_get_supp_ver(payload, rec->version);
125130
}
126131
}
127132
payload.start += length;
@@ -159,7 +164,7 @@ bool TLSPlugin::parse_tls(const uint8_t *data, uint16_t payload_len, RecordExtTL
159164
}
160165
tls_handshake tls_hs = tls_parser.tls_get_handshake();
161166

162-
rec->version = ((uint16_t) tls_hs.version.major << 8) | tls_hs.version.minor;
167+
rec->version = (rec->version == 0)?(((uint16_t) tls_hs.version.major << 8) | tls_hs.version.minor) : rec->version;
163168
ja3 += std::to_string((uint16_t) tls_hs.version.version) + ',';
164169

165170
if (!tls_parser.tls_skip_random(payload)) {

‎process/tls.hpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ struct RecordExtTLS : public RecordExt {
5858
char ja3_hash[33] = { 0 };
5959
uint8_t ja3_hash_bin[16] = { 0 };
6060
std::string ja3;
61+
bool server_hello_parsed;
6162

6263
/**
6364
* \brief Constructor.
@@ -67,6 +68,7 @@ struct RecordExtTLS : public RecordExt {
6768
alpn[0] = 0;
6869
sni[0] = 0;
6970
ja3_hash[0] = 0;
71+
server_hello_parsed = false;
7072
}
7173

7274
#ifdef WITH_NEMEA
@@ -144,6 +146,7 @@ struct RecordExtTLS : public RecordExt {
144146
#define TLS_EXT_ECLIPTIC_CURVES 10 // AKA supported_groups
145147
#define TLS_EXT_EC_POINT_FORMATS 11
146148
#define TLS_EXT_ALPN 16
149+
#define TLS_EXT_SUPPORTED_VER 43
147150

148151

149152
/**

‎process/tls_parser.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,13 @@ void TLSParser::tls_get_server_name(TLSData &data, char *buffer, size_t buffer_s
126126
return;
127127
}
128128

129+
void TLSParser::tls_get_supp_ver(TLSData &data, uint16_t &version)
130+
{
131+
tls_version* ext_ver = (tls_version *) data.start;
132+
version = ((uint16_t) ext_ver->major << 8) | ext_ver->minor;
133+
return;
134+
}
135+
129136
void TLSParser::tls_get_alpn(TLSData &data, char *buffer, size_t buffer_size)
130137
{
131138
uint16_t list_len = ntohs(*(uint16_t *) data.start);

‎process/tls_parser.hpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ class TLSParser
8686
bool tls_check_rec(TLSData&);
8787
void tls_get_server_name(TLSData &, char *, size_t);
8888
void tls_get_alpn(TLSData &, char *, size_t);
89+
void tls_get_supp_ver(TLSData &, uint16_t &);
8990

9091
void tls_get_quic_user_agent(TLSData &, char *, size_t);
9192
bool tls_check_handshake(TLSData&);

