# Detect Conversion of Existing Connection to TLS

**URL:** <https://discourse.mitmproxy.org/t/detect-conversion-of-existing-connection-to-tls/632>\
**Category:** help\
**Created:** [September 8, 2017, 4:31pm UTC](https://discourse.mitmproxy.org/t/detect-conversion-of-existing-connection-to-tls/632 "2017-09-08T16:31:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![smanzer](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@smanzer](https://discourse.mitmproxy.org/u/smanzer)\
**Post date:** [September 8, 2017, 4:31pm UTC](https://discourse.mitmproxy.org/t/detect-conversion-of-existing-connection-to-tls/632/1 "2017-09-08T16:31:27Z")

</div>

I’m using the docker image `mitmproxy/mitmproxy:2.0.2` to sniff traffic between a Postgres client (psql) and server. The server uses TLS, but the client and server each send a single message before deciding to do the TLS handshake - these message appear to confuse `mitmdump`, so that it doesn’t know to intercept/decrypt the subsequent TLS traffic:

I monitor the connection using this inline script for mitdump:

```auto
def tcp_message(tcp_flow):
    client_addr = tcp_flow.client_conn.address
    server_addr = tcp_flow.server_conn.address
    latest_msg = tcp_flow.messages[-1]
    content = latest_msg.content
    timestamp = latest_msg.timestamp
    from_client = latest_msg.from_client
    output = """
---
client addr: {}
server addr: {}
from_client: {}
timestamp: {}
payload:
{}
""".format(client_addr, server_addr, from_client, timestamp, content)
    print(output)

```

This script shows me the messages that precede the TLS handshake:

```auto
---
client addr: 172.18.0.1:60543
server addr: 172.18.0.4:5432
from_client: True
timestamp: 1504758794.6508732
payload:
b'\x00\x00\x00\x08\x04\xd2\x16/'

---
client addr: 172.18.0.1:60543
server addr: 172.18.0.4:5432
from_client: False
timestamp: 1504758794.6517434
payload:
b'S'

```

Subsequently, `mitmdump` does not recognize the conversion of the connection to use TLS, so all I can see is the encrypted messages. Does anyone have any advice about how to catch the handshake when it happens (since it does not happen right at the initial connect) and force `mitmdump` to intercept it? Any suggested modifications to my script appreciated!

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [September 11, 2017, 3:56am UTC](https://discourse.mitmproxy.org/t/detect-conversion-of-existing-connection-to-tls/632/2 "2017-09-11T03:56:04Z")

</div>

This is quite tricky unfortunately. The easiest way to do this is probably writing your own Layer, and then hooking `next_layer` (as e.g. [here](https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py#L129)). In that layer, you’d read both pre-TLS messages before opening up a TLS layer. You can read through [modes/socks\_proxy.py](https://github.com/mitmproxy/mitmproxy/blob/master/mitmproxy/proxy/modes/socks_proxy.py) to get a _rough_ idea on how to write your own layer, but it’s still a fairly nontrivial thing to do.

---

<div class="post-metadata">

**Author:** ![smanzer](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@smanzer](https://discourse.mitmproxy.org/u/smanzer)\
**Post date:** [September 11, 2017, 4:01pm UTC](https://discourse.mitmproxy.org/t/detect-conversion-of-existing-connection-to-tls/632/3 "2017-09-11T16:01:04Z")

</div>

Thank you for your reply! I will try out writing my own layer as you suggested.