Unknown or invalid cipher suite type X

[HugooB]

Describe the bug
Parsing HTTPS packets results in the following error: dpkt.ssl.SSL3Exception: Unknown or invalid cipher suite type X. There is a similar issue on the Salesforce JA3 git: salesforce/ja3#59 . Downgrading to 1.9.2 solves the issue.

To Reproduce

1. Get the PCAP from https://www.malware-traffic-analysis.net/2021/06/03/index.html
2. Install dpkt latest version (1.9.6)
3. Try to generate JA3 hashes by using Salesforce's JA3 python implementation
4. Get the error

Expected behavior
It should work

Details(please complete the following information):

• OS: MacOS 11.4
• Python 3.8.1

Additional context
salesforce/ja3#59

[obormot]

Relevant piece of the ja3 code here: https://github.com/salesforce/ja3/blob/master/python/ja3.py#L177
Pcap with only tcp/443 packets issue_587.pcap.gz

[obormot]

Looks like dpkt's SSL decoder fails to recognize one of the reserved GREASE cipher suite values (0x6a6a) present in the pcap. These cipher suites are defined here: https://datatracker.ietf.org/doc/html/rfc8701#section-2

This code block raises an exception if the given cipher suite is not known (i.e. not defined in ssl_ciphersuites.py)
https://github.com/kbandla/dpkt/blob/master/dpkt/ssl.py#L300

I think dpkt should have more permissive logic - i.e. it should not abort parsing the TLS record when it encounters an unknown (to dpkt) cipher suite. I will submit a fix for this

[HugooB]

Thanks for this quick reaction! Looking forward to the fix!

[obormot]

PR #588 is up

[obormot]

@HugooB I've now merged the fix into master. Please see if it helps resolve the issue (you'll need to install dpkt from master).
Once we publish a new release I'll update the ja3 issue.

[LouAlbano]

1.9.4 doesn't produce this error, 1.9.5 and 1.9.6 both do.

related: salesforce/ja3#59

[obormot]

@LouAlbano this was fixed in 1.9.7 (latest release). I will double check and comment on the ja3 issue