Merge pull request #1065 from gpotter2/tls-cont

TLS continuous data

2 files changed, 8 insertions, 0 deletions

diff --git a/scapy/layers/tls/record.py b/scapy/layers/tls/record.py
index aa44d9d4..f2d50247 100644
--- a/scapy/layers/tls/record.py
+++ b/scapy/layers/tls/record.py
@@ -288,6 +288,11 @@ class TLS(_GenericTLSSessionInheritance):
                     if s.rcs and not isinstance(s.rcs.cipher, Cipher_NULL):
                         from scapy.layers.tls.record_tls13 import TLS13
                         return TLS13
+        if _pkt and len(_pkt) < 5:
+                # Layer detected as TLS but too small to be a real packet (len<5).
+                # Those packets appear when sessions are interrupted or to flush buffers.
+                # Scapy should not try to decode them
+            return conf.raw_layer
         return TLS
 
     ### Parsing methods
diff --git a/test/tls.uts b/test/tls.uts
index 84ce41bd..ffaf6903 100644
--- a/test/tls.uts
+++ b/test/tls.uts
@@ -968,6 +968,9 @@ assert(not t7.pad and not t7.padlen)
 assert(isinstance(t7.msg[0], _TLSEncryptedContent))
 len(t7.msg[0].load) == 478
 
+= Reading TLS msg dissect - Packet too small
+assert isinstance(TLS(b"\x00"), Raw)
+
 = Reading TLS msg dissect - Wrong data
 from scapy.layers.tls.record import _TLSMsgListField
 assert isinstance(_TLSMsgListField.m2i(_TLSMsgListField("", []), TLS(type=0), '\x00\x03\x03\x00\x03abc'), Raw)