Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 10975, column 13
Null pointer passed to 2nd parameter expecting 'nonnull'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-18/lib/clang/18 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/epan -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -dwarf-debug-flags /usr/lib/llvm-18/bin/clang -### --analyze -x c -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/epan -fvisibility=hidden -fexcess-precision=fast -fstrict-flex-arrays=3 -fstack-clash-protection -fcf-protection=full -D _GLIBCXX_ASSERTIONS -fstack-protector-strong -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -fexceptions -Wno-format-truncation -Wno-format-nonliteral -fdiagnostics-color=always -Wno-pointer-sign -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -std=gnu11 -fPIC /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c -o /builds/wireshark/wireshark/sbout/2025-06-29-100246-3847-1 -Xclang -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2025-06-29-100246-3847-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "packet-ber.h"
41#include "packet-x509af.h"
42#include "packet-x509if.h"
43#include "packet-tls-utils.h"
44#include "packet-ocsp.h"
45#include "packet-tls.h"
46#include "packet-dtls.h"
47#include "packet-quic.h"
48#if defined(HAVE_LIBGNUTLS1)
49#include <gnutls/abstract.h>
50#endif
51
52/* JA3/JA3S calculations must ignore GREASE values
53 * as described in RFC 8701.
54 */
55#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff)))
((((x) & 0x0f0f) == 0x0a0a) && \
56 (((x) & 0xff) == (((x)>>8) & 0xff)))
57
58/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
59 * form for a similar purpose as GREASE.
60 */
61#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
62
63#define DTLS13_MAX_EPOCH10 10
64
65/* Lookup tables {{{ */
66const value_string ssl_version_short_names[] = {
67 { SSLV2_VERSION0x0002, "SSLv2" },
68 { SSLV3_VERSION0x300, "SSLv3" },
69 { TLSV1_VERSION0x301, "TLSv1" },
70 { TLCPV1_VERSION0x101, "TLCP" },
71 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
72 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
73 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
74 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
75 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
76 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
77 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
78 { 0x00, NULL((void*)0) }
79};
80
81const value_string ssl_versions[] = {
82 { SSLV2_VERSION0x0002, "SSL 2.0" },
83 { SSLV3_VERSION0x300, "SSL 3.0" },
84 { TLSV1_VERSION0x301, "TLS 1.0" },
85 { TLCPV1_VERSION0x101, "TLCP" },
86 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
87 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
88 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
89 { 0x7F0E, "TLS 1.3 (draft 14)" },
90 { 0x7F0F, "TLS 1.3 (draft 15)" },
91 { 0x7F10, "TLS 1.3 (draft 16)" },
92 { 0x7F11, "TLS 1.3 (draft 17)" },
93 { 0x7F12, "TLS 1.3 (draft 18)" },
94 { 0x7F13, "TLS 1.3 (draft 19)" },
95 { 0x7F14, "TLS 1.3 (draft 20)" },
96 { 0x7F15, "TLS 1.3 (draft 21)" },
97 { 0x7F16, "TLS 1.3 (draft 22)" },
98 { 0x7F17, "TLS 1.3 (draft 23)" },
99 { 0x7F18, "TLS 1.3 (draft 24)" },
100 { 0x7F19, "TLS 1.3 (draft 25)" },
101 { 0x7F1A, "TLS 1.3 (draft 26)" },
102 { 0x7F1B, "TLS 1.3 (draft 27)" },
103 { 0x7F1C, "TLS 1.3 (draft 28)" },
104 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
105 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
106 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
107 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
108 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
109 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
110 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
111 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
112 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
113 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0x00, NULL((void*)0) }
127};
128
129static const value_string ssl_version_ja4_names[] = {
130 { 0x0100, "s1" },
131 { SSLV2_VERSION0x0002, "s2" },
132 { SSLV3_VERSION0x300, "s3" },
133 { TLSV1_VERSION0x301, "10" },
134 { TLSV1DOT1_VERSION0x302, "11" },
135 { TLSV1DOT2_VERSION0x303, "12" },
136 { TLSV1DOT3_VERSION0x304, "13" },
137 { DTLSV1DOT0_VERSION0xfeff, "d1" },
138 { DTLSV1DOT2_VERSION0xfefd, "d2" },
139 { DTLSV1DOT3_VERSION0xfefc, "d3" },
140 { 0x00, NULL((void*)0) }
141};
142
143const value_string ssl_20_msg_types[] = {
144 { SSL2_HND_ERROR0x00, "Error" },
145 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
146 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
147 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
148 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
149 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
150 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
151 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
152 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
153 { 0x00, NULL((void*)0) }
154};
155/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
156/* Note: sorted by ascending value so value_string-ext can do a binary search */
157static const value_string ssl_20_cipher_suites[] = {
158 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
159 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
160 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
161 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
162 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
163 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
164 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
165 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
166 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
167 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
168 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
169 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
171 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
174 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
175 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
177 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
180 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
182 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
183 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
184 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
185 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
186 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
187 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
188#if 0
189 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
190#endif
191 /* RFC 2712 */
192 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
193 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
194 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
195 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
196 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
197 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
198 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
199 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
200 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
201 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
202 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
203 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
204 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
205 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
206 /* RFC 4785 */
207 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
208 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
209 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
210 /* RFC 5246 */
211 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
212 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
213 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
214 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
215 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
216 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
217 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
218 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
219 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
220 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
221 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
222 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
223 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
224 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
225 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
226 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
227 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
229 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
230 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
231 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
232 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
236 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
237 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
238 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
239 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
240 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
241 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
242 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
243 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
244 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
245 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
246 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
247 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
248 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
249 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
250 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
251 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
252 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
253 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
254 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
255 /* 0x00,0x6E-83 Unassigned */
256 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
257 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
258 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
259 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
262 /* RFC 4279 */
263 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
264 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
265 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
266 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
267 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
268 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
269 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
270 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
271 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
272 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
273 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
274 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
275 /* RFC 4162 */
276 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
277 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
278 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
279 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
280 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
281 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
282 /* RFC 5288 */
283 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
284 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
285 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
286 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
287 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
288 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
289 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
290 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
291 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
292 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
293 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
294 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
295 /* RFC 5487 */
296 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
298 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
299 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
300 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
301 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
302 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
303 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
304 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
305 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
306 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
307 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
308 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
309 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
310 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
311 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
312 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
313 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
314 /* From RFC 5932 */
315 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
316 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
317 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
318 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
322 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
323 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
324 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
327 /* 0x00,0xC6-FE Unassigned */
328 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
329 /* 0x01-BF,* Unassigned */
330 /* From RFC 4492 */
331 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
332 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
333 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
334 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
335 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
336 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
337 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
338 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
339 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
340 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
341 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
342 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
343 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
344 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
345 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
346 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
347 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
348 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
349 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
350 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
351 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
352 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
353 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
354 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
355 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
356 /* RFC 5054 */
357 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
358 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
359 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
360 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
361 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
362 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
363 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
364 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
365 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
366 /* RFC 5589 */
367 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
368 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
369 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
370 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
371 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
372 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
373 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
374 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
375 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
376 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
377 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
378 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
379 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
380 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
381 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
382 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
383 /* RFC 5489 */
384 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
385 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
386 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
387 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
388 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
389 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
390 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
391 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
392 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
393 /* 0xC0,0x3C-FF Unassigned
394 0xC1-FD,* Unassigned
395 0xFE,0x00-FD Unassigned
396 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
397 0xFF,0x00-FF Reserved for Private Use [RFC5246]
398 */
399
400 /* old numbers used in the beginning
401 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
402 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
403 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
404 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
405
406 /* https://tools.ietf.org/html/rfc7905 */
407 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
409 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
410 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414
415 /* GM/T 0024-2014 */
416 { 0x00e001, "ECDHE_SM1_SM3"},
417 { 0x00e003, "ECC_SM1_SM3"},
418 { 0x00e005, "IBSDH_SM1_SM3"},
419 { 0x00e007, "IBC_SM1_SM3"},
420 { 0x00e009, "RSA_SM1_SM3"},
421 { 0x00e00a, "RSA_SM1_SHA1"},
422 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
423 { 0x00e013, "ECC_SM4_CBC_SM3"},
424 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
425 { 0x00e017, "IBC_SM4_CBC_SM3"},
426 { 0x00e019, "RSA_SM4_CBC_SM3"},
427 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
428 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
429 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
430 { 0x00e053, "ECC_SM4_GCM_SM3"},
431 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
432 { 0x00e057, "IBC_SM4_GCM_SM3"},
433 { 0x00e059, "RSA_SM4_GCM_SM3"},
434 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
435
436 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
437 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
438 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
439 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
440 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
441 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
442 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
443 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
444 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
445 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
446 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
447 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
448 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
449 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
450 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
451 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
452 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
453
454 /* these from http://www.mozilla.org/projects/
455 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
456 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
457 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
458 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
459 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 /* note that ciphersuites of {0x00????} are TLS cipher suites in
461 * a sslv2 client hello message; the ???? above is the two-byte
462 * tls cipher suite id
463 */
464
465 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
466 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
467 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
468 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
469 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
470 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
471 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
472 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
473
474 { 0x00, NULL((void*)0) }
475};
476
477value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites" }
;
478
479
480/*
481 * Supported Groups (formerly named "EC Named Curve").
482 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
483 */
484const value_string ssl_extension_curves[] = {
485 { 1, "sect163k1" },
486 { 2, "sect163r1" },
487 { 3, "sect163r2" },
488 { 4, "sect193r1" },
489 { 5, "sect193r2" },
490 { 6, "sect233k1" },
491 { 7, "sect233r1" },
492 { 8, "sect239k1" },
493 { 9, "sect283k1" },
494 { 10, "sect283r1" },
495 { 11, "sect409k1" },
496 { 12, "sect409r1" },
497 { 13, "sect571k1" },
498 { 14, "sect571r1" },
499 { 15, "secp160k1" },
500 { 16, "secp160r1" },
501 { 17, "secp160r2" },
502 { 18, "secp192k1" },
503 { 19, "secp192r1" },
504 { 20, "secp224k1" },
505 { 21, "secp224r1" },
506 { 22, "secp256k1" },
507 { 23, "secp256r1" },
508 { 24, "secp384r1" },
509 { 25, "secp521r1" },
510 { 26, "brainpoolP256r1" }, /* RFC 7027 */
511 { 27, "brainpoolP384r1" }, /* RFC 7027 */
512 { 28, "brainpoolP512r1" }, /* RFC 7027 */
513 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
514 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
515 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
516 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
517 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
518 { 34, "GC256A" }, /* RFC9189 */
519 { 35, "GC256B" }, /* RFC9189 */
520 { 36, "GC256C" }, /* RFC9189 */
521 { 37, "GC256D" }, /* RFC9189 */
522 { 38, "GC512A" }, /* RFC9189 */
523 { 39, "GC512B" }, /* RFC9189 */
524 { 40, "GC512C" }, /* RFC9189 */
525 { 41, "curveSM2" }, /* RFC 8998 */
526 { 256, "ffdhe2048" }, /* RFC 7919 */
527 { 257, "ffdhe3072" }, /* RFC 7919 */
528 { 258, "ffdhe4096" }, /* RFC 7919 */
529 { 259, "ffdhe6144" }, /* RFC 7919 */
530 { 260, "ffdhe8192" }, /* RFC 7919 */
531 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
532 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
533 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
534 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
535 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
536 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
537 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
538 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
539 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
540 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
541 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
544 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
545 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
547 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
548 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 0xFF01, "arbitrary_explicit_prime_curves" },
556 { 0xFF02, "arbitrary_explicit_char2_curves" },
557 /* Below are various unofficial values that have been used for testing. */
558 /* PQC key exchange algorithms from OQS-OpenSSL,
559 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
560 These use IANA unassigned values and this list may be incomplete.
561 */
562 { 0x2F00, "p256_frodo640aes" },
563 { 0x2F01, "p256_frodo640shake" },
564 { 0x2F02, "p384_frodo976aes" },
565 { 0x0203, "frodo976shake" },
566 { 0x2F03, "p384_frodo976shake" },
567 { 0x0204, "frodo1344aes" },
568 { 0x2F04, "p521_frodo1344aes" },
569 { 0x0205, "frodo1344shake" },
570 { 0x2F05, "p521_frodo1344shake" },
571 { 0x023A, "kyber512" },
572 { 0x2F3A, "p256_kyber512" },
573 { 0x023C, "kyber768" },
574 { 0x2F3C, "p384_kyber768" },
575 { 0x023D, "kyber1024" },
576 { 0x2F3D, "p521_kyber1024" },
577 { 0x0214, "ntru_hps2048509" },
578 { 0x2F14, "p256_ntru_hps2048509" },
579 { 0x0215, "ntru_hps2048677" },
580 { 0x2F15, "p384_ntru_hps2048677" },
581 { 0x0216, "ntru_hps4096821" },
582 { 0x2F16, "p521_ntru_hps4096821" },
583 { 0x0245, "ntru_hps40961229" },
584 { 0x2F45, "p521_ntru_hps40961229" },
585 { 0x0217, "ntru_hrss701" },
586 { 0x2F17, "p384_ntru_hrss701" },
587 { 0x0246, "ntru_hrss1373" },
588 { 0x2F46, "p521_ntru_hrss1373" },
589 { 0x0218, "lightsaber" },
590 { 0x2F18, "p256_lightsaber" },
591 { 0x0219, "saber" },
592 { 0x2F19, "p384_saber" },
593 { 0x021A, "firesaber" },
594 { 0x2F1A, "p521_firesaber" },
595 { 0x021B, "sidhp434" },
596 { 0x2F1B, "p256_sidhp434" },
597 { 0x021C, "sidhp503" },
598 { 0x2F1C, "p256_sidhp503" },
599 { 0x021D, "sidhp610" },
600 { 0x2F1D, "p384_sidhp610" },
601 { 0x021E, "sidhp751" },
602 { 0x2F1E, "p521_sidhp751" },
603 { 0x021F, "sikep434" },
604 { 0x2F1F, "p256_sikep434" },
605 { 0x0220, "sikep503" },
606 { 0x2F20, "p256_sikep503" },
607 { 0x0221, "sikep610" },
608 { 0x2F21, "p384_sikep610" },
609 { 0x0222, "sikep751" },
610 { 0x2F22, "p521_sikep751" },
611 { 0x0238, "bikel1" },
612 { 0x2F38, "p256_bikel1" },
613 { 0x023B, "bikel3" },
614 { 0x2F3B, "p384_bikel3" },
615 { 0x023E, "kyber90s512" },
616 { 0x2F3E, "p256_kyber90s512" },
617 { 0x023F, "kyber90s768" },
618 { 0x2F3F, "p384_kyber90s768" },
619 { 0x0240, "kyber90s1024" },
620 { 0x2F40, "p521_kyber90s1024" },
621 { 0x022C, "hqc128" },
622 { 0x2F2C, "p256_hqc128" },
623 { 0x022D, "hqc192" },
624 { 0x2F2D, "p384_hqc192" },
625 { 0x022E, "hqc256" },
626 { 0x2F2E, "p521_hqc256" },
627 { 0x022F, "ntrulpr653" },
628 { 0x2F2F, "p256_ntrulpr653" },
629 { 0x0230, "ntrulpr761" },
630 { 0x2F43, "p256_ntrulpr761" },
631 { 0x0231, "ntrulpr857" },
632 { 0x2F31, "p384_ntrulpr857" },
633 { 0x0241, "ntrulpr1277" },
634 { 0x2F41, "p521_ntrulpr1277" },
635 { 0x0232, "sntrup653" },
636 { 0x2F32, "p256_sntrup653" },
637 { 0x0233, "sntrup761" },
638 { 0x2F44, "p256_sntrup761" },
639 { 0x0234, "sntrup857" },
640 { 0x2F34, "p384_sntrup857" },
641 { 0x0242, "sntrup1277" },
642 { 0x2F42, "p521_sntrup1277" },
643 /* Other PQ key exchange algorithms, using Reserved for Private Use values
644 https://blog.cloudflare.com/post-quantum-for-all
645 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
646 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
647 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
648 { 0x00, NULL((void*)0) }
649};
650
651const value_string ssl_curve_types[] = {
652 { 1, "explicit_prime" },
653 { 2, "explicit_char2" },
654 { 3, "named_curve" },
655 { 0x00, NULL((void*)0) }
656};
657
658const value_string ssl_extension_ec_point_formats[] = {
659 { 0, "uncompressed" },
660 { 1, "ansiX962_compressed_prime" },
661 { 2, "ansiX962_compressed_char2" },
662 { 0x00, NULL((void*)0) }
663};
664
665const value_string ssl_20_certificate_type[] = {
666 { 0x00, "N/A" },
667 { 0x01, "X.509 Certificate" },
668 { 0x00, NULL((void*)0) }
669};
670
671const value_string ssl_31_content_type[] = {
672 { 20, "Change Cipher Spec" },
673 { 21, "Alert" },
674 { 22, "Handshake" },
675 { 23, "Application Data" },
676 { 24, "Heartbeat" },
677 { 25, "Connection ID" },
678 { 0x00, NULL((void*)0) }
679};
680
681#if 0
682/* XXX - would be used if we dissected the body of a Change Cipher Spec
683 message. */
684const value_string ssl_31_change_cipher_spec[] = {
685 { 1, "Change Cipher Spec" },
686 { 0x00, NULL((void*)0) }
687};
688#endif
689
690const value_string ssl_31_alert_level[] = {
691 { 1, "Warning" },
692 { 2, "Fatal" },
693 { 0x00, NULL((void*)0) }
694};
695
696const value_string ssl_31_alert_description[] = {
697 { 0, "Close Notify" },
698 { 1, "End of Early Data" },
699 { 10, "Unexpected Message" },
700 { 20, "Bad Record MAC" },
701 { 21, "Decryption Failed" },
702 { 22, "Record Overflow" },
703 { 30, "Decompression Failure" },
704 { 40, "Handshake Failure" },
705 { 41, "No Certificate" },
706 { 42, "Bad Certificate" },
707 { 43, "Unsupported Certificate" },
708 { 44, "Certificate Revoked" },
709 { 45, "Certificate Expired" },
710 { 46, "Certificate Unknown" },
711 { 47, "Illegal Parameter" },
712 { 48, "Unknown CA" },
713 { 49, "Access Denied" },
714 { 50, "Decode Error" },
715 { 51, "Decrypt Error" },
716 { 60, "Export Restriction" },
717 { 70, "Protocol Version" },
718 { 71, "Insufficient Security" },
719 { 80, "Internal Error" },
720 { 86, "Inappropriate Fallback" },
721 { 90, "User Canceled" },
722 { 100, "No Renegotiation" },
723 { 109, "Missing Extension" },
724 { 110, "Unsupported Extension" },
725 { 111, "Certificate Unobtainable" },
726 { 112, "Unrecognized Name" },
727 { 113, "Bad Certificate Status Response" },
728 { 114, "Bad Certificate Hash Value" },
729 { 115, "Unknown PSK Identity" },
730 { 116, "Certificate Required" },
731 { 120, "No application Protocol" },
732 { 121, "ECH Required" },
733 { 0x00, NULL((void*)0) }
734};
735
736const value_string ssl_31_handshake_type[] = {
737 { SSL_HND_HELLO_REQUEST, "Hello Request" },
738 { SSL_HND_CLIENT_HELLO, "Client Hello" },
739 { SSL_HND_SERVER_HELLO, "Server Hello" },
740 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
741 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
742 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
743 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
744 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
745 { SSL_HND_CERTIFICATE, "Certificate" },
746 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
747 { SSL_HND_CERT_REQUEST, "Certificate Request" },
748 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
749 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
750 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
751 { SSL_HND_FINISHED, "Finished" },
752 { SSL_HND_CERT_URL, "Client Certificate URL" },
753 { SSL_HND_CERT_STATUS, "Certificate Status" },
754 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
755 { SSL_HND_KEY_UPDATE, "Key Update" },
756 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
757 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
758 { 0x00, NULL((void*)0) }
759};
760
761const value_string tls_heartbeat_type[] = {
762 { 1, "Request" },
763 { 2, "Response" },
764 { 0x00, NULL((void*)0) }
765};
766
767const value_string tls_heartbeat_mode[] = {
768 { 1, "Peer allowed to send requests" },
769 { 2, "Peer not allowed to send requests" },
770 { 0x00, NULL((void*)0) }
771};
772
773const value_string ssl_31_compression_method[] = {
774 { 0, "null" },
775 { 1, "DEFLATE" },
776 { 64, "LZS" },
777 { 0x00, NULL((void*)0) }
778};
779
780#if 0
781/* XXX - would be used if we dissected a Signature, as would be
782 seen in a server key exchange or certificate verify message. */
783const value_string ssl_31_key_exchange_algorithm[] = {
784 { 0, "RSA" },
785 { 1, "Diffie Hellman" },
786 { 0x00, NULL((void*)0) }
787};
788
789const value_string ssl_31_signature_algorithm[] = {
790 { 0, "Anonymous" },
791 { 1, "RSA" },
792 { 2, "DSA" },
793 { 0x00, NULL((void*)0) }
794};
795#endif
796
797const value_string ssl_31_client_certificate_type[] = {
798 { 1, "RSA Sign" },
799 { 2, "DSS Sign" },
800 { 3, "RSA Fixed DH" },
801 { 4, "DSS Fixed DH" },
802 /* GOST certificate types */
803 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
804 { 21, "GOST R 34.10-94" },
805 { 22, "GOST R 34.10-2001" },
806 /* END GOST certificate types */
807 { 64, "ECDSA Sign" },
808 { 65, "RSA Fixed ECDH" },
809 { 66, "ECDSA Fixed ECDH" },
810 { 80, "IBC Params" },
811 { 0x00, NULL((void*)0) }
812};
813
814#if 0
815/* XXX - would be used if we dissected exchange keys, as would be
816 seen in a client key exchange message. */
817const value_string ssl_31_public_value_encoding[] = {
818 { 0, "Implicit" },
819 { 1, "Explicit" },
820 { 0x00, NULL((void*)0) }
821};
822#endif
823
824/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
825/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
826static const value_string ssl_31_ciphersuite[] = {
827 /* RFC 2246, RFC 4346, RFC 5246 */
828 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
829 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
830 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
831 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
832 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
833 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
834 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
835 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
836 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
837 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
838 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
839 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
841 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
844 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
845 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
847 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
850 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
852 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
853 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
854 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
855 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
856
857 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
858 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
859#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
860 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
861 of the ietf-tls list */
862 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
863#endif
864 /* RFC 2712 */
865 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
866 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
867 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
868 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
869 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
870 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
871 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
872 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
873 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
874 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
875 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
876 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
877 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
878 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
879 /* RFC 4785 */
880 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
881 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
882 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
883 /* RFC 5246 */
884 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
885 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
886 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
887 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
888 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
889 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
890 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
891 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
892 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
893 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
894 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
895 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
896 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
897 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
898 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
899 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
900 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
902 /* RFC 4132 */
903 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
904 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
905 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
906 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
909 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
910 /* --- ??? --- */
911 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
912 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
913 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
914 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
915 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
916 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
917 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
918 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
919 /* --- ??? ---*/
920 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
921 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
922 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
923 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
924 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
925 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
926 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
927 /* draft-chudov-cryptopro-cptls-04.txt */
928 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
929 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
930 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
931 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
932 /* RFC 4132 */
933 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
934 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
935 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
936 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
939 /* RFC 4279 */
940 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
941 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
942 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
943 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
944 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
945 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
946 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
947 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
948 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
949 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
950 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
951 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
952 /* RFC 4162 */
953 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
954 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
955 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
956 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
957 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
958 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
959 /* RFC 5288 */
960 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
961 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
962 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
963 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
964 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
965 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
966 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
967 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
968 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
969 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
970 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
971 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
972 /* RFC 5487 */
973 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
974 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
975 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
976 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
977 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
978 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
979 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
980 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
981 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
982 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
983 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
984 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
985 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
986 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
987 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
988 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
989 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
990 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
991 /* From RFC 5932 */
992 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
993 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
994 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
995 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
999 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1000 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1001 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1004 /* RFC 8998 */
1005 { 0x00C6, "TLS_SM4_GCM_SM3" },
1006 { 0x00C7, "TLS_SM4_CCM_SM3" },
1007 /* 0x00,0xC8-FE Unassigned */
1008 /* From RFC 5746 */
1009 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1010 /* RFC 8701 */
1011 { 0x0A0A, "Reserved (GREASE)" },
1012 /* RFC 8446 */
1013 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1014 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1015 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1016 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1017 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1018 /* RFC 8701 */
1019 { 0x1A1A, "Reserved (GREASE)" },
1020 { 0x2A2A, "Reserved (GREASE)" },
1021 { 0x3A3A, "Reserved (GREASE)" },
1022 { 0x4A4A, "Reserved (GREASE)" },
1023 /* From RFC 7507 */
1024 { 0x5600, "TLS_FALLBACK_SCSV" },
1025 /* RFC 8701 */
1026 { 0x5A5A, "Reserved (GREASE)" },
1027 { 0x6A6A, "Reserved (GREASE)" },
1028 { 0x7A7A, "Reserved (GREASE)" },
1029 { 0x8A8A, "Reserved (GREASE)" },
1030 { 0x9A9A, "Reserved (GREASE)" },
1031 { 0xAAAA, "Reserved (GREASE)" },
1032 { 0xBABA, "Reserved (GREASE)" },
1033 /* From RFC 4492 */
1034 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1035 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1036 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1037 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1038 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1039 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1040 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1041 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1042 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1043 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1044 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1045 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1046 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1047 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1048 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1049 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1050 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1051 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1052 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1053 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1054 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1055 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1056 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1057 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1058 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1059 /* RFC 5054 */
1060 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1061 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1062 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1063 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1064 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1065 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1066 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1067 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1068 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1069 /* RFC 5589 */
1070 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1071 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1072 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1073 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1074 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1075 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1076 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1077 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1078 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1079 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1080 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1081 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1082 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1083 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1084 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1085 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1086 /* RFC 5489 */
1087 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1088 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1089 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1090 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1091 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1092 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1093 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1094 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1095 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1096 /* RFC 6209 */
1097 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1098 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1099 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1100 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1101 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1102 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1103 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1104 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1105 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1106 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1107 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1108 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1109 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1110 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1111 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1112 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1113 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1114 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1115 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1116 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1117 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1118 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1119 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1120 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1121 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1122 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1123 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1124 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1125 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1126 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1127 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1128 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1129 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1130 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1131 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1132 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1133 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1134 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1135 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1136 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1137 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1138 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1139 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1140 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1141 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1142 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1143 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1144 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1145 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1146 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1147 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1148 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1149 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1150 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1151 /* RFC 6367 */
1152 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1153 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1154 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1155 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1156 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1157 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1158 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1159 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1160 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1161 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1162 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1163 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1164 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1165 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1166 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1167 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1168 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1169 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1170 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1171 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1172 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1173 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1174 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1175 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1176 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1177 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1178 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1179 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1180 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1181 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1182 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1183 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1184 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1185 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1186 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1187 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1188 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1189 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1190 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1191 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1192 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1193 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1194 /* RFC 6655 */
1195 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1196 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1197 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1198 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1199 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1200 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1201 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1202 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1203 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1204 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1205 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1206 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1207 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1208 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1209 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1210 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1211 /* RFC 7251 */
1212 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1213 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1214 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1215 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1216 /* RFC 8492 */
1217 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1218 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1219 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1220 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1221 /* draft-camwinget-tls-ts13-macciphersuites */
1222 { 0xC0B4, "TLS_SHA256_SHA256" },
1223 { 0xC0B5, "TLS_SHA384_SHA384" },
1224 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1225 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1226 /* draft-smyshlyaev-tls12-gost-suites */
1227 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1228 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1229 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1230 /* draft-smyshlyaev-tls13-gost-suites */
1231 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1232 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1233 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1234 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1235 /* RFC 8701 */
