in pcap-cli/internal/transformer/json_tls_translator.go [29:106]
func (t *JSONPcapTranslator) translateTLSLayer_decodeClientHello(hs cryptobyte.String, TLS *gabs.Container) {
ch := make(map[string]interface{}, 4)
ch["type"] = "ClientHello"
var clientHello cryptobyte.String
hs.ReadUint24LengthPrefixed(&clientHello)
var legacyVersion uint16
clientHello.ReadUint16(&legacyVersion)
ch["legacy_version"] = layers.TLSVersion(legacyVersion).String()
// var random []byte
// clientHello.ReadBytes(&random, 32)
// ch.Set(random, "random")
// var legacySessionID []byte
// clientHello.ReadUint8LengthPrefixed((*cryptobyte.String)(&legacySessionID))
// ch.Set(legacySessionID, "legacy_session_id")
clientHello.Skip(33)
var ciphersuitesBytes cryptobyte.String
clientHello.ReadUint16LengthPrefixed(&ciphersuitesBytes)
var ciphers []uint16
for !ciphersuitesBytes.Empty() {
var ciphersuite uint16
ciphersuitesBytes.ReadUint16(&ciphersuite)
ciphers = append(ciphers, ciphersuite)
}
ch["ciphers"] = ciphers
var legacyCompressionMethods []uint8
clientHello.ReadUint8LengthPrefixed((*cryptobyte.String)(&legacyCompressionMethods))
ch["legacy_compression_methods"] = legacyCompressionMethods
var extensionsBytes cryptobyte.String
clientHello.ReadUint16LengthPrefixed(&extensionsBytes)
var extensions []map[string]interface{}
for !extensionsBytes.Empty() {
var extType uint16
extensionsBytes.ReadUint16(&extType)
ext := make(map[string]interface{}, 3)
ext["type"] = extType
var extData cryptobyte.String
extensionsBytes.ReadUint16LengthPrefixed(&extData)
switch extType {
default:
ext["name"] = "UNKNOWN"
case 0: // Server Name
ext["name"] = "server_name"
extData.Skip(5)
ext["data"] = string(extData)
case 16: // ALPN
ext["name"] = "application_layer_protocol_negotiation"
var alpnData cryptobyte.String
extData.ReadUint16LengthPrefixed(&alpnData)
var data []string
for !alpnData.Empty() {
var length uint8
alpnData.ReadUint8(&length)
var proto []byte
alpnData.ReadBytes(&proto, int(length))
data = append(data, string(proto))
}
ext["data"] = data
}
extensions = append(extensions, ext)
}
ch["extensions"] = extensions
TLS.SetP(ch, "data.client_hello")
}