wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-11-22 07:16:49 +03:00
Code Issues Projects Releases Wiki Activity
af68511acf
fq/format/tls
History
Mattias Wadman a4a332bf4e formats: Clenaup naming a bit
2023-05-01 13:19:04 +02:00
..
ciphersuites golangci-lint: Disable revive unused-parameter and update for new default config 2023-03-18 22:56:58 +01:00
keylog tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
rezlib tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
testdata tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
tlsdecrypt tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
alerts.go tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
extensions.go golangci-lint: Disable revive unused-parameter and update for new default config 2023-03-18 22:56:58 +01:00
README.md tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00
tls.go formats: Clenaup naming a bit 2023-05-01 13:19:04 +02:00
tls.md tls: Add TLS 1.0, 1.1, 1.2 decode and decryption 2023-03-05 13:52:12 +01:00

README.md

Dev notes

TLS deflate compression seems to actually be zlib, so zlib header + deflate. Also each record is compressed with a flush (trailing 0x00 0x00 0xff 0xff) so that they can be uncompressed individually.

https://lekensteyn.nl/files/wireshark-ssl-tls-decryption-secrets-sharkfest18eu.pdf

tshark -x -V -o tls.keylog_file:file.keylog -r file.pcap

Wireshark gui has TLS debug option to write key/iv etc

tcpdump -i en0 -w file.pcap
SSLKEYLOGFILE=file.keylog /path/to/sslkey-able/curl --http1.1 -tlsv1.2 --tls-max 1.2 -v https://host/path

TLS 1.3 dumps https://gitlab.com/wireshark/wireshark/-/issues/12779