1236 { 0xCACA, "Reserved (GREASE)" },
1237/*
12380xC0,0xAB-FF Unassigned
12390xC1,0x03-FD,* Unassigned
12400xFE,0x00-FD Unassigned
12410xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12420xFF,0x00-FF Reserved for Private Use [RFC5246]
1243*/
1244 /* old numbers used in the beginning
1245 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1246 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1247 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1248 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1249 /* RFC 7905 */
1250 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1253 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 /* RFC 8442 */
1258 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1259 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1260 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1261 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1262 /* RFC 8701 */
1263 { 0xDADA, "Reserved (GREASE)" },
1264 /* GM/T 0024-2014 */
1265 { 0xe001, "ECDHE_SM1_SM3"},
1266 { 0xe003, "ECC_SM1_SM3"},
1267 { 0xe005, "IBSDH_SM1_SM3"},
1268 { 0xe007, "IBC_SM1_SM3"},
1269 { 0xe009, "RSA_SM1_SM3"},
1270 { 0xe00a, "RSA_SM1_SHA1"},
1271 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1272 { 0xe013, "ECC_SM4_CBC_SM3"},
1273 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1274 { 0xe017, "IBC_SM4_CBC_SM3"},
1275 { 0xe019, "RSA_SM4_CBC_SM3"},
1276 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1277 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1278 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1279 { 0xe053, "ECC_SM4_GCM_SM3"},
1280 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1281 { 0xe057, "IBC_SM4_GCM_SM3"},
1282 { 0xe059, "RSA_SM4_GCM_SM3"},
1283 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1284 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1285 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1286 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1287 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1288 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1289 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1290 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1291 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1292 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1293 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1294 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1295 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1296 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1297 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1298 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1299 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1300 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1301 /* RFC 8701 */
1302 { 0xEAEA, "Reserved (GREASE)" },
1303 { 0xFAFA, "Reserved (GREASE)" },
1304 /* these from http://www.mozilla.org/projects/
1305 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1306 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1307 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1308 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1309 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1310 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1312 /* note that ciphersuites 0xff00 - 0xffff are private */
1313 { 0x00, NULL((void*)0) }
1314};
1315
1316value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
}
;
1317
1318/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1319const value_string tls_hello_extension_types[] = {
1320 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1321 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1322 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1323 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1327 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1328 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1329 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1330 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1331 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1332 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1333 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1334 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1335 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1336 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1337 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1338 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1339 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1340 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1341 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1342 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1343 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1344 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1345 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1346 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1347 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1348 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1349 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1350 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1351 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1352 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1353 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1354 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1357 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1360 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1363 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1364 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1365 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1366 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1367 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1368 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1369 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1370 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1371 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1372 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1373 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://tools.ietf.org/id/draft-agl-tls-nextprotoneg-03.html */
1374 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1376 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1377 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1379 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1380 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1381 https://twitter.com/ericlaw/status/274237352531083264 */
1382 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1383 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1384 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1385 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1386 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1387 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1388 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1395 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1396 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1397 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1398 { 0, NULL((void*)0) }
1399};
1400
1401const value_string tls_hello_ext_server_name_type_vs[] = {
1402 { 0, "host_name" },
1403 { 0, NULL((void*)0) }
1404};
1405
1406/* RFC 6066 Section 4 */
1407const value_string tls_hello_ext_max_fragment_length[] = {
1408 { 1, "512" }, // 2^9
1409 { 2, "1024" }, // 2^10
1410 { 3, "2048" }, // 2^11
1411 { 4, "4096" }, // 2^12
1412 { 0, NULL((void*)0) }
1413};
1414
1415/* RFC 8446 Section 4.2.9 */
1416const value_string tls_hello_ext_psk_ke_mode[] = {
1417 { 0, "PSK-only key establishment (psk_ke)" },
1418 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1419 { 0, NULL((void*)0) }
1420};
1421
1422/* RFC 6066 Section 6 */
1423const value_string tls_hello_ext_trusted_ca_key_type[] = {
1424 {0, "pre_agreed"},
1425 {1, "key_sha1_hash"},
1426 {2, "x509_name"},
1427 {3, "cert_sha1_hash"},
1428 {0, NULL((void*)0)}
1429};
1430
1431const value_string tls13_key_update_request[] = {
1432 { 0, "update_not_requested" },
1433 { 1, "update_requested" },
1434 { 0, NULL((void*)0) }
1435};
1436
1437/* RFC 5246 7.4.1.4.1 */
1438/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1439/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1440 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1441 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1442 *
1443 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1444 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1445 * and TLS HashAlgorithm registries, but the new values are not compatible
1446 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1447 * cause confusion if used to interpret one of those schemes in a
1448 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1449 */
1450const value_string tls_hash_algorithm[] = {
1451 { 0, "None" },
1452 { 1, "MD5" },
1453 { 2, "SHA1" },
1454 { 3, "SHA224" },
1455 { 4, "SHA256" },
1456 { 5, "SHA384" },
1457 { 6, "SHA512" },
1458#if 0
1459 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1460 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1461 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1462 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1463 */
1464 { 8, "Intrinsic" },
1465#endif
1466 { 0, NULL((void*)0) }
1467};
1468
1469const value_string tls_signature_algorithm[] = {
1470 { 0, "Anonymous" },
1471 { 1, "RSA" },
1472 { 2, "DSA" },
1473 { 3, "ECDSA" },
1474#if 0
1475 /* As above. */
1476 { 7, "ED25519" },
1477 { 8, "ED448" },
1478 { 64, "GOSTR34102012_256" },
1479 { 65, "GOSTR34102012_512" },
1480#endif
1481 { 0, NULL((void*)0) }
1482};
1483
1484/* RFC 8446 Section 4.2.3 */
1485const value_string tls13_signature_algorithm[] = {
1486 { 0x0201, "rsa_pkcs1_sha1" },
1487 { 0x0203, "ecdsa_sha1" },
1488 { 0x0401, "rsa_pkcs1_sha256" },
1489 { 0x0403, "ecdsa_secp256r1_sha256" },
1490 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1491 { 0x0501, "rsa_pkcs1_sha384" },
1492 { 0x0503, "ecdsa_secp384r1_sha384" },
1493 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0601, "rsa_pkcs1_sha512" },
1495 { 0x0603, "ecdsa_secp521r1_sha512" },
1496 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0708, "sm2sig_sm3" },
1498 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1499 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1500 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1501 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1502 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1503 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1504 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1505 { 0x0804, "rsa_pss_rsae_sha256" },
1506 { 0x0805, "rsa_pss_rsae_sha384" },
1507 { 0x0806, "rsa_pss_rsae_sha512" },
1508 { 0x0807, "ed25519" },
1509 { 0x0808, "ed448" },
1510 { 0x0809, "rsa_pss_pss_sha256" },
1511 { 0x080a, "rsa_pss_pss_sha384" },
1512 { 0x080b, "rsa_pss_pss_sha512" },
1513 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1514 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1515 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1516 /* PQC digital signature algorithms from OQS-OpenSSL,
1517 see https://github.com/open-quantum-safe/openssl/blob/OQS-OpenSSL_1_1_1-stable/oqs-template/oqs-sig-info.md */
1518 { 0xfea0, "dilithium2" },
1519 { 0xfea1, "p256_dilithium2" },
1520 { 0xfea2, "rsa3072_dilithium2" },
1521 { 0xfea3, "dilithium3" },
1522 { 0xfea4, "p384_dilithium3" },
1523 { 0xfea5, "dilithium5" },
1524 { 0xfea6, "p521_dilithium5" },
1525 { 0xfea7, "dilithium2_aes" },
1526 { 0xfea8, "p256_dilithium2_aes" },
1527 { 0xfea9, "rsa3072_dilithium2_aes" },
1528 { 0xfeaa, "dilithium3_aes" },
1529 { 0xfeab, "p384_dilithium3_aes" },
1530 { 0xfeac, "dilithium5_aes" },
1531 { 0xfead, "p521_dilithium5_aes" },
1532 { 0xfe0b, "falcon512" },
1533 { 0xfe0c, "p256_falcon512" },
1534 { 0xfe0d, "rsa3072_falcon512" },
1535 { 0xfe0e, "falcon1024" },
1536 { 0xfe0f, "p521_falcon1024" },
1537 { 0xfe96, "picnicl1full" },
1538 { 0xfe97, "p256_picnicl1full" },
1539 { 0xfe98, "rsa3072_picnicl1full" },
1540 { 0xfe1b, "picnic3l1" },
1541 { 0xfe1c, "p256_picnic3l1" },
1542 { 0xfe1d, "rsa3072_picnic3l1" },
1543 { 0xfe27, "rainbowIclassic" },
1544 { 0xfe28, "p256_rainbowIclassic" },
1545 { 0xfe29, "rsa3072_rainbowIclassic" },
1546 { 0xfe3c, "rainbowVclassic" },
1547 { 0xfe3d, "p521_rainbowVclassic" },
1548 { 0xfe42, "sphincsharaka128frobust" },
1549 { 0xfe43, "p256_sphincsharaka128frobust" },
1550 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1551 { 0xfe5e, "sphincssha256128frobust" },
1552 { 0xfe5f, "p256_sphincssha256128frobust" },
1553 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1554 { 0xfe7a, "sphincsshake256128frobust" },
1555 { 0xfe7b, "p256_sphincsshake256128frobust" },
1556 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1557 { 0, NULL((void*)0) }
1558};
1559
1560/* RFC 6091 3.1 */
1561const value_string tls_certificate_type[] = {
1562 { 0, "X.509" },
1563 { 1, "OpenPGP" },
1564 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1565 { 0, NULL((void*)0) }
1566};
1567
1568const value_string tls_cert_chain_type[] = {
1569 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1570 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1571 { 0, NULL((void*)0) }
1572};
1573
1574const value_string tls_cert_status_type[] = {
1575 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1576 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1577 { 0, NULL((void*)0) }
1578};
1579
1580/* Generated by tools/make-tls-ct-logids.py
1581 * Last-Modified Sat, 21 Jun 2025 20:28:00 GMT, 176 entries. */
1582static const bytes_string ct_logids[] = {
1583 { (const uint8_t[]){
1584 0xb2, 0x1e, 0x05, 0xcc, 0x8b, 0xa2, 0xcd, 0x8a, 0x20, 0x4e, 0x87,
1585 0x66, 0xf9, 0x2b, 0xb9, 0x8a, 0x25, 0x20, 0x67, 0x6b, 0xda, 0xfa,
1586 0x70, 0xe7, 0xb2, 0x49, 0x53, 0x2d, 0xef, 0x8b, 0x90, 0x5e,
1587 },
1588 32, "Google 'Argon2020' log" },
1589 { (const uint8_t[]){
1590 0xf6, 0x5c, 0x94, 0x2f, 0xd1, 0x77, 0x30, 0x22, 0x14, 0x54, 0x18,
1591 0x08, 0x30, 0x94, 0x56, 0x8e, 0xe3, 0x4d, 0x13, 0x19, 0x33, 0xbf,
1592 0xdf, 0x0c, 0x2f, 0x20, 0x0b, 0xcc, 0x4e, 0xf1, 0x64, 0xe3,
1593 },
1594 32, "Google 'Argon2021' log" },
1595 { (const uint8_t[]){
1596 0x29, 0x79, 0xbe, 0xf0, 0x9e, 0x39, 0x39, 0x21, 0xf0, 0x56, 0x73,
1597 0x9f, 0x63, 0xa5, 0x77, 0xe5, 0xbe, 0x57, 0x7d, 0x9c, 0x60, 0x0a,
1598 0xf8, 0xf9, 0x4d, 0x5d, 0x26, 0x5c, 0x25, 0x5d, 0xc7, 0x84,
1599 },
1600 32, "Google 'Argon2022' log" },
1601 { (const uint8_t[]){
1602 0xe8, 0x3e, 0xd0, 0xda, 0x3e, 0xf5, 0x06, 0x35, 0x32, 0xe7, 0x57,
1603 0x28, 0xbc, 0x89, 0x6b, 0xc9, 0x03, 0xd3, 0xcb, 0xd1, 0x11, 0x6b,
1604 0xec, 0xeb, 0x69, 0xe1, 0x77, 0x7d, 0x6d, 0x06, 0xbd, 0x6e,
1605 },
1606 32, "Google 'Argon2023' log" },
1607 { (const uint8_t[]){
1608 0xee, 0xcd, 0xd0, 0x64, 0xd5, 0xdb, 0x1a, 0xce, 0xc5, 0x5c, 0xb7,
1609 0x9d, 0xb4, 0xcd, 0x13, 0xa2, 0x32, 0x87, 0x46, 0x7c, 0xbc, 0xec,
1610 0xde, 0xc3, 0x51, 0x48, 0x59, 0x46, 0x71, 0x1f, 0xb5, 0x9b,
1611 },
1612 32, "Google 'Argon2024' log" },
1613 { (const uint8_t[]){
1614 0x4e, 0x75, 0xa3, 0x27, 0x5c, 0x9a, 0x10, 0xc3, 0x38, 0x5b, 0x6c,
1615 0xd4, 0xdf, 0x3f, 0x52, 0xeb, 0x1d, 0xf0, 0xe0, 0x8e, 0x1b, 0x8d,
1616 0x69, 0xc0, 0xb1, 0xfa, 0x64, 0xb1, 0x62, 0x9a, 0x39, 0xdf,
1617 },
1618 32, "Google 'Argon2025h1' log" },
1619 { (const uint8_t[]){
1620 0x12, 0xf1, 0x4e, 0x34, 0xbd, 0x53, 0x72, 0x4c, 0x84, 0x06, 0x19,
1621 0xc3, 0x8f, 0x3f, 0x7a, 0x13, 0xf8, 0xe7, 0xb5, 0x62, 0x87, 0x88,
1622 0x9c, 0x6d, 0x30, 0x05, 0x84, 0xeb, 0xe5, 0x86, 0x26, 0x3a,
1623 },
1624 32, "Google 'Argon2025h2' log" },
1625 { (const uint8_t[]){
1626 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1627 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1628 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1629 },
1630 32, "Google 'Argon2026h1' log" },
1631 { (const uint8_t[]){
1632 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1633 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1634 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1635 },
1636 32, "Google 'Argon2026h2' log" },
1637 { (const uint8_t[]){
1638 0x07, 0xb7, 0x5c, 0x1b, 0xe5, 0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6,
1639 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6, 0x57, 0x7c, 0x57, 0x94, 0xb7,
1640 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69, 0xd3, 0xa2, 0x1c,
1641 },
1642 32, "Google 'Xenon2020' log" },
1643 { (const uint8_t[]){
1644 0x7d, 0x3e, 0xf2, 0xf8, 0x8f, 0xff, 0x88, 0x55, 0x68, 0x24, 0xc2,
1645 0xc0, 0xca, 0x9e, 0x52, 0x89, 0x79, 0x2b, 0xc5, 0x0e, 0x78, 0x09,
1646 0x7f, 0x2e, 0x6a, 0x97, 0x68, 0x99, 0x7e, 0x22, 0xf0, 0xd7,
1647 },
1648 32, "Google 'Xenon2021' log" },
1649 { (const uint8_t[]){
1650 0x46, 0xa5, 0x55, 0xeb, 0x75, 0xfa, 0x91, 0x20, 0x30, 0xb5, 0xa2,
1651 0x89, 0x69, 0xf4, 0xf3, 0x7d, 0x11, 0x2c, 0x41, 0x74, 0xbe, 0xfd,
1652 0x49, 0xb8, 0x85, 0xab, 0xf2, 0xfc, 0x70, 0xfe, 0x6d, 0x47,
1653 },
1654 32, "Google 'Xenon2022' log" },
1655 { (const uint8_t[]){
1656 0xad, 0xf7, 0xbe, 0xfa, 0x7c, 0xff, 0x10, 0xc8, 0x8b, 0x9d, 0x3d,
1657 0x9c, 0x1e, 0x3e, 0x18, 0x6a, 0xb4, 0x67, 0x29, 0x5d, 0xcf, 0xb1,
1658 0x0c, 0x24, 0xca, 0x85, 0x86, 0x34, 0xeb, 0xdc, 0x82, 0x8a,
1659 },
1660 32, "Google 'Xenon2023' log" },
1661 { (const uint8_t[]){
1662 0x76, 0xff, 0x88, 0x3f, 0x0a, 0xb6, 0xfb, 0x95, 0x51, 0xc2, 0x61,
1663 0xcc, 0xf5, 0x87, 0xba, 0x34, 0xb4, 0xa4, 0xcd, 0xbb, 0x29, 0xdc,
1664 0x68, 0x42, 0x0a, 0x9f, 0xe6, 0x67, 0x4c, 0x5a, 0x3a, 0x74,
1665 },
1666 32, "Google 'Xenon2024' log" },
1667 { (const uint8_t[]){
1668 0xcf, 0x11, 0x56, 0xee, 0xd5, 0x2e, 0x7c, 0xaf, 0xf3, 0x87, 0x5b,
1669 0xd9, 0x69, 0x2e, 0x9b, 0xe9, 0x1a, 0x71, 0x67, 0x4a, 0xb0, 0x17,
1670 0xec, 0xac, 0x01, 0xd2, 0x5b, 0x77, 0xce, 0xcc, 0x3b, 0x08,
1671 },
1672 32, "Google 'Xenon2025h1' log" },
1673 { (const uint8_t[]){
1674 0xdd, 0xdc, 0xca, 0x34, 0x95, 0xd7, 0xe1, 0x16, 0x05, 0xe7, 0x95,
1675 0x32, 0xfa, 0xc7, 0x9f, 0xf8, 0x3d, 0x1c, 0x50, 0xdf, 0xdb, 0x00,
1676 0x3a, 0x14, 0x12, 0x76, 0x0a, 0x2c, 0xac, 0xbb, 0xc8, 0x2a,
1677 },
1678 32, "Google 'Xenon2025h2' log" },
1679 { (const uint8_t[]){
1680 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1681 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1682 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1683 },
1684 32, "Google 'Xenon2026h1' log" },
1685 { (const uint8_t[]){
1686 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1687 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1688 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1689 },
1690 32, "Google 'Xenon2026h2' log" },
1691 { (const uint8_t[]){
1692 0x68, 0xf6, 0x98, 0xf8, 0x1f, 0x64, 0x82, 0xbe, 0x3a, 0x8c, 0xee,
1693 0xb9, 0x28, 0x1d, 0x4c, 0xfc, 0x71, 0x51, 0x5d, 0x67, 0x93, 0xd4,
1694 0x44, 0xd1, 0x0a, 0x67, 0xac, 0xbb, 0x4f, 0x4f, 0xfb, 0xc4,
1695 },
1696 32, "Google 'Aviator' log" },
1697 { (const uint8_t[]){
1698 0x29, 0x3c, 0x51, 0x96, 0x54, 0xc8, 0x39, 0x65, 0xba, 0xaa, 0x50,
1699 0xfc, 0x58, 0x07, 0xd4, 0xb7, 0x6f, 0xbf, 0x58, 0x7a, 0x29, 0x72,
1700 0xdc, 0xa4, 0xc3, 0x0c, 0xf4, 0xe5, 0x45, 0x47, 0xf4, 0x78,
1701 },
1702 32, "Google 'Icarus' log" },
1703 { (const uint8_t[]){
1704 0xa4, 0xb9, 0x09, 0x90, 0xb4, 0x18, 0x58, 0x14, 0x87, 0xbb, 0x13,
1705 0xa2, 0xcc, 0x67, 0x70, 0x0a, 0x3c, 0x35, 0x98, 0x04, 0xf9, 0x1b,
1706 0xdf, 0xb8, 0xe3, 0x77, 0xcd, 0x0e, 0xc8, 0x0d, 0xdc, 0x10,
1707 },
1708 32, "Google 'Pilot' log" },
1709 { (const uint8_t[]){
1710 0xee, 0x4b, 0xbd, 0xb7, 0x75, 0xce, 0x60, 0xba, 0xe1, 0x42, 0x69,
1711 0x1f, 0xab, 0xe1, 0x9e, 0x66, 0xa3, 0x0f, 0x7e, 0x5f, 0xb0, 0x72,
1712 0xd8, 0x83, 0x00, 0xc4, 0x7b, 0x89, 0x7a, 0xa8, 0xfd, 0xcb,
1713 },
1714 32, "Google 'Rocketeer' log" },
1715 { (const uint8_t[]){
1716 0xbb, 0xd9, 0xdf, 0xbc, 0x1f, 0x8a, 0x71, 0xb5, 0x93, 0x94, 0x23,
1717 0x97, 0xaa, 0x92, 0x7b, 0x47, 0x38, 0x57, 0x95, 0x0a, 0xab, 0x52,
1718 0xe8, 0x1a, 0x90, 0x96, 0x64, 0x36, 0x8e, 0x1e, 0xd1, 0x85,
1719 },
1720 32, "Google 'Skydiver' log" },
1721 { (const uint8_t[]){
1722 0xfa, 0xd4, 0xc9, 0x7c, 0xc4, 0x9e, 0xe2, 0xf8, 0xac, 0x85, 0xc5,
1723 0xea, 0x5c, 0xea, 0x09, 0xd0, 0x22, 0x0d, 0xbb, 0xf4, 0xe4, 0x9c,
1724 0x6b, 0x50, 0x66, 0x2f, 0xf8, 0x68, 0xf8, 0x6b, 0x8c, 0x28,
1725 },
1726 32, "Google 'Argon2017' log" },
1727 { (const uint8_t[]){
1728 0xa4, 0x50, 0x12, 0x69, 0x05, 0x5a, 0x15, 0x54, 0x5e, 0x62, 0x11,
1729 0xab, 0x37, 0xbc, 0x10, 0x3f, 0x62, 0xae, 0x55, 0x76, 0xa4, 0x5e,
1730 0x4b, 0x17, 0x14, 0x45, 0x3e, 0x1b, 0x22, 0x10, 0x6a, 0x25,
1731 },
1732 32, "Google 'Argon2018' log" },
1733 { (const uint8_t[]){
1734 0x63, 0xf2, 0xdb, 0xcd, 0xe8, 0x3b, 0xcc, 0x2c, 0xcf, 0x0b, 0x72,
1735 0x84, 0x27, 0x57, 0x6b, 0x33, 0xa4, 0x8d, 0x61, 0x77, 0x8f, 0xbd,
1736 0x75, 0xa6, 0x38, 0xb1, 0xc7, 0x68, 0x54, 0x4b, 0xd8, 0x8d,
1737 },
1738 32, "Google 'Argon2019' log" },
1739 { (const uint8_t[]){
1740 0xb1, 0x0c, 0xd5, 0x59, 0xa6, 0xd6, 0x78, 0x46, 0x81, 0x1f, 0x7d,
1741 0xf9, 0xa5, 0x15, 0x32, 0x73, 0x9a, 0xc4, 0x8d, 0x70, 0x3b, 0xea,
1742 0x03, 0x23, 0xda, 0x5d, 0x38, 0x75, 0x5b, 0xc0, 0xad, 0x4e,
1743 },
1744 32, "Google 'Xenon2018' log" },
1745 { (const uint8_t[]){
1746 0x08, 0x41, 0x14, 0x98, 0x00, 0x71, 0x53, 0x2c, 0x16, 0x19, 0x04,
1747 0x60, 0xbc, 0xfc, 0x47, 0xfd, 0xc2, 0x65, 0x3a, 0xfa, 0x29, 0x2c,
1748 0x72, 0xb3, 0x7f, 0xf8, 0x63, 0xae, 0x29, 0xcc, 0xc9, 0xf0,
1749 },
1750 32, "Google 'Xenon2019' log" },
1751 { (const uint8_t[]){
1752 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1753 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1754 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1755 },
1756 32, "Google 'Submariner' log" },
1757 { (const uint8_t[]){
1758 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1759 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1760 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1761 },
1762 32, "Google 'Daedalus' log" },
1763 { (const uint8_t[]){
1764 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1765 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1766 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1767 },
1768 32, "Google 'Testtube' log" },
1769 { (const uint8_t[]){
1770 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1771 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1772 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1773 },
1774 32, "Google 'Crucible' log" },
1775 { (const uint8_t[]){
1776 0x52, 0xeb, 0x4b, 0x22, 0x5e, 0xc8, 0x96, 0x97, 0x48, 0x50, 0x67,
1777 0x5f, 0x23, 0xe4, 0x3b, 0xc1, 0xd0, 0x21, 0xe3, 0x21, 0x4c, 0xe5,
1778 0x2e, 0xcd, 0x5f, 0xa8, 0x7c, 0x20, 0x3c, 0xdf, 0xca, 0x03,
1779 },
1780 32, "Google 'Solera2018' log" },
1781 { (const uint8_t[]){
1782 0x0b, 0x76, 0x0e, 0x9a, 0x8b, 0x9a, 0x68, 0x2f, 0x88, 0x98, 0x5b,
1783 0x15, 0xe9, 0x47, 0x50, 0x1a, 0x56, 0x44, 0x6b, 0xba, 0x88, 0x30,
1784 0x78, 0x5c, 0x38, 0x42, 0x99, 0x43, 0x86, 0x45, 0x0c, 0x00,
1785 },
1786 32, "Google 'Solera2019' log" },
1787 { (const uint8_t[]){
1788 0x1f, 0xc7, 0x2c, 0xe5, 0xa1, 0xb7, 0x99, 0xf4, 0x00, 0xc3, 0x59,
1789 0xbf, 0xf9, 0x6c, 0xa3, 0x91, 0x35, 0x48, 0xe8, 0x64, 0x42, 0x20,
1790 0x61, 0x09, 0x52, 0xe9, 0xba, 0x17, 0x74, 0xf7, 0xba, 0xc7,
1791 },
1792 32, "Google 'Solera2020' log" },
1793 { (const uint8_t[]){
1794 0xa3, 0xc9, 0x98, 0x45, 0xe8, 0x0a, 0xb7, 0xce, 0x00, 0x15, 0x7b,
1795 0x37, 0x42, 0xdf, 0x02, 0x07, 0xdd, 0x27, 0x2b, 0x2b, 0x60, 0x2e,
1796 0xcf, 0x98, 0xee, 0x2c, 0x12, 0xdb, 0x9c, 0x5a, 0xe7, 0xe7,
1797 },
1798 32, "Google 'Solera2021' log" },
1799 { (const uint8_t[]){
1800 0x69, 0x7a, 0xaf, 0xca, 0x1a, 0x6b, 0x53, 0x6f, 0xae, 0x21, 0x20,
1801 0x50, 0x46, 0xde, 0xba, 0xd7, 0xe0, 0xea, 0xea, 0x13, 0xd2, 0x43,
1802 0x2e, 0x6e, 0x9d, 0x8f, 0xb3, 0x79, 0xf2, 0xb9, 0xaa, 0xf3,
1803 },
1804 32, "Google 'Solera2022' log" },
1805 { (const uint8_t[]){
1806 0xf9, 0x7e, 0x97, 0xb8, 0xd3, 0x3e, 0xf7, 0xa1, 0x59, 0x02, 0xa5,
1807 0x3a, 0x19, 0xe1, 0x79, 0x90, 0xe5, 0xdc, 0x40, 0x6a, 0x03, 0x18,
1808 0x25, 0xba, 0xad, 0x93, 0xe9, 0x8f, 0x9b, 0x9c, 0x69, 0xcb,
1809 },
1810 32, "Google 'Solera2023' log" },
1811 { (const uint8_t[]){
1812 0x30, 0x24, 0xce, 0x7e, 0xeb, 0x16, 0x88, 0x62, 0x72, 0x4b, 0xea,
1813 0x70, 0x2e, 0xff, 0xf9, 0x92, 0xcf, 0xe4, 0x56, 0x43, 0x41, 0x91,
1814 0xaa, 0x59, 0x5b, 0x25, 0xf8, 0x02, 0x26, 0xc8, 0x00, 0x17,
1815 },
1816 32, "Google 'Solera2024' log" },
1817 { (const uint8_t[]){
1818 0x3f, 0xe1, 0xcb, 0x46, 0xed, 0x47, 0x35, 0x79, 0xaf, 0x01, 0x41,
1819 0xf9, 0x72, 0x4d, 0x9d, 0xc4, 0x43, 0x47, 0x2d, 0x75, 0x6e, 0x85,
1820 0xe7, 0x71, 0x9c, 0x55, 0x82, 0x48, 0x5d, 0xd4, 0xe1, 0xe4,
1821 },
1822 32, "Google 'Solera2025h1' log" },
1823 { (const uint8_t[]){
1824 0x26, 0x02, 0x39, 0x48, 0x87, 0x4c, 0xf7, 0xfc, 0xd0, 0xfb, 0x64,
1825 0x71, 0xa4, 0x3e, 0x84, 0x7e, 0xbb, 0x20, 0x0a, 0xe6, 0xe2, 0xfa,
1826 0x24, 0x23, 0x6d, 0xf6, 0xd1, 0xa6, 0x06, 0x63, 0x0f, 0xb1,
1827 },
1828 32, "Google 'Solera2025h2' log" },
1829 { (const uint8_t[]){
1830 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1831 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1832 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1833 },
1834 32, "Google 'Solera2026h1' log" },
1835 { (const uint8_t[]){
1836 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1837 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1838 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1839 },
1840 32, "Google 'Solera2026h2' log" },
1841 { (const uint8_t[]){
1842 0x5e, 0xa7, 0x73, 0xf9, 0xdf, 0x56, 0xc0, 0xe7, 0xb5, 0x36, 0x48,
1843 0x7d, 0xd0, 0x49, 0xe0, 0x32, 0x7a, 0x91, 0x9a, 0x0c, 0x84, 0xa1,
1844 0x12, 0x12, 0x84, 0x18, 0x75, 0x96, 0x81, 0x71, 0x45, 0x58,
1845 },
1846 32, "Cloudflare 'Nimbus2020' Log" },
1847 { (const uint8_t[]){
1848 0x44, 0x94, 0x65, 0x2e, 0xb0, 0xee, 0xce, 0xaf, 0xc4, 0x40, 0x07,
1849 0xd8, 0xa8, 0xfe, 0x28, 0xc0, 0xda, 0xe6, 0x82, 0xbe, 0xd8, 0xcb,
1850 0x31, 0xb5, 0x3f, 0xd3, 0x33, 0x96, 0xb5, 0xb6, 0x81, 0xa8,
1851 },
1852 32, "Cloudflare 'Nimbus2021' Log" },
1853 { (const uint8_t[]){
1854 0x41, 0xc8, 0xca, 0xb1, 0xdf, 0x22, 0x46, 0x4a, 0x10, 0xc6, 0xa1,
1855 0x3a, 0x09, 0x42, 0x87, 0x5e, 0x4e, 0x31, 0x8b, 0x1b, 0x03, 0xeb,
1856 0xeb, 0x4b, 0xc7, 0x68, 0xf0, 0x90, 0x62, 0x96, 0x06, 0xf6,
1857 },
1858 32, "Cloudflare 'Nimbus2022' Log" },
1859 { (const uint8_t[]){
1860 0x7a, 0x32, 0x8c, 0x54, 0xd8, 0xb7, 0x2d, 0xb6, 0x20, 0xea, 0x38,
1861 0xe0, 0x52, 0x1e, 0xe9, 0x84, 0x16, 0x70, 0x32, 0x13, 0x85, 0x4d,
1862 0x3b, 0xd2, 0x2b, 0xc1, 0x3a, 0x57, 0xa3, 0x52, 0xeb, 0x52,
1863 },
1864 32, "Cloudflare 'Nimbus2023' Log" },
1865 { (const uint8_t[]){
1866 0xda, 0xb6, 0xbf, 0x6b, 0x3f, 0xb5, 0xb6, 0x22, 0x9f, 0x9b, 0xc2,
1867 0xbb, 0x5c, 0x6b, 0xe8, 0x70, 0x91, 0x71, 0x6c, 0xbb, 0x51, 0x84,
1868 0x85, 0x34, 0xbd, 0xa4, 0x3d, 0x30, 0x48, 0xd7, 0xfb, 0xab,
1869 },
1870 32, "Cloudflare 'Nimbus2024' Log" },
1871 { (const uint8_t[]){
1872 0xcc, 0xfb, 0x0f, 0x6a, 0x85, 0x71, 0x09, 0x65, 0xfe, 0x95, 0x9b,
1873 0x53, 0xce, 0xe9, 0xb2, 0x7c, 0x22, 0xe9, 0x85, 0x5c, 0x0d, 0x97,
1874 0x8d, 0xb6, 0xa9, 0x7e, 0x54, 0xc0, 0xfe, 0x4c, 0x0d, 0xb0,
1875 },
1876 32, "Cloudflare 'Nimbus2025'" },
1877 { (const uint8_t[]){
1878 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1879 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1880 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1881 },
1882 32, "Cloudflare 'Nimbus2026'" },
1883 { (const uint8_t[]){
1884 0x1f, 0xbc, 0x36, 0xe0, 0x02, 0xed, 0xe9, 0x7f, 0x40, 0x19, 0x9e,
1885 0x86, 0xb3, 0x57, 0x3b, 0x8a, 0x42, 0x17, 0xd8, 0x01, 0x87, 0x74,
1886 0x6a, 0xd0, 0xda, 0x03, 0xa0, 0x60, 0x54, 0xd2, 0x0d, 0xf4,
1887 },
1888 32, "Cloudflare 'Nimbus2017' Log" },
1889 { (const uint8_t[]){
1890 0xdb, 0x74, 0xaf, 0xee, 0xcb, 0x29, 0xec, 0xb1, 0xfe, 0xca, 0x3e,
1891 0x71, 0x6d, 0x2c, 0xe5, 0xb9, 0xaa, 0xbb, 0x36, 0xf7, 0x84, 0x71,
1892 0x83, 0xc7, 0x5d, 0x9d, 0x4f, 0x37, 0xb6, 0x1f, 0xbf, 0x64,
1893 },
1894 32, "Cloudflare 'Nimbus2018' Log" },
1895 { (const uint8_t[]){
1896 0x74, 0x7e, 0xda, 0x83, 0x31, 0xad, 0x33, 0x10, 0x91, 0x21, 0x9c,
1897 0xce, 0x25, 0x4f, 0x42, 0x70, 0xc2, 0xbf, 0xfd, 0x5e, 0x42, 0x20,
1898 0x08, 0xc6, 0x37, 0x35, 0x79, 0xe6, 0x10, 0x7b, 0xcc, 0x56,
1899 },
1900 32, "Cloudflare 'Nimbus2019' Log" },
1901 { (const uint8_t[]){
1902 0x56, 0x14, 0x06, 0x9a, 0x2f, 0xd7, 0xc2, 0xec, 0xd3, 0xf5, 0xe1,
1903 0xbd, 0x44, 0xb2, 0x3e, 0xc7, 0x46, 0x76, 0xb9, 0xbc, 0x99, 0x11,
1904 0x5c, 0xc0, 0xef, 0x94, 0x98, 0x55, 0xd6, 0x89, 0xd0, 0xdd,
1905 },
1906 32, "DigiCert Log Server" },
1907 { (const uint8_t[]){
1908 0x87, 0x75, 0xbf, 0xe7, 0x59, 0x7c, 0xf8, 0x8c, 0x43, 0x99, 0x5f,
1909 0xbd, 0xf3, 0x6e, 0xff, 0x56, 0x8d, 0x47, 0x56, 0x36, 0xff, 0x4a,
1910 0xb5, 0x60, 0xc1, 0xb4, 0xea, 0xff, 0x5e, 0xa0, 0x83, 0x0f,
1911 },
1912 32, "DigiCert Log Server 2" },
1913 { (const uint8_t[]){
1914 0xf0, 0x95, 0xa4, 0x59, 0xf2, 0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d,
1915 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b, 0xfe, 0x1d, 0x47, 0xe3, 0x99,
1916 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa, 0x8e, 0xb2, 0x73,
1917 },
1918 32, "DigiCert Yeti2020 Log" },
1919 { (const uint8_t[]){
1920 0x5c, 0xdc, 0x43, 0x92, 0xfe, 0xe6, 0xab, 0x45, 0x44, 0xb1, 0x5e,
1921 0x9a, 0xd4, 0x56, 0xe6, 0x10, 0x37, 0xfb, 0xd5, 0xfa, 0x47, 0xdc,
1922 0xa1, 0x73, 0x94, 0xb2, 0x5e, 0xe6, 0xf6, 0xc7, 0x0e, 0xca,
1923 },
1924 32, "DigiCert Yeti2021 Log" },
1925 { (const uint8_t[]){
1926 0x22, 0x45, 0x45, 0x07, 0x59, 0x55, 0x24, 0x56, 0x96, 0x3f, 0xa1,
1927 0x2f, 0xf1, 0xf7, 0x6d, 0x86, 0xe0, 0x23, 0x26, 0x63, 0xad, 0xc0,
1928 0x4b, 0x7f, 0x5d, 0xc6, 0x83, 0x5c, 0x6e, 0xe2, 0x0f, 0x02,
1929 },
1930 32, "DigiCert Yeti2022 Log" },
1931 { (const uint8_t[]){
1932 0x35, 0xcf, 0x19, 0x1b, 0xbf, 0xb1, 0x6c, 0x57, 0xbf, 0x0f, 0xad,
1933 0x4c, 0x6d, 0x42, 0xcb, 0xbb, 0xb6, 0x27, 0x20, 0x26, 0x51, 0xea,
1934 0x3f, 0xe1, 0x2a, 0xef, 0xa8, 0x03, 0xc3, 0x3b, 0xd6, 0x4c,
1935 },
1936 32, "DigiCert Yeti2023 Log" },
1937 { (const uint8_t[]){
1938 0x48, 0xb0, 0xe3, 0x6b, 0xda, 0xa6, 0x47, 0x34, 0x0f, 0xe5, 0x6a,
1939 0x02, 0xfa, 0x9d, 0x30, 0xeb, 0x1c, 0x52, 0x01, 0xcb, 0x56, 0xdd,
1940 0x2c, 0x81, 0xd9, 0xbb, 0xbf, 0xab, 0x39, 0xd8, 0x84, 0x73,
1941 },
1942 32, "DigiCert Yeti2024 Log" },
1943 { (const uint8_t[]){
1944 0x7d, 0x59, 0x1e, 0x12, 0xe1, 0x78, 0x2a, 0x7b, 0x1c, 0x61, 0x67,
1945 0x7c, 0x5e, 0xfd, 0xf8, 0xd0, 0x87, 0x5c, 0x14, 0xa0, 0x4e, 0x95,
1946 0x9e, 0xb9, 0x03, 0x2f, 0xd9, 0x0e, 0x8c, 0x2e, 0x79, 0xb8,
1947 },
1948 32, "DigiCert Yeti2025 Log" },
1949 { (const uint8_t[]){
1950 0xc6, 0x52, 0xa0, 0xec, 0x48, 0xce, 0xb3, 0xfc, 0xab, 0x17, 0x09,
1951 0x92, 0xc4, 0x3a, 0x87, 0x41, 0x33, 0x09, 0xe8, 0x00, 0x65, 0xa2,
1952 0x62, 0x52, 0x40, 0x1b, 0xa3, 0x36, 0x2a, 0x17, 0xc5, 0x65,
1953 },
1954 32, "DigiCert Nessie2020 Log" },
1955 { (const uint8_t[]){
1956 0xee, 0xc0, 0x95, 0xee, 0x8d, 0x72, 0x64, 0x0f, 0x92, 0xe3, 0xc3,
1957 0xb9, 0x1b, 0xc7, 0x12, 0xa3, 0x69, 0x6a, 0x09, 0x7b, 0x4b, 0x6a,
1958 0x1a, 0x14, 0x38, 0xe6, 0x47, 0xb2, 0xcb, 0xed, 0xc5, 0xf9,
1959 },
1960 32, "DigiCert Nessie2021 Log" },
1961 { (const uint8_t[]){
1962 0x51, 0xa3, 0xb0, 0xf5, 0xfd, 0x01, 0x79, 0x9c, 0x56, 0x6d, 0xb8,
1963 0x37, 0x78, 0x8f, 0x0c, 0xa4, 0x7a, 0xcc, 0x1b, 0x27, 0xcb, 0xf7,
1964 0x9e, 0x88, 0x42, 0x9a, 0x0d, 0xfe, 0xd4, 0x8b, 0x05, 0xe5,
1965 },
1966 32, "DigiCert Nessie2022 Log" },
1967 { (const uint8_t[]){
1968 0xb3, 0x73, 0x77, 0x07, 0xe1, 0x84, 0x50, 0xf8, 0x63, 0x86, 0xd6,
1969 0x05, 0xa9, 0xdc, 0x11, 0x09, 0x4a, 0x79, 0x2d, 0xb1, 0x67, 0x0c,
1970 0x0b, 0x87, 0xdc, 0xf0, 0x03, 0x0e, 0x79, 0x36, 0xa5, 0x9a,
1971 },
1972 32, "DigiCert Nessie2023 Log" },
1973 { (const uint8_t[]){
1974 0x73, 0xd9, 0x9e, 0x89, 0x1b, 0x4c, 0x96, 0x78, 0xa0, 0x20, 0x7d,
1975 0x47, 0x9d, 0xe6, 0xb2, 0xc6, 0x1c, 0xd0, 0x51, 0x5e, 0x71, 0x19,
1976 0x2a, 0x8c, 0x6b, 0x80, 0x10, 0x7a, 0xc1, 0x77, 0x72, 0xb5,
1977 },
1978 32, "DigiCert Nessie2024 Log" },
1979 { (const uint8_t[]){
1980 0xe6, 0xd2, 0x31, 0x63, 0x40, 0x77, 0x8c, 0xc1, 0x10, 0x41, 0x06,
1981 0xd7, 0x71, 0xb9, 0xce, 0xc1, 0xd2, 0x40, 0xf6, 0x96, 0x84, 0x86,
1982 0xfb, 0xba, 0x87, 0x32, 0x1d, 0xfd, 0x1e, 0x37, 0x8e, 0x50,
1983 },
1984 32, "DigiCert Nessie2025 Log" },
1985 { (const uint8_t[]){
1986 0xb6, 0x9d, 0xdc, 0xbc, 0x3c, 0x1a, 0xbd, 0xef, 0x6f, 0x9f, 0xd6,
1987 0x0c, 0x88, 0xb1, 0x06, 0x7b, 0x77, 0xf0, 0x82, 0x68, 0x8b, 0x2d,
1988 0x78, 0x65, 0xd0, 0x4b, 0x39, 0xab, 0xe9, 0x27, 0xa5, 0x75,
1989 },
1990 32, "DigiCert 'Wyvern2024h1' Log" },
1991 { (const uint8_t[]){
1992 0x0c, 0x2a, 0xef, 0x2c, 0x4a, 0x5b, 0x98, 0x83, 0xd4, 0xdd, 0xa3,
1993 0x82, 0xfe, 0x50, 0xfb, 0x51, 0x88, 0xb3, 0xe9, 0x73, 0x33, 0xa1,
1994 0xec, 0x53, 0xa0, 0x9d, 0xc9, 0xa7, 0x9d, 0x0d, 0x08, 0x20,
1995 },
1996 32, "DigiCert 'Wyvern2024h2' Log" },
1997 { (const uint8_t[]){
1998 0x73, 0x20, 0x22, 0x0f, 0x08, 0x16, 0x8a, 0xf9, 0xf3, 0xc4, 0xa6,
1999 0x8b, 0x0a, 0xb2, 0x6a, 0x9a, 0x4a, 0x00, 0xee, 0xf5, 0x77, 0x85,
2000 0x8a, 0x08, 0x4d, 0x05, 0x00, 0xd4, 0xa5, 0x42, 0x44, 0x59,
2001 },
2002 32, "DigiCert 'Wyvern2025h1' Log" },
2003 { (const uint8_t[]){
2004 0xed, 0x3c, 0x4b, 0xd6, 0xe8, 0x06, 0xc2, 0xa4, 0xa2, 0x00, 0x57,
2005 0xdb, 0xcb, 0x24, 0xe2, 0x38, 0x01, 0xdf, 0x51, 0x2f, 0xed, 0xc4,
2006 0x86, 0xc5, 0x70, 0x0f, 0x20, 0xdd, 0xb7, 0x3e, 0x3f, 0xe0,
2007 },
2008 32, "DigiCert 'Wyvern2025h2' Log" },
2009 { (const uint8_t[]){
2010 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
2011 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
2012 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
2013 },
2014 32, "DigiCert 'Wyvern2026h1'" },
2015 { (const uint8_t[]){
2016 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
2017 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
2018 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
2019 },
2020 32, "DigiCert 'Wyvern2026h2'" },
2021 { (const uint8_t[]){
2022 0xdb, 0x07, 0x6c, 0xde, 0x6a, 0x8b, 0x78, 0xec, 0x58, 0xd6, 0x05,
2023 0x64, 0x96, 0xeb, 0x6a, 0x26, 0xa8, 0xc5, 0x9e, 0x72, 0x12, 0x93,
2024 0xe8, 0xac, 0x03, 0x27, 0xdd, 0xde, 0x89, 0xdb, 0x5a, 0x2a,
2025 },
2026 32, "DigiCert 'Sphinx2024h1' Log" },
2027 { (const uint8_t[]){
2028 0xdc, 0xc9, 0x5e, 0x6f, 0xa2, 0x99, 0xb9, 0xb0, 0xfd, 0xbd, 0x6c,
2029 0xa6, 0xa3, 0x6e, 0x1d, 0x72, 0xc4, 0x21, 0x2f, 0xdd, 0x1e, 0x0f,
2030 0x47, 0x55, 0x3a, 0x36, 0xd6, 0xcf, 0x1a, 0xd1, 0x1d, 0x8d,
2031 },
2032 32, "DigiCert 'Sphinx2024h2' Log" },
2033 { (const uint8_t[]){
2034 0xde, 0x85, 0x81, 0xd7, 0x50, 0x24, 0x7c, 0x6b, 0xcd, 0xcb, 0xaf,
2035 0x56, 0x37, 0xc5, 0xe7, 0x81, 0xc6, 0x4c, 0xe4, 0x6e, 0xd6, 0x17,
2036 0x63, 0x9f, 0x8f, 0x34, 0xa7, 0x26, 0xc9, 0xe2, 0xbd, 0x37,
2037 },
2038 32, "DigiCert 'Sphinx2025h1' Log" },
2039 { (const uint8_t[]){
2040 0xa4, 0x42, 0xc5, 0x06, 0x49, 0x60, 0x61, 0x54, 0x8f, 0x0f, 0xd4,
2041 0xea, 0x9c, 0xfb, 0x7a, 0x2d, 0x26, 0x45, 0x4d, 0x87, 0xa9, 0x7f,
2042 0x2f, 0xdf, 0x45, 0x59, 0xf6, 0x27, 0x4f, 0x3a, 0x84, 0x54,
2043 },
2044 32, "DigiCert 'Sphinx2025h2' Log" },
2045 { (const uint8_t[]){
2046 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
2047 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
2048 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
2049 },
2050 32, "DigiCert 'Sphinx2026h1'" },
2051 { (const uint8_t[]){
2052 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
2053 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
2054 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
2055 },
2056 32, "DigiCert 'Sphinx2026h2'" },
2057 { (const uint8_t[]){
2058 0xdd, 0xeb, 0x1d, 0x2b, 0x7a, 0x0d, 0x4f, 0xa6, 0x20, 0x8b, 0x81,
2059 0xad, 0x81, 0x68, 0x70, 0x7e, 0x2e, 0x8e, 0x9d, 0x01, 0xd5, 0x5c,
2060 0x88, 0x8d, 0x3d, 0x11, 0xc4, 0xcd, 0xb6, 0xec, 0xbe, 0xcc,
2061 },
2062 32, "Symantec log" },
2063 { (const uint8_t[]){
2064 0xbc, 0x78, 0xe1, 0xdf, 0xc5, 0xf6, 0x3c, 0x68, 0x46, 0x49, 0x33,
2065 0x4d, 0xa1, 0x0f, 0xa1, 0x5f, 0x09, 0x79, 0x69, 0x20, 0x09, 0xc0,
2066 0x81, 0xb4, 0xf3, 0xf6, 0x91, 0x7f, 0x3e, 0xd9, 0xb8, 0xa5,
2067 },
2068 32, "Symantec 'Vega' log" },
2069 { (const uint8_t[]){
2070 0x15, 0x97, 0x04, 0x88, 0xd7, 0xb9, 0x97, 0xa0, 0x5b, 0xeb, 0x52,
2071 0x51, 0x2a, 0xde, 0xe8, 0xd2, 0xe8, 0xb4, 0xa3, 0x16, 0x52, 0x64,
2072 0x12, 0x1a, 0x9f, 0xab, 0xfb, 0xd5, 0xf8, 0x5a, 0xd9, 0x3f,
2073 },
2074 32, "Symantec 'Sirius' log" },
2075 { (const uint8_t[]){
2076 0x05, 0x9c, 0x01, 0xd3, 0x20, 0xe0, 0x07, 0x84, 0x13, 0x95, 0x80,
2077 0x49, 0x8d, 0x11, 0x7c, 0x90, 0x32, 0x66, 0xaf, 0xaf, 0x72, 0x50,
2078 0xb5, 0xaf, 0x3b, 0x46, 0xa4, 0x3e, 0x11, 0x84, 0x0d, 0x4a,
2079 },
2080 32, "DigiCert Yeti2022-2 Log" },
2081 { (const uint8_t[]){
2082 0xc1, 0x16, 0x4a, 0xe0, 0xa7, 0x72, 0xd2, 0xd4, 0x39, 0x2d, 0xc8,
2083 0x0a, 0xc1, 0x07, 0x70, 0xd4, 0xf0, 0xc4, 0x9b, 0xde, 0x99, 0x1a,
2084 0x48, 0x40, 0xc1, 0xfa, 0x07, 0x51, 0x64, 0xf6, 0x33, 0x60,
2085 },
2086 32, "DigiCert Yeti2018 Log" },
2087 { (const uint8_t[]){
2088 0xe2, 0x69, 0x4b, 0xae, 0x26, 0xe8, 0xe9, 0x40, 0x09, 0xe8, 0x86,
2089 0x1b, 0xb6, 0x3b, 0x83, 0xd4, 0x3e, 0xe7, 0xfe, 0x74, 0x88, 0xfb,
2090 0xa4, 0x8f, 0x28, 0x93, 0x01, 0x9d, 0xdd, 0xf1, 0xdb, 0xfe,
2091 },
2092 32, "DigiCert Yeti2019 Log" },
2093 { (const uint8_t[]){
2094 0x6f, 0xf1, 0x41, 0xb5, 0x64, 0x7e, 0x42, 0x22, 0xf7, 0xef, 0x05,
2095 0x2c, 0xef, 0xae, 0x7c, 0x21, 0xfd, 0x60, 0x8e, 0x27, 0xd2, 0xaf,
2096 0x5a, 0x6e, 0x9f, 0x4b, 0x8a, 0x37, 0xd6, 0x63, 0x3e, 0xe5,
2097 },
2098 32, "DigiCert Nessie2018 Log" },
2099 { (const uint8_t[]){
2100 0xfe, 0x44, 0x61, 0x08, 0xb1, 0xd0, 0x1a, 0xb7, 0x8a, 0x62, 0xcc,
2101 0xfe, 0xab, 0x6a, 0xb2, 0xb2, 0xba, 0xbf, 0xf3, 0xab, 0xda, 0xd8,
2102 0x0a, 0x4d, 0x8b, 0x30, 0xdf, 0x2d, 0x00, 0x08, 0x83, 0x0c,
2103 },
2104 32, "DigiCert Nessie2019 Log" },
2105 { (const uint8_t[]){
2106 0xa7, 0xce, 0x4a, 0x4e, 0x62, 0x07, 0xe0, 0xad, 0xde, 0xe5, 0xfd,
2107 0xaa, 0x4b, 0x1f, 0x86, 0x76, 0x87, 0x67, 0xb5, 0xd0, 0x02, 0xa5,
2108 0x5d, 0x47, 0x31, 0x0e, 0x7e, 0x67, 0x0a, 0x95, 0xea, 0xb2,
2109 },
2110 32, "Symantec Deneb" },
2111 { (const uint8_t[]){
2112 0xcd, 0xb5, 0x17, 0x9b, 0x7f, 0xc1, 0xc0, 0x46, 0xfe, 0xea, 0x31,
2113 0x13, 0x6a, 0x3f, 0x8f, 0x00, 0x2e, 0x61, 0x82, 0xfa, 0xf8, 0x89,
2114 0x6f, 0xec, 0xc8, 0xb2, 0xf5, 0xb5, 0xab, 0x60, 0x49, 0x00,
2115 },
2116 32, "Certly.IO log" },
2117 { (const uint8_t[]){
2118 0x74, 0x61, 0xb4, 0xa0, 0x9c, 0xfb, 0x3d, 0x41, 0xd7, 0x51, 0x59,
2119 0x57, 0x5b, 0x2e, 0x76, 0x49, 0xa4, 0x45, 0xa8, 0xd2, 0x77, 0x09,
2120 0xb0, 0xcc, 0x56, 0x4a, 0x64, 0x82, 0xb7, 0xeb, 0x41, 0xa3,
2121 },
2122 32, "Izenpe log" },
2123 { (const uint8_t[]){
2124 0x89, 0x41, 0x44, 0x9c, 0x70, 0x74, 0x2e, 0x06, 0xb9, 0xfc, 0x9c,
2125 0xe7, 0xb1, 0x16, 0xba, 0x00, 0x24, 0xaa, 0x36, 0xd5, 0x9a, 0xf4,
2126 0x4f, 0x02, 0x04, 0x40, 0x4f, 0x00, 0xf7, 0xea, 0x85, 0x66,
2127 },
2128 32, "Izenpe 'Argi' log" },
2129 { (const uint8_t[]){
2130 0x41, 0xb2, 0xdc, 0x2e, 0x89, 0xe6, 0x3c, 0xe4, 0xaf, 0x1b, 0xa7,
2131 0xbb, 0x29, 0xbf, 0x68, 0xc6, 0xde, 0xe6, 0xf9, 0xf1, 0xcc, 0x04,
2132 0x7e, 0x30, 0xdf, 0xfa, 0xe3, 0xb3, 0xba, 0x25, 0x92, 0x63,
2133 },
2134 32, "WoSign log" },
2135 { (const uint8_t[]){
2136 0x9e, 0x4f, 0xf7, 0x3d, 0xc3, 0xce, 0x22, 0x0b, 0x69, 0x21, 0x7c,
2137 0x89, 0x9e, 0x46, 0x80, 0x76, 0xab, 0xf8, 0xd7, 0x86, 0x36, 0xd5,
2138 0xcc, 0xfc, 0x85, 0xa3, 0x1a, 0x75, 0x62, 0x8b, 0xa8, 0x8b,
2139 },
2140 32, "WoSign CT log #1" },
2141 { (const uint8_t[]){
2142 0x63, 0xd0, 0x00, 0x60, 0x26, 0xdd, 0xe1, 0x0b, 0xb0, 0x60, 0x1f,
2143 0x45, 0x24, 0x46, 0x96, 0x5e, 0xe2, 0xb6, 0xea, 0x2c, 0xd4, 0xfb,
2144 0xc9, 0x5a, 0xc8, 0x66, 0xa5, 0x50, 0xaf, 0x90, 0x75, 0xb7,
2145 },
2146 32, "WoSign log 2" },
2147 { (const uint8_t[]){
2148 0xac, 0x3b, 0x9a, 0xed, 0x7f, 0xa9, 0x67, 0x47, 0x57, 0x15, 0x9e,
2149 0x6d, 0x7d, 0x57, 0x56, 0x72, 0xf9, 0xd9, 0x81, 0x00, 0x94, 0x1e,
2150 0x9b, 0xde, 0xff, 0xec, 0xa1, 0x31, 0x3b, 0x75, 0x78, 0x2d,
2151 },
2152 32, "Venafi log" },
2153 { (const uint8_t[]){
2154 0x03, 0x01, 0x9d, 0xf3, 0xfd, 0x85, 0xa6, 0x9a, 0x8e, 0xbd, 0x1f,
2155 0xac, 0xc6, 0xda, 0x9b, 0xa7, 0x3e, 0x46, 0x97, 0x74, 0xfe, 0x77,
2156 0xf5, 0x79, 0xfc, 0x5a, 0x08, 0xb8, 0x32, 0x8c, 0x1d, 0x6b,
2157 },
2158 32, "Venafi Gen2 CT log" },
2159 { (const uint8_t[]){
2160 0xa5, 0x77, 0xac, 0x9c, 0xed, 0x75, 0x48, 0xdd, 0x8f, 0x02, 0x5b,
2161 0x67, 0xa2, 0x41, 0x08, 0x9d, 0xf8, 0x6e, 0x0f, 0x47, 0x6e, 0xc2,
2162 0x03, 0xc2, 0xec, 0xbe, 0xdb, 0x18, 0x5f, 0x28, 0x26, 0x38,
2163 },
2164 32, "CNNIC CT log" },
2165 { (const uint8_t[]){
2166 0x34, 0xbb, 0x6a, 0xd6, 0xc3, 0xdf, 0x9c, 0x03, 0xee, 0xa8, 0xa4,
2167 0x99, 0xff, 0x78, 0x91, 0x48, 0x6c, 0x9d, 0x5e, 0x5c, 0xac, 0x92,
2168 0xd0, 0x1f, 0x7b, 0xfd, 0x1b, 0xce, 0x19, 0xdb, 0x48, 0xef,
2169 },
2170 32, "StartCom log" },
2171 { (const uint8_t[]){
2172 0x55, 0x81, 0xd4, 0xc2, 0x16, 0x90, 0x36, 0x01, 0x4a, 0xea, 0x0b,
2173 0x9b, 0x57, 0x3c, 0x53, 0xf0, 0xc0, 0xe4, 0x38, 0x78, 0x70, 0x25,
2174 0x08, 0x17, 0x2f, 0xa3, 0xaa, 0x1d, 0x07, 0x13, 0xd3, 0x0c,
2175 },
2176 32, "Sectigo 'Sabre' CT log" },
2177 { (const uint8_t[]){
2178 0xa2, 0xe2, 0xbf, 0xd6, 0x1e, 0xde, 0x2f, 0x2f, 0x07, 0xa0, 0xd6,
2179 0x4e, 0x6d, 0x37, 0xa7, 0xdc, 0x65, 0x43, 0xb0, 0xc6, 0xb5, 0x2e,
2180 0xa2, 0xda, 0xb7, 0x8a, 0xf8, 0x9a, 0x6d, 0xf5, 0x17, 0xd8,
2181 },
2182 32, "Sectigo 'Sabre2024h1'" },
2183 { (const uint8_t[]){
2184 0x19, 0x98, 0x10, 0x71, 0x09, 0xf0, 0xd6, 0x52, 0x2e, 0x30, 0x80,
2185 0xd2, 0x9e, 0x3f, 0x64, 0xbb, 0x83, 0x6e, 0x28, 0xcc, 0xf9, 0x0f,
2186 0x52, 0x8e, 0xee, 0xdf, 0xce, 0x4a, 0x3f, 0x16, 0xb4, 0xca,
2187 },
2188 32, "Sectigo 'Sabre2024h2'" },
2189 { (const uint8_t[]){
2190 0xe0, 0x92, 0xb3, 0xfc, 0x0c, 0x1d, 0xc8, 0xe7, 0x68, 0x36, 0x1f,
2191 0xde, 0x61, 0xb9, 0x96, 0x4d, 0x0a, 0x52, 0x78, 0x19, 0x8a, 0x72,
2192 0xd6, 0x72, 0xc4, 0xb0, 0x4d, 0xa5, 0x6d, 0x6f, 0x54, 0x04,
2193 },
2194 32, "Sectigo 'Sabre2025h1'" },
2195 { (const uint8_t[]){
2196 0x1a, 0x04, 0xff, 0x49, 0xd0, 0x54, 0x1d, 0x40, 0xaf, 0xf6, 0xa0,
2197 0xc3, 0xbf, 0xf1, 0xd8, 0xc4, 0x67, 0x2f, 0x4e, 0xec, 0xee, 0x23,
2198 0x40, 0x68, 0x98, 0x6b, 0x17, 0x40, 0x2e, 0xdc, 0x89, 0x7d,
2199 },
2200 32, "Sectigo 'Sabre2025h2'" },
2201 { (const uint8_t[]){
2202 0x6f, 0x53, 0x76, 0xac, 0x31, 0xf0, 0x31, 0x19, 0xd8, 0x99, 0x00,
2203 0xa4, 0x51, 0x15, 0xff, 0x77, 0x15, 0x1c, 0x11, 0xd9, 0x02, 0xc1,
2204 0x00, 0x29, 0x06, 0x8d, 0xb2, 0x08, 0x9a, 0x37, 0xd9, 0x13,
2205 },
2206 32, "Sectigo 'Mammoth' CT log" },
2207 { (const uint8_t[]){
2208 0x29, 0xd0, 0x3a, 0x1b, 0xb6, 0x74, 0xaa, 0x71, 0x1c, 0xd3, 0x03,
2209 0x5b, 0x65, 0x57, 0xc1, 0x4f, 0x8a, 0xa7, 0x8b, 0x4f, 0xe8, 0x38,
2210 0x94, 0x49, 0xec, 0xa4, 0x53, 0xf9, 0x44, 0xbd, 0x24, 0x68,
2211 },
2212 32, "Sectigo 'Mammoth2024h1'" },
2213 { (const uint8_t[]){
2214 0x50, 0x85, 0x01, 0x58, 0xdc, 0xb6, 0x05, 0x95, 0xc0, 0x0e, 0x92,
2215 0xa8, 0x11, 0x02, 0xec, 0xcd, 0xfe, 0x3f, 0x6b, 0x78, 0x58, 0x42,
2216 0x9f, 0x57, 0x98, 0x35, 0x38, 0xc9, 0xda, 0x52, 0x50, 0x63,
2217 },
2218 32, "Sectigo 'Mammoth2024h1b'" },
2219 { (const uint8_t[]){
2220 0xdf, 0xe1, 0x56, 0xeb, 0xaa, 0x05, 0xaf, 0xb5, 0x9c, 0x0f, 0x86,
2221 0x71, 0x8d, 0xa8, 0xc0, 0x32, 0x4e, 0xae, 0x56, 0xd9, 0x6e, 0xa7,
2222 0xf5, 0xa5, 0x6a, 0x01, 0xd1, 0xc1, 0x3b, 0xbe, 0x52, 0x5c,
2223 },
2224 32, "Sectigo 'Mammoth2024h2'" },
2225 { (const uint8_t[]){
2226 0x13, 0x4a, 0xdf, 0x1a, 0xb5, 0x98, 0x42, 0x09, 0x78, 0x0c, 0x6f,
2227 0xef, 0x4c, 0x7a, 0x91, 0xa4, 0x16, 0xb7, 0x23, 0x49, 0xce, 0x58,
2228 0x57, 0x6a, 0xdf, 0xae, 0xda, 0xa7, 0xc2, 0xab, 0xe0, 0x22,
2229 },
2230 32, "Sectigo 'Mammoth2025h1'" },
2231 { (const uint8_t[]){
2232 0xaf, 0x18, 0x1a, 0x28, 0xd6, 0x8c, 0xa3, 0xe0, 0xa9, 0x8a, 0x4c,
2233 0x9c, 0x67, 0xab, 0x09, 0xf8, 0xbb, 0xbc, 0x22, 0xba, 0xae, 0xbc,
2234 0xb1, 0x38, 0xa3, 0xa1, 0x9d, 0xd3, 0xf9, 0xb6, 0x03, 0x0d,
2235 },
2236 32, "Sectigo 'Mammoth2025h2'" },
2237 { (const uint8_t[]){
2238 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
2239 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
2240 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
2241 },
2242 32, "Sectigo 'Mammoth2026h1'" },
2243 { (const uint8_t[]){
2244 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
2245 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
2246 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
2247 },
2248 32, "Sectigo 'Mammoth2026h2'" },
2249 { (const uint8_t[]){
2250 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
2251 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
2252 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
2253 },
2254 32, "Sectigo 'Sabre2026h1'" },
2255 { (const uint8_t[]){
2256 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
2257 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
2258 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
2259 },
2260 32, "Sectigo 'Sabre2026h2'" },
2261 { (const uint8_t[]){
2262 0x0d, 0x1d, 0xbc, 0x89, 0x44, 0xe9, 0xf5, 0x00, 0x55, 0x42, 0xd7,
2263 0x2d, 0x3e, 0x14, 0x4c, 0xcc, 0x43, 0x08, 0x2a, 0xb6, 0xea, 0x1e,
2264 0x94, 0xdf, 0xd7, 0x06, 0x65, 0x7d, 0x2e, 0x86, 0xf3, 0x01,
2265 },
2266 32, "Sectigo 'Elephant2025h2'" },
2267 { (const uint8_t[]){
2268 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
2269 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
2270 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
2271 },
2272 32, "Sectigo 'Elephant2026h1'" },
2273 { (const uint8_t[]){
2274 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
2275 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
2276 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
2277 },
2278 32, "Sectigo 'Elephant2026h2'" },
2279 { (const uint8_t[]){
2280 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
2281 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
2282 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
2283 },
2284 32, "Sectigo 'Elephant2027h1'" },
2285 { (const uint8_t[]){
2286 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
2287 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
2288 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
2289 },
2290 32, "Sectigo 'Elephant2027h2'" },
2291 { (const uint8_t[]){
2292 0x5c, 0xa5, 0x77, 0xd2, 0x9b, 0x7f, 0x8b, 0xaf, 0x41, 0x9e, 0xd8,
2293 0xec, 0xab, 0xfb, 0x6d, 0xcb, 0xae, 0xc3, 0x85, 0x37, 0x02, 0xd5,
2294 0x74, 0x6f, 0x17, 0x4d, 0xad, 0x3c, 0x93, 0x4a, 0xa9, 0x6a,
2295 },
2296 32, "Sectigo 'Tiger2025h2'" },
2297 { (const uint8_t[]){
2298 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
2299 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
2300 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
2301 },
2302 32, "Sectigo 'Tiger2026h1'" },
2303 { (const uint8_t[]){
2304 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
2305 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
2306 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
2307 },
2308 32, "Sectigo 'Tiger2026h2'" },
2309 { (const uint8_t[]){
2310 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
2311 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
2312 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
2313 },
2314 32, "Sectigo 'Tiger2027h1'" },
2315 { (const uint8_t[]){
2316 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
2317 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
2318 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
2319 },
2320 32, "Sectigo 'Tiger2027h2'" },
2321 { (const uint8_t[]){
2322 0xdb, 0x76, 0xfd, 0xad, 0xac, 0x65, 0xe7, 0xd0, 0x95, 0x08, 0x88,
2323 0x6e, 0x21, 0x59, 0xbd, 0x8b, 0x90, 0x35, 0x2f, 0x5f, 0xea, 0xd3,
2324 0xe3, 0xdc, 0x5e, 0x22, 0xeb, 0x35, 0x0a, 0xcc, 0x7b, 0x98,
2325 },
2326 32, "Sectigo 'Dodo' CT log" },
2327 { (const uint8_t[]){
2328 0xe7, 0x12, 0xf2, 0xb0, 0x37, 0x7e, 0x1a, 0x62, 0xfb, 0x8e, 0xc9,
2329 0x0c, 0x61, 0x84, 0xf1, 0xea, 0x7b, 0x37, 0xcb, 0x56, 0x1d, 0x11,
2330 0x26, 0x5b, 0xf3, 0xe0, 0xf3, 0x4b, 0xf2, 0x41, 0x54, 0x6e,
2331 },
2332 32, "Let's Encrypt 'Oak2020' log" },
2333 { (const uint8_t[]){
2334 0x94, 0x20, 0xbc, 0x1e, 0x8e, 0xd5, 0x8d, 0x6c, 0x88, 0x73, 0x1f,
2335 0x82, 0x8b, 0x22, 0x2c, 0x0d, 0xd1, 0xda, 0x4d, 0x5e, 0x6c, 0x4f,
2336 0x94, 0x3d, 0x61, 0xdb, 0x4e, 0x2f, 0x58, 0x4d, 0xa2, 0xc2,
2337 },
2338 32, "Let's Encrypt 'Oak2021' log" },
2339 { (const uint8_t[]){
2340 0xdf, 0xa5, 0x5e, 0xab, 0x68, 0x82, 0x4f, 0x1f, 0x6c, 0xad, 0xee,
2341 0xb8, 0x5f, 0x4e, 0x3e, 0x5a, 0xea, 0xcd, 0xa2, 0x12, 0xa4, 0x6a,
2342 0x5e, 0x8e, 0x3b, 0x12, 0xc0, 0x20, 0x44, 0x5c, 0x2a, 0x73,
2343 },
2344 32, "Let's Encrypt 'Oak2022' log" },
2345 { (const uint8_t[]){
2346 0xb7, 0x3e, 0xfb, 0x24, 0xdf, 0x9c, 0x4d, 0xba, 0x75, 0xf2, 0x39,
2347 0xc5, 0xba, 0x58, 0xf4, 0x6c, 0x5d, 0xfc, 0x42, 0xcf, 0x7a, 0x9f,
2348 0x35, 0xc4, 0x9e, 0x1d, 0x09, 0x81, 0x25, 0xed, 0xb4, 0x99,
2349 },
2350 32, "Let's Encrypt 'Oak2023' log" },
2351 { (const uint8_t[]){
2352 0x3b, 0x53, 0x77, 0x75, 0x3e, 0x2d, 0xb9, 0x80, 0x4e, 0x8b, 0x30,
2353 0x5b, 0x06, 0xfe, 0x40, 0x3b, 0x67, 0xd8, 0x4f, 0xc3, 0xf4, 0xc7,
2354 0xbd, 0x00, 0x0d, 0x2d, 0x72, 0x6f, 0xe1, 0xfa, 0xd4, 0x17,
2355 },
2356 32, "Let's Encrypt 'Oak2024H1' log" },
2357 { (const uint8_t[]){
2358 0x3f, 0x17, 0x4b, 0x4f, 0xd7, 0x22, 0x47, 0x58, 0x94, 0x1d, 0x65,
2359 0x1c, 0x84, 0xbe, 0x0d, 0x12, 0xed, 0x90, 0x37, 0x7f, 0x1f, 0x85,
2360 0x6a, 0xeb, 0xc1, 0xbf, 0x28, 0x85, 0xec, 0xf8, 0x64, 0x6e,
2361 },
2362 32, "Let's Encrypt 'Oak2024H2' log" },
2363 { (const uint8_t[]){
2364 0xa2, 0xe3, 0x0a, 0xe4, 0x45, 0xef, 0xbd, 0xad, 0x9b, 0x7e, 0x38,
2365 0xed, 0x47, 0x67, 0x77, 0x53, 0xd7, 0x82, 0x5b, 0x84, 0x94, 0xd7,
2366 0x2b, 0x5e, 0x1b, 0x2c, 0xc4, 0xb9, 0x50, 0xa4, 0x47, 0xe7,
2367 },
2368 32, "Let's Encrypt 'Oak2025h1'" },
2369 { (const uint8_t[]){
2370 0x0d, 0xe1, 0xf2, 0x30, 0x2b, 0xd3, 0x0d, 0xc1, 0x40, 0x62, 0x12,
2371 0x09, 0xea, 0x55, 0x2e, 0xfc, 0x47, 0x74, 0x7c, 0xb1, 0xd7, 0xe9,
2372 0x30, 0xef, 0x0e, 0x42, 0x1e, 0xb4, 0x7e, 0x4e, 0xaa, 0x34,
2373 },
2374 32, "Let's Encrypt 'Oak2025h2'" },
2375 { (const uint8_t[]){
2376 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
2377 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
2378 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
2379 },
2380 32, "Let's Encrypt 'Oak2026h1'" },
2381 { (const uint8_t[]){
2382 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
2383 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
2384 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
2385 },
2386 32, "Let's Encrypt 'Oak2026h2'" },
2387 { (const uint8_t[]){
2388 0x65, 0x9b, 0x33, 0x50, 0xf4, 0x3b, 0x12, 0xcc, 0x5e, 0xa5, 0xab,
2389 0x4e, 0xc7, 0x65, 0xd3, 0xfd, 0xe6, 0xc8, 0x82, 0x43, 0x77, 0x77,
2390 0x78, 0xe7, 0x20, 0x03, 0xf9, 0xeb, 0x2b, 0x8c, 0x31, 0x29,
2391 },
2392 32, "Let's Encrypt 'Oak2019' log" },
2393 { (const uint8_t[]){
2394 0x84, 0x9f, 0x5f, 0x7f, 0x58, 0xd2, 0xbf, 0x7b, 0x54, 0xec, 0xbd,
2395 0x74, 0x61, 0x1c, 0xea, 0x45, 0xc4, 0x9c, 0x98, 0xf1, 0xd6, 0x48,
2396 0x1b, 0xc6, 0xf6, 0x9e, 0x8c, 0x17, 0x4f, 0x24, 0xf3, 0xcf,
2397 },
2398 32, "Let's Encrypt 'Testflume2019' log" },
2399 { (const uint8_t[]){
2400 0x23, 0x2d, 0x41, 0xa4, 0xcd, 0xac, 0x87, 0xce, 0xd9, 0xf9, 0x43,
2401 0xf4, 0x68, 0xc2, 0x82, 0x09, 0x5a, 0xe0, 0x9d, 0x30, 0xd6, 0x2e,
2402 0x2f, 0xa6, 0x5d, 0xdc, 0x3b, 0x91, 0x9c, 0x2e, 0x46, 0x8f,
2403 },
2404 32, "Let's Encrypt 'Sapling 2022h2' log" },
2405 { (const uint8_t[]){
2406 0xc1, 0x83, 0x24, 0x0b, 0xf1, 0xa4, 0x50, 0xc7, 0x6f, 0xbb, 0x00,
2407 0x72, 0x69, 0xdc, 0xac, 0x3b, 0xe2, 0x2a, 0x48, 0x05, 0xd4, 0xdb,
2408 0xe0, 0x49, 0x66, 0xc3, 0xc8, 0xab, 0xc4, 0x47, 0xb0, 0x0c,
2409 },
2410 32, "Let's Encrypt 'Sapling 2023h1' log" },
2411 { (const uint8_t[]){
2412 0xc6, 0x3f, 0x22, 0x18, 0xc3, 0x7d, 0x56, 0xa6, 0xaa, 0x06, 0xb5,
2413 0x96, 0xda, 0x8e, 0x53, 0xd4, 0xd7, 0x15, 0x6d, 0x1e, 0x9b, 0xac,
2414 0x8e, 0x44, 0xd2, 0x20, 0x2d, 0xe6, 0x4d, 0x69, 0xd9, 0xdc,
2415 },
2416 32, "Let's Encrypt 'Testflume2020' log" },
2417 { (const uint8_t[]){
2418 0x03, 0xed, 0xf1, 0xda, 0x97, 0x76, 0xb6, 0xf3, 0x8c, 0x34, 0x1e,
2419 0x39, 0xed, 0x9d, 0x70, 0x7a, 0x75, 0x70, 0x36, 0x9c, 0xf9, 0x84,
2420 0x4f, 0x32, 0x7f, 0xe9, 0xe1, 0x41, 0x38, 0x36, 0x1b, 0x60,
2421 },
2422 32, "Let's Encrypt 'Testflume2021' log" },
2423 { (const uint8_t[]){
2424 0x23, 0x27, 0xef, 0xda, 0x35, 0x25, 0x10, 0xdb, 0xc0, 0x19, 0xef,
2425 0x49, 0x1a, 0xe3, 0xff, 0x1c, 0xc5, 0xa4, 0x79, 0xbc, 0xe3, 0x78,
2426 0x78, 0x36, 0x0e, 0xe3, 0x18, 0xcf, 0xfb, 0x64, 0xf8, 0xc8,
2427 },
2428 32, "Let's Encrypt 'Testflume2022' log" },
2429 { (const uint8_t[]){
2430 0x55, 0x34, 0xb7, 0xab, 0x5a, 0x6a, 0xc3, 0xa7, 0xcb, 0xeb, 0xa6,
2431 0x54, 0x87, 0xb2, 0xa2, 0xd7, 0x1b, 0x48, 0xf6, 0x50, 0xfa, 0x17,
2432 0xc5, 0x19, 0x7c, 0x97, 0xa0, 0xcb, 0x20, 0x76, 0xf3, 0xc6,
2433 },
2434 32, "Let's Encrypt 'Testflume2023' log" },
2435 { (const uint8_t[]){
2436 0x29, 0x6a, 0xfa, 0x2d, 0x56, 0x8b, 0xca, 0x0d, 0x2e, 0xa8, 0x44,
2437 0x95, 0x6a, 0xe9, 0x72, 0x1f, 0xc3, 0x5f, 0xa3, 0x55, 0xec, 0xda,
2438 0x99, 0x69, 0x3a, 0xaf, 0xd4, 0x58, 0xa7, 0x1a, 0xef, 0xdd,
2439 },
2440 32, "Let's Encrypt 'Clicky' log" },
2441 { (const uint8_t[]){
2442 0xa5, 0x95, 0x94, 0x3b, 0x53, 0x70, 0xbe, 0xe9, 0x06, 0xe0, 0x05,
2443 0x0d, 0x1f, 0xb5, 0xbb, 0xc6, 0xa4, 0x0e, 0x65, 0xf2, 0x65, 0xae,
2444 0x85, 0x2c, 0x76, 0x36, 0x3f, 0xad, 0xb2, 0x33, 0x36, 0xed,
2445 },
2446 32, "Trust Asia Log2020" },
2447 { (const uint8_t[]){
2448 0xa8, 0xdc, 0x52, 0xf6, 0x3d, 0x6b, 0x24, 0x25, 0xe5, 0x31, 0xe3,
2449 0x7c, 0xf4, 0xe4, 0x4a, 0x71, 0x4f, 0x14, 0x2a, 0x20, 0x80, 0x3b,
2450 0x0d, 0x04, 0xd2, 0xe2, 0xee, 0x06, 0x64, 0x79, 0x4a, 0x23,
2451 },
2452 32, "Trust Asia CT2021" },
2453 { (const uint8_t[]){
2454 0x67, 0x8d, 0xb6, 0x5b, 0x3e, 0x74, 0x43, 0xb6, 0xf3, 0xa3, 0x70,
2455 0xd5, 0xe1, 0x3a, 0xb1, 0xb4, 0x3b, 0xe0, 0xa0, 0xd3, 0x51, 0xf7,
2456 0xca, 0x74, 0x22, 0x50, 0xc7, 0xc6, 0xfa, 0x51, 0xa8, 0x8a,
2457 },
2458 32, "Trust Asia Log2021" },
2459 { (const uint8_t[]){
2460 0xc3, 0x65, 0xf9, 0xb3, 0x65, 0x4f, 0x32, 0x83, 0xc7, 0x9d, 0xa9,
2461 0x8e, 0x93, 0xd7, 0x41, 0x8f, 0x5b, 0xab, 0x7b, 0xe3, 0x25, 0x2c,
2462 0x98, 0xe1, 0xd2, 0xf0, 0x4b, 0xb9, 0xeb, 0x42, 0x7d, 0x23,
2463 },
2464 32, "Trust Asia Log2022" },
2465 { (const uint8_t[]){
2466 0xe8, 0x7e, 0xa7, 0x66, 0x0b, 0xc2, 0x6c, 0xf6, 0x00, 0x2e, 0xf5,
2467 0x72, 0x5d, 0x3f, 0xe0, 0xe3, 0x31, 0xb9, 0x39, 0x3b, 0xb9, 0x2f,
2468 0xbf, 0x58, 0xeb, 0x3b, 0x90, 0x49, 0xda, 0xf5, 0x43, 0x5a,
2469 },
2470 32, "Trust Asia Log2023" },
2471 { (const uint8_t[]){
2472 0x30, 0x6d, 0x29, 0x57, 0x6a, 0xd2, 0x1a, 0x9d, 0x4a, 0xe1, 0x2a,
2473 0xca, 0xd8, 0xaa, 0x8a, 0x78, 0x3a, 0xa6, 0x5a, 0x32, 0x11, 0x60,
2474 0xac, 0xff, 0x5b, 0x0e, 0xee, 0x4c, 0xa3, 0x20, 0x1d, 0x05,
2475 },
2476 32, "Trust Asia Log2024" },
2477 { (const uint8_t[]){
2478 0x87, 0x4f, 0xb5, 0x0d, 0xc0, 0x29, 0xd9, 0x93, 0x1d, 0xe5, 0x73,
2479 0xe9, 0xf2, 0x89, 0x9e, 0x8e, 0x45, 0x33, 0xb3, 0x92, 0xd3, 0x8b,
2480 0x0a, 0x46, 0x25, 0x74, 0xbf, 0x0f, 0xee, 0xb2, 0xfc, 0x1e,
2481 },
2482 32, "Trust Asia Log2024-2" },
2483 { (const uint8_t[]){
2484 0x28, 0xe2, 0x81, 0x38, 0xfd, 0x83, 0x21, 0x45, 0xe9, 0xa9, 0xd6,
2485 0xaa, 0x75, 0x37, 0x6d, 0x83, 0x77, 0xa8, 0x85, 0x12, 0xb3, 0xc0,
2486 0x7f, 0x72, 0x41, 0x48, 0x21, 0xdc, 0xbd, 0xe9, 0x8c, 0x66,
2487 },
2488 32, "TrustAsia Log2025a" },
2489 { (const uint8_t[]){
2490 0x28, 0x2c, 0x8b, 0xdd, 0x81, 0x0f, 0xf9, 0x09, 0x12, 0x0a, 0xce,
2491 0x16, 0xd6, 0xe0, 0xec, 0x20, 0x1b, 0xea, 0x82, 0xa3, 0xa4, 0xaf,
2492 0x19, 0xd9, 0xef, 0xfb, 0x59, 0xe8, 0x3f, 0xdc, 0x42, 0x68,
2493 },
2494 32, "TrustAsia Log2025b" },
2495 { (const uint8_t[]){
2496 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
2497 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
2498 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
2499 },
2500 32, "TrustAsia 'log2026a'" },
2501 { (const uint8_t[]){
2502 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
2503 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
2504 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
2505 },
2506 32, "TrustAsia 'log2026b'" },
2507 { (const uint8_t[]){
2508 0x45, 0x35, 0x94, 0x98, 0xd9, 0x3a, 0x89, 0xe0, 0x28, 0x03, 0x08,
2509 0xd3, 0x7d, 0x62, 0x6d, 0xc4, 0x23, 0x75, 0x47, 0x58, 0xdc, 0xe0,
2510 0x37, 0x00, 0x36, 0xfb, 0xab, 0x0e, 0xdf, 0x8a, 0x6b, 0xcf,
2511 },
2512 32, "Trust Asia Log1" },
2513 { (const uint8_t[]){
2514 0xc9, 0xcf, 0x89, 0x0a, 0x21, 0x10, 0x9c, 0x66, 0x6c, 0xc1, 0x7a,
2515 0x3e, 0xd0, 0x65, 0xc9, 0x30, 0xd0, 0xe0, 0x13, 0x5a, 0x9f, 0xeb,
2516 0xa8, 0x5a, 0xf1, 0x42, 0x10, 0xb8, 0x07, 0x24, 0x21, 0xaa,
2517 },
2518 32, "GDCA CT log #1" },
2519 { (const uint8_t[]){
2520 0x92, 0x4a, 0x30, 0xf9, 0x09, 0x33, 0x6f, 0xf4, 0x35, 0xd6, 0x99,
2521 0x3a, 0x10, 0xac, 0x75, 0xa2, 0xc6, 0x41, 0x72, 0x8e, 0x7f, 0xc2,
2522 0xd6, 0x59, 0xae, 0x61, 0x88, 0xff, 0xad, 0x40, 0xce, 0x01,
2523 },
2524 32, "GDCA CT log #2" },
2525 { (const uint8_t[]){
2526 0x71, 0x7e, 0xa7, 0x42, 0x09, 0x75, 0xbe, 0x84, 0xa2, 0x72, 0x35,
2527 0x53, 0xf1, 0x77, 0x7c, 0x26, 0xdd, 0x51, 0xaf, 0x4e, 0x10, 0x21,
2528 0x44, 0x09, 0x4d, 0x90, 0x19, 0xb4, 0x62, 0xfb, 0x66, 0x68,
2529 },
2530 32, "GDCA Log 1" },
2531 { (const uint8_t[]){
2532 0x14, 0x30, 0x8d, 0x90, 0xcc, 0xd0, 0x30, 0x13, 0x50, 0x05, 0xc0,
2533 0x1c, 0xa5, 0x26, 0xd8, 0x1e, 0x84, 0xe8, 0x76, 0x24, 0xe3, 0x9b,
2534 0x62, 0x48, 0xe0, 0x8f, 0x72, 0x4a, 0xea, 0x3b, 0xb4, 0x2a,
2535 },
2536 32, "GDCA Log 2" },
2537 { (const uint8_t[]){
2538 0xe0, 0x12, 0x76, 0x29, 0xe9, 0x04, 0x96, 0x56, 0x4e, 0x3d, 0x01,
2539 0x47, 0x98, 0x44, 0x98, 0xaa, 0x48, 0xf8, 0xad, 0xb1, 0x66, 0x00,
2540 0xeb, 0x79, 0x02, 0xa1, 0xef, 0x99, 0x09, 0x90, 0x62, 0x73,
2541 },
2542 32, "PuChuangSiDa CT log" },
2543 { (const uint8_t[]){
2544 0x53, 0x7b, 0x69, 0xa3, 0x56, 0x43, 0x35, 0xa9, 0xc0, 0x49, 0x04,
2545 0xe3, 0x95, 0x93, 0xb2, 0xc2, 0x98, 0xeb, 0x8d, 0x7a, 0x6e, 0x83,
2546 0x02, 0x36, 0x35, 0xc6, 0x27, 0x24, 0x8c, 0xd6, 0xb4, 0x40,
2547 },
2548 32, "Nordu 'flimsy' log" },
2549 { (const uint8_t[]){
2550 0xaa, 0xe7, 0x0b, 0x7f, 0x3c, 0xb8, 0xd5, 0x66, 0xc8, 0x6c, 0x2f,
2551 0x16, 0x97, 0x9c, 0x9f, 0x44, 0x5f, 0x69, 0xab, 0x0e, 0xb4, 0x53,
2552 0x55, 0x89, 0xb2, 0xf7, 0x7a, 0x03, 0x01, 0x04, 0xf3, 0xcd,
2553 },
2554 32, "Nordu 'plausible' log" },
2555 { (const uint8_t[]){
2556 0xcf, 0x55, 0xe2, 0x89, 0x23, 0x49, 0x7c, 0x34, 0x0d, 0x52, 0x06,
2557 0xd0, 0x53, 0x53, 0xae, 0xb2, 0x58, 0x34, 0xb5, 0x2f, 0x1f, 0x8d,
2558 0xc9, 0x52, 0x68, 0x09, 0xf2, 0x12, 0xef, 0xdd, 0x7c, 0xa6,
2559 },
2560 32, "SHECA CT log 1" },
2561 { (const uint8_t[]){
2562 0x32, 0xdc, 0x59, 0xc2, 0xd4, 0xc4, 0x19, 0x68, 0xd5, 0x6e, 0x14,
2563 0xbc, 0x61, 0xac, 0x8f, 0x0e, 0x45, 0xdb, 0x39, 0xfa, 0xf3, 0xc1,
2564 0x55, 0xaa, 0x42, 0x52, 0xf5, 0x00, 0x1f, 0xa0, 0xc6, 0x23,
2565 },
2566 32, "SHECA CT log 2" },
2567 { (const uint8_t[]){
2568 0x96, 0x06, 0xc0, 0x2c, 0x69, 0x00, 0x33, 0xaa, 0x1d, 0x14, 0x5f,
2569 0x59, 0xc6, 0xe2, 0x64, 0x8d, 0x05, 0x49, 0xf0, 0xdf, 0x96, 0xaa,
2570 0xb8, 0xdb, 0x91, 0x5a, 0x70, 0xd8, 0xec, 0xf3, 0x90, 0xa5,
2571 },
2572 32, "Akamai CT Log" },
2573 { (const uint8_t[]){
2574 0x39, 0x37, 0x6f, 0x54, 0x5f, 0x7b, 0x46, 0x07, 0xf5, 0x97, 0x42,
2575 0xd7, 0x68, 0xcd, 0x5d, 0x24, 0x37, 0xbf, 0x34, 0x73, 0xb6, 0x53,
2576 0x4a, 0x48, 0x34, 0xbc, 0xf7, 0x2e, 0x68, 0x1c, 0x83, 0xc9,
2577 },
2578 32, "Alpha CT Log" },
2579 { (const uint8_t[]){
2580 0xb0, 0xb7, 0x84, 0xbc, 0x81, 0xc0, 0xdd, 0xc4, 0x75, 0x44, 0xe8,
2581 0x83, 0xf0, 0x59, 0x85, 0xbb, 0x90, 0x77, 0xd1, 0x34, 0xd8, 0xab,
2582 0x88, 0xb2, 0xb2, 0xe5, 0x33, 0x98, 0x0b, 0x8e, 0x50, 0x8b,
2583 },
2584 32, "Up In The Air 'Behind the Sofa' log" },
2585 { (const uint8_t[]){
2586 0x47, 0x44, 0x47, 0x7c, 0x75, 0xde, 0x42, 0x6d, 0x5c, 0x44, 0xef,
2587 0xd4, 0xa9, 0x2c, 0x96, 0x77, 0x59, 0x7f, 0x65, 0x7a, 0x8f, 0xe0,
2588 0xca, 0xdb, 0xc6, 0xd6, 0x16, 0xed, 0xa4, 0x97, 0xc4, 0x25,
2589 },
2590 32, "Qihoo 360 2020" },
2591 { (const uint8_t[]){
2592 0xc6, 0xd7, 0xed, 0x9e, 0xdb, 0x8e, 0x74, 0xf0, 0xa7, 0x1b, 0x4d,
2593 0x4a, 0x98, 0x4b, 0xcb, 0xeb, 0xab, 0xbd, 0x28, 0xcc, 0x1f, 0xd7,
2594 0x63, 0x29, 0xe8, 0x87, 0x26, 0xcd, 0x4c, 0x25, 0x46, 0x63,
2595 },
2596 32, "Qihoo 360 2021" },
2597 { (const uint8_t[]){
2598 0x66, 0x3c, 0xb0, 0x9c, 0x1f, 0xcd, 0x9b, 0xaa, 0x62, 0x76, 0x3c,
2599 0xcb, 0x53, 0x4e, 0xec, 0x80, 0x58, 0x12, 0x28, 0x05, 0x07, 0xac,
2600 0x69, 0xa4, 0x5f, 0xcd, 0x38, 0xcf, 0x4c, 0xc7, 0x4c, 0xf1,
2601 },
2602 32, "Qihoo 360 2022" },
2603 { (const uint8_t[]){
2604 0xe2, 0x64, 0x7f, 0x6e, 0xda, 0x34, 0x05, 0x03, 0xc6, 0x4d, 0x4e,
2605 0x10, 0xa8, 0x69, 0x68, 0x1f, 0xde, 0x9c, 0x5a, 0x2c, 0xf3, 0xb3,
2606 0x2d, 0x5f, 0x20, 0x0b, 0x96, 0x36, 0x05, 0x90, 0x88, 0x23,
2607 },
2608 32, "Qihoo 360 2023" },
2609 { (const uint8_t[]){
2610 0xc5, 0xcf, 0xe5, 0x4b, 0x61, 0x51, 0xb4, 0x9b, 0x14, 0x2e, 0xd2,
2611 0x63, 0xbd, 0xe7, 0x32, 0x93, 0x36, 0x37, 0x99, 0x79, 0x95, 0x50,
2612 0xae, 0x44, 0x35, 0xcd, 0x1a, 0x69, 0x97, 0xc9, 0xc3, 0xc3,
2613 },
2614 32, "Qihoo 360 v1 2020" },
2615 { (const uint8_t[]){
2616 0x48, 0x14, 0x58, 0x7c, 0xf2, 0x8b, 0x08, 0xfe, 0x68, 0x3f, 0xd2,
2617 0xbc, 0xd9, 0x45, 0x99, 0x4c, 0x2e, 0xb7, 0x4c, 0x8a, 0xe8, 0xc8,
2618 0x7f, 0xce, 0x42, 0x9b, 0x7c, 0xd3, 0x1d, 0x51, 0xbd, 0xc4,
2619 },
2620 32, "Qihoo 360 v1 2021" },
2621 { (const uint8_t[]){
2622 0x49, 0x11, 0xb8, 0xd6, 0x14, 0xcf, 0xd3, 0xd9, 0x9f, 0x16, 0xd3,
2623 0x76, 0x54, 0x5e, 0xe1, 0xb8, 0xcc, 0xfc, 0x51, 0x1f, 0x50, 0x9f,
2624 0x08, 0x0b, 0xa0, 0xa0, 0x87, 0xd9, 0x1d, 0xfa, 0xee, 0xa9,
2625 },
2626 32, "Qihoo 360 v1 2022" },
2627 { (const uint8_t[]){
2628 0xb6, 0x74, 0x0b, 0x12, 0x00, 0x2e, 0x03, 0x3f, 0xd0, 0xe7, 0xe9,
2629 0x41, 0xf4, 0xba, 0x3e, 0xe1, 0xbf, 0xc1, 0x49, 0xb5, 0x24, 0xb4,
2630 0xcf, 0x62, 0x8d, 0x53, 0xef, 0xea, 0x1f, 0x40, 0x3a, 0x8d,
2631 },
2632 32, "Qihoo 360 v1 2023" },
2633 { (const uint8_t[]){
2634 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
2635 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
2636 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
2637 },
2638 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
2639 { NULL((void*)0), 0, NULL((void*)0) }
2640};
2641
2642/*
2643 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
2644 */
2645static dissector_table_t ssl_alpn_dissector_table;
2646static dissector_table_t dtls_alpn_dissector_table;
2647
2648/*
2649 * Special cases for prefix matching of the ALPN, if the ALPN includes
2650 * a version number for a draft or protocol revision.
2651 */
2652typedef struct ssl_alpn_prefix_match_protocol {
2653 const char *proto_prefix;
2654 const char *dissector_name;
2655} ssl_alpn_prefix_match_protocol_t;
2656
2657static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
2658 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
2659 * already exists 3.1 as of this writing... match the prefix. */
2660 { "spdy/", "spdy" },
2661 /* draft-ietf-httpbis-http2-16 */
2662 { "h2-", "http2" }, /* draft versions */
2663};
2664
2665const value_string compress_certificate_algorithm_vals[] = {
2666 { 1, "zlib" },
2667 { 2, "brotli" },
2668 { 3, "zstd" },
2669 { 0, NULL((void*)0) }
2670};
2671
2672
2673const val64_string quic_transport_parameter_id[] = {
2674 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
2675 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
2676 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
2677 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
2678 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
2679 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
2680 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
2681 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
2682 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
2683 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
2684 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
2685 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
2686 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
2687 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
2688 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
2689 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
2690 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
2691 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
2692 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
2693 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
2694 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
2695 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
2696 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
2697 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
2698 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
2699 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
2700 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
2701 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
2702 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
2703 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
2704 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
2705 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
2706 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
2707 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
2708 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
2709 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
2710 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
2711 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
2712 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
2713 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
2714 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
2715 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
2716 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
2717 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
2718 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d, "initial_max_path_id" },
2719 { 0, NULL((void*)0) }
2720};
2721
2722/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
2723const val64_string quic_enable_time_stamp_v2_vals[] = {
2724 { 1, "I would like to receive TIME_STAMP frames" },
2725 { 2, "I am able to generate TIME_STAMP frames" },
2726 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
2727 { 0, NULL((void*)0) }
2728};
2729
2730/* https://tools.ietf.org/html/draft-multipath-04 */
2731const val64_string quic_enable_multipath_vals[] = {
2732 { 0, "don't support multipath" },
2733 { 1, "support multipath as defined in this document" },
2734 { 0, NULL((void*)0) }
2735};
2736
2737/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2738const value_string tls_hello_ext_ech_clienthello_types[] = {
2739 { 0, "Outer Client Hello" },
2740 { 1, "Inner Client Hello" },
2741 { 0, NULL((void*)0) }
2742};
2743
2744/* RFC 9180 */
2745const value_string kem_id_type_vals[] = {
2746 { 0x0000, "Reserved" },
2747 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2748 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2749 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2750 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2751 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2752 { 0, NULL((void*)0) }
2753};
2754const value_string kdf_id_type_vals[] = {
2755 { 0x0000, "Reserved" },
2756 { 0x0001, "HKDF-SHA256" },
2757 { 0x0002, "HKDF-SHA384" },
2758 { 0x0003, "HKDF-SHA512" },
2759 { 0, NULL((void*)0) }
2760};
2761const value_string aead_id_type_vals[] = {
2762 { 0x0000, "Reserved" },
2763 { 0x0001, "AES-128-GCM" },
2764 { 0x0002, "AES-256-GCM" },
2765 { 0x0003, "ChaCha20Poly1305" },
2766 { 0xFFFF, "Export-only" },
2767 { 0, NULL((void*)0) }
2768};
2769
2770const value_string token_binding_key_parameter_vals[] = {
2771 { 0, "rsa2048_pkcs1.5" },
2772 { 1, "rsa2048_pss" },
2773 { 2, "ecdsap256" },
2774 { 0, NULL((void*)0) }
2775};
2776
2777/* Lookup tables }}} */
2778
2779void
2780quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2781{
2782 const char *label;
2783 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)
) {
2784 label = "GREASE";
2785 } else {
2786 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2787 }
2788 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2789}
2790
2791/* we keep this internal to packet-tls-utils, as there should be
2792 no need to access it any other way.
2793
2794 This also allows us to hide the dependency on zlib.
2795*/
2796struct _SslDecompress {
2797 int compression;
2798#ifdef USE_ZLIB_OR_ZLIBNG
2799 zlib_stream istream;
2800#endif
2801};
2802
2803/* To assist in parsing client/server key exchange messages
2804 0 indicates unknown */
2805int ssl_get_keyex_alg(int cipher)
2806{
2807 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2808 switch(cipher) {
2809 case 0x0017:
2810 case 0x0018:
2811 case 0x0019:
2812 case 0x001a:
2813 case 0x001b:
2814 case 0x0034:
2815 case 0x003a:
2816 case 0x0046:
2817 case 0x006c:
2818 case 0x006d:
2819 case 0x0089:
2820 case 0x009b:
2821 case 0x00a6:
2822 case 0x00a7:
2823 case 0x00bf:
2824 case 0x00c5:
2825 case 0xc084:
2826 case 0xc085:
2827 return KEX_DH_ANON0x13;
2828 case 0x000b:
2829 case 0x000c:
2830 case 0x000d:
2831 case 0x0030:
2832 case 0x0036:
2833 case 0x003e:
2834 case 0x0042:
2835 case 0x0068:
2836 case 0x0085:
2837 case 0x0097:
2838 case 0x00a4:
2839 case 0x00a5:
2840 case 0x00bb:
2841 case 0x00c1:
2842 case 0xc082:
2843 case 0xc083:
2844 return KEX_DH_DSS0x14;
2845 case 0x000e:
2846 case 0x000f:
2847 case 0x0010:
2848 case 0x0031:
2849 case 0x0037:
2850 case 0x003f:
2851 case 0x0043:
2852 case 0x0069:
2853 case 0x0086:
2854 case 0x0098:
2855 case 0x00a0:
2856 case 0x00a1:
2857 case 0x00bc:
2858 case 0x00c2:
2859 case 0xc07e:
2860 case 0xc07f:
2861 return KEX_DH_RSA0x15;
2862 case 0x0011:
2863 case 0x0012:
2864 case 0x0013:
2865 case 0x0032:
2866 case 0x0038:
2867 case 0x0040:
2868 case 0x0044:
2869 case 0x0063:
2870 case 0x0065:
2871 case 0x0066:
2872 case 0x006a:
2873 case 0x0087:
2874 case 0x0099:
2875 case 0x00a2:
2876 case 0x00a3:
2877 case 0x00bd:
2878 case 0x00c3:
2879 case 0xc080:
2880 case 0xc081:
2881 return KEX_DHE_DSS0x10;
2882 case 0x002d:
2883 case 0x008e:
2884 case 0x008f:
2885 case 0x0090:
2886 case 0x0091:
2887 case 0x00aa:
2888 case 0x00ab:
2889 case 0x00b2:
2890 case 0x00b3:
2891 case 0x00b4:
2892 case 0x00b5:
2893 case 0xc090:
2894 case 0xc091:
2895 case 0xc096:
2896 case 0xc097:
2897 case 0xc0a6:
2898 case 0xc0a7:
2899 case 0xc0aa:
2900 case 0xc0ab:
2901 case 0xccad:
2902 case 0xe41c:
2903 case 0xe41d:
2904 return KEX_DHE_PSK0x11;
2905 case 0x0014:
2906 case 0x0015:
2907 case 0x0016:
2908 case 0x0033:
2909 case 0x0039:
2910 case 0x0045:
2911 case 0x0067:
2912 case 0x006b:
2913 case 0x0088:
2914 case 0x009a:
2915 case 0x009e:
2916 case 0x009f:
2917 case 0x00be:
2918 case 0x00c4:
2919 case 0xc07c:
2920 case 0xc07d:
2921 case 0xc09e:
2922 case 0xc09f:
2923 case 0xc0a2:
2924 case 0xc0a3:
2925 case 0xccaa:
2926 case 0xe41e:
2927 case 0xe41f:
2928 return KEX_DHE_RSA0x12;
2929 case 0xc015:
2930 case 0xc016:
2931 case 0xc017:
2932 case 0xc018:
2933 case 0xc019:
2934 return KEX_ECDH_ANON0x19;
2935 case 0xc001:
2936 case 0xc002:
2937 case 0xc003:
2938 case 0xc004:
2939 case 0xc005:
2940 case 0xc025:
2941 case 0xc026:
2942 case 0xc02d:
2943 case 0xc02e:
2944 case 0xc074:
2945 case 0xc075:
2946 case 0xc088:
2947 case 0xc089:
2948 return KEX_ECDH_ECDSA0x1a;
2949 case 0xc00b:
2950 case 0xc00c:
2951 case 0xc00d:
2952 case 0xc00e:
2953 case 0xc00f:
2954 case 0xc029:
2955 case 0xc02a:
2956 case 0xc031:
2957 case 0xc032:
2958 case 0xc078:
2959 case 0xc079:
2960 case 0xc08c:
2961 case 0xc08d:
2962 return KEX_ECDH_RSA0x1b;
2963 case 0xc006:
2964 case 0xc007:
2965 case 0xc008:
2966 case 0xc009:
2967 case 0xc00a:
2968 case 0xc023:
2969 case 0xc024:
2970 case 0xc02b:
2971 case 0xc02c:
2972 case 0xc072:
2973 case 0xc073:
2974 case 0xc086:
2975 case 0xc087:
2976 case 0xc0ac:
2977 case 0xc0ad:
2978 case 0xc0ae:
2979 case 0xc0af:
2980 case 0xcca9:
2981 case 0xe414:
2982 case 0xe415:
2983 return KEX_ECDHE_ECDSA0x16;
2984 case 0xc033:
2985 case 0xc034:
2986 case 0xc035:
2987 case 0xc036:
2988 case 0xc037:
2989 case 0xc038:
2990 case 0xc039:
2991 case 0xc03a:
2992 case 0xc03b:
2993 case 0xc09a:
2994 case 0xc09b:
2995 case 0xccac:
2996 case 0xe418:
2997 case 0xe419:
2998 case 0xd001:
2999 case 0xd002:
3000 case 0xd003:
3001 case 0xd005:
3002 return KEX_ECDHE_PSK0x17;
3003 case 0xc010:
3004 case 0xc011:
3005 case 0xc012:
3006 case 0xc013:
3007 case 0xc014:
3008 case 0xc027:
3009 case 0xc028:
3010 case 0xc02f:
3011 case 0xc030:
3012 case 0xc076:
3013 case 0xc077:
3014 case 0xc08a:
3015 case 0xc08b:
3016 case 0xcca8:
3017 case 0xe412:
3018 case 0xe413:
3019 return KEX_ECDHE_RSA0x18;
3020 case 0x001e:
3021 case 0x001f:
3022 case 0x0020:
3023 case 0x0021:
3024 case 0x0022:
3025 case 0x0023:
3026 case 0x0024:
3027 case 0x0025:
3028 case 0x0026:
3029 case 0x0027:
3030 case 0x0028:
3031 case 0x0029:
3032 case 0x002a:
3033 case 0x002b:
3034 return KEX_KRB50x1c;
3035 case 0x002c:
3036 case 0x008a:
3037 case 0x008b:
3038 case 0x008c:
3039 case 0x008d:
3040 case 0x00a8:
3041 case 0x00a9:
3042 case 0x00ae:
3043 case 0x00af:
3044 case 0x00b0:
3045 case 0x00b1:
3046 case 0xc064:
3047 case 0xc065:
3048 case 0xc08e:
3049 case 0xc08f:
3050 case 0xc094:
3051 case 0xc095:
3052 case 0xc0a4:
3053 case 0xc0a5:
3054 case 0xc0a8:
3055 case 0xc0a9:
3056 case 0xccab:
3057 case 0xe416:
3058 case 0xe417:
3059 return KEX_PSK0x1d;
3060 case 0x0001:
3061 case 0x0002:
3062 case 0x0003:
3063 case 0x0004:
3064 case 0x0005:
3065 case 0x0006:
3066 case 0x0007:
3067 case 0x0008:
3068 case 0x0009:
3069 case 0x000a:
3070 case 0x002f:
3071 case 0x0035:
3072 case 0x003b:
3073 case 0x003c:
3074 case 0x003d:
3075 case 0x0041:
3076 case 0x0060:
3077 case 0x0061:
3078 case 0x0062:
3079 case 0x0064:
3080 case 0x0084:
3081 case 0x0096:
3082 case 0x009c:
3083 case 0x009d:
3084 case 0x00ba:
3085 case 0x00c0:
3086 case 0xc07a:
3087 case 0xc07b:
3088 case 0xc09c:
3089 case 0xc09d:
3090 case 0xc0a0:
3091 case 0xc0a1:
3092 case 0xe410:
3093 case 0xe411:
3094 case 0xfefe:
3095 case 0xfeff:
3096 case 0xffe0:
3097 case 0xffe1:
3098 return KEX_RSA0x1e;
3099 case 0x002e:
3100 case 0x0092:
3101 case 0x0093:
3102 case 0x0094:
3103 case 0x0095:
3104 case 0x00ac:
3105 case 0x00ad:
3106 case 0x00b6:
3107 case 0x00b7:
3108 case 0x00b8:
3109 case 0x00b9:
3110 case 0xc092:
3111 case 0xc093:
3112 case 0xc098:
3113 case 0xc099:
3114 case 0xccae:
3115 case 0xe41a:
3116 case 0xe41b:
3117 return KEX_RSA_PSK0x1f;
3118 case 0xc01a:
3119 case 0xc01d:
3120 case 0xc020:
3121 return KEX_SRP_SHA0x20;
3122 case 0xc01c:
3123 case 0xc01f:
3124 case 0xc022:
3125 return KEX_SRP_SHA_DSS0x21;
3126 case 0xc01b:
3127 case 0xc01e:
3128 case 0xc021:
3129 return KEX_SRP_SHA_RSA0x22;
3130 case 0xc0ff:
3131 return KEX_ECJPAKE0x24;
3132 case 0xe003:
3133 case 0xe013:
3134 case 0xe053:
3135 return KEX_ECC_SM20x26;
3136 default:
3137 break;
3138 }
3139
3140 return 0;
3141 /* }}} */
3142}
3143
3144static wmem_list_t *connection_id_session_list;
3145
3146void
3147ssl_init_cid_list(void) {
3148 connection_id_session_list = wmem_list_new(wmem_file_scope());
3149}
3150
3151void
3152ssl_cleanup_cid_list(void) {
3153 wmem_destroy_list(connection_id_session_list);
3154}
3155
3156void
3157ssl_add_session_by_cid(SslDecryptSession *session)
3158{
3159 wmem_list_append(connection_id_session_list, session);
3160}
3161
3162SslDecryptSession *
3163ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
3164{
3165 SslDecryptSession * ssl_cid = NULL((void*)0);
3166 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
3167
3168 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
3169 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
3170 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3170, "ssl != ((void*)0)"))))
;
3171 SslSession *session = &ssl->session;
3172
3173 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
3174 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
3175 ssl_cid = ssl;
3176 }
3177 }
3178
3179 if (session->server_cid_len > 0) {
3180 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
3181 ssl_cid = ssl;
3182 }
3183 }
3184
3185 it = wmem_list_frame_next(it);
3186 }
3187
3188 return ssl_cid;
3189}
3190
3191/* StringInfo structure (len + data) functions {{{ */
3192
3193int
3194ssl_data_alloc(StringInfo* str, size_t len)
3195{
3196 str->data = (unsigned char *)g_malloc(len);
3197 /* the allocator can return a null pointer for a size equal to 0,
3198 * and that must be allowed */
3199 if (len > 0 && !str->data)
3200 return -1;
3201 str->data_len = (unsigned) len;
3202 return 0;
3203}
3204
3205void
3206ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
3207{
3208 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3208, "data"))))
;
3209 memcpy(str->data, data, len);
3210 str->data_len = len;
3211}
3212
3213static int
3214ssl_data_realloc(StringInfo* str, unsigned len)
3215{
3216 str->data = (unsigned char *)g_realloc(str->data, len);
3217 if (!str->data)
3218 return -1;
3219 str->data_len = len;
3220 return 0;
3221}
3222
3223static StringInfo *
3224ssl_data_clone(StringInfo *str)
3225{
3226 StringInfo *cloned_str;
3227 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
3228 sizeof(StringInfo) + str->data_len);
3229 cloned_str->data = (unsigned char *) (cloned_str + 1);
3230 ssl_data_set(cloned_str, str->data, str->data_len);
3231 return cloned_str;
3232}
3233
3234static int
3235ssl_data_copy(StringInfo* dst, StringInfo* src)
3236{
3237 if (dst->data_len < src->data_len) {
3238 if (ssl_data_realloc(dst, src->data_len))
3239 return -1;
3240 }
3241 memcpy(dst->data, src->data, src->data_len);
3242 dst->data_len = src->data_len;
3243 return 0;
3244}
3245
3246/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
3247 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
3248 * success. */
3249static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
3250 size_t i;
3251
3252 if (hex_len & 1)
3253 return false0;
3254
3255 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
3256 for (i = 0; i < hex_len / 2; i++) {
3257 int a = ws_xton(in[i*2]);
3258 int b = ws_xton(in[i*2 + 1]);
3259 if (a == -1 || b == -1)
3260 return false0;
3261 out->data[i] = a << 4 | b;
3262 }
3263 out->data_len = (unsigned)hex_len / 2;
3264 return true1;
3265}
3266/* StringInfo structure (len + data) functions }}} */
3267
3268
3269/* libgcrypt wrappers for HMAC/message digest operations {{{ */
3270/* hmac abstraction layer */
3271#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
3272
3273static inline int
3274ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
3275{
3276 gcry_error_t err;
3277 const char *err_str, *err_src;
3278
3279 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
3280 if (err != 0) {
3281 err_str = gcry_strerror(err);
3282 err_src = gcry_strsource(err);
3283 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
3284 return -1;
3285 }
3286 return 0;
3287}
3288
3289static inline int
3290ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
3291{
3292 gcry_error_t err;
3293 const char *err_str, *err_src;
3294
3295 err = gcry_md_setkey (*(md), key, len);
3296 if (err != 0) {
3297 err_str = gcry_strerror(err);
3298 err_src = gcry_strsource(err);
3299 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
3300 return -1;
3301 }
3302 return 0;
3303}
3304
3305static inline int
3306ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
3307{
3308 gcry_md_reset(*md);
3309 return 0;
3310}
3311
3312static inline void
3313ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
3314{
3315 gcry_md_write(*(md), data, len);
3316}
3317static inline void
3318ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3319{
3320 int algo;
3321 unsigned len;
3322
3323 algo = gcry_md_get_algo (*(md));
3324 len = gcry_md_get_algo_dlen(algo);
3325 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3325, "len <= *datalen"))))
;
3326 memcpy(data, gcry_md_read(*(md), algo), len);
3327 *datalen = len;
3328}
3329static inline void
3330ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
3331{
3332 gcry_md_close(*(md));
3333}
3334
3335/* message digest abstraction layer*/
3336#define SSL_MDgcry_md_hd_t gcry_md_hd_t
3337
3338static inline int
3339ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
3340{
3341 gcry_error_t err;
3342 const char *err_str, *err_src;
3343 err = gcry_md_open(md,algo, 0);
3344 if (err != 0) {
3345 err_str = gcry_strerror(err);
3346 err_src = gcry_strsource(err);
3347 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
3348 return -1;
3349 }
3350 return 0;
3351}
3352static inline void
3353ssl_md_update(SSL_MDgcry_md_hd_t* md, unsigned char* data, int len)
3354{
3355 gcry_md_write(*(md), data, len);
3356}
3357static inline void
3358ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3359{
3360 int algo;
3361 int len;
3362 algo = gcry_md_get_algo (*(md));
3363 len = gcry_md_get_algo_dlen (algo);
3364 memcpy(data, gcry_md_read(*(md), algo), len);
3365 *datalen = len;
3366}
3367static inline void
3368ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
3369{
3370 gcry_md_close(*(md));
3371}
3372
3373static inline void
3374ssl_md_reset(SSL_MDgcry_md_hd_t* md)
3375{
3376 gcry_md_reset(*md);
3377}
3378
3379/* md5 /sha abstraction layer */
3380#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
3381#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
3382
3383static inline int
3384ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
3385{
3386 gcry_error_t err;
3387 const char *err_str, *err_src;
3388 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
3389 if (err != 0) {
3390 err_str = gcry_strerror(err);
3391 err_src = gcry_strsource(err);
3392 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
3393 return -1;
3394 }
3395 return 0;
3396}
3397static inline void
3398ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3399{
3400 gcry_md_write(*(md), data, len);
3401}
3402static inline void
3403ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
3404{
3405 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
3406 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
3407}
3408
3409static inline void
3410ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
3411{
3412 gcry_md_reset(*md);
3413}
3414
3415static inline void
3416ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
3417{
3418 gcry_md_close(*(md));
3419}
3420
3421static inline int
3422ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
3423{
3424 gcry_error_t err;
3425 const char *err_str, *err_src;
3426 err = gcry_md_open(md,GCRY_MD_MD5, 0);
3427 if (err != 0) {
3428 err_str = gcry_strerror(err);
3429 err_src = gcry_strsource(err);
3430 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
3431 return -1;
3432 }
3433 return 0;
3434}
3435static inline void
3436ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3437{
3438 gcry_md_write(*(md), data, len);
3439}
3440static inline void
3441ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
3442{
3443 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
3444 gcry_md_get_algo_dlen(GCRY_MD_MD5));
3445}
3446
3447static inline void
3448ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
3449{
3450 gcry_md_reset(*md);
3451}
3452
3453static inline void
3454ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
3455{
3456 gcry_md_close(*(md));
3457}
3458/* libgcrypt wrappers for HMAC/message digest operations }}} */
3459
3460/* libgcrypt wrappers for Cipher state manipulation {{{ */
3461int
3462ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
3463{
3464 int ret;
3465#if 0
3466 unsigned char *ivp;
3467 int i;
3468 gcry_cipher_hd_t c;
3469 c=(gcry_cipher_hd_t)*cipher;
3470#endif
3471 ssl_debug_printf("--------------------------------------------------------------------");
3472#if 0
3473 for(ivp=c->iv,i=0; i < iv_len; i++ )
3474 {
3475 ssl_debug_printf("%d ",ivp[i]);
3476 i++;
3477 }
3478#endif
3479 ssl_debug_printf("--------------------------------------------------------------------");
3480 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
3481#if 0
3482 for(ivp=c->iv,i=0; i < iv_len; i++ )
3483 {
3484 ssl_debug_printf("%d ",ivp[i]);
3485 i++;
3486 }
3487#endif
3488 ssl_debug_printf("--------------------------------------------------------------------");
3489 return ret;
3490}
3491/* stream cipher abstraction layer*/
3492static int
3493ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
3494 unsigned char* iv, int mode)
3495{
3496 int gcry_modes[] = {
3497 GCRY_CIPHER_MODE_STREAM,
3498 GCRY_CIPHER_MODE_CBC,
3499 GCRY_CIPHER_MODE_GCM,
3500 GCRY_CIPHER_MODE_CCM,
3501 GCRY_CIPHER_MODE_CCM,
3502 GCRY_CIPHER_MODE_POLY1305,
3503 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
3504 };
3505 int err;
3506 if (algo == -1) {
3507 /* NULL mode */
3508 *(cipher) = (gcry_cipher_hd_t)-1;
3509 return 0;
3510 }
3511 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
3512 if (err !=0)
3513 return -1;
3514 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
3515 if (err != 0)
3516 return -1;
3517 /* AEAD cipher suites will set the nonce later. */
3518 if (mode == MODE_CBC) {
3519 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
3520 if (err != 0)
3521 return -1;
3522 }
3523 return 0;
3524}
3525static inline int
3526ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
3527 const unsigned char * in, int inl)
3528{
3529 if ((*cipher) == (gcry_cipher_hd_t)-1)
3530 {
3531 if (in && inl)
3532 memcpy(out, in, outl < inl ? outl : inl);
3533 return 0;
3534 }
3535 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
3536}
3537static inline int
3538ssl_get_digest_by_name(const char*name)
3539{
3540 return gcry_md_map_name(name);
3541}
3542static inline int
3543ssl_get_cipher_by_name(const char* name)
3544{
3545 return gcry_cipher_map_name(name);
3546}
3547
3548static inline void
3549ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
3550{
3551 if ((*cipher) != (gcry_cipher_hd_t)-1)
3552 gcry_cipher_close(*cipher);
3553 *cipher = NULL((void*)0);
3554}
3555/* }}} */
3556
3557/* Digests, Ciphers and Cipher Suites registry {{{ */
3558static const SslDigestAlgo digests[]={
3559 {"MD5", 16},
3560 {"SHA1", 20},
3561 {"SHA256", 32},
3562 {"SHA384", 48},
3563 {"SM3", 32},
3564 {"Not Applicable", 0},
3565};
3566
3567#define DIGEST_MAX_SIZE48 48
3568
3569/* get index digest index */
3570static const SslDigestAlgo *
3571ssl_cipher_suite_dig(const SslCipherSuite *cs) {
3572 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
3573 return &digests[DIG_NA0x45 - DIG_MD50x40];
3574 }
3575 return &digests[cs->dig - DIG_MD50x40];
3576}
3577
3578static const char *ciphers[]={
3579 "DES",
3580 "3DES",
3581 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
3582 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
3583 "IDEA",
3584 "AES",
3585 "AES256",
3586 "CAMELLIA128",
3587 "CAMELLIA256",
3588 "SEED",
3589 "CHACHA20", /* since Libgcrypt 1.7.0 */
3590 "SM1",
3591 "SM4",
3592 "*UNKNOWN*"
3593};
3594
3595static const SslCipherSuite cipher_suites[]={
3596 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
3597 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
3598 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3599 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
3600 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
3601 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3602 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
3603 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3604 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
3605 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
3606 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3607 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
3608 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
3609 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3610 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
3611 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
3612 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3613 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
3614 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
3615 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3616 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
3617 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
3618 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3619 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
3620 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3621 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
3622 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
3623 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
3624 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
3625 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
3626 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
3627 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
3628 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
3629 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
3630 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
3631 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
3632 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
3633 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
3634 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
3635 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
3636 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
3637 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
3638 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
3639 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
3640 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
3641 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
3642 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
3643 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
3644 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
3645 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
3646 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
3647 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
3648 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
3649 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
3650 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3651 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3652 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3653 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3654 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3655 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3656 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
3657 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
3658 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
3659 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
3660 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
3661 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
3662 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
3663 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
3664 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
3665 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
3666 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
3667 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
3668 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
3669 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
3670 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
3671 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
3672 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
3673 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
3674 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
3675 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
3676 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
3677 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
3678 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
3679 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
3680 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
3681 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
3682 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
3683 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
3684 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
3685 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
3686 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
3687 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
3688 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
3689 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
3690 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
3691 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
3692 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
3693 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
3694 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
3695 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
3696 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
3697 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
3698 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
3699 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
3700 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
3701 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
3702 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
3703 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
3704 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
3705 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
3706 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
3707 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
3708 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
3709 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
3710 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
3711 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
3712 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
3713 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
3714 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
3715 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
3716 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
3717 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
3718 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3719 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3720 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3721 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3722 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3723 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
3724 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3725 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3726 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3727 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3728 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3729 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
3730
3731 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
3732 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
3733 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
3734 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
3735 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
3736 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
3737 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3738
3739 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3740 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3741 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3742 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3743 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3744 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3745 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3746 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3747 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3748 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3749 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3750 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3751 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3752 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3753 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3754 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3755 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3756 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3757 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3758 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3759 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3760 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3761 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3762 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3763 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3764 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3765 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3766 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3767 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3768 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3769 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3770 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3771 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3772 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3773 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3774 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3775 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3776 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3777 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3778 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3779 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3780 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3781 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3782 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3783 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3784 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3785 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3786 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3787 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3788 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3789 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3790 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3791 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3792 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3793 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3794 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3795 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3796 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3797 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3798 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3799 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3800 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3801 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3802 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3803 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3804 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3805 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3806 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3807 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3808 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3809 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3810 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3811 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3812 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3813 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3814 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3815 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3816 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3817 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3818 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3819 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3820 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3821 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3822 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3823 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3824 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3825 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3826 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3827 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3828 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3829 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3830 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3831 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3832 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3833 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3834 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3835 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3836 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3837 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3838 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3839 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3840 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3841 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3842 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3843 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3844 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3845 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3846 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3847 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3848 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3849 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3850 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3851 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3852 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3853 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3854 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3855 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3856 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3857 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3858 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3859 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3860 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3861 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3862 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3863 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3864 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3865 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3866 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3867 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3868 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3869 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3870 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3871 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3872 /* GM */
3873 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3874 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3875 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3876 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3877 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3878 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3879 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3880 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3881 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3882 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3883 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3884 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3885 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3886 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3887 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3888 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3889 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3890 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3891 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3892 {-1, 0, 0, 0, MODE_STREAM}
3893};
3894
3895#define MAX_BLOCK_SIZE16 16
3896#define MAX_KEY_SIZE32 32
3897
3898const SslCipherSuite *
3899ssl_find_cipher(int num)
3900{
3901 const SslCipherSuite *c;
3902 for(c=cipher_suites;c->number!=-1;c++){
3903 if(c->number==num){
3904 return c;
3905 }
3906 }
3907
3908 return NULL((void*)0);
3909}
3910
3911int
3912ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3913{
3914 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3915}
3916
3917unsigned
3918ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3919{
3920 int cipher_algo;
3921 if (cipher_suite->mode != MODE_CBC) return 0;
3922 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3923 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3924}
3925
3926static unsigned
3927ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3928{
3929 switch (cipher_suite_num) {
3930 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3931 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3932 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3933 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3934 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3935 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3936 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3937 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3938 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3939 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3940 return 5;
3941
3942 /* not defined in below draft, but "implemented by several vendors",
3943 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3944 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3945 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3946 return 7;
3947
3948 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3949 * used 7. Until a pcap proves 8, let's use the old value. Link:
3950 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3951 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3952 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3953 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3954 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3955 return 7;
3956
3957 default:
3958 return 0;
3959 }
3960}
3961
3962/* Digests, Ciphers and Cipher Suites registry }}} */
3963
3964
3965/* HMAC and the Pseudorandom function {{{ */
3966static int
3967tls_hash(StringInfo *secret, StringInfo *seed, int md,
3968 StringInfo *out, unsigned out_len)
3969{
3970 /* RFC 2246 5. HMAC and the pseudorandom function
3971 * '+' denotes concatenation.
3972 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3973 * HMAC_hash(secret, A(2) + seed) + ...
3974 * A(0) = seed
3975 * A(i) = HMAC_hash(secret, A(i - 1))
3976 */
3977 uint8_t *ptr;
3978 unsigned left, tocpy;
3979 uint8_t *A;
3980 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3981 unsigned A_l, tmp_l;
3982 SSL_HMACgcry_md_hd_t hm;
3983
3984 ptr = out->data;
3985 left = out_len;
3986
3987 ssl_print_string("tls_hash: hash secret", secret);
3988 ssl_print_string("tls_hash: hash seed", seed);
3989 /* A(0) = seed */
3990 A = seed->data;
3991 A_l = seed->data_len;
3992
3993 if (ssl_hmac_init(&hm, md) != 0) {
3994 return -1;
3995 }
3996 while (left) {
3997 /* A(i) = HMAC_hash(secret, A(i-1)) */
3998 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3999 ssl_hmac_update(&hm, A, A_l);
4000 A_l = sizeof(_A); /* upper bound len for hash output */
4001 ssl_hmac_final(&hm, _A, &A_l);
4002 A = _A;
4003
4004 /* HMAC_hash(secret, A(i) + seed) */
4005 ssl_hmac_reset(&hm);
4006 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
4007 ssl_hmac_update(&hm, A, A_l);
4008 ssl_hmac_update(&hm, seed->data, seed->data_len);
4009 tmp_l = sizeof(tmp); /* upper bound len for hash output */
4010 ssl_hmac_final(&hm, tmp, &tmp_l);
4011 ssl_hmac_reset(&hm);
4012
4013 /* ssl_hmac_final puts the actual digest output size in tmp_l */
4014 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
4015 memcpy(ptr, tmp, tocpy);
4016 ptr += tocpy;
4017 left -= tocpy;
4018 }
4019 ssl_hmac_cleanup(&hm);
4020 out->data_len = out_len;
4021
4022 ssl_print_string("hash out", out);
4023 return 0;
4024}
4025
4026static bool_Bool
4027tls_prf(StringInfo* secret, const char *usage,
4028 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4029{
4030 StringInfo seed, sha_out, md5_out;
4031 uint8_t *ptr;
4032 StringInfo s1, s2;
4033 unsigned i,s_l;
4034 size_t usage_len, rnd2_len;
4035 bool_Bool success = false0;
4036 usage_len = strlen(usage);
4037 rnd2_len = rnd2 ? rnd2->data_len : 0;
4038
4039 /* initialize buffer for sha, md5 random seed*/
4040 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
4041 ssl_debug_printf("tls_prf: can't allocate sha out\n");
4042 return false0;
4043 }
4044 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
4045 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
4046 goto free_sha;
4047 }
4048 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4049 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
4050 (int) (usage_len+rnd1->data_len+rnd2_len));
4051 goto free_md5;
4052 }
4053
4054 ptr=seed.data;
4055 memcpy(ptr,usage,usage_len);
4056 ptr+=usage_len;
4057 memcpy(ptr,rnd1->data,rnd1->data_len);
4058 if (rnd2_len > 0) {
4059 ptr+=rnd1->data_len;
4060 memcpy(ptr,rnd2->data,rnd2->data_len);
4061 /*ptr+=rnd2->data_len;*/
4062 }
4063
4064 /* initialize buffer for client/server seeds*/
4065 s_l=secret->data_len/2 + secret->data_len%2;
4066 if (ssl_data_alloc(&s1, s_l) < 0) {
4067 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
4068 goto free_seed;
4069 }
4070 if (ssl_data_alloc(&s2, s_l) < 0) {
4071 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
4072 goto free_s1;
4073 }
4074
4075 memcpy(s1.data,secret->data,s_l);
4076 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
4077
4078 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
4079 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
4080 goto free_s2;
4081 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
4082 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
4083 goto free_s2;
4084
4085 for (i = 0; i < out_len; i++)
4086 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
4087 /* success, now store the new meaningful data length */
4088 out->data_len = out_len;
4089 success = true1;
4090
4091 ssl_print_string("PRF out",out);
4092free_s2:
4093 g_free(s2.data);
4094free_s1:
4095 g_free(s1.data);
4096free_seed:
4097 g_free(seed.data);
4098free_md5:
4099 g_free(md5_out.data);
4100free_sha:
4101 g_free(sha_out.data);
4102 return success;
4103}
4104
4105static bool_Bool
4106tls12_prf(int md, StringInfo* secret, const char* usage,
4107 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4108{
4109 StringInfo label_seed;
4110 int success;
4111 size_t usage_len, rnd2_len;
4112 rnd2_len = rnd2 ? rnd2->data_len : 0;
4113
4114 usage_len = strlen(usage);
4115 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4116 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
4117 return false0;
4118 }
4119 memcpy(label_seed.data, usage, usage_len);
4120 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
4121 if (rnd2_len > 0)
4122 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
4123
4124 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
4125 success = tls_hash(secret, &label_seed, md, out, out_len);
4126 g_free(label_seed.data);
4127 if(success != -1){
4128 ssl_print_string("PRF out", out);
4129 return true1;
4130 }
4131 return false0;
4132}
4133
4134static bool_Bool
4135ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
4136 StringInfo *out, unsigned out_len)
4137{
4138 SSL_MD5_CTXgcry_md_hd_t md5;
4139 uint8_t tmp[16];
4140
4141 if (ssl_md5_init(&md5) != 0) {
4142 return false0;
4143 }
4144 ssl_md5_update(&md5,r1->data,r1->data_len);
4145 ssl_md5_update(&md5,r2->data,r2->data_len);
4146 ssl_md5_final(tmp,&md5);
4147 ssl_md5_cleanup(&md5);
4148
4149 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4149, "out_len <= sizeof(tmp)"))))
;
4150 ssl_data_set(out, tmp, out_len);
4151 ssl_print_string("export iv", out);
4152 return true1;
4153}
4154
4155static bool_Bool
4156ssl3_prf(StringInfo* secret, const char* usage,
4157 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4158{
4159 SSL_MD5_CTXgcry_md_hd_t md5;
4160 SSL_SHA_CTXgcry_md_hd_t sha;
4161 unsigned off;
4162 int i = 0,j;
4163 uint8_t buf[20];
4164
4165 if (ssl_sha_init(&sha) != 0) {
4166 return false0;
4167 }
4168 if (ssl_md5_init(&md5) != 0) {
4169 ssl_sha_cleanup(&sha);
4170 return false0;
4171 }
4172 for (off = 0; off < out_len; off += 16) {
4173 unsigned char outbuf[16];
4174 i++;
4175
4176 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
4177 /* A, BB, CCC, ... */
4178 for(j=0;j<i;j++){
4179 buf[j]=64+i;
4180 }
4181
4182 ssl_sha_update(&sha,buf,i);
4183 ssl_sha_update(&sha,secret->data,secret->data_len);
4184
4185 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
4186 if (rnd2)
4187 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4188 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4189 }
4190 else{
4191 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4192 if (rnd2)
4193 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4194 }
4195
4196 ssl_sha_final(buf,&sha);
4197 ssl_sha_reset(&sha);
4198
4199 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
4200 secret->data_len);
4201 ssl_md5_update(&md5,secret->data,secret->data_len);
4202 ssl_md5_update(&md5,buf,20);
4203 ssl_md5_final(outbuf,&md5);
4204 ssl_md5_reset(&md5);
4205
4206 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
4207 }
4208 ssl_sha_cleanup(&sha);
4209 ssl_md5_cleanup(&md5);
4210 out->data_len = out_len;
4211
4212 return true1;
4213}
4214
4215/* out_len is the wanted output length for the pseudorandom function.
4216 * Ensure that ssl->cipher_suite is set. */
4217static bool_Bool
4218prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
4219 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
4220{
4221 switch (ssl->session.version) {
4222 case SSLV3_VERSION0x300:
4223 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
4224
4225 case TLSV1_VERSION0x301:
4226 case TLSV1DOT1_VERSION0x302:
4227 case DTLSV1DOT0_VERSION0xfeff:
4228 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4229 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
4230
4231 default: /* TLSv1.2 */
4232 switch (ssl->cipher_suite->dig) {
4233 case DIG_SM30x44:
4234#if GCRYPT_VERSION_NUMBER0x010a03 >= 0x010900
4235 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
4236 out, out_len);
4237#else
4238 return false0;
4239#endif
4240 case DIG_SHA3840x43:
4241 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
4242 out, out_len);
4243 default:
4244 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
4245 out, out_len);
4246 }
4247 }
4248}
4249
4250static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
4251{
4252 SSL_MD5_CTXgcry_md_hd_t md5;
4253 SSL_SHA_CTXgcry_md_hd_t sha;
4254
4255 if (ssl_data_alloc(out, 36) < 0)
4256 return -1;
4257
4258 if (ssl_md5_init(&md5) != 0)
4259 return -1;
4260 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
4261 ssl_md5_final(out->data,&md5);
4262 ssl_md5_cleanup(&md5);
4263
4264 if (ssl_sha_init(&sha) != 0)
4265 return -1;
4266 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
4267 ssl_sha_final(out->data+16,&sha);
4268 ssl_sha_cleanup(&sha);
4269 return 0;
4270}
4271
4272static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
4273{
4274 SSL_MDgcry_md_hd_t mc;
4275 uint8_t tmp[48];
4276 unsigned len;
4277
4278 if (ssl_md_init(&mc, md) != 0)
4279 return -1;
4280 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
4281 ssl_md_final(&mc, tmp, &len);
4282 ssl_md_cleanup(&mc);
4283
4284 if (ssl_data_alloc(out, len) < 0)
4285 return -1;
4286 memcpy(out->data, tmp, len);
4287 return 0;
4288}
4289
4290/**
4291 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
4292 * inlined and removed once support for draft 19 and before is dropped.
4293 */
4294static inline const char *
4295tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
4296{
4297 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
4298 return "TLS 1.3, ";
4299 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4300 return "dtls13";
4301 } else {
4302 return "tls13 ";
4303 }
4304}
4305
4306/*
4307 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
4308 * custom label prefix. If "context_hash" is NULL, then an empty context is
4309 * used. Otherwise it must have the same length as the hash algorithm output.
4310 */
4311bool_Bool
4312tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
4313 const char *label_prefix, const char *label,
4314 const uint8_t *context_hash, uint8_t context_length,
4315 uint16_t out_len, unsigned char **out)
4316{
4317 /* RFC 8446 Section 7.1:
4318 * HKDF-Expand-Label(Secret, Label, Context, Length) =
4319 * HKDF-Expand(Secret, HkdfLabel, Length)
4320 * struct {
4321 * uint16 length = Length;
4322 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
4323 * opaque context<0..255> = Context;
4324 * } HkdfLabel;
4325 *
4326 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
4327 * HKDF-Expand(PRK, info, L) -> OKM
4328 */
4329 gcry_error_t err;
4330 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
4331 const unsigned label_length = (unsigned) strlen(label);
4332
4333 /* Some sanity checks */
4334 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4334, "label_length > 0 && label_prefix_length + label_length <= 255"
))))
;
38
'?' condition is true
4335
4336 /* info = HkdfLabel { length, label, context } */
4337 GByteArray *info = g_byte_array_new();
4338 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))))
;
4339 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
4340
4341 const uint8_t label_vector_length = label_prefix_length + label_length;
4342 g_byte_array_append(info, &label_vector_length, 1);
4343 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
4344 g_byte_array_append(info, (const uint8_t*)label, label_length);
4345
4346 g_byte_array_append(info, &context_length, 1);
4347 if (context_length
38.1
'context_length' is not equal to 0
) {
39
Taking true branch
4348 g_byte_array_append(info, context_hash, context_length);
4349 }
4350
4351 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
4352 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
4353 g_byte_array_free(info, true1);
4354
4355 if (err) {
40
Assuming 'err' is not equal to 0
41
Taking true branch
4356 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
4357 wmem_free(NULL((void*)0), *out);
4358 *out = NULL((void*)0);
42
Null pointer value stored to 'ech_verify_out'
4359 return false0;
4360 }
4361
4362 return true1;
4363}
4364
4365bool_Bool
4366tls13_hkdf_expand_label(int md, const StringInfo *secret,
4367 const char *label_prefix, const char *label,
4368 uint16_t out_len, unsigned char **out)
4369{
4370 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
4371}
4372/* HMAC and the Pseudorandom function }}} */
4373
4374/* Record Decompression (after decryption) {{{ */
4375#ifdef USE_ZLIB_OR_ZLIBNG
4376/* memory allocation functions for zlib initialization */
4377static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
4378{
4379 return g_malloc0(no*size);
4380}
4381static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
4382{
4383 g_free(addr);
4384}
4385#endif /* USE_ZLIB_OR_ZLIBNG */
4386
4387static SslDecompress*
4388ssl_create_decompressor(int compression)
4389{
4390 SslDecompress *decomp;
4391#ifdef USE_ZLIB_OR_ZLIBNG
4392 int err;
4393#endif
4394
4395 if (compression == 0) return NULL((void*)0);
4396 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
4397 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)))
;
4398 decomp->compression = compression;
4399 switch (decomp->compression) {
4400#ifdef USE_ZLIB_OR_ZLIBNG
4401 case 1: /* DEFLATE */
4402 decomp->istream.zalloc = ssl_zalloc;
4403 decomp->istream.zfree = ssl_zfree;
4404 decomp->istream.opaque = Z_NULL0;
4405 decomp->istream.next_in = Z_NULL0;
4406 decomp->istream.next_out = Z_NULL0;
4407 decomp->istream.avail_in = 0;
4408 decomp->istream.avail_out = 0;
4409 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3", (int)sizeof(z_stream
))
;
4410 if (err != Z_OK0) {
4411 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
4412 return NULL((void*)0);
4413 }
4414 break;
4415#endif /* USE_ZLIB_OR_ZLIBNG */
4416 default:
4417 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
4418 return NULL((void*)0);
4419 }
4420 return decomp;
4421}
4422
4423#ifdef USE_ZLIB_OR_ZLIBNG
4424static int
4425ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
4426{
4427 int err;
4428
4429 switch (decomp->compression) {
4430 case 1: /* DEFLATE */
4431 err = Z_OK0;
4432 if (out_str->data_len < 16384) { /* maximal plain length */
4433 ssl_data_realloc(out_str, 16384);
4434 }
4435#ifdef z_constconst
4436 decomp->istream.next_in = in;
4437#else
4438DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
4439 decomp->istream.next_in = (Bytef *)in;
4440DIAG_ON(cast-qual)clang diagnostic pop
4441#endif
4442 decomp->istream.avail_in = inl;
4443 decomp->istream.next_out = out_str->data;
4444 decomp->istream.avail_out = out_str->data_len;
4445 if (inl > 0)
4446 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
4447 if (err != Z_OK0) {
4448 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
4449 return -1;
4450 }
4451 *outl = out_str->data_len - decomp->istream.avail_out;
4452 break;
4453 default:
4454 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4455 return -1;
4456 }
4457 return 0;
4458}
4459#else /* USE_ZLIB_OR_ZLIBNG */
4460int
4461ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
4462{
4463 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4464 return -1;
4465}
4466#endif /* USE_ZLIB_OR_ZLIBNG */
4467/* Record Decompression (after decryption) }}} */
4468
4469/* Create a new structure to store decrypted chunks. {{{ */
4470static SslFlow*
4471ssl_create_flow(void)
4472{
4473 SslFlow *flow;
4474
4475 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
4476 flow->byte_seq = 0;
4477 flow->flags = 0;
4478 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
4479 return flow;
4480}
4481/* }}} */
4482
4483/* Use the negotiated security parameters for decryption. {{{ */
4484void
4485ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
4486{
4487 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
4488 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
4489 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
4490 *new_decoder ? "" : " (No decoder found - retransmission?)");
4491 if (*new_decoder) {
4492 *dest = *new_decoder;
4493 *new_decoder = NULL((void*)0);
4494 }
4495}
4496/* }}} */
4497
4498/* Init cipher state given some security parameters. {{{ */
4499static bool_Bool
4500ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
4501
4502static SslDecoder*
4503ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
4504 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
4505{
4506 SslDecoder *dec;
4507 ssl_cipher_mode_t mode = cipher_suite->mode;
4508
4509 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)))
;
4510 /* init mac buffer: mac storage is embedded into decoder struct to save a
4511 memory allocation and waste samo more memory*/
4512 dec->cipher_suite=cipher_suite;
4513 dec->compression = compression;
4514 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4515 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4516 // the special case for NULL ciphers, even if there is insufficiency
4517 // keying material (including MAC key), we will can still create
4518 // decoders since "decryption" is easy for such ciphers.
4519 dec->mac_key.data = dec->_mac_key_or_write_iv;
4520 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4521 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4522 // Input for the nonce, to be used with AEAD ciphers.
4523 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4523, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))))
;
4524 dec->write_iv.data = dec->_mac_key_or_write_iv;
4525 ssl_data_set(&dec->write_iv, iv, iv_length);
4526 }
4527 dec->seq = 0;
4528 dec->decomp = ssl_create_decompressor(compression);
4529 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4530
4531 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4532 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4533 cipher_algo, cipher_suite->mode);
4534 return NULL((void*)0);
4535 }
4536
4537 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4538 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4539 mode = MODE_ECB;
4540 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4541 mode = MODE_STREAM;
4542 } else {
4543 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4544 return NULL((void*)0);
4545 }
4546
4547 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4548 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4549 cipher_algo, MODE_ECB);
4550 ssl_cipher_cleanup(&dec->evp);
4551 dec->evp = NULL((void*)0);
4552 return NULL((void*)0);
4553 }
4554 } else {
4555 dec->sn_evp = NULL((void*)0);
4556 }
4557
4558 dec->dtls13_aad.data = NULL((void*)0);
4559 dec->dtls13_aad.data_len = 0;
4560 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4561 return dec;
4562}
4563
4564static bool_Bool
4565ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4566{
4567 SslDecoder *dec = (SslDecoder *) user_data;
4568
4569 if (dec->evp)
4570 ssl_cipher_cleanup(&dec->evp);
4571 if (dec->sn_evp)
4572 ssl_cipher_cleanup(&dec->sn_evp);
4573
4574#ifdef USE_ZLIB_OR_ZLIBNG
4575 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4576 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4577#endif
4578
4579 return false0;
4580}
4581/* }}} */
4582
4583/* (Pre-)master secrets calculations {{{ */
4584#ifdef HAVE_LIBGNUTLS1
4585static bool_Bool
4586ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4587 StringInfo *encrypted_pre_master,
4588 GHashTable *key_hash);
4589#endif /* HAVE_LIBGNUTLS */
4590
4591static bool_Bool
4592ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4593 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4594
4595bool_Bool
4596ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4597 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4598 const char *ssl_psk, packet_info *pinfo,
4599#ifdef HAVE_LIBGNUTLS1
4600 GHashTable *key_hash,
4601#endif
4602 const ssl_master_key_map_t *mk_map)
4603{
4604 /* check for required session data */
4605 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4606 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4607 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4608 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4609 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4610 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4611 return false0;
4612 }
4613
4614 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4615 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4616 return false0;
4617 }
4618
4619 /* check to see if the PMS was provided to us*/
4620 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4621 mk_map->pms, &ssl_session->client_random)) {
4622 return true1;
4623 }
4624
4625 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4626 {
4627 /* calculate pre master secret*/
4628 StringInfo pre_master_secret;
4629 unsigned psk_len, pre_master_len;
4630
4631 if (!ssl_psk || (ssl_psk[0] == 0)) {
4632 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
4633 return false0;
4634 }
4635
4636 /* convert hex string into char*/
4637 if (!from_hex(&ssl_session->psk, ssl_psk, strlen(ssl_psk))) {
4638 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
4639 G_STRFUNC((const char*) (__func__)));
4640 return false0;
4641 }
4642
4643 psk_len = ssl_session->psk.data_len;
4644 if (psk_len >= (2 << 15)) {
4645 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
4646 G_STRFUNC((const char*) (__func__)));
4647 return false0;
4648 }
4649
4650
4651 pre_master_len = psk_len * 2 + 4;
4652
4653 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4654 pre_master_secret.data_len = pre_master_len;
4655 /* 2 bytes psk_len*/
4656 pre_master_secret.data[0] = psk_len >> 8;
4657 pre_master_secret.data[1] = psk_len & 0xFF;
4658 /* psk_len bytes times 0*/
4659 memset(&pre_master_secret.data[2], 0, psk_len);
4660 /* 2 bytes psk_len*/
4661 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4662 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4663 /* psk*/
4664 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4665
4666 ssl_session->pre_master_secret.data = pre_master_secret.data;
4667 ssl_session->pre_master_secret.data_len = pre_master_len;
4668 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4669
4670 /* Remove the master secret if it was there.
4671 This forces keying material regeneration in
4672 case we're renegotiating */
4673 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4674 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4675 return true1;
4676 }
4677 else
4678 {
4679 unsigned encrlen, skip;
4680 encrlen = length;
4681 skip = 0;
4682
4683 /* get encrypted data, on tls1 we have to skip two bytes
4684 * (it's the encrypted len and should be equal to record len - 2)
4685 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4686 */
4687 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4688 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4689 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4690 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4691 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4692 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4693 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4694 {
4695 encrlen = tvb_get_ntohs(tvb, offset);
4696 skip = 2;
4697 if (encrlen > length - 2)
4698 {
4699 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4700 G_STRFUNC((const char*) (__func__)), encrlen, length);
4701 return false0;
4702 }
4703 }
4704 /* the valid lower bound is higher than 8, but it is sufficient for the
4705 * ssl keylog file below */
4706 if (encrlen < 8) {
4707 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4708 G_STRFUNC((const char*) (__func__)), encrlen);
4709 return false0;
4710 }
4711
4712 StringInfo encrypted_pre_master = {
4713 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4714 .data_len = encrlen,
4715 };
4716
4717#ifdef HAVE_LIBGNUTLS1
4718 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4719 if (ssl_session->cert_key_id) {
4720 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4721 return true1;
4722
4723 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4724 G_STRFUNC((const char*) (__func__)));
4725 }
4726#endif /* HAVE_LIBGNUTLS */
4727
4728 /* try to find the pre-master secret from the encrypted one. The
4729 * ssl key logfile stores only the first 8 bytes, so truncate it */
4730 encrypted_pre_master.data_len = 8;
4731 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4732 true1, mk_map->pre_master, &encrypted_pre_master))
4733 return true1;
4734 }
4735 return false0;
4736}
4737
4738/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4739int
4740ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4741{
4742 StringInfo key_block = { NULL((void*)0), 0 };
4743 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4744 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4745 int needed;
4746 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4747 unsigned encr_key_len, write_iv_len = 0;
4748 bool_Bool is_export_cipher;
4749 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4750 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4751 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4752
4753 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4754 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4755 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4756 return -1;
4757 }
4758
4759 /* check for enough info to proceed */
4760 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4761 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4762 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4763 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4764 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4765 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4766 /* Special case: for NULL encryption, allow dissection of data even if
4767 * the Client Hello is missing (MAC keys are now skipped though). */
4768 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4769 if ((ssl_session->state & need_all) == need_all &&
4770 cipher_suite->enc == ENC_NULL0x3D) {
4771 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4772 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4773 goto create_decoders;
4774 }
4775
4776 return -1;
4777 }
4778
4779 /* if master key is not available, generate is from the pre-master secret */
4780 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
4781 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
4782 StringInfo handshake_hashed_data;
4783 int ret;
4784
4785 handshake_hashed_data.data = NULL((void*)0);
4786 handshake_hashed_data.data_len = 0;
4787
4788 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4789 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4790 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4790, "ssl_session->handshake_data.data_len > 0"
))))
;
4791
4792 switch(ssl_session->session.version) {
4793 case TLSV1_VERSION0x301:
4794 case TLSV1DOT1_VERSION0x302:
4795 case DTLSV1DOT0_VERSION0xfeff:
4796 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4797 case TLCPV1_VERSION0x101:
4798 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
4799 break;
4800 default:
4801 switch (cipher_suite->dig) {
4802 case DIG_SHA3840x43:
4803 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4804 break;
4805 default:
4806 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4807 break;
4808 }
4809 break;
4810 }
4811 if (ret) {
4812 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
4813 return -1;
4814 }
4815
4816 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4817 ssl_session->handshake_data.data = NULL((void*)0);
4818 ssl_session->handshake_data.data_len = 0;
4819
4820 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4821 &handshake_hashed_data,
4822 NULL((void*)0), &ssl_session->master_secret,
4823 SSL_MASTER_SECRET_LENGTH48)) {
4824 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4825 g_free(handshake_hashed_data.data);
4826 return -1;
4827 }
4828 g_free(handshake_hashed_data.data);
4829 } else {
4830 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4831 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4832 ssl_print_string("client random",&ssl_session->client_random);
4833 ssl_print_string("server random",&ssl_session->server_random);
4834 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4835 &ssl_session->client_random,
4836 &ssl_session->server_random, &ssl_session->master_secret,
4837 SSL_MASTER_SECRET_LENGTH48)) {
4838 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4839 return -1;
4840 }
4841 }
4842 ssl_print_string("master secret",&ssl_session->master_secret);
4843
4844 /* the pre-master secret has been 'consumed' so we must clear it now */
4845 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4846 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4847 }
4848
4849 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4850 if (cipher_suite->enc != ENC_NULL0x3D) {
4851 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4852 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4853 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4854 if (cipher_algo == 0) {
4855 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4856 return -1;
4857 }
4858 }
4859
4860 /* Export ciphers consume less material from the key block. */
4861 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4862 is_export_cipher = encr_key_len > 0;
4863 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4864 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4865 }
4866
4867 if (cipher_suite->mode == MODE_CBC) {
4868 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4869 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4870 /* account for a four-byte salt for client and server side (from
4871 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4872 write_iv_len = 4;
4873 } else if (cipher_suite->mode == MODE_POLY1305) {
4874 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4875 write_iv_len = 12;
4876 }
4877
4878 /* Compute the key block. First figure out how much data we need */
4879 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4880 needed += 2 * encr_key_len; /* encryption key */
4881 needed += 2 * write_iv_len; /* write IV */
4882
4883 key_block.data = (unsigned char *)g_malloc(needed);
4884 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4885 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4886 &ssl_session->server_random,&ssl_session->client_random,
4887 &key_block, needed)) {
4888 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4889 goto fail;
4890 }
4891 ssl_print_string("key expansion", &key_block);
4892
4893 ptr=key_block.data;
4894 /* client/server write MAC key (for non-AEAD ciphers) */
4895 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4896 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4897 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4898 }
4899 /* client/server write encryption key */
4900 c_wk=ptr; ptr += encr_key_len;
4901 s_wk=ptr; ptr += encr_key_len;
4902 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4903 if (write_iv_len > 0) {
4904 c_iv=ptr; ptr += write_iv_len;
4905 s_iv=ptr; /* ptr += write_iv_len; */
4906 }
4907
4908 /* export ciphers work with a smaller key length */
4909 if (is_export_cipher) {
4910 if (cipher_suite->mode == MODE_CBC) {
4911
4912 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4913 all we should need. This is a sanity check */
4914 if (write_iv_len > MAX_BLOCK_SIZE16) {
4915 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4916 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4917 goto fail;
4918 }
4919
4920 if(ssl_session->session.version==SSLV3_VERSION0x300){
4921 /* The length of these fields are ignored by this caller */
4922 StringInfo iv_c, iv_s;
4923 iv_c.data = _iv_c;
4924 iv_s.data = _iv_s;
4925
4926 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4927 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4928 &ssl_session->server_random, &iv_c, write_iv_len)) {
4929 goto fail;
4930 }
4931 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4932 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4933 &ssl_session->client_random, &iv_s, write_iv_len)) {
4934 goto fail;
4935 }
4936 }
4937 else{
4938 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4939 StringInfo iv_block;
4940 StringInfo key_null;
4941 uint8_t _key_null;
4942
4943 key_null.data = &_key_null;
4944 key_null.data_len = 0;
4945
4946 iv_block.data = _iv_block;
4947
4948 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4949 if (!prf(ssl_session, &key_null, "IV block",
4950 &ssl_session->client_random,
4951 &ssl_session->server_random, &iv_block,
4952 write_iv_len * 2)) {
4953 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4954 goto fail;
4955 }
4956
4957 memcpy(_iv_c, iv_block.data, write_iv_len);
4958 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4959 }
4960
4961 c_iv=_iv_c;
4962 s_iv=_iv_s;
4963 }
4964
4965 if (ssl_session->session.version==SSLV3_VERSION0x300){
4966
4967 SSL_MD5_CTXgcry_md_hd_t md5;
4968 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4969
4970 if (ssl_md5_init(&md5) != 0)
4971 goto fail;
4972 ssl_md5_update(&md5,c_wk,encr_key_len);
4973 ssl_md5_update(&md5,ssl_session->client_random.data,
4974 ssl_session->client_random.data_len);
4975 ssl_md5_update(&md5,ssl_session->server_random.data,
4976 ssl_session->server_random.data_len);
4977 ssl_md5_final(_key_c,&md5);
4978 ssl_md5_cleanup(&md5);
4979 c_wk=_key_c;
4980
4981 if (ssl_md5_init(&md5) != 0)
4982 goto fail;
4983 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4984 ssl_md5_update(&md5,s_wk,encr_key_len);
4985 ssl_md5_update(&md5,ssl_session->server_random.data,
4986 ssl_session->server_random.data_len);
4987 ssl_md5_update(&md5,ssl_session->client_random.data,
4988 ssl_session->client_random.data_len);
4989 ssl_md5_final(_key_s,&md5);
4990 ssl_md5_cleanup(&md5);
4991 s_wk=_key_s;
4992 }
4993 else{
4994 StringInfo key_c, key_s, k;
4995 key_c.data = _key_c;
4996 key_s.data = _key_s;
4997
4998 k.data = c_wk;
4999 k.data_len = encr_key_len;
5000 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
5001 if (!prf(ssl_session, &k, "client write key",
5002 &ssl_session->client_random,
5003 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
5004 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
5005 goto fail;
5006 }
5007 c_wk=_key_c;
5008
5009 k.data = s_wk;
5010 k.data_len = encr_key_len;
5011 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
5012 if (!prf(ssl_session, &k, "server write key",
5013 &ssl_session->client_random,
5014 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
5015 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
5016 goto fail;
5017 }
5018 s_wk=_key_s;
5019 }
5020 }
5021
5022 /* show key material info */
5023 if (c_mk != NULL((void*)0)) {
5024 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5025 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5026 }
5027 ssl_print_data("Client Write key", c_wk, encr_key_len);
5028 ssl_print_data("Server Write key", s_wk, encr_key_len);
5029 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
5030 if (write_iv_len > 0) {
5031 ssl_print_data("Client Write IV", c_iv, write_iv_len);
5032 ssl_print_data("Server Write IV", s_iv, write_iv_len);
5033 }
5034
5035create_decoders:
5036 /* create both client and server ciphers*/
5037 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
5038 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
5039 if (!ssl_session->client_new) {
5040 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
5041 goto fail;
5042 }
5043 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
5044 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
5045 if (!ssl_session->server_new) {
5046 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
5047 goto fail;
5048 }
5049
5050 /* Continue the SSL stream after renegotiation with new keys. */
5051 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5052 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5053
5054 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
5055 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
5056 g_free(key_block.data);
5057 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
5058 return 0;
5059
5060fail:
5061 g_free(key_block.data);
5062 return -1;
5063}
5064
5065/* Generated the key material based on the given secret. */
5066bool_Bool
5067tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
5068{
5069 bool_Bool success = false0;
5070 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
5071 unsigned char *sn_key = NULL((void*)0);
5072 SslDecoder *decoder;
5073 unsigned key_length, iv_length;
5074 int hash_algo;
5075 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
5076 int cipher_algo;
5077
5078 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
5079 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
5080 ssl_session->session.version);
5081 return false0;
5082 }
5083
5084 if (cipher_suite == NULL((void*)0)) {
5085 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
5086 return false0;
5087 }
5088
5089 if (cipher_suite->kex != KEX_TLS130x23) {
5090 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
5091 return false0;
5092 }
5093
5094 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
5095 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
5096 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5097 cipher_algo = ssl_get_cipher_by_name(cipher_name);
5098 if (cipher_algo == 0) {
5099 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5100 return false0;
5101 }
5102
5103 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
5104 hash_algo = ssl_get_digest_by_name(hash_name);
5105 if (!hash_algo) {
5106 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
5107 return false0;
5108 }
5109
5110 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
5111 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
5112 iv_length = 12;
5113 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
5114
5115 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
5116 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
5117 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5118 return false0;
5119 }
5120 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
5121 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
5122 goto end;
5123 }
5124
5125 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5126 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
5127 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5128 goto end;
5129 }
5130 }
5131
5132 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
5133 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
5134 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5135 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
5136 }
5137
5138 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5139 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
5140 if (!decoder) {
5141 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5142 goto end;
5143 }
5144
5145 /* Continue the TLS session with new keys, but reuse old flow to keep things
5146 * like "Follow TLS" working (by linking application data records). */
5147 if (is_from_server) {
5148 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5149 ssl_session->server = decoder;
5150 } else {
5151 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5152 ssl_session->client = decoder;
5153 }
5154 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
5155 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
5156 success = true1;
5157
5158end:
5159 wmem_free(NULL((void*)0), write_key);
5160 wmem_free(NULL((void*)0), write_iv);
5161 if (sn_key)
5162 wmem_free(NULL((void*)0), sn_key);
5163 return success;
5164}
5165/* (Pre-)master secrets calculations }}} */
5166
5167#ifdef HAVE_LIBGNUTLS1
5168/* Decrypt RSA pre-master secret using RSA private key. {{{ */
5169static bool_Bool
5170ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
5171 StringInfo *encrypted_pre_master, GHashTable *key_hash)
5172{
5173 int ret;
5174
5175 if (!encrypted_pre_master)
5176 return false0;
5177
5178 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)
) {
5179 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
5180 "(cipher suite 0x%04X %s) and cannot be decrypted "
5181 "using a RSA private key file.\n",
5182 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
5183 val_to_str_ext_const(ssl_session->session.cipher,
5184 &ssl_31_ciphersuite_ext, "unknown"));
5185 return false0;
5186 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
5187 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
5188 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
5189 return false0;
5190 }
5191
5192 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
5193
5194 ssl_print_string("pre master encrypted", encrypted_pre_master);
5195 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
5196 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
5197 gnutls_datum_t pms = { 0 };
5198 if (pk) {
5199 // Try to decrypt using the RSA keys table from (D)TLS preferences.
5200 ret = gnutls_privkey_decrypt_data(pk, 0, &epms, &pms);
5201 } else {
5202 // Try to decrypt using a hardware token.
5203 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
5204 }
5205 if (ret < 0) {
5206 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
5207 return false0;
5208 }
5209
5210 if (pms.size != 48) {
5211 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
5212 G_STRFUNC((const char*) (__func__)), pms.size, 48);
5213 if (pk) {
5214 gnutls_free(pms.data);
5215 } else {
5216 g_free(pms.data);
5217 }
5218 return false0;
5219 }
5220
5221 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
5222 ssl_session->pre_master_secret.data_len = 48;
5223 if (pk) {
5224 gnutls_free(pms.data);
5225 } else {
5226 g_free(pms.data);
5227 }
5228 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
5229
5230 /* Remove the master secret if it was there.
5231 This forces keying material regeneration in
5232 case we're renegotiating */
5233 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
5234 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
5235 return true1;
5236} /* }}} */
5237#endif /* HAVE_LIBGNUTLS */
5238
5239/* Decryption integrity check {{{ */
5240
5241static int
5242tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
5243 uint32_t datalen, uint8_t* mac)
5244{
5245 SSL_HMACgcry_md_hd_t hm;
5246 int md;
5247 uint32_t len;
5248 uint8_t buf[DIGEST_MAX_SIZE48];
5249 int16_t temp;
5250
5251 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5252 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
5253 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5254
5255 if (ssl_hmac_init(&hm,md) != 0)
5256 return -1;
5257 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5258 return -1;
5259
5260 /* hash sequence number */
5261 phton64(buf, decoder->seq);
5262
5263 decoder->seq++;
5264
5265 ssl_hmac_update(&hm,buf,8);
5266
5267 /* hash content type */
5268 buf[0]=ct;
5269 ssl_hmac_update(&hm,buf,1);
5270
5271 /* hash version,data length and data*/
5272 /* *((int16_t*)buf) = g_htons(ver); */
5273 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5274 memcpy(buf, &temp, 2);
5275 ssl_hmac_update(&hm,buf,2);
5276
5277 /* *((int16_t*)buf) = g_htons(datalen); */
5278 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5279 memcpy(buf, &temp, 2);
5280 ssl_hmac_update(&hm,buf,2);
5281 ssl_hmac_update(&hm,data,datalen);
5282
5283 /* get digest and digest len*/
5284 len = sizeof(buf);
5285 ssl_hmac_final(&hm,buf,&len);
5286 ssl_hmac_cleanup(&hm);
5287 ssl_print_data("Mac", buf, len);
5288 if(memcmp(mac,buf,len))
5289 return -1;
5290
5291 return 0;
5292}
5293
5294static int
5295ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
5296 uint32_t datalen, uint8_t* mac)
5297{
5298 SSL_MDgcry_md_hd_t mc;
5299 int md;
5300 uint32_t len;
5301 uint8_t buf[64],dgst[20];
5302 int pad_ct;
5303 int16_t temp;
5304
5305 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
5306
5307 /* get cipher used for digest computation */
5308 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5309 if (ssl_md_init(&mc,md) !=0)
5310 return -1;
5311
5312 /* do hash computation on data && padding */
5313 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5314
5315 /* hash padding*/
5316 memset(buf,0x36,pad_ct);
5317 ssl_md_update(&mc,buf,pad_ct);
5318
5319 /* hash sequence number */
5320 phton64(buf, decoder->seq);
5321 decoder->seq++;
5322 ssl_md_update(&mc,buf,8);
5323
5324 /* hash content type */
5325 buf[0]=ct;
5326 ssl_md_update(&mc,buf,1);
5327
5328 /* hash data length in network byte order and data*/
5329 /* *((int16_t* )buf) = g_htons(datalen); */
5330 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5331 memcpy(buf, &temp, 2);
5332 ssl_md_update(&mc,buf,2);
5333 ssl_md_update(&mc,data,datalen);
5334
5335 /* get partial digest */
5336 ssl_md_final(&mc,dgst,&len);
5337 ssl_md_reset(&mc);
5338
5339 /* hash mac key */
5340 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5341
5342 /* hash padding and partial digest*/
5343 memset(buf,0x5c,pad_ct);
5344 ssl_md_update(&mc,buf,pad_ct);
5345 ssl_md_update(&mc,dgst,len);
5346
5347 ssl_md_final(&mc,dgst,&len);
5348 ssl_md_cleanup(&mc);
5349
5350 if(memcmp(mac,dgst,len))
5351 return -1;
5352
5353 return 0;
5354}
5355
5356static int
5357dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
5358 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
5359{
5360 SSL_HMACgcry_md_hd_t hm;
5361 int md;
5362 uint32_t len;
5363 uint8_t buf[DIGEST_MAX_SIZE48];
5364 int16_t temp;
5365
5366 int ver = ssl->session.version;
5367 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
5368
5369 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5370 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
5371 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5372
5373 if (ssl_hmac_init(&hm,md) != 0)
5374 return -1;
5375 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5376 return -1;
5377
5378 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
5379
5380 if (is_cid && !ssl->session.deprecated_cid) {
5381 /* hash seq num placeholder */
5382 memset(buf,0xFF,8);
5383 ssl_hmac_update(&hm,buf,8);
5384
5385 /* hash content type + cid length + content type */
5386 buf[0]=ct;
5387 buf[1]=cidl;
5388 buf[2]=ct;
5389 ssl_hmac_update(&hm,buf,3);
5390
5391 /* hash version */
5392 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5393 memcpy(buf, &temp, 2);
5394 ssl_hmac_update(&hm,buf,2);
5395
5396 /* hash sequence number */
5397 phton64(buf, decoder->seq);
5398 buf[0]=decoder->epoch>>8;
5399 buf[1]=(uint8_t)decoder->epoch;
5400 ssl_hmac_update(&hm,buf,8);
5401
5402 /* hash cid */
5403 ssl_hmac_update(&hm,cid,cidl);
5404 } else {
5405 /* hash sequence number */
5406 phton64(buf, decoder->seq);
5407 buf[0]=decoder->epoch>>8;
5408 buf[1]=(uint8_t)decoder->epoch;
5409 ssl_hmac_update(&hm,buf,8);
5410
5411 /* hash content type */
5412 buf[0]=ct;
5413 ssl_hmac_update(&hm,buf,1);
5414
5415 /* hash version */
5416 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5417 memcpy(buf, &temp, 2);
5418 ssl_hmac_update(&hm,buf,2);
5419
5420 if (is_cid && ssl->session.deprecated_cid) {
5421 /* hash cid */
5422 ssl_hmac_update(&hm,cid,cidl);
5423
5424 /* hash cid length */
5425 buf[0] = cidl;
5426 ssl_hmac_update(&hm,buf,1);
5427 }
5428 }
5429
5430 /* data length and data */
5431 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5432 memcpy(buf, &temp, 2);
5433 ssl_hmac_update(&hm,buf,2);
5434 ssl_hmac_update(&hm,data,datalen);
5435
5436 /* get digest and digest len */
5437 len = sizeof(buf);
5438 ssl_hmac_final(&hm,buf,&len);
5439 ssl_hmac_cleanup(&hm);
5440 ssl_print_data("Mac", buf, len);
5441 if(memcmp(mac,buf,len))
5442 return -1;
5443
5444 return 0;
5445}
5446/* Decryption integrity check }}} */
5447
5448
5449static bool_Bool
5450tls_decrypt_aead_record(SslDecryptSession *ssl, SslDecoder *decoder,
5451 uint8_t ct, uint16_t record_version,
5452 bool_Bool ignore_mac_failed,
5453 const unsigned char *in, uint16_t inl,
5454 const unsigned char *cid, uint8_t cidl,
5455 StringInfo *out_str, unsigned *outl)
5456{
5457 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
5458 * GenericAEADCipher: { nonce_explicit, [content] }
5459 * In TLS 1.3 this explicit nonce is gone.
