Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libcups: Add interface for logging IPP/HTTP traffic over a http_t connection #8

Open
michaelrsweet opened this issue May 17, 2022 · 1 comment
Labels
enhancement New feature or request priority-low
Milestone

Comments

@michaelrsweet
Copy link
Member

Since Wireshark can't decrypt modern TLS traffic (forward secrecy), it would be nice for ipptool to provide a way to log all traffic going over a connection to a file so that the decrypted data is available for analysis.

@zdohnal
Copy link
Member

zdohnal commented Jan 26, 2023

Hi Mike,

I was able to decrypt TLS connection with Wireshark (3.6.10) +tcpdump with following steps:

Prereq:

  • the uri has to be 'https'
  • invocation of packet sniffer has to happen in the same terminal tab and not from different one nor from launcher, unless you define the variable in ~/.bashrc and restart the terminal

Steps:

$ export SSLKEYLOGFILE=$HOME/Desktop/keylogfile.txt
$ env | grep "SSLKEYLOGFILE"  # has to be defined where you start the command which starts the communication you want to investigate - I made a mistake to run the tcpdump in a different terminal, where the variable wasn't defined
$ sudo tcpdump -s0 -w file.pcap -i any host <printer_ip> &
(reproduce the issue - from the same terminal tab - and end the tcpdump process)
$ ipptool -tv https://192.168.1.1/ipp/print get-printer-attributes.test 

then go to Wireshark -> Edit -> Preferences -> Protocols -> TLS and put the path from env variable to (Pre)-Master-Secret log filename box.

In the end open the captured file in Wireshark and you should see the decrypted packets.

However this is useless if we want to debug real driverless temporary/permanent queue communication, which always uses ipp or ipps - I've asked wireshark upstream whether there is a way how to tackle it https://gitlab.com/wireshark/wireshark/-/issues/18825 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request priority-low
Projects
None yet
Development

No branches or pull requests

2 participants