Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decode PVA in TLS via ALPN #14

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Decode PVA in TLS via ALPN #14

wants to merge 1 commit into from

Conversation

mdavidsaver
Copy link
Owner

Add decoding of PVA within TLS using the tls.alpn table provisionally using pva/1 as the protocol name string.

The test/pva-tls.pcapng.gz capture contains a TLS 1.3 session with the associated session keys embedded to it. So it can be dissected like any other capture.

wireshark -X lua_script:pva.lua test/pva-tls.pcapng.gz

The process to capture and embed session keys was:

wireshark -X lua_script:pva.lua &   # save capture as /tmp/pva.pcapng.gz
SSLKEYLOGFILE=/tmp/pva-secrets pvget ...
editcap --inject-secrets tls,/tmp/pva-secrets /tmp/pva.pcapng.gz test/pva-tls.pcapng.gz

Alternately, the raw capture and keylog can be analyzed separately. (the keylog path can also be set through the GUI)

wireshark -X lua_script:pva.lua -o tls.keylog_file:/tmp/pva-secrets /tmp/pva.pcapng.gz

@kasemir @george-mcintyre To my mind, this wireshark feature along is sufficient to justify using the ALPN extension.

see https://wiki.wireshark.org/TLS

@mdavidsaver
Copy link
Owner Author

Updated test/pva-tls.pcapng.gz with a session using client certificate and intermediate CA.

@mdavidsaver mdavidsaver mentioned this pull request Aug 17, 2023
19 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant