TLS 1.3 の packet を見てみた

TLS 1.3 パケット見てみるをシリーズ化する目標。

1. [Client Hello](https://qiita.com/uturned0/items/44092e09321099506131?utm_campaign=post_article&utm_medium=twitter&utm_source=twitter_share)
1. [Hello Retry Request, Change Cipher Spec](https://qiita.com/uturned0/items/537368b4d4b8ffe52b19)
1. [Change Cipher Spec, Client Hello](https://qiita.com/uturned0/items/4cb10d019acc067e373b)
1. [Server Hello](https://qiita.com/uturned0/items/765d7e66261987f58883)
1. [Server Hello 書き直し](https://qiita.com/uturned0/items/775db3d08c8a46c75d50)
1. [Certificate, Certificate Verify, Finished](https://qiita.com/uturned0/items/cdb5e43438f1894c722a)
1. [Application Data]()
1. [Finished](https://qiita.com/uturned0/items/9dbbe63d05d4f2889a4d)

うーん。こう見ると、複数のTLS record typeが混ざってんだな・・


# request

mac chromeで example.com を開いた. HTTP/2 で取得してた。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/24737/35226b10-214f-5e27-4d23-eaa02db0818e.png)



# all packets(暗号化を解いた場合）

wireshark+chromeで複合した場合の見え方

https://qiita.com/uturned0/items/bbff862b64d689a542ad

| ar      | Length | src port | dst port | RTO | Source      | Destination | Protocol | Info                                                                                                                                 |
| ------- | ------ | -------- | -------- | --- | ----------- | ----------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| 03:04.3 | 78     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[SYN\] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 TSval=734761486 TSecr=0 SACK\_PERM=1                                      |
| 03:04.4 | 74     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[SYN, ACK\] Seq=0 Ack=1 Win=65535 Len=0 MSS=1414 SACK\_PERM=1 TSval=1367443020 TSecr=734761486 WS=512                 |
| 03:04.4 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=1 Ack=1 Win=131776 Len=0 TSval=734761583 TSecr=1367443020                                                  |
| 03:04.4 | 583    | 49236    | 443      | CS0 | localhost   | example.com | TLSv1.3  | Client Hello                                                                                                                         |
| 03:04.5 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=1 Ack=518 Win=67072 Len=0 TSval=1367443118 TSecr=734761583                                                 |
| 03:04.5 | 165    | 443      | 49236    | CS0 | example.com | localhost   | TLSv1.3  | Hello Retry Request, Change Cipher Spec                                                                                              |
| 03:04.5 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=518 Ack=100 Win=131648 Len=0 TSval=734761673 TSecr=1367443118                                              |
| 03:04.5 | 409    | 49236    | 443      | CS0 | localhost   | example.com | TLSv1.3  | Change Cipher Spec, Client Hello                                                                                                     |
| 03:04.6 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=100 Ack=861 Win=68096 Len=0 TSval=1367443216 TSecr=734761673                                               |
| 03:04.6 | 1468   | 443      | 49236    | CS0 | example.com | localhost   | TLSv1.3  | Server Hello, Encrypted Extensions                                                                                                   |
| 03:04.6 | 1468   | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[PSH, ACK\] Seq=1502 Ack=861 Win=68096 Len=1402 TSval=1367443217 TSecr=734761673 \[TCP segment of a reassembled PDU\] |
| 03:04.6 | 1423   | 443      | 49236    | CS0 | example.com | localhost   | TLSv1.3  | Certificate, Certificate Verify, Finished                                                                                            |
| 03:04.6 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=861 Ack=2904 Win=128832 Len=0 TSval=734761766 TSecr=1367443217                                             |
| 03:04.6 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=861 Ack=4261 Win=127488 Len=0 TSval=734761766 TSecr=1367443217                                             |
| 03:04.6 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | \[TCP Window Update\] 49236  >  443 \[ACK\] Seq=861 Ack=4261 Win=131072 Len=0 TSval=734761766 TSecr=1367443217                       |
| 03:04.6 | 140    | 49236    | 443      | CS0 | localhost   | example.com | TLSv1.3  | Finished                                                                                                                             |
| 03:04.6 | 158    | 49236    | 443      | CS0 | localhost   | example.com | HTTP2    | Magic, SETTINGS\[0\], WINDOW\_UPDATE\[0\]                                                                                            |
| 03:04.6 | 534    | 49236    | 443      | CS0 | localhost   | example.com | HTTP2    | HEADERS\[1\]: GET /                                                                                                                  |
| 03:04.7 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=4261 Ack=935 Win=68096 Len=0 TSval=1367443321 TSecr=734761772                                              |
| 03:04.7 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=4261 Ack=1027 Win=68096 Len=0 TSval=1367443321 TSecr=734761772                                             |
| 03:04.7 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=4261 Ack=1495 Win=69120 Len=0 TSval=1367443321 TSecr=734761772                                             |
| 03:04.7 | 321    | 443      | 49236    | CS0 | example.com | localhost   | TLSv1.3  | New Session Ticket                                                                                                                   |
| 03:04.7 | 321    | 443      | 49236    | CS0 | example.com | localhost   | TLSv1.3  | New Session Ticket                                                                                                                   |
| 03:04.7 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=1495 Ack=4516 Win=130816 Len=0 TSval=734761864 TSecr=1367443321                                            |
| 03:04.7 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=1495 Ack=4771 Win=130560 Len=0 TSval=734761864 TSecr=1367443321                                            |
| 03:04.7 | 193    | 443      | 49236    | CS0 | example.com | localhost   | HTTP2    | WINDOW\_UPDATE\[0\]                                                                                                                  |
| 03:04.7 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=1495 Ack=4898 Win=130432 Len=0 TSval=734761864 TSecr=1367443321                                            |
| 03:04.7 | 982    | 443      | 49236    | CS0 | example.com | localhost   | HTTP2    | DATA\[1\]                                                                                                                            |
| 03:04.7 | 66     | 49236    | 443      | CS0 | localhost   | example.com | TCP      | 49236  >  443 \[ACK\] Seq=1495 Ack=5814 Win=129472 Len=0 TSval=734761864 TSecr=1367443322                                            |
| 03:04.7 | 97     | 49236    | 443      | CS0 | localhost   | example.com | HTTP2    | SETTINGS\[0\]                                                                                                                        |
| 03:04.9 | 66     | 443      | 49236    | CS0 | example.com | localhost   | TCP      | 443  >  49236 \[ACK\] Seq=5814 Ack=1526 Win=69120 Len=0 TSval=1367443462 TSecr=734761864                                             |


# all packets(暗号化されていない場合）

今回の全パケットはこちらです。わかりやすいように src/dest IP address は名前にしてあります。
| #    | time       | src         | dest        | protocol | length | TCP flags    | seq  | ack  | info                                                                                                                               |
| ---- | ---------- | ----------- | ----------- | -------- | ------ | ------------ | ---- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- |
| 130  | 2.487113   | localhost   | example.com | TCP      | 78     | ····CE····S· | 0    | 0    | 58364 → 443 \[SYN, ECN, CWR\] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 TSval=107391323 TSecr=0 SACK\_PERM=1                            |
| 133  | 2.641277   | example.com | localhost   | TCP      | 74     | ·····E·A··S· | 0    | 1    | 443 → 58364 \[SYN, ACK, ECN\] Seq=0 Ack=1 Win=65535 Len=0 MSS=1382 SACK\_PERM=1 TSval=2936265566 TSecr=107391323 WS=512            |
| 134  | 2.641642   | localhost   | example.com | TCP      | 66     | ·······A···· | 1    | 1    | 58364 → 443 \[ACK\] Seq=1 Ack=1 Win=131520 Len=0 TSval=107391476 TSecr=2936265566                                                  |
| 135  | 2.642373   | localhost   | example.com | TLSv1.3  | 583    | ·······AP··· | 1    | 1    | Client Hello                                                                                                                       |
| 139  | 2.805043   | example.com | localhost   | TCP      | 66     | ·······A···· | 1    | 518  | 443 → 58364 \[ACK\] Seq=1 Ack=518 Win=67072 Len=0 TSval=2936265726 TSecr=107391476                                                 |
| 140  | 2.805047   | example.com | localhost   | TLSv1.3  | 165    | ·······AP··· | 1    | 518  | Hello Retry Request, Change Cipher Spec                                                                                            |
| 141  | 2.805283   | localhost   | example.com | TCP      | 66     | ·······A···· | 518  | 100  | 58364 → 443 \[ACK\] Seq=518 Ack=100 Win=131392 Len=0 TSval=107391638 TSecr=2936265727                                              |
| 142  | 2.80656    | localhost   | example.com | TLSv1.3  | 409    | ·······AP··· | 518  | 100  | Change Cipher Spec, Client Hello                                                                                                   |
| 145  | 2.967469   | example.com | localhost   | TCP      | 66     | ·······A···· | 100  | 861  | 443 → 58364 \[ACK\] Seq=100 Ack=861 Win=68096 Len=0 TSval=2936265895 TSecr=107391639                                               |
| 146  | 2.96767    | example.com | localhost   | TLSv1.3  | 1436   | ·······A···· | 100  | 861  | Server Hello, Application Data                                                                                                     |
| 147  | 2.972801   | example.com | localhost   | TCP      | 1436   | ·······AP··· | 1470 | 861  | 443 → 58364 \[PSH, ACK\] Seq=1470 Ack=861 Win=68096 Len=1370 TSval=2936265897 TSecr=107391639 \[TCP segment of a reassembled PDU\] |
| 148  | 2.972935   | example.com | localhost   | TLSv1.3  | 1436   | ·······A···· | 2840 | 861  | Application Data, Application Data                                                                                                 |
| 149  | 2.97294    | example.com | localhost   | TLSv1.3  | 117    | ·······AP··· | 4210 | 861  | Application Data                                                                                                                   |
| 150  | 2.973082   | localhost   | example.com | TCP      | 66     | ·······A···· | 861  | 2840 | 58364 → 443 \[ACK\] Seq=861 Ack=2840 Win=128768 Len=0 TSval=107391804 TSecr=2936265897                                             |
| 151  | 2.973117   | localhost   | example.com | TCP      | 66     | ·······A···· | 861  | 4261 | 58364 → 443 \[ACK\] Seq=861 Ack=4261 Win=127296 Len=0 TSval=107391804 TSecr=2936265897                                             |
| 152  | 2.997266   | localhost   | example.com | TCP      | 66     | ·······A···· | 861  | 4261 | \[TCP Window Update\] 58364 → 443 \[ACK\] Seq=861 Ack=4261 Win=131072 Len=0 TSval=107391828 TSecr=2936265897                       |
| 153  | 2.998117   | localhost   | example.com | TLSv1.3  | 140    | ·······AP··· | 861  | 4261 | Application Data                                                                                                                   |
| 154  | 2.998521   | localhost   | example.com | TLSv1.3  | 158    | ·······AP··· | 935  | 4261 | Application Data                                                                                                                   |
| 155  | 2.998889   | localhost   | example.com | TLSv1.3  | 534    | ·······AP··· | 1027 | 4261 | Application Data                                                                                                                   |
| 173  | 3.151537   | example.com | localhost   | TCP      | 66     | ·······A···· | 4261 | 935  | 443 → 58364 \[ACK\] Seq=4261 Ack=935 Win=68096 Len=0 TSval=2936266078 TSecr=107391828                                              |
| 174  | 3.15154    | example.com | localhost   | TLSv1.3  | 321    | ·······AP··· | 4261 | 935  | Application Data                                                                                                                   |
| 175  | 3.151542   | example.com | localhost   | TLSv1.3  | 321    | ·······AP··· | 4516 | 935  | Application Data                                                                                                                   |
| 176  | 3.151543   | example.com | localhost   | TLSv1.3  | 162    | ·······AP··· | 4771 | 935  | Application Data, Application Data                                                                                                 |
| 177  | 3.151817   | localhost   | example.com | TCP      | 66     | ·······A···· | 1495 | 4516 | 58364 → 443 \[ACK\] Seq=1495 Ack=4516 Win=130816 Len=0 TSval=107391979 TSecr=2936266078                                            |
| 178  | 3.151817   | localhost   | example.com | TCP      | 66     | ·······A···· | 1495 | 4771 | 58364 → 443 \[ACK\] Seq=1495 Ack=4771 Win=130560 Len=0 TSval=107391979 TSecr=2936266078                                            |
| 179  | 3.151817   | localhost   | example.com | TCP      | 66     | ·······A···· | 1495 | 4867 | 58364 → 443 \[ACK\] Seq=1495 Ack=4867 Win=130432 Len=0 TSval=107391979 TSecr=2936266078                                            |
| 180  | 3.152917   | localhost   | example.com | TLSv1.3  | 97     | ·······AP··· | 1495 | 4867 | Application Data                                                                                                                   |
| 181  | 3.158304   | example.com | localhost   | TLSv1.3  | 97     | ·······AP··· | 4867 | 1027 | Application Data                                                                                                                   |
| 182  | 3.158506   | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 4898 | 58364 → 443 \[ACK\] Seq=1526 Ack=4898 Win=131008 Len=0 TSval=107391985 TSecr=2936266080                                            |
| 183  | 3.171335   | example.com | localhost   | TLSv1.3  | 981    | ·······AP··· | 4898 | 1495 | Application Data, Application Data, Application Data                                                                               |
| 184  | 3.171566   | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5813 | 58364 → 443 \[ACK\] Seq=1526 Ack=5813 Win=130112 Len=0 TSval=107391998 TSecr=2936266087                                            |
| 185  | 3.326376   | example.com | localhost   | TCP      | 66     | ·······A···· | 5813 | 1526 | 443 → 58364 \[ACK\] Seq=5813 Ack=1526 Win=69120 Len=0 TSval=2936266254 TSecr=107391980                                             |
| 1098 | 48.839818  | localhost   | example.com | TCP      | 54     | ·······A···· | 1525 | 5813 | \[TCP Keep-Alive\] 58364 → 443 \[ACK\] Seq=1525 Ack=5813 Win=131072 Len=0                                                          |
| 1108 | 48.992493  | example.com | localhost   | TCP      | 66     | ·······A···· | 5813 | 1526 | \[TCP Keep-Alive ACK\] 443 → 58364 \[ACK\] Seq=5813 Ack=1526 Win=69120 Len=0 TSval=2936311918 TSecr=107391998                      |
| 1369 | 64.549821  | example.com | localhost   | TCP      | 66     | ·······A···· | 5812 | 1526 | \[TCP Keep-Alive\] 443 → 58364 \[ACK\] Seq=5812 Ack=1526 Win=69120 Len=0 TSval=2936327237 TSecr=107391998                          |
| 1370 | 64.55017   | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5813 | \[TCP Keep-Alive ACK\] 58364 → 443 \[ACK\] Seq=1526 Ack=5813 Win=131072 Len=0 TSval=107452954 TSecr=2936311918                     |
| 2417 | 109.887607 | localhost   | example.com | TCP      | 54     | ·······A···· | 1525 | 5813 | \[TCP Keep-Alive\] 58364 → 443 \[ACK\] Seq=1525 Ack=5813 Win=131072 Len=0                                                          |
| 2418 | 110.041827 | example.com | localhost   | TCP      | 66     | ·······A···· | 5813 | 1526 | \[TCP Keep-Alive ACK\] 443 → 58364 \[ACK\] Seq=5813 Ack=1526 Win=69120 Len=0 TSval=2936372958 TSecr=107452954                      |
| 2790 | 125.889367 | example.com | localhost   | TCP      | 66     | ·······A···· | 5812 | 1526 | \[TCP Keep-Alive\] 443 → 58364 \[ACK\] Seq=5812 Ack=1526 Win=69120 Len=0 TSval=2936388677 TSecr=107452954                          |
| 2791 | 125.889583 | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5813 | \[TCP Keep-Alive ACK\] 58364 → 443 \[ACK\] Seq=1526 Ack=5813 Win=131072 Len=0 TSval=107513834 TSecr=2936372958                     |
| 4317 | 171.346262 | localhost   | example.com | TCP      | 54     | ·······A···· | 1525 | 5813 | \[TCP Keep-Alive\] 58364 → 443 \[ACK\] Seq=1525 Ack=5813 Win=131072 Len=0                                                          |
| 4318 | 171.522983 | example.com | localhost   | TCP      | 66     | ·······A···· | 5813 | 1526 | \[TCP Keep-Alive ACK\] 443 → 58364 \[ACK\] Seq=5813 Ack=1526 Win=69120 Len=0 TSval=2936434446 TSecr=107513834                      |
| 4366 | 183.843569 | example.com | localhost   | TLSv1.3  | 123    | ·······AP··· | 5813 | 1526 | Application Data                                                                                                                   |
| 4367 | 183.843575 | example.com | localhost   | TLSv1.3  | 90     | ·······AP··· | 5870 | 1526 | Application Data                                                                                                                   |
| 4368 | 183.843577 | example.com | localhost   | TCP      | 66     | ·······A···F | 5894 | 1526 | 443 → 58364 \[FIN, ACK\] Seq=5894 Ack=1526 Win=69120 Len=0 TSval=2936446685 TSecr=107513834                                        |
| 4369 | 183.844156 | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5870 | 58364 → 443 \[ACK\] Seq=1526 Ack=5870 Win=131008 Len=0 TSval=107571319 TSecr=2936446685                                            |
| 4370 | 183.844157 | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5894 | 58364 → 443 \[ACK\] Seq=1526 Ack=5894 Win=130944 Len=0 TSval=107571319 TSecr=2936446685                                            |
| 4371 | 183.8442   | localhost   | example.com | TCP      | 66     | ·······A···· | 1526 | 5895 | 58364 → 443 \[ACK\] Seq=1526 Ack=5895 Win=130944 Len=0 TSval=107571319 TSecr=2936446685                                            |
| 4372 | 183.846191 | localhost   | example.com | TCP      | 54     | ·······A·R·· | 1526 | 5895 | 58364 → 443 \[RST, ACK\] Seq=1526 Ack=5895 Win=131008 Len=0                                                                        |