SSL dissector fails to decode AES256CBC in RDPUDP traffic
Summary
In the attached capture with the provided key, the SSL dissector fails to decode application data in RDPUDP packets. The SSL log talk of padding problems.
Steps to reproduce
Open the capture, configure the decoding key, and go to packet 142.
What is the current bug behavior?
The TLS payloads aren't decoded and on packet 141 the SSL logs says:
ssl_decrypt_record failed: padding 121 too large for work 48
The rather strange thing is that in the full capture, the TCP channel of RDP uses the same certificate and the same ciphers are negotiated, and decoding works fine.
I did some debugging in the TLS dissector and I feel like the only possibility with this padding bug is a bug with the IV used to decode AES CBC. And placing some breakpoints in the code I feel like IV are never used in my case, but I may have missed something (I must admit I've hit my limits with the knowledge of TLS).
What is the expected correct behavior?
SSL records should be decoded, and we should see some RDP multi-transport records in them.
Sample capture file
capture with just RDP UDP decoding key full capture with both TCP and UDP
Relevant logs and/or screenshots
None
Build information
3.5.1 (v3.5.1rc0-130-g98faf05b6b91)
Compiled (64-bit) using GCC 9.3.0, with Qt 5.12.8, with libpcap, with POSIX
capabilities (Linux), with libnl 3, with GLib 2.64.6, with zlib 1.2.11, with Lua
5.2.4, with GnuTLS 3.6.13 and PKCS #11 support, with Gcrypt 1.8.5, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.40.0, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.10, with SMI 0.4.8, with
QtMultimedia, without automatic updates, with SpeexDSP (using system library),
without Minizip.
Running on Linux 5.4.0-80-generic, with Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
(with SSE4.2), with 15980 MB of physical memory, with GLib 2.64.6, with zlib
1.2.11, with Qt 5.12.8, with libpcap 1.9.1 (with TPACKET_V3), with c-ares
1.15.0, with GnuTLS 3.6.13, with Gcrypt 1.8.5, with nghttp2 1.40.0, with brotli
1.0.7, with LZ4 1.9.2, with Zstandard 1.4.4, with libsmi 0.4.8, with light
display mode, without HiDPI, with locale fr_FR.UTF-8, binary plugins supported
(18 loaded).