Wireshark decodificando apenas uma direção

Eu escrevi um cliente de chat em python que usa criptografia TLS. O servidor é executado em um PC, e o cliente em outro.

O servidor cria as chaves SSL (server.key e server.crt) e então eu copio server.crt para o PC cliente.

O cliente não cria nenhuma chave SSL própria.

Usando LD_PRELOAD, eu coleto o SSLKEYLOGFILE no PC servidor. Eu coleto o pcap usando tcpdump no PC servidor também.

Levo ambos ao Wireshark para descriptografar o pcap.

No entanto, apenas pacotes Client -> Server são decodificados. Mensagens Server -> Client permanecem criptografadas. Por que isso?

Keylog.txt:

SERVER_HANDSHAKE_TRAFFIC_SECRET 6e1c671e89c253c9670297d7af1c651236cb52ffcec31f393ff2d4c345b65b83 83156d3d139ab2bda9fb30bc68699fadeaff736373585e9296618973b804e67b858f904b6d67d35791f154d2df1c53ec
CLIENT_HANDSHAKE_TRAFFIC_SECRET 6e1c671e89c253c9670297d7af1c651236cb52ffcec31f393ff2d4c345b65b83 d27b9286b3f209da0cfca1055cd6c5a0b7dc638a3b47b760fc52c46530c6f0129e3ab8cb97de02d708dcd78e4b8eeef6
EXPORTER_SECRET 6e1c671e89c253c9670297d7af1c651236cb52ffcec31f393ff2d4c345b65b83 a81094854b39ab0a39ab4b1d0669591024a3c05d4a8b0df0870e2df824b447b9cdd206e4f120dbeb871a0f642bff783b
SERVER_TRAFFIC_SECRET_0 6e1c671e89c253c9670297d7af1c651236cb52ffcec31f393ff2d4c345b65b83 fa8a418607881a3c78082009acded37a4f1640b6d7e4932785b071bd3dcae67aaef91ef664bb1fc1f01e22d800b11e73
CLIENT_TRAFFIC_SECRET_0 6e1c671e89c253c9670297d7af1c651236cb52ffcec31f393ff2d4c345b65b83 f90a697b55859c7144ccf34c499869cddbec964f37386ab08cf7ed137cd54c53b9c119b42fda4f37b0ba3e5a62694cf7

Servidor.py:

import socket
import ssl
import argparse

# Server-side
def create_tls_server(certfile, keyfile, port):
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.load_cert_chain(certfile, keyfile)

    hostname = socket.gethostname()
    IPAddr = socket.gethostbyname(hostname)
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
    sock.bind((IPAddr, port))
    sock.listen(2)

    print(f"Server started on {IPAddr}:{port}. Waiting for connections...")

    while True:
        client_socket, addr = sock.accept()  # Accept raw connection
        try:
            ssl_conn = context.wrap_socket(client_socket, server_side=True)  # Wrap here
            print(f"Connected by {addr}. Waiting for message...")
            while True:
                data = ssl_conn.recv(1024).decode()
                if not data:
                    break
                print(f"Received: {data}")
                if data == 'bye':
                    break
                print(">> ", end='')
                response = input()
                ssl_conn.send(response.encode())
        except Exception as e:
            print(f"Error: {e}")
        finally:
            ssl_conn.close()
            client_socket.close()  # close the connection
            print(f"Connection with {addr} closed.")
            break

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="TLS Server")
    parser.add_argument("-p", "--port", type=int, default=8500, help="Port number")
    parser.add_argument("-v", "--version", type=int, default=ssl.PROTOCOL_TLS_SERVER, help="TLS Version")
    args = parser.parse_args()

    create_tls_server('./server.crt', './server.key', args.port)

Cliente.py:

import socket
import ssl
import argparse

# Client-side
def connect_tls_client(cafile, port, host):
    context = ssl.create_default_context()
    context.load_verify_locations(cafile)

    sock = socket.socket()  # instantiate
    sock.connect((host, port))  # connect to the server

    client_socket = context.wrap_socket(sock, server_hostname=host)

    print(">> ", end='')
    message = input()

    while message.lower().strip() != 'bye':
        client_socket.send(message.encode())  # send message
        data = client_socket.recv(1024).decode()  # receive response
        if not data:
            break

        print('Received from server: ' + data)  # show in terminal

        if data == 'bye':
            break

        print(">> ", end='')
        message = input()

    client_socket.close()  # close the connection

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="TLS Client")
    parser.add_argument("-s", "--server_ip", default="name-of-remote-serverenter image description here", help="Server IP address")
    parser.add_argument("-p", "--port", type=int, default=8500, help="Port number")
    parser.add_argument("-v", "--version", type=int, default=ssl.PROTOCOL_TLS_SERVER, help="TLS Version")
    args = parser.parse_args()

    connect_tls_client('./server.crt', args.port, args.server_ip)