user: root cause detail.

Co-Authored-By: blaisewang [email protected]
Signed-off-by: CFC4N <[email protected]>

user/module/probe_openssl.go

@@ -486,7 +486,12 @@ func (this *MOpenSSLProbe) saveMasterSecret(secretEvent *event.MasterSecretEvent
 			length = 48
 			transcript = crypto.SHA384
 		default:
-			// TODO need to get root cause,
+			// TODO: multi version compatible.
+			// root cause : cipher's offset in ssl_st struct was changed between 1.1.1*.
+			// group a : 1.1.1a
+			// group b : 1.1.1b-1.1.1c
+			// group c : 1.1.1d-1.1.1i
+			// group e : 1.1.1j-1.1.1q
 			length = 32
 			transcript = crypto.SHA256
 			this.logger.Printf("non-TLSv1.3 cipher suite in tls13_hkdf_expand, CipherId: %d, use SHA256 default.", secretEvent.CipherId)