5460 * With AES GCM/CCM, "[content]" is actually the concatenation of the
5461 * ciphertext and authentication tag.
5462 */
5463 const uint16_t version = ssl->session.version;
5464 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
5465 gcry_error_t err;
5466 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
5467 unsigned ciphertext_len, auth_tag_len;
5468 unsigned char nonce[12];
5469 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
5470 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
5471 const uint8_t draft_version = ssl->session.tls13_draft_version;
5472 const unsigned char *auth_tag_wire;
5473 unsigned char auth_tag_calc[16];
5474 unsigned char *aad = NULL((void*)0);
5475 unsigned aad_len = 0;
5476
5477 switch (cipher_mode) {
5478 case MODE_GCM:
5479 case MODE_CCM:
5480 case MODE_POLY1305:
5481 auth_tag_len = 16;
5482 break;
5483 case MODE_CCM_8:
5484 auth_tag_len = 8;
5485 break;
5486 default:
5487 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
5488 return false0;
5489 }
5490
5491 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
5492 if (is_v12 && cipher_mode != MODE_POLY1305) {
5493 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
5494 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
5495 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
5496 return false0;
5497 }
5498 explicit_nonce = in;
5499 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
5500 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
5501 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5502 if (inl < auth_tag_len) {
5503 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
5504 return false0;
5505 }
5506 ciphertext = in;
5507 ciphertext_len = inl - auth_tag_len;
5508 } else {
5509 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
5510 return false0;
5511 }
5512 auth_tag_wire = ciphertext + ciphertext_len;
5513
5514 /*
5515 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
5516 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
5517 */
5518 if (is_v12 && cipher_mode != MODE_POLY1305) {
5519 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5519, "decoder->write_iv.data_len == 4"))))
;
5520 /* Implicit (4) and explicit (8) part of nonce. */
5521 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
5522 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
5523
5524 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5525 /*
5526 * Technically the nonce length must be at least 8 bytes, but for
5527 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5528 */
5529 const unsigned nonce_len = 12;
5530 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5530, "decoder->write_iv.data_len == nonce_len"
))))
;
5531 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5532 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5533 phton64(nonce + nonce_len - 8, pntoh64(nonce + nonce_len - 8) ^ decoder->seq);
5534 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5535 }
5536
5537 /* Set nonce and additional authentication data */
5538 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0)
;
5539 ssl_print_data("nonce", nonce, 12);
5540 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5541 if (err) {
5542 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5543 return false0;
5544 }
5545
5546 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5547 if (is_cid) { /* if connection ID */
5548 if (ssl->session.deprecated_cid) {
5549 aad_len = 14 + cidl;
5550 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5551 phton64(aad, decoder->seq); /* record sequence number */
5552 phton16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5553 aad[8] = ct; /* TLSCompressed.type */
5554 phton16(aad + 9, record_version); /* TLSCompressed.version */
5555 memcpy(aad + 11, cid, cidl); /* cid */
5556 aad[11 + cidl] = cidl; /* cid_length */
5557 phton16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5558 } else {
5559 aad_len = 23 + cidl;
5560 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5561 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5562 aad[8] = ct; /* TLSCompressed.type */
5563 aad[9] = cidl; /* cid_length */
5564 aad[10] = ct; /* TLSCompressed.type */
5565 phton16(aad + 11, record_version); /* TLSCompressed.version */
5566 phton64(aad + 13, decoder->seq); /* record sequence number */
5567 phton16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5568 memcpy(aad + 21, cid, cidl); /* cid */
5569 phton16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5570 }
5571 } else if (is_v12) {
5572 aad_len = 13;
5573 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5574 phton64(aad, decoder->seq); /* record sequence number */
5575 if (version == DTLSV1DOT2_VERSION0xfefd) {
5576 phton16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5577 }
5578 aad[8] = ct; /* TLSCompressed.type */
5579 phton16(aad + 9, record_version); /* TLSCompressed.version */
5580 phton16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5581 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5582 aad_len = decoder->dtls13_aad.data_len;
5583 aad = decoder->dtls13_aad.data;
5584 } else if (draft_version >= 25 || draft_version == 0) {
5585 aad_len = 5;
5586 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5587 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5588 phton16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5589 phton16(aad + 3, inl); /* TLSCiphertext.length */
5590 }
5591
5592 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5593 /* size of plaintext, additional authenticated data and auth tag. */
5594 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5595
5596 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5597 }
5598
5599 if (aad && aad_len > 0) {
5600 ssl_print_data("AAD", aad, aad_len);
5601 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5602 if (err) {
5603 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5604 return false0;
5605 }
5606 }
5607
5608 /* Decrypt now that nonce and AAD are set. */
5609 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5610 if (err) {
5611 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5612 return false0;
5613 }
5614
5615 /* Check authentication tag for authenticity (replaces MAC) */
5616 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5617 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5618 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5619 } else {
5620 if (err) {
5621 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5622 } else {
5623 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5624 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5625 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5626 }
5627 if (ignore_mac_failed) {
5628 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5629 } else {
5630 return false0;
5631 }
5632 }
5633
5634 /*
5635 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5636 * after successful authentication to ensure that early data is skipped when
5637 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5638 */
5639 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5640 decoder->seq++;
5641 }
5642
5643 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5644 *outl = ciphertext_len;
5645 return true1;
5646}
5647
5648/* Record decryption glue based on security parameters {{{ */
5649/* Assume that we are called only for a non-NULL decoder which also means that
5650 * we have a non-NULL decoder->cipher_suite. */
5651int
5652ssl_decrypt_record(SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5653 bool_Bool ignore_mac_failed,
5654 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5655 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5656{
5657 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5658 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5659
5660 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5661 ssl_print_data("Ciphertext",in, inl);
5662
5663 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5664 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5665 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5666 return -1;
5667 }
5668
5669 /* ensure we have enough storage space for decrypted data */
5670 if (inl > out_str->data_len)
5671 {
5672 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5673 inl + 32, out_str->data_len);
5674 ssl_data_realloc(out_str, inl + 32);
5675 }
5676
5677 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5678 * a separate MAC, so use a different routine for simplicity. */
5679 if (decoder->cipher_suite->mode == MODE_GCM ||
5680 decoder->cipher_suite->mode == MODE_CCM ||
5681 decoder->cipher_suite->mode == MODE_CCM_8 ||
5682 decoder->cipher_suite->mode == MODE_POLY1305 ||
5683 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5684 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5685
5686 if (!tls_decrypt_aead_record(ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5687 /* decryption failed */
5688 return -1;
5689 }
5690
5691 goto skip_mac;
5692 }
5693
5694 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5695 * (notation: { unencrypted, [ encrypted ] })
5696 * GenericStreamCipher: { [content, mac] }
5697 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5698 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5699 * GenericAEADCipher: { nonce_explicit, [content] }
5700 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5701 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5702 */
5703
5704 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5705
5706 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5707 if (decoder->cipher_suite->mode == MODE_CBC) {
5708 unsigned blocksize = 0;
5709
5710 switch (ssl->session.version) {
5711 case TLSV1DOT1_VERSION0x302:
5712 case TLSV1DOT2_VERSION0x303:
5713 case DTLSV1DOT0_VERSION0xfeff:
5714 case DTLSV1DOT2_VERSION0xfefd:
5715 case DTLSV1DOT3_VERSION0xfefc:
5716 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5717 case TLCPV1_VERSION0x101:
5718 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5719 if (inl < blocksize) {
5720 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5721 inl, blocksize);
5722 return -1;
5723 }
5724 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5725 if (pad != 0) {
5726 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5727 gcry_strsource (pad), gcry_strerror (pad));
5728 }
5729
5730 inl -= blocksize;
5731 in += blocksize;
5732 break;
5733 }
5734
5735 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5736 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5737 /*
5738 * MAC is calculated over (IV + ) ENCRYPTED contents:
5739 *
5740 * MAC(MAC_write_key, ... +
5741 * IV + // for TLS 1.1 or greater
5742 * TLSCiphertext.enc_content);
5743 */
5744 if (inl < maclen) {
5745 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5746 G_STRFUNC((const char*) (__func__)), inl, maclen);
5747 return -1;
5748 }
5749 inl -= maclen;
5750 mac = (uint8_t *)in + inl;
5751 mac_frag = (uint8_t *)in - blocksize;
5752 mac_fraglen = blocksize + inl;
5753 }
5754 }
5755
5756 /* First decrypt*/
5757 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5758 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5759 gcry_strerror (pad));
5760 return -1;
5761 }
5762
5763 ssl_print_data("Plaintext", out_str->data, inl);
5764 worklen=inl;
5765
5766
5767 /* strip padding for GenericBlockCipher */
5768 if (decoder->cipher_suite->mode == MODE_CBC) {
5769 if (inl < 1) { /* Should this check happen earlier? */
5770 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5771 return -1;
5772 }
5773 pad=out_str->data[inl-1];
5774 if (worklen <= pad) {
5775 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5776 pad, worklen);
5777 return -1;
5778 }
5779 worklen-=(pad+1);
5780 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5781 pad, worklen);
5782 }
5783
5784 /* MAC for GenericStreamCipher and GenericBlockCipher.
5785 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5786 if (!mac) {
5787 /*
5788 * MAC is calculated over the DECRYPTED contents:
5789 *
5790 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5791 */
5792 if (worklen < maclen) {
5793 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5794 return -1;
5795 }
5796 worklen -= maclen;
5797 mac = out_str->data + worklen;
5798 mac_frag = out_str->data;
5799 mac_fraglen = worklen;
5800 }
5801
5802 /* If NULL encryption active and no keys are available, do not bother
5803 * checking the MAC. We do not have keys for that. */
5804 if (decoder->cipher_suite->mode == MODE_STREAM &&
5805 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5806 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5807 ssl_debug_printf("MAC check skipped due to missing keys\n");
5808 decoder->seq++; // Increment this for display
5809 goto skip_mac;
5810 }
5811
5812 /* Now check the MAC */
5813 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5814 worklen, ssl->session.version, ct, decoder->seq);
5815 if(ssl->session.version==SSLV3_VERSION0x300){
5816 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5817 if(ignore_mac_failed) {
5818 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5819 }
5820 else{
5821 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5822 return -1;
5823 }
5824 }
5825 else{
5826 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5827 }
5828 }
5829 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5830 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5831 if(ignore_mac_failed) {
5832 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5833 }
5834 else{
5835 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5836 return -1;
5837 }
5838 }
5839 else{
5840 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5841 }
5842 }
5843 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5844 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5845 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5846 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5847 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5848 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5849 }
5850 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5851 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5852 }
5853 else if(ignore_mac_failed) {
5854 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5855 }
5856 else{
5857 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5858 return -1;
5859 }
5860 }
5861skip_mac:
5862
5863 *outl = worklen;
5864
5865 if (decoder->compression > 0) {
5866 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5867 ssl_data_copy(comp_str, out_str);
5868 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5869 if (!decoder->decomp) {
5870 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5871 return -1;
5872 }
5873 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5874 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5875 *outl = uncomplen;
5876 }
5877
5878 return 0;
5879}
5880/* Record decryption glue based on security parameters }}} */
5881
5882
5883
5884#ifdef HAVE_LIBGNUTLS1
5885
5886/* RSA private key file processing {{{ */
5887static void
5888ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5889 gnutls_datum_t *subjectPublicKeyInfo)
5890{
5891 gnutls_pubkey_t pubkey = NULL((void*)0);
5892 cert_key_id_t key_id;
5893 size_t key_id_len = sizeof(key_id);
5894 int r;
5895
5896 if (!subjectPublicKeyInfo->size) {
5897 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5898 return;
5899 }
5900
5901 r = gnutls_pubkey_init(&pubkey);
5902 if (r < 0) {
5903 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5904 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5905 return;
5906 }
5907
5908 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5909 if (r < 0) {
5910 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5911 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5912 goto end;
5913 }
5914
5915 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5916 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5917 goto end;
5918 }
5919
5920 /* Generate a 20-byte SHA-1 hash. */
5921 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5922 if (r < 0) {
5923 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5924 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5925 goto end;
5926 }
5927
5928 if (key_id_len != sizeof(key_id)) {
5929 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5930 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5931 goto end;
5932 }
5933
5934 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5935 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)))
;
5936 *ssl->cert_key_id = key_id;
5937
5938end:
5939 gnutls_pubkey_deinit(pubkey);
5940}
5941
5942/* RSA private key file processing }}} */
5943#endif /* HAVE_LIBGNUTLS */
5944
5945/*--- Start of dissector-related code below ---*/
5946
5947/* get ssl data for this session. if no ssl data is found allocate a new one*/
5948SslDecryptSession *
5949ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle)
5950{
5951 void *conv_data;
5952 SslDecryptSession *ssl_session;
5953 int proto_ssl;
5954
5955 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5956 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5957 if (conv_data != NULL((void*)0))
5958 return (SslDecryptSession *)conv_data;
5959
5960 /* no previous SSL conversation info, initialize it. */
5961 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)))
;
5962
5963 /* data_len is the part that is meaningful, not the allocated length */
5964 ssl_session->master_secret.data_len = 0;
5965 ssl_session->master_secret.data = ssl_session->_master_secret;
5966 ssl_session->session_id.data_len = 0;
5967 ssl_session->session_id.data = ssl_session->_session_id;
5968 ssl_session->client_random.data_len = 0;
5969 ssl_session->client_random.data = ssl_session->_client_random;
5970 ssl_session->server_random.data_len = 0;
5971 ssl_session->server_random.data = ssl_session->_server_random;
5972 ssl_session->session_ticket.data_len = 0;
5973 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5974 ssl_session->server_data_for_iv.data_len = 0;
5975 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5976 ssl_session->client_data_for_iv.data_len = 0;
5977 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5978 ssl_session->app_data_segment.data = NULL((void*)0);
5979 ssl_session->app_data_segment.data_len = 0;
5980 ssl_session->handshake_data.data=NULL((void*)0);
5981 ssl_session->handshake_data.data_len=0;
5982 ssl_session->ech_transcript.data=NULL((void*)0);
5983 ssl_session->ech_transcript.data_len=0;
5984
5985 /* Initialize parameters which are not necessary specific to decryption. */
5986 ssl_session->session.version = SSL_VER_UNKNOWN0;
5987 clear_address(&ssl_session->session.srv_addr);
5988 ssl_session->session.srv_ptype = PT_NONE;
5989 ssl_session->session.srv_port = 0;
5990 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5991 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5992 ssl_session->session.client_random.data_len = 0;
5993 ssl_session->session.client_random.data = ssl_session->session._client_random;
5994 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5995 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5996 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5997 ssl_session->session.ech = false0;
5998 ssl_session->session.hrr_ech_declined = false0;
5999 ssl_session->session.first_ch_ech_frame = 0;
6000
6001 conversation_add_proto_data(conversation, proto_ssl, ssl_session);
6002 return ssl_session;
6003}
6004
6005void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
6006{
6007 if (ssl) {
6008 /* Ensure that secrets are not restored using stale identifiers. Split
6009 * between client and server in case the packets somehow got out of order. */
6010 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
6011
6012 if (is_client) {
6013 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
6014 ssl->session_id.data_len = 0;
6015 ssl->session_ticket.data_len = 0;
6016 ssl->master_secret.data_len = 0;
6017 ssl->client_random.data_len = 0;
6018 ssl->has_early_data = false0;
6019 if (ssl->handshake_data.data_len > 0) {
6020 // The EMS handshake hash starts with at the Client Hello,
6021 // ensure that any messages before it are forgotten.
6022 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
6023 ssl->handshake_data.data = NULL((void*)0);
6024 ssl->handshake_data.data_len = 0;
6025 }
6026 } else {
6027 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
6028 ssl->server_random.data_len = 0;
6029 ssl->pre_master_secret.data_len = 0;
6030#ifdef HAVE_LIBGNUTLS1
6031 ssl->cert_key_id = NULL((void*)0);
6032#endif
6033 ssl->psk.data_len = 0;
6034 }
6035
6036 if (ssl->state & clear_flags) {
6037 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
6038 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
6039 ssl->state &= ~clear_flags;
6040 }
6041 }
6042
6043 /* These flags might be used for non-decryption purposes and may affect the
6044 * dissection, so reset them as well. */
6045 if (is_client) {
6046 session->client_cert_type = 0;
6047 } else {
6048 session->compression = 0;
6049 session->server_cert_type = 0;
6050 /* session->is_session_resumed is already handled in the ServerHello dissection. */
6051 }
6052 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
6053 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
6054}
6055
6056void
6057tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
6058 dissector_handle_t app_handle)
6059{
6060 conversation_t *conversation;
6061 SslSession *session;
6062
6063 /* Ignore if the TLS or other dissector is disabled. */
6064 if (!tls_handle || !app_handle)
6065 return;
6066
6067 conversation = find_or_create_conversation(pinfo);
6068 session = &ssl_get_session(conversation, tls_handle)->session;
6069 session->app_handle = app_handle;
6070}
6071
6072static uint32_t
6073ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
6074 dissector_handle_t app_handle, uint32_t last_nontls_frame)
6075{
6076 conversation_t *conversation;
6077 SslSession *session;
6078
6079 /* Ignore if the TLS dissector is disabled. */
6080 if (!tls_handle)
6081 return 0;
6082 /* The caller should always pass a valid handle to its own dissector. */
6083 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6083, "app_handle"))))
;
6084
6085 conversation = find_or_create_conversation(pinfo);
6086 session = &ssl_get_session(conversation, tls_handle)->session;
6087
6088 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6089 session->last_nontls_frame,
6090 (void *)session->app_handle,
6091 dissector_handle_get_dissector_name(session->app_handle));
6092 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6093 pinfo->num, (void *)app_handle,
6094 dissector_handle_get_dissector_name(app_handle));
6095
6096 /* Do not switch again if a dissector did it before. */
6097 if (session->last_nontls_frame) {
6098 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
6099 return session->last_nontls_frame;
6100 }
6101
6102 session->app_handle = app_handle;
6103 /* The TLS dissector should be called first for this conversation. */
6104 conversation_set_dissector(conversation, tls_handle);
6105 /* TLS starts after this frame. */
6106 session->last_nontls_frame = last_nontls_frame;
6107 return 0;
6108}
6109
6110/* ssl_starttls_ack: mark future frames as encrypted. */
6111uint32_t
6112ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6113 dissector_handle_t app_handle)
6114{
6115 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
6116}
6117
6118uint32_t
6119ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6120 dissector_handle_t app_handle)
6121{
6122 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
6123}
6124
6125dissector_handle_t
6126ssl_find_appdata_dissector(const char *name)
6127{
6128 /* Accept 'http' for backwards compatibility and sanity. */
6129 if (!strcmp(name, "http"))
6130 name = "http-over-tls";
6131 /* XXX - Should this check to see if the dissector is actually added for
6132 * Decode As in the appropriate table?
6133 */
6134 return find_dissector(name);
6135}
6136
6137/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
6138static int
6139ssl_equal (const void *v, const void *v2)
6140{
6141 const StringInfo *val1;
6142 const StringInfo *val2;
6143 val1 = (const StringInfo *)v;
6144 val2 = (const StringInfo *)v2;
6145
6146 if (val1->data_len == val2->data_len &&
6147 !memcmp(val1->data, val2->data, val2->data_len)) {
6148 return 1;
6149 }
6150 return 0;
6151}
6152
6153static unsigned
6154ssl_hash (const void *v)
6155{
6156 unsigned l,hash;
6157 const StringInfo* id;
6158 const unsigned* cur;
6159 hash = 0;
6160 id = (const StringInfo*) v;
6161
6162 /* id and id->data are mallocated in ssl_save_master_key(). As such 'data'
6163 * should be aligned for any kind of access (for example as a unsigned as
6164 * is done below). The intermediate void* cast is to prevent "cast
6165 * increases required alignment of target type" warnings on CPUs (such
6166 * as SPARCs) that do not allow misaligned memory accesses.
6167 */
6168 cur = (const unsigned*)(void*) id->data;
6169
6170 for (l=4; (l < id->data_len); l+=4, cur++)
6171 hash = hash ^ (*cur);
6172
6173 return hash;
6174}
6175/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
6176
6177/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
6178void
6179ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6180{
6181 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6181, "main_handle"))))
;
6182 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6182, "subdissector_handle"))))
;
6183 /* Registration is required for Export PDU feature to work properly. */
6184 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6185, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
6185 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6185, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
;
6186 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
6187
6188 if (port) {
6189 dissector_add_uint(dissector_table_name, port, subdissector_handle);
6190 if (tcp)
6191 dissector_add_uint("tcp.port", port, main_handle);
6192 else
6193 dissector_add_uint("udp.port", port, main_handle);
6194 dissector_add_uint("sctp.port", port, main_handle);
6195 } else {
6196 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
6197 }
6198}
6199
6200void
6201ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6202{
6203 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
6204 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
6205 if (main_handle) {
6206 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
6207 dissector_delete_uint("sctp.port", port, main_handle);
6208 }
6209
6210 if (port) {
6211 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
6212 }
6213}
6214
6215void
6216ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
6217{
6218 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
6219 session->srv_ptype = ptype;
6220 session->srv_port = port;
6221}
6222
6223int
6224ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
6225{
6226 int ret;
6227 if (session && session->srv_addr.type != AT_NONE) {
6228 ret = (session->srv_ptype == pinfo->ptype) &&
6229 (session->srv_port == pinfo->srcport) &&
6230 addresses_equal(&session->srv_addr, &pinfo->src);
6231 } else {
6232 ret = (dissector_get_uint_handle(table, pinfo->srcport) != 0);
6233 }
6234
6235 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
6236 return ret;
6237}
6238/* Handling of association between tls/dtls ports and clear text protocol. }}} */
6239
6240
6241/* Links SSL records with the real packet data. {{{ */
6242SslPacketInfo *
6243tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
6244{
6245 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6246 if (!pi) {
6247 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)))
;
6248 pi->srcport = pinfo->srcport;
6249 pi->destport = pinfo->destport;
6250 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
6251 }
6252
6253 return pi;
6254}
6255
6256/**
6257 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
6258 * avoid the need for a decoder in the second pass. Additionally, it remembers
6259 * sequence numbers (for reassembly and Follow TLS Stream).
6260 *
6261 * @param proto The protocol identifier (proto_ssl or proto_dtls).
6262 * @param pinfo The packet where the record originates from.
6263 * @param data Decrypted data to store in the record.
6264 * @param data_len Length of decrypted record data.
6265 * @param record_id The identifier for this record within the current packet.
6266 * @param flow Information about sequence numbers, etc.
6267 * @param type TLS Content Type (such as handshake or application_data).
6268 * @param curr_layer_num_ssl The layer identifier for this TLS session.
6269 */
6270void
6271ssl_add_record_info(int proto, packet_info *pinfo, const unsigned char *data, int data_len, int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl, uint64_t record_seq)
6272{
6273 SslRecordInfo* rec, **prec;
6274 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
6275
6276 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)))
;
6277 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), data, data_len);
6278 rec->data_len = data_len;
6279 rec->id = record_id;
6280 rec->type = type;
6281 rec->next = NULL((void*)0);
6282 rec->record_seq = record_seq;
6283
6284 if (flow && type == SSL_ID_APP_DATA) {
6285 rec->seq = flow->byte_seq;
6286 rec->flow = flow;
6287 flow->byte_seq += data_len;
6288 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
6289 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + data_len, (void*)flow);
6290 }
6291
6292 /* Remember decrypted records. */
6293 prec = &pi->records;
6294 while (*prec) prec = &(*prec)->next;
6295 *prec = rec;
6296}
6297
6298/* search in packet data for the specified id; return a newly created tvb for the associated data */
6299tvbuff_t*
6300ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
6301{
6302 SslRecordInfo* rec;
6303 SslPacketInfo* pi;
6304 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6305
6306 if (!pi)
6307 return NULL((void*)0);
6308
6309 for (rec = pi->records; rec; rec = rec->next)
6310 if (rec->id == record_id) {
6311 *matched_record = rec;
6312 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
6313 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->data_len, rec->data_len);
6314 }
6315
6316 return NULL((void*)0);
6317}
6318/* Links SSL records with the real packet data. }}} */
6319
6320/* initialize/reset per capture state data (ssl sessions cache). {{{ */
6321void
6322ssl_common_init(ssl_master_key_map_t *mk_map,
6323 StringInfo *decrypted_data, StringInfo *compressed_data)
6324{
6325 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
6326 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
6327 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
6328 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
6329 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
6330 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
6331 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6332 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6333 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6334 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6335 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6336 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6337
6338 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
6339 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
6340
6341 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
6342
6343 ssl_data_alloc(decrypted_data, 32);
6344 ssl_data_alloc(compressed_data, 32);
6345}
6346
6347void
6348ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
6349 StringInfo *decrypted_data, StringInfo *compressed_data)
6350{
6351 g_hash_table_destroy(mk_map->session);
6352 g_hash_table_destroy(mk_map->tickets);
6353 g_hash_table_destroy(mk_map->crandom);
6354 g_hash_table_destroy(mk_map->pre_master);
6355 g_hash_table_destroy(mk_map->pms);
6356 g_hash_table_destroy(mk_map->tls13_client_early);
6357 g_hash_table_destroy(mk_map->tls13_client_handshake);
6358 g_hash_table_destroy(mk_map->tls13_server_handshake);
6359 g_hash_table_destroy(mk_map->tls13_client_appdata);
6360 g_hash_table_destroy(mk_map->tls13_server_appdata);
6361 g_hash_table_destroy(mk_map->tls13_early_exporter);
6362 g_hash_table_destroy(mk_map->tls13_exporter);
6363
6364 g_hash_table_destroy(mk_map->ech_secret);
6365 g_hash_table_destroy(mk_map->ech_config);
6366
6367 g_hash_table_destroy(mk_map->used_crandom);
6368
6369 g_free(decrypted_data->data);
6370 g_free(compressed_data->data);
6371
6372 /* close the previous keylog file now that the cache are cleared, this
6373 * allows the cache to be filled with the full keylog file contents. */
6374 if (*ssl_keylog_file) {
6375 fclose(*ssl_keylog_file);
6376 *ssl_keylog_file = NULL((void*)0);
6377 }
6378}
6379/* }}} */
6380
6381/* parse ssl related preferences (private keys and ports association strings) */
6382#if defined(HAVE_LIBGNUTLS1)
6383/* Load a single RSA key file item from preferences. {{{ */
6384void
6385ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
6386{
6387 gnutls_x509_privkey_t x509_priv_key;
6388 gnutls_privkey_t priv_key = NULL((void*)0);
6389 FILE* fp = NULL((void*)0);
6390 int ret;
6391 size_t key_id_len = 20;
6392 unsigned char *key_id = NULL((void*)0);
6393 char *err = NULL((void*)0);
6394 dissector_handle_t handle;
6395 /* try to load keys file first */
6396 fp = ws_fopenfopen(uats->keyfile, "rb");
6397 if (!fp) {
6398 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
6399 return;
6400 }
6401
6402 if ((int)strlen(uats->password) == 0) {
6403 x509_priv_key = rsa_load_pem_key(fp, &err);
6404 } else {
6405 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
6406 }
6407 fclose(fp);
6408
6409 if (!x509_priv_key) {
6410 if (err) {
6411 report_failure("Can't load private key from %s: %s",
6412 uats->keyfile, err);
6413 g_free(err);
6414 } else
6415 report_failure("Can't load private key from %s: unknown error",
6416 uats->keyfile);
6417 return;
6418 }
6419 if (err) {
6420 report_failure("Load of private key from %s \"succeeded\" with error %s",
6421 uats->keyfile, err);
6422 g_free(err);
6423 }
6424
6425 gnutls_privkey_init(&priv_key);
6426 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6427 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6428 if (ret < 0) {
6429 report_failure("Can't convert private key %s: %s",
6430 uats->keyfile, gnutls_strerror(ret));
6431 goto end;
6432 }
6433
6434 key_id = (unsigned char *) g_malloc0(key_id_len);
6435 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6436 if (ret < 0) {
6437 report_failure("Can't calculate public key ID for %s: %s",
6438 uats->keyfile, gnutls_strerror(ret));
6439 goto end;
6440 }
6441 ssl_print_data("KeyID", key_id, key_id_len);
6442 if (key_id_len != 20) {
6443 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6444 uats->keyfile, key_id_len);
6445 goto end;
6446 }
6447
6448 g_hash_table_replace(key_hash, key_id, priv_key);
6449 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6450 priv_key = NULL((void*)0);
6451 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6452
6453 handle = ssl_find_appdata_dissector(uats->protocol);
6454 if (handle) {
6455 /* Port to subprotocol mapping */
6456 uint16_t port = 0;
6457 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6458 if (port > 0) {
6459 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6460 port, uats->keyfile, uats->password);
6461
6462 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6463 }
6464 } else {
6465 if (strcmp(uats->port, "start_tls"))
6466 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6467 }
6468 }
6469
6470end:
6471 gnutls_x509_privkey_deinit(x509_priv_key);
6472 gnutls_privkey_deinit(priv_key);
6473 g_free(key_id);
6474}
6475/* }}} */
6476#endif
6477
6478
6479/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6480/** store a known (pre-)master secret into cache */
6481static void
6482ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6483 StringInfo *mk)
6484{
6485 StringInfo *ht_key, *master_secret;
6486
6487 if (key->data_len == 0) {
6488 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6489 return;
6490 }
6491
6492 if (mk->data_len == 0) {
6493 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6494 G_STRFUNC((const char*) (__func__)), label);
6495 return;
6496 }
6497
6498 /* ssl_hash() depends on session_ticket->data being aligned for unsigned access
6499 * so be careful in changing how it is allocated. */
6500 ht_key = ssl_data_clone(key);
6501 master_secret = ssl_data_clone(mk);
6502 g_hash_table_insert(ht, ht_key, master_secret);
6503
6504 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6505 ssl_print_string("stored key", ht_key);
6506 ssl_print_string("stored (pre-)master secret", master_secret);
6507}
6508
6509/** restore a (pre-)master secret given some key in the cache */
6510static bool_Bool
6511ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6512 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6513{
6514 StringInfo *ms;
6515
6516 if (key->data_len == 0) {
6517 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6518 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6519 return false0;
6520 }
6521
6522 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6523 if (!ms) {
6524 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6525 is_pre_master ? "pre-" : "", label);
6526 return false0;
6527 }
6528
6529 /* (pre)master secret found, clear knowledge of other keys and set it in the
6530 * current conversation */
6531 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6532 SSL_HAVE_SESSION_KEY(1<<3));
6533 if (is_pre_master) {
6534 /* unlike master secret, pre-master secret has a variable size (48 for
6535 * RSA, varying for PSK) and is therefore not statically allocated */
6536 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6537 ms->data_len);
6538 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6539 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6540 } else {
6541 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6542 ssl->state |= SSL_MASTER_SECRET(1<<5);
6543 }
6544 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6545 is_pre_master ? "pre-" : "", label);
6546 ssl_print_string(label, key);
6547 ssl_print_string("(pre-)master secret", ms);
6548 return true1;
6549}
6550/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6551
6552/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6553 * the decoder should be attempted to be initialized. {{{*/
6554void
6555ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6556{
6557 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
6558 /* TLS 1.3 implementations only provide secrets derived from the master
6559 * secret which are loaded in tls13_change_key. No master secrets can be
6560 * loaded here, so just return. */
6561 return;
6562 }
6563 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6564 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
6565 ssl_debug_printf(" session key already available, nothing to do.\n");
6566 return;
6567 }
6568 if (!(ssl->state & SSL_CIPHER(1<<2))) {
6569 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6570 return;
6571 }
6572
6573 /* for decryption, there needs to be a master secret (which can be derived
6574 * from pre-master secret). If missing, try to pick a master key from cache
6575 * (an earlier packet in the capture or key logfile). */
6576 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6577 !ssl_restore_master_key(ssl, "Session ID", false0,
6578 mk_map->session, &ssl->session_id) &&
6579 (!ssl->session.is_session_resumed ||
6580 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6581 mk_map->tickets, &ssl->session_ticket)) &&
6582 !ssl_restore_master_key(ssl, "Client Random", false0,
6583 mk_map->crandom, &ssl->client_random)) {
6584 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6585 /* how unfortunate, the master secret could not be found */
6586 ssl_debug_printf(" Cannot find master secret\n");
6587 return;
6588 } else {
6589 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6590 "because of a NULL cipher\n");
6591 }
6592 }
6593
6594 if (ssl_generate_keyring_material(ssl) < 0) {
6595 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6596 return;
6597 }
6598 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6599 ssl_save_master_key("Client Random", mk_map->crandom,
6600 &ssl->client_random, &ssl->master_secret);
6601 ssl_save_master_key("Session ID", mk_map->session,
6602 &ssl->session_id, &ssl->master_secret);
6603 /* Only save the new secrets if the server sent the ticket. The client
6604 * ticket might have become stale. */
6605 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6606 ssl_save_master_key("Session Ticket", mk_map->tickets,
6607 &ssl->session_ticket, &ssl->master_secret);
6608 }
6609} /* }}} */
6610
6611/* Load the traffic key secret from the keylog file. */
6612StringInfo *
6613tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6614 bool_Bool is_from_server, TLSRecordType type)
6615{
6616 GHashTable *key_map;
6617 const char *label;
6618
6619 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6620 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6621 return NULL((void*)0);
6622 }
6623
6624 if (ssl->client_random.data_len == 0) {
6625 /* May happen if Hello message is missing and Finished is found. */
6626 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6627 return NULL((void*)0);
6628 }
6629
6630 switch (type) {
6631 case TLS_SECRET_0RTT_APP:
6632 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6632, "!is_from_server"))))
;
6633 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6634 key_map = mk_map->tls13_client_early;
6635 break;
6636 case TLS_SECRET_HANDSHAKE:
6637 if (is_from_server) {
6638 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6639 key_map = mk_map->tls13_server_handshake;
6640 } else {
6641 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6642 key_map = mk_map->tls13_client_handshake;
6643 }
6644 break;
6645 case TLS_SECRET_APP:
6646 if (is_from_server) {
6647 label = "SERVER_TRAFFIC_SECRET_0";
6648 key_map = mk_map->tls13_server_appdata;
6649 } else {
6650 label = "CLIENT_TRAFFIC_SECRET_0";
6651 key_map = mk_map->tls13_client_appdata;
6652 }
6653 break;
6654 default:
6655 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6655, __func__, "assertion \"not reached\" failed")
;
6656 }
6657
6658 /* Transitioning to new keys, mark old ones as unusable. */
6659 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6660 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6661
6662 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6663 if (!secret) {
6664 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6665 /* Disable decryption, the keys are invalid. */
6666 if (is_from_server) {
6667 ssl->server = NULL((void*)0);
6668 } else {
6669 ssl->client = NULL((void*)0);
6670 }
6671 return NULL((void*)0);
6672 }
6673
6674 /* TLS 1.3 secret found, set new keys. */
6675 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6676 ssl_print_string("Client Random", &ssl->client_random);
6677 ssl_print_string(label, secret);
6678 return secret;
6679}
6680
6681/* Load the new key. */
6682void
6683tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6684 bool_Bool is_from_server, TLSRecordType type)
6685{
6686 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6687 /*
6688 * QUIC does not use the TLS record layer for message protection.
6689 * The required keys will be extracted later by QUIC.
6690 */
6691 return;
6692 }
6693
6694 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6695 if (!secret) {
6696 if (type != TLS_SECRET_HANDSHAKE) {
6697 return;
6698 }
6699 /*
6700 * Workaround for when for some reason we don't have the handshake
6701 * secret but do have the application traffic secret. (#20240)
6702 * If we can't find the handshake secret, we'll never decrypt the
6703 * Finished message, so we won't know when to change to the app
6704 * traffic key, so we do so now.
6705 */
6706 type = TLS_SECRET_APP;
6707 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6708 if (!secret) {
6709 return;
6710 }
6711 }
6712
6713 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6714 /*
6715 * Remember the application traffic secret to support Key Update. The
6716 * other secrets cannot be used for this purpose, so free them.
6717 */
6718 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6719 StringInfo *app_secret = &decoder->app_traffic_secret;
6720 if (type == TLS_SECRET_APP) {
6721 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6722 app_secret->data,
6723 secret->data_len);
6724 ssl_data_set(app_secret, secret->data, secret->data_len);
6725 } else {
6726 wmem_free(wmem_file_scope(), app_secret->data);
6727 app_secret->data = NULL((void*)0);
6728 app_secret->data_len = 0;
6729 }
6730 }
6731}
6732
6733/**
6734 * Update to next application data traffic secret for TLS 1.3. The previous
6735 * secret should have been set by tls13_change_key.
6736 */
6737void
6738tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6739{
6740 /* RFC 8446 Section 7.2:
6741 * application_traffic_secret_N+1 =
6742 * HKDF-Expand-Label(application_traffic_secret_N,
6743 * "traffic upd", "", Hash.length)
6744 *
6745 * Both application_traffic_secret_N are of the same length (Hash.length).
6746 */
6747 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6748 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6749 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6750 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6751
6752 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6753 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6754 return;
6755 }
6756
6757 /*
6758 * Previous traffic secret is available, so find the hash function,
6759 * expand the new traffic secret and generate new keys.
6760 */
6761 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6762 int hash_algo = ssl_get_digest_by_name(hash_name);
6763 const unsigned hash_len = app_secret->data_len;
6764 unsigned char *new_secret;
6765 const char *label = "traffic upd";
6766 if (tls13_draft_version && tls13_draft_version < 20) {
6767 label = "application traffic secret";
6768 }
6769 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6770 tls13_hkdf_label_prefix(ssl),
6771 label, hash_len, &new_secret)) {
6772 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6773 return;
6774 }
6775 ssl_data_set(app_secret, new_secret, hash_len);
6776 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6777 /*
6778 * Remember the application traffic secret on the new decoder to
6779 * support another Key Update.
6780 */
6781 decoder = is_from_server ? ssl->server : ssl->client;
6782 app_secret = &decoder->app_traffic_secret;
6783 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6784 app_secret->data,
6785 hash_len);
6786 ssl_data_set(app_secret, new_secret, hash_len);
6787 }
6788 wmem_free(NULL((void*)0), new_secret);
6789}
6790
6791void
6792tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6793{
6794 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6795 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6796 }
6797}
6798
6799/** SSL keylog file handling. {{{ */
6800
6801static GRegex *
6802ssl_compile_keyfile_regex(void)
6803{
6804#define OCTET "(?:[[:xdigit:]]{2})"
6805 const char *pattern =
6806 "(?:"
6807 /* Matches Client Hellos having this Client Random */
6808 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6809 /* Matches first part of encrypted RSA pre-master secret */
6810 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6811 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6812 but it can be of any length for DHE */
6813 ")(?<pms>" OCTET "+)"
6814 "|(?:"
6815 /* Matches Server Hellos having a Session ID */
6816 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6817 /* Matches Client Hellos having this Client Random */
6818 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6819 /* Master-Secret is given, its length is fixed */
6820 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6821 "|(?"
6822 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6823 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6824 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6825 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6826 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6827 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6828 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6829 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6830 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6831 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6832 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6833 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6834 ") (?<derived_secret>" OCTET "+)";
6835#undef OCTET
6836 static GRegex *regex = NULL((void*)0);
6837 GError *gerr = NULL((void*)0);
6838
6839 if (!regex) {
6840 regex = g_regex_new(pattern,
6841 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6842 G_REGEX_MATCH_ANCHORED, &gerr);
6843 if (gerr) {
6844 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6845 gerr->message);
6846 g_error_free(gerr);
6847 regex = NULL((void*)0);
6848 }
6849 }
6850
6851 return regex;
6852}
6853
6854typedef struct ssl_master_key_match_group {
6855 const char *re_group_name;
6856 GHashTable *master_key_ht;
6857} ssl_master_key_match_group_t;
6858
6859void
6860tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6861{
6862 ssl_master_key_match_group_t mk_groups[] = {
6863 { "encrypted_pmk", mk_map->pre_master },
6864 { "session_id", mk_map->session },
6865 { "client_random", mk_map->crandom },
6866 { "client_random_pms", mk_map->pms },
6867 /* TLS 1.3 map from Client Random to derived secret. */
6868 { "client_early", mk_map->tls13_client_early },
6869 { "client_handshake", mk_map->tls13_client_handshake },
6870 { "server_handshake", mk_map->tls13_server_handshake },
6871 { "client_appdata", mk_map->tls13_client_appdata },
6872 { "server_appdata", mk_map->tls13_server_appdata },
6873 { "early_exporter", mk_map->tls13_early_exporter },
6874 { "exporter", mk_map->tls13_exporter },
6875 { "ech_secret", mk_map->ech_secret },
6876 { "ech_config", mk_map->ech_config },
6877 };
6878
6879 /* The format of the file is a series of records with one of the following formats:
6880 * - "RSA xxxx yyyy"
6881 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6882 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6883 * (this is the original format introduced with bug 4349)
6884 *
6885 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6886 * Where xxxx is the SSL session ID (hex-encoded)
6887 * Where yyyy is the cleartext master secret (hex-encoded)
6888 * (added to support openssl s_client Master-Key output)
6889 * This is somewhat is a misnomer because there's nothing RSA specific
6890 * about this.
6891 *
6892 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6893 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6894 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6895 * (This format allows SSL connections to be decrypted, if a user can
6896 * capture the PMS but could not recover the MS for a specific session
6897 * with a SSL Server.)
6898 *
6899 * - "CLIENT_RANDOM xxxx yyyy"
6900 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6901 * Where yyyy is the cleartext master secret (hex-encoded)
6902 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6903 * ECDHE-RSA.)
6904 *
6905 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6906 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6907 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6908 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6909 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6910 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6911 * - "EXPORTER_SECRET xxxx yyyy"
6912 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6913 * Where yyyy is the secret (hex-encoded) derived from the early,
6914 * handshake or master secrets. (This format is introduced with TLS 1.3
6915 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6916 */
6917 GRegex *regex = ssl_compile_keyfile_regex();
6918 if (!regex)
6919 return;
6920
6921 const char *next_line = (const char *)data;
6922 const char *line_end = next_line + datalen;
6923 while (next_line && next_line < line_end) {
6924 const char *line = next_line;
6925 next_line = (const char *)memchr(line, '\n', line_end - line);
6926 ssize_t linelen;
6927
6928 if (next_line) {
6929 linelen = next_line - line;
6930 next_line++; /* drop LF */
6931 } else {
6932 linelen = (ssize_t)(line_end - line);
6933 }
6934 if (linelen > 0 && line[linelen - 1] == '\r') {
6935 linelen--; /* drop CR */
6936 }
6937
6938 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6939 GMatchInfo *mi;
6940 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6941 char *hex_key, *hex_pre_ms_or_ms;
6942 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
6943 StringInfo *pre_ms_or_ms = NULL((void*)0);
6944 GHashTable *ht = NULL((void*)0);
6945
6946 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6947 * otherwise we will use the Master Secret
6948 */
6949 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6950 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6951 g_free(hex_pre_ms_or_ms);
6952 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6953 }
6954 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6955 g_free(hex_pre_ms_or_ms);
6956 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6957 }
6958 /* There is always a match, otherwise the regex is wrong. */
6959 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6959, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))))
;
6960
6961 /* convert from hex to bytes and save to hashtable */
6962 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
6963 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6964 g_free(hex_pre_ms_or_ms);
6965
6966 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6967 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6968 ssl_master_key_match_group_t *g = &mk_groups[i];
6969 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6970 if (hex_key && *hex_key) {
6971 ssl_debug_printf(" matched %s\n", g->re_group_name);
6972 ht = g->master_key_ht;
6973 from_hex(key, hex_key, strlen(hex_key));
6974 g_free(hex_key);
6975 break;
6976 }
6977 g_free(hex_key);
6978 }
6979 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6979, "ht"))))
; /* Cannot be reached, or regex is wrong. */
6980
6981 g_hash_table_insert(ht, key, pre_ms_or_ms);
6982
6983 } else if (linelen > 0 && line[0] != '#') {
6984 ssl_debug_printf(" unrecognized line\n");
6985 }
6986 /* always free match info even if there is no match. */
6987 g_match_info_free(mi);
6988 }
6989}
6990
6991void
6992ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6993 const ssl_master_key_map_t *mk_map)
6994{
6995 /* no need to try if no key log file is configured. */
6996 if (!tls_keylog_filename || !*tls_keylog_filename) {
6997 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6998 G_STRFUNC((const char*) (__func__)));
6999 return;
7000 }
7001
7002 /* Validate regexes before even trying to use it. */
7003 if (!ssl_compile_keyfile_regex()) {
7004 return;
7005 }
7006
7007 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
7008
7009 /* if the keylog file was deleted/overwritten, re-open it */
7010 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
7011 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
7012 fclose(*keylog_file);
7013 *keylog_file = NULL((void*)0);
7014 }
7015
7016 if (*keylog_file == NULL((void*)0)) {
7017 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
7018 if (!*keylog_file) {
7019 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
7020 return;
7021 }
7022 }
7023
7024 for (;;) {
7025 char buf[1110], *line;
7026 line = fgets(buf, sizeof(buf), *keylog_file);
7027 if (!line) {
7028 if (feof(*keylog_file)) {
7029 /* Ensure that newly appended keys can be read in the future. */
7030 clearerr(*keylog_file);
7031 } else if (ferror(*keylog_file)) {
7032 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
7033 fclose(*keylog_file);
7034 *keylog_file = NULL((void*)0);
7035 }
7036 break;
7037 }
7038 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
7039 }
7040}
7041/** SSL keylog file handling. }}} */
7042
7043#ifdef SSL_DECRYPT_DEBUG /* {{{ */
7044
7045static FILE* ssl_debug_file;
7046
7047void
7048ssl_set_debug(const char* name)
7049{
7050 static int debug_file_must_be_closed;
7051 int use_stderr;
7052
7053 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
7054
7055 if (debug_file_must_be_closed)
7056 fclose(ssl_debug_file);
7057
7058 if (use_stderr)
7059 ssl_debug_file = stderrstderr;
7060 else if (!name || (strcmp(name, "") ==0))
7061 ssl_debug_file = NULL((void*)0);
7062 else
7063 ssl_debug_file = ws_fopenfopen(name, "w");
7064
7065 if (!use_stderr && ssl_debug_file)
7066 debug_file_must_be_closed = 1;
7067 else
7068 debug_file_must_be_closed = 0;
7069
7070 ssl_debug_printf("Wireshark SSL debug log \n\n");
7071#ifdef HAVE_LIBGNUTLS1
7072 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
7073#endif
7074 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
7075 ssl_debug_printf("\n");
7076}
7077
7078void
7079ssl_debug_flush(void)
7080{
7081 if (ssl_debug_file)
7082 fflush(ssl_debug_file);
7083}
7084
7085void
7086ssl_debug_printf(const char* fmt, ...)
7087{
7088 va_list ap;
7089
7090 if (!ssl_debug_file)
7091 return;
7092
7093 va_start(ap, fmt)__builtin_va_start(ap, fmt);
7094 vfprintf(ssl_debug_file, fmt, ap);
7095 va_end(ap)__builtin_va_end(ap);
7096}
7097
7098void
7099ssl_print_data(const char* name, const unsigned char* data, size_t len)
7100{
7101 size_t i, j, k;
7102 if (!ssl_debug_file)
7103 return;
7104 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
7105 for (i=0; i<len; i+=16) {
7106 fprintf(ssl_debug_file,"| ");
7107 for (j=i, k=0; k<16 && j<len; ++j, ++k)
7108 fprintf(ssl_debug_file,"%.2x ",data[j]);
7109 for (; k<16; ++k)
7110 fprintf(ssl_debug_file," ");
7111 fputc('|', ssl_debug_file);
7112 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
7113 unsigned char c = data[j];
7114 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
7115 fputc(c, ssl_debug_file);
7116 }
7117 for (; k<16; ++k)
7118 fputc(' ', ssl_debug_file);
7119 fprintf(ssl_debug_file,"|\n");
7120 }
7121}
7122
7123void
7124ssl_print_string(const char* name, const StringInfo* data)
7125{
7126 ssl_print_data(name, data->data, data->data_len);
7127}
7128#endif /* SSL_DECRYPT_DEBUG }}} */
7129
7130/* UAT preferences callbacks. {{{ */
7131/* checks for SSL and DTLS UAT key list fields */
7132
7133bool_Bool
7134ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7135{
7136 // This should be removed in favor of Decode As. Make it optional.
7137 *err = NULL((void*)0);
7138 return true1;
7139}
7140
7141bool_Bool
7142ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7143{
7144 if (!p || strlen(p) == 0u) {
7145 // This should be removed in favor of Decode As. Make it optional.
7146 *err = NULL((void*)0);
7147 return true1;
7148 }
7149
7150 if (strcmp(p, "start_tls") != 0){
7151 uint16_t port;
7152 if (!ws_strtou16(p, NULL((void*)0), &port)) {
7153 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
7154 return false0;
7155 }
7156 }
7157
7158 *err = NULL((void*)0);
7159 return true1;
7160}
7161
7162bool_Bool
7163ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7164{
7165 ws_statb64struct stat st;
7166
7167 if (!p || strlen(p) == 0u) {
7168 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
7169 return false0;
7170 } else {
7171 if (ws_stat64stat(p, &st) != 0) {
7172 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p)
;
7173 return false0;
7174 }
7175 }
7176
7177 *err = NULL((void*)0);
7178 return true1;
7179}
7180
7181bool_Bool
7182ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
7183{
7184#if defined(HAVE_LIBGNUTLS1)
7185 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
7186 FILE *fp = NULL((void*)0);
7187
7188 if (p && (strlen(p) > 0u)) {
7189 fp = ws_fopenfopen(f->keyfile, "rb");
7190 if (fp) {
7191 char *msg = NULL((void*)0);
7192 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
7193 if (!priv_key) {
7194 fclose(fp);
7195 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg)
;
7196 g_free(msg);
7197 return false0;
7198 }
7199 g_free(msg);
7200 gnutls_x509_privkey_deinit(priv_key);
7201 fclose(fp);
7202 } else {
7203 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
)
;
7204 return false0;
7205 }
7206 }
7207
7208 *err = NULL((void*)0);
7209 return true1;
7210#else
7211 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
)
;
7212 return false0;
7213#endif
7214}
7215/* UAT preferences callbacks. }}} */
7216
7217/** maximum size of ssl_association_info() string */
7218#define SSL_ASSOC_MAX_LEN8192 8192
7219
7220typedef struct ssl_association_info_callback_data
7221{
7222 char *str;
7223 const char *table_protocol;
7224} ssl_association_info_callback_data_t;
7225
7226/**
7227 * callback function used by ssl_association_info() to traverse the SSL associations.
7228 */
7229static void
7230ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
7231{
7232 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
7233 const int l = (const int)strlen(data->str);
7234 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
7235}
7236
7237/**
7238 * @return an information string on the SSL protocol associations. The string must be freed.
7239 */
7240char*
7241ssl_association_info(const char* dissector_table_name, const char* table_protocol)
7242{
7243 ssl_association_info_callback_data_t data;
7244
7245 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
7246 data.table_protocol = table_protocol;
7247 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
7248 return data.str;
7249}
7250
7251
7252/** Begin of code related to dissection of wire data. */
7253
7254/* Helpers for dissecting Variable-Length Vectors. {{{ */
7255bool_Bool
7256ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7257 unsigned offset, unsigned offset_end, uint32_t *ret_length,
7258 int hf_length, uint32_t min_value, uint32_t max_value)
7259{
7260 unsigned veclen_size;
7261 uint32_t veclen_value;
7262 proto_item *pi;
7263
7264 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 7264, (uint64_t)min_value, (uint64_t)max_value))))
;
7265 if (offset > offset_end) {
7266 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
7267 "Vector offset is past buffer end offset (%u > %u)",
7268 offset, offset_end);
7269 *ret_length = 0;
7270 return false0; /* Cannot read length. */
7271 }
7272
7273 if (max_value > 0xffffff) {
7274 veclen_size = 4;
7275 } else if (max_value > 0xffff) {
7276 veclen_size = 3;
7277 } else if (max_value > 0xff) {
7278 veclen_size = 2;
7279 } else {
7280 veclen_size = 1;
7281 }
7282
7283 if (offset_end - offset < veclen_size) {
7284 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7285 tvb, offset, offset_end - offset,
7286 "No more room for vector of length %u",
7287 veclen_size);
7288 *ret_length = 0;
7289 return false0; /* Cannot read length. */
7290 }
7291
7292 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
7293 offset += veclen_size;
7294
7295 if (veclen_value < min_value) {
7296 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7297 "Vector length %u is smaller than minimum %u",
7298 veclen_value, min_value);
7299 } else if (veclen_value > max_value) {
7300 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7301 "Vector length %u is larger than maximum %u",
7302 veclen_value, max_value);
7303 }
7304
7305 if (offset_end - offset < veclen_value) {
7306 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
7307 "Vector length %u is too large, truncating it to %u",
7308 veclen_value, offset_end - offset);
7309 *ret_length = offset_end - offset;
7310 return false0; /* Length is truncated to avoid overflow. */
7311 }
7312
7313 *ret_length = veclen_value;
7314 return true1; /* Length is OK. */
7315}
7316
7317bool_Bool
7318ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7319 unsigned offset, unsigned offset_end)
7320{
7321 if (offset < offset_end) {
7322 unsigned trailing = offset_end - offset;
7323 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7324 tvb, offset, trailing,
7325 "%u trailing byte%s unprocessed",
7326 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7327 return false0; /* unprocessed data warning */
7328 } else if (offset > offset_end) {
7329 /*
7330 * Returned offset runs past the end. This should not happen and is
7331 * possibly a dissector bug.
7332 */
7333 unsigned excess = offset - offset_end;
7334 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7335 tvb, offset_end, excess,
7336 "Dissector processed too much data (%u byte%s)",
7337 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7338 return false0; /* overflow error */
7339 }
7340
7341 return true1; /* OK, offset matches. */
7342}
7343/** }}} */
7344
7345
7346static uint32_t
7347ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7348 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7349 uint16_t version, int hf_sig_len, int hf_sig);
7350
7351/* change_cipher_spec(20) dissection */
7352void
7353ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7354 packet_info *pinfo, proto_tree *tree,
7355 uint32_t offset, SslSession *session,
7356 bool_Bool is_from_server,
7357 const SslDecryptSession *ssl)
7358{
7359 /*
7360 * struct {
7361 * enum { change_cipher_spec(1), (255) } type;
7362 * } ChangeCipherSpec;
7363 */
7364 proto_item *ti;
7365 proto_item_set_text(tree,
7366 "%s Record Layer: %s Protocol: Change Cipher Spec",
7367 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7368 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7369 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7370
7371 if (session->version == TLSV1DOT3_VERSION0x304) {
7372 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7373 return;
7374 }
7375
7376 /* Remember frame number of first CCS */
7377 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7378 if (*ccs_frame == 0)
7379 *ccs_frame = pinfo->num;
7380
7381 /* Use heuristics to detect an abbreviated handshake, assume that missing
7382 * ServerHelloDone implies reusing previously negotiating keys. Then when
7383 * a Session ID or ticket is present, it must be a resumed session.
7384 * Normally this should be done at the Finished message, but that may be
7385 * encrypted so we do it here, at the last cleartext message. */
7386 if (is_from_server && ssl) {
7387 if (session->is_session_resumed) {
7388 const char *resumed = NULL((void*)0);
7389 if (ssl->session_ticket.data_len) {
7390 resumed = "Session Ticket";
7391 } else if (ssl->session_id.data_len) {
7392 resumed = "Session ID";
7393 }
7394 if (resumed) {
7395 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7396 } else {
7397 /* Can happen if the capture somehow starts in the middle */
7398 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7399 }
7400 } else {
7401 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7402 }
7403 }
7404 if (is_from_server && session->is_session_resumed)
7405 expert_add_info(pinfo, ti, &hf->ei.resumed);
7406}
7407
7408/** Begin of handshake(22) record dissections */
7409
7410/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7411 * {{{ */
7412static void
7413tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7414{
7415 uint32_t sighash, hashalg, sigalg;
7416 proto_item *ti_sigalg;
7417 proto_tree *sigalg_tree;
7418
7419 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7420 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7421 if (ja4_data) {
7422 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7423 }
7424
7425 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7426
7427 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7428 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7429 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7430 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7431 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7432
7433 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7434 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7435 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7436 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7437 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7438 sighash);
7439 }
7440} /* }}} */
7441
7442/* dissect a list of hash algorithms, return the number of bytes dissected
7443 this is used for the signature algorithms extension and for the
7444 TLS1.2 certificate request. {{{ */
7445static int
7446ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7447 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7448{
7449 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7450 * struct {
7451 * HashAlgorithm hash;
7452 * SignatureAlgorithm signature;
7453 * } SignatureAndHashAlgorithm;
7454 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7455 */
7456 proto_tree *subtree;
7457 proto_item *ti;
7458 unsigned sh_alg_length;
7459 uint32_t next_offset;
7460
7461 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7462 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7463 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7464 return offset_end;
7465 }
7466 offset += 2;
7467 next_offset = offset + sh_alg_length;
7468
7469 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7470 "Signature Hash Algorithms (%u algorithm%s)",
7471 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7472 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7473
7474 while (offset + 2 <= next_offset) {
7475 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7476 offset += 2;
7477 }
7478
7479 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7480 offset = next_offset;
7481 }
7482
7483 return offset;
7484} /* }}} */
7485
7486/* Dissection of DistinguishedName (for CertificateRequest and
7487 * certificate_authorities extension). {{{ */
7488static uint32_t
7489tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7490 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7491{
7492 proto_item *ti;
7493 proto_tree *subtree;
7494 uint32_t dnames_length, next_offset;
7495 asn1_ctx_t asn1_ctx;
7496 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7497
7498 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7499 /* DistinguishedName certificate_authorities<0..2^16-1> */
7500 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7501 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7502 return offset_end;
7503 }
7504 offset += 2;
7505 next_offset = offset + dnames_length;
7506
7507 if (dnames_length > 0) {
7508 ti = proto_tree_add_none_format(tree,
7509 hf->hf.hs_dnames,
7510 tvb, offset, dnames_length,
7511 "Distinguished Names (%d byte%s)",
7512 dnames_length,
7513 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7514 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7515
7516 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7517
7518 while (offset < next_offset) {
7519 /* get the length of the current certificate */
7520 uint32_t name_length;
7521
7522 if (dnames_count-- == 0) {
7523 /* stop adding to tree when the list is considered too large
7524 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7525 Note: dnames_count must be set low enough not to hit the
7526 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7527 */
7528 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7529 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7530 proto_item_set_generated(ti);
7531 return next_offset;
7532 }
7533
7534 /* opaque DistinguishedName<1..2^16-1> */
7535 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7536 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7537 return next_offset;
7538 }
7539 offset += 2;
7540
7541 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7542 subtree, hf->hf.hs_dname);
7543 offset += name_length;
7544 }
7545 }
7546 return offset;
7547} /* }}} */
7548
7549
7550/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7551static int
7552ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7553 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7554{
7555 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7556}
7557
7558static int
7559ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7560 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7561{
7562 if (hnd_type == SSL_HND_CLIENT_HELLO) {
7563 /*
7564 * struct {
7565 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7566 * } SignatureSchemeList;
7567 */
7568
7569 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7570 } else {
7571 asn1_ctx_t asn1_ctx;
7572 unsigned pubkey_length, sign_length;
7573
7574 /*
7575 * struct {
7576 * uint32 valid_time;
7577 * SignatureScheme expected_cert_verify_algorithm;
7578 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7579 * } Credential;
7580 *
7581 * struct {
7582 * Credential cred;
7583 * SignatureScheme algorithm;
7584 * opaque signature<0..2^16-1>;
7585 * } DelegatedCredential;
7586 */
7587
7588 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7589
7590 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7591 offset += 4;
7592
7593 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7594 offset += 2;
7595
7596 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7597 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7598 return offset_end;
7599 }
7600 offset += 3;
7601 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7602 offset += pubkey_length;
7603
7604 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7605 offset += 2;
7606
7607 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7608 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7609 return offset_end;
7610 }
7611 offset += 2;
7612 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7613 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7614 offset += sign_length;
7615
7616 return offset;
7617 }
7618}
7619
7620static int
7621ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7622 packet_info *pinfo, proto_tree *tree,
7623 uint32_t offset, uint32_t offset_end,
7624 uint8_t hnd_type)
7625{
7626
7627 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7628
7629 switch (hnd_type) {
7630 case SSL_HND_CLIENT_HELLO: {
7631 proto_tree *alps_tree;
7632 proto_item *ti;
7633 uint32_t next_offset, alps_length, name_length;
7634
7635 /*
7636 * opaque ProtocolName<1..2^8-1>;
7637 * struct {
7638 * ProtocolName supported_protocols<2..2^16-1>
7639 * } ApplicationSettingsSupport;
7640 */
7641
7642 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7643 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7644 return offset_end;
7645 }
7646 offset += 2;
7647 next_offset = offset + alps_length;
7648
7649 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7650 tvb, offset, alps_length, ENC_NA0x00000000);
7651 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7652
7653 /* Parse list (note missing check for end of vector, ssl_add_vector below
7654 * ensures that data is always available.) */
7655 while (offset < next_offset) {
7656 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7657 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7658 return next_offset;
7659 }
7660 offset++;
7661
7662 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7663 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7664 offset += name_length;
7665 }
7666
7667 return offset;
7668 }
7669 case SSL_HND_ENCRYPTED_EXTS:
7670 /* Opaque blob */
7671 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7672 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7673 break;
7674 }
7675
7676 return offset_end;
7677}
7678
7679static int
7680ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7681 packet_info *pinfo, proto_tree *tree,
7682 uint32_t offset, uint32_t offset_end,
7683 uint8_t hnd_type, SslSession *session,
7684 bool_Bool is_dtls, ja4_data_t *ja4_data)
7685{
7686
7687 /* https://tools.ietf.org/html/rfc7301#section-3.1
7688 * opaque ProtocolName<1..2^8-1>;
7689 * struct {
7690 * ProtocolName protocol_name_list<2..2^16-1>
7691 * } ProtocolNameList;
7692 */
7693 proto_tree *alpn_tree;
7694 proto_item *ti;
7695 uint32_t next_offset, alpn_length, name_length;
7696 uint8_t *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7697
7698 /* ProtocolName protocol_name_list<2..2^16-1> */
7699 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7700 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7701 return offset_end;
7702 }
7703 offset += 2;
7704 next_offset = offset + alpn_length;
7705
7706 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7707 tvb, offset, alpn_length, ENC_NA0x00000000);
7708 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7709
7710 /* Parse list (note missing check for end of vector, ssl_add_vector below
7711 * ensures that data is always available.) */
7712 while (offset < next_offset) {
7713 /* opaque ProtocolName<1..2^8-1> */
7714 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7715 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7716 return next_offset;
7717 }
7718 offset++;
7719
7720 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7721 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7722 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7723 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7724 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7725 if ((g_ascii_isprint(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_PRINT
) != 0)
) && g_ascii_isprint(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_PRINT
) != 0)
) {
7726 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7727 }
7728 else {
7729 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7730 alpn_last_char & 0x0F);
7731 }
7732 }
7733 /* Remember first ALPN ProtocolName entry for server. */
7734 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7735 /* '\0'-terminated string for dissector table match and prefix
7736 * comparison purposes. */
7737 proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7738 name_length, ENC_ASCII0x00000000);
7739 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7740 client_proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7741 name_length, ENC_ASCII0x00000000);
7742 }
7743 offset += name_length;
7744 }
7745
7746 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7747 * exactly one "ProtocolName". */
7748 if (proto_name) {
7749 dissector_handle_t handle;
7750
7751 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7752
7753 if (is_dtls) {
7754 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7755 proto_name);
7756 } else {
7757 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7758 proto_name);
7759 if (handle == NULL((void*)0)) {
7760 /* Try prefix matching */
7761 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0]))
; i++) {
7762 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7763
7764 /* string_string is inappropriate as it compares strings
7765 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7766 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )
) {
7767 handle = find_dissector(alpn_proto->dissector_name);
7768 break;
7769 }
7770 }
7771 }
7772 }
7773 if (handle != NULL((void*)0)) {
7774 /* ProtocolName match, so set the App data dissector handle.
7775 * This may override protocols given via the UAT dialog, but
7776 * since the ALPN hint is precise, do it anyway. */
7777 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7778 (void *)session->app_handle,
7779 (void *)handle,
7780 dissector_handle_get_dissector_name(handle));
7781 session->app_handle = handle;
7782 }
7783 } else if (client_proto_name) {
7784 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7785 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7786 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7787 }
7788
7789 return offset;
7790}
7791
7792static int
7793ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7794 packet_info *pinfo, proto_tree *tree,
7795 uint32_t offset, uint32_t offset_end)
7796{
7797 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7798 * The "extension_data" field of a "next_protocol_negotiation" extension
7799 * in a "ServerHello" contains an optional list of protocols advertised
7800 * by the server. Protocols are named by opaque, non-empty byte strings
7801 * and the list of protocols is serialized as a concatenation of 8-bit,
7802 * length prefixed byte strings. Implementations MUST ensure that the
7803 * empty string is not included and that no byte strings are truncated.
7804 */
7805 uint32_t npn_length;
7806 proto_tree *npn_tree;
7807
7808 /* List is optional, do not add tree if there are no entries. */
7809 if (offset == offset_end) {
7810 return offset;
7811 }
7812
7813 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7814
7815 while (offset < offset_end) {
7816 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7817 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7818 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7819 return offset_end;
7820 }
7821 offset++;
7822
7823 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7824 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7825 offset += npn_length;
7826 }
7827
7828 return offset;
7829}
7830
7831static int
7832ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7833 packet_info *pinfo, proto_tree *tree,
7834 uint32_t offset, uint32_t offset_end)
7835{
7836 /* https://tools.ietf.org/html/rfc5746#section-3.2
7837 * struct {
7838 * opaque renegotiated_connection<0..255>;
7839 * } RenegotiationInfo;
7840 *
7841 */
7842 proto_tree *reneg_info_tree;
7843 uint32_t reneg_info_length;
7844
7845 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7846
7847 /* opaque renegotiated_connection<0..255> */
7848 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7849 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7850 return offset_end;
7851 }
7852 offset++;
7853
7854 if (reneg_info_length > 0) {
7855 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7856 offset += reneg_info_length;
7857 }
7858
7859 return offset;
7860}
7861
7862static int
7863ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7864 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7865 const char **group_name_out)
7866{
7867 /* RFC 8446 Section 4.2.8
7868 * struct {
7869 * NamedGroup group;
7870 * opaque key_exchange<1..2^16-1>;
7871 * } KeyShareEntry;
7872 */
7873 uint32_t key_exchange_length, group;
7874 proto_tree *ks_tree;
7875
7876 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7877
7878 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7879 offset += 2;
7880 const char *group_name = val_to_str(group, ssl_extension_curves, "Unknown (%u)");
7881 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7882 if (group_name_out) {
7883 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff)))
? group_name : NULL((void*)0);
7884 }
7885
7886 /* opaque key_exchange<1..2^16-1> */
7887 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7888 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7889 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7890 }
7891 offset += 2;
7892 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7893 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7894
7895 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7896 offset += key_exchange_length;
7897
7898 return offset;
7899}
7900
7901static int
7902ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7903 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7904 uint8_t hnd_type)
7905{
7906 proto_tree *key_share_tree;
7907 uint32_t next_offset;
7908 uint32_t client_shares_length;
7909 uint32_t group;
7910 const char *group_name = NULL((void*)0);
7911
7912 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7913 return offset;
7914 }
7915
7916 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7917
7918 switch(hnd_type){
7919 case SSL_HND_CLIENT_HELLO:
7920 /* KeyShareEntry client_shares<0..2^16-1> */
7921 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7922 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7923 return offset_end;
7924 }
7925 offset += 2;
7926 next_offset = offset + client_shares_length;
7927 const char *sep = " ";
7928 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7929 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7930 if (group_name) {
7931 proto_item_append_text(tree, "%s%s", sep, group_name);
7932 sep = ", ";
7933 }
7934 }
7935 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7936 return next_offset;
7937 }
7938 break;
7939 case SSL_HND_SERVER_HELLO:
7940 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7941 if (group_name) {
7942 proto_item_append_text(tree, " %s", group_name);
7943 }
7944 break;
7945 case SSL_HND_HELLO_RETRY_REQUEST:
7946 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7947 offset += 2;
7948 group_name = val_to_str(group, ssl_extension_curves, "Unknown (%u)");
7949 proto_item_append_text(tree, " %s", group_name);
7950 break;
7951 default: /* no default */
7952 break;
7953 }
7954
7955 return offset;
7956}
7957
7958static int
7959ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7960 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7961 uint8_t hnd_type)
7962{
7963 /* RFC 8446 Section 4.2.11
7964 * struct {
7965 * opaque identity<1..2^16-1>;
7966 * uint32 obfuscated_ticket_age;
7967 * } PskIdentity;
7968 * opaque PskBinderEntry<32..255>;
7969 * struct {
7970 * select (Handshake.msg_type) {
7971 * case client_hello:
7972 * PskIdentity identities<7..2^16-1>;
7973 * PskBinderEntry binders<33..2^16-1>;
7974 * case server_hello:
7975 * uint16 selected_identity;
7976 * };
7977 * } PreSharedKeyExtension;
7978 */
7979
7980 proto_tree *psk_tree;
7981
7982 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7983
7984 switch (hnd_type){
7985 case SSL_HND_CLIENT_HELLO: {
7986 uint32_t identities_length, identities_end, binders_length;
7987
7988 /* PskIdentity identities<7..2^16-1> */
7989 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7990 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7991 return offset_end;
7992 }
7993 offset += 2;
7994 identities_end = offset + identities_length;
7995
7996 while (offset < identities_end) {
7997 uint32_t identity_length;
7998 proto_tree *identity_tree;
7999
8000 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
8001
8002 /* opaque identity<1..2^16-1> */
8003 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
8004 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
8005 return identities_end;
8006 }
8007 offset += 2;
8008 proto_item_append_text(identity_tree, "length: %u)", identity_length);
8009
8010 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
8011 offset += identity_length;
8012
8013 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8014 offset += 4;
8015
8016 proto_item_set_len(identity_tree, 2 + identity_length + 4);
8017 }
8018 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
8019 offset = identities_end;
8020 }
8021
8022 /* PskBinderEntry binders<33..2^16-1> */
8023 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
8024 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
8025 return offset_end;
8026 }
8027 offset += 2;
8028
8029 proto_item *binders_item;
8030 proto_tree *binders_tree;
8031 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
8032 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
8033 uint32_t binders_end = offset + binders_length;
8034 while (offset < binders_end) {
8035 uint32_t binder_length;
8036 proto_item *binder_item;
8037 proto_tree *binder_tree;
8038
8039 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
8040 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
8041
8042 /* opaque PskBinderEntry<32..255>; */
8043 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
8044 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
8045 return binders_end;
8046 }
8047 offset += 1;
8048 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
8049
8050 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
8051 offset += binder_length;
8052
8053 proto_item_set_end(binder_item, tvb, offset);
8054 }
8055 }
8056 break;
8057 case SSL_HND_SERVER_HELLO: {
8058 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8059 offset += 2;
8060 }
8061 break;
8062 default:
8063 break;
8064 }
8065
8066 return offset;
8067}
8068
8069static uint32_t
8070ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
8071 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
8072 uint8_t hnd_type, SslDecryptSession *ssl)
8073{
8074 /* RFC 8446 Section 4.2.10
8075 * struct {} Empty;
8076 * struct {
8077 * select (Handshake.msg_type) {
8078 * case new_session_ticket: uint32 max_early_data_size;
8079 * case client_hello: Empty;
8080 * case encrypted_extensions: Empty;
8081 * };
8082 * } EarlyDataIndication;
8083 */
8084 switch (hnd_type) {
8085 case SSL_HND_CLIENT_HELLO:
8086 /* Remember that early_data will follow the handshake. */
8087 if (ssl) {
8088 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
8089 ssl->has_early_data = true1;
8090 }
8091 break;
8092 case SSL_HND_NEWSESSION_TICKET:
8093 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8094 offset += 4;
8095 break;
8096 default:
8097 break;
8098 }
8099 return offset;
8100}
8101
8102static uint16_t
8103tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
8104{
8105 if (draft_version) {
8106 *draft_version = 0;
8107 }
8108 if (!is_dtls) {
8109 uint8_t tls13_draft = extract_tls13_draft_version(version);
8110 if (tls13_draft != 0) {
8111 /* This is TLS 1.3 (a draft version). */
8112 if (draft_version) {
8113 *draft_version = tls13_draft;
8114 }
8115 version = TLSV1DOT3_VERSION0x304;
8116 }
8117 if (version == 0xfb17 || version == 0xfb1a) {
8118 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
8119 tls13_draft = (uint8_t)version;
8120 if (draft_version) {
8121 *draft_version = tls13_draft;
8122 }
8123 version = TLSV1DOT3_VERSION0x304;
8124 }
8125 }
8126
8127 switch (version) {
8128 case SSLV3_VERSION0x300:
8129 case TLSV1_VERSION0x301:
8130 case TLSV1DOT1_VERSION0x302:
8131 case TLSV1DOT2_VERSION0x303:
8132 case TLSV1DOT3_VERSION0x304:
8133 case TLCPV1_VERSION0x101:
8134 if (is_dtls)
8135 return SSL_VER_UNKNOWN0;
8136 break;
8137
8138 case DTLSV1DOT0_VERSION0xfeff:
8139 case DTLSV1DOT0_OPENSSL_VERSION0x100:
8140 case DTLSV1DOT2_VERSION0xfefd:
8141 case DTLSV1DOT3_VERSION0xfefc:
8142 if (!is_dtls)
8143 return SSL_VER_UNKNOWN0;
8144 break;
8145
8146 default: /* invalid version number */
8147 return SSL_VER_UNKNOWN0;
8148 }
8149
8150 return version;
8151}
8152
8153static int
8154ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8155 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8156 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
8157{
8158
8159 /* RFC 8446 Section 4.2.1
8160 * struct {
8161 * ProtocolVersion versions<2..254>; // ClientHello
8162 * } SupportedVersions;
8163 * Note that ServerHello and HelloRetryRequest are handled by the caller.
8164 */
8165 uint32_t versions_length, next_offset;
8166 /* ProtocolVersion versions<2..254> */
8167 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
8168 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
8169 return offset_end;
8170 }
8171 offset++;
8172 next_offset = offset + versions_length;
8173
8174 unsigned version;
8175 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
8176 uint8_t draft_version, max_draft_version = 0;
8177 const char *sep = " ";
8178 while (offset + 2 <= next_offset) {
8179 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
8180 offset += 2;
8181
8182 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8183 proto_item_append_text(tree, "%s%s", sep, val_to_str(version, ssl_versions, "Unknown (0x%04x)"));
8184 sep = ", ";
8185 }
8186
8187 current_version = tls_try_get_version(is_dtls, version, &draft_version);
8188 if (session->version == SSL_VER_UNKNOWN0) {
8189 if (lowest_version == SSL_VER_UNKNOWN0) {
8190 lowest_version = current_version;
8191 } else if (current_version != SSL_VER_UNKNOWN0) {
8192 if (!is_dtls) {
8193 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version))
;
8194 } else {
8195 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version))
;
8196 }
8197 }
8198 }
8199 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version))
;
8200 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8201 /* The DTLS version numbers get mapped to "00" for unknown per
8202 * JA4 spec, but if JA4 ever does support DTLS we'll probably
8203 * need to take the MIN instead of MAX here for DTLS.
8204 */
8205 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version))
;
8206 }
8207 }
8208 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
8209 col_set_str(pinfo->cinfo, COL_PROTOCOL,
8210 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
8211 }
8212 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
8213 offset = next_offset;
8214 }
8215
8216 /* XXX remove this when draft 19 support is dropped,
8217 * this is only required for early data decryption. */
8218 if (max_draft_version) {
8219 session->tls13_draft_version = max_draft_version;
8220 }
8221
8222 return offset;
8223}
8224
8225static int
8226ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8227 packet_info *pinfo, proto_tree *tree,
8228 uint32_t offset, uint32_t offset_end)
8229{
8230 /* RFC 8446 Section 4.2.2
8231 * struct {
8232 * opaque cookie<1..2^16-1>;
8233 * } Cookie;
8234 */
8235 uint32_t cookie_length;
8236 /* opaque cookie<1..2^16-1> */
8237 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
8238 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
8239 return offset_end;
8240 }
8241 offset += 2;
8242
8243 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
8244 offset += cookie_length;
8245
8246 return offset;
8247}
8248
8249static int
8250ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8251 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8252{
8253 /* RFC 8446 Section 4.2.9
8254 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
8255 *
8256 * struct {
8257 * PskKeyExchangeMode ke_modes<1..255>;
8258 * } PskKeyExchangeModes;
8259 */
8260 uint32_t ke_modes_length, next_offset;
8261
8262 /* PskKeyExchangeMode ke_modes<1..255> */
8263 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
8264 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
8265 return offset_end;
8266 }
8267 offset++;
8268 next_offset = offset + ke_modes_length;
8269
8270 while (offset < next_offset) {
8271 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
8272 offset++;
8273 }
8274
8275 return offset;
8276}
8277
8278static uint32_t
8279ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8280 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8281{
8282 /* RFC 8446 Section 4.2.4
8283 * opaque DistinguishedName<1..2^16-1>;
8284 * struct {
8285 * DistinguishedName authorities<3..2^16-1>;
8286 * } CertificateAuthoritiesExtension;
8287 */
8288 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
8289}
8290
8291static int
8292ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8293 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8294{
8295 /* RFC 8446 Section 4.2.5
8296 * struct {
8297 * opaque certificate_extension_oid<1..2^8-1>;
8298 * opaque certificate_extension_values<0..2^16-1>;
8299 * } OIDFilter;
8300 * struct {
8301 * OIDFilter filters<0..2^16-1>;
8302 * } OIDFilterExtension;
8303 */
8304 proto_tree *subtree;
8305 uint32_t filters_length, oid_length, values_length, value_offset;
8306 asn1_ctx_t asn1_ctx;
8307 const char *oid, *name;
8308
8309 /* OIDFilter filters<0..2^16-1> */
8310 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8311 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8312 return offset_end;
8313 }
8314 offset += 2;
8315 offset_end = offset + filters_length;
8316
8317 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8318
8319 while (offset < offset_end) {
8320 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8321 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8322
8323 /* opaque certificate_extension_oid<1..2^8-1> */
8324 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8325 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8326 return offset_end;
8327 }
8328 offset++;
8329 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8330 hf->hf.hs_ext_oid_filters_oid, &oid);
8331 offset += oid_length;
8332
8333 /* Append OID to tree label */
8334 name = oid_resolved_from_string(pinfo->pool, oid);
8335 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8336
8337 /* opaque certificate_extension_values<0..2^16-1> */
8338 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8339 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8340 return offset_end;
8341 }
8342 offset += 2;
8343 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8344 if (values_length > 0) {
8345 value_offset = offset;
8346 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8347 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8348 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8349 }
8350 offset += values_length;
8351 }
8352
8353 return offset;
8354}
8355
8356static int
8357ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8358 packet_info *pinfo, proto_tree *tree,
8359 uint32_t offset, uint32_t offset_end)
8360{
8361 /* https://tools.ietf.org/html/rfc6066#section-3
8362 *
8363 * struct {
8364 * NameType name_type;
8365 * select (name_type) {
8366 * case host_name: HostName;
8367 * } name;
8368 * } ServerName;
8369 *
8370 * enum {
8371 * host_name(0), (255)
8372 * } NameType;
8373 *
8374 * opaque HostName<1..2^16-1>;
8375 *
8376 * struct {
8377 * ServerName server_name_list<1..2^16-1>
8378 * } ServerNameList;
8379 */
8380 proto_tree *server_name_tree;
8381 uint32_t list_length, server_name_length, next_offset;
8382
8383 /* The server SHALL include "server_name" extension with empty data. */
8384 if (offset == offset_end) {
8385 return offset;
8386 }
8387
8388 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8389
8390 /* ServerName server_name_list<1..2^16-1> */
8391 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8392 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8393 return offset_end;
8394 }
8395 offset += 2;
8396 next_offset = offset + list_length;
8397
8398 while (offset < next_offset) {
8399 uint32_t name_type;
8400 const uint8_t *server_name = NULL((void*)0);
8401 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8402 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8403 offset++;
8404
8405 /* opaque HostName<1..2^16-1> */
8406 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8407 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8408 return next_offset;
8409 }
8410 offset += 2;
8411
8412 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8413 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8414 pinfo->pool, &server_name);
8415 offset += server_name_length;
8416 // Each type must only occur once, so we don't check for duplicates.
8417 if (name_type == 0) {
8418 proto_item_append_text(tree, " name=%s", server_name);
8419 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8420
8421 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8422 // Client Hello: Client (Src) -> Server (Dst)
8423 switch (pinfo->dst.type) {
8424 case AT_IPv4:
8425 if (pinfo->dst.len == sizeof(uint32_t)) {
8426 add_ipv4_name(*(uint32_t *)pinfo->dst.data, server_name, false0);
8427 }
8428 break;
8429 case AT_IPv6:
8430 if (pinfo->dst.len == sizeof(ws_in6_addr)) {
8431 add_ipv6_name(pinfo->dst.data, server_name, false0);
8432 }
8433 break;
8434 }
8435 }
8436 }
8437 }
8438 return offset;
8439}
8440
8441static int
8442ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8443 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8444{
8445 unsigned ext_len = offset_end - offset;
8446 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8447 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8448 /* Save the Session Ticket such that it can be used as identifier for
8449 * restoring a previous Master Secret (in ChangeCipherSpec) */
8450 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8451 ssl->session_ticket.data, ext_len);
8452 ssl->session_ticket.data_len = ext_len;
8453 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8454 }
8455 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8456 tvb, offset, ext_len, ENC_NA0x00000000);
8457 return offset + ext_len;
8458}
8459
8460static int
8461ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8462 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8463 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8464{
8465 uint8_t cert_list_length;
8466 uint8_t cert_type;
8467 proto_tree *cert_list_tree;
8468 proto_item *ti;
8469
8470 switch(hnd_type){
8471 case SSL_HND_CLIENT_HELLO:
8472 cert_list_length = tvb_get_uint8(tvb, offset);
8473 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8474 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8475 offset += 1;
8476 if (offset_end - offset != (uint32_t)cert_list_length)
8477 return offset;
8478
8479 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8480 cert_list_length, cert_list_length);
8481 proto_item_append_text(ti, " (%d)", cert_list_length);
8482
8483 /* make this a subtree */
8484 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8485
8486 /* loop over all point formats */
8487 while (cert_list_length > 0)
8488 {
8489 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8490 offset++;
8491 cert_list_length--;
8492 }
8493 break;
8494 case SSL_HND_SERVER_HELLO:
8495 case SSL_HND_ENCRYPTED_EXTENSIONS:
8496 case SSL_HND_CERTIFICATE:
8497 cert_type = tvb_get_uint8(tvb, offset);
8498 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8499 offset += 1;
8500 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8501 session->client_cert_type = cert_type;
8502 }
8503 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8504 session->server_cert_type = cert_type;
8505 }
8506 break;
8507 default: /* no default */
8508 break;
8509 }
8510
8511 return offset;
8512}
8513
8514static uint32_t
8515ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8516 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8517 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8518{
8519 uint32_t compress_certificate_algorithms_length, next_offset;
8520
8521 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8522 * enum {
8523 * zlib(1),
8524 * brotli(2),
8525 * (65535)
8526 * } CertificateCompressionAlgorithm;
8527 *
8528 * struct {
8529 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8530 * } CertificateCompressionAlgorithms;
8531 */
8532 switch (hnd_type) {
8533 case SSL_HND_CLIENT_HELLO:
8534 case SSL_HND_CERT_REQUEST:
8535 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8536 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8537 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8538 return offset_end;
8539 }
8540 offset += 1;
8541 next_offset = offset + compress_certificate_algorithms_length;
8542
8543 while (offset < next_offset) {
8544 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8545 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8546 offset += 2;
8547 }
8548 break;
8549 default:
8550 break;
8551 }
8552
8553 return offset;
8554}
8555
8556static uint32_t
8557ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8558 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8559 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8560{
8561 uint32_t key_parameters_length, next_offset;
8562 proto_item *p_ti;
8563 proto_tree *p_tree;
8564
8565 /* RFC 8472
8566 *
8567 * struct {
8568 * uint8 major;
8569 * uint8 minor;
8570 * } TB_ProtocolVersion;
8571 *
8572 * enum {
8573 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8574 * } TokenBindingKeyParameters;
8575 *
8576 * struct {
8577 * TB_ProtocolVersion token_binding_version;
8578 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8579 * } TokenBindingParameters;
8580 */
8581
8582 switch (hnd_type) {
8583 case SSL_HND_CLIENT_HELLO:
8584 case SSL_HND_SERVER_HELLO:
8585 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8586 offset += 1;
8587 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8588 offset += 1;
8589
8590 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8591 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8592 return offset_end;
8593 }
8594 offset += 1;
8595 next_offset = offset + key_parameters_length;
8596
8597 p_ti = proto_tree_add_none_format(tree,
8598 hf->hf.hs_ext_token_binding_key_parameters,
8599 tvb, offset, key_parameters_length,
8600 "Key parameters identifiers (%d identifier%s)",
8601 key_parameters_length,
8602 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8603 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8604
8605 while (offset < next_offset) {
8606 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8607 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8608 offset += 1;
8609 }
8610
8611 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8612 offset = next_offset;
8613 }
8614
8615 break;
8616 default:
8617 break;
8618 }
8619
8620 return offset;
8621}
8622
8623static uint32_t
8624ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8625 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8626 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8627{
8628 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8629 uint32_t next_offset;
8630
8631 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8632 *
8633 * Note: the following structures are not literally defined in the spec,
8634 * they instead use an ASCII diagram.
8635 *
8636 * struct {
8637 * uint16 id;
8638 * opaque value<0..2^16-1>;
8639 * } TransportParameter; // before draft -27
8640 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8641 *
8642 * struct {
8643 * opaque ipv4Address[4];
8644 * uint16 ipv4Port;
8645 * opaque ipv6Address[16];
8646 * uint16 ipv6Port;
8647 * opaque connectionId<0..18>;
8648 * opaque statelessResetToken[16];
8649 * } PreferredAddress;
8650 */
8651
8652 if (offset_end - offset >= 6 &&
8653 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8654 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8655 // Assume encoding of Transport Parameters draft -26 or older with at
8656 // least one transport parameter that has a valid length.
8657 use_varint_encoding = false0;
8658 }
8659
8660 if (use_varint_encoding) {
8661 next_offset = offset_end;
8662 } else {
8663 uint32_t quic_length;
8664 // Assume draft -26 or earlier.
8665 /* TransportParameter TransportParameters<0..2^16-1>; */
8666 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8667 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8668 return offset_end;
8669 }
8670 offset += 2;
8671 next_offset = offset + quic_length;
8672 }
8673
8674 while (offset < next_offset) {
8675 uint64_t parameter_type; /* 62-bit space */
8676 uint32_t parameter_length;
8677 proto_tree *parameter_tree;
8678 uint32_t parameter_end_offset;
8679 uint64_t value;
8680 uint32_t len = 0, i;
8681
8682 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8683 NULL((void*)0), "Parameter");
8684 /* TransportParameter ID and Length. */
8685 if (use_varint_encoding) {
8686 uint64_t parameter_length64;
8687 uint32_t type_len = 0;
8688
8689 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8690 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8691 offset += type_len;
8692
8693 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8694 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8695 parameter_length = (uint32_t)parameter_length64;
8696 offset += len;
8697
8698 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8699 } else {
8700 parameter_type = tvb_get_ntohs(tvb, offset);
8701 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8702 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8703 offset += 2;
8704
8705 /* opaque value<0..2^16-1> */
8706 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8707 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8708 return next_offset;
8709 }
8710 offset += 2;
8711
8712 proto_item_set_len(parameter_tree, 4 + parameter_length);
8713 }
8714
8715 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)
) {
8716 proto_item_append_text(parameter_tree, ": GREASE");
8717 } else {
8718 proto_item_append_text(parameter_tree, ": %s", val64_to_str(parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8719 }
8720
8721 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8722 parameter_end_offset = offset + parameter_length;
8723
8724 /* Omit the value field if the parameter's length is 0. */
8725 if (parameter_length != 0) {
8726 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8727 tvb, offset, parameter_length, ENC_NA0x00000000);
8728 }
8729
8730 switch (parameter_type) {
8731 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8732 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8733 tvb, offset, parameter_length, ENC_NA0x00000000);
8734 offset += parameter_length;
8735 break;
8736 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8737 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8738 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8739 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8740 offset += len;
8741 break;
8742 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8743 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8744 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8745 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8746 offset += 16;
8747 break;
8748 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8749 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8750 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8751 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8752 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8753 offset += len;
8754 break;
8755 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8756 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8757 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8758 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8759 offset += len;
8760 break;
8761 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8762 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8763 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8764 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8765 offset += len;
8766 break;
8767 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8768 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8769 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8770 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8771 offset += len;
8772 break;
8773 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8774 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8775 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8776 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8777 offset += len;
8778 break;
8779 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8780 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8781 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8782 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8783 offset += len;
8784 break;
8785 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8786 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8787 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8788 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8789 offset += len;
8790 break;
8791 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8792 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8793 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8794 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8795 offset += len;
8796 break;
8797 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8798 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8799 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8800 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8801 offset += len;
8802 break;
8803 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8804 /* No Payload */
8805 break;
8806 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8807 uint32_t connectionid_length;
8808 quic_cid_t cid;
8809
8810 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8811 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8812 offset += 4;
8813 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8814 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8815 offset += 2;
8816 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8817 tvb, offset, 16, ENC_NA0x00000000);
8818 offset += 16;
8819 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8820 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8821 offset += 2;
8822 /* XXX - Should we add these addresses and ports as addresses that the client
8823 * is allowed / expected to migrate the server address to? Right now we don't
8824 * enforce that (see RFC 9000 Section 9, which implies that while the client
8825 * can migrate to whatever address it wants, it can only migrate the server
8826 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8827 */
8828
8829 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8830 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8831 break;
8832 }
8833 offset += 1;
8834
8835 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8836 tvb, offset, connectionid_length, ENC_NA0x00000000);
8837 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8838 cid.len = connectionid_length;
8839 // RFC 9000 5.1.1 "If the preferred_address transport
8840 // parameter is sent, the sequence number of the supplied
8841 // connection ID is 1."
8842 cid.seq_num = 1;
8843 // Multipath draft-07 "Also, the Path Identifier for the
8844 // connection ID specified in the "preferred address"
8845 // transport parameter is 0."
8846 cid.path_id = 0;
8847 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8848 quic_add_connection(pinfo, &cid);
8849 }
8850 offset += connectionid_length;
8851
8852 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8853 tvb, offset, 16, ENC_NA0x00000000);
8854 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8855 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8856 }
8857 offset += 16;
8858 }
8859 break;
8860 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8861 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8862 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8863 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8864 offset += len;
8865 break;
8866 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8867 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8868 tvb, offset, parameter_length, ENC_NA0x00000000);
8869 offset += parameter_length;
8870 break;
8871 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8872 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8873 tvb, offset, parameter_length, ENC_NA0x00000000);
8874 offset += parameter_length;
8875 break;
8876 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8877 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8878 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8879 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8880 offset += len;
8881 break;
8882 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8883 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8884 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8885 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8886 offset += len;
8887 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8888 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8889 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8890 offset += len;
8891 break;
8892 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8893 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8894 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8895 if (len > 0) {
8896 quic_add_loss_bits(pinfo, value);
8897 }
8898 offset += 1;
8899 break;
8900 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8901 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8902 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8903 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8904 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8905 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8906 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8907 offset += len;
8908 break;
8909 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8910 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8911 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8912 offset += parameter_length;
8913 break;
8914 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8915 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8916 tvb, offset, parameter_length, ENC_NA0x00000000);
8917 offset += parameter_length;
8918 break;
8919 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8920 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8921 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8922 offset += 4;
8923 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8924 uint32_t versions_length;
8925
8926 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8927 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8928 offset += 1;
8929 for (i = 0; i < versions_length / 4; i++) {
8930 quic_proto_tree_add_version(tvb, parameter_tree,
8931 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8932 offset += 4;
8933 }
8934 }
8935 break;
8936 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8937 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8938 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8939 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8940 offset += len;
8941 break;
8942 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8943 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8944 tvb, offset, parameter_length, ENC_NA0x00000000);
8945 offset += parameter_length;
8946 break;
8947 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8948 /* This field was used for non-standard Google-specific parameters encoded as a
8949 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8950 * parameters. Report it as a bytes blob... */
8951 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8952 tvb, offset, parameter_length, ENC_NA0x00000000);
8953 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8954 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8955 tvb, offset, 4, ENC_NA0x00000000);
8956 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8957 offset += parameter_length;
8958 break;
8959 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8960 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8961 tvb, offset, parameter_length, ENC_NA0x00000000);
8962 offset += parameter_length;
8963 break;
8964 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8965 /* No Payload */
8966 break;
8967 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8968 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8969 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8970 offset += parameter_length;
8971 break;
8972 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8973 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8974 quic_proto_tree_add_version(tvb, parameter_tree,
8975 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8976 offset += 4;
8977 for (i = 4; i < parameter_length; i += 4) {
8978 quic_proto_tree_add_version(tvb, parameter_tree,
8979 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8980 offset += 4;
8981 }
8982 break;
8983 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8984 /* No Payload */
8985 quic_add_grease_quic_bit(pinfo);
8986 break;
8987 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8988 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8989 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8990 offset += parameter_length;
8991 break;
8992 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8993 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8994 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8995 if (value == 1) {
8996 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8997 }
8998 offset += parameter_length;
8999 break;
9000 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
9001 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
9002 /* No Payload */
9003 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
9004 break;
9005 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
9006 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
9007 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9008 if (value > 1) {
9009 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9010 }
9011 /* multipath draft-07: "The value of the initial_max_paths
9012 * parameter MUST be at least 2." TODO: Expert Info? */
9013 offset += parameter_length;
9014 break;
9015 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
9016 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
9017 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
9018 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d:
9019 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
9020 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9021 /* multipath draft-09 and later: "If an endpoint receives an
9022 * initial_max_path_id transport parameter with value 0, the
9023 * peer aims to enable the multipath extension without allowing
9024 * extra paths immediately."
9025 */
9026 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9027 offset += parameter_length;
9028 break;
9029 default:
9030 offset += parameter_length;
9031 /*TODO display expert info about unknown ? */
9032 break;
9033 }
9034
9035 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
9036 /* Dissection did not end at expected location, fix it. */
9037 offset = parameter_end_offset;
9038 }
9039 }
9040
9041 return offset;
9042}
9043
9044static int
9045ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9046 proto_tree *tree, uint32_t offset,
9047 SslSession *session, SslDecryptSession *ssl,
9048 bool_Bool from_server, bool_Bool is_hrr)
9049{
9050 uint8_t sessid_length;
9051 proto_item *ti;
9052 proto_tree *rnd_tree;
9053 proto_tree *ti_rnd;
9054 proto_tree *ech_confirm_tree;
9055 uint8_t draft_version = session->tls13_draft_version;
9056
9057 if (ssl) {
7
Assuming 'ssl' is non-null, which participates in a condition later
8
Taking true branch
9058 StringInfo *rnd;
9059 if (from_server
8.1
'from_server' is true
)
9
Taking true branch
9060 rnd = &ssl->server_random;
9061 else
9062 rnd = &ssl->client_random;
9063
9064 /* save provided random for later keyring generation */
9065 tvb_memcpy(tvb, rnd->data, offset, 32);
9066 rnd->data_len = 32;
9067 if (from_server
9.1
'from_server' is true
)
10
Taking true branch
9068 ssl->state |= SSL_SERVER_RANDOM(1<<1);
9069 else
9070 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
9071 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
9072 from_server
10.1
'from_server' is true
? "SERVER" : "CLIENT", ssl->state);
11
'?' condition is true
9073 }
9074
9075 if (!from_server
11.1
'from_server' is true
&& session->client_random.data_len == 0) {
9076 session->client_random.data_len = 32;
9077 tvb_memcpy(tvb, session->client_random.data, offset, 32);
9078 }
9079
9080 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
9081
9082 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
12
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
13
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
14
Taking true branch
9083
9084 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9085 /* show the time */
9086 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
9087 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
9088 offset += 4;
9089
9090 /* show the random bytes */
9091 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
9092 tvb, offset, 28, ENC_NA0x00000000);
9093 offset += 28;
9094 } else {
9095 if (is_hrr) {
9096 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
9097 } else if (from_server && session->ech) {
9098 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9099 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
9100 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
9101 session->ech_confirmation, 8);
9102 proto_item_set_generated(ti);
9103 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
9104 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9105 } else {
9106 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9107 }
9108 }
9109
9110 offset += 32;
9111 }
9112
9113 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
9114 if (from_server
14.1
'from_server' is not equal to 0
== 0 || !(session->version
14.2
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
15
Taking true branch
9115 /* show the session id (length followed by actual Session ID) */
9116 sessid_length = tvb_get_uint8(tvb, offset);
9117 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
9118 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9119 offset++;
9120
9121 if (ssl
15.1
'ssl' is non-null, which participates in a condition later
) {
9122 /* save the authoritative SID for later use in ChangeCipherSpec.
