rusticata/tls-parser

The way to extract SNI info

K-Rintaro opened this issue · 0 comments

I am trying to extract the SNI information from the raw packet (client hello packet) data, and I tried some patterns. However, I could not understand how to do so, and I would really appreciate it if you could tell me about it. As far as I read the document and other dependencies, TlsClientHelloContents seems to be useful, but I am not sure.
screenshot 2024-06-24 155337

My code is below:

use tls_parser::parse_tls_plaintext;
use tls_parser::nom::{Err};

fn main() {
let res = parse_tls_plaintext(&packet); //&packet is the raw packet (client hello packet) data from pnet
match res {
    Ok((_rem,record)) => {
        println!("{:?}", record);
    },
    Err(Err::Incomplete(_needed)) => {
        eprintln!("Defragmentation required (TLS record)");
    },
    Err(e) => { eprintln!("parse_tls_record_with_header failed: {:?}",e); }
}
}

Result:

parse_tls_record_with_header failed: Error(Error { input: [here is the raw packet data], code: TooLarge })

I am sorry for taking your time.