Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 4909, column 17
Potential leak of memory pointed to by 'handshake_hashed_data.data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-21/lib/clang/21 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-21/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2026-04-12-100331-3641-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <[email protected]>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <[email protected]>
6 * Copyright (c) 2014, Peter Wu <[email protected]>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <[email protected]>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "packet-ber.h"
41#include "packet-x509af.h"
42#include "packet-x509if.h"
43#include "packet-tls-utils.h"
44#include "packet-ocsp.h"
45#include "packet-tls.h"
46#include "packet-dtls.h"
47#include "packet-quic.h"
48#if defined(HAVE_LIBGNUTLS1)
49#include <gnutls/abstract.h>
50#include <gnutls/x509.h>
51#include <gnutls/pkcs12.h>
52#endif
53
54/* JA3/JA3S calculations must ignore GREASE values
55 * as described in RFC 8701.
56 */
57#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
58 (((x) & 0xff) == (((x)>>8) & 0xff)))
59
60/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
61 * form for a similar purpose as GREASE.
62 */
63#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
64
65#define DTLS13_MAX_EPOCH10 10
66
67/* Lookup tables {{{ */
68const value_string ssl_version_short_names[] = {
69 { SSLV2_VERSION0x0002, "SSLv2" },
70 { SSLV3_VERSION0x300, "SSLv3" },
71 { TLSV1_VERSION0x301, "TLSv1" },
72 { TLCPV1_VERSION0x101, "TLCP" },
73 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
74 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
75 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
76 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
77 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
78 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
79 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
80 { 0x00, NULL((void*)0) }
81};
82
83const value_string ssl_versions[] = {
84 { SSLV2_VERSION0x0002, "SSL 2.0" },
85 { SSLV3_VERSION0x300, "SSL 3.0" },
86 { TLSV1_VERSION0x301, "TLS 1.0" },
87 { TLCPV1_VERSION0x101, "TLCP" },
88 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
89 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
90 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
91 { 0x7F0E, "TLS 1.3 (draft 14)" },
92 { 0x7F0F, "TLS 1.3 (draft 15)" },
93 { 0x7F10, "TLS 1.3 (draft 16)" },
94 { 0x7F11, "TLS 1.3 (draft 17)" },
95 { 0x7F12, "TLS 1.3 (draft 18)" },
96 { 0x7F13, "TLS 1.3 (draft 19)" },
97 { 0x7F14, "TLS 1.3 (draft 20)" },
98 { 0x7F15, "TLS 1.3 (draft 21)" },
99 { 0x7F16, "TLS 1.3 (draft 22)" },
100 { 0x7F17, "TLS 1.3 (draft 23)" },
101 { 0x7F18, "TLS 1.3 (draft 24)" },
102 { 0x7F19, "TLS 1.3 (draft 25)" },
103 { 0x7F1A, "TLS 1.3 (draft 26)" },
104 { 0x7F1B, "TLS 1.3 (draft 27)" },
105 { 0x7F1C, "TLS 1.3 (draft 28)" },
106 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
107 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
108 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
109 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
110 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
111 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
112 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
113 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0x00, NULL((void*)0) }
129};
130
131static const value_string ssl_version_ja4_names[] = {
132 { 0x0100, "s1" },
133 { SSLV2_VERSION0x0002, "s2" },
134 { SSLV3_VERSION0x300, "s3" },
135 { TLSV1_VERSION0x301, "10" },
136 { TLSV1DOT1_VERSION0x302, "11" },
137 { TLSV1DOT2_VERSION0x303, "12" },
138 { TLSV1DOT3_VERSION0x304, "13" },
139 { DTLSV1DOT0_VERSION0xfeff, "d1" },
140 { DTLSV1DOT2_VERSION0xfefd, "d2" },
141 { DTLSV1DOT3_VERSION0xfefc, "d3" },
142 { 0x00, NULL((void*)0) }
143};
144
145const value_string ssl_20_msg_types[] = {
146 { SSL2_HND_ERROR0x00, "Error" },
147 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
148 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
149 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
150 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
151 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
152 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
153 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
154 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
155 { 0x00, NULL((void*)0) }
156};
157/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
158/* Note: sorted by ascending value so value_string-ext can do a binary search */
159static const value_string ssl_20_cipher_suites[] = {
160 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
161 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
162 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
163 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
164 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
165 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
166 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
167 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
168 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
169 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
170 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
171 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
172 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
173 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
174 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
175 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
176 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
177 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
178 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
179 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
180 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
181 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
182 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
183 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
184 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
185 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
186 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
187 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
188 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
189 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
190#if 0
191 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
192#endif
193 /* RFC 2712 */
194 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
195 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
196 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
197 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
198 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
199 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
200 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
201 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
202 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
203 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
204 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
205 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
206 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
207 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
208 /* RFC 4785 */
209 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
210 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
211 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
212 /* RFC 5246 */
213 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
214 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
215 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
216 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
217 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
218 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
219 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
220 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
221 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
222 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
223 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
224 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
225 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
226 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
227 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
228 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
229 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
230 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
231 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
232 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
238 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
239 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
240 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
241 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
242 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
243 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
244 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
245 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
246 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
248 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
250 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
251 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
252 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
253 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
254 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
255 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
256 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
257 /* 0x00,0x6E-83 Unassigned */
258 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
259 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
264 /* RFC 4279 */
265 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
266 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
267 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
268 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
269 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
270 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
271 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
272 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
273 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
274 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
275 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
276 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
277 /* RFC 4162 */
278 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
279 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
280 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
281 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
282 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
283 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
284 /* RFC 5288 */
285 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
286 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
287 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
288 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
289 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
290 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
291 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
292 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
293 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
294 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
295 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
296 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
297 /* RFC 5487 */
298 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
299 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
300 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
301 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
302 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
303 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
304 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
305 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
306 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
307 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
308 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
309 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
310 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
311 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
312 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
313 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
314 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
315 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
316 /* From RFC 5932 */
317 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
318 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
324 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
329 /* 0x00,0xC6-FE Unassigned */
330 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
331 /* 0x01-BF,* Unassigned */
332 /* From RFC 4492 */
333 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
334 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
335 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
336 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
337 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
338 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
339 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
340 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
341 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
342 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
343 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
344 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
345 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
346 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
347 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
348 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
349 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
350 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
351 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
352 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
353 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
354 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
355 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
356 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
357 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
358 /* RFC 5054 */
359 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
360 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
363 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
365 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
366 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
367 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
368 /* RFC 5589 */
369 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
370 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
371 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
372 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
373 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
374 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
375 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
376 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
377 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
378 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
379 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
380 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
381 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
382 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
383 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
384 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
385 /* RFC 5489 */
386 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
387 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
388 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
389 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
390 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
391 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
392 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
393 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
394 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
395 /* 0xC0,0x3C-FF Unassigned
396 0xC1-FD,* Unassigned
397 0xFE,0x00-FD Unassigned
398 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
399 0xFF,0x00-FF Reserved for Private Use [RFC5246]
400 */
401
402 /* old numbers used in the beginning
403 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
404 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
405 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
407
408 /* https://tools.ietf.org/html/rfc7905 */
409 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
410 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416
417 /* GM/T 0024-2014 */
418 { 0x00e001, "ECDHE_SM1_SM3"},
419 { 0x00e003, "ECC_SM1_SM3"},
420 { 0x00e005, "IBSDH_SM1_SM3"},
421 { 0x00e007, "IBC_SM1_SM3"},
422 { 0x00e009, "RSA_SM1_SM3"},
423 { 0x00e00a, "RSA_SM1_SHA1"},
424 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
425 { 0x00e013, "ECC_SM4_CBC_SM3"},
426 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
427 { 0x00e017, "IBC_SM4_CBC_SM3"},
428 { 0x00e019, "RSA_SM4_CBC_SM3"},
429 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
430 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
431 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
432 { 0x00e053, "ECC_SM4_GCM_SM3"},
433 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
434 { 0x00e057, "IBC_SM4_GCM_SM3"},
435 { 0x00e059, "RSA_SM4_GCM_SM3"},
436 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
437
438 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
439 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
440 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
441 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
442 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
443 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
444 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
445 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
446 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
447 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
448 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
449 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
450 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
451 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
452 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
453 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
454 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
455
456 /* these from http://www.mozilla.org/projects/
457 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
458 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
459 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
460 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
462 /* note that ciphersuites of {0x00????} are TLS cipher suites in
463 * a sslv2 client hello message; the ???? above is the two-byte
464 * tls cipher suite id
465 */
466
467 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