9123 * (D)TLS restricts the SID to 32 chars, it does not make sense to
9124 * save more, so ignore larger ones. */
9125 if (from_server
15.2
'from_server' is true
&& sessid_length <= 32) {
16
Assuming 'sessid_length' is > 32
17
Taking false branch
9126 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
9127 ssl->session_id.data_len = sessid_length;
9128 }
9129 }
9130 if (sessid_length
17.1
'sessid_length' is > 0
> 0) {
18
Taking true branch
9131 proto_tree_add_item(tree, hf->hf.hs_session_id,
9132 tvb, offset, sessid_length, ENC_NA0x00000000);
9133 offset += sessid_length;
9134 }
9135 }
9136
9137 return offset;
9138}
9139
9140static int
9141ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9142 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9143 bool_Bool has_length)
9144{
9145 /* TLS 1.2/1.3 status_request Client Hello Extension.
9146 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
9147 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
9148 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
9149 * struct {
9150 * CertificateStatusType status_type;
9151 * uint16 request_length; // for status_request_v2
9152 * select (status_type) {
9153 * case ocsp: OCSPStatusRequest;
9154 * case ocsp_multi: OCSPStatusRequest;
9155 * } request;
9156 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
9157 *
9158 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
9159 * struct {
9160 * ResponderID responder_id_list<0..2^16-1>;
9161 * Extensions request_extensions;
9162 * } OCSPStatusRequest;
9163 * opaque ResponderID<1..2^16-1>;
9164 * opaque Extensions<0..2^16-1>;
9165 */
9166 unsigned cert_status_type;
9167
9168 cert_status_type = tvb_get_uint8(tvb, offset);
9169 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
9170 tvb, offset, 1, ENC_NA0x00000000);
9171 offset++;
9172
9173 if (has_length) {
9174 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
9175 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9176 offset += 2;
9177 }
9178
9179 switch (cert_status_type) {
9180 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9181 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9182 {
9183 uint32_t responder_id_list_len;
9184 uint32_t request_extensions_len;
9185
9186 /* ResponderID responder_id_list<0..2^16-1> */
9187 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
9188 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
9189 return offset_end;
9190 }
9191 offset += 2;
9192 if (responder_id_list_len != 0) {
9193 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9194 tvb, offset, responder_id_list_len,
9195 "Responder ID list is not implemented, contact Wireshark"
9196 " developers if you want this to be supported");
9197 }
9198 offset += responder_id_list_len;
9199
9200 /* opaque Extensions<0..2^16-1> */
9201 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
9202 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
9203 return offset_end;
9204 }
9205 offset += 2;
9206 if (request_extensions_len != 0) {
9207 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9208 tvb, offset, request_extensions_len,
9209 "Request Extensions are not implemented, contact"
9210 " Wireshark developers if you want this to be supported");
9211 }
9212 offset += request_extensions_len;
9213 break;
9214 }
9215 }
9216
9217 return offset;
9218}
9219
9220static unsigned
9221ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9222 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9223{
9224 /* https://tools.ietf.org/html/rfc6961#section-2.2
9225 * struct {
9226 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
9227 * } CertificateStatusRequestListV2;
9228 */
9229 uint32_t req_list_length, next_offset;
9230
9231 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
9232 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
9233 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
9234 return offset_end;
9235 }
9236 offset += 2;
9237 next_offset = offset + req_list_length;
9238
9239 while (offset < next_offset) {
9240 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
9241 }
9242
9243 return offset;
9244}
9245
9246static uint32_t
9247tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9248 uint32_t offset, uint32_t offset_end)
9249{
9250 uint32_t response_length;
9251 proto_item *ocsp_resp;
9252 proto_tree *ocsp_resp_tree;
9253 asn1_ctx_t asn1_ctx;
9254
9255 /* opaque OCSPResponse<1..2^24-1>; */
9256 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
9257 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9258 return offset_end;
9259 }
9260 offset += 3;
9261
9262 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
9263 response_length, ENC_BIG_ENDIAN0x00000000);
9264 proto_item_set_text(ocsp_resp, "OCSP Response");
9265 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
9266 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
9267 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9268 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
9269 }
9270 offset += response_length;
9271
9272 return offset;
9273}
9274
9275uint32_t
9276tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9277 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9278{
9279 /* TLS 1.2 "CertificateStatus" handshake message.
9280 * TLS 1.3 "status_request" Certificate extension.
9281 * struct {
9282 * CertificateStatusType status_type;
9283 * select (status_type) {
9284 * case ocsp: OCSPResponse;
9285 * case ocsp_multi: OCSPResponseList; // status_request_v2
9286 * } response;
9287 * } CertificateStatus;
9288 * opaque OCSPResponse<1..2^24-1>;
9289 * struct {
9290 * OCSPResponse ocsp_response_list<1..2^24-1>;
9291 * } OCSPResponseList; // status_request_v2
9292 */
9293 uint32_t status_type, resp_list_length, next_offset;
9294
9295 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9296 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9297 offset += 1;
9298
9299 switch (status_type) {
9300 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9301 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9302 break;
9303
9304 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9305 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9306 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9307 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9308 return offset_end;
9309 }
9310 offset += 3;
9311 next_offset = offset + resp_list_length;
9312
9313 while (offset < next_offset) {
9314 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9315 }
9316 break;
9317 }
9318
9319 return offset;
9320}
9321
9322static unsigned
9323ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9324 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9325 wmem_strbuf_t *ja3)
9326{
9327 /* RFC 8446 Section 4.2.7
9328 * enum { ..., (0xFFFF) } NamedGroup;
9329 * struct {
9330 * NamedGroup named_group_list<2..2^16-1>
9331 * } NamedGroupList;
9332 *
9333 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9334 * the extension itself from "elliptic_curves" to "supported_groups".
9335 */
9336 uint32_t groups_length, next_offset;
9337 proto_tree *groups_tree;
9338 proto_item *ti;
9339 char *ja3_dash = "";
9340
9341 /* NamedGroup named_group_list<2..2^16-1> */
9342 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9343 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9344 return offset_end;
9345 }
9346 offset += 2;
9347 next_offset = offset + groups_length;
9348
9349 ti = proto_tree_add_none_format(tree,
9350 hf->hf.hs_ext_supported_groups,
9351 tvb, offset, groups_length,
9352 "Supported Groups (%d group%s)",
9353 groups_length / 2,
9354 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9355
9356 /* make this a subtree */
9357 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9358
9359 if (ja3) {
9360 wmem_strbuf_append_c(ja3, ',');
9361 }
9362 /* loop over all groups */
9363 while (offset + 2 <= offset_end) {
9364 uint32_t ext_supported_group;
9365
9366 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9367 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9368 offset += 2;
9369 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))
) {
9370 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9371 ja3_dash = "-";
9372 }
9373 }
9374 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9375 offset = next_offset;
9376 }
9377
9378 return offset;
9379}
9380
9381static int
9382ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9383 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9384{
9385 uint8_t ecpf_length;
9386 proto_tree *ecpf_tree;
9387 proto_item *ti;
9388
9389 ecpf_length = tvb_get_uint8(tvb, offset);
9390 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9391 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9392
9393 offset += 1;
9394 ti = proto_tree_add_none_format(tree,
9395 hf->hf.hs_ext_ec_point_formats,
9396 tvb, offset, ecpf_length,
9397 "Elliptic curves point formats (%d)",
9398 ecpf_length);
9399
9400 /* make this a subtree */
9401 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9402
9403 if (ja3) {
9404 wmem_strbuf_append_c(ja3, ',');
9405 }
9406
9407 /* loop over all point formats */
9408 while (ecpf_length > 0)
9409 {
9410 uint32_t ext_ec_point_format;
9411
9412 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9413 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9414 offset++;
9415 ecpf_length--;
9416 if (ja3) {
9417 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9418 if (ecpf_length > 0) {
9419 wmem_strbuf_append_c(ja3, '-');
9420 }
9421 }
9422 }
9423
9424 return offset;
9425}
9426
9427static int
9428ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9429 packet_info *pinfo, proto_tree *tree,
9430 uint32_t offset, uint32_t next_offset)
9431{
9432 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9433 * opaque srp_I<1..2^8-1>;
9434 */
9435 uint32_t username_len;
9436
9437 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9438 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9439 return next_offset;
9440 }
9441 offset++;
9442
9443 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9444 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9445 offset += username_len;
9446
9447 return offset;
9448}
9449
9450static uint32_t
9451tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9452 uint32_t offset, uint32_t offset_end, uint16_t version)
9453{
9454 /* https://tools.ietf.org/html/rfc6962#section-3.2
9455 * enum { v1(0), (255) } Version;
9456 * struct {
9457 * opaque key_id[32];
9458 * } LogID;
9459 * opaque CtExtensions<0..2^16-1>;
9460 * struct {
9461 * Version sct_version;
9462 * LogID id;
9463 * uint64 timestamp;
9464 * CtExtensions extensions;
9465 * digitally-signed struct { ... };
9466 * } SignedCertificateTimestamp;
9467 */
9468 uint32_t sct_version;
9469 uint64_t sct_timestamp_ms;
9470 nstime_t sct_timestamp;
9471 uint32_t exts_len;
9472 const char *log_name;
9473
9474 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9475 offset++;
9476 if (sct_version != 0) {
9477 // TODO expert info about unknown SCT version?
9478 return offset;
9479 }
9480 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9481 log_name = bytesval_to_str(tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9482 proto_item_append_text(tree, " (%s)", log_name);
9483 offset += 32;
9484 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9485 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9486 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9487 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9488 offset += 8;
9489 /* opaque CtExtensions<0..2^16-1> */
9490 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9491 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9492 return offset_end;
9493 }
9494 offset += 2;
9495 if (exts_len > 0) {
9496 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9497 offset += exts_len;
9498 }
9499 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9500 hf->hf.sct_sct_signature_length,
9501 hf->hf.sct_sct_signature);
9502 return offset;
9503}
9504
9505uint32_t
9506tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9507 uint32_t offset, uint32_t offset_end, uint16_t version)
9508{
9509 /* https://tools.ietf.org/html/rfc6962#section-3.3
9510 * opaque SerializedSCT<1..2^16-1>;
9511 * struct {
9512 * SerializedSCT sct_list <1..2^16-1>;
9513 * } SignedCertificateTimestampList;
9514 */
9515 uint32_t list_length, sct_length, next_offset;
9516 proto_tree *subtree;
9517
9518 /* SerializedSCT sct_list <1..2^16-1> */
9519 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9520 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9521 return offset_end;
9522 }
9523 offset += 2;
9524
9525 while (offset < offset_end) {
9526 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9527
9528 /* opaque SerializedSCT<1..2^16-1> */
9529 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9530 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9531 return offset_end;
9532 }
9533 offset += 2;
9534 next_offset = offset + sct_length;
9535 proto_item_set_len(subtree, 2 + sct_length);
9536 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9537 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9538 offset = next_offset;
9539 }
9540 }
9541
9542 return offset;
9543}
9544
9545static int
9546dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9547 proto_tree *tree, uint32_t offset)
9548{
9549 uint32_t kdf_id, aead_id;
9550 proto_item *cs_ti;
9551 proto_tree *cs_tree;
9552
9553 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9554 tvb, offset, 4, ENC_NA0x00000000);
9555 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9556
9557 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9558 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9559 offset += 2;
9560 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9561 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9562 offset += 2;
9563
9564 proto_item_append_text(cs_ti, ": %s/%s",
9565 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9566 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9567 return offset;
9568}
9569
9570static int
9571dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9572 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9573 uint32_t *config_id)
9574{
9575 uint32_t length, cipher_suite_length;
9576 proto_item *kc_ti, *css_ti;
9577 proto_tree *kc_tree, *css_tree;
9578 uint32_t original_offset = offset, next_offset;
9579
9580 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9581 tvb, offset, -1, ENC_NA0x00000000);
9582 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9583
9584 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9585 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9586 offset += 1;
9587 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9588 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9589 offset += 2;
9590 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9591 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9592 offset += 2;
9593 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9594 tvb, offset, length, ENC_NA0x00000000);
9595 offset += length;
9596
9597 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9598 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9599 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9600 return offset_end;
9601 }
9602 offset += 2;
9603 next_offset = offset + cipher_suite_length;
9604
9605 css_ti = proto_tree_add_none_format(kc_tree,
9606 hf->hf.ech_hpke_keyconfig_cipher_suites,
9607 tvb, offset, cipher_suite_length,
9608 "Cipher Suites (%d suite%s)",
9609 cipher_suite_length / 4,
9610 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9611 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9612
9613
9614 while (offset + 4 <= next_offset) {
9615 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9616 }
9617
9618 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9619 offset = next_offset;
9620 }
9621
9622 proto_item_set_len(kc_ti, offset - original_offset);
9623
9624 return offset;
9625}
9626
9627static int
9628dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9629 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9630 const uint8_t **public_name, uint32_t *config_id)
9631{
9632 uint32_t public_name_length, extensions_length, next_offset;
9633
9634 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9635 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9636 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9637 offset += 1;
9638 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9639 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9640 offset += 1;
9641 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9642 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9643 offset += public_name_length;
9644
9645 /* Extension extensions<0..2^16-1>; */
9646 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9647 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9648 return offset_end;
9649 }
9650 offset += 2;
9651 next_offset = offset + extensions_length;
9652
9653 if (extensions_length > 0) {
9654 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9655 tvb, offset, extensions_length, ENC_NA0x00000000);
9656 }
9657 offset += extensions_length;
9658
9659 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9660 offset = next_offset;
9661 }
9662
9663 return offset;
9664}
9665
9666static int
9667dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9668 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9669{
9670 uint32_t version, length;
9671 proto_item *ech_ti;
9672 proto_tree *ech_tree;
9673 const uint8_t *public_name = NULL((void*)0);
9674 uint32_t config_id = 0;
9675
9676 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9677 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9678
9679 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9680 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9681 offset += 2;
9682 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9683 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9684 offset += 2;
9685
9686 proto_item_set_len(ech_ti, 4 + length);
9687
9688 switch(version) {
9689 case 0xfe0d:
9690 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9691 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9692 break;
9693
9694 default:
9695 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9696 }
9697
9698 return 4 + length;
9699}
9700
9701uint32_t
9702ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9703 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9704{
9705 uint32_t echconfiglist_length, next_offset;
9706
9707 /* ECHConfig ECHConfigList<1..2^16-1>; */
9708 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9709 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9710 return offset_end;
9711 }
9712 offset += 2;
9713 next_offset = offset + echconfiglist_length;
9714
9715 while (offset < next_offset) {
9716 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9717 }
9718
9719 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9720 offset = next_offset;
9721 }
9722
9723 return offset;
9724}
9725
9726static uint32_t
9727ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9728 uint32_t offset, uint32_t offset_end)
9729{
9730 uint32_t ext_length, next_offset;
9731 proto_tree *ext_tree;
9732 proto_item *ti;
9733
9734 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9735 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9736 return offset_end;
9737 }
9738 offset += 1;
9739 next_offset = offset + ext_length;
9740
9741 ti = proto_tree_add_none_format(tree,
9742 hf->hf.hs_ext_ech_outer_ext,
9743 tvb, offset, ext_length,
9744 "Outer Extensions (%d extension%s)",
9745 ext_length / 2,
9746 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9747
9748 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9749
9750 while (offset + 2 <= offset_end) {
9751 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9752 offset += 2;
9753 }
9754
9755 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9756 offset = next_offset;
9757 }
9758
9759 return offset;
9760}
9761
9762static uint32_t
9763// NOLINTNEXTLINE(misc-no-recursion)
9764ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9765 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9766 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
9767 uint32_t initial_offset, uint32_t hello_length)
9768{
9769 uint32_t ch_type, length;
9770 proto_item *ti, *payload_ti;
9771 proto_tree *retry_tree, *payload_tree;
9772
9773 switch (hnd_type) {
9774 case SSL_HND_CLIENT_HELLO:
9775 /*
9776 * enum { outer(0), inner(1) } ECHClientHelloType;
9777 *
9778 * struct {
9779 * ECHClientHelloType type;
9780 * select (ECHClientHello.type) {
9781 * case outer:
9782 * HpkeSymmetricCipherSuite cipher_suite;
9783 * uint8 config_id;
9784 * opaque enc<0..2^16-1>;
9785 * opaque payload<1..2^16-1>;
9786 * case inner:
9787 * Empty;
9788 * };
9789 * } ECHClientHello;
9790 */
9791
9792 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9793 offset += 1;
9794 switch (ch_type) {
9795 case 0: /* outer */
9796 if (ssl && session->first_ch_ech_frame == 0) {
9797 session->first_ch_ech_frame = pinfo->num;
9798 }
9799 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9800 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9801 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9802
9803 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9804 uint8_t config_id = tvb_get_uint8(tvb, offset);
9805 offset += 1;
9806 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9807 offset += 2;
9808 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9809 offset += length;
9810 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9811 offset += 2;
9812 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9813 offset += length;
9814
9815 if (!mk_map) {
9816 break;
9817 }
9818 if (session->client_random.data_len == 0) {
9819 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9820 break;
9821 }
9822 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9823 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9824 if (!ech_secret || !ech_config) {
9825 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9826 G_STRFUNC((const char*) (__func__)));
9827 break;
9828 }
9829
9830 if (hpke_hkdf_len(kdf_id) == 0) {
9831 ssl_debug_printf("Unsupported KDF\n");
9832 break;
9833 }
9834
9835 if (hpke_aead_key_len(aead_id) == 0) {
9836 ssl_debug_printf("Unsupported AEAD\n");
9837 break;
9838 }
9839
9840 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9841
9842 uint16_t version = GUINT16_FROM_BE(*(uint16_t *)ech_config->data)(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)ech_config
->data) >> 8) | (guint16) ((guint16) (*(uint16_t *)ech_config
->data) << 8))))))
;
9843 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9844 ssl_debug_printf("Unexpected version in ECH Config\n");
9845 break;
9846 }
9847 uint32_t ech_config_offset = 2;
9848 if (GUINT16_FROM_BE(*(uint16_t *)(ech_config->data + ech_config_offset))(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)(ech_config
->data + ech_config_offset)) >> 8) | (guint16) ((guint16
) (*(uint16_t *)(ech_config->data + ech_config_offset)) <<
8))))))
!= ech_config->data_len - 4) {
9849 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9850 break;
9851 }
9852 ech_config_offset += 2;
9853 if (*(ech_config->data + ech_config_offset) != config_id) {
9854 ssl_debug_printf("ECH Config version mismatch\n");
9855 break;
9856 }
9857 ech_config_offset += 1;
9858 uint16_t kem_id_be = *(uint16_t *)(ech_config->data + ech_config_offset);
9859 uint16_t kem_id = GUINT16_FROM_BE(kem_id_be)(((((guint16) ( (guint16) ((guint16) (kem_id_be) >> 8) |
(guint16) ((guint16) (kem_id_be) << 8))))))
;
9860 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9861 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9862 GByteArray *info = g_byte_array_new();
9863 g_byte_array_append(info, "tls ech", 8);
9864 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9865 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9866 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9867 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9868 key, base_nonce)) {
9869 g_byte_array_free(info, TRUE(!(0)));
9870 break;
9871 }
9872 g_byte_array_free(info, TRUE(!(0)));
9873 gcry_cipher_hd_t cipher;
9874 if (hpke_setup_aead(&cipher, aead_id, key) ||
9875 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9876 gcry_cipher_close(cipher);
9877 break;
9878 }
9879 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9880 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9881 tvb_memcpy(tvb, ech_aad, initial_offset, hello_length);
9882 memset(ech_aad + offset - length - initial_offset, 0, length);
9883 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9884 gcry_cipher_close(cipher);
9885 wmem_free(NULL((void*)0), ech_aad);
9886 break;
9887 }
9888 wmem_free(NULL((void*)0), ech_aad);
9889 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, length - 16);
9890 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, length - 16, payload, length - 16)) {
9891 gcry_cipher_close(cipher);
9892 break;
9893 }
9894 unsigned char ech_auth_tag_calc[16];
9895 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, 16)) {
9896 gcry_cipher_close(cipher);
9897 break;
9898 }
9899 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9900 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, 16);
9901 gcry_cipher_close(cipher);
9902 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9903 payload + length - 16, 16)) {
9904 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9905 } else {
9906 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9907 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, length - 16, length - 16);
9908 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9909 if (ssl) {
9910 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9911 uint32_t len_offset = ssl->ech_transcript.data_len;
9912 if (ssl->ech_transcript.data_len > 0)
9913 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9914 ssl->ech_transcript.data_len + hello_length + 4);
9915 else
9916 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9917 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9918 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9919 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9920 ssl->ech_transcript.data_len += 38;
9921 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset + 34,
9922 tvb_get_uint8(tvb, initial_offset + 34) + 1);
9923 ssl->ech_transcript.data_len += tvb_get_uint8(tvb, initial_offset + 34) + 1;
9924 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9925 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9926 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9927 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9928 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9929 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9930 1 + tvb_get_uint8(ech_tvb, ech_offset));
9931 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9932 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9933 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9934 ssl->ech_transcript.data_len += 2;
9935 uint16_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9936 ech_offset += 2;
9937 while (extensions_end - ech_offset >= 4) {
9938 if (tvb_get_ntohs(ech_tvb, ech_offset) != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9939 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9940 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2));
9941 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
9942 ech_offset += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
9943 } else if (tvb_get_ntohs(ech_tvb, ech_offset + 2) > 0) {
9944 uint8_t outer_extensions_end = tvb_get_uint8(ech_tvb, ech_offset + 4) + ech_offset + 5;
9945 ech_offset += 5;
9946 uint16_t outer_offset = initial_offset + 35 + tvb_get_uint8(tvb, initial_offset + 34);
9947 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9948 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9949 while (outer_extensions_end - ech_offset >= 2) {
9950 while (hello_length - outer_offset >= 4) {
9951 if (tvb_get_ntohs(tvb, outer_offset) == tvb_get_ntohs(ech_tvb, ech_offset)) {
9952 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9953 4 + tvb_get_ntohs(tvb, outer_offset + 2));
9954 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9955 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9956 break;
9957 } else {
9958 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9959 }
9960 }
9961 ech_offset += 2;
9962 }
9963 }
9964 }
9965 uint16_t ech_extensions_len_be = GUINT16_TO_BE(ssl->ech_transcript.data_len - ech_extensions_len_offset - 2)((((guint16) ( (guint16) ((guint16) (ssl->ech_transcript.data_len
- ech_extensions_len_offset - 2) >> 8) | (guint16) ((guint16
) (ssl->ech_transcript.data_len - ech_extensions_len_offset
- 2) << 8)))))
;
9966 *(ssl->ech_transcript.data + ech_extensions_len_offset) = ech_extensions_len_be & 0xff;
9967 *(ssl->ech_transcript.data + ech_extensions_len_offset + 1) = (ech_extensions_len_be >> 8);
9968 *(ssl->ech_transcript.data + len_offset + 2) = ((ssl->ech_transcript.data_len - len_offset - 4) >> 8);
9969 *(ssl->ech_transcript.data + len_offset + 3) = (ssl->ech_transcript.data_len - len_offset - 4) & 0xff;
9970 }
9971 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, length - 16, session,
9972 ssl, NULL((void*)0), mk_map);
9973 if (ech_padding_begin < length - 16) {
9974 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, length - 16 - ech_padding_begin,
9975 ENC_NA0x00000000);
9976 }
9977 }
9978
9979 break;
9980 case 1: /* inner */
9981 break;
9982 }
9983 break;
9984
9985 case SSL_HND_ENCRYPTED_EXTENSIONS:
9986 /*
9987 * struct {
9988 * ECHConfigList retry_configs;
9989 * } ECHEncryptedExtensions;
9990 */
9991
9992 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9993 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9994 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9995 break;
9996
9997 case SSL_HND_HELLO_RETRY_REQUEST:
9998 /*
9999 * struct {
10000 * opaque confirmation[8];
10001 * } ECHHelloRetryRequest;
10002 */
10003
10004 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
10005 if (session->ech) {
10006 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
10007 proto_item_set_generated(ti);
10008 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
10009 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10010 } else {
10011 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10012 }
10013 }
10014 offset += 8;
10015 break;
10016 }
10017
10018 return offset;
10019}
10020
10021static uint32_t
10022ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10023 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10024 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
10025{
10026 uint32_t record_digest_length, encrypted_sni_length;
10027
10028 switch (hnd_type) {
10029 case SSL_HND_CLIENT_HELLO:
10030 /*
10031 * struct {
10032 * CipherSuite suite;
10033 * KeyShareEntry key_share;
10034 * opaque record_digest<0..2^16-1>;
10035 * opaque encrypted_sni<0..2^16-1>;
10036 * } ClientEncryptedSNI;
10037 */
10038 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10039 offset += 2;
10040 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
10041
10042 /* opaque record_digest<0..2^16-1> */
10043 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
10044 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
10045 return offset_end;
10046 }
10047 offset += 2;
10048 if (record_digest_length > 0) {
10049 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
10050 offset += record_digest_length;
10051 }
10052
10053 /* opaque encrypted_sni<0..2^16-1> */
10054 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
10055 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
10056 return offset_end;
10057 }
10058 offset += 2;
10059 if (encrypted_sni_length > 0) {
10060 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
10061 offset += encrypted_sni_length;
10062 }
10063 break;
10064
10065 case SSL_HND_ENCRYPTED_EXTENSIONS:
10066 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
10067 offset += 16;
10068 break;
10069 }
10070
10071 return offset;
10072}
10073/** TLS Extensions (in Client Hello and Server Hello). }}} */
10074
10075/* Connection ID dissection. {{{ */
10076static uint32_t
10077ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10078 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
10079 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
10080{
10081 /* keep track of the decrypt session only for the first pass */
10082 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
10083 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
10084 *session_cidl = cidl;
10085 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
10086 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
10087 if (ssl) {
10088 ssl_add_session_by_cid(ssl);
10089 }
10090 }
10091
10092 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
10093 tvb, offset, 1, ENC_NA0x00000000);
10094 offset++;
10095
10096 if (cidl > 0) {
10097 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
10098 tvb, offset, cidl, ENC_NA0x00000000);
10099 offset += cidl;
10100 }
10101
10102 return offset;
10103}
10104
10105static uint32_t
10106ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10107 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
10108 SslSession *session, SslDecryptSession *ssl)
10109{
10110 uint8_t cidl = tvb_get_uint8(tvb, offset);
10111
10112 switch (hnd_type) {
10113 case SSL_HND_CLIENT_HELLO:
10114 session->client_cid_len_present = true1;
10115 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10116 cidl, &session->client_cid, &session->client_cid_len);
10117 case SSL_HND_SERVER_HELLO:
10118 session->server_cid_len_present = true1;
10119 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10120 cidl, &session->server_cid, &session->server_cid_len);
10121 default:
10122 return offset;
10123 }
10124} /* }}} */
10125
10126/* Trusted CA dissection. {{{ */
10127static uint32_t
10128ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
10129 uint32_t offset, uint32_t offset_end)
10130{
10131 proto_item *ti;
10132 proto_tree *subtree;
10133 uint32_t keys_length, next_offset;
10134
10135 /*
10136 * struct {
10137 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
10138 * } TrustedAuthorities;
10139 *
10140 * struct {
10141 * IdentifierType identifier_type;
10142 * select (identifier_type) {
10143 * case pre_agreed: struct {};
10144 * case key_sha1_hash: SHA1Hash;
10145 * case x509_name: DistinguishedName;
10146 * case cert_sha1_hash: SHA1Hash;
10147 * } identifier;
10148 * } TrustedAuthority;
10149 *
10150 * enum {
10151 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10152 * cert_sha1_hash(3), (255)
10153 * } IdentifierType;
10154 *
10155 * opaque DistinguishedName<1..2^16-1>;
10156 *
10157 */
10158
10159
10160 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
10161 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
10162 0, UINT16_MAX(65535)))
10163 {
10164 return offset_end;
10165 }
10166 offset += 2;
10167 next_offset = offset + keys_length;
10168
10169 if (keys_length > 0)
10170 {
10171 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
10172 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
10173 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
10174
10175 while (offset < next_offset)
10176 {
10177 uint32_t identifier_type;
10178 proto_tree *trusted_key_tree;
10179 proto_item *trusted_key_item;
10180 asn1_ctx_t asn1_ctx;
10181 uint32_t key_len = 0;
10182
10183 identifier_type = tvb_get_uint8(tvb, offset);
10184
10185 // Use 0 as length for now as we'll only know the size when we decode the identifier
10186 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
10187 offset, 0, "Trusted CA Key");
10188 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
10189
10190 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
10191 offset, 1, identifier_type);
10192 offset++;
10193
10194 /*
10195 * enum {
10196 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10197 * cert_sha1_hash(3), (255)
10198 * } IdentifierType;
10199 */
10200 switch (identifier_type)
10201 {
10202 case 0:
10203 key_len = 0;
10204 break;
10205 case 2:
10206 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10207
10208 uint32_t name_length;
10209 /* opaque DistinguishedName<1..2^16-1> */
10210 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
10211 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
10212 return next_offset;
10213 }
10214 offset += 2;
10215
10216 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
10217 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
10218 offset += name_length;
10219 break;
10220 case 1:
10221 case 3:
10222 key_len = 20;
10223 /* opaque SHA1Hash[20]; */
10224 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
10225 offset, 20, ENC_NA0x00000000);
10226 break;
10227
10228 default:
10229 key_len = 0;
10230 /*TODO display expert info about unknown ? */
10231 break;
10232 }
10233 proto_item_set_len(trusted_key_item, 1 + key_len);
10234 offset += key_len;
10235 }
10236 }
10237
10238 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10239 {
10240 offset = next_offset;
10241 }
10242
10243 return offset;
10244} /* }}} */
10245
10246
10247/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10248bool_Bool
10249ssl_is_valid_content_type(uint8_t type)
10250{
10251 switch ((ContentType) type) {
10252 case SSL_ID_CHG_CIPHER_SPEC:
10253 case SSL_ID_ALERT:
10254 case SSL_ID_HANDSHAKE:
10255 case SSL_ID_APP_DATA:
10256 case SSL_ID_HEARTBEAT:
10257 case SSL_ID_TLS12_CID:
10258 case SSL_ID_DTLS13_ACK:
10259 return true1;
10260 }
10261 return false0;
10262}
10263
10264bool_Bool
10265ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10266{
10267 switch ((HandshakeType) hs_type) {
10268 case SSL_HND_HELLO_VERIFY_REQUEST:
10269 /* hello_verify_request is DTLS-only */
10270 return is_dtls;
10271
10272 case SSL_HND_HELLO_REQUEST:
10273 case SSL_HND_CLIENT_HELLO:
10274 case SSL_HND_SERVER_HELLO:
10275 case SSL_HND_NEWSESSION_TICKET:
10276 case SSL_HND_END_OF_EARLY_DATA:
10277 case SSL_HND_HELLO_RETRY_REQUEST:
10278 case SSL_HND_ENCRYPTED_EXTENSIONS:
10279 case SSL_HND_CERTIFICATE:
10280 case SSL_HND_SERVER_KEY_EXCHG:
10281 case SSL_HND_CERT_REQUEST:
10282 case SSL_HND_SVR_HELLO_DONE:
10283 case SSL_HND_CERT_VERIFY:
10284 case SSL_HND_CLIENT_KEY_EXCHG:
10285 case SSL_HND_FINISHED:
10286 case SSL_HND_CERT_URL:
10287 case SSL_HND_CERT_STATUS:
10288 case SSL_HND_SUPPLEMENTAL_DATA:
10289 case SSL_HND_KEY_UPDATE:
10290 case SSL_HND_COMPRESSED_CERTIFICATE:
10291 case SSL_HND_ENCRYPTED_EXTS:
10292 return true1;
10293 case SSL_HND_MESSAGE_HASH:
10294 return false0;
10295 }
10296 return false0;
10297}
10298
10299static bool_Bool
10300ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10301 bool_Bool is_dtls)
10302{
10303 /* Consider all valid Handshake messages (except for Client Hello) and
10304 * all other valid record types (other than Handshake) */
10305 return (content_type == SSL_ID_HANDSHAKE &&
10306 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10307 handshake_type != SSL_HND_CLIENT_HELLO) ||
10308 (content_type != SSL_ID_HANDSHAKE &&
10309 ssl_is_valid_content_type(content_type));
10310}
10311
10312/**
10313 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10314 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10315 * Returns true if the supported_versions extension was found, false if not.
10316 */
10317bool_Bool
10318tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10319 uint16_t *server_version, bool_Bool *is_hrr)
10320{
10321 /* SHA256("HelloRetryRequest") */
10322 static const uint8_t tls13_hrr_random_magic[] = {
10323 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10324 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10325 };
10326 uint8_t session_id_length;
10327
10328 *server_version = tvb_get_ntohs(tvb, offset);
10329
10330 /*
10331 * Try to look for supported_versions extension. Minimum length:
10332 * 2 + 32 + 1 = 35 (version, random, session id length)
10333 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10334 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10335 *
10336 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10337 * there's a separate expert info warning for that.
10338 */
10339 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10340 offset += 2;
10341 if (is_hrr) {
10342 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10343 }
10344 offset += 32;
10345 session_id_length = tvb_get_uint8(tvb, offset);
10346 offset++;
10347 if (offset_end - offset < session_id_length + 5u) {
10348 return false0;
10349 }
10350 offset += session_id_length + 5;
10351
10352 while (offset_end - offset >= 6) {
10353 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10354 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10355 if (offset_end - offset < 4u + ext_len) {
10356 break; /* not enough data for type, length and data */
10357 }
10358 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10359 if (ext_len == 2) {
10360 *server_version = tvb_get_ntohs(tvb, offset + 4);
10361 }
10362 return true1;
10363 }
10364 offset += 4 + ext_len;
10365 }
10366 } else {
10367 if (is_hrr) {
10368 *is_hrr = false0;
10369 }
10370 }
10371 return false0;
10372}
10373
10374/**
10375 * Scan a Client Hello handshake message to see if the supported_versions
10376 * extension is found, in which case the version field is legacy_version.
10377 */
10378static bool_Bool
10379tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10380{
10381 uint8_t session_id_length;
10382
10383 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10384
10385 /*
10386 * Try to look for supported_versions extension. Minimum length:
10387 * 2 + 32 + 1 = 35 (version, random, session id length)
10388 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10389 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10390 *
10391 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10392 * there's a separate expert info warning for that.
10393 */
10394 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10395 offset += 2;
10396 offset += 32;
10397 session_id_length = tvb_get_uint8(tvb, offset);
10398 offset++;
10399 if (offset_end - offset < session_id_length + 2u) {
10400 return false0;
10401 }
10402 offset += session_id_length;
10403 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10404 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10405 offset++;
10406 if (offset_end - offset < cookie_length + 2u) {
10407 return false0;
10408 }
10409 }
10410 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10411 offset += 2;
10412 if (offset_end - offset < cipher_suites_length + 1u) {
10413 return false0;
10414 }
10415 offset += cipher_suites_length;
10416 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10417 offset++;
10418 if (offset_end - offset < compression_methods_length + 2u) {
10419 return false0;
10420 }
10421 offset += compression_methods_length + 2;
10422
10423 while (offset_end - offset >= 6) {
10424 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10425 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10426 if (offset_end - offset < 4u + ext_len) {
10427 break; /* not enough data for type, length and data */
10428 }
10429 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10430 return true1;
10431 }
10432 offset += 4 + ext_len;
10433 }
10434 }
10435 return false0;
10436}
10437void
10438ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10439 uint8_t content_type, uint8_t handshake_type,
10440 bool_Bool is_dtls, uint16_t version)
10441{
10442 uint8_t tls13_draft = 0;
10443
10444 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10445 is_dtls))
10446 return;
10447
10448 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10449 if (version == SSL_VER_UNKNOWN0) {
10450 return;
10451 }
10452
10453 session->tls13_draft_version = tls13_draft;
10454 session->version = version;
10455 if (ssl) {
10456 ssl->state |= SSL_VERSION(1<<4);
10457 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10458 }
10459}
10460
10461void
10462ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10463 ContentType content_type,
10464 unsigned record_length, proto_item *length_pi,
10465 uint16_t version, tvbuff_t *decrypted_tvb)
10466{
10467 unsigned max_expansion;
10468 if (version == TLSV1DOT3_VERSION0x304) {
10469 /* TLS 1.3: Max length is 2^14 + 256 */
10470 max_expansion = 256;
10471 } else {
10472 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10473 max_expansion = 2048;
10474 }
10475 /*
10476 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10477 * and ChangeCipherSpec.
10478 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10479 * so assume it is permitted.
10480 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10481 * assume TLS 1.2 requirements.
10482 */
10483 if (record_length == 0 &&
10484 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10485 content_type == SSL_ID_ALERT ||
10486 content_type == SSL_ID_HANDSHAKE)) {
10487 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10488 "Zero-length %s fragments are not allowed",
10489 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10490 }
10491 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10492 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10493 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10494 }
10495 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10496 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10497 "TLSPlaintext length MUST NOT exceed 2^14");
10498 }
10499}
10500
10501static void
10502ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10503{
10504 /* store selected cipher suite for decryption */
10505 ssl->session.cipher = cipher;
10506
10507 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10508 if (!cs) {
10509 ssl->cipher_suite = NULL((void*)0);
10510 ssl->state &= ~SSL_CIPHER(1<<2);
10511 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10512 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10513 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10514 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10515 * to avoid a potential buffer overflow in ssl3_check_mac. */
10516 ssl->cipher_suite = NULL((void*)0);
10517 ssl->state &= ~SSL_CIPHER(1<<2);
10518 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10519 } else {
10520 /* Cipher found, save this for the delayed decoder init */
10521 ssl->cipher_suite = cs;
10522 ssl->state |= SSL_CIPHER(1<<2);
10523 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10524 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10525 ssl->state);
10526 }
10527}
10528/* }}} */
10529
10530
10531/* Client Hello and Server Hello dissections. {{{ */
10532static int
10533ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10534 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10535 SslSession *session, SslDecryptSession *ssl,
10536 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10537 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length);
10538int
10539// NOLINTNEXTLINE(misc-no-recursion)
10540ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10541 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10542 uint32_t offset_end, SslSession *session,
10543 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10544{
10545 /* struct {
10546 * ProtocolVersion client_version;
10547 * Random random;
10548 * SessionID session_id;
10549 * opaque cookie<0..32>; //new field for DTLS
10550 * CipherSuite cipher_suites<2..2^16-1>;
10551 * CompressionMethod compression_methods<1..2^8-1>;
10552 * Extension client_hello_extension_list<0..2^16-1>;
10553 * } ClientHello;
10554 */
10555 proto_item *ti;
10556 proto_tree *cs_tree;
10557 uint32_t client_version;
10558 uint32_t cipher_suite_length;
10559 uint32_t compression_methods_length;
10560 uint8_t compression_method;
10561 uint32_t next_offset;
10562 uint32_t initial_offset = offset;
10563 uint32_t hello_length = offset_end - initial_offset;
10564 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10565 char *ja3_hash;
10566 char *ja3_dash = "";
10567 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10568 ja4_data_t ja4_data;
10569 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10570 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10571 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10572 wmem_list_frame_t *curr_entry;
10573
10574 ja4_data.max_version = 0;
10575 ja4_data.server_name_present = false0;
10576 ja4_data.num_cipher_suites = 0;
10577 ja4_data.num_extensions = 0;
10578 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10579 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10580 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10581 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10582
10583 /* show the client version */
10584 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, tvb,
10585 offset, 2, ENC_BIG_ENDIAN0x00000000,
10586 &client_version);
10587 if (tls_scan_client_hello(tvb, offset, offset_end)) {
10588 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10589 }
10590 offset += 2;
10591 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10592
10593 /*
10594 * Is it version 1.3?
10595 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10596 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10597 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10598 * Hello".
10599 */
10600 if (dtls_hfs != NULL((void*)0)) {
10601 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10602 /* Don't do that. */
10603 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10604 }
10605 } else {
10606 if (client_version == TLSV1DOT3_VERSION0x304) {
10607 /* Don't do that. */
10608 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10609 }
10610 }
10611
10612 /* dissect fields that are present in both ClientHello and ServerHello */
10613 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, false0, false0);
10614
10615 /* fields specific for DTLS (cookie_len, cookie) */
10616 if (dtls_hfs != NULL((void*)0)) {
10617 uint32_t cookie_length;
10618 /* opaque cookie<0..32> (for DTLS only) */
10619 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
10620 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10621 return offset;
10622 }
10623 offset++;
10624 if (cookie_length > 0) {
10625 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10626 tvb, offset, cookie_length, ENC_NA0x00000000);
10627 offset += cookie_length;
10628 }
10629 }
10630
10631 /* CipherSuite cipher_suites<2..2^16-1> */
10632 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10633 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10634 return offset;
10635 }
10636 offset += 2;
10637 next_offset = offset + cipher_suite_length;
10638 ti = proto_tree_add_none_format(tree,
10639 hf->hf.hs_cipher_suites,
10640 tvb, offset, cipher_suite_length,
10641 "Cipher Suites (%d suite%s)",
10642 cipher_suite_length / 2,
10643 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10644 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10645 while (offset + 2 <= next_offset) {
10646 uint32_t cipher_suite;
10647
10648 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, tvb, offset, 2,
10649 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10650 offset += 2;
10651 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))
) {
10652 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10653 ja3_dash = "-";
10654 ja4_data.num_cipher_suites += 1;
10655 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10656 }
10657 }
10658 wmem_strbuf_append_c(ja3, ',');
10659 if (!ssl_end_vector(hf, tvb, pinfo, cs_tree, offset, next_offset)) {
10660 offset = next_offset;
10661 }
10662
10663 /* CompressionMethod compression_methods<1..2^8-1> */
10664 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10665 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10666 return offset;
10667 }
10668 offset++;
10669 next_offset = offset + compression_methods_length;
10670 ti = proto_tree_add_none_format(tree,
10671 hf->hf.hs_comp_methods,
10672 tvb, offset, compression_methods_length,
10673 "Compression Methods (%u method%s)",
10674 compression_methods_length,
10675 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10676 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10677 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10678 while (offset < next_offset) {
10679 compression_method = tvb_get_uint8(tvb, offset);
10680 /* TODO: make reserved/private comp meth. fields selectable */
10681 if (compression_method < 64)
10682 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10683 tvb, offset, 1, compression_method);
10684 else if (compression_method > 63 && compression_method < 193)
10685 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10686 compression_method, "Reserved - to be assigned by IANA (%u)",
10687 compression_method);
10688 else
10689 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10690 compression_method, "Private use range (%u)",
10691 compression_method);
10692 offset++;
10693 }
10694
10695 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10696 if (offset < offset_end) {
10697 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10698 offset_end, SSL_HND_CLIENT_HELLO,
10699 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map, initial_offset, hello_length);
10700 if (ja4_data.max_version > 0) {
10701 client_version = ja4_data.max_version;
10702 }
10703 } else {
10704 wmem_strbuf_append_printf(ja3, ",,");
10705 }
10706
10707 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10708 wmem_strbuf_append(ja4_a, "t");
10709 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10710 wmem_strbuf_append(ja4_a, "q");
10711 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10712 wmem_strbuf_append(ja4_a, "d");
10713 }
10714 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10715 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10716 if (ja4_data.num_cipher_suites > 99) {
10717 wmem_strbuf_append(ja4_a, "99");
10718 } else {
10719 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10720 }
10721 if (ja4_data.num_extensions > 99) {
10722 wmem_strbuf_append(ja4_a, "99");
10723 } else {
10724 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10725 }
10726 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10727 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10728 } else {
10729 wmem_strbuf_append(ja4_a, "00");
10730 }
10731
10732 curr_entry = wmem_list_head(ja4_data.cipher_list);
10733 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10734 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10735 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10736 wmem_strbuf_append(ja4_br, ",");
10737 }
10738 curr_entry = wmem_list_frame_next(curr_entry);
10739 }
10740
10741 curr_entry = wmem_list_head(ja4_data.extension_list);
10742 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10743 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10744 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10745 wmem_strbuf_append(ja4_cr, ",");
10746 }
10747 curr_entry = wmem_list_frame_next(curr_entry);
10748 }
10749
10750 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10751 wmem_strbuf_append(ja4_cr, "_");
10752 curr_entry = wmem_list_head(ja4_data.sighash_list);
10753 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10754 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10755 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10756 wmem_strbuf_append(ja4_cr, ",");
10757 }
10758 curr_entry = wmem_list_frame_next(curr_entry);
10759 }
10760 }
10761 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10762 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10763 } else {
10764 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10765 }
10766 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10767
10768 g_free(ja4_hash);
10769 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10770 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10771 } else {
10772 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10773 }
10774 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10775 g_free(ja4_hash);
10776
10777 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10778 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10779
10780 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, tvb, offset, 0, ja4);
10781 proto_item_set_generated(ti);
10782 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, tvb, offset, 0, ja4_r);
10783 proto_item_set_generated(ti);
10784
10785 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10786 wmem_strbuf_get_len(ja3));
10787 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10788 proto_item_set_generated(ti);
10789 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, tvb, offset, 0, ja3_hash);
10790 proto_item_set_generated(ti);
10791 g_free(ja3_hash);
10792 return offset;
10793}
10794
10795void
10796ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10797 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10798 SslSession *session, SslDecryptSession *ssl,
10799 bool_Bool is_dtls, bool_Bool is_hrr)
10800{
10801 /* struct {
10802 * ProtocolVersion server_version;
10803 * Random random;
10804 * SessionID session_id; // TLS 1.2 and before
10805 * CipherSuite cipher_suite;
10806 * CompressionMethod compression_method; // TLS 1.2 and before
10807 * Extension server_hello_extension_list<0..2^16-1>;
10808 * } ServerHello;
10809 */
10810 uint8_t draft_version = session->tls13_draft_version;
10811 proto_item *ti;
10812 uint32_t server_version;
10813 uint32_t cipher_suite;
10814 uint32_t initial_offset = offset;
10815 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10816 char *ja3_hash;
10817
10818 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10819 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10820
10821 /* Initially assume that the session is resumed. If this is not the case, a
10822 * ServerHelloDone will be observed before the ChangeCipherSpec message
10823 * which will reset this flag. */
10824 session->is_session_resumed = true1;
10825
10826 /* show the server version */
10827 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10828 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10829
10830 uint16_t supported_server_version;
10831 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
1
Taking false branch
10832 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10833 }
10834 /*
10835 * Is it version 1.3?
10836 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10837 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10838 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10839 * Hello".
