Struct TlsSession 

pub struct TlsSession { /* private fields */ }

A TLS session that can decrypt traffic.

Manages the full lifecycle:

1. Collect handshake data (client_random, server_random, cipher_suite)
2. Look up keys from SSLKEYLOGFILE
3. Derive encryption keys
4. Create decryption contexts for both directions
5. Decrypt application data records

Implementations

impl TlsSession

pub fn new(keylog: Arc<KeyLog>) -> Self

Create a new TLS session with a keylog reference.

pub fn state(&self) -> SessionState

Get the current session state.

pub fn handshake(&self) -> &HandshakeData

Get the handshake data.

pub fn process_client_hello(&mut self, client_random: [u8; 32])

Process a ClientHello message.

Extracts the client_random from the handshake.

pub fn process_server_hello( &mut self, server_random: [u8; 32], cipher_suite: u16, version: TlsVersion, ) -> Result<(), SessionError>

Process a ServerHello message.

Extracts server_random and cipher_suite, then attempts key derivation.

pub fn try_establish_keys(&mut self) -> Result<(), SessionError>

Attempt to establish decryption keys.

This requires:

• client_random and server_random from handshake
• Cipher suite selection
• Key material from SSLKEYLOGFILE

pub fn can_decrypt(&self) -> bool

Check if the session can decrypt traffic.

pub fn is_tls13_handshake_phase(&self) -> bool

Check if we’re in TLS 1.3 handshake encryption mode.

pub fn tls13_handshake_phase(&self) -> Tls13HandshakePhase

Get the current TLS 1.3 handshake phase.

pub fn transition_to_application_data(&mut self)

Transition to TLS 1.3 application data phase. Called when both Finished messages have been processed.

pub fn mark_server_finished(&mut self)

Mark that the server has sent its Finished message.

pub fn mark_client_finished(&mut self)

Mark that the client has sent its Finished message. This also transitions to application data mode.

pub fn decrypt_record( &mut self, direction: Direction, record_type: u8, ciphertext: &[u8], ) -> Result<Vec<u8>, SessionError>

Decrypt a TLS record.

Returns the decrypted plaintext. For TLS 1.3, this automatically uses the correct keys based on the handshake phase.

pub fn decrypt_handshake_record( &mut self, direction: Direction, record_type: u8, ciphertext: &[u8], ) -> Result<Vec<u8>, SessionError>

Decrypt a TLS 1.3 handshake record specifically. Use this when you know you’re decrypting handshake messages.

pub fn decrypt_application_record( &mut self, direction: Direction, record_type: u8, ciphertext: &[u8], ) -> Result<Vec<u8>, SessionError>

Decrypt a TLS 1.3 application data record specifically. Use this when you know you’re decrypting application data.

pub fn cipher_suite_name(&self) -> Option<&'static str>

Get the cipher suite name if available.

pub fn client_sequence(&self) -> Option<u64>

Get the client’s sequence number (for debugging).

pub fn server_sequence(&self) -> Option<u64>

Get the server’s sequence number (for debugging).

pub fn close(&mut self)

Close the session.