Skip to content

Commit a3aca72

Browse files
ericlaw1979ericlaw1979
committed
Extract ClientHello and ServerHello
1 parent b1d81a0 commit a3aca72

3 files changed

Lines changed: 102 additions & 8 deletions

File tree

‎FiddlerImportNetlog/FiddlerInterface.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
namespace FiddlerImportNetlog
1010
{
1111
[ProfferFormat("NetLog JSON",
12-
"Chromium's JSON-based event log format (v1.3.2.3). See https://dev.chromium.org/for-testers/providing-network-details for more details.",
12+
"Chromium's JSON-based event log format (v1.3.3.0). See https://dev.chromium.org/for-testers/providing-network-details for more details.",
1313
".json;.gz" // We handle import of JSON files.
1414
)]
1515
public class HTTPArchiveFormatImport : ISessionImporter

‎FiddlerImportNetlog/Importer.cs‎

Lines changed: 97 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,10 @@ struct Magics
4040
public int SEND_BODY;
4141
public int SEND_REQUEST;
4242
public int SSL_CERTIFICATES_RECEIVED;
43+
public int SSL_HANDSHAKE_MESSAGE_SENT;
4344
public int SSL_HANDSHAKE_MESSAGE_RECEIVED;
4445
public int TCP_CONNECT;
46+
public int SOCKET_BYTES_SENT;
4547
public int HOST_RESOLVER_IMPL_REQUEST;
4648
public int HOST_RESOLVER_IMPL_JOB;
4749
public int HOST_RESOLVER_IMPL_PROC_TASK;
@@ -169,8 +171,10 @@ private void ExtractSessionsFromTraceJSON(ArrayList alTraceEvents)
169171
NetLogMagics.SEND_BODY = 20;
170172
NetLogMagics.SEND_REQUEST = 21;
171173
NetLogMagics.SSL_CERTIFICATES_RECEIVED = 22;
172-
NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED = 23;
173-
NetLogMagics.TCP_CONNECT = 24;
174+
NetLogMagics.SSL_HANDSHAKE_MESSAGE_SENT = 23;
175+
NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED = 24;
176+
NetLogMagics.TCP_CONNECT = 25;
177+
NetLogMagics.SOCKET_BYTES_SENT = 26;
174178

175179
NetLogMagics.HOST_RESOLVER_IMPL_REQUEST = 30;
176180
NetLogMagics.HOST_RESOLVER_IMPL_JOB = 31;
@@ -357,8 +361,10 @@ public bool ExtractSessionsFromJSON(Hashtable htFile)
357361

358362
// Socket-level Events
359363
NetLogMagics.SSL_CERTIFICATES_RECEIVED = getIntValue(htEventTypes["SSL_CERTIFICATES_RECEIVED"], -899);
360-
NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED = getIntValue(htEventTypes["SSL_HANDSHAKE_MESSAGE_RECEIVED"], -898);
361-
NetLogMagics.TCP_CONNECT = getIntValue(htEventTypes["TCP_CONNECT"], -897);
364+
NetLogMagics.SSL_HANDSHAKE_MESSAGE_SENT = getIntValue(htEventTypes["SSL_HANDSHAKE_MESSAGE_SENT"], -898);
365+
NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED = getIntValue(htEventTypes["SSL_HANDSHAKE_MESSAGE_RECEIVED"], -897);
366+
NetLogMagics.TCP_CONNECT = getIntValue(htEventTypes["TCP_CONNECT"], -896);
367+
NetLogMagics.SOCKET_BYTES_SENT = getIntValue(htEventTypes["SOCKET_BYTES_SENT"], -895);
362368

363369
// DNS
364370
NetLogMagics.HOST_RESOLVER_IMPL_REQUEST = getIntValue(htEventTypes["HOST_RESOLVER_IMPL_REQUEST"], -799);
@@ -463,7 +469,14 @@ public bool ExtractSessionsFromJSON(Hashtable htFile)
463469
List<Hashtable> events;
464470
int iSocketID = getIntValue(htSource["id"], -1);
465471

