I want to parse the Client Hello message of the TLS handshake record. I was taking a look at a code in Github that was very helpful and used dpkt library in order to parse the packets. The code is clear but I have a question about a part of the code that you can find below:
def parse_client_hello(handshake):
hello = handshake.data
compressions = []
cipher_suites = []
extensions = []
payload = handshake.data.data
session_id, payload = unpacker('p', payload)
cipher_suites, pretty_cipher_suites = parse_extension(payload, 'cipher_suites')
verboseprint('TLS Record Layer Length: {0}'.format(len(handshake)))
verboseprint('Client Hello Version: {0}'.format(dpkt.ssl.ssl3_versions_str[hello.version]))
verboseprint('Client Hello Length: {0}'.format(len(hello)))
verboseprint('Session ID: {0}'.format(hexlify(session_id)))
print('[*] Ciphers: {0}'.format(pretty_cipher_suites))
def unpacker(type_string, packet):
"""
Returns network-order parsed data and the packet minus the parsed data.
"""
if type_string.endswith('H'):
length = 2
if type_string.endswith('B'):
length = 1
if type_string.endswith('P'): # 2 bytes for the length of the string
length, packet = unpacker('H', packet)
type_string = '{0}s'.format(length)
if type_string.endswith('p'): # 1 byte for the length of the string
length, packet = unpacker('B', packet)
type_string = '{0}s'.format(length)
data = struct.unpack('!' + type_string, packet[:length])[0]
if type_string.endswith('s'):
data = ''.join(data)
return data, packet[length:]
My question is about the unpacker() function that it is used in oder to parse information about the Client Hello such as : Cipher suites,compressions.
I don't understand what is the purpose of this function,what it does?
I also wanted to know if I can use dpkt.ssl.TLSClientHello insted of the unpacker() function in order to extract Client Hello information such as Cipher suites,compressions etc?
