public TlsConversationModelBuilder(TlsConversationContext modelContext) { m_conversationModel = new TlsConversationModel { Records = new List <TlsRecordModel>() }; modelContext.Add(m_conversationModel); m_modelContext = modelContext; }
static void Main(string[] args) { if (args.Length != 2) { PrintUsage(); return; } var modelContext = TlsConversationContext.CreateInMemory(); if (String.Equals("extract", args[0], StringComparison.InvariantCultureIgnoreCase)) { var filepath = args[1]; var frameKeyProvider = new FrameKeyProvider(); var keyFile = Path.ChangeExtension(filepath, "key"); var secretMap = File.Exists(keyFile) ? TlsMasterSecretMap.LoadFromFile(keyFile): new TlsMasterSecretMap(); var packets = FastPcapFileReaderDevice.ReadAll(args[1]).Select((p, i) => (Key: frameKeyProvider.GetKey(p), Value: (Meta: new PacketMeta { Number = i + 1, Timestamp = p.Timestamp }, Packet: p))); var flows = from packet in packets group packet by packet.Key; var conversations = TcpStreamConversation.CreateConversations(flows.ToDictionary(x => x.Key, x => x.Select(y => y.Value))); foreach (var conversation in conversations) { var modelBuilder = new TlsConversationModelBuilder(modelContext); var decoderBuilder = new TlsDecoderBuilder(); var processor = new TlsSessionProcessor(modelBuilder, decoderBuilder); processor.ProcessConversation(conversation); var model = modelBuilder.ToModel(); modelContext.SaveChanges(); var tlsDecoder = decoderBuilder.ToDecoder(); var masterSecret = secretMap.GetMasterSecret(ByteString.ByteArrayToString(tlsDecoder.ClientRandom)); if (masterSecret != null) { tlsDecoder.MasterSecret = ByteString.StringToByteArray(masterSecret); var tlsSecurityParameters = TlsSecurityParameters.Create(tlsDecoder.ProtocolVersion, tlsDecoder.CipherSuite.ToString(), tlsDecoder.Compression); tlsDecoder.InitializeKeyBlock(tlsSecurityParameters); // USE TLS DECODER DumpConversationContent(tlsDecoder, conversation, processor.ClientDataRecords, processor.ServerDataRecords); } } CsvFeatureWriter.WriteCsv(Path.ChangeExtension(filepath, "csv"), modelContext); } }