‎tests/functional/reference/tls‎

Lines changed: 28 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,29 @@
1-
160.85.255.180,192.168.88.244,672,208,0,2020-09-07T06:52:40.858429,2020-09-07T06:52:40.964957,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,1,443,59673,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
2-
160.85.255.180,192.168.88.244,672,208,0,2020-09-07T06:52:40.858553,2020-09-07T06:52:40.965848,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,1,443,59674,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
3-
160.85.255.180,192.168.88.244,672,208,0,2020-09-07T06:52:40.870218,2020-09-07T06:52:40.972697,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,1,443,59675,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
4-
160.85.255.180,192.168.88.244,672,208,0,2020-09-07T06:52:40.870714,2020-09-07T06:52:40.973197,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,1,443,59676,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
5-
160.85.255.180,192.168.88.244,672,208,0,2020-09-07T06:52:40.870851,2020-09-07T06:52:40.975124,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,1,443,59677,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
6-
160.85.255.180,192.168.88.244,714,3436,0,2020-09-07T06:52:40.477735,2020-09-07T06:52:40.549534,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,4,443,59672,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
7-
82.145.216.15,192.168.88.244,714,4308,0,2020-09-07T06:52:41.372241,2020-09-07T06:52:41.418203,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,2,4,443,59678,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"af.opera.com"
8-
87.106.189.123,172.16.121.155,1085,4455,0,2015-10-20T07:09:33.614159,2015-10-20T07:09:34.161736,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,7,9,443,3923,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
9-
87.106.189.123,172.16.121.155,496,325,0,2015-10-20T07:09:33.611190,2015-10-20T07:09:33.712851,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,4,4,443,3919,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
10-
87.106.189.123,172.16.121.155,496,325,0,2015-10-20T07:09:33.612842,2015-10-20T07:09:33.714751,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,4,4,443,3920,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
11-
87.106.189.123,172.16.121.155,496,325,0,2015-10-20T07:09:33.613610,2015-10-20T07:09:33.716640,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,4,4,443,3921,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
12-
87.106.189.123,172.16.121.155,496,325,0,2015-10-20T07:09:33.613897,2015-10-20T07:09:33.713722,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,4,4,443,3922,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
13-
87.106.189.123,172.16.121.155,496,325,0,2015-10-20T07:09:33.614399,2015-10-20T07:09:33.715479,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,4,4,443,3924,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
1+
104.26.1.201,192.168.0.228,569,1460,0,2023-03-10T09:04:19.289282,2023-03-10T09:04:19.304938,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52641,772,0,6,24,16,"",cd08e31494f9531f560d64c695473da9,"chrek.stdout.cz"
2+
104.26.6.183,192.168.0.228,599,264,0,2023-03-10T09:04:17.091196,2023-03-10T09:04:17.110050,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52635,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"cdn.xsd.cz"
3+
104.26.8.145,192.168.0.228,604,264,0,2023-03-10T09:04:16.211748,2023-03-10T09:04:16.225609,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52627,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"www.aktualne.cz"
4+
160.85.255.180,192.168.88.244,1344,416,0,2020-09-07T06:52:40.858429,2020-09-07T06:52:40.964957,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,2,443,59673,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
5+
160.85.255.180,192.168.88.244,1344,416,0,2020-09-07T06:52:40.858553,2020-09-07T06:52:40.965848,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,2,443,59674,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
6+
160.85.255.180,192.168.88.244,1344,416,0,2020-09-07T06:52:40.870218,2020-09-07T06:52:40.972697,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,2,443,59675,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
7+
160.85.255.180,192.168.88.244,1344,416,0,2020-09-07T06:52:40.870714,2020-09-07T06:52:40.973197,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,2,443,59676,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
8+
160.85.255.180,192.168.88.244,1344,416,0,2020-09-07T06:52:40.870851,2020-09-07T06:52:40.975124,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,2,443,59677,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
9+
