fix: crash in parser with nil decode context

- Use gopacket.NewPacket with LinkTypeIPv4/IPv6 instead of DecodeFromBytes
- Fixes panic: runtime error: invalid memory address or nil pointer dereference
- Properly handles raw IP packets after SLL header stripping

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

internal/tlsparse/parser.go

@@ -163,31 +163,19 @@ func (p *ParserImpl) Process(pkt api.RawPacket) (*api.TLSClientHello, error) {
 	}
 	tcpLayer = packet.Layer(layers.LayerTypeTCP)
 
-	// If no IP/TCP layer found with Ethernet, try direct IP decoding
+	// If no IP/TCP layer found with Ethernet, try parsing as raw IP
-	// This handles raw IP data (e.g., after stripping SLL header)
+	// This handles stripped SLL data or other non-Ethernet formats
 	if ipLayer == nil || tcpLayer == nil {
-		// Try IPv4
+		// Try parsing as raw IPv4 packet
-		ipv4 := &layers.IPv4{}
+		rawPacket := gopacket.NewPacket(data, layers.LinkTypeIPv4, gopacket.Default)
-		if err := ipv4.DecodeFromBytes(data, nil); err == nil {
+		ipLayer = rawPacket.Layer(layers.LayerTypeIPv4)
-			ipLayer = ipv4
+		if ipLayer == nil {
-			// Try to decode TCP from IPv4 payload
+			// Try parsing as raw IPv6 packet
-			tcp := &layers.TCP{}
+			rawPacket = gopacket.NewPacket(data, layers.LinkTypeIPv6, gopacket.Default)
-			if err := tcp.DecodeFromBytes(ipv4.Payload, nil); err == nil {
+			ipLayer = rawPacket.Layer(layers.LayerTypeIPv6)
-				tcpLayer = tcp
-			}
 		}
-	}
+		if ipLayer != nil {
-	
+			tcpLayer = rawPacket.Layer(layers.LayerTypeTCP)
-	// Try IPv6 if IPv4 didn't work
-	if ipLayer == nil {
-		ipv6 := &layers.IPv6{}
-		if err := ipv6.DecodeFromBytes(data, nil); err == nil {
-			ipLayer = ipv6
-			// Try to decode TCP from IPv6 payload
-			tcp := &layers.TCP{}
-			if err := tcp.DecodeFromBytes(ipv6.Payload, nil); err == nil {
-				tcpLayer = tcp
-			}
 		}
 	}