Repository navigation
feat(application): dissect RFC 9146 connection-ID DTLS records - #2631
Merged
Merged
Conversation
- tls12_cid records fell back to Raw: their CID sits before the length and its length is negotiated. DTLS parses them with a DTLSCIDCiphertext schema and data model, keeping the content encrypted. - DTLSContext resolves the length from CIDs the hellos negotiated, matched by value, then from a caller's cid_length; unknown stays Raw, quietly. Learned CIDs live on the instance, and each extraction gets its own. - SSL decodes the connection_id extension; a TLS hello carrying it, DTLS-only per RFC 9146 section 10.2, decodes too. make() takes cid. - Chained records, rebuilds and makes carry the CIDs they need. Tests: an Mbed TLS 4.2.0 capture cross-checked with tshark 4.6.9, plus RFC 9146 Figure 3 vectors; both round trips byte-exact.
JarryShaw
added
feat
Owner
Author
|
GOOD TO GO at A Sonnet cross-review checked the record layout against RFC 9146 (§4 Figure 3, §3, and §10.3 for the DTLS 1.2 limit). tshark's dissection agrees with every CID record in the Mbed TLS capture. A 7,047-case mutation differential found no change outside CID datagrams. Handled refusals stay quiet. The fix round applied the owner's ruling that memory is per instance. Nothing was shared before; tests now fail if any shared store returns. It also documented two things: extension 54 decoding in TLS hellos, and the prefix-match caveat. |
JarryShaw
removed
the
review: good-to-go
This was referenced Nov 2, 2026
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
…types and the registry split into 1.6.0 (#2449) - Breaking: Quick-Start values their fields cannot carry raise, reversing 1.5.0's round-down of a TCP rate under 80 kbps (#2630). - Folded into unreleased entries: tls12_cid records and DTLSContext (#2631), LinkType 105 and 127 in Frame and PCAP-NG (#2632), and DTLS.analyze_handshake behind dtls_handshake and packet (#2634). - Changed: foundation.registry.protocols split into per-layer submodules (#2635); 1.6.0's register_* roles and 1.5.0's three register_protocol* roles point at their submodules, 1.5.0's text unchanged. - The conventions entry records the per-layer wrapper placement (#2635) and parse ownership (#2634). No entry for #2629, which changes no released behaviour. - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
This was referenced Nov 2, 2026
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
#2515) #2631 added DTLSCIDCiphertext (data and schema) and the TLS ConnectionId extension data to their submodules' __all__ but not to the packages, so test_every_package_reexports_every_child_export failed on main. - data.application: DTLS_CIDCiphertext, TLS_ConnectionId - schema.application: DTLS_CIDCiphertext - data and schema aggregators list the same names in __all__ Aliases follow the <protocol>_<name> form the siblings use (DTLS_Ciphertext, TLS_ExtensionData). The test is not tier-gated; it fails on 3.14 as well, and passes on 3.14 and 3.15 with this change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
feat— a new featureDescription of your pull request and other information
tls12_cidrecords (RFC 9146) parse as DTLS 1.2 layers chained with the other records in their datagram. When the connection ID length is unknown, the record staysRawquietly.DTLSContext, found through the context channel asESPContextis. It learns the IDs the capture's own ClientHello/ServerHello negotiated and matches them by value, so mismatched lengths per direction resolve. A caller can also pass IDs or acid_length.connection_iddecodes toConnectionId(cid=…)onSSL. TLS hellos decode it too, although RFC 9146 marks it DTLS-only.Test vectors are a real Mbed TLS exchange, pinned against tshark's dissection. All other DTLS output is unchanged over every sample capture and a 7,047-case mutation differential.
UDP.from_datawithout__context__keeps the bytes exact, but CID records come backRaw, because the CID length is not on the wire. This is documented. The owner's answers on #2515 are implemented: DTLS 1.3 CID records are a follow-up in #2625, and a reused instance keeps its IDs. A Sonnet cross-review returned GOOD TO GO, and its notes are folded in.Closes #2515