Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dissection of TLS handshake for OpenVPN #2254

Open
IvanNardi opened this issue Jan 11, 2024 · 0 comments
Open

Add dissection of TLS handshake for OpenVPN #2254

IvanNardi opened this issue Jan 11, 2024 · 0 comments

Comments

@IvanNardi
Copy link
Collaborator

It seems feasible, but not trivial for the general case.

Critical points:

  • there is no standard way to know if there will be a TLS handshake (unlike FTP where we have AUTH TLS message or IMAP with STARTTLS). We need some kind of heuristic: with some luck we might reuse the ones that we are already using for OpenVPN detection in the first place
  • fragmentation: TLS messages might be split in fragments (in the same UDP packet, or in different ones). nDPI lacks a generic way to reassemble data
  • classification results: OpenVPN/TLS? What if we have a TLS subclassification via SNI or certificate? TLS/SUB_PROTOCOL, losing the information about OpenVPN? Please, note that (with the current logic/code) we need to have TLS in the result, because we write to flow->protos.tls_quic
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant