DTLS: improve support (#1146)

* DTLS: add some pcap tests

* DTLS: fix parsing of Client/Server Helllo message

* DTLS: add parsing of server certificates

6 files changed, 24 insertions, 0 deletions

diff --git a/tests/pcap/dtls2.pcap b/tests/pcap/dtls2.pcap
new file mode 100644
index 000000000..68be6c38d
--- /dev/null
+++ b/tests/pcap/dtls2.pcap
diff --git a/tests/pcap/dtls_certificate_fragments.pcap b/tests/pcap/dtls_certificate_fragments.pcap
new file mode 100644
index 000000000..5551b5cab
--- /dev/null
+++ b/tests/pcap/dtls_certificate_fragments.pcap
diff --git a/tests/pcap/dtls_session_id_and_coockie_both.pcap b/tests/pcap/dtls_session_id_and_coockie_both.pcap
new file mode 100644
index 000000000..932f96e44
--- /dev/null
+++ b/tests/pcap/dtls_session_id_and_coockie_both.pcap
diff --git a/tests/result/dtls2.pcap.out b/tests/result/dtls2.pcap.out
new file mode 100644
index 000000000..cf26153f5
--- /dev/null
+++ b/tests/result/dtls2.pcap.out
@@ -0,0 +1,8 @@
+DTLS	30	4991	1
+
+JA3 Host Stats: 
+		 IP Address                  	 # JA3C     
+	1	 61.68.110.153            	 1      
+
+
+	1	UDP 61.68.110.153:53045 <-> 212.32.214.39:61457 [proto: 30/DTLS][cat: Web/5][14 pkts/2246 bytes <-> 16 pkts/2745 bytes][Goodput ratio: 74/75][382.15 sec][bytes ratio: -0.100 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/241 27857/28359 60550/60551 26256/25033][Pkt Len c2s/s2c min/avg/max/stddev: 123/102 160/172 325/867 46/180][Risk: ** Weak TLS cipher **** TLS (probably) not carrying HTTPS **** SNI TLS extension was missing **][DTLSv1.0][JA3C: 1b45c913a0c0fde5f263502e65999485][JA3S: 749bd1edea60396ffaa65213b7971718 (WEAK)][Issuer: C=US][Subject: C=US, CN=*.relay.ros.rockstargames.com][Validity: 2014-09-12 21:31:19 - 2037-02-15 21:31:19][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (140912213119Z)][Plen Bins: 0,3,43,46,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/dtls_certificate_fragments.pcap.out b/tests/result/dtls_certificate_fragments.pcap.out
new file mode 100644
index 000000000..e9461e6c9
--- /dev/null
+++ b/tests/result/dtls_certificate_fragments.pcap.out
@@ -0,0 +1,8 @@
+DTLS	20	5978	1
+
+JA3 Host Stats: 
+		 IP Address                  	 # JA3C     
+	1	 10.186.198.149           	 1      
+
+
+	1	UDP 10.186.198.149:39347 <-> 35.210.59.134:44443 [proto: 30/DTLS][cat: Web/5][11 pkts/2624 bytes <-> 9 pkts/3354 bytes][Goodput ratio: 82/89][2.92 sec][bytes ratio: -0.122 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/76 2179/186 659/75][Pkt Len c2s/s2c min/avg/max/stddev: 167/90 239/373 416/1454 97/388][Risk: ** Weak TLS cipher **** TLS (probably) not carrying HTTPS **** SNI TLS extension was missing **][DTLSv1.0][JA3C: 3c3d129780d0066cd8936a6291a8d44f][JA3S: d45798bc098cd930de7eb2f5f866e994 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (Opera Software ASA1)][Plen Bins: 0,5,0,35,5,10,10,0,10,10,5,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0]
diff --git a/tests/result/dtls_session_id_and_coockie_both.pcap.out b/tests/result/dtls_session_id_and_coockie_both.pcap.out
new file mode 100644
index 000000000..d729967ea
--- /dev/null
+++ b/tests/result/dtls_session_id_and_coockie_both.pcap.out
@@ -0,0 +1,8 @@
+DTLS	4	604	1
+
+JA3 Host Stats: 
+		 IP Address                  	 # JA3C     
+	1	 185.196.113.239          	 1      
+
+
+	1	UDP 185.196.113.239:50257 <-> 223.116.105.247:44443 [proto: 30/DTLS][cat: Web/5][2 pkts/302 bytes <-> 2 pkts/302 bytes][Goodput ratio: 72/72][0.06 sec][Risk: ** TLS (probably) not carrying HTTPS **** SNI TLS extension was missing **][DTLSv1.2][JA3C: e15c510766789ed8f49de0e37951c1da][JA3S: a1d48eca741e476d8ee735578a26bdbd][Cipher: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384][Plen Bins: 0,25,0,50,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]