472+
/*if (iType == NetLogMagics.SOCKET_BYTES_SENT)
473+
{
474+
FiddlerApplication.Log.LogFormat("!!!! IT WORKED!!!!");
475+
//htParams["bytes"]
476+
}*/
477+
466478
if (iType != NetLogMagics.SSL_CERTIFICATES_RECEIVED &&
479+
iType != NetLogMagics.SSL_HANDSHAKE_MESSAGE_SENT &&
467480
iType != NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED &&
468481
iType != NetLogMagics.TCP_CONNECT) continue;
469482

@@ -713,18 +726,94 @@ private void GenerateSocketListSession(Dictionary<int, List<Hashtable>> dictSock
713726
htThisSocket.Add("Server Certificates", alCerts);
714727
continue;
715728
}
729+
730+
if (iType == NetLogMagics.SSL_HANDSHAKE_MESSAGE_SENT)
731+
{
732+
// https://source.chromium.org/chromium/chromium/src/+/main:third_party/boringssl/src/include/openssl/ssl3.h;l=306;drc=5539ecff898c79b0771340051d62bf81649e448d
733+
int iHandshakeMessageType = getIntValue(htParams["type"], -1);
734+
735+
if ((iHandshakeMessageType != 1/*ClientHello*/)) continue;
736+
737+
// Okay, it's a ClientHello. Log it.
738+
string sBase64Bytes = htParams["bytes"] as string;
739+
if (String.IsNullOrEmpty(sBase64Bytes)) continue;
740+
FiddlerApplication.Log.LogFormat("Saw Handshake Message Sent of type={0}", iHandshakeMessageType);
741+
742+
if (iHandshakeMessageType == 1 /*ClientHello*/)
743+
{
744+
try
745+
{
746+
byte[] arr = Convert.FromBase64String(sBase64Bytes);
747+
748+
MemoryStream oMS = new MemoryStream();
749+
// BUG BUG BUG: HACKERY; we have to construct a fake header here.
750+
oMS.WriteByte(0x16);
751+
oMS.WriteByte(0x3);
752+
oMS.WriteByte(0x3);
753+
oMS.WriteByte(0);
754+
oMS.WriteByte(0x9b);
755+
oMS.Write(arr, 0, arr.Length);
756+
757+
oMS.Position = 0;
758+
string sDesc = Utilities.UNSTABLE_DescribeClientHello(oMS);
759+
//FiddlerApplication.Log.LogFormat("Got ClientHello:\n{0}\n{1}", Utilities.ByteArrayToHexView(arr, 16), sDesc);
760+
761+
var htClientHello = new Hashtable();
762+
htThisSocket.Add("ClientHello", htClientHello);
763+
htClientHello.Add("RAW", sBase64Bytes);
764+
ArrayList arrDesc = new ArrayList(sDesc.Split('\n').Select(s => s.Trim().Replace('\t', ' ')).Where(s => !string.IsNullOrEmpty(s)).Skip(2).ToArray());
765+
htClientHello.Add("Parsed", arrDesc);
766+
}
767+
catch { }
768+
769+
continue;
770+
}
771+
}
772+
716773
// {"params":{"certificates":["-----BEGIN CERTIFICATE-----\nMIINqg==\n-----END CERTIFICATE-----\n","-----BEGIN CERTIFICATE-----\u4\n-----END CERTIFICATE-----\n"]},"phase":0,"source":{"id":789,"type":8},"time":"464074729","type":69},
717774
// Parse out client certificate requests (Type 13==CertificateRequest)
718775
// {"params":{"bytes":"DQA...","type":13},"phase":0,"source":{"id":10850,"type":8},"time":"160915359","type":60(SSL_HANDSHAKE_MESSAGE_RECEIVED)})
719776
if (iType == NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED)
720777
{
778+
// https://source.chromium.org/chromium/chromium/src/+/main:third_party/boringssl/src/include/openssl/ssl3.h;l=306;drc=5539ecff898c79b0771340051d62bf81649e448d
721779
int iHandshakeMessageType = getIntValue(htParams["type"], -1);
722780

723-
if (iHandshakeMessageType != 13/*CertificateRequest*/) continue;
781+
if ((iHandshakeMessageType != 2/*ServerHello*/) &&
782+
(iHandshakeMessageType != 13/*CertificateRequest*/)) continue;
724783