468 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
469 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
470 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
471 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
472 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
473 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
474 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
475
476 { 0x00, NULL((void*)0) }
477};
478
479value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
480
481
482/*
483 * Supported Groups (formerly named "EC Named Curve").
484 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
485 */
486const value_string ssl_extension_curves[] = {
487 { 1, "sect163k1" },
488 { 2, "sect163r1" },
489 { 3, "sect163r2" },
490 { 4, "sect193r1" },
491 { 5, "sect193r2" },
492 { 6, "sect233k1" },
493 { 7, "sect233r1" },
494 { 8, "sect239k1" },
495 { 9, "sect283k1" },
496 { 10, "sect283r1" },
497 { 11, "sect409k1" },
498 { 12, "sect409r1" },
499 { 13, "sect571k1" },
500 { 14, "sect571r1" },
501 { 15, "secp160k1" },
502 { 16, "secp160r1" },
503 { 17, "secp160r2" },
504 { 18, "secp192k1" },
505 { 19, "secp192r1" },
506 { 20, "secp224k1" },
507 { 21, "secp224r1" },
508 { 22, "secp256k1" },
509 { 23, "secp256r1" },
510 { 24, "secp384r1" },
511 { 25, "secp521r1" },
512 { 26, "brainpoolP256r1" }, /* RFC 7027 */
513 { 27, "brainpoolP384r1" }, /* RFC 7027 */
514 { 28, "brainpoolP512r1" }, /* RFC 7027 */
515 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
516 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
517 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
518 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
519 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
520 { 34, "GC256A" }, /* RFC9189 */
521 { 35, "GC256B" }, /* RFC9189 */
522 { 36, "GC256C" }, /* RFC9189 */
523 { 37, "GC256D" }, /* RFC9189 */
524 { 38, "GC512A" }, /* RFC9189 */
525 { 39, "GC512B" }, /* RFC9189 */
526 { 40, "GC512C" }, /* RFC9189 */
527 { 41, "curveSM2" }, /* RFC 8998 */
528 { 256, "ffdhe2048" }, /* RFC 7919 */
529 { 257, "ffdhe3072" }, /* RFC 7919 */
530 { 258, "ffdhe4096" }, /* RFC 7919 */
531 { 259, "ffdhe6144" }, /* RFC 7919 */
532 { 260, "ffdhe8192" }, /* RFC 7919 */
533 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
534 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
537 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
538 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
539 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
541 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
546 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
547 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
548 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 0xFF01, "arbitrary_explicit_prime_curves" },
558 { 0xFF02, "arbitrary_explicit_char2_curves" },
559 /* Below are various unofficial values that have been used for testing. */
560 /* PQC key exchange algorithms from OQS-OpenSSL,
561 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
562 These use IANA unassigned values and this list may be incomplete.
563 */
564 { 0x2F00, "p256_frodo640aes" },
565 { 0x2F01, "p256_frodo640shake" },
566 { 0x2F02, "p384_frodo976aes" },
567 { 0x0203, "frodo976shake" },
568 { 0x2F03, "p384_frodo976shake" },
569 { 0x0204, "frodo1344aes" },
570 { 0x2F04, "p521_frodo1344aes" },
571 { 0x0205, "frodo1344shake" },
572 { 0x2F05, "p521_frodo1344shake" },
573 { 0x023A, "kyber512" },
574 { 0x2F3A, "p256_kyber512" },
575 { 0x023C, "kyber768" },
576 { 0x2F3C, "p384_kyber768" },
577 { 0x023D, "kyber1024" },
578 { 0x2F3D, "p521_kyber1024" },
579 { 0x0214, "ntru_hps2048509" },
580 { 0x2F14, "p256_ntru_hps2048509" },
581 { 0x0215, "ntru_hps2048677" },
582 { 0x2F15, "p384_ntru_hps2048677" },
583 { 0x0216, "ntru_hps4096821" },
584 { 0x2F16, "p521_ntru_hps4096821" },
585 { 0x0245, "ntru_hps40961229" },
586 { 0x2F45, "p521_ntru_hps40961229" },
587 { 0x0217, "ntru_hrss701" },
588 { 0x2F17, "p384_ntru_hrss701" },
589 { 0x0246, "ntru_hrss1373" },
590 { 0x2F46, "p521_ntru_hrss1373" },
591 { 0x0218, "lightsaber" },
592 { 0x2F18, "p256_lightsaber" },
593 { 0x0219, "saber" },
594 { 0x2F19, "p384_saber" },
595 { 0x021A, "firesaber" },
596 { 0x2F1A, "p521_firesaber" },
597 { 0x021B, "sidhp434" },
598 { 0x2F1B, "p256_sidhp434" },
599 { 0x021C, "sidhp503" },
600 { 0x2F1C, "p256_sidhp503" },
601 { 0x021D, "sidhp610" },
602 { 0x2F1D, "p384_sidhp610" },
603 { 0x021E, "sidhp751" },
604 { 0x2F1E, "p521_sidhp751" },
605 { 0x021F, "sikep434" },
606 { 0x2F1F, "p256_sikep434" },
607 { 0x0220, "sikep503" },
608 { 0x2F20, "p256_sikep503" },
609 { 0x0221, "sikep610" },
610 { 0x2F21, "p384_sikep610" },
611 { 0x0222, "sikep751" },
612 { 0x2F22, "p521_sikep751" },
613 { 0x0238, "bikel1" },
614 { 0x2F38, "p256_bikel1" },
615 { 0x023B, "bikel3" },
616 { 0x2F3B, "p384_bikel3" },
617 { 0x023E, "kyber90s512" },
618 { 0x2F3E, "p256_kyber90s512" },
619 { 0x023F, "kyber90s768" },
620 { 0x2F3F, "p384_kyber90s768" },
621 { 0x0240, "kyber90s1024" },
622 { 0x2F40, "p521_kyber90s1024" },
623 { 0x022C, "hqc128" },
624 { 0x2F2C, "p256_hqc128" },
625 { 0x022D, "hqc192" },
626 { 0x2F2D, "p384_hqc192" },
627 { 0x022E, "hqc256" },
628 { 0x2F2E, "p521_hqc256" },
629 { 0x022F, "ntrulpr653" },
630 { 0x2F2F, "p256_ntrulpr653" },
631 { 0x0230, "ntrulpr761" },
632 { 0x2F43, "p256_ntrulpr761" },
633 { 0x0231, "ntrulpr857" },
634 { 0x2F31, "p384_ntrulpr857" },
635 { 0x0241, "ntrulpr1277" },
636 { 0x2F41, "p521_ntrulpr1277" },
637 { 0x0232, "sntrup653" },
638 { 0x2F32, "p256_sntrup653" },
639 { 0x0233, "sntrup761" },
640 { 0x2F44, "p256_sntrup761" },
641 { 0x0234, "sntrup857" },
642 { 0x2F34, "p384_sntrup857" },
643 { 0x0242, "sntrup1277" },
644 { 0x2F42, "p521_sntrup1277" },
645 /* Other PQ key exchange algorithms, using Reserved for Private Use values
646 https://blog.cloudflare.com/post-quantum-for-all
647 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
648 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
649 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
650 { 0x00, NULL((void*)0) }
651};
652
653const value_string ssl_curve_types[] = {
654 { 1, "explicit_prime" },
655 { 2, "explicit_char2" },
656 { 3, "named_curve" },
657 { 0x00, NULL((void*)0) }
658};
659
660const value_string ssl_extension_ec_point_formats[] = {
661 { 0, "uncompressed" },
662 { 1, "ansiX962_compressed_prime" },
663 { 2, "ansiX962_compressed_char2" },
664 { 0x00, NULL((void*)0) }
665};
666
667const value_string ssl_20_certificate_type[] = {
668 { 0x00, "N/A" },
669 { 0x01, "X.509 Certificate" },
670 { 0x00, NULL((void*)0) }
671};
672
673const value_string ssl_31_content_type[] = {
674 { 20, "Change Cipher Spec" },
675 { 21, "Alert" },
676 { 22, "Handshake" },
677 { 23, "Application Data" },
678 { 24, "Heartbeat" },
679 { 25, "Connection ID" },
680 { 0x00, NULL((void*)0) }
681};
682
683#if 0
684/* XXX - would be used if we dissected the body of a Change Cipher Spec
685 message. */
686const value_string ssl_31_change_cipher_spec[] = {
687 { 1, "Change Cipher Spec" },
688 { 0x00, NULL((void*)0) }
689};
690#endif
691
692const value_string ssl_31_alert_level[] = {
693 { 1, "Warning" },
694 { 2, "Fatal" },
695 { 0x00, NULL((void*)0) }
696};
697
698const value_string ssl_31_alert_description[] = {
699 { 0, "Close Notify" },
700 { 1, "End of Early Data" },
701 { 10, "Unexpected Message" },
702 { 20, "Bad Record MAC" },
703 { 21, "Decryption Failed" },
704 { 22, "Record Overflow" },
705 { 30, "Decompression Failure" },
706 { 40, "Handshake Failure" },
707 { 41, "No Certificate" },
708 { 42, "Bad Certificate" },
709 { 43, "Unsupported Certificate" },
710 { 44, "Certificate Revoked" },
711 { 45, "Certificate Expired" },
712 { 46, "Certificate Unknown" },
713 { 47, "Illegal Parameter" },
714 { 48, "Unknown CA" },
715 { 49, "Access Denied" },
716 { 50, "Decode Error" },
717 { 51, "Decrypt Error" },
718 { 60, "Export Restriction" },
719 { 70, "Protocol Version" },
720 { 71, "Insufficient Security" },
721 { 80, "Internal Error" },
722 { 86, "Inappropriate Fallback" },
723 { 90, "User Canceled" },
724 { 100, "No Renegotiation" },
725 { 109, "Missing Extension" },
726 { 110, "Unsupported Extension" },
727 { 111, "Certificate Unobtainable" },
728 { 112, "Unrecognized Name" },
729 { 113, "Bad Certificate Status Response" },
730 { 114, "Bad Certificate Hash Value" },
731 { 115, "Unknown PSK Identity" },
732 { 116, "Certificate Required" },
733 { 120, "No application Protocol" },
734 { 121, "ECH Required" },
735 { 0x00, NULL((void*)0) }
736};
737
738const value_string ssl_31_handshake_type[] = {
739 { SSL_HND_HELLO_REQUEST, "Hello Request" },
740 { SSL_HND_CLIENT_HELLO, "Client Hello" },
741 { SSL_HND_SERVER_HELLO, "Server Hello" },
742 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
743 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
744 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
745 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
746 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
747 { SSL_HND_CERTIFICATE, "Certificate" },
748 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
749 { SSL_HND_CERT_REQUEST, "Certificate Request" },
750 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
751 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
752 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
753 { SSL_HND_FINISHED, "Finished" },
754 { SSL_HND_CERT_URL, "Client Certificate URL" },
755 { SSL_HND_CERT_STATUS, "Certificate Status" },
756 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
757 { SSL_HND_KEY_UPDATE, "Key Update" },
758 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
759 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
760 { 0x00, NULL((void*)0) }
761};
762
763const value_string tls_heartbeat_type[] = {
764 { 1, "Request" },
765 { 2, "Response" },
766 { 0x00, NULL((void*)0) }
767};
768
769const value_string tls_heartbeat_mode[] = {
770 { 1, "Peer allowed to send requests" },
771 { 2, "Peer not allowed to send requests" },
772 { 0x00, NULL((void*)0) }
773};
774
775const value_string ssl_31_compression_method[] = {
776 { 0, "null" },
777 { 1, "DEFLATE" },
778 { 64, "LZS" },
779 { 0x00, NULL((void*)0) }
780};
781
782#if 0
783/* XXX - would be used if we dissected a Signature, as would be
784 seen in a server key exchange or certificate verify message. */
785const value_string ssl_31_key_exchange_algorithm[] = {
786 { 0, "RSA" },
787 { 1, "Diffie Hellman" },
788 { 0x00, NULL((void*)0) }
789};
790
791const value_string ssl_31_signature_algorithm[] = {
792 { 0, "Anonymous" },
793 { 1, "RSA" },
794 { 2, "DSA" },
795 { 0x00, NULL((void*)0) }
796};
797#endif
798
799const value_string ssl_31_client_certificate_type[] = {
800 { 1, "RSA Sign" },
801 { 2, "DSS Sign" },
802 { 3, "RSA Fixed DH" },
803 { 4, "DSS Fixed DH" },
804 /* GOST certificate types */
805 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
806 { 21, "GOST R 34.10-94" },
807 { 22, "GOST R 34.10-2001" },
808 /* END GOST certificate types */
809 { 64, "ECDSA Sign" },
810 { 65, "RSA Fixed ECDH" },
811 { 66, "ECDSA Fixed ECDH" },
812 { 80, "IBC Params" },
813 { 0x00, NULL((void*)0) }
814};
815
816#if 0
817/* XXX - would be used if we dissected exchange keys, as would be
818 seen in a client key exchange message. */
819const value_string ssl_31_public_value_encoding[] = {
820 { 0, "Implicit" },
821 { 1, "Explicit" },
822 { 0x00, NULL((void*)0) }
823};
824#endif
825
826/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
827/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
828static const value_string ssl_31_ciphersuite[] = {
829 /* RFC 2246, RFC 4346, RFC 5246 */
830 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
831 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
832 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
833 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
834 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
835 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
836 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
837 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
838 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
839 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
840 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
841 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
842 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
843 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
844 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
845 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
846 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
847 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
848 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
849 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
850 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
851 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
852 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
853 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
854 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
855 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
856 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
857 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
858
859 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
860 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
861#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
862 to remove according to David Hopwood <[email protected]>
863 of the ietf-tls list */
864 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
865#endif
866 /* RFC 2712 */
867 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
868 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
869 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
870 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
871 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
872 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
873 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
874 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
875 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
876 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
877 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
878 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
879 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
880 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
881 /* RFC 4785 */
882 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
883 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
884 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
885 /* RFC 5246 */
886 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
887 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
888 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
889 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
890 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
891 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
892 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
893 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
894 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
895 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
896 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
897 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
898 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
899 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
900 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
901 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
902 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
903 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
904 /* RFC 4132 */
905 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
906 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
911 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
912 /* --- ??? --- */
913 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
914 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
915 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
916 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
917 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
919 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
921 /* --- ??? ---*/
922 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
923 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
924 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
925 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
926 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
927 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
928 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
929 /* draft-chudov-cryptopro-cptls-04.txt */
930 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
931 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
932 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
933 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
934 /* RFC 4132 */
935 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
936 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
941 /* RFC 4279 */
942 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
943 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
944 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
945 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
946 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
947 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
948 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
949 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
950 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
951 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
952 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
953 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
954 /* RFC 4162 */
955 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
956 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
957 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
958 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
959 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
960 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
961 /* RFC 5288 */
962 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
963 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
964 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
965 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
966 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
967 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
968 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
969 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
970 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
971 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
972 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
973 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
974 /* RFC 5487 */
975 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
976 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
977 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
978 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
979 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
980 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
981 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
982 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
