1
1
mirror of https://github.com/wader/fq.git synced 2024-11-26 21:55:57 +03:00
fq/format/pcap
Mattias Wadman 9852f56b74 tls: Add TLS 1.0, 1.1, 1.2 decode and decryption
What it can do:
- Decodes records and most standard messages and extensions.
- Decryptes records and reassemples application data stream if a keylog is provided
  and the cipher suite is supported.
- Supports most recommended and used ciphers and a bunch of older ones.

What it can't do:
- SSL v3 maybe supported, is similar to TLS 1.0, not tested.
- Decryption and renegotiation/cipher change.
- Record defragmentation not supported, seems rare over TCP.
- TLS 1.3
- SSL v2 but v2 compat header is supported.
- Some key exchange messages not decoded yet

Decryption code is heavly based on golang crypto/tls and zmap/zcrypto.

Will be base for decoding http2 and other TLS based on protocols.

Fixes #587
2023-03-05 13:52:12 +01:00
..
testdata tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
pcap.go decode: Support multiple format args and some rename and refactor 2023-02-18 21:38:51 +01:00
pcap.md doc,rtmp,pcap,markdown: Add more examples 2022-10-09 19:18:14 +02:00
pcapng.go decode: Support multiple format args and some rename and refactor 2023-02-18 21:38:51 +01:00
shared.go tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00