Scapy：处理部分TLS段

不知道是否有更好的解决方案，但这是我为解决问题所做的工作。累积的帧大小似乎与Wireshark从多个数据包重组TLS帧时的行为一致。

注意
：此解决方案假定没有错误排序的数据包或重复。此外，此处显示的解决方案也不完整。以下代码仅显示当TLS帧跨越单个TCP流的多个IP数据包时如何累积TLS帧。请遵循Janus的建议（在下面的评论中提到），或提出自己的解决方案以累积不同的流。

def extractDataFromPcap(pcapfile):  load_layer("tls")  try:    reader = PcapReader(pcapfile)    # tls frame accumulation related variables.    tls_accumulate = False    tls_leftover_len = 0    tls_blist = list()    for pkt in reader:      try:        if tls_accumulate and pkt.haslayer(TCP):          ip_tcp_hdr_overhead = ((pkt[IP].ihl*4) + (pkt[TCP].dataofs*4))          pkt_payload_len = (pkt[IP].len - ip_tcp_hdr_overhead)          tls_leftover_len = (tls_leftover_len - pkt_payload_len)          tls_blist.append(raw(pkt[TCP].payload))          if tls_leftover_len <= 0: # got complete TLS frame tls_raw_bytes = b''.join(tls_blist) # parse accumulated frame. tls = TLS(tls_raw_bytes) #... process tls object # reset accumlation variables. tls_accumulate = False tls_leftover_len = 0 tls_blist = list()          else: continue        if pkt.haslayer(TCP) and pkt.haslayer(TLS):          if not tls_accumulate: # Process new TLS frame. # Pkt over head: ip-hdr-len + tcp-hdr-len ip_tcp_hdr_overhead = ((pkt[IP].ihl*4) + (pkt[TCP].dataofs*4)) pkt_payload_len = (pkt[IP].len - ip_tcp_hdr_overhead) if pkt[TLS].len > pkt_payload_len:   # partial TLS frame. Start accumulating.   tls_accumulate = True   tls_leftover_len = (pkt[TLS].len - pkt_payload_len)   tls_blist.append(raw(pkt[TCP].payload)) else:   # complete TLS frame   # ... process complete TLS frame       except Exception as error:        pkt.show()        print("tcp-processing error: %s", error)        sys.exit(-1)  except Exception as error:    print("packet processing error: %s", error)    sys.exit(-1)