983 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
984 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
985 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
986 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
987 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
988 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
989 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
990 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
991 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
992 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
993 /* From RFC 5932 */
994 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
995 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1001 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1006 /* RFC 8998 */
1007 { 0x00C6, "TLS_SM4_GCM_SM3" },
1008 { 0x00C7, "TLS_SM4_CCM_SM3" },
1009 /* 0x00,0xC8-FE Unassigned */
1010 /* From RFC 5746 */
1011 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1012 /* RFC 8701 */
1013 { 0x0A0A, "Reserved (GREASE)" },
1014 /* RFC 8446 */
1015 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1016 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1017 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1018 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1019 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1020 /* RFC 8701 */
1021 { 0x1A1A, "Reserved (GREASE)" },
1022 { 0x2A2A, "Reserved (GREASE)" },
1023 { 0x3A3A, "Reserved (GREASE)" },
1024 { 0x4A4A, "Reserved (GREASE)" },
1025 /* From RFC 7507 */
1026 { 0x5600, "TLS_FALLBACK_SCSV" },
1027 /* RFC 8701 */
1028 { 0x5A5A, "Reserved (GREASE)" },
1029 { 0x6A6A, "Reserved (GREASE)" },
1030 { 0x7A7A, "Reserved (GREASE)" },
1031 { 0x8A8A, "Reserved (GREASE)" },
1032 { 0x9A9A, "Reserved (GREASE)" },
1033 { 0xAAAA, "Reserved (GREASE)" },
1034 { 0xBABA, "Reserved (GREASE)" },
1035 /* From RFC 4492 */
1036 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1037 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1038 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1039 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1040 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1041 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1042 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1043 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1044 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1045 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1046 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1047 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1048 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1049 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1050 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1051 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1052 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1053 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1054 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1055 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1056 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1057 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1058 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1059 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1060 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1061 /* RFC 5054 */
1062 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1063 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1066 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1068 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1069 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1070 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1071 /* RFC 5589 */
1072 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1073 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1074 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1075 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1076 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1077 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1078 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1079 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1080 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1081 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1082 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1083 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1084 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1085 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1086 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1087 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1088 /* RFC 5489 */
1089 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1090 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1091 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1092 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1093 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1094 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1095 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1096 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1097 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1098 /* RFC 6209 */
1099 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1100 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1101 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1102 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1103 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1104 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1105 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1106 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1107 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1108 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1109 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1110 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1111 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1112 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1113 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1114 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1115 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1116 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1117 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1118 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1119 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1120 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1121 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1122 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1123 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1124 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1125 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1126 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1127 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1128 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1129 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1130 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1131 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1132 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1133 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1134 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1135 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1136 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1137 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1138 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1139 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1140 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1141 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1142 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1143 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1144 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1145 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1146 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1147 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1148 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1149 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1150 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1151 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1152 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1153 /* RFC 6367 */
1154 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1155 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1156 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1157 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1158 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1159 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1160 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1161 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1162 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1163 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1164 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1165 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1166 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1167 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1168 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1169 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1170 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1171 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1172 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1173 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1174 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1175 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1176 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1177 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1178 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1179 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1180 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1181 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1182 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1183 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1184 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1185 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1186 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1187 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1188 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1189 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1190 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1191 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1192 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1193 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1194 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1195 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1196 /* RFC 6655 */
1197 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1198 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1199 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1200 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1201 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1202 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1203 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1204 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1205 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1206 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1207 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1208 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1209 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1210 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1211 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1212 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1213 /* RFC 7251 */
1214 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1215 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1216 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1217 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1218 /* RFC 8492 */
1219 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1220 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1221 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1222 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1223 /* draft-camwinget-tls-ts13-macciphersuites */
1224 { 0xC0B4, "TLS_SHA256_SHA256" },
1225 { 0xC0B5, "TLS_SHA384_SHA384" },
1226 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1227 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1228 /* draft-smyshlyaev-tls12-gost-suites */
1229 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1230 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1231 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1232 /* draft-smyshlyaev-tls13-gost-suites */
1233 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1234 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1235 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1236 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1237 /* RFC 8701 */
1238 { 0xCACA, "Reserved (GREASE)" },
1239/*
12400xC0,0xAB-FF Unassigned
12410xC1,0x03-FD,* Unassigned
12420xFE,0x00-FD Unassigned
12430xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12440xFF,0x00-FF Reserved for Private Use [RFC5246]
1245*/
1246 /* old numbers used in the beginning
1247 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1248 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1249 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 /* RFC 7905 */
1252 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1253 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 /* RFC 8442 */
1260 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1261 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1262 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1263 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1264 /* RFC 8701 */
1265 { 0xDADA, "Reserved (GREASE)" },
1266 /* GM/T 0024-2014 */
1267 { 0xe001, "ECDHE_SM1_SM3"},
1268 { 0xe003, "ECC_SM1_SM3"},
1269 { 0xe005, "IBSDH_SM1_SM3"},
1270 { 0xe007, "IBC_SM1_SM3"},
1271 { 0xe009, "RSA_SM1_SM3"},
1272 { 0xe00a, "RSA_SM1_SHA1"},
1273 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1274 { 0xe013, "ECC_SM4_CBC_SM3"},
1275 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1276 { 0xe017, "IBC_SM4_CBC_SM3"},
1277 { 0xe019, "RSA_SM4_CBC_SM3"},
1278 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1279 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1280 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1281 { 0xe053, "ECC_SM4_GCM_SM3"},
1282 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1283 { 0xe057, "IBC_SM4_GCM_SM3"},
1284 { 0xe059, "RSA_SM4_GCM_SM3"},
1285 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1286 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1287 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1288 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1289 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1290 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1291 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1292 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1293 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1294 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1295 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1296 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1297 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1298 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1299 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1300 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1301 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1302 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1303 /* RFC 8701 */
1304 { 0xEAEA, "Reserved (GREASE)" },
1305 { 0xFAFA, "Reserved (GREASE)" },
1306 /* these from http://www.mozilla.org/projects/
1307 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1308 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1309 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1310 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1311 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1312 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1313 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1314 /* note that ciphersuites 0xff00 - 0xffff are private */
1315 { 0x00, NULL((void*)0) }
1316};
1317
1318value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1319
1320/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1321const value_string tls_hello_extension_types[] = {
1322 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1323 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1329 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1330 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1332 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1333 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1334 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1335 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1336 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1337 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1338 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1339 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1340 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1341 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1342 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1344 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1345 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1346 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1347 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1348 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1349 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1350 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1351 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1352 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1353 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1354 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1359 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1360 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1365 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1367 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1370 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1371 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1372 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1373 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1376 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1377 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1378 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1379 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1380 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1383 https://twitter.com/ericlaw/status/274237352531083264 */
1384 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1385 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1386 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1387 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1388 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1397 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1399 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { 0, NULL((void*)0) }
1401};
1402
1403const value_string tls_hello_ext_server_name_type_vs[] = {
1404 { 0, "host_name" },
1405 { 0, NULL((void*)0) }
1406};
1407
1408/* RFC 6066 Section 4 */
1409const value_string tls_hello_ext_max_fragment_length[] = {
1410 { 1, "512" }, // 2^9
1411 { 2, "1024" }, // 2^10
1412 { 3, "2048" }, // 2^11
1413 { 4, "4096" }, // 2^12
1414 { 0, NULL((void*)0) }
1415};
1416
1417/* RFC 8446 Section 4.2.9 */
1418const value_string tls_hello_ext_psk_ke_mode[] = {
1419 { 0, "PSK-only key establishment (psk_ke)" },
1420 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1421 { 0, NULL((void*)0) }
1422};
1423
1424/* RFC 6066 Section 6 */
1425const value_string tls_hello_ext_trusted_ca_key_type[] = {
1426 {0, "pre_agreed"},
1427 {1, "key_sha1_hash"},
1428 {2, "x509_name"},
1429 {3, "cert_sha1_hash"},
1430 {0, NULL((void*)0)}
1431};
1432
1433const value_string tls13_key_update_request[] = {
1434 { 0, "update_not_requested" },
1435 { 1, "update_requested" },
1436 { 0, NULL((void*)0) }
1437};
1438
1439/* RFC 5246 7.4.1.4.1 */
1440/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1441/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1442 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1443 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1444 *
1445 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1446 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1447 * and TLS HashAlgorithm registries, but the new values are not compatible
1448 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1449 * cause confusion if used to interpret one of those schemes in a
1450 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1451 */
1452const value_string tls_hash_algorithm[] = {
1453 { 0, "None" },
1454 { 1, "MD5" },
1455 { 2, "SHA1" },
1456 { 3, "SHA224" },
1457 { 4, "SHA256" },
1458 { 5, "SHA384" },
1459 { 6, "SHA512" },
1460#if 0
1461 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1462 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1463 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1464 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1465 */
1466 { 8, "Intrinsic" },
1467#endif
1468 { 0, NULL((void*)0) }
1469};
1470
1471const value_string tls_signature_algorithm[] = {
1472 { 0, "Anonymous" },
1473 { 1, "RSA" },
1474 { 2, "DSA" },
1475 { 3, "ECDSA" },
1476#if 0
1477 /* As above. */
1478 { 7, "ED25519" },
1479 { 8, "ED448" },
1480 { 64, "GOSTR34102012_256" },
1481 { 65, "GOSTR34102012_512" },
1482#endif
1483 { 0, NULL((void*)0) }
1484};
1485
1486/* RFC 8446 Section 4.2.3 */
1487const value_string tls13_signature_algorithm[] = {
1488 { 0x0201, "rsa_pkcs1_sha1" },
1489 { 0x0203, "ecdsa_sha1" },
1490 { 0x0401, "rsa_pkcs1_sha256" },
1491 { 0x0403, "ecdsa_secp256r1_sha256" },
1492 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1493 { 0x0501, "rsa_pkcs1_sha384" },
1494 { 0x0503, "ecdsa_secp384r1_sha384" },
1495 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1496 { 0x0601, "rsa_pkcs1_sha512" },
1497 { 0x0603, "ecdsa_secp521r1_sha512" },
1498 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1499 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1500 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0708, "sm2sig_sm3" },
1504 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1505 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1506 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1507 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1508 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1509 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1510 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1511 { 0x0804, "rsa_pss_rsae_sha256" },
1512 { 0x0805, "rsa_pss_rsae_sha384" },
1513 { 0x0806, "rsa_pss_rsae_sha512" },
1514 { 0x0807, "ed25519" },
1515 { 0x0808, "ed448" },
1516 { 0x0809, "rsa_pss_pss_sha256" },
1517 { 0x080a, "rsa_pss_pss_sha384" },
1518 { 0x080b, "rsa_pss_pss_sha512" },
1519 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1520 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1521 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1522 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1523 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1526 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1537 /* PQC digital signature algorithms from OQS-OpenSSL,
1538 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1539 { 0xfea0, "dilithium2" },
1540 { 0xfea1, "p256_dilithium2" },
1541 { 0xfea2, "rsa3072_dilithium2" },
1542 { 0xfea3, "dilithium3" },
1543 { 0xfea4, "p384_dilithium3" },
1544 { 0xfea5, "dilithium5" },
1545 { 0xfea6, "p521_dilithium5" },
1546 { 0xfea7, "dilithium2_aes" },
1547 { 0xfea8, "p256_dilithium2_aes" },
1548 { 0xfea9, "rsa3072_dilithium2_aes" },
1549 { 0xfeaa, "dilithium3_aes" },
1550 { 0xfeab, "p384_dilithium3_aes" },
1551 { 0xfeac, "dilithium5_aes" },
1552 { 0xfead, "p521_dilithium5_aes" },
1553 { 0xfe0b, "falcon512" },
1554 { 0xfe0c, "p256_falcon512" },
1555 { 0xfe0d, "rsa3072_falcon512" },
1556 { 0xfe0e, "falcon1024" },
1557 { 0xfe0f, "p521_falcon1024" },
1558 { 0xfe96, "picnicl1full" },
1559 { 0xfe97, "p256_picnicl1full" },
1560 { 0xfe98, "rsa3072_picnicl1full" },
1561 { 0xfe1b, "picnic3l1" },
1562 { 0xfe1c, "p256_picnic3l1" },
1563 { 0xfe1d, "rsa3072_picnic3l1" },
1564 { 0xfe27, "rainbowIclassic" },
1565 { 0xfe28, "p256_rainbowIclassic" },
1566 { 0xfe29, "rsa3072_rainbowIclassic" },
1567 { 0xfe3c, "rainbowVclassic" },
1568 { 0xfe3d, "p521_rainbowVclassic" },
1569 { 0xfe42, "sphincsharaka128frobust" },
1570 { 0xfe43, "p256_sphincsharaka128frobust" },
1571 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1572 { 0xfe5e, "sphincssha256128frobust" },
1573 { 0xfe5f, "p256_sphincssha256128frobust" },
1574 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1575 { 0xfe7a, "sphincsshake256128frobust" },
1576 { 0xfe7b, "p256_sphincsshake256128frobust" },
1577 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1578 { 0, NULL((void*)0) }
1579};
1580
1581/* RFC 6091 3.1 */
1582const value_string tls_certificate_type[] = {
1583 { 0, "X.509" },
1584 { 1, "OpenPGP" },
1585 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1586 { 0, NULL((void*)0) }
1587};
1588
1589const value_string tls_cert_chain_type[] = {
1590 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1591 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1592 { 0, NULL((void*)0) }
1593};
1594
1595const value_string tls_cert_status_type[] = {
1596 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1597 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1598 { 0, NULL((void*)0) }
1599};
1600
1601/* Generated by tools/make-tls-ct-logids.py
1602 * Last-Modified Sat, 15 Nov 2025 14:27:28 GMT, 187 entries. */
1603static const bytes_string ct_logids[] = {
1604 { (const uint8_t[]){
1605 0xb2, 0x1e, 0x05, 0xcc, 0x8b, 0xa2, 0xcd, 0x8a, 0x20, 0x4e, 0x87,
1606 0x66, 0xf9, 0x2b, 0xb9, 0x8a, 0x25, 0x20, 0x67, 0x6b, 0xda, 0xfa,
1607 0x70, 0xe7, 0xb2, 0x49, 0x53, 0x2d, 0xef, 0x8b, 0x90, 0x5e,
1608 },
1609 32, "Google 'Argon2020' log" },
1610 { (const uint8_t[]){
1611 0xf6, 0x5c, 0x94, 0x2f, 0xd1, 0x77, 0x30, 0x22, 0x14, 0x54, 0x18,
1612 0x08, 0x30, 0x94, 0x56, 0x8e, 0xe3, 0x4d, 0x13, 0x19, 0x33, 0xbf,
1613 0xdf, 0x0c, 0x2f, 0x20, 0x0b, 0xcc, 0x4e, 0xf1, 0x64, 0xe3,
1614 },
1615 32, "Google 'Argon2021' log" },
1616 { (const uint8_t[]){
1617 0x29, 0x79, 0xbe, 0xf0, 0x9e, 0x39, 0x39, 0x21, 0xf0, 0x56, 0x73,
1618 0x9f, 0x63, 0xa5, 0x77, 0xe5, 0xbe, 0x57, 0x7d, 0x9c, 0x60, 0x0a,
1619 0xf8, 0xf9, 0x4d, 0x5d, 0x26, 0x5c, 0x25, 0x5d, 0xc7, 0x84,
1620 },
1621 32, "Google 'Argon2022' log" },
1622 { (const uint8_t[]){
1623 0xe8, 0x3e, 0xd0, 0xda, 0x3e, 0xf5, 0x06, 0x35, 0x32, 0xe7, 0x57,
1624 0x28, 0xbc, 0x89, 0x6b, 0xc9, 0x03, 0xd3, 0xcb, 0xd1, 0x11, 0x6b,
1625 0xec, 0xeb, 0x69, 0xe1, 0x77, 0x7d, 0x6d, 0x06, 0xbd, 0x6e,
1626 },
1627 32, "Google 'Argon2023' log" },
1628 { (const uint8_t[]){
1629 0xee, 0xcd, 0xd0, 0x64, 0xd5, 0xdb, 0x1a, 0xce, 0xc5, 0x5c, 0xb7,
1630 0x9d, 0xb4, 0xcd, 0x13, 0xa2, 0x32, 0x87, 0x46, 0x7c, 0xbc, 0xec,
1631 0xde, 0xc3, 0x51, 0x48, 0x59, 0x46, 0x71, 0x1f, 0xb5, 0x9b,
1632 },
1633 32, "Google 'Argon2024' log" },
1634 { (const uint8_t[]){
1635 0x4e, 0x75, 0xa3, 0x27, 0x5c, 0x9a, 0x10, 0xc3, 0x38, 0x5b, 0x6c,
1636 0xd4, 0xdf, 0x3f, 0x52, 0xeb, 0x1d, 0xf0, 0xe0, 0x8e, 0x1b, 0x8d,
1637 0x69, 0xc0, 0xb1, 0xfa, 0x64, 0xb1, 0x62, 0x9a, 0x39, 0xdf,
1638 },
1639 32, "Google 'Argon2025h1' log" },
1640 { (const uint8_t[]){
1641 0x12, 0xf1, 0x4e, 0x34, 0xbd, 0x53, 0x72, 0x4c, 0x84, 0x06, 0x19,
1642 0xc3, 0x8f, 0x3f, 0x7a, 0x13, 0xf8, 0xe7, 0xb5, 0x62, 0x87, 0x88,
1643 0x9c, 0x6d, 0x30, 0x05, 0x84, 0xeb, 0xe5, 0x86, 0x26, 0x3a,
1644 },
1645 32, "Google 'Argon2025h2' log" },
1646 { (const uint8_t[]){
1647 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1648 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1649 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1650 },
1651 32, "Google 'Argon2026h1' log" },
1652 { (const uint8_t[]){
1653 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1654 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1655 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1656 },
1657 32, "Google 'Argon2026h2' log" },
1658 { (const uint8_t[]){
1659 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1660 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1661 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1662 },
1663 32, "Google 'Argon2027h1'" },
1664 { (const uint8_t[]){
1665 0x07, 0xb7, 0x5c, 0x1b, 0xe5, 0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6,
1666 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6, 0x57, 0x7c, 0x57, 0x94, 0xb7,
1667 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69, 0xd3, 0xa2, 0x1c,
1668 },
1669 32, "Google 'Xenon2020' log" },
1670 { (const uint8_t[]){
1671 0x7d, 0x3e, 0xf2, 0xf8, 0x8f, 0xff, 0x88, 0x55, 0x68, 0x24, 0xc2,
1672 0xc0, 0xca, 0x9e, 0x52, 0x89, 0x79, 0x2b, 0xc5, 0x0e, 0x78, 0x09,
1673 0x7f, 0x2e, 0x6a, 0x97, 0x68, 0x99, 0x7e, 0x22, 0xf0, 0xd7,
1674 },
1675 32, "Google 'Xenon2021' log" },
1676 { (const uint8_t[]){
1677 0x46, 0xa5, 0x55, 0xeb, 0x75, 0xfa, 0x91, 0x20, 0x30, 0xb5, 0xa2,
1678 0x89, 0x69, 0xf4, 0xf3, 0x7d, 0x11, 0x2c, 0x41, 0x74, 0xbe, 0xfd,
1679 0x49, 0xb8, 0x85, 0xab, 0xf2, 0xfc, 0x70, 0xfe, 0x6d, 0x47,
1680 },
1681 32, "Google 'Xenon2022' log" },
1682 { (const uint8_t[]){
1683 0xad, 0xf7, 0xbe, 0xfa, 0x7c, 0xff, 0x10, 0xc8, 0x8b, 0x9d, 0x3d,
1684 0x9c, 0x1e, 0x3e, 0x18, 0x6a, 0xb4, 0x67, 0x29, 0x5d, 0xcf, 0xb1,
1685 0x0c, 0x24, 0xca, 0x85, 0x86, 0x34, 0xeb, 0xdc, 0x82, 0x8a,
1686 },
1687 32, "Google 'Xenon2023' log" },
1688 { (const uint8_t[]){
1689 0x76, 0xff, 0x88, 0x3f, 0x0a, 0xb6, 0xfb, 0x95, 0x51, 0xc2, 0x61,
1690 0xcc, 0xf5, 0x87, 0xba, 0x34, 0xb4, 0xa4, 0xcd, 0xbb, 0x29, 0xdc,
1691 0x68, 0x42, 0x0a, 0x9f, 0xe6, 0x67, 0x4c, 0x5a, 0x3a, 0x74,
1692 },
1693 32, "Google 'Xenon2024' log" },
1694 { (const uint8_t[]){
1695 0xcf, 0x11, 0x56, 0xee, 0xd5, 0x2e, 0x7c, 0xaf, 0xf3, 0x87, 0x5b,
1696 0xd9, 0x69, 0x2e, 0x9b, 0xe9, 0x1a, 0x71, 0x67, 0x4a, 0xb0, 0x17,
1697 0xec, 0xac, 0x01, 0xd2, 0x5b, 0x77, 0xce, 0xcc, 0x3b, 0x08,
1698 },
1699 32, "Google 'Xenon2025h1' log" },
1700 { (const uint8_t[]){
1701 0xdd, 0xdc, 0xca, 0x34, 0x95, 0xd7, 0xe1, 0x16, 0x05, 0xe7, 0x95,
1702 0x32, 0xfa, 0xc7, 0x9f, 0xf8, 0x3d, 0x1c, 0x50, 0xdf, 0xdb, 0x00,
1703 0x3a, 0x14, 0x12, 0x76, 0x0a, 0x2c, 0xac, 0xbb, 0xc8, 0x2a,
1704 },
1705 32, "Google 'Xenon2025h2' log" },
1706 { (const uint8_t[]){
1707 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1708 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1709 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1710 },
1711 32, "Google 'Xenon2026h1' log" },
1712 { (const uint8_t[]){
1713 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1714 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1715 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1716 },
1717 32, "Google 'Xenon2026h2' log" },
1718 { (const uint8_t[]){
1719 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1720 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1721 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1722 },
1723 32, "Google 'Xenon2027h1'" },
1724 { (const uint8_t[]){
1725 0x68, 0xf6, 0x98, 0xf8, 0x1f, 0x64, 0x82, 0xbe, 0x3a, 0x8c, 0xee,
1726 0xb9, 0x28, 0x1d, 0x4c, 0xfc, 0x71, 0x51, 0x5d, 0x67, 0x93, 0xd4,
1727 0x44, 0xd1, 0x0a, 0x67, 0xac, 0xbb, 0x4f, 0x4f, 0xfb, 0xc4,
1728 },
1729 32, "Google 'Aviator' log" },
1730 { (const uint8_t[]){
1731 0x29, 0x3c, 0x51, 0x96, 0x54, 0xc8, 0x39, 0x65, 0xba, 0xaa, 0x50,
1732 0xfc, 0x58, 0x07, 0xd4, 0xb7, 0x6f, 0xbf, 0x58, 0x7a, 0x29, 0x72,
1733 0xdc, 0xa4, 0xc3, 0x0c, 0xf4, 0xe5, 0x45, 0x47, 0xf4, 0x78,
1734 },
1735 32, "Google 'Icarus' log" },
1736 { (const uint8_t[]){
1737 0xa4, 0xb9, 0x09, 0x90, 0xb4, 0x18, 0x58, 0x14, 0x87, 0xbb, 0x13,
1738 0xa2, 0xcc, 0x67, 0x70, 0x0a, 0x3c, 0x35, 0x98, 0x04, 0xf9, 0x1b,
1739 0xdf, 0xb8, 0xe3, 0x77, 0xcd, 0x0e, 0xc8, 0x0d, 0xdc, 0x10,
1740 },
1741 32, "Google 'Pilot' log" },
1742 { (const uint8_t[]){
1743 0xee, 0x4b, 0xbd, 0xb7, 0x75, 0xce, 0x60, 0xba, 0xe1, 0x42, 0x69,
1744 0x1f, 0xab, 0xe1, 0x9e, 0x66, 0xa3, 0x0f, 0x7e, 0x5f, 0xb0, 0x72,
1745 0xd8, 0x83, 0x00, 0xc4, 0x7b, 0x89, 0x7a, 0xa8, 0xfd, 0xcb,
1746 },
1747 32, "Google 'Rocketeer' log" },
1748 { (const uint8_t[]){
1749 0xbb, 0xd9, 0xdf, 0xbc, 0x1f, 0x8a, 0x71, 0xb5, 0x93, 0x94, 0x23,
1750 0x97, 0xaa, 0x92, 0x7b, 0x47, 0x38, 0x57, 0x95, 0x0a, 0xab, 0x52,
1751 0xe8, 0x1a, 0x90, 0x96, 0x64, 0x36, 0x8e, 0x1e, 0xd1, 0x85,
1752 },
1753 32, "Google 'Skydiver' log" },
1754 { (const uint8_t[]){
1755 0xfa, 0xd4, 0xc9, 0x7c, 0xc4, 0x9e, 0xe2, 0xf8, 0xac, 0x85, 0xc5,
1756 0xea, 0x5c, 0xea, 0x09, 0xd0, 0x22, 0x0d, 0xbb, 0xf4, 0xe4, 0x9c,
1757 0x6b, 0x50, 0x66, 0x2f, 0xf8, 0x68, 0xf8, 0x6b, 0x8c, 0x28,
1758 },
1759 32, "Google 'Argon2017' log" },
1760 { (const uint8_t[]){
1761 0xa4, 0x50, 0x12, 0x69, 0x05, 0x5a, 0x15, 0x54, 0x5e, 0x62, 0x11,
1762 0xab, 0x37, 0xbc, 0x10, 0x3f, 0x62, 0xae, 0x55, 0x76, 0xa4, 0x5e,
1763 0x4b, 0x17, 0x14, 0x45, 0x3e, 0x1b, 0x22, 0x10, 0x6a, 0x25,
1764 },
1765 32, "Google 'Argon2018' log" },
1766 { (const uint8_t[]){
1767 0x63, 0xf2, 0xdb, 0xcd, 0xe8, 0x3b, 0xcc, 0x2c, 0xcf, 0x0b, 0x72,
1768 0x84, 0x27, 0x57, 0x6b, 0x33, 0xa4, 0x8d, 0x61, 0x77, 0x8f, 0xbd,
1769 0x75, 0xa6, 0x38, 0xb1, 0xc7, 0x68, 0x54, 0x4b, 0xd8, 0x8d,
1770 },
1771 32, "Google 'Argon2019' log" },
1772 { (const uint8_t[]){
1773 0xb1, 0x0c, 0xd5, 0x59, 0xa6, 0xd6, 0x78, 0x46, 0x81, 0x1f, 0x7d,
1774 0xf9, 0xa5, 0x15, 0x32, 0x73, 0x9a, 0xc4, 0x8d, 0x70, 0x3b, 0xea,
1775 0x03, 0x23, 0xda, 0x5d, 0x38, 0x75, 0x5b, 0xc0, 0xad, 0x4e,
1776 },
1777 32, "Google 'Xenon2018' log" },
1778 { (const uint8_t[]){
1779 0x08, 0x41, 0x14, 0x98, 0x00, 0x71, 0x53, 0x2c, 0x16, 0x19, 0x04,
1780 0x60, 0xbc, 0xfc, 0x47, 0xfd, 0xc2, 0x65, 0x3a, 0xfa, 0x29, 0x2c,
1781 0x72, 0xb3, 0x7f, 0xf8, 0x63, 0xae, 0x29, 0xcc, 0xc9, 0xf0,
1782 },
1783 32, "Google 'Xenon2019' log" },
1784 { (const uint8_t[]){
1785 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1786 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1787 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1788 },
1789 32, "Google 'Submariner' log" },
1790 { (const uint8_t[]){
1791 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1792 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1793 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1794 },
1795 32, "Google 'Daedalus' log" },
1796 { (const uint8_t[]){
1797 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1798 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1799 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1800 },
1801 32, "Google 'Testtube' log" },
1802 { (const uint8_t[]){
1803 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1804 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1805 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1806 },
1807 32, "Google 'Crucible' log" },
1808 { (const uint8_t[]){
1809 0x52, 0xeb, 0x4b, 0x22, 0x5e, 0xc8, 0x96, 0x97, 0x48, 0x50, 0x67,
1810 0x5f, 0x23, 0xe4, 0x3b, 0xc1, 0xd0, 0x21, 0xe3, 0x21, 0x4c, 0xe5,
1811 0x2e, 0xcd, 0x5f, 0xa8, 0x7c, 0x20, 0x3c, 0xdf, 0xca, 0x03,
1812 },
1813 32, "Google 'Solera2018' log" },
1814 { (const uint8_t[]){
1815 0x0b, 0x76, 0x0e, 0x9a, 0x8b, 0x9a, 0x68, 0x2f, 0x88, 0x98, 0x5b,
1816 0x15, 0xe9, 0x47, 0x50, 0x1a, 0x56, 0x44, 0x6b, 0xba, 0x88, 0x30,
1817 0x78, 0x5c, 0x38, 0x42, 0x99, 0x43, 0x86, 0x45, 0x0c, 0x00,
1818 },
1819 32, "Google 'Solera2019' log" },
1820 { (const uint8_t[]){
1821 0x1f, 0xc7, 0x2c, 0xe5, 0xa1, 0xb7, 0x99, 0xf4, 0x00, 0xc3, 0x59,
1822 0xbf, 0xf9, 0x6c, 0xa3, 0x91, 0x35, 0x48, 0xe8, 0x64, 0x42, 0x20,
1823 0x61, 0x09, 0x52, 0xe9, 0xba, 0x17, 0x74, 0xf7, 0xba, 0xc7,
1824 },
1825 32, "Google 'Solera2020' log" },
1826 { (const uint8_t[]){
1827 0xa3, 0xc9, 0x98, 0x45, 0xe8, 0x0a, 0xb7, 0xce, 0x00, 0x15, 0x7b,
1828 0x37, 0x42, 0xdf, 0x02, 0x07, 0xdd, 0x27, 0x2b, 0x2b, 0x60, 0x2e,
1829 0xcf, 0x98, 0xee, 0x2c, 0x12, 0xdb, 0x9c, 0x5a, 0xe7, 0xe7,
1830 },
1831 32, "Google 'Solera2021' log" },
1832 { (const uint8_t[]){
1833 0x69, 0x7a, 0xaf, 0xca, 0x1a, 0x6b, 0x53, 0x6f, 0xae, 0x21, 0x20,
1834 0x50, 0x46, 0xde, 0xba, 0xd7, 0xe0, 0xea, 0xea, 0x13, 0xd2, 0x43,
1835 0x2e, 0x6e, 0x9d, 0x8f, 0xb3, 0x79, 0xf2, 0xb9, 0xaa, 0xf3,
1836 },
1837 32, "Google 'Solera2022' log" },
1838 { (const uint8_t[]){
1839 0xf9, 0x7e, 0x97, 0xb8, 0xd3, 0x3e, 0xf7, 0xa1, 0x59, 0x02, 0xa5,
1840 0x3a, 0x19, 0xe1, 0x79, 0x90, 0xe5, 0xdc, 0x40, 0x6a, 0x03, 0x18,
1841 0x25, 0xba, 0xad, 0x93, 0xe9, 0x8f, 0x9b, 0x9c, 0x69, 0xcb,
1842 },
1843 32, "Google 'Solera2023' log" },
1844 { (const uint8_t[]){
1845 0x30, 0x24, 0xce, 0x7e, 0xeb, 0x16, 0x88, 0x62, 0x72, 0x4b, 0xea,
1846 0x70, 0x2e, 0xff, 0xf9, 0x92, 0xcf, 0xe4, 0x56, 0x43, 0x41, 0x91,
1847 0xaa, 0x59, 0x5b, 0x25, 0xf8, 0x02, 0x26, 0xc8, 0x00, 0x17,
1848 },
1849 32, "Google 'Solera2024' log" },
1850 { (const uint8_t[]){
1851 0x3f, 0xe1, 0xcb, 0x46, 0xed, 0x47, 0x35, 0x79, 0xaf, 0x01, 0x41,
1852 0xf9, 0x72, 0x4d, 0x9d, 0xc4, 0x43, 0x47, 0x2d, 0x75, 0x6e, 0x85,
1853 0xe7, 0x71, 0x9c, 0x55, 0x82, 0x48, 0x5d, 0xd4, 0xe1, 0xe4,
1854 },
1855 32, "Google 'Solera2025h1' log" },
1856 { (const uint8_t[]){
1857 0x26, 0x02, 0x39, 0x48, 0x87, 0x4c, 0xf7, 0xfc, 0xd0, 0xfb, 0x64,
1858 0x71, 0xa4, 0x3e, 0x84, 0x7e, 0xbb, 0x20, 0x0a, 0xe6, 0xe2, 0xfa,
1859 0x24, 0x23, 0x6d, 0xf6, 0xd1, 0xa6, 0x06, 0x63, 0x0f, 0xb1,
1860 },
1861 32, "Google 'Solera2025h2' log" },
1862 { (const uint8_t[]){
1863 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1864 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1865 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1866 },
1867 32, "Google 'Solera2026h1' log" },
1868 { (const uint8_t[]){
1869 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1870 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1871 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1872 },
1873 32, "Google 'Solera2026h2' log" },
1874 { (const uint8_t[]){
1875 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1876 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1877 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1878 },
1879 32, "Google 'Solera2027h1' log" },
1880 { (const uint8_t[]){
1881 0x5e, 0xa7, 0x73, 0xf9, 0xdf, 0x56, 0xc0, 0xe7, 0xb5, 0x36, 0x48,
