Skip to content

pcapgo: add read/write support for Decryption Secrets Block (DSB). #1042

Open
cfc4n wants to merge 2 commits intogoogle:masterfrom
cfc4n:master
Open

pcapgo: add read/write support for Decryption Secrets Block (DSB). #1042
cfc4n wants to merge 2 commits intogoogle:masterfrom
cfc4n:master

Conversation

@cfc4n
Copy link
Copy Markdown

@cfc4n cfc4n commented Aug 5, 2022

Support reading and writing pcapng files with DSBs.
the same as https//github.com/wireshark/wireshark

The TLS dissector will be updated in the future to make use of these secrets.
pcapng spec update: IETF-OPSAWG-WG/draft-ietf-opsawg-pcap#54

DSB block format:

                        1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 0 |                   Block Type = 0x0000000A                     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 4 |                      Block Total Length                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 8 |                          Secrets Type                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
12 |                         Secrets Length                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
16 /                                                               /
   /                          Secrets Data                         /
   /              (variable length, padded to 32 bits)             /
   /                                                               /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   /                                                               /
   /                       Options (variable)                      /
   /                                                               /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   /                       Block Total Length                      /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Use Case:
gojue/ecapture#153

@google-cla
Copy link
Copy Markdown

google-cla bot commented Aug 5, 2022

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

A Decryption Secrets Block (DSB) stores (session) secrets that enable decryption of packets within the capture file.

see https://github.com/pcapng/pcapng/blob/master/draft-tuexen-opsawg-pcapng.md for more info.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@stv0g
Copy link
Copy Markdown

stv0g commented Aug 18, 2022

LGTM. We need this as well.

@gconnell Any chance to get this merged?

@mosajjal
Copy link
Copy Markdown

hey there. feel free to move this to the new fork (gopacket/gopacket) and I'll take a look at it.

@stv0g
Copy link
Copy Markdown

stv0g commented Aug 22, 2022

@mosajjal I create another PR in the fork.

Could you briefly elaborate why there is a fork? Or why there is a need for one?
I couldnt find any note or issue in the new repo explaining it.

@stv0g
Copy link
Copy Markdown

stv0g commented Aug 22, 2022

Nevermind, I found #1016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants