From 510b411ab707d7bec9115226dc7a1ba51b74dadc Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:29:02 -0400
Subject: [PATCH] utils: delete the TLS key-log scratch file after loading it

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/utils.py                | 13 +++++++------
 test/scapy/layers/tls/tls.uts | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/scapy/utils.py b/scapy/utils.py
index 0879f3322bf..b72224009fd 100644
--- a/scapy/utils.py
+++ b/scapy/utils.py
@@ -2005,12 +2005,13 @@ def _read_block_dsb(self, block, size):
                 from scapy.layers.tls.session import load_nss_keys
 
                 # Write Key Log to a file and parse it
-                filename = get_temp_file()
-                with open(filename, "wb") as fd:
-                    fd.write(secrets_data)
-                    fd.close()
-
-                keys = load_nss_keys(filename)
+                filename = get_temp_file(keep=True)
+                try:
+                    with open(filename, "wb") as fd:
+                        fd.write(secrets_data)
+                    keys = load_nss_keys(filename)
+                finally:
+                    os.unlink(filename)
                 if not keys:
                     warning("PcapNg: invalid TLS Key Log in DSB!")
                 else:
diff --git a/test/scapy/layers/tls/tls.uts b/test/scapy/layers/tls/tls.uts
index e3d194b2763..64409b96e54 100644
--- a/test/scapy/layers/tls/tls.uts
+++ b/test/scapy/layers/tls/tls.uts
@@ -1633,6 +1633,38 @@ if shutil.which("editcap"):
     assert b"BEGIN PRIVATE KEY" in packets[28].inner.msg[0].data
     conf = bck_conf
 
+= pcapng Decryption Secrets Block does not retain a temporary file
+
+import struct
+import scapy.layers.tls.session
+
+def pcapng_block(block_type, body):
+    body += b"\x00" * (-len(body) % 4)
+    length = 12 + len(body)
+    return (
+        struct.pack("<II", block_type, length)
+        + body
+        + struct.pack("<I", length)
+    )
+
+key_log_path = scapy_path("doc/notebooks/tls/raw_data/tls_nss_example.keys.txt")
+with open(key_log_path, "rb") as key_log_file:
+    key_log = key_log_file.read()
+
+section = bytes.fromhex("4d3c2b1a") + struct.pack("<HHq", 1, 0, -1)
+secrets = struct.pack("<II", 0x544c534b, len(key_log)) + key_log
+capture = pcapng_block(0x0a0d0d0a, section) + pcapng_block(10, secrets)
+temp_files_before = set(conf.temp_files)
+with PcapReader(io.BytesIO(capture)) as reader:
+    assert len(reader.read_all()) == 0
+
+new_temp_files = [path for path in conf.temp_files if path not in temp_files_before]
+for path in new_temp_files:
+    os.unlink(path)
+    conf.temp_files.remove(path)
+
+assert not new_temp_files
+
 = pcapng file with a non-UTF-8 Decryption Secrets Block
 
 # GH3936