1882 0x7d, 0xd0, 0x49, 0xe0, 0x32, 0x7a, 0x91, 0x9a, 0x0c, 0x84, 0xa1,
1883 0x12, 0x12, 0x84, 0x18, 0x75, 0x96, 0x81, 0x71, 0x45, 0x58,
1884 },
1885 32, "Cloudflare 'Nimbus2020' Log" },
1886 { (const uint8_t[]){
1887 0x44, 0x94, 0x65, 0x2e, 0xb0, 0xee, 0xce, 0xaf, 0xc4, 0x40, 0x07,
1888 0xd8, 0xa8, 0xfe, 0x28, 0xc0, 0xda, 0xe6, 0x82, 0xbe, 0xd8, 0xcb,
1889 0x31, 0xb5, 0x3f, 0xd3, 0x33, 0x96, 0xb5, 0xb6, 0x81, 0xa8,
1890 },
1891 32, "Cloudflare 'Nimbus2021' Log" },
1892 { (const uint8_t[]){
1893 0x41, 0xc8, 0xca, 0xb1, 0xdf, 0x22, 0x46, 0x4a, 0x10, 0xc6, 0xa1,
1894 0x3a, 0x09, 0x42, 0x87, 0x5e, 0x4e, 0x31, 0x8b, 0x1b, 0x03, 0xeb,
1895 0xeb, 0x4b, 0xc7, 0x68, 0xf0, 0x90, 0x62, 0x96, 0x06, 0xf6,
1896 },
1897 32, "Cloudflare 'Nimbus2022' Log" },
1898 { (const uint8_t[]){
1899 0x7a, 0x32, 0x8c, 0x54, 0xd8, 0xb7, 0x2d, 0xb6, 0x20, 0xea, 0x38,
1900 0xe0, 0x52, 0x1e, 0xe9, 0x84, 0x16, 0x70, 0x32, 0x13, 0x85, 0x4d,
1901 0x3b, 0xd2, 0x2b, 0xc1, 0x3a, 0x57, 0xa3, 0x52, 0xeb, 0x52,
1902 },
1903 32, "Cloudflare 'Nimbus2023' Log" },
1904 { (const uint8_t[]){
1905 0xda, 0xb6, 0xbf, 0x6b, 0x3f, 0xb5, 0xb6, 0x22, 0x9f, 0x9b, 0xc2,
1906 0xbb, 0x5c, 0x6b, 0xe8, 0x70, 0x91, 0x71, 0x6c, 0xbb, 0x51, 0x84,
1907 0x85, 0x34, 0xbd, 0xa4, 0x3d, 0x30, 0x48, 0xd7, 0xfb, 0xab,
1908 },
1909 32, "Cloudflare 'Nimbus2024' Log" },
1910 { (const uint8_t[]){
1911 0xcc, 0xfb, 0x0f, 0x6a, 0x85, 0x71, 0x09, 0x65, 0xfe, 0x95, 0x9b,
1912 0x53, 0xce, 0xe9, 0xb2, 0x7c, 0x22, 0xe9, 0x85, 0x5c, 0x0d, 0x97,
1913 0x8d, 0xb6, 0xa9, 0x7e, 0x54, 0xc0, 0xfe, 0x4c, 0x0d, 0xb0,
1914 },
1915 32, "Cloudflare 'Nimbus2025'" },
1916 { (const uint8_t[]){
1917 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1918 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1919 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1920 },
1921 32, "Cloudflare 'Nimbus2026'" },
1922 { (const uint8_t[]){
1923 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1924 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1925 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1926 },
1927 32, "Cloudflare 'Nimbus2027'" },
1928 { (const uint8_t[]){
1929 0x1f, 0xbc, 0x36, 0xe0, 0x02, 0xed, 0xe9, 0x7f, 0x40, 0x19, 0x9e,
1930 0x86, 0xb3, 0x57, 0x3b, 0x8a, 0x42, 0x17, 0xd8, 0x01, 0x87, 0x74,
1931 0x6a, 0xd0, 0xda, 0x03, 0xa0, 0x60, 0x54, 0xd2, 0x0d, 0xf4,
1932 },
1933 32, "Cloudflare 'Nimbus2017' Log" },
1934 { (const uint8_t[]){
1935 0xdb, 0x74, 0xaf, 0xee, 0xcb, 0x29, 0xec, 0xb1, 0xfe, 0xca, 0x3e,
1936 0x71, 0x6d, 0x2c, 0xe5, 0xb9, 0xaa, 0xbb, 0x36, 0xf7, 0x84, 0x71,
1937 0x83, 0xc7, 0x5d, 0x9d, 0x4f, 0x37, 0xb6, 0x1f, 0xbf, 0x64,
1938 },
1939 32, "Cloudflare 'Nimbus2018' Log" },
1940 { (const uint8_t[]){
1941 0x74, 0x7e, 0xda, 0x83, 0x31, 0xad, 0x33, 0x10, 0x91, 0x21, 0x9c,
1942 0xce, 0x25, 0x4f, 0x42, 0x70, 0xc2, 0xbf, 0xfd, 0x5e, 0x42, 0x20,
1943 0x08, 0xc6, 0x37, 0x35, 0x79, 0xe6, 0x10, 0x7b, 0xcc, 0x56,
1944 },
1945 32, "Cloudflare 'Nimbus2019' Log" },
1946 { (const uint8_t[]){
1947 0x56, 0x14, 0x06, 0x9a, 0x2f, 0xd7, 0xc2, 0xec, 0xd3, 0xf5, 0xe1,
1948 0xbd, 0x44, 0xb2, 0x3e, 0xc7, 0x46, 0x76, 0xb9, 0xbc, 0x99, 0x11,
1949 0x5c, 0xc0, 0xef, 0x94, 0x98, 0x55, 0xd6, 0x89, 0xd0, 0xdd,
1950 },
1951 32, "DigiCert Log Server" },
1952 { (const uint8_t[]){
1953 0x87, 0x75, 0xbf, 0xe7, 0x59, 0x7c, 0xf8, 0x8c, 0x43, 0x99, 0x5f,
1954 0xbd, 0xf3, 0x6e, 0xff, 0x56, 0x8d, 0x47, 0x56, 0x36, 0xff, 0x4a,
1955 0xb5, 0x60, 0xc1, 0xb4, 0xea, 0xff, 0x5e, 0xa0, 0x83, 0x0f,
1956 },
1957 32, "DigiCert Log Server 2" },
1958 { (const uint8_t[]){
1959 0xf0, 0x95, 0xa4, 0x59, 0xf2, 0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d,
1960 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b, 0xfe, 0x1d, 0x47, 0xe3, 0x99,
1961 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa, 0x8e, 0xb2, 0x73,
1962 },
1963 32, "DigiCert Yeti2020 Log" },
1964 { (const uint8_t[]){
1965 0x5c, 0xdc, 0x43, 0x92, 0xfe, 0xe6, 0xab, 0x45, 0x44, 0xb1, 0x5e,
1966 0x9a, 0xd4, 0x56, 0xe6, 0x10, 0x37, 0xfb, 0xd5, 0xfa, 0x47, 0xdc,
1967 0xa1, 0x73, 0x94, 0xb2, 0x5e, 0xe6, 0xf6, 0xc7, 0x0e, 0xca,
1968 },
1969 32, "DigiCert Yeti2021 Log" },
1970 { (const uint8_t[]){
1971 0x22, 0x45, 0x45, 0x07, 0x59, 0x55, 0x24, 0x56, 0x96, 0x3f, 0xa1,
1972 0x2f, 0xf1, 0xf7, 0x6d, 0x86, 0xe0, 0x23, 0x26, 0x63, 0xad, 0xc0,
1973 0x4b, 0x7f, 0x5d, 0xc6, 0x83, 0x5c, 0x6e, 0xe2, 0x0f, 0x02,
1974 },
1975 32, "DigiCert Yeti2022 Log" },
1976 { (const uint8_t[]){
1977 0x35, 0xcf, 0x19, 0x1b, 0xbf, 0xb1, 0x6c, 0x57, 0xbf, 0x0f, 0xad,
1978 0x4c, 0x6d, 0x42, 0xcb, 0xbb, 0xb6, 0x27, 0x20, 0x26, 0x51, 0xea,
1979 0x3f, 0xe1, 0x2a, 0xef, 0xa8, 0x03, 0xc3, 0x3b, 0xd6, 0x4c,
1980 },
1981 32, "DigiCert Yeti2023 Log" },
1982 { (const uint8_t[]){
1983 0x48, 0xb0, 0xe3, 0x6b, 0xda, 0xa6, 0x47, 0x34, 0x0f, 0xe5, 0x6a,
1984 0x02, 0xfa, 0x9d, 0x30, 0xeb, 0x1c, 0x52, 0x01, 0xcb, 0x56, 0xdd,
1985 0x2c, 0x81, 0xd9, 0xbb, 0xbf, 0xab, 0x39, 0xd8, 0x84, 0x73,
1986 },
1987 32, "DigiCert Yeti2024 Log" },
1988 { (const uint8_t[]){
1989 0x7d, 0x59, 0x1e, 0x12, 0xe1, 0x78, 0x2a, 0x7b, 0x1c, 0x61, 0x67,
1990 0x7c, 0x5e, 0xfd, 0xf8, 0xd0, 0x87, 0x5c, 0x14, 0xa0, 0x4e, 0x95,
1991 0x9e, 0xb9, 0x03, 0x2f, 0xd9, 0x0e, 0x8c, 0x2e, 0x79, 0xb8,
1992 },
1993 32, "DigiCert Yeti2025 Log" },
1994 { (const uint8_t[]){
1995 0xc6, 0x52, 0xa0, 0xec, 0x48, 0xce, 0xb3, 0xfc, 0xab, 0x17, 0x09,
1996 0x92, 0xc4, 0x3a, 0x87, 0x41, 0x33, 0x09, 0xe8, 0x00, 0x65, 0xa2,
1997 0x62, 0x52, 0x40, 0x1b, 0xa3, 0x36, 0x2a, 0x17, 0xc5, 0x65,
1998 },
1999 32, "DigiCert Nessie2020 Log" },
2000 { (const uint8_t[]){
2001 0xee, 0xc0, 0x95, 0xee, 0x8d, 0x72, 0x64, 0x0f, 0x92, 0xe3, 0xc3,
2002 0xb9, 0x1b, 0xc7, 0x12, 0xa3, 0x69, 0x6a, 0x09, 0x7b, 0x4b, 0x6a,
2003 0x1a, 0x14, 0x38, 0xe6, 0x47, 0xb2, 0xcb, 0xed, 0xc5, 0xf9,
2004 },
2005 32, "DigiCert Nessie2021 Log" },
2006 { (const uint8_t[]){
2007 0x51, 0xa3, 0xb0, 0xf5, 0xfd, 0x01, 0x79, 0x9c, 0x56, 0x6d, 0xb8,
2008 0x37, 0x78, 0x8f, 0x0c, 0xa4, 0x7a, 0xcc, 0x1b, 0x27, 0xcb, 0xf7,
2009 0x9e, 0x88, 0x42, 0x9a, 0x0d, 0xfe, 0xd4, 0x8b, 0x05, 0xe5,
2010 },
2011 32, "DigiCert Nessie2022 Log" },
2012 { (const uint8_t[]){
2013 0xb3, 0x73, 0x77, 0x07, 0xe1, 0x84, 0x50, 0xf8, 0x63, 0x86, 0xd6,
2014 0x05, 0xa9, 0xdc, 0x11, 0x09, 0x4a, 0x79, 0x2d, 0xb1, 0x67, 0x0c,
2015 0x0b, 0x87, 0xdc, 0xf0, 0x03, 0x0e, 0x79, 0x36, 0xa5, 0x9a,
2016 },
2017 32, "DigiCert Nessie2023 Log" },
2018 { (const uint8_t[]){
2019 0x73, 0xd9, 0x9e, 0x89, 0x1b, 0x4c, 0x96, 0x78, 0xa0, 0x20, 0x7d,
2020 0x47, 0x9d, 0xe6, 0xb2, 0xc6, 0x1c, 0xd0, 0x51, 0x5e, 0x71, 0x19,
2021 0x2a, 0x8c, 0x6b, 0x80, 0x10, 0x7a, 0xc1, 0x77, 0x72, 0xb5,
2022 },
2023 32, "DigiCert Nessie2024 Log" },
2024 { (const uint8_t[]){
2025 0xe6, 0xd2, 0x31, 0x63, 0x40, 0x77, 0x8c, 0xc1, 0x10, 0x41, 0x06,
2026 0xd7, 0x71, 0xb9, 0xce, 0xc1, 0xd2, 0x40, 0xf6, 0x96, 0x84, 0x86,
2027 0xfb, 0xba, 0x87, 0x32, 0x1d, 0xfd, 0x1e, 0x37, 0x8e, 0x50,
2028 },
2029 32, "DigiCert Nessie2025 Log" },
2030 { (const uint8_t[]){
2031 0xb6, 0x9d, 0xdc, 0xbc, 0x3c, 0x1a, 0xbd, 0xef, 0x6f, 0x9f, 0xd6,
2032 0x0c, 0x88, 0xb1, 0x06, 0x7b, 0x77, 0xf0, 0x82, 0x68, 0x8b, 0x2d,
2033 0x78, 0x65, 0xd0, 0x4b, 0x39, 0xab, 0xe9, 0x27, 0xa5, 0x75,
2034 },
2035 32, "DigiCert 'Wyvern2024h1' Log" },
2036 { (const uint8_t[]){
2037 0x0c, 0x2a, 0xef, 0x2c, 0x4a, 0x5b, 0x98, 0x83, 0xd4, 0xdd, 0xa3,
2038 0x82, 0xfe, 0x50, 0xfb, 0x51, 0x88, 0xb3, 0xe9, 0x73, 0x33, 0xa1,
2039 0xec, 0x53, 0xa0, 0x9d, 0xc9, 0xa7, 0x9d, 0x0d, 0x08, 0x20,
2040 },
2041 32, "DigiCert 'Wyvern2024h2' Log" },
2042 { (const uint8_t[]){
2043 0x73, 0x20, 0x22, 0x0f, 0x08, 0x16, 0x8a, 0xf9, 0xf3, 0xc4, 0xa6,
2044 0x8b, 0x0a, 0xb2, 0x6a, 0x9a, 0x4a, 0x00, 0xee, 0xf5, 0x77, 0x85,
2045 0x8a, 0x08, 0x4d, 0x05, 0x00, 0xd4, 0xa5, 0x42, 0x44, 0x59,
2046 },
2047 32, "DigiCert 'Wyvern2025h1' Log" },
2048 { (const uint8_t[]){
2049 0xed, 0x3c, 0x4b, 0xd6, 0xe8, 0x06, 0xc2, 0xa4, 0xa2, 0x00, 0x57,
2050 0xdb, 0xcb, 0x24, 0xe2, 0x38, 0x01, 0xdf, 0x51, 0x2f, 0xed, 0xc4,
2051 0x86, 0xc5, 0x70, 0x0f, 0x20, 0xdd, 0xb7, 0x3e, 0x3f, 0xe0,
2052 },
2053 32, "DigiCert 'Wyvern2025h2' Log" },
2054 { (const uint8_t[]){
2055 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
2056 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
2057 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
2058 },
2059 32, "DigiCert 'Wyvern2026h1'" },
2060 { (const uint8_t[]){
2061 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
2062 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
2063 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
2064 },
2065 32, "DigiCert 'Wyvern2026h2'" },
2066 { (const uint8_t[]){
2067 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
2068 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
2069 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
2070 },
2071 32, "DigiCert 'Wyvern2027h1'" },
2072 { (const uint8_t[]){
2073 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
2074 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
2075 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
2076 },
2077 32, "DigiCert 'Wyvern2027h2'" },
2078 { (const uint8_t[]){
2079 0xdb, 0x07, 0x6c, 0xde, 0x6a, 0x8b, 0x78, 0xec, 0x58, 0xd6, 0x05,
2080 0x64, 0x96, 0xeb, 0x6a, 0x26, 0xa8, 0xc5, 0x9e, 0x72, 0x12, 0x93,
2081 0xe8, 0xac, 0x03, 0x27, 0xdd, 0xde, 0x89, 0xdb, 0x5a, 0x2a,
2082 },
2083 32, "DigiCert 'Sphinx2024h1' Log" },
2084 { (const uint8_t[]){
2085 0xdc, 0xc9, 0x5e, 0x6f, 0xa2, 0x99, 0xb9, 0xb0, 0xfd, 0xbd, 0x6c,
2086 0xa6, 0xa3, 0x6e, 0x1d, 0x72, 0xc4, 0x21, 0x2f, 0xdd, 0x1e, 0x0f,
2087 0x47, 0x55, 0x3a, 0x36, 0xd6, 0xcf, 0x1a, 0xd1, 0x1d, 0x8d,
2088 },
2089 32, "DigiCert 'Sphinx2024h2' Log" },
2090 { (const uint8_t[]){
2091 0xde, 0x85, 0x81, 0xd7, 0x50, 0x24, 0x7c, 0x6b, 0xcd, 0xcb, 0xaf,
2092 0x56, 0x37, 0xc5, 0xe7, 0x81, 0xc6, 0x4c, 0xe4, 0x6e, 0xd6, 0x17,
2093 0x63, 0x9f, 0x8f, 0x34, 0xa7, 0x26, 0xc9, 0xe2, 0xbd, 0x37,
2094 },
2095 32, "DigiCert 'Sphinx2025h1' Log" },
2096 { (const uint8_t[]){
2097 0xa4, 0x42, 0xc5, 0x06, 0x49, 0x60, 0x61, 0x54, 0x8f, 0x0f, 0xd4,
2098 0xea, 0x9c, 0xfb, 0x7a, 0x2d, 0x26, 0x45, 0x4d, 0x87, 0xa9, 0x7f,
2099 0x2f, 0xdf, 0x45, 0x59, 0xf6, 0x27, 0x4f, 0x3a, 0x84, 0x54,
2100 },
2101 32, "DigiCert 'Sphinx2025h2' Log" },
2102 { (const uint8_t[]){
2103 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
2104 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
2105 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
2106 },
2107 32, "DigiCert 'Sphinx2026h1'" },
2108 { (const uint8_t[]){
2109 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
2110 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
2111 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
2112 },
2113 32, "DigiCert 'Sphinx2026h2'" },
2114 { (const uint8_t[]){
2115 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
2116 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
2117 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
2118 },
2119 32, "DigiCert 'sphinx2027h1'" },
2120 { (const uint8_t[]){
2121 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
2122 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
2123 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
2124 },
2125 32, "DigiCert 'sphinx2027h2'" },
2126 { (const uint8_t[]){
2127 0xdd, 0xeb, 0x1d, 0x2b, 0x7a, 0x0d, 0x4f, 0xa6, 0x20, 0x8b, 0x81,
2128 0xad, 0x81, 0x68, 0x70, 0x7e, 0x2e, 0x8e, 0x9d, 0x01, 0xd5, 0x5c,
2129 0x88, 0x8d, 0x3d, 0x11, 0xc4, 0xcd, 0xb6, 0xec, 0xbe, 0xcc,
2130 },
2131 32, "Symantec log" },
2132 { (const uint8_t[]){
2133 0xbc, 0x78, 0xe1, 0xdf, 0xc5, 0xf6, 0x3c, 0x68, 0x46, 0x49, 0x33,
2134 0x4d, 0xa1, 0x0f, 0xa1, 0x5f, 0x09, 0x79, 0x69, 0x20, 0x09, 0xc0,
2135 0x81, 0xb4, 0xf3, 0xf6, 0x91, 0x7f, 0x3e, 0xd9, 0xb8, 0xa5,
2136 },
2137 32, "Symantec 'Vega' log" },
2138 { (const uint8_t[]){
2139 0x15, 0x97, 0x04, 0x88, 0xd7, 0xb9, 0x97, 0xa0, 0x5b, 0xeb, 0x52,
2140 0x51, 0x2a, 0xde, 0xe8, 0xd2, 0xe8, 0xb4, 0xa3, 0x16, 0x52, 0x64,
2141 0x12, 0x1a, 0x9f, 0xab, 0xfb, 0xd5, 0xf8, 0x5a, 0xd9, 0x3f,
2142 },
2143 32, "Symantec 'Sirius' log" },
2144 { (const uint8_t[]){
2145 0x05, 0x9c, 0x01, 0xd3, 0x20, 0xe0, 0x07, 0x84, 0x13, 0x95, 0x80,
2146 0x49, 0x8d, 0x11, 0x7c, 0x90, 0x32, 0x66, 0xaf, 0xaf, 0x72, 0x50,
2147 0xb5, 0xaf, 0x3b, 0x46, 0xa4, 0x3e, 0x11, 0x84, 0x0d, 0x4a,
2148 },
2149 32, "DigiCert Yeti2022-2 Log" },
2150 { (const uint8_t[]){
2151 0xc1, 0x16, 0x4a, 0xe0, 0xa7, 0x72, 0xd2, 0xd4, 0x39, 0x2d, 0xc8,
2152 0x0a, 0xc1, 0x07, 0x70, 0xd4, 0xf0, 0xc4, 0x9b, 0xde, 0x99, 0x1a,
2153 0x48, 0x40, 0xc1, 0xfa, 0x07, 0x51, 0x64, 0xf6, 0x33, 0x60,
2154 },
2155 32, "DigiCert Yeti2018 Log" },
2156 { (const uint8_t[]){
2157 0xe2, 0x69, 0x4b, 0xae, 0x26, 0xe8, 0xe9, 0x40, 0x09, 0xe8, 0x86,
2158 0x1b, 0xb6, 0x3b, 0x83, 0xd4, 0x3e, 0xe7, 0xfe, 0x74, 0x88, 0xfb,
2159 0xa4, 0x8f, 0x28, 0x93, 0x01, 0x9d, 0xdd, 0xf1, 0xdb, 0xfe,
2160 },
2161 32, "DigiCert Yeti2019 Log" },
2162 { (const uint8_t[]){
2163 0x6f, 0xf1, 0x41, 0xb5, 0x64, 0x7e, 0x42, 0x22, 0xf7, 0xef, 0x05,
2164 0x2c, 0xef, 0xae, 0x7c, 0x21, 0xfd, 0x60, 0x8e, 0x27, 0xd2, 0xaf,
2165 0x5a, 0x6e, 0x9f, 0x4b, 0x8a, 0x37, 0xd6, 0x63, 0x3e, 0xe5,
2166 },
2167 32, "DigiCert Nessie2018 Log" },
2168 { (const uint8_t[]){
2169 0xfe, 0x44, 0x61, 0x08, 0xb1, 0xd0, 0x1a, 0xb7, 0x8a, 0x62, 0xcc,
2170 0xfe, 0xab, 0x6a, 0xb2, 0xb2, 0xba, 0xbf, 0xf3, 0xab, 0xda, 0xd8,
2171 0x0a, 0x4d, 0x8b, 0x30, 0xdf, 0x2d, 0x00, 0x08, 0x83, 0x0c,
2172 },
2173 32, "DigiCert Nessie2019 Log" },
2174 { (const uint8_t[]){
2175 0xa7, 0xce, 0x4a, 0x4e, 0x62, 0x07, 0xe0, 0xad, 0xde, 0xe5, 0xfd,
2176 0xaa, 0x4b, 0x1f, 0x86, 0x76, 0x87, 0x67, 0xb5, 0xd0, 0x02, 0xa5,
2177 0x5d, 0x47, 0x31, 0x0e, 0x7e, 0x67, 0x0a, 0x95, 0xea, 0xb2,
2178 },
2179 32, "Symantec Deneb" },
2180 { (const uint8_t[]){
2181 0xcd, 0xb5, 0x17, 0x9b, 0x7f, 0xc1, 0xc0, 0x46, 0xfe, 0xea, 0x31,
2182 0x13, 0x6a, 0x3f, 0x8f, 0x00, 0x2e, 0x61, 0x82, 0xfa, 0xf8, 0x89,
2183 0x6f, 0xec, 0xc8, 0xb2, 0xf5, 0xb5, 0xab, 0x60, 0x49, 0x00,
2184 },
2185 32, "Certly.IO log" },
2186 { (const uint8_t[]){
2187 0x74, 0x61, 0xb4, 0xa0, 0x9c, 0xfb, 0x3d, 0x41, 0xd7, 0x51, 0x59,
2188 0x57, 0x5b, 0x2e, 0x76, 0x49, 0xa4, 0x45, 0xa8, 0xd2, 0x77, 0x09,
2189 0xb0, 0xcc, 0x56, 0x4a, 0x64, 0x82, 0xb7, 0xeb, 0x41, 0xa3,
2190 },
2191 32, "Izenpe log" },
2192 { (const uint8_t[]){
2193 0x89, 0x41, 0x44, 0x9c, 0x70, 0x74, 0x2e, 0x06, 0xb9, 0xfc, 0x9c,
2194 0xe7, 0xb1, 0x16, 0xba, 0x00, 0x24, 0xaa, 0x36, 0xd5, 0x9a, 0xf4,
2195 0x4f, 0x02, 0x04, 0x40, 0x4f, 0x00, 0xf7, 0xea, 0x85, 0x66,
2196 },
2197 32, "Izenpe 'Argi' log" },
2198 { (const uint8_t[]){
2199 0x41, 0xb2, 0xdc, 0x2e, 0x89, 0xe6, 0x3c, 0xe4, 0xaf, 0x1b, 0xa7,
2200 0xbb, 0x29, 0xbf, 0x68, 0xc6, 0xde, 0xe6, 0xf9, 0xf1, 0xcc, 0x04,
2201 0x7e, 0x30, 0xdf, 0xfa, 0xe3, 0xb3, 0xba, 0x25, 0x92, 0x63,
2202 },
2203 32, "WoSign log" },
2204 { (const uint8_t[]){
2205 0x9e, 0x4f, 0xf7, 0x3d, 0xc3, 0xce, 0x22, 0x0b, 0x69, 0x21, 0x7c,
2206 0x89, 0x9e, 0x46, 0x80, 0x76, 0xab, 0xf8, 0xd7, 0x86, 0x36, 0xd5,
2207 0xcc, 0xfc, 0x85, 0xa3, 0x1a, 0x75, 0x62, 0x8b, 0xa8, 0x8b,
2208 },
2209 32, "WoSign CT log #1" },
2210 { (const uint8_t[]){
2211 0x63, 0xd0, 0x00, 0x60, 0x26, 0xdd, 0xe1, 0x0b, 0xb0, 0x60, 0x1f,
2212 0x45, 0x24, 0x46, 0x96, 0x5e, 0xe2, 0xb6, 0xea, 0x2c, 0xd4, 0xfb,
2213 0xc9, 0x5a, 0xc8, 0x66, 0xa5, 0x50, 0xaf, 0x90, 0x75, 0xb7,
2214 },
2215 32, "WoSign log 2" },
2216 { (const uint8_t[]){
2217 0xac, 0x3b, 0x9a, 0xed, 0x7f, 0xa9, 0x67, 0x47, 0x57, 0x15, 0x9e,
2218 0x6d, 0x7d, 0x57, 0x56, 0x72, 0xf9, 0xd9, 0x81, 0x00, 0x94, 0x1e,
2219 0x9b, 0xde, 0xff, 0xec, 0xa1, 0x31, 0x3b, 0x75, 0x78, 0x2d,
2220 },
2221 32, "Venafi log" },
2222 { (const uint8_t[]){
2223 0x03, 0x01, 0x9d, 0xf3, 0xfd, 0x85, 0xa6, 0x9a, 0x8e, 0xbd, 0x1f,
2224 0xac, 0xc6, 0xda, 0x9b, 0xa7, 0x3e, 0x46, 0x97, 0x74, 0xfe, 0x77,
2225 0xf5, 0x79, 0xfc, 0x5a, 0x08, 0xb8, 0x32, 0x8c, 0x1d, 0x6b,
2226 },
2227 32, "Venafi Gen2 CT log" },
2228 { (const uint8_t[]){
2229 0xa5, 0x77, 0xac, 0x9c, 0xed, 0x75, 0x48, 0xdd, 0x8f, 0x02, 0x5b,
2230 0x67, 0xa2, 0x41, 0x08, 0x9d, 0xf8, 0x6e, 0x0f, 0x47, 0x6e, 0xc2,
2231 0x03, 0xc2, 0xec, 0xbe, 0xdb, 0x18, 0x5f, 0x28, 0x26, 0x38,
2232 },
2233 32, "CNNIC CT log" },
2234 { (const uint8_t[]){
2235 0x34, 0xbb, 0x6a, 0xd6, 0xc3, 0xdf, 0x9c, 0x03, 0xee, 0xa8, 0xa4,
2236 0x99, 0xff, 0x78, 0x91, 0x48, 0x6c, 0x9d, 0x5e, 0x5c, 0xac, 0x92,
2237 0xd0, 0x1f, 0x7b, 0xfd, 0x1b, 0xce, 0x19, 0xdb, 0x48, 0xef,
2238 },
2239 32, "StartCom log" },
2240 { (const uint8_t[]){
2241 0x55, 0x81, 0xd4, 0xc2, 0x16, 0x90, 0x36, 0x01, 0x4a, 0xea, 0x0b,
2242 0x9b, 0x57, 0x3c, 0x53, 0xf0, 0xc0, 0xe4, 0x38, 0x78, 0x70, 0x25,
2243 0x08, 0x17, 0x2f, 0xa3, 0xaa, 0x1d, 0x07, 0x13, 0xd3, 0x0c,
2244 },
2245 32, "Sectigo 'Sabre' CT log" },
2246 { (const uint8_t[]){
2247 0xa2, 0xe2, 0xbf, 0xd6, 0x1e, 0xde, 0x2f, 0x2f, 0x07, 0xa0, 0xd6,
2248 0x4e, 0x6d, 0x37, 0xa7, 0xdc, 0x65, 0x43, 0xb0, 0xc6, 0xb5, 0x2e,
2249 0xa2, 0xda, 0xb7, 0x8a, 0xf8, 0x9a, 0x6d, 0xf5, 0x17, 0xd8,
2250 },
2251 32, "Sectigo 'Sabre2024h1'" },
2252 { (const uint8_t[]){
2253 0x19, 0x98, 0x10, 0x71, 0x09, 0xf0, 0xd6, 0x52, 0x2e, 0x30, 0x80,
2254 0xd2, 0x9e, 0x3f, 0x64, 0xbb, 0x83, 0x6e, 0x28, 0xcc, 0xf9, 0x0f,
2255 0x52, 0x8e, 0xee, 0xdf, 0xce, 0x4a, 0x3f, 0x16, 0xb4, 0xca,
2256 },
2257 32, "Sectigo 'Sabre2024h2'" },
2258 { (const uint8_t[]){
2259 0xe0, 0x92, 0xb3, 0xfc, 0x0c, 0x1d, 0xc8, 0xe7, 0x68, 0x36, 0x1f,
2260 0xde, 0x61, 0xb9, 0x96, 0x4d, 0x0a, 0x52, 0x78, 0x19, 0x8a, 0x72,
2261 0xd6, 0x72, 0xc4, 0xb0, 0x4d, 0xa5, 0x6d, 0x6f, 0x54, 0x04,
2262 },
2263 32, "Sectigo 'Sabre2025h1'" },
2264 { (const uint8_t[]){
2265 0x1a, 0x04, 0xff, 0x49, 0xd0, 0x54, 0x1d, 0x40, 0xaf, 0xf6, 0xa0,
2266 0xc3, 0xbf, 0xf1, 0xd8, 0xc4, 0x67, 0x2f, 0x4e, 0xec, 0xee, 0x23,
2267 0x40, 0x68, 0x98, 0x6b, 0x17, 0x40, 0x2e, 0xdc, 0x89, 0x7d,
2268 },
2269 32, "Sectigo 'Sabre2025h2'" },
2270 { (const uint8_t[]){
2271 0x6f, 0x53, 0x76, 0xac, 0x31, 0xf0, 0x31, 0x19, 0xd8, 0x99, 0x00,
2272 0xa4, 0x51, 0x15, 0xff, 0x77, 0x15, 0x1c, 0x11, 0xd9, 0x02, 0xc1,
2273 0x00, 0x29, 0x06, 0x8d, 0xb2, 0x08, 0x9a, 0x37, 0xd9, 0x13,
2274 },
2275 32, "Sectigo 'Mammoth' CT log" },
2276 { (const uint8_t[]){
2277 0x29, 0xd0, 0x3a, 0x1b, 0xb6, 0x74, 0xaa, 0x71, 0x1c, 0xd3, 0x03,
2278 0x5b, 0x65, 0x57, 0xc1, 0x4f, 0x8a, 0xa7, 0x8b, 0x4f, 0xe8, 0x38,
2279 0x94, 0x49, 0xec, 0xa4, 0x53, 0xf9, 0x44, 0xbd, 0x24, 0x68,
2280 },
2281 32, "Sectigo 'Mammoth2024h1'" },
2282 { (const uint8_t[]){
2283 0x50, 0x85, 0x01, 0x58, 0xdc, 0xb6, 0x05, 0x95, 0xc0, 0x0e, 0x92,
2284 0xa8, 0x11, 0x02, 0xec, 0xcd, 0xfe, 0x3f, 0x6b, 0x78, 0x58, 0x42,
2285 0x9f, 0x57, 0x98, 0x35, 0x38, 0xc9, 0xda, 0x52, 0x50, 0x63,
2286 },
2287 32, "Sectigo 'Mammoth2024h1b'" },
2288 { (const uint8_t[]){
2289 0xdf, 0xe1, 0x56, 0xeb, 0xaa, 0x05, 0xaf, 0xb5, 0x9c, 0x0f, 0x86,
2290 0x71, 0x8d, 0xa8, 0xc0, 0x32, 0x4e, 0xae, 0x56, 0xd9, 0x6e, 0xa7,
2291 0xf5, 0xa5, 0x6a, 0x01, 0xd1, 0xc1, 0x3b, 0xbe, 0x52, 0x5c,
2292 },
2293 32, "Sectigo 'Mammoth2024h2'" },
2294 { (const uint8_t[]){
2295 0x13, 0x4a, 0xdf, 0x1a, 0xb5, 0x98, 0x42, 0x09, 0x78, 0x0c, 0x6f,
2296 0xef, 0x4c, 0x7a, 0x91, 0xa4, 0x16, 0xb7, 0x23, 0x49, 0xce, 0x58,
2297 0x57, 0x6a, 0xdf, 0xae, 0xda, 0xa7, 0xc2, 0xab, 0xe0, 0x22,
2298 },
2299 32, "Sectigo 'Mammoth2025h1'" },
2300 { (const uint8_t[]){
2301 0xaf, 0x18, 0x1a, 0x28, 0xd6, 0x8c, 0xa3, 0xe0, 0xa9, 0x8a, 0x4c,
2302 0x9c, 0x67, 0xab, 0x09, 0xf8, 0xbb, 0xbc, 0x22, 0xba, 0xae, 0xbc,
2303 0xb1, 0x38, 0xa3, 0xa1, 0x9d, 0xd3, 0xf9, 0xb6, 0x03, 0x0d,
2304 },