725-
// Okay, it's a CertificateRequest. Log it.
784+
// Okay, it's a ServerHello or CertificateRequest. Log it.
726785
string sBase64Bytes = htParams["bytes"] as string;
727786
if (String.IsNullOrEmpty(sBase64Bytes)) continue;
787+
//FiddlerApplication.Log.LogFormat("Saw Handshake Message Received of type={0}", iHandshakeMessageType);
788+
789+
if (iHandshakeMessageType == 2 /*ServerHello*/)
790+
{
791+
try {
792+
byte[] arr = Convert.FromBase64String(sBase64Bytes);
793+
794+
MemoryStream oMS = new MemoryStream();
795+
// BUG BUG BUG: HACKERY; we have to construct a fake header here.
796+
oMS.WriteByte(0x16);
797+
oMS.WriteByte(0x3);
798+
oMS.WriteByte(0x3);
799+
oMS.WriteByte(0);
800+
oMS.WriteByte(0x9b);
801+
oMS.Write(arr, 0, arr.Length);
802+
803+
oMS.Position = 0;
804+
string sDesc = Utilities.UNSTABLE_DescribeServerHello(oMS);
805+
// FiddlerApplication.Log.LogFormat("Got ServerHello:\n{0}\n{1}", Utilities.ByteArrayToHexView(arr, 16), sDesc);
806+
807+
var htServerHello = new Hashtable();
808+
htThisSocket.Add("ServerHello", htServerHello);
809+
htServerHello.Add("RAW", sBase64Bytes);
810+
ArrayList arrDesc = new ArrayList(sDesc.Split('\n').Select(s => s.Trim().Replace('\t', ' ')).Where(s => !string.IsNullOrEmpty(s)).Skip(2).ToArray());
811+
htServerHello.Add("Parsed", arrDesc);
812+
}
813+
catch {}
814+
815+
continue;
816+
}
728817

729818
// BORING SSL: https://cs.chromium.org/chromium/src/third_party/boringssl/src/ssl/handshake_client.cc?l=1102&rcl=5ce7022394055e183c12368778d361461fe90a6e
730819

@@ -986,7 +1075,9 @@ private void ParseSessionsFromBucket(KeyValuePair<int, List<Hashtable>> kvpUR)
9861075
case "HTTP_TRANSACTION_SEND_REQUEST_BODY": iType = NetLogMagics.SEND_BODY; break;
9871076
case "HTTP_TRANSACTION_SEND_REQUEST": iType = NetLogMagics.SEND_REQUEST; break;
9881077
case "SSL_CERTIFICATES_RECEIVED": iType = NetLogMagics.SSL_CERTIFICATES_RECEIVED; break;
1078+
case "SSL_HANDSHAKE_MESSAGE_SENT": iType = NetLogMagics.SSL_HANDSHAKE_MESSAGE_SENT; break;
9891079
case "SSL_HANDSHAKE_MESSAGE_RECEIVED": iType = NetLogMagics.SSL_HANDSHAKE_MESSAGE_RECEIVED; break;
1080+
case "SOCKET_BYTES_SENT": iType = NetLogMagics.SOCKET_BYTES_SENT; break;
9901081
}
9911082
}
9921083

‎FiddlerImportNetlog/Properties/AssemblyInfo.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[assembly: AssemblyCopyright("Copyright ©2021 Eric Lawrence")]
77
[assembly: System.Resources.NeutralResourcesLanguage("en-US")]
88
[assembly: ComVisible(false)]
9-
[assembly: AssemblyVersion("1.3.2.3")] // ALWAYS UPDATE THE VERSION in the [ProfferFormat] attribute in FiddlerInterface.cs to match!
9+
[assembly: AssemblyVersion("1.3.3.0")] // ALWAYS UPDATE THE VERSION in the [ProfferFormat] attribute in FiddlerInterface.cs to match!
1010
[assembly: Fiddler.RequiredVersion("4.6.0.0")]
1111

1212

@@ -20,6 +20,9 @@ HTTP_STREAM_JOB has a binding between the request and the socket. Hook them up s
2020
--> source_dependency = 1701 (URL_REQUEST)
2121
*/
2222

23+
// v1.3.3.0
24+
// Add ClientHello and ServerHello to SecureSocket list
25+
2326
// v1.3.2.3
2427
// Add more traffic_annotation values
2528

0 commit comments

Comments
 (0)