C program to extract TLS record layer - ssl

Question

I am trying to parse a pcap to get the packet bytes of only the TLS Record Layer in the payload.
In my following code I have managed to get only the tcp protocol bytes from the payload which contains the TLS Record Layer. I want to further extract only the TLS Record Layer bytes from this.
Could you tell me how I can modify my code to extract only that part of the payload?
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet){
static int count = 1; /* packet counter */
/* declare pointers to packet headers */
const struct ether_header *ethernet; /* The ethernet header [1] */
const struct ip *ip; /* The IP header */
const struct tcphdr *tcp; /* The TCP header */
const struct sniff_udp *udp; /* The UDP header */
const char *payload; /* Packet payload */
int size_ip;
int size_tcp;
int size_udp;
int size_payload;
printf("\nPacket number %d:\n", count);
count++;
/* define ethernet header */
ethernet = (struct ether_header*)(packet);
/* define/compute ip header offset */
ip = (struct ip*)(packet + sizeof(struct ether_header));
size_ip = sizeof(struct ip);
if (size_ip < 20) {
//printf(" * Invalid IP header length: %u bytes\n", size_ip);
return;
}
/* print source and destination IP addresses */
printf(" From: %s\n", inet_ntoa(ip->ip_src));
printf(" To: %s\n", inet_ntoa(ip->ip_dst));
/* determine protocol */
switch(ip->ip_p) {
case IPPROTO_TCP:
printf(" Protocol: TCP\n");
break;
case IPPROTO_UDP:
printf(" Protocol: UDP\n");
break;
case IPPROTO_ICMP:
printf(" Protocol: ICMP\n");
return;
case IPPROTO_IP:
printf(" Protocol: IP\n");
return;
default:
printf(" Protocol: unknown\n");
return;
}
/*
* OK, this packet is TCP.
*/
/* define/compute tcp header offset */
if(ip->ip_p == IPPROTO_TCP)
{
tcp = (struct tcphdr *)(packet + sizeof(struct ether_header) + sizeof(struct ip));
size_tcp = sizeof(struct tcphdr);
printf(" Src port: %d\n", ntohs(tcp->th_sport));
printf(" Dst port: %d\n", ntohs(tcp->th_dport));
int sport = ntohs(tcp->th_sport);
int dport = ntohs(tcp->th_dport);
/* define/compute tcp payload (segment) offset */
payload = (u_char *)(packet + sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
/* compute tcp payload (segment) size */
size_payload = header->len - (sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
/*
* Print payload data; it might be binary, so don't just
* treat it as a string.
*/
if (size_payload > 0) {
printf(" Payload (%d bytes):\n", size_payload);
print_payload(payload, size_payload);
//if ((sport == 80) || (dport == 80))
//{
// printf(" HTTP prase:\n");
// prase_http(payload, size_payload);
//}
if(sport == 443 || dport == 443)
{
// printf(" SSL/TLS prase:\n");
//prase_ssl_tls(payload, size_payload);
//printf("%u",payload);
// print_payload(payload, size_payload);
parser(payload,size_payload);
}
}
}
/* UDP */
else if(ip->ip_p == IPPROTO_UDP)
{
udp = (struct sniff_udp*)(packet + SIZE_ETHERNET + size_ip);
size_udp = 8;
printf(" Src port: %d\n", ntohs(udp->uh_sport));
printf(" Dst port: %d\n", ntohs(udp->uh_dport));
int sport = ntohs(udp->uh_sport);
int dport = ntohs(udp->uh_dport);
payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_udp);
size_payload = ntohs(ip->ip_len) - (size_ip + size_udp);
if (size_payload > 0) {
//printf(" Payload (%d bytes:)\n", size_payload);
if(sport == 53 || dport == 53)
{
// printf(" DNS prase:\n");
// prase_dns(payload, size_payload);
}
}
}
return;
}
This is the got_packet function passed as argument to pcap_loop which is part of <pcap.h> .All reference structures are used from
<arpa/inet.h>,<net/ethernet.h>,<netinet/ip.h>,<netinet/tcp.h>
I am looking to extract this part of the packet(image link attached):
Screenshot from wireshark as to what I wish to parse
Could someone help me with this?