2305 32, "Sectigo 'Mammoth2025h2'" },
2306 { (const uint8_t[]){
2307 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
2308 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
2309 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
2310 },
2311 32, "Sectigo 'Mammoth2026h1'" },
2312 { (const uint8_t[]){
2313 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
2314 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
2315 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
2316 },
2317 32, "Sectigo 'Mammoth2026h2'" },
2318 { (const uint8_t[]){
2319 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
2320 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
2321 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
2322 },
2323 32, "Sectigo 'Sabre2026h1'" },
2324 { (const uint8_t[]){
2325 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
2326 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
2327 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
2328 },
2329 32, "Sectigo 'Sabre2026h2'" },
2330 { (const uint8_t[]){
2331 0x0d, 0x1d, 0xbc, 0x89, 0x44, 0xe9, 0xf5, 0x00, 0x55, 0x42, 0xd7,
2332 0x2d, 0x3e, 0x14, 0x4c, 0xcc, 0x43, 0x08, 0x2a, 0xb6, 0xea, 0x1e,
2333 0x94, 0xdf, 0xd7, 0x06, 0x65, 0x7d, 0x2e, 0x86, 0xf3, 0x01,
2334 },
2335 32, "Sectigo 'Elephant2025h2'" },
2336 { (const uint8_t[]){
2337 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
2338 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
2339 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
2340 },
2341 32, "Sectigo 'Elephant2026h1'" },
2342 { (const uint8_t[]){
2343 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
2344 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
2345 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
2346 },
2347 32, "Sectigo 'Elephant2026h2'" },
2348 { (const uint8_t[]){
2349 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
2350 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
2351 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
2352 },
2353 32, "Sectigo 'Elephant2027h1'" },
2354 { (const uint8_t[]){
2355 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
2356 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
2357 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
2358 },
2359 32, "Sectigo 'Elephant2027h2'" },
2360 { (const uint8_t[]){
2361 0x5c, 0xa5, 0x77, 0xd2, 0x9b, 0x7f, 0x8b, 0xaf, 0x41, 0x9e, 0xd8,
2362 0xec, 0xab, 0xfb, 0x6d, 0xcb, 0xae, 0xc3, 0x85, 0x37, 0x02, 0xd5,
2363 0x74, 0x6f, 0x17, 0x4d, 0xad, 0x3c, 0x93, 0x4a, 0xa9, 0x6a,
2364 },
2365 32, "Sectigo 'Tiger2025h2'" },
2366 { (const uint8_t[]){
2367 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
2368 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
2369 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
2370 },
2371 32, "Sectigo 'Tiger2026h1'" },
2372 { (const uint8_t[]){
2373 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
2374 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
2375 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
2376 },
2377 32, "Sectigo 'Tiger2026h2'" },
2378 { (const uint8_t[]){
2379 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
2380 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
2381 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
2382 },
2383 32, "Sectigo 'Tiger2027h1'" },
2384 { (const uint8_t[]){
2385 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
2386 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
2387 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
2388 },
2389 32, "Sectigo 'Tiger2027h2'" },
2390 { (const uint8_t[]){
2391 0xdb, 0x76, 0xfd, 0xad, 0xac, 0x65, 0xe7, 0xd0, 0x95, 0x08, 0x88,
2392 0x6e, 0x21, 0x59, 0xbd, 0x8b, 0x90, 0x35, 0x2f, 0x5f, 0xea, 0xd3,
2393 0xe3, 0xdc, 0x5e, 0x22, 0xeb, 0x35, 0x0a, 0xcc, 0x7b, 0x98,
2394 },
2395 32, "Sectigo 'Dodo' CT log" },
2396 { (const uint8_t[]){
2397 0xe7, 0x12, 0xf2, 0xb0, 0x37, 0x7e, 0x1a, 0x62, 0xfb, 0x8e, 0xc9,
2398 0x0c, 0x61, 0x84, 0xf1, 0xea, 0x7b, 0x37, 0xcb, 0x56, 0x1d, 0x11,
2399 0x26, 0x5b, 0xf3, 0xe0, 0xf3, 0x4b, 0xf2, 0x41, 0x54, 0x6e,
2400 },
2401 32, "Let's Encrypt 'Oak2020' log" },
2402 { (const uint8_t[]){
2403 0x94, 0x20, 0xbc, 0x1e, 0x8e, 0xd5, 0x8d, 0x6c, 0x88, 0x73, 0x1f,
2404 0x82, 0x8b, 0x22, 0x2c, 0x0d, 0xd1, 0xda, 0x4d, 0x5e, 0x6c, 0x4f,
2405 0x94, 0x3d, 0x61, 0xdb, 0x4e, 0x2f, 0x58, 0x4d, 0xa2, 0xc2,
2406 },
2407 32, "Let's Encrypt 'Oak2021' log" },
2408 { (const uint8_t[]){
2409 0xdf, 0xa5, 0x5e, 0xab, 0x68, 0x82, 0x4f, 0x1f, 0x6c, 0xad, 0xee,
2410 0xb8, 0x5f, 0x4e, 0x3e, 0x5a, 0xea, 0xcd, 0xa2, 0x12, 0xa4, 0x6a,
2411 0x5e, 0x8e, 0x3b, 0x12, 0xc0, 0x20, 0x44, 0x5c, 0x2a, 0x73,
2412 },
2413 32, "Let's Encrypt 'Oak2022' log" },
2414 { (const uint8_t[]){
2415 0xb7, 0x3e, 0xfb, 0x24, 0xdf, 0x9c, 0x4d, 0xba, 0x75, 0xf2, 0x39,
2416 0xc5, 0xba, 0x58, 0xf4, 0x6c, 0x5d, 0xfc, 0x42, 0xcf, 0x7a, 0x9f,
2417 0x35, 0xc4, 0x9e, 0x1d, 0x09, 0x81, 0x25, 0xed, 0xb4, 0x99,
2418 },
2419 32, "Let's Encrypt 'Oak2023' log" },
2420 { (const uint8_t[]){
2421 0x3b, 0x53, 0x77, 0x75, 0x3e, 0x2d, 0xb9, 0x80, 0x4e, 0x8b, 0x30,
2422 0x5b, 0x06, 0xfe, 0x40, 0x3b, 0x67, 0xd8, 0x4f, 0xc3, 0xf4, 0xc7,
2423 0xbd, 0x00, 0x0d, 0x2d, 0x72, 0x6f, 0xe1, 0xfa, 0xd4, 0x17,
2424 },
2425 32, "Let's Encrypt 'Oak2024H1' log" },
2426 { (const uint8_t[]){
2427 0x3f, 0x17, 0x4b, 0x4f, 0xd7, 0x22, 0x47, 0x58, 0x94, 0x1d, 0x65,
2428 0x1c, 0x84, 0xbe, 0x0d, 0x12, 0xed, 0x90, 0x37, 0x7f, 0x1f, 0x85,
2429 0x6a, 0xeb, 0xc1, 0xbf, 0x28, 0x85, 0xec, 0xf8, 0x64, 0x6e,
2430 },
2431 32, "Let's Encrypt 'Oak2024H2' log" },
2432 { (const uint8_t[]){
2433 0xa2, 0xe3, 0x0a, 0xe4, 0x45, 0xef, 0xbd, 0xad, 0x9b, 0x7e, 0x38,
2434 0xed, 0x47, 0x67, 0x77, 0x53, 0xd7, 0x82, 0x5b, 0x84, 0x94, 0xd7,
2435 0x2b, 0x5e, 0x1b, 0x2c, 0xc4, 0xb9, 0x50, 0xa4, 0x47, 0xe7,
2436 },
2437 32, "Let's Encrypt 'Oak2025h1'" },
2438 { (const uint8_t[]){
2439 0x0d, 0xe1, 0xf2, 0x30, 0x2b, 0xd3, 0x0d, 0xc1, 0x40, 0x62, 0x12,
2440 0x09, 0xea, 0x55, 0x2e, 0xfc, 0x47, 0x74, 0x7c, 0xb1, 0xd7, 0xe9,
2441 0x30, 0xef, 0x0e, 0x42, 0x1e, 0xb4, 0x7e, 0x4e, 0xaa, 0x34,
2442 },
2443 32, "Let's Encrypt 'Oak2025h2'" },
2444 { (const uint8_t[]){
2445 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
2446 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
2447 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
2448 },
2449 32, "Let's Encrypt 'Oak2026h1'" },
2450 { (const uint8_t[]){
2451 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
2452 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
2453 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
2454 },
2455 32, "Let's Encrypt 'Oak2026h2'" },
2456 { (const uint8_t[]){
2457 0x65, 0x9b, 0x33, 0x50, 0xf4, 0x3b, 0x12, 0xcc, 0x5e, 0xa5, 0xab,
2458 0x4e, 0xc7, 0x65, 0xd3, 0xfd, 0xe6, 0xc8, 0x82, 0x43, 0x77, 0x77,
2459 0x78, 0xe7, 0x20, 0x03, 0xf9, 0xeb, 0x2b, 0x8c, 0x31, 0x29,
2460 },
2461 32, "Let's Encrypt 'Oak2019' log" },
2462 { (const uint8_t[]){
2463 0x84, 0x9f, 0x5f, 0x7f, 0x58, 0xd2, 0xbf, 0x7b, 0x54, 0xec, 0xbd,
2464 0x74, 0x61, 0x1c, 0xea, 0x45, 0xc4, 0x9c, 0x98, 0xf1, 0xd6, 0x48,
2465 0x1b, 0xc6, 0xf6, 0x9e, 0x8c, 0x17, 0x4f, 0x24, 0xf3, 0xcf,
2466 },
2467 32, "Let's Encrypt 'Testflume2019' log" },
2468 { (const uint8_t[]){
2469 0x23, 0x2d, 0x41, 0xa4, 0xcd, 0xac, 0x87, 0xce, 0xd9, 0xf9, 0x43,
2470 0xf4, 0x68, 0xc2, 0x82, 0x09, 0x5a, 0xe0, 0x9d, 0x30, 0xd6, 0x2e,
2471 0x2f, 0xa6, 0x5d, 0xdc, 0x3b, 0x91, 0x9c, 0x2e, 0x46, 0x8f,
2472 },
2473 32, "Let's Encrypt 'Sapling 2022h2' log" },
2474 { (const uint8_t[]){
2475 0xc1, 0x83, 0x24, 0x0b, 0xf1, 0xa4, 0x50, 0xc7, 0x6f, 0xbb, 0x00,
2476 0x72, 0x69, 0xdc, 0xac, 0x3b, 0xe2, 0x2a, 0x48, 0x05, 0xd4, 0xdb,
2477 0xe0, 0x49, 0x66, 0xc3, 0xc8, 0xab, 0xc4, 0x47, 0xb0, 0x0c,
2478 },
2479 32, "Let's Encrypt 'Sapling 2023h1' log" },
2480 { (const uint8_t[]){
2481 0xc6, 0x3f, 0x22, 0x18, 0xc3, 0x7d, 0x56, 0xa6, 0xaa, 0x06, 0xb5,
2482 0x96, 0xda, 0x8e, 0x53, 0xd4, 0xd7, 0x15, 0x6d, 0x1e, 0x9b, 0xac,
2483 0x8e, 0x44, 0xd2, 0x20, 0x2d, 0xe6, 0x4d, 0x69, 0xd9, 0xdc,
2484 },
2485 32, "Let's Encrypt 'Testflume2020' log" },
2486 { (const uint8_t[]){
2487 0x03, 0xed, 0xf1, 0xda, 0x97, 0x76, 0xb6, 0xf3, 0x8c, 0x34, 0x1e,
2488 0x39, 0xed, 0x9d, 0x70, 0x7a, 0x75, 0x70, 0x36, 0x9c, 0xf9, 0x84,
2489 0x4f, 0x32, 0x7f, 0xe9, 0xe1, 0x41, 0x38, 0x36, 0x1b, 0x60,
2490 },
2491 32, "Let's Encrypt 'Testflume2021' log" },
2492 { (const uint8_t[]){
2493 0x23, 0x27, 0xef, 0xda, 0x35, 0x25, 0x10, 0xdb, 0xc0, 0x19, 0xef,
2494 0x49, 0x1a, 0xe3, 0xff, 0x1c, 0xc5, 0xa4, 0x79, 0xbc, 0xe3, 0x78,
2495 0x78, 0x36, 0x0e, 0xe3, 0x18, 0xcf, 0xfb, 0x64, 0xf8, 0xc8,
2496 },
2497 32, "Let's Encrypt 'Testflume2022' log" },
2498 { (const uint8_t[]){
2499 0x55, 0x34, 0xb7, 0xab, 0x5a, 0x6a, 0xc3, 0xa7, 0xcb, 0xeb, 0xa6,
2500 0x54, 0x87, 0xb2, 0xa2, 0xd7, 0x1b, 0x48, 0xf6, 0x50, 0xfa, 0x17,
2501 0xc5, 0x19, 0x7c, 0x97, 0xa0, 0xcb, 0x20, 0x76, 0xf3, 0xc6,
2502 },
2503 32, "Let's Encrypt 'Testflume2023' log" },
2504 { (const uint8_t[]){
2505 0x29, 0x6a, 0xfa, 0x2d, 0x56, 0x8b, 0xca, 0x0d, 0x2e, 0xa8, 0x44,
2506 0x95, 0x6a, 0xe9, 0x72, 0x1f, 0xc3, 0x5f, 0xa3, 0x55, 0xec, 0xda,
2507 0x99, 0x69, 0x3a, 0xaf, 0xd4, 0x58, 0xa7, 0x1a, 0xef, 0xdd,
2508 },
2509 32, "Let's Encrypt 'Clicky' log" },
2510 { (const uint8_t[]){
2511 0xa5, 0x95, 0x94, 0x3b, 0x53, 0x70, 0xbe, 0xe9, 0x06, 0xe0, 0x05,
2512 0x0d, 0x1f, 0xb5, 0xbb, 0xc6, 0xa4, 0x0e, 0x65, 0xf2, 0x65, 0xae,
2513 0x85, 0x2c, 0x76, 0x36, 0x3f, 0xad, 0xb2, 0x33, 0x36, 0xed,
2514 },
2515 32, "Trust Asia Log2020" },
2516 { (const uint8_t[]){
2517 0xa8, 0xdc, 0x52, 0xf6, 0x3d, 0x6b, 0x24, 0x25, 0xe5, 0x31, 0xe3,
2518 0x7c, 0xf4, 0xe4, 0x4a, 0x71, 0x4f, 0x14, 0x2a, 0x20, 0x80, 0x3b,
2519 0x0d, 0x04, 0xd2, 0xe2, 0xee, 0x06, 0x64, 0x79, 0x4a, 0x23,
2520 },
2521 32, "Trust Asia CT2021" },
2522 { (const uint8_t[]){
2523 0x67, 0x8d, 0xb6, 0x5b, 0x3e, 0x74, 0x43, 0xb6, 0xf3, 0xa3, 0x70,
2524 0xd5, 0xe1, 0x3a, 0xb1, 0xb4, 0x3b, 0xe0, 0xa0, 0xd3, 0x51, 0xf7,
2525 0xca, 0x74, 0x22, 0x50, 0xc7, 0xc6, 0xfa, 0x51, 0xa8, 0x8a,
2526 },
2527 32, "Trust Asia Log2021" },
2528 { (const uint8_t[]){
2529 0xc3, 0x65, 0xf9, 0xb3, 0x65, 0x4f, 0x32, 0x83, 0xc7, 0x9d, 0xa9,
2530 0x8e, 0x93, 0xd7, 0x41, 0x8f, 0x5b, 0xab, 0x7b, 0xe3, 0x25, 0x2c,
2531 0x98, 0xe1, 0xd2, 0xf0, 0x4b, 0xb9, 0xeb, 0x42, 0x7d, 0x23,
2532 },
2533 32, "Trust Asia Log2022" },
2534 { (const uint8_t[]){
2535 0xe8, 0x7e, 0xa7, 0x66, 0x0b, 0xc2, 0x6c, 0xf6, 0x00, 0x2e, 0xf5,
2536 0x72, 0x5d, 0x3f, 0xe0, 0xe3, 0x31, 0xb9, 0x39, 0x3b, 0xb9, 0x2f,
2537 0xbf, 0x58, 0xeb, 0x3b, 0x90, 0x49, 0xda, 0xf5, 0x43, 0x5a,
2538 },
2539 32, "Trust Asia Log2023" },
2540 { (const uint8_t[]){
2541 0x30, 0x6d, 0x29, 0x57, 0x6a, 0xd2, 0x1a, 0x9d, 0x4a, 0xe1, 0x2a,
2542 0xca, 0xd8, 0xaa, 0x8a, 0x78, 0x3a, 0xa6, 0x5a, 0x32, 0x11, 0x60,
2543 0xac, 0xff, 0x5b, 0x0e, 0xee, 0x4c, 0xa3, 0x20, 0x1d, 0x05,
2544 },
2545 32, "Trust Asia Log2024" },
2546 { (const uint8_t[]){
2547 0x87, 0x4f, 0xb5, 0x0d, 0xc0, 0x29, 0xd9, 0x93, 0x1d, 0xe5, 0x73,
2548 0xe9, 0xf2, 0x89, 0x9e, 0x8e, 0x45, 0x33, 0xb3, 0x92, 0xd3, 0x8b,
2549 0x0a, 0x46, 0x25, 0x74, 0xbf, 0x0f, 0xee, 0xb2, 0xfc, 0x1e,
2550 },
2551 32, "Trust Asia Log2024-2" },
2552 { (const uint8_t[]){
2553 0x28, 0xe2, 0x81, 0x38, 0xfd, 0x83, 0x21, 0x45, 0xe9, 0xa9, 0xd6,
2554 0xaa, 0x75, 0x37, 0x6d, 0x83, 0x77, 0xa8, 0x85, 0x12, 0xb3, 0xc0,
2555 0x7f, 0x72, 0x41, 0x48, 0x21, 0xdc, 0xbd, 0xe9, 0x8c, 0x66,
2556 },
2557 32, "TrustAsia Log2025a" },
2558 { (const uint8_t[]){
2559 0x28, 0x2c, 0x8b, 0xdd, 0x81, 0x0f, 0xf9, 0x09, 0x12, 0x0a, 0xce,
2560 0x16, 0xd6, 0xe0, 0xec, 0x20, 0x1b, 0xea, 0x82, 0xa3, 0xa4, 0xaf,
2561 0x19, 0xd9, 0xef, 0xfb, 0x59, 0xe8, 0x3f, 0xdc, 0x42, 0x68,
2562 },
2563 32, "TrustAsia Log2025b" },
2564 { (const uint8_t[]){
2565 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
2566 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
2567 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
2568 },
2569 32, "TrustAsia 'log2026a'" },
2570 { (const uint8_t[]){
2571 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
2572 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
2573 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
2574 },
2575 32, "TrustAsia 'log2026b'" },
2576 { (const uint8_t[]){
2577 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
2578 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
2579 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
2580 },
2581 32, "TrustAsia 'HETU2027'" },
2582 { (const uint8_t[]){
2583 0x45, 0x35, 0x94, 0x98, 0xd9, 0x3a, 0x89, 0xe0, 0x28, 0x03, 0x08,
2584 0xd3, 0x7d, 0x62, 0x6d, 0xc4, 0x23, 0x75, 0x47, 0x58, 0xdc, 0xe0,
2585 0x37, 0x00, 0x36, 0xfb, 0xab, 0x0e, 0xdf, 0x8a, 0x6b, 0xcf,
2586 },
2587 32, "Trust Asia Log1" },
2588 { (const uint8_t[]){
2589 0xc9, 0xcf, 0x89, 0x0a, 0x21, 0x10, 0x9c, 0x66, 0x6c, 0xc1, 0x7a,
2590 0x3e, 0xd0, 0x65, 0xc9, 0x30, 0xd0, 0xe0, 0x13, 0x5a, 0x9f, 0xeb,
2591 0xa8, 0x5a, 0xf1, 0x42, 0x10, 0xb8, 0x07, 0x24, 0x21, 0xaa,
2592 },
2593 32, "GDCA CT log #1" },
2594 { (const uint8_t[]){
2595 0x92, 0x4a, 0x30, 0xf9, 0x09, 0x33, 0x6f, 0xf4, 0x35, 0xd6, 0x99,
2596 0x3a, 0x10, 0xac, 0x75, 0xa2, 0xc6, 0x41, 0x72, 0x8e, 0x7f, 0xc2,
2597 0xd6, 0x59, 0xae, 0x61, 0x88, 0xff, 0xad, 0x40, 0xce, 0x01,
2598 },
2599 32, "GDCA CT log #2" },
2600 { (const uint8_t[]){
2601 0x71, 0x7e, 0xa7, 0x42, 0x09, 0x75, 0xbe, 0x84, 0xa2, 0x72, 0x35,
2602 0x53, 0xf1, 0x77, 0x7c, 0x26, 0xdd, 0x51, 0xaf, 0x4e, 0x10, 0x21,
2603 0x44, 0x09, 0x4d, 0x90, 0x19, 0xb4, 0x62, 0xfb, 0x66, 0x68,
2604 },
2605 32, "GDCA Log 1" },
2606 { (const uint8_t[]){
2607 0x14, 0x30, 0x8d, 0x90, 0xcc, 0xd0, 0x30, 0x13, 0x50, 0x05, 0xc0,
2608 0x1c, 0xa5, 0x26, 0xd8, 0x1e, 0x84, 0xe8, 0x76, 0x24, 0xe3, 0x9b,
2609 0x62, 0x48, 0xe0, 0x8f, 0x72, 0x4a, 0xea, 0x3b, 0xb4, 0x2a,
2610 },
2611 32, "GDCA Log 2" },
2612 { (const uint8_t[]){
2613 0xe0, 0x12, 0x76, 0x29, 0xe9, 0x04, 0x96, 0x56, 0x4e, 0x3d, 0x01,
2614 0x47, 0x98, 0x44, 0x98, 0xaa, 0x48, 0xf8, 0xad, 0xb1, 0x66, 0x00,
2615 0xeb, 0x79, 0x02, 0xa1, 0xef, 0x99, 0x09, 0x90, 0x62, 0x73,
2616 },
2617 32, "PuChuangSiDa CT log" },
2618 { (const uint8_t[]){
2619 0x53, 0x7b, 0x69, 0xa3, 0x56, 0x43, 0x35, 0xa9, 0xc0, 0x49, 0x04,
2620 0xe3, 0x95, 0x93, 0xb2, 0xc2, 0x98, 0xeb, 0x8d, 0x7a, 0x6e, 0x83,
2621 0x02, 0x36, 0x35, 0xc6, 0x27, 0x24, 0x8c, 0xd6, 0xb4, 0x40,
2622 },
2623 32, "Nordu 'flimsy' log" },
2624 { (const uint8_t[]){
2625 0xaa, 0xe7, 0x0b, 0x7f, 0x3c, 0xb8, 0xd5, 0x66, 0xc8, 0x6c, 0x2f,
2626 0x16, 0x97, 0x9c, 0x9f, 0x44, 0x5f, 0x69, 0xab, 0x0e, 0xb4, 0x53,
2627 0x55, 0x89, 0xb2, 0xf7, 0x7a, 0x03, 0x01, 0x04, 0xf3, 0xcd,
2628 },
2629 32, "Nordu 'plausible' log" },
2630 { (const uint8_t[]){
2631 0xcf, 0x55, 0xe2, 0x89, 0x23, 0x49, 0x7c, 0x34, 0x0d, 0x52, 0x06,
2632 0xd0, 0x53, 0x53, 0xae, 0xb2, 0x58, 0x34, 0xb5, 0x2f, 0x1f, 0x8d,
2633 0xc9, 0x52, 0x68, 0x09, 0xf2, 0x12, 0xef, 0xdd, 0x7c, 0xa6,
2634 },
2635 32, "SHECA CT log 1" },
2636 { (const uint8_t[]){
2637 0x32, 0xdc, 0x59, 0xc2, 0xd4, 0xc4, 0x19, 0x68, 0xd5, 0x6e, 0x14,
2638 0xbc, 0x61, 0xac, 0x8f, 0x0e, 0x45, 0xdb, 0x39, 0xfa, 0xf3, 0xc1,
2639 0x55, 0xaa, 0x42, 0x52, 0xf5, 0x00, 0x1f, 0xa0, 0xc6, 0x23,
2640 },
2641 32, "SHECA CT log 2" },
2642 { (const uint8_t[]){
2643 0x96, 0x06, 0xc0, 0x2c, 0x69, 0x00, 0x33, 0xaa, 0x1d, 0x14, 0x5f,
2644 0x59, 0xc6, 0xe2, 0x64, 0x8d, 0x05, 0x49, 0xf0, 0xdf, 0x96, 0xaa,
2645 0xb8, 0xdb, 0x91, 0x5a, 0x70, 0xd8, 0xec, 0xf3, 0x90, 0xa5,
2646 },
2647 32, "Akamai CT Log" },
2648 { (const uint8_t[]){
2649 0x39, 0x37, 0x6f, 0x54, 0x5f, 0x7b, 0x46, 0x07, 0xf5, 0x97, 0x42,
2650 0xd7, 0x68, 0xcd, 0x5d, 0x24, 0x37, 0xbf, 0x34, 0x73, 0xb6, 0x53,
2651 0x4a, 0x48, 0x34, 0xbc, 0xf7, 0x2e, 0x68, 0x1c, 0x83, 0xc9,
2652 },
2653 32, "Alpha CT Log" },
2654 { (const uint8_t[]){
2655 0xb0, 0xb7, 0x84, 0xbc, 0x81, 0xc0, 0xdd, 0xc4, 0x75, 0x44, 0xe8,
2656 0x83, 0xf0, 0x59, 0x85, 0xbb, 0x90, 0x77, 0xd1, 0x34, 0xd8, 0xab,
2657 0x88, 0xb2, 0xb2, 0xe5, 0x33, 0x98, 0x0b, 0x8e, 0x50, 0x8b,
2658 },
2659 32, "Up In The Air 'Behind the Sofa' log" },
2660 { (const uint8_t[]){
2661 0x47, 0x44, 0x47, 0x7c, 0x75, 0xde, 0x42, 0x6d, 0x5c, 0x44, 0xef,
2662 0xd4, 0xa9, 0x2c, 0x96, 0x77, 0x59, 0x7f, 0x65, 0x7a, 0x8f, 0xe0,
2663 0xca, 0xdb, 0xc6, 0xd6, 0x16, 0xed, 0xa4, 0x97, 0xc4, 0x25,
2664 },
2665 32, "Qihoo 360 2020" },
2666 { (const uint8_t[]){
2667 0xc6, 0xd7, 0xed, 0x9e, 0xdb, 0x8e, 0x74, 0xf0, 0xa7, 0x1b, 0x4d,
2668 0x4a, 0x98, 0x4b, 0xcb, 0xeb, 0xab, 0xbd, 0x28, 0xcc, 0x1f, 0xd7,
2669 0x63, 0x29, 0xe8, 0x87, 0x26, 0xcd, 0x4c, 0x25, 0x46, 0x63,
2670 },
2671 32, "Qihoo 360 2021" },
2672 { (const uint8_t[]){
2673 0x66, 0x3c, 0xb0, 0x9c, 0x1f, 0xcd, 0x9b, 0xaa, 0x62, 0x76, 0x3c,
2674 0xcb, 0x53, 0x4e, 0xec, 0x80, 0x58, 0x12, 0x28, 0x05, 0x07, 0xac,
2675 0x69, 0xa4, 0x5f, 0xcd, 0x38, 0xcf, 0x4c, 0xc7, 0x4c, 0xf1,
2676 },
2677 32, "Qihoo 360 2022" },
2678 { (const uint8_t[]){
2679 0xe2, 0x64, 0x7f, 0x6e, 0xda, 0x34, 0x05, 0x03, 0xc6, 0x4d, 0x4e,
2680 0x10, 0xa8, 0x69, 0x68, 0x1f, 0xde, 0x9c, 0x5a, 0x2c, 0xf3, 0xb3,
2681 0x2d, 0x5f, 0x20, 0x0b, 0x96, 0x36, 0x05, 0x90, 0x88, 0x23,
2682 },
2683 32, "Qihoo 360 2023" },
2684 { (const uint8_t[]){
2685 0xc5, 0xcf, 0xe5, 0x4b, 0x61, 0x51, 0xb4, 0x9b, 0x14, 0x2e, 0xd2,
2686 0x63, 0xbd, 0xe7, 0x32, 0x93, 0x36, 0x37, 0x99, 0x79, 0x95, 0x50,
2687 0xae, 0x44, 0x35, 0xcd, 0x1a, 0x69, 0x97, 0xc9, 0xc3, 0xc3,
2688 },
2689 32, "Qihoo 360 v1 2020" },
2690 { (const uint8_t[]){
2691 0x48, 0x14, 0x58, 0x7c, 0xf2, 0x8b, 0x08, 0xfe, 0x68, 0x3f, 0xd2,
2692 0xbc, 0xd9, 0x45, 0x99, 0x4c, 0x2e, 0xb7, 0x4c, 0x8a, 0xe8, 0xc8,
2693 0x7f, 0xce, 0x42, 0x9b, 0x7c, 0xd3, 0x1d, 0x51, 0xbd, 0xc4,
2694 },
2695 32, "Qihoo 360 v1 2021" },
2696 { (const uint8_t[]){
2697 0x49, 0x11, 0xb8, 0xd6, 0x14, 0xcf, 0xd3, 0xd9, 0x9f, 0x16, 0xd3,
2698 0x76, 0x54, 0x5e, 0xe1, 0xb8, 0xcc, 0xfc, 0x51, 0x1f, 0x50, 0x9f,
2699 0x08, 0x0b, 0xa0, 0xa0, 0x87, 0xd9, 0x1d, 0xfa, 0xee, 0xa9,
2700 },
2701 32, "Qihoo 360 v1 2022" },
2702 { (const uint8_t[]){
2703 0xb6, 0x74, 0x0b, 0x12, 0x00, 0x2e, 0x03, 0x3f, 0xd0, 0xe7, 0xe9,
2704 0x41, 0xf4, 0xba, 0x3e, 0xe1, 0xbf, 0xc1, 0x49, 0xb5, 0x24, 0xb4,
2705 0xcf, 0x62, 0x8d, 0x53, 0xef, 0xea, 0x1f, 0x40, 0x3a, 0x8d,
2706 },
2707 32, "Qihoo 360 v1 2023" },
2708 { (const uint8_t[]){
2709 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
2710 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
2711 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
2712 },
2713 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
2714 { (const uint8_t[]){
2715 0x39, 0xb9, 0x87, 0x88, 0x28, 0x19, 0x5f, 0x3b, 0x2d, 0x0d, 0x1b,
2716 0x48, 0x14, 0xa3, 0xae, 0x8c, 0x0d, 0x01, 0xfe, 0x48, 0x62, 0x21,
2717 0xdd, 0x69, 0x39, 0x7d, 0x76, 0xf7, 0x85, 0x74, 0x11, 0xc3,
2718 },
2719 32, "Merklemap 'CompactLog' log" },
2720 { (const uint8_t[]){
2721 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
2722 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
2723 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
2724 },
2725 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
2726 { NULL((void*)0), 0, NULL((void*)0) }
2727};
2728
2729/*
2730 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
2731 */
2732static dissector_table_t ssl_alpn_dissector_table;
2733static dissector_table_t dtls_alpn_dissector_table;
2734
2735/*
2736 * Special cases for prefix matching of the ALPN, if the ALPN includes
2737 * a version number for a draft or protocol revision.
