diff options
author | Pierre Lalet <pierre@droids-corp.org> | 2018-01-20 00:21:30 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-01-20 00:21:30 +0100 |
commit | eab6e0eaf5bbc097befb22a994277114556fa24b (patch) | |
tree | 9c8c1927db10e0ed7147445aaac886c9eeb2227b | |
parent | 379ff7b79b60b45b1568972934d31ac89a72ca2b (diff) | |
parent | f91eae081d39becebea4de50ed4a4a7e2ea6a4c3 (diff) | |
download | scapy-eab6e0eaf5bbc097befb22a994277114556fa24b.tar.gz |
Merge pull request #1065 from gpotter2/tls-cont
TLS continuous data
-rw-r--r-- | scapy/layers/tls/record.py | 5 | ||||
-rw-r--r-- | test/tls.uts | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/scapy/layers/tls/record.py b/scapy/layers/tls/record.py index aa44d9d4..f2d50247 100644 --- a/scapy/layers/tls/record.py +++ b/scapy/layers/tls/record.py @@ -288,6 +288,11 @@ class TLS(_GenericTLSSessionInheritance): if s.rcs and not isinstance(s.rcs.cipher, Cipher_NULL): from scapy.layers.tls.record_tls13 import TLS13 return TLS13 + if _pkt and len(_pkt) < 5: + # Layer detected as TLS but too small to be a real packet (len<5). + # Those packets appear when sessions are interrupted or to flush buffers. + # Scapy should not try to decode them + return conf.raw_layer return TLS ### Parsing methods diff --git a/test/tls.uts b/test/tls.uts index 84ce41bd..ffaf6903 100644 --- a/test/tls.uts +++ b/test/tls.uts @@ -968,6 +968,9 @@ assert(not t7.pad and not t7.padlen) assert(isinstance(t7.msg[0], _TLSEncryptedContent)) len(t7.msg[0].load) == 478 += Reading TLS msg dissect - Packet too small +assert isinstance(TLS(b"\x00"), Raw) + = Reading TLS msg dissect - Wrong data from scapy.layers.tls.record import _TLSMsgListField assert isinstance(_TLSMsgListField.m2i(_TLSMsgListField("", []), TLS(type=0), '\x00\x03\x03\x00\x03abc'), Raw) |