TLS defragmentation doesn't work properly #4085
Description
Brief description
Hi,
I encountered a couple of TLS parsing issues with this pcap file.
There are three (fragmented) TLS sessions. The first is a TLS 1.3 Session Resumption and the other two perform a full TLS 1.2 handshake.
sniff(offline=test.pcap, session=TLSSession) doesn't get the two Certificate messages as the packets are fragmented. But it parses all three ServerHello messages correctly. This is all expected behaviour I guess.
sniff(offline=test.pcap, session=TLS_over_TCP) only gets the Certificate message of the third TLS session and doesn't parse any of the ServerHello messages in the pcap file.
If you require any more information please let me know.
Cheers,
stulle123
Scapy version
2.5.0
Python version
3.11.3
Operating system
macOS 12.6
Additional environment information
No response
How to reproduce
from scapy.layers.inet import TCP
from scapy.layers.tls.record import TLS
from scapy.layers.tls.session import TLSSession
from scapy.main import load_layer
from scapy.sendrecv import sniff
from scapy.sessions import TCPSession
load_layer("tls")
class TLS_over_TCP(TLSSession, TCPSession):
pass
"""First TLS Session
"""
# ServerHello parsed properly with TLSSession
capture = sniff(offline="test.pcap", session=TLSSession)
server_hello = capture[5]
print(server_hello.summary())
# ServerHello NOT parsed with TLS_over_TCP
capture = sniff(offline="test.pcap", session=TLS_over_TCP)
print(capture[5].summary())
"""Second TLS Session
"""
# Certificate parsed as _TLSEncryptedContent with TLSSession
capture = sniff(offline="test.pcap", session=TLSSession)
tls_record = capture[24][TLS]
cert_raw = tls_record[3]
# cert_raw.show()
# Certificate NOT parsed with TLS_over_TCP
capture = sniff(offline="test.pcap", session=TLS_over_TCP)
capture[24].show()
"""Third TLS Session
"""
# Certificate parsed properly with TLS_over_TCP
capture = sniff(offline="test.pcap", session=TLS_over_TCP)
print(capture[43].summary())Actual result
No response
Expected result
No response
Related resources
No response