scapy.layers.tls.record_tls13

Common TLS 1.3 fields & bindings.

This module covers the record layer, along with the ChangeCipherSpec, Alert and ApplicationData submessages. For the Handshake type, see tls_handshake.py.

See the TLS class documentation for more information.

class scapy.layers.tls.record_tls13.TLS13(*args, **kargs)

Bases: scapy.layers.tls.session._GenericTLSSessionInheritance

aliastypes

deciphered_len

do_dissect_payload(s)

Try to dissect the following data as a TLS message. Note that overloading .guess_payload_class() would not be enough, as the TLS session to be used would get lost.

fields_desc

Display RFC-like schema

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      TYPE     |            VERSION            |      LEN      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |             INNER             |    AUTH TAG   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |
+-+-+-+-+-+-+-+-+

                            Fig. TLS13                            

TLS13 fields

type	ByteEnumField	23
version	_TLSVersionField	771
len	_TLSLengthField	None
inner	_TLSInnerPlaintextField	<TLSInnerPlaintext  |>
auth_tag	_TLSMACField	None

post_build(pkt, pay)

Apply the previous methods according to the writing cipher type.

post_dissect(s)

Commit the pending read state if it has been triggered. We update nothing if the prcs was not set, as this probably means that we’re working out-of-context (and we need to keep the default rcs).

pre_dissect(s)

Decrypt, verify and decompress the message.

class scapy.layers.tls.record_tls13.TLSInnerPlaintext(*args, **kargs)

Bases: scapy.layers.tls.session._GenericTLSSessionInheritance

aliastypes

fields_desc

Display RFC-like schema

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              MSG              |      TYPE     |      PAD      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |
+-+-+-+-+-+-+-+-+

                      Fig. TLSInnerPlaintext                      

TLSInnerPlaintext fields

msg	_TLSMsgListField	[]
type	ByteEnumField	None
pad	XStrField	b''

pre_dissect(s)

We need to parse the padding and type as soon as possible, else we won’t be able to parse the message list…