10840 */
10841 if (is_dtls) {
2
Assuming 'is_dtls' is false
3
Taking false branch
10842 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10843 /* Don't do that. */
10844 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10845 }
10846 } else {
10847 if (server_version == TLSV1DOT3_VERSION0x304) {
4
Assuming 'server_version' is not equal to TLSV1DOT3_VERSION
5
Taking false branch
10848 /* Don't do that. */
10849 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10850 }
10851 }
10852
10853 offset += 2;
10854 wmem_strbuf_append_printf(ja3, "%i", server_version);
10855
10856 /* dissect fields that are present in both ClientHello and ServerHello */
10857 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
6
Calling 'ssl_dissect_hnd_hello_common'
19
Returning from 'ssl_dissect_hnd_hello_common'
10858
10859 if (ssl
19.1
'ssl' is non-null
) {
20
Taking true branch
10860 /* store selected cipher suite for decryption */
10861 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10862 }
10863
10864 /* now the server-selected cipher suite */
10865 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10866 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10867 offset += 2;
10868 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10869
10870 /* No compression with TLS 1.3 before draft -22 */
10871 if (!(session->version
20.1
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
21
Taking true branch
10872 if (ssl
21.1
'ssl' is non-null
) {
22
Taking true branch
10873 /* store selected compression method for decryption */
10874 ssl->session.compression = tvb_get_uint8(tvb, offset);
10875 }
10876 /* and the server-selected compression method */
10877 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10878 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10879 offset++;
10880 }
10881
10882 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10883 if (offset < offset_end) {
23
Assuming 'offset' is >= 'offset_end'
10884 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10885 offset_end,
10886 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10887 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0), 0, 0);
10888 }
10889
10890 if (ssl
23.1
'ssl' is non-null
&& ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
24
Assuming field 'data_len' is > 0
25
Assuming the condition is true
26
Assuming field 'data_len' is > 0
27
Taking true branch
10891 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10892 if (hash_algo) {
28
Assuming 'hash_algo' is not equal to 0
29
Taking true branch
10893 SSL_MDgcry_md_hd_t mc;
10894 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10895 unsigned char prk[DIGEST_MAX_SIZE48];
10896 unsigned char *ech_verify_out = NULL((void*)0);
10897 unsigned int len;
10898 ssl_md_init(&mc, hash_algo);
10899 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10900 if (is_hrr) {
30
Assuming 'is_hrr' is false
31
Taking false branch
10901 ssl_md_final(&mc, transcript_hash, &len);
10902 ssl_md_cleanup(&mc);
10903 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10904 ssl->ech_transcript.data_len = 4 + len;
10905 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10906 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10907 ssl->ech_transcript.data[1] = 0;
10908 ssl->ech_transcript.data[2] = 0;
10909 ssl->ech_transcript.data[3] = len;
10910 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10911 ssl_md_init(&mc, hash_algo);
10912 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10913 } else {
10914 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10915 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10916 }
10917 if (initial_offset > 4) {
32
Assuming 'initial_offset' is > 4
33
Taking true branch
10918 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10919 4 + offset_end - initial_offset);
10920 if (is_hrr
33.1
'is_hrr' is false
)
34
Taking false branch
10921 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10922 else
10923 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10924 } else {
10925 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10926 prefix[2] = ((offset - initial_offset) >> 8);
10927 prefix[3] = (offset - initial_offset) & 0xff;
10928 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10929 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
10930 offset_end - initial_offset);
10931 ssl_md_update(&mc, prefix, 4);
10932 if (is_hrr)
10933 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset, 34), 34);
10934 else
10935 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset, 26), 26);
10936 }
10937 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
10938 uint8_t zeros[8] = { 0 };
10939 uint32_t confirmation_offset = initial_offset + 26;
10940 if (is_hrr
34.1
'is_hrr' is false
) {
35
Taking false branch
10941 uint32_t hrr_offset = initial_offset + 34;
10942 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset,
10943 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
10944 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
10945 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 3), 3);
10946 hrr_offset += 3;
10947 uint16_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
10948 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 2), 2);
10949 hrr_offset += 2;
10950 while (extensions_end - hrr_offset >= 4) {
10951 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
10952 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
10953 confirmation_offset = hrr_offset + 4;
10954 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 4), 4);
10955 ssl_md_update(&mc, zeros, 8);
10956 hrr_offset += 12;
10957 } else {
10958 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
10959 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
10960 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
10961 }
10962 }
10963 } else {
10964 ssl_md_update(&mc, zeros, 8);
10965 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
10966 offset - initial_offset - 34);
10967 }
10968 ssl_md_final(&mc, transcript_hash, &len);
10969 ssl_md_cleanup(&mc);
10970 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10971 StringInfo prk_string = {prk, len};
10972 tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
37
Calling 'tls13_hkdf_expand_label_context'
43
Returning from 'tls13_hkdf_expand_label_context'
10973 is_hrr
35.1
'is_hrr' is false
? "hrr ech accept confirmation" : "ech accept confirmation",
36
'?' condition is false
10974 transcript_hash, len, 8, &ech_verify_out);
10975 memcpy(is_hrr
43.1
'is_hrr' is false
? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
44
'?' condition is false
45
Null pointer passed to 2nd parameter expecting 'nonnull'
10976 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10977 if (is_hrr) {
10978 ssl->session.hrr_ech_declined = true1;
10979 ssl->session.first_ch_ech_frame = 0;
10980 }
10981 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10982 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10983 }
10984 wmem_free(NULL((void*)0), ech_verify_out);
10985 ssl->session.ech = true1;
10986 }
10987 }
10988
10989 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10990 wmem_strbuf_get_len(ja3));
10991 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10992 proto_item_set_generated(ti);
10993 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10994 proto_item_set_generated(ti);
10995 g_free(ja3_hash);
10996}
10997/* Client Hello and Server Hello dissections. }}} */
10998
10999/* New Session Ticket dissection. {{{ */
11000void
11001ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11002 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11003 SslSession *session, SslDecryptSession *ssl,
11004 bool_Bool is_dtls, GHashTable *session_hash)
11005{
11006 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
11007 * struct {
11008 * uint32 ticket_lifetime_hint;
11009 * opaque ticket<0..2^16-1>;
11010 * } NewSessionTicket;
11011 *
11012 * RFC 8446 Section 4.6.1 (TLS 1.3):
11013 * struct {
11014 * uint32 ticket_lifetime;
11015 * uint32 ticket_age_add;
11016 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
11017 * opaque ticket<1..2^16-1>;
11018 * Extension extensions<0..2^16-2>;
11019 * } NewSessionTicket;
11020 */
11021 proto_tree *subtree;
11022 proto_item *subitem;
11023 uint32_t ticket_len;
11024 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
11025 unsigned char draft_version = session->tls13_draft_version;
11026 uint32_t lifetime_hint;
11027
11028 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11029 hf->ett.session_ticket, NULL((void*)0),
11030 "TLS Session Ticket");
11031
11032 /* ticket lifetime hint */
11033 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
11034 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
11035 offset += 4;
11036
11037 if (lifetime_hint >= 60) {
11038 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
11039 proto_item_append_text(subitem, " (%s)", time_str);
11040 }
11041
11042 if (is_tls13) {
11043
11044 /* for TLS 1.3: ticket_age_add */
11045 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
11046 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
11047 offset += 4;
11048
11049 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
11050 if (draft_version == 0 || draft_version >= 21) {
11051 uint32_t ticket_nonce_len;
11052
11053 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
11054 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
11055 return;
11056 }
11057 offset++;
11058
11059 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
11060 offset += ticket_nonce_len;
11061 }
11062
11063 }
11064
11065 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
11066 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
11067 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
11068 return;
11069 }
11070 offset += 2;
11071
11072 /* Content depends on implementation, so just show data! */
11073 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
11074 tvb, offset, ticket_len, ENC_NA0x00000000);
11075 /* save the session ticket to cache for ssl_finalize_decryption */
11076 if (ssl && !is_tls13) {
11077 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
11078 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
11079 ssl->session_ticket.data, ticket_len);
11080 ssl->session_ticket.data_len = ticket_len;
11081 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
11082 /* NewSessionTicket is received after the first (client)
11083 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
11084 * Since the second CCS has already the session key available it will
11085 * just return. To ensure that the session ticket is mapped to a
11086 * master key (from the first CCS), save the ticket here too. */
11087 ssl_save_master_key("Session Ticket", session_hash,
11088 &ssl->session_ticket, &ssl->master_secret);
11089 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
11090 }
11091 offset += ticket_len;
11092
11093 if (is_tls13) {
11094 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11095 offset_end, SSL_HND_NEWSESSION_TICKET,
11096 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11097 }
11098} /* }}} */
11099
11100void
11101ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11102 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11103 SslSession *session, SslDecryptSession *ssl,
11104 bool_Bool is_dtls)
11105{
11106 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
11107 * struct {
11108 * ProtocolVersion server_version;
11109 * CipherSuite cipher_suite; // not before draft -19
11110 * Extension extensions<2..2^16-1>;
11111 * } HelloRetryRequest;
11112 * Note: no longer used since draft -22
11113 */
11114 uint32_t version;
11115 uint8_t draft_version;
11116
11117 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11118 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
11119 draft_version = extract_tls13_draft_version(version);
11120 offset += 2;
11121
11122 if (draft_version == 0 || draft_version >= 19) {
11123 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
11124 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11125 offset += 2;
11126 }
11127
11128 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11129 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11130 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11131}
11132
11133void
11134ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11135 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11136 SslSession *session, SslDecryptSession *ssl,
11137 bool_Bool is_dtls)
11138{
11139 /* RFC 8446 Section 4.3.1
11140 * struct {
11141 * Extension extensions<0..2^16-1>;
11142 * } EncryptedExtensions;
11143 */
11144 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11145 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11146 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11147}
11148
11149/* Certificate and Certificate Request dissections. {{{ */
11150void
11151ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11152 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11153 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11154 bool_Bool is_from_server, bool_Bool is_dtls)
11155{
11156 /* opaque ASN.1Cert<1..2^24-1>;
11157 *
11158 * Before RFC 8446 (TLS <= 1.2):
11159 * struct {
11160 * select(certificate_type) {
11161 *
11162 * // certificate type defined in RFC 7250
11163 * case RawPublicKey:
11164 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11165 *
11166 * // X.509 certificate defined in RFC 5246
11167 * case X.509:
11168 * ASN.1Cert certificate_list<0..2^24-1>;
11169 * };
11170 * } Certificate;
11171 *
11172 * RFC 8446 (since draft -20):
11173 * struct {
11174 * select(certificate_type){
11175 * case RawPublicKey:
11176 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11177 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11178 *
11179 * case X.509:
11180 * opaque cert_data<1..2^24-1>;
11181 * }
11182 * Extension extensions<0..2^16-1>;
11183 * } CertificateEntry;
11184 * struct {
11185 * opaque certificate_request_context<0..2^8-1>;
11186 * CertificateEntry certificate_list<0..2^24-1>;
11187 * } Certificate;
11188 */
11189 enum { CERT_X509, CERT_RPK } cert_type;
11190 asn1_ctx_t asn1_ctx;
11191#if defined(HAVE_LIBGNUTLS1)
11192 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11193 unsigned certificate_index = 0;
11194#endif
11195 uint32_t next_offset, certificate_list_length, cert_length;
11196 proto_tree *subtree = tree;
11197
11198 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11199
11200 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11201 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11202 cert_type = CERT_RPK;
11203 } else {
11204 cert_type = CERT_X509;
11205 }
11206
11207#if defined(HAVE_LIBGNUTLS1)
11208 /* Ask the pkcs1 dissector to return the public key details */
11209 if (ssl)
11210 asn1_ctx.private_data = &subjectPublicKeyInfo;
11211#endif
11212
11213 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11214 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11215 uint32_t context_length;
11216 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11217 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11218 return;
11219 }
11220 offset++;
11221 if (context_length > 0) {
11222 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11223 tvb, offset, context_length, ENC_NA0x00000000);
11224 offset += context_length;
11225 }
11226 }
11227
11228 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11229 /* For RPK before TLS 1.3, the single RPK is stored directly without
11230 * another "certificate_list" field. */
11231 certificate_list_length = offset_end - offset;
11232 next_offset = offset_end;
11233 } else {
11234 /* CertificateEntry certificate_list<0..2^24-1> */
11235 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11236 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11237 return;
11238 }
11239 offset += 3; /* 24-bit length value */
11240 next_offset = offset + certificate_list_length;
11241 }
11242
11243 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11244 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11245 proto_item *ti;
11246
11247 ti = proto_tree_add_none_format(tree,
11248 hf->hf.hs_certificates,
11249 tvb, offset, certificate_list_length,
11250 "Certificates (%u bytes)",
11251 certificate_list_length);
11252
11253 /* make it a subtree */
11254 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11255 }
11256
11257 while (offset < next_offset) {
11258 switch (cert_type) {
11259 case CERT_RPK:
11260 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11261 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11262 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11263 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11264 return;
11265 }
11266 offset += 3;
11267
11268 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11269 offset += cert_length;
11270 break;
11271 case CERT_X509:
11272 /* opaque ASN1Cert<1..2^24-1> */
11273 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11274 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11275 return;
11276 }
11277 offset += 3;
11278
11279 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11280#if defined(HAVE_LIBGNUTLS1)
11281 if (is_from_server && ssl && certificate_index == 0) {
11282 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11283 /* Only attempt to get the RSA modulus for the first cert. */
11284 asn1_ctx.private_data = NULL((void*)0);
11285 }
11286#endif
11287 offset += cert_length;
11288 break;
11289 }
11290
11291 /* TLS 1.3: Extension extensions<0..2^16-1> */
11292 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11293 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11294 next_offset, SSL_HND_CERTIFICATE,
11295 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11296 }
11297
11298#if defined(HAVE_LIBGNUTLS1)
11299 certificate_index++;
11300#endif
11301 }
11302}
11303
11304void
11305ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11306 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11307 SslSession *session, bool_Bool is_dtls)
11308{
11309 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11310 * enum {
11311 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11312 * (255)
11313 * } ClientCertificateType;
11314 *
11315 * opaque DistinguishedName<1..2^16-1>;
11316 *
11317 * struct {
11318 * ClientCertificateType certificate_types<1..2^8-1>;
11319 * DistinguishedName certificate_authorities<3..2^16-1>;
11320 * } CertificateRequest;
11321 *
11322 *
11323 * As per TLSv1.2 (RFC 5246) the format has changed to:
11324 *
11325 * enum {
11326 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11327 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11328 * fortezza_dms_RESERVED(20), (255)
11329 * } ClientCertificateType;
11330 *
11331 * enum {
11332 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11333 * sha512(6), (255)
11334 * } HashAlgorithm;
11335 *
11336 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11337 * SignatureAlgorithm;
11338 *
11339 * struct {
11340 * HashAlgorithm hash;
11341 * SignatureAlgorithm signature;
11342 * } SignatureAndHashAlgorithm;
11343 *
11344 * SignatureAndHashAlgorithm
11345 * supported_signature_algorithms<2..2^16-2>;
11346 *
11347 * opaque DistinguishedName<1..2^16-1>;
11348 *
11349 * struct {
11350 * ClientCertificateType certificate_types<1..2^8-1>;
11351 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11352 * DistinguishedName certificate_authorities<0..2^16-1>;
11353 * } CertificateRequest;
11354 *
11355 * draft-ietf-tls-tls13-18:
11356 * struct {
11357 * opaque certificate_request_context<0..2^8-1>;
11358 * SignatureScheme
11359 * supported_signature_algorithms<2..2^16-2>;
11360 * DistinguishedName certificate_authorities<0..2^16-1>;
11361 * CertificateExtension certificate_extensions<0..2^16-1>;
11362 * } CertificateRequest;
11363 *
11364 * RFC 8446 (since draft-ietf-tls-tls13-19):
11365 *
11366 * struct {
11367 * opaque certificate_request_context<0..2^8-1>;
11368 * Extension extensions<2..2^16-1>;
11369 * } CertificateRequest;
11370 */
11371 proto_item *ti;
11372 proto_tree *subtree;
11373 uint32_t next_offset;
11374 asn1_ctx_t asn1_ctx;
11375 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11376 unsigned char draft_version = session->tls13_draft_version;
11377
11378 if (!tree)
11379 return;
11380
11381 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11382
11383 if (is_tls13) {
11384 uint32_t context_length;
11385 /* opaque certificate_request_context<0..2^8-1> */
11386 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11387 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11388 return;
11389 }
11390 offset++;
11391 if (context_length > 0) {
11392 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11393 tvb, offset, context_length, ENC_NA0x00000000);
11394 offset += context_length;
11395 }
11396 } else {
11397 uint32_t cert_types_count;
11398 /* ClientCertificateType certificate_types<1..2^8-1> */
11399 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11400 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11401 return;
11402 }
11403 offset++;
11404 next_offset = offset + cert_types_count;
11405
11406 ti = proto_tree_add_none_format(tree,
11407 hf->hf.hs_cert_types,
11408 tvb, offset, cert_types_count,
11409 "Certificate types (%u type%s)",
11410 cert_types_count,
11411 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11412 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11413
11414 while (offset < next_offset) {
11415 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11416 offset++;
11417 }
11418 }
11419
11420 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11421 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11422 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11423 }
11424
11425 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11426 /*
11427 * TLS 1.3 draft 19 and newer: Extensions.
11428 * SslDecryptSession pointer is NULL because Certificate Extensions
11429 * should not influence decryption state.
11430 */
11431 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11432 offset_end, SSL_HND_CERT_REQUEST,
11433 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11434 } else if (is_tls13 && draft_version <= 18) {
11435 /*
11436 * TLS 1.3 draft 18 and older: certificate_authorities and
11437 * certificate_extensions (a vector of OID mappings).
11438 */
11439 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11440 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11441 } else {
11442 /* for TLS 1.2 and older, the certificate_authorities field. */
11443 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11444 }
11445}
11446/* Certificate and Certificate Request dissections. }}} */
11447
11448void
11449ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11450 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11451{
11452 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11453 hf->hf.hs_client_cert_vrfy_sig_len,
11454 hf->hf.hs_client_cert_vrfy_sig);
11455}
11456
11457/* Finished dissection. {{{ */
11458void
11459ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11460 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11461 const SslSession *session, ssl_hfs_t *ssl_hfs)
11462{
11463 /* For SSLv3:
11464 * struct {
11465 * opaque md5_hash[16];
11466 * opaque sha_hash[20];
11467 * } Finished;
11468 *
11469 * For (D)TLS:
11470 * struct {
11471 * opaque verify_data[12];
11472 * } Finished;
11473 *
11474 * For TLS 1.3:
11475 * struct {
11476 * opaque verify_data[Hash.length];
11477 * }
11478 */
11479 if (!tree)
11480 return;
11481
11482 if (session->version == SSLV3_VERSION0x300) {
11483 if (ssl_hfs != NULL((void*)0)) {
11484 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11485 tvb, offset, 16, ENC_NA0x00000000);
11486 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11487 tvb, offset + 16, 20, ENC_NA0x00000000);
11488 }
11489 } else {
11490 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11491 proto_tree_add_item(tree, hf->hf.hs_finished,
11492 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11493 }
11494} /* }}} */
11495
11496/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11497void
11498ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11499{
11500 uint16_t url_hash_len;
11501
11502 /* enum {
11503 * individual_certs(0), pkipath(1), (255)
11504 * } CertChainType;
11505 *
11506 * struct {
11507 * CertChainType type;
11508 * URLAndHash url_and_hash_list<1..2^16-1>;
11509 * } CertificateURL;
11510 *
11511 * struct {
11512 * opaque url<1..2^16-1>;
11513 * unint8 padding;
11514 * opaque SHA1Hash[20];
11515 * } URLAndHash;
11516 */
11517
11518 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11519 tvb, offset, 1, ENC_NA0x00000000);
11520 offset++;
11521
11522 url_hash_len = tvb_get_ntohs(tvb, offset);
11523 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11524 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11525 offset += 2;
11526 while (url_hash_len-- > 0) {
11527 proto_item *urlhash_item;
11528 proto_tree *urlhash_tree;
11529 uint16_t url_len;
11530
11531 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11532 tvb, offset, -1, ENC_NA0x00000000);
11533 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11534
11535 url_len = tvb_get_ntohs(tvb, offset);
11536 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11537 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11538 offset += 2;
11539
11540 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11541 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11542 offset += url_len;
11543
11544 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11545 tvb, offset, 1, ENC_NA0x00000000);
11546 offset++;
11547 /* Note: RFC 6066 says that padding must be 0x01 */
11548
11549 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11550 tvb, offset, 20, ENC_NA0x00000000);
11551 offset += 20;
11552 }
11553} /* }}} */
11554
11555void
11556ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11557 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11558 SslSession *session, SslDecryptSession *ssl,
11559 bool_Bool is_from_server, bool_Bool is_dtls)
11560{
11561 uint32_t algorithm, uncompressed_length;
11562 uint32_t compressed_certificate_message_length;
11563 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11564 proto_item *ti;
11565 /*
11566 * enum {
11567 * zlib(1),
11568 * brotli(2),
11569 * zstd(3),
11570 * (65535)
11571 * } CertificateCompressionAlgorithm;
11572 *
11573 * struct {
11574 * CertificateCompressionAlgorithm algorithm;
11575 * uint24 uncompressed_length;
11576 * opaque compressed_certificate_message<1..2^24-1>;
11577 * } CompressedCertificate;
11578 */
11579
11580 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11581 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11582 offset += 2;
11583
11584 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11585 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11586 offset += 3;
11587
11588 /* opaque compressed_certificate_message<1..2^24-1>; */
11589 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11590 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11591 return;
11592 }
11593 offset += 3;
11594
11595 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11596 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11597
11598 /* Certificate decompression following algorithm */
11599 switch (algorithm) {
11600 case 1: /* zlib */
11601 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11602 break;
11603 case 2: /* brotli */
11604 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11605 break;
11606 case 3: /* zstd */
11607 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11608 break;
11609 }
11610
11611 if (uncompressed_tvb) {
11612 proto_tree *uncompressed_tree;
11613
11614 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11615 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11616 tvb, offset, offset_end - offset,
11617 "Invalid uncompressed length %u (expected %u)",
11618 tvb_captured_length(uncompressed_tvb),
11619 uncompressed_length);
11620 } else {
11621 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11622 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11623 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11624 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11625 }
11626 }
11627}
11628
11629/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11630static int
11631// NOLINTNEXTLINE(misc-no-recursion)
11632ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11633 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11634 SslSession *session, SslDecryptSession *ssl,
11635 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11636 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length)
11637{
11638 uint32_t exts_len;
11639 uint16_t ext_type;
11640 uint32_t ext_len;
11641 uint32_t next_offset;
11642 proto_item *ext_item;
11643 proto_tree *ext_tree;
11644 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11645 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11646 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11647 char *ja3_dash = "";
11648 unsigned supported_version;
11649
11650 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11651 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11652 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11653 return offset_end;
11654 }
11655 offset += 2;
11656 offset_end = offset + exts_len;
11657
11658 if (ja4_data) {
11659 ja4_data->num_extensions = 0;
11660 }
11661 while (offset_end - offset >= 4)
11662 {
11663 ext_type = tvb_get_ntohs(tvb, offset);
11664 ext_len = tvb_get_ntohs(tvb, offset + 2);
11665
11666 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11667 ja4_data->num_extensions += 1;
11668 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11669 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11670 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11671 }
11672 }
11673
11674 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11675 "Extension: %s (len=%u)", val_to_str(ext_type,
11676 tls_hello_extension_types,
11677 "Unknown type %u"), ext_len);
11678 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11679
11680 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11681 tvb, offset, 2, ext_type);
11682 offset += 2;
11683 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11684 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11685 ja3_dash = "-";
11686 }
11687
11688 /* opaque extension_data<0..2^16-1> */
11689 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11690 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11691 return offset_end;
11692 }
11693 offset += 2;
11694 next_offset = offset + ext_len;
11695
11696 switch (ext_type) {
11697 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11698 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11699 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11700 if (ja4_data) {
11701 ja4_data->server_name_present = true1;
11702 }
11703 }
11704 break;
11705 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11706 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11707 offset += 1;
11708 break;
11709 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11710 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11711 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11712 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11713 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11714 }
11715 break;
11716 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11717 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11718 offset, next_offset,
11719 hnd_type, ext_type,
11720 session);
11721 break;
11722 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11723 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11724 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11725 next_offset, ja3_sg);
11726 } else {
11727 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11728 next_offset, NULL((void*)0));
11729 }
11730 break;
11731 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11732 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11733 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11734 } else {
11735 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11736 }
11737 break;
11738 break;
11739 case SSL_HND_HELLO_EXT_SRP12:
11740 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11741 break;
11742 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11743 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11744 break;
11745 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11746 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11747 break;
11748 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11749 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11750 break;
11751 case SSL_HND_HELLO_EXT_USE_SRTP14:
11752 if (is_dtls) {
11753 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11754 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11755 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11756 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11757 }
11758 } else {
11759 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11760 }
11761 break;
11762 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11763 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11764 break;
11765 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11766 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map, initial_offset, hello_length);
11767 break;
11768 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11769 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11770 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11771 offset++;
11772 break;
11773 case SSL_HND_HELLO_EXT_ALPN16:
11774 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11775 break;
11776 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11777 if (hnd_type == SSL_HND_CLIENT_HELLO)
11778 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11779 break;
11780 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11781 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11782 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11783 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11784 break;
11785 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11786 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11787 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11788 offset, next_offset,
11789 hnd_type, ext_type,
11790 session);
11791 break;
11792 case SSL_HND_HELLO_EXT_PADDING21:
11793 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11794 offset += ext_len;
11795 break;
11796 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11797 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11798 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11799 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11800 }
11801 break;
11802 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11803 if (ssl) {
11804 switch (hnd_type) {
11805 case SSL_HND_CLIENT_HELLO:
11806 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11807 break;
11808 case SSL_HND_SERVER_HELLO:
11809 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11810 break;
11811 default: /* no default */
11812 break;
11813 }
11814 }
11815 break;
11816 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11817 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11818 break;
11819 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11820 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11821 break;
11822 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11823 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11824 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11825 offset += 2;
11826 break;
11827 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11828 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11829 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11830 break;
11831 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11832 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11833 break;
11834 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11835 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11836 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11837 break;
11838 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11839 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11840 break;
11841 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11842 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11843 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11844 break;
11845 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11846 switch (hnd_type) {
11847 case SSL_HND_CLIENT_HELLO:
11848 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11849 break;
11850 case SSL_HND_SERVER_HELLO:
11851 case SSL_HND_HELLO_RETRY_REQUEST:
11852 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11853 offset += 2;
11854 proto_item_append_text(ext_tree, " %s", val_to_str(supported_version, ssl_versions, "Unknown (0x%04x)"));
11855 break;
11856 }
11857 break;
11858 case SSL_HND_HELLO_EXT_COOKIE44:
11859 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11860 break;
11861 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11862 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11863 break;
11864 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11865 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11866 break;
11867 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11868 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11869 break;
11870 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11871 break;
11872 case SSL_HND_HELLO_EXT_NPN13172:
11873 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11874 break;
11875 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11876 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11877 break;
11878 case SSL_HND_HELLO_EXT_ALPS17613:
11879 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11880 break;
11881 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11882 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11883 break;
11884 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11885 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11886 break;
11887 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11888 session->deprecated_cid = true1;
11889 /* FALLTHRU */
11890 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11891 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11892 break;
11893 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11894 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11895 break;
11896 default:
11897 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11898 tvb, offset, ext_len, ENC_NA0x00000000);
11899 offset += ext_len;
11900 break;
11901 }
11902
11903 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11904 /* Dissection did not end at expected location, fix it. */
11905 offset = next_offset;
11906 }
11907 }
11908
11909 if (ja3) {
11910 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11911 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11912 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11913 } else {
11914 wmem_strbuf_append_c(ja3, ',');
11915 }
11916 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11917 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11918 } else {
11919 wmem_strbuf_append_c(ja3, ',');
11920 }
11921 }
11922 }
11923
11924 /* Check if Extensions vector is correctly terminated. */
11925 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11926 offset = offset_end;
11927 }
11928
11929 return offset;
11930} /* }}} */
11931
11932
11933/* ClientKeyExchange algo-specific dissectors. {{{ */
11934
11935static void
11936dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11937 proto_tree *tree, uint32_t offset,
11938 uint32_t length)
11939{
11940 int point_len;
11941 proto_tree *ssl_ecdh_tree;
11942
11943 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11944 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11945
11946 /* point */
11947 point_len = tvb_get_uint8(tvb, offset);
11948 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11949 offset, 1, ENC_BIG_ENDIAN0x00000000);
11950 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11951 offset + 1, point_len, ENC_NA0x00000000);
11952}
11953
11954static void
11955dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11956 proto_tree *tree, uint32_t offset, uint32_t length)
11957{
11958 int yc_len;
11959 proto_tree *ssl_dh_tree;
11960
11961 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11962 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11963
11964 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11965 yc_len = tvb_get_ntohs(tvb, offset);
11966 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11967 offset, 2, ENC_BIG_ENDIAN0x00000000);
11968 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11969 offset + 2, yc_len, ENC_NA0x00000000);
11970}
11971
11972static void
11973dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11974 proto_tree *tree, uint32_t offset,
11975 uint32_t length, const SslSession *session)
11976{
11977 int epms_len;
11978 proto_tree *ssl_rsa_tree;
11979
11980 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11981 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11982
11983 /* EncryptedPreMasterSecret.pre_master_secret */
11984 switch (session->version) {
11985 case SSLV2_VERSION0x0002:
11986 case SSLV3_VERSION0x300:
11987 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11988 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11989 * not present. The handshake contents represents the EPMS, see:
11990 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11991 epms_len = length;
11992 break;
11993
11994 default:
11995 /* TLS and DTLS include vector length before EPMS */
11996 epms_len = tvb_get_ntohs(tvb, offset);
11997 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11998 offset, 2, ENC_BIG_ENDIAN0x00000000);
11999 offset += 2;
12000 break;
12001 }
12002 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
12003 offset, epms_len, ENC_NA0x00000000);
12004}
12005
12006/* Used in PSK cipher suites */
12007static uint32_t
12008dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12009 proto_tree *tree, uint32_t offset)
12010{
12011 unsigned identity_len;
12012 proto_tree *ssl_psk_tree;
12013
12014 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12015 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
12016 /* identity */
12017 identity_len = tvb_get_ntohs(tvb, offset);
12018 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
12019 offset, 2, ENC_BIG_ENDIAN0x00000000);
12020 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
12021 offset + 2, identity_len, ENC_NA0x00000000);
12022
12023 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
12024 return 2 + identity_len;
12025}
12026
12027/* Used in RSA PSK cipher suites */
12028static void
12029dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12030 proto_tree *tree, uint32_t offset,
12031 uint32_t length)
12032{
12033 int identity_len, epms_len;
12034 proto_tree *ssl_psk_tree;
12035
12036 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12037 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
12038
12039 /* identity */
12040 identity_len = tvb_get_ntohs(tvb, offset);
12041 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
12042 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12043 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
12044 tvb, offset + 2, identity_len, ENC_NA0x00000000);
12045 offset += 2 + identity_len;
12046
12047 /* Yc */
12048 epms_len = tvb_get_ntohs(tvb, offset);
12049 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12050 offset, 2, ENC_BIG_ENDIAN0x00000000);
12051 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
12052 offset + 2, epms_len, ENC_NA0x00000000);
12053}
12054
12055/* Used in Diffie-Hellman PSK cipher suites */
12056static void
12057dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12058 proto_tree *tree, uint32_t offset, uint32_t length)
12059{
12060 /*
12061 * struct {
12062 * select (KeyExchangeAlgorithm) {
12063 * case diffie_hellman_psk:
12064 * opaque psk_identity<0..2^16-1>;
12065 * ClientDiffieHellmanPublic public;
12066 * } exchange_keys;
12067 * } ClientKeyExchange;
12068 */
12069
12070 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12071 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
12072}
12073
12074/* Used in EC Diffie-Hellman PSK cipher suites */
12075static void
12076dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12077 proto_tree *tree, uint32_t offset, uint32_t length)
12078{
12079 /*
12080 * struct {
12081 * select (KeyExchangeAlgorithm) {
12082 * case ec_diffie_hellman_psk:
12083 * opaque psk_identity<0..2^16-1>;
12084 * ClientECDiffieHellmanPublic public;
12085 * } exchange_keys;
12086 * } ClientKeyExchange;
12087 */
12088
12089 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12090 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
12091}
12092
12093/* Used in EC J-PAKE cipher suites */
12094static void
12095dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12096 proto_tree *tree, uint32_t offset,
12097 uint32_t length)
12098{
12099 /*
12100 * struct {
12101 * ECPoint V;
12102 * opaque r<1..2^8-1>;
12103 * } ECSchnorrZKP;
12104 *
12105 * struct {
12106 * ECPoint X;
12107 * ECSchnorrZKP zkp;
12108 * } ECJPAKEKeyKP;
12109 *
12110 * struct {
12111 * ECJPAKEKeyKP ecjpake_key_kp;
12112 * } ClientECJPAKEParams;
12113 *
12114 * select (KeyExchangeAlgorithm) {
12115 * case ecjpake:
12116 * ClientECJPAKEParams params;
12117 * } ClientKeyExchange;
12118 */
12119
12120 int point_len;
12121 proto_tree *ssl_ecjpake_tree;
12122
12123 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12124 hf->ett.keyex_params, NULL((void*)0),
12125 "EC J-PAKE Client Params");
12126
12127 /* ECJPAKEKeyKP.X */
12128 point_len = tvb_get_uint8(tvb, offset);
12129 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12130 offset, 1, ENC_BIG_ENDIAN0x00000000);
12131 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12132 offset + 1, point_len, ENC_NA0x00000000);
12133 offset += 1 + point_len;
12134
12135 /* ECJPAKEKeyKP.zkp.V */
12136 point_len = tvb_get_uint8(tvb, offset);
12137 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12138 offset, 1, ENC_BIG_ENDIAN0x00000000);
12139 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12140 offset + 1, point_len, ENC_NA0x00000000);
12141 offset += 1 + point_len;
12142
12143 /* ECJPAKEKeyKP.zkp.r */
12144 point_len = tvb_get_uint8(tvb, offset);
12145 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12146 offset, 1, ENC_BIG_ENDIAN0x00000000);
12147 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12148 offset + 1, point_len, ENC_NA0x00000000);
12149}
12150
12151static void
12152dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12153 proto_tree *tree, uint32_t offset,
12154 uint32_t length)
12155{
12156 int epms_len;
12157 proto_tree *ssl_ecc_sm2_tree;
12158
12159 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12160 hf->ett.keyex_params, NULL((void*)0),
12161 "ECC-SM2 Encrypted PreMaster Secret");
12162
12163 epms_len = tvb_get_ntohs(tvb, offset);
12164 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12165 offset, 2, ENC_BIG_ENDIAN0x00000000);
12166 offset += 2;
12167 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12168 offset, epms_len, ENC_NA0x00000000);
12169}
12170/* ClientKeyExchange algo-specific dissectors. }}} */
12171
12172
12173/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12174static uint32_t
12175ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12176 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12177 uint16_t version, int hf_sig_len, int hf_sig)
12178{
12179 uint32_t sig_len;
12180
12181 switch (version) {
12182 case TLSV1DOT2_VERSION0x303:
12183 case DTLSV1DOT2_VERSION0xfefd:
12184 case TLSV1DOT3_VERSION0x304:
12185 case DTLSV1DOT3_VERSION0xfefc:
12186 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12187 offset += 2;
12188 break;
12189
12190 default:
12191 break;
12192 }
12193
12194 /* Sig */
12195 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12196 hf_sig_len, 0, UINT16_MAX(65535))) {
12197 return offset_end;
12198 }
12199 offset += 2;
12200 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12201 offset += sig_len;
12202 return offset;
12203} /* }}} */
12204
12205/* ServerKeyExchange algo-specific dissectors. {{{ */
12206
12207/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12208static void
12209dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12210 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12211 uint16_t version)
12212{
12213 /*
12214 * TLSv1.2 (RFC 5246 sec 7.4.8)
12215 * struct {
12216 * digitally-signed struct {
12217 * opaque handshake_messages[handshake_messages_length];
12218 * }
12219 * } CertificateVerify;
12220 *
12221 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12222 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12223 *
12224 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12225 * does more hashing including the master secret and padding.
12226 */
12227 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12228 hf->hf.hs_server_keyex_sig_len,
12229 hf->hf.hs_server_keyex_sig);
12230}
12231
12232static uint32_t
12233dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12234{
12235 /*
12236 * RFC 4492 ECC cipher suites for TLS
12237 *
12238 * struct {
12239 * ECCurveType curve_type;
12240 * select (curve_type) {
12241 * case explicit_prime:
12242 * ...
12243 * case explicit_char2:
12244 * ...
12245 * case named_curve:
12246 * NamedCurve namedcurve;
12247 * };
12248 * } ECParameters;
12249 */
12250
12251 int curve_type;
12252
12253 /* ECParameters.curve_type */
12254 curve_type = tvb_get_uint8(tvb, offset);
12255 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12256 offset, 1, ENC_BIG_ENDIAN0x00000000);
12257 offset++;
12258
12259 if (curve_type != 3)
12260 return offset_end; /* only named_curves are supported */
12261
12262 /* case curve_type == named_curve; ECParameters.namedcurve */
12263 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12264 offset, 2, ENC_BIG_ENDIAN0x00000000);
12265 offset += 2;
12266
12267 return offset;
12268}
12269
12270static void
12271dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12272 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12273 uint16_t version, bool_Bool anon)
12274{
12275 /*
12276 * RFC 4492 ECC cipher suites for TLS
12277 *
12278 * struct {
12279 * opaque point <1..2^8-1>;
12280 * } ECPoint;
12281 *
12282 * struct {
12283 * ECParameters curve_params;
12284 * ECPoint public;
12285 * } ServerECDHParams;
12286 *
12287 * select (KeyExchangeAlgorithm) {
12288 * case ec_diffie_hellman:
12289 * ServerECDHParams params;
12290 * Signature signed_params;
12291 * } ServerKeyExchange;
12292 */
12293
12294 int point_len;
12295 proto_tree *ssl_ecdh_tree;
12296
12297 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12298 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12299
12300 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12301 if (offset >= offset_end)
12302 return; /* only named_curves are supported */
12303
12304 /* ECPoint.point */
12305 point_len = tvb_get_uint8(tvb, offset);
12306 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12307 offset, 1, ENC_BIG_ENDIAN0x00000000);
12308 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12309 offset + 1, point_len, ENC_NA0x00000000);
12310 offset += 1 + point_len;
12311
12312 /* Signature (if non-anonymous KEX) */
12313 if (!anon) {
12314 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12315 }
12316}
12317
12318static void
12319dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12320 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12321 uint16_t version, bool_Bool anon)
12322{
12323 int p_len, g_len, ys_len;
12324 proto_tree *ssl_dh_tree;
12325
12326 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12327 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12328
12329 /* p */
12330 p_len = tvb_get_ntohs(tvb, offset);
12331 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12332 offset, 2, ENC_BIG_ENDIAN0x00000000);
12333 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12334 offset + 2, p_len, ENC_NA0x00000000);
12335 offset += 2 + p_len;
12336
12337 /* g */
12338 g_len = tvb_get_ntohs(tvb, offset);
12339 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12340 offset, 2, ENC_BIG_ENDIAN0x00000000);
12341 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12342 offset + 2, g_len, ENC_NA0x00000000);
12343 offset += 2 + g_len;
12344
12345 /* Ys */
12346 ys_len = tvb_get_ntohs(tvb, offset);
12347 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12348 offset, 2, ys_len);
12349 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12350 offset + 2, ys_len, ENC_NA0x00000000);
12351 offset += 2 + ys_len;
12352
12353 /* Signature (if non-anonymous KEX) */
12354 if (!anon) {
12355 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12356 }
12357}
12358
12359/* Only used in RSA-EXPORT cipher suites */
12360static void
12361dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12362 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12363 uint16_t version)
12364{
12365 int modulus_len, exponent_len;
12366 proto_tree *ssl_rsa_tree;
12367
12368 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12369 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12370
12371 /* modulus */
12372 modulus_len = tvb_get_ntohs(tvb, offset);
12373 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12374 offset, 2, ENC_BIG_ENDIAN0x00000000);
12375 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12376 offset + 2, modulus_len, ENC_NA0x00000000);
12377 offset += 2 + modulus_len;
12378
12379 /* exponent */
12380 exponent_len = tvb_get_ntohs(tvb, offset);
12381 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12382 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12383 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12384 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12385 offset += 2 + exponent_len;
12386
12387 /* Signature */
12388 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12389}
12390
12391/* Used in RSA PSK and PSK cipher suites */
12392static uint32_t
12393dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12394 proto_tree *tree, uint32_t offset)
12395{
12396 unsigned hint_len;
12397 proto_tree *ssl_psk_tree;
12398
12399 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12400 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12401
12402 /* hint */
12403 hint_len = tvb_get_ntohs(tvb, offset);
12404 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12405 offset, 2, ENC_BIG_ENDIAN0x00000000);
12406 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12407 offset + 2, hint_len, ENC_NA0x00000000);
12408
12409 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12410 return 2 + hint_len;
12411}
12412
12413/* Used in Diffie-Hellman PSK cipher suites */
12414static void
12415dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12416 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12417{
12418 /*
12419 * struct {
12420 * select (KeyExchangeAlgorithm) {
12421 * case diffie_hellman_psk:
12422 * opaque psk_identity_hint<0..2^16-1>;
12423 * ServerDHParams params;
12424 * };
12425 * } ServerKeyExchange;
12426 */
12427
12428 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12429 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12430}
12431
12432/* Used in EC Diffie-Hellman PSK cipher suites */
12433static void
12434dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12435 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12436{
12437 /*
12438 * struct {
12439 * select (KeyExchangeAlgorithm) {
12440 * case ec_diffie_hellman_psk:
12441 * opaque psk_identity_hint<0..2^16-1>;
12442 * ServerECDHParams params;
12443 * };
12444 * } ServerKeyExchange;
12445 */
12446
12447 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12448 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12449}
12450
12451/* Used in EC J-PAKE cipher suites */
12452static void
12453dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12454 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12455{
12456 /*
12457 * struct {
12458 * ECPoint V;
12459 * opaque r<1..2^8-1>;
12460 * } ECSchnorrZKP;
12461 *
12462 * struct {
12463 * ECPoint X;
12464 * ECSchnorrZKP zkp;
12465 * } ECJPAKEKeyKP;
12466 *
12467 * struct {
12468 * ECParameters curve_params;
12469 * ECJPAKEKeyKP ecjpake_key_kp;
12470 * } ServerECJPAKEParams;
12471 *
12472 * select (KeyExchangeAlgorithm) {
12473 * case ecjpake:
12474 * ServerECJPAKEParams params;
12475 * } ServerKeyExchange;
12476 */
12477
12478 int point_len;
12479 proto_tree *ssl_ecjpake_tree;
12480
12481 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12482 hf->ett.keyex_params, NULL((void*)0),
12483 "EC J-PAKE Server Params");
12484
12485 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12486 if (offset >= offset_end)
12487 return; /* only named_curves are supported */
12488
12489 /* ECJPAKEKeyKP.X */
12490 point_len = tvb_get_uint8(tvb, offset);
12491 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12492 offset, 1, ENC_BIG_ENDIAN0x00000000);
12493 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12494 offset + 1, point_len, ENC_NA0x00000000);
12495 offset += 1 + point_len;
12496
12497 /* ECJPAKEKeyKP.zkp.V */
12498 point_len = tvb_get_uint8(tvb, offset);
12499 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12500 offset, 1, ENC_BIG_ENDIAN0x00000000);
12501 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12502 offset + 1, point_len, ENC_NA0x00000000);
12503 offset += 1 + point_len;
12504
12505 /* ECJPAKEKeyKP.zkp.r */
12506 point_len = tvb_get_uint8(tvb, offset);
12507 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12508 offset, 1, ENC_BIG_ENDIAN0x00000000);
12509 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12510 offset + 1, point_len, ENC_NA0x00000000);
12511}
12512
12513/* Only used in ECC-SM2-EXPORT cipher suites */
12514static void
12515dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12516 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12517 uint16_t version)
12518{
12519 proto_tree *ssl_ecc_sm2_tree;
12520
12521 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12522 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12523
12524 /* Signature */
12525 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12526}
12527/* ServerKeyExchange algo-specific dissectors. }}} */
12528
12529/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12530void
12531ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12532 proto_tree *tree, uint32_t offset, uint32_t length,
12533 const SslSession *session)
12534{
12535 switch (ssl_get_keyex_alg(session->cipher)) {
12536 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12537 case KEX_DH_DSS0x14:
12538 case KEX_DH_RSA0x15:
12539 case KEX_DHE_DSS0x10:
12540 case KEX_DHE_RSA0x12:
12541 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12542 break;
12543 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12544 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12545 break;
12546 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12547 case KEX_ECDH_ECDSA0x1a:
12548 case KEX_ECDH_RSA0x1b:
12549 case KEX_ECDHE_ECDSA0x16:
12550 case KEX_ECDHE_RSA0x18:
12551 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12552 break;
12553 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12554 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12555 break;
12556 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12557 /* XXX: implement support for KRB5 */
12558 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12559 tvb, offset, length,
12560 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12561 " developers if you want them to be supported");
12562 break;
12563 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12564 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12565 break;
12566 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12567 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12568 break;
12569 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12570 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12571 break;
12572 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12573 case KEX_SRP_SHA_DSS0x21:
12574 case KEX_SRP_SHA_RSA0x22:
12575 /* XXX: implement support for SRP_SHA* */
12576 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12577 tvb, offset, length,
12578 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12579 " developers if you want them to be supported");
12580 break;
12581 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12582 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12583 break;
12584 case KEX_ECC_SM20x26: /* GB/T 38636 */
12585 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12586 break;
12587 default:
12588 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12589 tvb, offset, length);
12590 break;
12591 }
12592}
12593
12594void
12595ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12596 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12597 const SslSession *session)
12598{
12599 switch (ssl_get_keyex_alg(session->cipher)) {
12600 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12601 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12602 break;
12603 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12604 case KEX_DH_RSA0x15:
12605 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12606 tvb, offset, offset_end - offset);
12607 break;
12608 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12609 case KEX_DHE_RSA0x12:
12610 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12611 break;
12612 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12613 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12614 break;
12615 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12616 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12617 break;
12618 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12619 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12620 break;
12621 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12622 case KEX_ECDH_RSA0x1b:
12623 case KEX_ECDHE_ECDSA0x16:
12624 case KEX_ECDHE_RSA0x18:
12625 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12626 break;
12627 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12628 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12629 tvb, offset, offset_end - offset);
12630 break;
12631 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12632 case KEX_RSA_PSK0x1f:
12633 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12634 break;
12635 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12636 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12637 break;
12638 case KEX_ECC_SM20x26: /* GB/T 38636 */
12639 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12640 break;
12641 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12642 case KEX_SRP_SHA_DSS0x21:
12643 case KEX_SRP_SHA_RSA0x22:
12644 /* XXX: implement support for SRP_SHA* */
12645 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12646 tvb, offset, offset_end - offset,
12647 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12648 " developers if you want them to be supported");
12649 break;
12650 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12651 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12652 break;
12653 default:
12654 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12655 tvb, offset, offset_end - offset);
12656 break;
12657 }
12658}
12659/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12660
12661void
12662tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12663 proto_tree *tree, uint32_t offset)
12664{
12665 /* RFC 8446 Section 4.6.3
12666 * enum {
12667 * update_not_requested(0), update_requested(1), (255)
12668 * } KeyUpdateRequest;
12669 *
12670 * struct {
12671 * KeyUpdateRequest request_update;
12672 * } KeyUpdate;
12673 */
12674 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12675}
12676
12677void
12678ssl_common_register_ssl_alpn_dissector_table(const char *name,
12679 const char *ui_name, const int proto)
12680{
12681 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12682 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12683 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12684}
12685
12686void
12687ssl_common_register_dtls_alpn_dissector_table(const char *name,
12688 const char *ui_name, const int proto)
12689{
12690 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12691 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12692 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12693}
12694
12695void
12696ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12697{
12698 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12699 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12700 &(options->psk));
12701
12702 if (is_dtls) {
12703 prefs_register_obsolete_preference(module, "keylog_file");
12704 prefs_register_static_text_preference(module, "keylog_file_removed",
12705 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12706 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12707 return;
12708 }
12709
12710 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12711 "The name of a file which contains a list of \n"
12712 "(pre-)master secrets in one of the following formats:\n"
12713 "\n"
12714 "RSA <EPMS> <PMS>\n"
12715 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12716 "CLIENT_RANDOM <CRAND> <MS>\n"
12717 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12718 "\n"
12719 "Where:\n"
12720 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12721 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12722 "<SSLID> = The SSL Session ID\n"
12723 "<MS> = The Master-Secret (MS)\n"
12724 "<CRAND> = The Client's random number from the ClientHello message\n"
12725 "\n"
12726 "(All fields are in hex notation)",
12727 &(options->keylog_filename), false0);
12728}
12729
12730void
12731ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length)
12732{
12733 if (ssl_session && ssl_session->session.version != TLSV1DOT3_VERSION0x304 && !(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
12734 uint32_t old_length = ssl_session->handshake_data.data_len;
12735 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12736 if (tvb) {
12737 if (tvb_bytes_exist(tvb, offset, length)) {
12738 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12739 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12740 ssl_session->handshake_data.data_len += length;
12741 }
12742 } else {
12743 /* DTLS calculates the hash as if each handshake message had been
12744 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12745 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12746 */
12747 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12747, (int64_t)length, (int64_t)4))))
;
12748 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12749 memset(ssl_session->handshake_data.data + old_length, 0, length);
12750 ssl_session->handshake_data.data_len += length;
12751 }
12752 }
12753}
12754
12755
12756/*
12757 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12758 *
12759 * Local variables:
12760 * c-basic-offset: 4
12761 * tab-width: 8
12762 * indent-tabs-mode: nil
12763 * End:
12764 *
12765 * vi: set shiftwidth=4 tabstop=8 expandtab:
12766 * :indentSize=4:tabSize=8:noTabs=true:
12767 */