2738 */
2739typedef struct ssl_alpn_prefix_match_protocol {
2740 const char *proto_prefix;
2741 const char *dissector_name;
2742} ssl_alpn_prefix_match_protocol_t;
2743
2744static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
2745 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
2746 * already exists 3.1 as of this writing... match the prefix. */
2747 { "spdy/", "spdy" },
2748 /* draft-ietf-httpbis-http2-16 */
2749 { "h2-", "http2" }, /* draft versions */
2750};
2751
2752const value_string compress_certificate_algorithm_vals[] = {
2753 { 1, "zlib" },
2754 { 2, "brotli" },
2755 { 3, "zstd" },
2756 { 0, NULL((void*)0) }
2757};
2758
2759
2760const val64_string quic_transport_parameter_id[] = {
2761 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
2762 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
2763 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
2764 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
2765 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
2766 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
2767 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
2768 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
2769 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
2770 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
2771 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
2772 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
2773 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
2774 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
2775 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
2776 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
2777 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
2778 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
2779 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
2780 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
2781 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
2782 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
2783 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
2784 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
2785 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
2786 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
2787 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
2788 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
2789 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
2790 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
2791 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
2792 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
2793 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
2794 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
2795 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
2796 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
2797 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
2798 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
2799 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
2800 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
2801 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
2802 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
2803 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
2804 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
2805 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
2806 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
2807 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
2808 { 0, NULL((void*)0) }
2809};
2810
2811/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
2812const val64_string quic_address_discovery_vals[] = {
2813 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
2814 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
2815 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
2816 { 0, NULL((void*)0) }
2817};
2818
2819/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
2820const val64_string quic_enable_time_stamp_v2_vals[] = {
2821 { 1, "I would like to receive TIME_STAMP frames" },
2822 { 2, "I am able to generate TIME_STAMP frames" },
2823 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
2824 { 0, NULL((void*)0) }
2825};
2826
2827/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
2828const val64_string quic_enable_multipath_vals[] = {
2829 { 0, "don't support multipath" },
2830 { 1, "support multipath as defined in this document" },
2831 { 0, NULL((void*)0) }
2832};
2833
2834/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2835const value_string tls_hello_ext_ech_clienthello_types[] = {
2836 { 0, "Outer Client Hello" },
2837 { 1, "Inner Client Hello" },
2838 { 0, NULL((void*)0) }
2839};
2840
2841/* RFC 9180 */
2842const value_string kem_id_type_vals[] = {
2843 { 0x0000, "Reserved" },
2844 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2845 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2846 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2847 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2848 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2849 { 0, NULL((void*)0) }
2850};
2851const value_string kdf_id_type_vals[] = {
2852 { 0x0000, "Reserved" },
2853 { 0x0001, "HKDF-SHA256" },
2854 { 0x0002, "HKDF-SHA384" },
2855 { 0x0003, "HKDF-SHA512" },
2856 { 0, NULL((void*)0) }
2857};
2858const value_string aead_id_type_vals[] = {
2859 { 0x0000, "Reserved" },
2860 { 0x0001, "AES-128-GCM" },
2861 { 0x0002, "AES-256-GCM" },
2862 { 0x0003, "ChaCha20Poly1305" },
2863 { 0xFFFF, "Export-only" },
2864 { 0, NULL((void*)0) }
2865};
2866
2867const value_string token_binding_key_parameter_vals[] = {
2868 { 0, "rsa2048_pkcs1.5" },
2869 { 1, "rsa2048_pss" },
2870 { 2, "ecdsap256" },
2871 { 0, NULL((void*)0) }
2872};
2873
2874/* Lookup tables }}} */
2875
2876void
2877quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2878{
2879 const char *label;
2880 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2881 label = "GREASE";
2882 } else {
2883 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2884 }
2885 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2886}
2887
2888/* we keep this internal to packet-tls-utils, as there should be
2889 no need to access it any other way.
2890
2891 This also allows us to hide the dependency on zlib.
2892*/
2893struct _SslDecompress {
2894 int compression;
2895#ifdef USE_ZLIB_OR_ZLIBNG
2896 zlib_stream istream;
2897#endif
2898};
2899
2900/* To assist in parsing client/server key exchange messages
2901 0 indicates unknown */
2902int ssl_get_keyex_alg(int cipher)
2903{
2904 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2905 switch(cipher) {
2906 case 0x0017:
2907 case 0x0018:
2908 case 0x0019:
2909 case 0x001a:
2910 case 0x001b:
2911 case 0x0034:
2912 case 0x003a:
2913 case 0x0046:
2914 case 0x006c:
2915 case 0x006d:
2916 case 0x0089:
2917 case 0x009b:
2918 case 0x00a6:
2919 case 0x00a7:
2920 case 0x00bf:
2921 case 0x00c5:
2922 case 0xc084:
2923 case 0xc085:
2924 return KEX_DH_ANON0x13;
2925 case 0x000b:
2926 case 0x000c:
2927 case 0x000d:
2928 case 0x0030:
2929 case 0x0036:
2930 case 0x003e:
2931 case 0x0042:
2932 case 0x0068:
2933 case 0x0085:
2934 case 0x0097:
2935 case 0x00a4:
2936 case 0x00a5:
2937 case 0x00bb:
2938 case 0x00c1:
2939 case 0xc082:
2940 case 0xc083:
2941 return KEX_DH_DSS0x14;
2942 case 0x000e:
2943 case 0x000f:
2944 case 0x0010:
2945 case 0x0031:
2946 case 0x0037:
2947 case 0x003f:
2948 case 0x0043:
2949 case 0x0069:
2950 case 0x0086:
2951 case 0x0098:
2952 case 0x00a0:
2953 case 0x00a1:
2954 case 0x00bc:
2955 case 0x00c2:
2956 case 0xc07e:
2957 case 0xc07f:
2958 return KEX_DH_RSA0x15;
2959 case 0x0011:
2960 case 0x0012:
2961 case 0x0013:
2962 case 0x0032:
2963 case 0x0038:
2964 case 0x0040:
2965 case 0x0044:
2966 case 0x0063:
2967 case 0x0065:
2968 case 0x0066:
2969 case 0x006a:
2970 case 0x0087:
2971 case 0x0099:
2972 case 0x00a2:
2973 case 0x00a3:
2974 case 0x00bd:
2975 case 0x00c3:
2976 case 0xc080:
2977 case 0xc081:
2978 return KEX_DHE_DSS0x10;
2979 case 0x002d:
2980 case 0x008e:
2981 case 0x008f:
2982 case 0x0090:
2983 case 0x0091:
2984 case 0x00aa:
2985 case 0x00ab:
2986 case 0x00b2:
2987 case 0x00b3:
2988 case 0x00b4:
2989 case 0x00b5:
2990 case 0xc090:
2991 case 0xc091:
2992 case 0xc096:
2993 case 0xc097:
2994 case 0xc0a6:
2995 case 0xc0a7:
2996 case 0xc0aa:
2997 case 0xc0ab:
2998 case 0xccad:
2999 case 0xe41c:
3000 case 0xe41d:
3001 return KEX_DHE_PSK0x11;
3002 case 0x0014:
3003 case 0x0015:
3004 case 0x0016:
3005 case 0x0033:
3006 case 0x0039:
3007 case 0x0045:
3008 case 0x0067:
3009 case 0x006b:
3010 case 0x0088:
3011 case 0x009a:
3012 case 0x009e:
3013 case 0x009f:
3014 case 0x00be:
3015 case 0x00c4:
3016 case 0xc07c:
3017 case 0xc07d:
3018 case 0xc09e:
3019 case 0xc09f:
3020 case 0xc0a2:
3021 case 0xc0a3:
3022 case 0xccaa:
3023 case 0xe41e:
3024 case 0xe41f:
3025 return KEX_DHE_RSA0x12;
3026 case 0xc015:
3027 case 0xc016:
3028 case 0xc017:
3029 case 0xc018:
3030 case 0xc019:
3031 return KEX_ECDH_ANON0x19;
3032 case 0xc001:
3033 case 0xc002:
3034 case 0xc003:
3035 case 0xc004:
3036 case 0xc005:
3037 case 0xc025:
3038 case 0xc026:
3039 case 0xc02d:
3040 case 0xc02e:
3041 case 0xc074:
3042 case 0xc075:
3043 case 0xc088:
3044 case 0xc089:
3045 return KEX_ECDH_ECDSA0x1a;
3046 case 0xc00b:
3047 case 0xc00c:
3048 case 0xc00d:
3049 case 0xc00e:
3050 case 0xc00f:
3051 case 0xc029:
3052 case 0xc02a:
3053 case 0xc031:
3054 case 0xc032:
3055 case 0xc078:
3056 case 0xc079:
3057 case 0xc08c:
3058 case 0xc08d:
3059 return KEX_ECDH_RSA0x1b;
3060 case 0xc006:
3061 case 0xc007:
3062 case 0xc008:
3063 case 0xc009:
3064 case 0xc00a:
3065 case 0xc023:
3066 case 0xc024:
3067 case 0xc02b:
3068 case 0xc02c:
3069 case 0xc072:
3070 case 0xc073:
3071 case 0xc086:
3072 case 0xc087:
3073 case 0xc0ac:
3074 case 0xc0ad:
3075 case 0xc0ae:
3076 case 0xc0af:
3077 case 0xcca9:
3078 case 0xe414:
3079 case 0xe415:
3080 return KEX_ECDHE_ECDSA0x16;
3081 case 0xc033:
3082 case 0xc034:
3083 case 0xc035:
3084 case 0xc036:
3085 case 0xc037:
3086 case 0xc038:
3087 case 0xc039:
3088 case 0xc03a:
3089 case 0xc03b:
3090 case 0xc09a:
3091 case 0xc09b:
3092 case 0xccac:
3093 case 0xe418:
3094 case 0xe419:
3095 case 0xd001:
3096 case 0xd002:
3097 case 0xd003:
3098 case 0xd005:
3099 return KEX_ECDHE_PSK0x17;
3100 case 0xc010:
3101 case 0xc011:
3102 case 0xc012:
3103 case 0xc013:
3104 case 0xc014:
3105 case 0xc027:
3106 case 0xc028:
3107 case 0xc02f:
3108 case 0xc030:
3109 case 0xc076:
3110 case 0xc077:
3111 case 0xc08a:
3112 case 0xc08b:
3113 case 0xcca8:
3114 case 0xe412:
3115 case 0xe413:
3116 return KEX_ECDHE_RSA0x18;
3117 case 0x001e:
3118 case 0x001f:
3119 case 0x0020:
3120 case 0x0021:
3121 case 0x0022:
3122 case 0x0023:
3123 case 0x0024:
3124 case 0x0025:
3125 case 0x0026:
3126 case 0x0027:
3127 case 0x0028:
3128 case 0x0029:
3129 case 0x002a:
3130 case 0x002b:
3131 return KEX_KRB50x1c;
3132 case 0x002c:
3133 case 0x008a:
3134 case 0x008b:
3135 case 0x008c:
3136 case 0x008d:
3137 case 0x00a8:
3138 case 0x00a9:
3139 case 0x00ae:
3140 case 0x00af:
3141 case 0x00b0:
3142 case 0x00b1:
3143 case 0xc064:
3144 case 0xc065:
3145 case 0xc08e:
3146 case 0xc08f:
3147 case 0xc094:
3148 case 0xc095:
3149 case 0xc0a4:
3150 case 0xc0a5:
3151 case 0xc0a8:
3152 case 0xc0a9:
3153 case 0xccab:
3154 case 0xe416:
3155 case 0xe417:
3156 return KEX_PSK0x1d;
3157 case 0x0001:
3158 case 0x0002:
3159 case 0x0003:
3160 case 0x0004:
3161 case 0x0005:
3162 case 0x0006:
3163 case 0x0007:
3164 case 0x0008:
3165 case 0x0009:
3166 case 0x000a:
3167 case 0x002f:
3168 case 0x0035:
3169 case 0x003b:
3170 case 0x003c:
3171 case 0x003d:
3172 case 0x0041:
3173 case 0x0060:
3174 case 0x0061:
3175 case 0x0062:
3176 case 0x0064:
3177 case 0x0084:
3178 case 0x0096:
3179 case 0x009c:
3180 case 0x009d:
3181 case 0x00ba:
3182 case 0x00c0:
3183 case 0xc07a:
3184 case 0xc07b:
3185 case 0xc09c:
3186 case 0xc09d:
3187 case 0xc0a0:
3188 case 0xc0a1:
3189 case 0xe410:
3190 case 0xe411:
3191 case 0xfefe:
3192 case 0xfeff:
3193 case 0xffe0:
3194 case 0xffe1:
3195 return KEX_RSA0x1e;
3196 case 0x002e:
3197 case 0x0092:
3198 case 0x0093:
3199 case 0x0094:
3200 case 0x0095:
3201 case 0x00ac:
3202 case 0x00ad:
3203 case 0x00b6:
3204 case 0x00b7:
3205 case 0x00b8:
3206 case 0x00b9:
3207 case 0xc092:
3208 case 0xc093:
3209 case 0xc098:
3210 case 0xc099:
3211 case 0xccae:
3212 case 0xe41a:
3213 case 0xe41b:
3214 return KEX_RSA_PSK0x1f;
3215 case 0xc01a:
3216 case 0xc01d:
3217 case 0xc020:
3218 return KEX_SRP_SHA0x20;
3219 case 0xc01c:
3220 case 0xc01f:
3221 case 0xc022:
3222 return KEX_SRP_SHA_DSS0x21;
3223 case 0xc01b:
3224 case 0xc01e:
3225 case 0xc021:
3226 return KEX_SRP_SHA_RSA0x22;
3227 case 0xc0ff:
3228 return KEX_ECJPAKE0x24;
3229 case 0xe003:
3230 case 0xe013:
3231 case 0xe053:
3232 return KEX_ECC_SM20x26;
3233 default:
3234 break;
3235 }
3236
3237 return 0;
3238 /* }}} */
3239}
3240
3241static wmem_list_t *connection_id_session_list;
3242
3243void
3244ssl_init_cid_list(void) {
3245 connection_id_session_list = wmem_list_new(wmem_file_scope());
3246}
3247
3248void
3249ssl_cleanup_cid_list(void) {
3250 wmem_destroy_list(connection_id_session_list);
3251}
3252
3253void
3254ssl_add_session_by_cid(SslDecryptSession *session)
3255{
3256 wmem_list_append(connection_id_session_list, session);
3257}
3258
3259SslDecryptSession *
3260ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
3261{
3262 SslDecryptSession * ssl_cid = NULL((void*)0);
3263 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
3264
3265 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
3266 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
3267 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3267, "ssl != ((void*)0)"))));
3268 SslSession *session = &ssl->session;
3269
3270 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
3271 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
3272 ssl_cid = ssl;
3273 }
3274 }
3275
3276 if (session->server_cid_len > 0) {
3277 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
3278 ssl_cid = ssl;
3279 }
3280 }
3281
3282 it = wmem_list_frame_next(it);
3283 }
3284
3285 return ssl_cid;
3286}
3287
3288/* StringInfo structure (len + data) functions {{{ */
3289
3290int
3291ssl_data_alloc(StringInfo* str, size_t len)
3292{
3293 str->data = (unsigned char *)g_malloc(len);
22
←
Memory is allocated
→
3294 /* the allocator can return a null pointer for a size equal to 0,
3295 * and that must be allowed */
3296 if (len
22.1
'len' is > 0
 > 0 && !str->data)
23
←
Assuming field 'data' is non-null
→
24
←
Taking false branch
→
3297 return -1;
3298 str->data_len = (unsigned) len;
3299 return 0;
3300}
3301
3302void
3303ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
3304{
3305 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3305, "data"))));
3306 memcpy(str->data, data, len);
3307 str->data_len = len;
3308}
3309
3310static int
3311ssl_data_realloc(StringInfo* str, unsigned len)
3312{
3313 str->data = (unsigned char *)g_realloc(str->data, len);
3314 if (!str->data)
3315 return -1;
3316 str->data_len = len;
3317 return 0;
3318}
3319
3320static StringInfo *
3321ssl_data_clone(StringInfo *str)
3322{
3323 StringInfo *cloned_str;
3324 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
3325 sizeof(StringInfo) + str->data_len);
3326 cloned_str->data = (unsigned char *) (cloned_str + 1);
3327 ssl_data_set(cloned_str, str->data, str->data_len);
3328 return cloned_str;
3329}
3330
3331static int
3332ssl_data_copy(StringInfo* dst, StringInfo* src)
3333{
3334 if (dst->data_len < src->data_len) {
3335 if (ssl_data_realloc(dst, src->data_len))
3336 return -1;
3337 }
3338 memcpy(dst->data, src->data, src->data_len);
3339 dst->data_len = src->data_len;
3340 return 0;
3341}
3342
3343/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
3344 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
3345 * success. */
3346static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
3347 size_t i;
3348
3349 if (hex_len & 1)
3350 return false0;
3351
3352 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
3353 for (i = 0; i < hex_len / 2; i++) {
3354 int a = ws_xton(in[i*2]);
3355 int b = ws_xton(in[i*2 + 1]);
3356 if (a == -1 || b == -1)
3357 return false0;
3358 out->data[i] = a << 4 | b;
3359 }
3360 out->data_len = (unsigned)hex_len / 2;
3361 return true1;
3362}
3363/* StringInfo structure (len + data) functions }}} */
3364
3365
3366/* libgcrypt wrappers for HMAC/message digest operations {{{ */
3367/* hmac abstraction layer */
3368#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
3369
3370static inline int
3371ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
3372{
3373 gcry_error_t err;
3374 const char *err_str, *err_src;
3375
3376 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
3377 if (err != 0) {
3378 err_str = gcry_strerror(err);
3379 err_src = gcry_strsource(err);
3380 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
3381 return -1;
3382 }
3383 return 0;
3384}
3385
3386static inline int
3387ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
3388{
3389 gcry_error_t err;
3390 const char *err_str, *err_src;
3391
3392 err = gcry_md_setkey (*(md), key, len);
3393 if (err != 0) {
3394 err_str = gcry_strerror(err);
3395 err_src = gcry_strsource(err);
3396 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
3397 return -1;
3398 }
3399 return 0;
3400}
3401
3402static inline int
3403ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
3404{
3405 gcry_md_reset(*md);
3406 return 0;
3407}
3408
3409static inline void
3410ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
3411{
3412 gcry_md_write(*(md), data, len);
3413}
3414static inline void
3415ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3416{
3417 int algo;
3418 unsigned len;
3419
3420 algo = gcry_md_get_algo (*(md));
3421 len = gcry_md_get_algo_dlen(algo);
3422 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3422, "len <= *datalen"))));
3423 memcpy(data, gcry_md_read(*(md), algo), len);
3424 *datalen = len;
3425}
3426static inline void
3427ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
3428{
3429 gcry_md_close(*(md));
3430}
3431
3432/* message digest abstraction layer*/
3433#define SSL_MDgcry_md_hd_t gcry_md_hd_t
3434
3435static inline int
3436ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
3437{
3438 gcry_error_t err;
3439 const char *err_str, *err_src;
3440 err = gcry_md_open(md,algo, 0);
3441 if (err != 0) {
3442 err_str = gcry_strerror(err);
3443 err_src = gcry_strsource(err);
3444 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
3445 return -1;
3446 }
3447 return 0;
3448}
3449static inline void
3450ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, int len)
3451{
3452 gcry_md_write(*(md), data, len);
3453}
3454static inline void
3455ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3456{
3457 int algo;
3458 int len;
3459 algo = gcry_md_get_algo (*(md));
3460 len = gcry_md_get_algo_dlen (algo);
3461 memcpy(data, gcry_md_read(*(md), algo), len);
3462 *datalen = len;
3463}
3464static inline void
3465ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
3466{
3467 gcry_md_close(*(md));
3468}
3469
3470static inline void
3471ssl_md_reset(SSL_MDgcry_md_hd_t* md)
3472{
3473 gcry_md_reset(*md);
3474}
3475
3476/* md5 /sha abstraction layer */
3477#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
3478#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
3479
3480static inline int
3481ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
3482{
3483 gcry_error_t err;
3484 const char *err_str, *err_src;
3485 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
3486 if (err != 0) {
3487 err_str = gcry_strerror(err);
3488 err_src = gcry_strsource(err);
3489 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
3490 return -1;
3491 }
3492 return 0;
3493}
3494static inline void
3495ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3496{
3497 gcry_md_write(*(md), data, len);
3498}
3499static inline void
3500ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
3501{
3502 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
3503 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
3504}
3505
3506static inline void
3507ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
3508{
3509 gcry_md_reset(*md);
3510}
3511
3512static inline void
3513ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
3514{
3515 gcry_md_close(*(md));
3516}
3517
3518static inline int
3519ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
3520{
3521 gcry_error_t err;
3522 const char *err_str, *err_src;
3523 err = gcry_md_open(md,GCRY_MD_MD5, 0);
3524 if (err != 0) {
3525 err_str = gcry_strerror(err);
3526 err_src = gcry_strsource(err);
3527 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
3528 return -1;
3529 }
3530 return 0;
3531}
3532static inline void
3533ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3534{
3535 gcry_md_write(*(md), data, len);
3536}
3537static inline void
3538ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
3539{
3540 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
3541 gcry_md_get_algo_dlen(GCRY_MD_MD5));
3542}
3543
3544static inline void
3545ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
3546{
3547 gcry_md_reset(*md);
3548}
3549
3550static inline void
3551ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
3552{
3553 gcry_md_close(*(md));
3554}
3555/* libgcrypt wrappers for HMAC/message digest operations }}} */
3556
3557/* libgcrypt wrappers for Cipher state manipulation {{{ */
3558int
3559ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
3560{
3561 int ret;
3562#if 0
3563 unsigned char *ivp;
3564 int i;
3565 gcry_cipher_hd_t c;
3566 c=(gcry_cipher_hd_t)*cipher;
3567#endif
3568 ssl_debug_printf("--------------------------------------------------------------------");
3569#if 0
3570 for(ivp=c->iv,i=0; i < iv_len; i++ )
3571 {
3572 ssl_debug_printf("%d ",ivp[i]);
3573 i++;
3574 }
3575#endif
3576 ssl_debug_printf("--------------------------------------------------------------------");
3577 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
3578#if 0
3579 for(ivp=c->iv,i=0; i < iv_len; i++ )
3580 {
3581 ssl_debug_printf("%d ",ivp[i]);
3582 i++;
3583 }
3584#endif
3585 ssl_debug_printf("--------------------------------------------------------------------");
3586 return ret;
3587}
3588/* stream cipher abstraction layer*/
3589static int
3590ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
3591 unsigned char* iv, int mode)
3592{
3593 int gcry_modes[] = {
3594 GCRY_CIPHER_MODE_STREAM,
3595 GCRY_CIPHER_MODE_CBC,
3596 GCRY_CIPHER_MODE_GCM,
3597 GCRY_CIPHER_MODE_CCM,
3598 GCRY_CIPHER_MODE_CCM,
3599 GCRY_CIPHER_MODE_POLY1305,
3600 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
3601 };
3602 int err;
3603 if (algo == -1) {
3604 /* NULL mode */
3605 *(cipher) = (gcry_cipher_hd_t)-1;
3606 return 0;
3607 }
3608 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
3609 if (err !=0)
3610 return -1;
3611 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
3612 if (err != 0)
3613 return -1;
3614 /* AEAD cipher suites will set the nonce later. */
3615 if (mode == MODE_CBC) {
3616 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
3617 if (err != 0)
3618 return -1;
3619 }
3620 return 0;
3621}
3622static inline int
3623ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
3624 const unsigned char * in, int inl)
3625{
3626 if ((*cipher) == (gcry_cipher_hd_t)-1)
3627 {
3628 if (in && inl)
3629 memcpy(out, in, outl < inl ? outl : inl);
3630 return 0;
3631 }
3632 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
3633}
3634static inline int
3635ssl_get_digest_by_name(const char*name)
3636{
3637 return gcry_md_map_name(name);
3638}
3639static inline int
3640ssl_get_cipher_by_name(const char* name)
3641{
3642 return gcry_cipher_map_name(name);
3643}
3644
3645static inline void
3646ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
3647{
3648 if ((*cipher) != (gcry_cipher_hd_t)-1)
3649 gcry_cipher_close(*cipher);
3650 *cipher = NULL((void*)0);
3651}
3652/* }}} */
3653
3654/* Digests, Ciphers and Cipher Suites registry {{{ */
3655static const SslDigestAlgo digests[]={
3656 {"MD5", 16},
3657 {"SHA1", 20},
3658 {"SHA256", 32},
3659 {"SHA384", 48},
3660 {"SM3", 32},
3661 {"Not Applicable", 0},
3662};
3663
3664#define DIGEST_MAX_SIZE48 48
3665
3666/* get index digest index */
3667static const SslDigestAlgo *
3668ssl_cipher_suite_dig(const SslCipherSuite *cs) {
3669 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
3670 return &digests[DIG_NA0x45 - DIG_MD50x40];
3671 }
3672 return &digests[cs->dig - DIG_MD50x40];
3673}
3674
3675static const char *ciphers[]={
3676 "DES",
3677 "3DES",
3678 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
3679 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
3680 "IDEA",
3681 "AES",
3682 "AES256",
3683 "CAMELLIA128",
3684 "CAMELLIA256",
3685 "SEED",
3686 "CHACHA20", /* since Libgcrypt 1.7.0 */
3687 "SM1",
3688 "SM4",
3689 "*UNKNOWN*"
3690};
3691
3692static const SslCipherSuite cipher_suites[]={
3693 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
3694 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
3695 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3696 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
3697 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
3698 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3699 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
3700 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3701 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
3702 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
3703 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3704 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
3705 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
3706 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3707 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
3708 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
3709 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3710 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
3711 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
3712 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3713 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
3714 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
3715 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3716 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
3717 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3718 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
3719 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
3720 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
3721 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
3722 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
3723 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
3724 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
3725 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
3726 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
3727 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
3728 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
3729 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
3730 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
3731 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
3732 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
3733 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
3734 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
3735 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
3736 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
3737 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
3738 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
3739 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
3740 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
3741 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
3742 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
3743 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
3744 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
3745 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
3746 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
3747 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3748 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3749 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3750 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3751 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3752 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3753 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
3754 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
3755 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
3756 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
3757 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
3758 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
3759 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
