scapy.layers.tls.record_tls13

Common TLS 1.3 fields & bindings.

This module covers the record layer, along with the ChangeCipherSpec, Alert and ApplicationData submessages. For the Handshake type, see tls_handshake.py.

See the TLS class documentation for more information.

class scapy.layers.tls.record_tls13.TLS13(*args, **kargs)

Bases: scapy.layers.tls.session._GenericTLSSessionInheritance

aliastypes
deciphered_len
do_dissect_payload(s)

Try to dissect the following data as a TLS message. Note that overloading .guess_payload_class() would not be enough, as the TLS session to be used would get lost.

fields_desc
Display RFC-like schema
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      TYPE     |            VERSION            |      LEN      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |             INNER             |    AUTH TAG   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |
+-+-+-+-+-+-+-+-+

                            Fig. TLS13                            
TLS13 fields

type

ByteEnumField

23

version

_TLSVersionField

771

len

_TLSLengthField

None

inner

_TLSInnerPlaintextField

<TLSInnerPlaintext  |>

auth_tag

_TLSMACField

None

post_build(pkt, pay)

Apply the previous methods according to the writing cipher type.

post_dissect(s)

Commit the pending read state if it has been triggered. We update nothing if the prcs was not set, as this probably means that we’re working out-of-context (and we need to keep the default rcs).

pre_dissect(s)

Decrypt, verify and decompress the message.

class scapy.layers.tls.record_tls13.TLSInnerPlaintext(*args, **kargs)

Bases: scapy.layers.tls.session._GenericTLSSessionInheritance

aliastypes
fields_desc
Display RFC-like schema
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              MSG              |      TYPE     |      PAD      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               |
+-+-+-+-+-+-+-+-+

                      Fig. TLSInnerPlaintext                      
TLSInnerPlaintext fields

msg

_TLSMsgListField

[]

type

ByteEnumField

None

pad

XStrField

b''

pre_dissect(s)

We need to parse the padding and type as soon as possible, else we won’t be able to parse the message list…