160.85.255.180,192.168.88.244,1428,6872,0,2020-09-07T06:52:40.477735,2020-09-07T06:52:40.549534,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,8,443,59672,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"ja3er.com"
10+
172.67.69.20,192.168.0.228,610,264,0,2023-03-10T09:04:18.815874,2023-03-10T09:04:18.836732,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52640,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"recommend.aktualne.cz"
11+
172.67.73.164,192.168.0.228,616,264,0,2023-03-10T09:04:16.603334,2023-03-10T09:04:16.622460,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52629,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"prod-snowly-sasic.stdout.cz"
12+
18.66.15.50,192.168.0.228,569,286,0,2023-03-10T09:04:17.214373,2023-03-10T09:04:17.235193,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52637,772,0,6,24,24,"",0d69ff451640d67ee8b5122752834766,"sdk.privacy-center.org"
13+
185.26.182.106,192.168.0.228,569,0,0,2023-03-10T09:04:00.558609,2023-03-10T09:04:00.558609,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,0,443,52614,771,0,6,24,0,"",cd08e31494f9531f560d64c695473da9,"features.opera-api.com"
14+
185.59.208.153,192.168.0.228,682,2025,0,2023-03-10T09:04:16.701535,2023-03-10T09:04:16.737482,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,2,3,443,52630,771,0,6,24,24,"h2",cd08e31494f9531f560d64c695473da9,"delivery.r2b2.cz"
15+
23.218.208.236,192.168.0.228,672,316,0,2023-03-10T09:04:16.722338,2023-03-10T09:04:16.744620,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52631,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"assets.adobedtm.com"
16+
46.255.231.124,192.168.0.228,594,255,0,2023-03-10T09:04:17.063884,2023-03-10T09:04:17.089634,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52634,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"i0.cz"
17+
46.255.231.204,192.168.0.228,615,255,0,2023-03-10T09:04:17.338077,2023-03-10T09:04:17.355878,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52638,772,0,6,24,24,"",598872011444709307b861ae817a4b60,"pocasi-backend.aktualne.cz"
18+
52.84.193.121,192.168.0.228,569,286,0,2023-03-10T09:04:16.968115,2023-03-10T09:04:17.000426,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52632,772,0,6,24,24,"",0d69ff451640d67ee8b5122752834766,"d27xxe7juh1us6.cloudfront.net"
19+
54.226.148.116,192.168.0.228,747,1689,0,2023-03-10T09:04:17.182933,2023-03-10T09:04:17.411187,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,2,6,443,52636,771,0,6,24,24,"h2",cd08e31494f9531f560d64c695473da9,"goldengate.grammarly.com"
20+
82.145.216.15,192.168.88.244,1428,8616,0,2020-09-07T06:52:41.372241,2020-09-07T06:52:41.418203,d8:58:d7:00:c9:27,08:f8:bc:64:5e:6a,4,8,443,59678,771,0,6,24,24,"http/1.1",b32309a26951912be7dba376398abc3b,"af.opera.com"
21+
82.145.216.16,192.168.0.228,569,1340,0,2023-03-10T09:04:16.204659,2023-03-10T09:04:16.235645,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52626,772,0,6,24,16,"",cd08e31494f9531f560d64c695473da9,"sitecheck.opera.com"
22+
82.145.216.16,192.168.0.228,569,1460,0,2023-03-10T09:04:17.460626,2023-03-10T09:04:17.499628,90:5c:44:2e:bb:e0,08:f8:bc:64:5e:6a,1,1,443,52639,772,0,6,24,16,"",cd08e31494f9531f560d64c695473da9,"af.opera.com"
23+
87.106.189.123,172.16.121.155,2170,8910,0,2015-10-20T07:09:33.614159,2015-10-20T07:09:34.161736,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,14,18,443,3923,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
24+
87.106.189.123,172.16.121.155,992,650,0,2015-10-20T07:09:33.611190,2015-10-20T07:09:33.712851,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,8,8,443,3919,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
25+
87.106.189.123,172.16.121.155,992,650,0,2015-10-20T07:09:33.612842,2015-10-20T07:09:33.714751,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,8,8,443,3920,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
26+
87.106.189.123,172.16.121.155,992,650,0,2015-10-20T07:09:33.613610,2015-10-20T07:09:33.716640,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,8,8,443,3921,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
27+
87.106.189.123,172.16.121.155,992,650,0,2015-10-20T07:09:33.613897,2015-10-20T07:09:33.713722,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,8,8,443,3922,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
28+
87.106.189.123,172.16.121.155,992,650,0,2015-10-20T07:09:33.614399,2015-10-20T07:09:33.715479,00:50:56:e5:80:5b,00:0c:29:9d:b9:d0,8,8,443,3924,771,0,6,26,26,"",9a7b51089c089491dbc4879218db549c,"asecuritysite.com"
1429
ipaddr DST_IP,ipaddr SRC_IP,uint64 BYTES,uint64 BYTES_REV,uint64 LINK_BIT_FIELD,time TIME_FIRST,time TIME_LAST,macaddr DST_MAC,macaddr SRC_MAC,uint32 PACKETS,uint32 PACKETS_REV,uint16 DST_PORT,uint16 SRC_PORT,uint16 TLS_VERSION,uint8 DIR_BIT_FIELD,uint8 PROTOCOL,uint8 TCP_FLAGS,uint8 TCP_FLAGS_REV,string TLS_ALPN,bytes TLS_JA3,string TLS_SNI

0 commit comments

Comments
 (0)