Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10984] SSL Decrypted Packet Not Decoded As HTTP

[bugzilla-daemon@xxxxxxxxxxxxx]

Peter Wu changed bug 10984

What	Removed	Added
Status	UNCONFIRMED	CONFIRMED
Ever confirmed		1

Comment # 3 on bug 10984 from Peter Wu

WORKAROUND
Modifying the HTTP dissector - for example with -o http.ssl.port:443,443 -
makes the HTTP dissector work again.

PROBLEM
The SPDY and HTTP dissectors share the same port and ssl_dissector_register can
only handle one protocol:

association_find: TCP port 443 found 0x603000091600
ssl_association_remove removing TCP 443 - http handle 0x60300004fe40
association_add TCP port 443 protocol spdy handle 0x60300007ea00

This is problematic. It happens to work because the HTTP dissector registers
with the SSL dissector again whenever a setting becomes different than the
default (by disabling compression for example).

command (I could not reproduce it with my default profile even with compression
disabled):
HOME=/does/not/exist \
gdb -q --args tshark -r https_example_com.pcapng \
    -o ssl.keylog_file:premaster.txt

The ssl_dissector_add API is probably flawed if it cannot handle multiple
protocols for the same port. Let me think about it. Btw, when ALPN is
available, then SPDY does not need the ssl_dissector_add call, but we cannot
count on this extension being available for older captures.

---

      You are receiving this mail because:

• You are watching all bug changes.