SSL Dissector working

Question

Hi,

I wanted to know if every time i select a new SSL packet is the packet decrypted and dissected again. To be clearer If I give Wireshark the necessary info such as the session key and the client random the ssl stream is decrypted. Does this happen every time the packet is selected or it just happens once and we keep the whole decrypted frame?

My intuition says it must be the Decrypted every time as keeping a decrypted record for every packet sounds impractical. Can someone please comment on this? Thanks

-Koundi

Accepted Answer

Once the TLS record is decrypted, it will be cached for future use.

Basically it works like this:

The first time a packet is seen, decryption is tried. If the packet is visited again later (because you select the packet for example), it will be skipped. From the dissect_ssl function:
```
/* try decryption only the first time we see this packet
 * (to keep cipher synchronized) */
if (pinfo->fd->flags.visited)
     ssl_session = NULL;
```

Function dissect_ssl3_record will try to decrypt the record if the SslDecryptSession pointer is still valid (here, ssl is the same as ssl_session above).

    if (ssl){
        decrypt_ssl3_record(tvb, pinfo, offset,
            record_length, content_type, ssl, TRUE);
    }
    ...
    dissect_ssl_payload(tvb, pinfo, offset, tree, session, app_handle);

Function decrypt_ssl3_record will try to decrypt the data and then calls ssl_add_data_info to cache the result (on success). Note that this is only invoked the first time.
Function dissect_ssl_payload will try to load the decrypted data via ssl_get_data_info. This may be invoked multiple times for the same packet.