public void SetServerHello(TlsPacket.TlsServerHello serverHello, TlsPacketContext packetContext) { m_tlsDecoder.ProtocolVersion = TlsSecurityParameters.GetSslProtocolVersion(serverHello.Version.Major, serverHello.Version.Minor); m_tlsDecoder.ServerRandom = ByteString.Combine(serverHello.Random.RandomTime, serverHello.Random.RandomBytes); m_tlsDecoder.CipherSuite = (TlsCipherSuite)serverHello.CipherSuite.CipherId; m_tlsDecoder.Compression = serverHello.CompressionMethod; }
public void SetServerHello(TlsPacket.TlsServerHello serverHello, TlsPacketContext packetContext) { m_conversationModel.Version = TlsSecurityParameters.GetSslProtocolVersion(serverHello.Version.Major, serverHello.Version.Minor).ToString(); m_conversationModel.SessionId = ByteString.ByteArrayToString(serverHello.SessionId.Sid); m_conversationModel.ServerRandom = ByteString.ByteArrayToString(serverHello.Random.RandomBytes); m_conversationModel.ServerCipherSuite = $"{(TlsCipherSuite)serverHello.CipherSuite.CipherId}"; m_conversationModel.ServerExtensions = GetExtensions(serverHello.Extensions); }
static void Main(string[] args) { if (args.Length != 2) { PrintUsage(); return; } var modelContext = TlsConversationContext.CreateInMemory(); if (String.Equals("extract", args[0], StringComparison.InvariantCultureIgnoreCase)) { var filepath = args[1]; var frameKeyProvider = new FrameKeyProvider(); var keyFile = Path.ChangeExtension(filepath, "key"); var secretMap = File.Exists(keyFile) ? TlsMasterSecretMap.LoadFromFile(keyFile): new TlsMasterSecretMap(); var packets = FastPcapFileReaderDevice.ReadAll(args[1]).Select((p, i) => (Key: frameKeyProvider.GetKey(p), Value: (Meta: new PacketMeta { Number = i + 1, Timestamp = p.Timestamp }, Packet: p))); var flows = from packet in packets group packet by packet.Key; var conversations = TcpStreamConversation.CreateConversations(flows.ToDictionary(x => x.Key, x => x.Select(y => y.Value))); foreach (var conversation in conversations) { var modelBuilder = new TlsConversationModelBuilder(modelContext); var decoderBuilder = new TlsDecoderBuilder(); var processor = new TlsSessionProcessor(modelBuilder, decoderBuilder); processor.ProcessConversation(conversation); var model = modelBuilder.ToModel(); modelContext.SaveChanges(); var tlsDecoder = decoderBuilder.ToDecoder(); var masterSecret = secretMap.GetMasterSecret(ByteString.ByteArrayToString(tlsDecoder.ClientRandom)); if (masterSecret != null) { tlsDecoder.MasterSecret = ByteString.StringToByteArray(masterSecret); var tlsSecurityParameters = TlsSecurityParameters.Create(tlsDecoder.ProtocolVersion, tlsDecoder.CipherSuite.ToString(), tlsDecoder.Compression); tlsDecoder.InitializeKeyBlock(tlsSecurityParameters); // USE TLS DECODER DumpConversationContent(tlsDecoder, conversation, processor.ClientDataRecords, processor.ServerDataRecords); } } CsvFeatureWriter.WriteCsv(Path.ChangeExtension(filepath, "csv"), modelContext); } }