3760 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
3761 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
3762 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
3763 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
3764 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
3765 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
3766 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
3767 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
3768 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
3769 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
3770 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
3771 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
3772 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
3773 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
3774 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
3775 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
3776 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
3777 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
3778 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
3779 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
3780 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
3781 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
3782 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
3783 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
3784 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
3785 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
3786 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
3787 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
3788 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
3789 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
3790 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
3791 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
3792 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
3793 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
3794 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
3795 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
3796 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
3797 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
3798 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
3799 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
3800 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
3801 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
3802 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
3803 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
3804 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
3805 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
3806 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
3807 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
3808 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
3809 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
3810 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
3811 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
3812 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
3813 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
3814 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
3815 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3816 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3817 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3818 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3819 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3820 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
3821 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3822 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3823 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3824 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3825 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3826 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
3827
3828 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
3829 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
3830 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
3831 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
3832 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
3833 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
3834 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3835
3836 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3837 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3838 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3839 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3840 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3841 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3842 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3843 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3844 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3845 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3846 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3847 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3848 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3849 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3850 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3851 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3852 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3853 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3854 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3855 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3856 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3857 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3858 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3859 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3860 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3861 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3862 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3863 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3864 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3865 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3866 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3867 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3868 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3869 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3870 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3871 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3872 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3873 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3874 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3875 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3876 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3877 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3878 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3879 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3880 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3881 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3882 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3883 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3884 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3885 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3886 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3887 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3888 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3889 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3890 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3891 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3892 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3893 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3894 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3895 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3896 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3897 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3898 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3899 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3900 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3901 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3902 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3903 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3904 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3905 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3906 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3907 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3908 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3909 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3910 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3911 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3912 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3913 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3914 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3915 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3916 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3917 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3918 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3919 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3920 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3921 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3922 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3923 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3924 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3925 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3926 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3927 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3928 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3929 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3930 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3931 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3932 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3933 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3934 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3935 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3936 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3937 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3938 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3939 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3940 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3941 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3942 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3943 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3944 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3945 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3946 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3947 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3948 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3949 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3950 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3951 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3952 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3953 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3954 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3955 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3956 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3957 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3958 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3959 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3960 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3961 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3962 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3963 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3964 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3965 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3966 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3967 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3968 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3969 /* GM */
3970 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3971 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3972 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3973 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3974 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3975 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3976 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3977 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3978 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3979 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3980 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3981 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3982 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3983 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3984 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3985 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3986 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3987 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3988 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3989 {-1, 0, 0, 0, MODE_STREAM}
3990};
3991
3992#define MAX_BLOCK_SIZE16 16
3993#define MAX_KEY_SIZE32 32
3994
3995const SslCipherSuite *
3996ssl_find_cipher(int num)
3997{
3998 const SslCipherSuite *c;
3999 for(c=cipher_suites;c->number!=-1;c++){
4000 if(c->number==num){
4001 return c;
4002 }
4003 }
4004
4005 return NULL((void*)0);
4006}
4007
4008int
4009ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
4010{
4011 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
4012}
4013
4014unsigned
4015ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
4016{
4017 int cipher_algo;
4018 if (cipher_suite->mode != MODE_CBC) return 0;
4019 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
4020 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4021}
4022
4023static unsigned
4024ssl_get_cipher_export_keymat_size(int cipher_suite_num)
4025{
4026 switch (cipher_suite_num) {
4027 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
4028 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
4029 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
4030 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
4031 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
4032 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
4033 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
4034 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
4035 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
4036 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
4037 return 5;
4038
4039 /* not defined in below draft, but "implemented by several vendors",
4040 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
4041 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
4042 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
4043 return 7;
4044
4045 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
4046 * used 7. Until a pcap proves 8, let's use the old value. Link:
4047 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
4048 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
4049 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
4050 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
4051 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
4052 return 7;
4053
4054 default:
4055 return 0;
4056 }
4057}
4058
4059/* Digests, Ciphers and Cipher Suites registry }}} */
4060
4061
4062/* HMAC and the Pseudorandom function {{{ */
4063static int
4064tls_hash(StringInfo *secret, StringInfo *seed, int md,
4065 StringInfo *out, unsigned out_len)
4066{
4067 /* RFC 2246 5. HMAC and the pseudorandom function
4068 * '+' denotes concatenation.
4069 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
4070 * HMAC_hash(secret, A(2) + seed) + ...
4071 * A(0) = seed
4072 * A(i) = HMAC_hash(secret, A(i - 1))
4073 */
4074 uint8_t *ptr;
4075 unsigned left, tocpy;
4076 uint8_t *A;
4077 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
4078 unsigned A_l, tmp_l;
4079 SSL_HMACgcry_md_hd_t hm;
4080
4081 ptr = out->data;
4082 left = out_len;
4083
4084 ssl_print_string("tls_hash: hash secret", secret);
4085 ssl_print_string("tls_hash: hash seed", seed);
4086 /* A(0) = seed */
4087 A = seed->data;
4088 A_l = seed->data_len;
4089
4090 if (ssl_hmac_init(&hm, md) != 0) {
4091 return -1;
4092 }
4093 while (left) {
4094 /* A(i) = HMAC_hash(secret, A(i-1)) */
4095 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
4096 ssl_hmac_update(&hm, A, A_l);
4097 A_l = sizeof(_A); /* upper bound len for hash output */
4098 ssl_hmac_final(&hm, _A, &A_l);
4099 A = _A;
4100
4101 /* HMAC_hash(secret, A(i) + seed) */
4102 ssl_hmac_reset(&hm);
4103 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
4104 ssl_hmac_update(&hm, A, A_l);
4105 ssl_hmac_update(&hm, seed->data, seed->data_len);
4106 tmp_l = sizeof(tmp); /* upper bound len for hash output */
4107 ssl_hmac_final(&hm, tmp, &tmp_l);
4108 ssl_hmac_reset(&hm);
4109
4110 /* ssl_hmac_final puts the actual digest output size in tmp_l */
4111 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
4112 memcpy(ptr, tmp, tocpy);
4113 ptr += tocpy;
4114 left -= tocpy;
4115 }
4116 ssl_hmac_cleanup(&hm);
4117 out->data_len = out_len;
4118
4119 ssl_print_string("hash out", out);
4120 return 0;
4121}
4122
4123static bool_Bool
4124tls_prf(StringInfo* secret, const char *usage,
4125 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4126{
4127 StringInfo seed, sha_out, md5_out;
4128 uint8_t *ptr;
4129 StringInfo s1, s2;
4130 unsigned i,s_l;
4131 size_t usage_len, rnd2_len;
4132 bool_Bool success = false0;
4133 usage_len = strlen(usage);
4134 rnd2_len = rnd2 ? rnd2->data_len : 0;
4135
4136 /* initialize buffer for sha, md5 random seed*/
4137 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
4138 ssl_debug_printf("tls_prf: can't allocate sha out\n");
4139 return false0;
4140 }
4141 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
4142 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
4143 goto free_sha;
4144 }
4145 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4146 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
4147 (int) (usage_len+rnd1->data_len+rnd2_len));
4148 goto free_md5;
4149 }
4150
4151 ptr=seed.data;
4152 memcpy(ptr,usage,usage_len);
4153 ptr+=usage_len;
4154 memcpy(ptr,rnd1->data,rnd1->data_len);
4155 if (rnd2_len > 0) {
4156 ptr+=rnd1->data_len;
4157 memcpy(ptr,rnd2->data,rnd2->data_len);
4158 /*ptr+=rnd2->data_len;*/
4159 }
4160
4161 /* initialize buffer for client/server seeds*/
4162 s_l=secret->data_len/2 + secret->data_len%2;
4163 if (ssl_data_alloc(&s1, s_l) < 0) {
4164 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
4165 goto free_seed;
4166 }
4167 if (ssl_data_alloc(&s2, s_l) < 0) {
4168 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
4169 goto free_s1;
4170 }
4171
4172 memcpy(s1.data,secret->data,s_l);
4173 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
4174
4175 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
4176 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
4177 goto free_s2;
4178 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
4179 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
4180 goto free_s2;
4181
4182 for (i = 0; i < out_len; i++)
4183 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
4184 /* success, now store the new meaningful data length */
4185 out->data_len = out_len;
4186 success = true1;
4187
4188 ssl_print_string("PRF out",out);
4189free_s2:
4190 g_free(s2.data);
4191free_s1:
4192 g_free(s1.data);
4193free_seed:
4194 g_free(seed.data);
4195free_md5:
4196 g_free(md5_out.data);
4197free_sha:
4198 g_free(sha_out.data);
4199 return success;
4200}
4201
4202static bool_Bool
4203tls12_prf(int md, StringInfo* secret, const char* usage,
4204 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4205{
4206 StringInfo label_seed;
4207 int success;
4208 size_t usage_len, rnd2_len;
4209 rnd2_len = rnd2 ? rnd2->data_len : 0;
4210
4211 usage_len = strlen(usage);
4212 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4213 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
4214 return false0;
4215 }
4216 memcpy(label_seed.data, usage, usage_len);
4217 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
4218 if (rnd2_len > 0)
4219 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
4220
4221 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
4222 success = tls_hash(secret, &label_seed, md, out, out_len);
4223 g_free(label_seed.data);
4224 if(success != -1){
4225 ssl_print_string("PRF out", out);
4226 return true1;
4227 }
4228 return false0;
4229}
4230
4231static bool_Bool
4232ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
4233 StringInfo *out, unsigned out_len)
4234{
4235 SSL_MD5_CTXgcry_md_hd_t md5;
4236 uint8_t tmp[16];
4237
4238 if (ssl_md5_init(&md5) != 0) {
4239 return false0;
4240 }
4241 ssl_md5_update(&md5,r1->data,r1->data_len);
4242 ssl_md5_update(&md5,r2->data,r2->data_len);
4243 ssl_md5_final(tmp,&md5);
4244 ssl_md5_cleanup(&md5);
4245
4246 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4246, "out_len <= sizeof(tmp)"))));
4247 ssl_data_set(out, tmp, out_len);
4248 ssl_print_string("export iv", out);
4249 return true1;
4250}
4251
4252static bool_Bool
4253ssl3_prf(StringInfo* secret, const char* usage,
4254 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4255{
4256 SSL_MD5_CTXgcry_md_hd_t md5;
4257 SSL_SHA_CTXgcry_md_hd_t sha;
4258 unsigned off;
4259 int i = 0,j;
4260 uint8_t buf[20];
4261
4262 if (ssl_sha_init(&sha) != 0) {
4263 return false0;
4264 }
4265 if (ssl_md5_init(&md5) != 0) {
4266 ssl_sha_cleanup(&sha);
4267 return false0;
4268 }
4269 for (off = 0; off < out_len; off += 16) {
4270 unsigned char outbuf[16];
4271 i++;
4272
4273 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
4274 /* A, BB, CCC, ... */
4275 for(j=0;j<i;j++){
4276 buf[j]=64+i;
4277 }
4278
4279 ssl_sha_update(&sha,buf,i);
4280 ssl_sha_update(&sha,secret->data,secret->data_len);
4281
4282 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
4283 if (rnd2)
4284 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4285 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4286 }
4287 else{
4288 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4289 if (rnd2)
4290 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4291 }
4292
4293 ssl_sha_final(buf,&sha);
4294 ssl_sha_reset(&sha);
4295
4296 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
4297 secret->data_len);
4298 ssl_md5_update(&md5,secret->data,secret->data_len);
4299 ssl_md5_update(&md5,buf,20);
4300 ssl_md5_final(outbuf,&md5);
4301 ssl_md5_reset(&md5);
4302
4303 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
4304 }
4305 ssl_sha_cleanup(&sha);
4306 ssl_md5_cleanup(&md5);
4307 out->data_len = out_len;
4308
4309 return true1;
4310}
4311
4312/* out_len is the wanted output length for the pseudorandom function.
4313 * Ensure that ssl->cipher_suite is set. */
4314static bool_Bool
4315prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
4316 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
4317{
4318 switch (ssl->session.version) {
4319 case SSLV3_VERSION0x300:
4320 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
4321
4322 case TLSV1_VERSION0x301:
4323 case TLSV1DOT1_VERSION0x302:
4324 case DTLSV1DOT0_VERSION0xfeff:
4325 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4326 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
4327
4328 default: /* TLSv1.2 */
4329 switch (ssl->cipher_suite->dig) {
4330 case DIG_SM30x44:
4331#if GCRYPT_VERSION_NUMBER0x010a03 >= 0x010900
4332 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
4333 out, out_len);
4334#else
4335 return false0;
4336#endif
4337 case DIG_SHA3840x43:
4338 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
4339 out, out_len);
4340 default:
4341 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
4342 out, out_len);
4343 }
4344 }
4345}
4346
4347static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
4348{
4349 SSL_MD5_CTXgcry_md_hd_t md5;
4350 SSL_SHA_CTXgcry_md_hd_t sha;
4351
4352 if (ssl_data_alloc(out, 36) < 0)
21
←
Calling 'ssl_data_alloc'
→
25
←
Returned allocated memory
→
26
←
Taking false branch
→
4353 return -1;
4354
4355 if (ssl_md5_init(&md5) != 0)
27
←
Taking true branch
→
4356 return -1;
4357 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
4358 ssl_md5_final(out->data,&md5);
4359 ssl_md5_cleanup(&md5);
4360
4361 if (ssl_sha_init(&sha) != 0)
4362 return -1;
4363 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
4364 ssl_sha_final(out->data+16,&sha);
4365 ssl_sha_cleanup(&sha);
4366 return 0;
4367}
4368
4369static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
4370{
4371 SSL_MDgcry_md_hd_t mc;
4372 uint8_t tmp[48];
4373 unsigned len;
4374
4375 if (ssl_md_init(&mc, md) != 0)
4376 return -1;
4377 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
4378 ssl_md_final(&mc, tmp, &len);
4379 ssl_md_cleanup(&mc);
4380
4381 if (ssl_data_alloc(out, len) < 0)
4382 return -1;
4383 memcpy(out->data, tmp, len);
4384 return 0;
4385}
4386
4387/**
4388 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
4389 * inlined and removed once support for draft 19 and before is dropped.
4390 */
4391static inline const char *
4392tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
4393{
4394 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
4395 return "TLS 1.3, ";
4396 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4397 return "dtls13";
4398 } else {
4399 return "tls13 ";
4400 }
4401}
4402
4403/*
4404 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
4405 * custom label prefix. If "context_hash" is NULL, then an empty context is
4406 * used. Otherwise it must have the same length as the hash algorithm output.
4407 */
4408bool_Bool
4409tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
4410 const char *label_prefix, const char *label,
4411 const uint8_t *context_hash, uint8_t context_length,
4412 uint16_t out_len, unsigned char **out)
4413{
4414 /* RFC 8446 Section 7.1:
4415 * HKDF-Expand-Label(Secret, Label, Context, Length) =
4416 * HKDF-Expand(Secret, HkdfLabel, Length)
4417 * struct {
4418 * uint16 length = Length;
4419 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
4420 * opaque context<0..255> = Context;
4421 * } HkdfLabel;
4422 *
4423 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
4424 * HKDF-Expand(PRK, info, L) -> OKM
4425 */
4426 gcry_error_t err;
4427 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
4428 const unsigned label_length = (unsigned) strlen(label);
4429
4430 /* Some sanity checks */
4431 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4431, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
4432
4433 /* info = HkdfLabel { length, label, context } */
4434 GByteArray *info = g_byte_array_new();
4435 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
4436 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
4437
4438 const uint8_t label_vector_length = label_prefix_length + label_length;
4439 g_byte_array_append(info, &label_vector_length, 1);
4440 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
4441 g_byte_array_append(info, (const uint8_t*)label, label_length);
4442
4443 g_byte_array_append(info, &context_length, 1);
4444 if (context_length) {
4445 g_byte_array_append(info, context_hash, context_length);
4446 }
4447
4448 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
4449 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
4450 g_byte_array_free(info, true1);
4451
4452 if (err) {
4453 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
4454 wmem_free(NULL((void*)0), *out);
4455 *out = NULL((void*)0);
4456 return false0;
4457 }
4458
4459 return true1;
4460}
4461
4462bool_Bool
4463tls13_hkdf_expand_label(int md, const StringInfo *secret,
4464 const char *label_prefix, const char *label,
4465 uint16_t out_len, unsigned char **out)
4466{
4467 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
4468}
4469/* HMAC and the Pseudorandom function }}} */
4470
4471/* Record Decompression (after decryption) {{{ */
4472#ifdef USE_ZLIB_OR_ZLIBNG
4473/* memory allocation functions for zlib initialization */
4474static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
4475{
4476 return g_malloc0(no*size);
4477}
4478static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
4479{
4480 g_free(addr);
4481}
4482#endif /* USE_ZLIB_OR_ZLIBNG */
4483
4484static SslDecompress*
4485ssl_create_decompressor(int compression)
4486{
4487 SslDecompress *decomp;
4488#ifdef USE_ZLIB_OR_ZLIBNG
4489 int err;
4490#endif
4491
4492 if (compression == 0) return NULL((void*)0);
4493 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
4494 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
4495 decomp->compression = compression;
4496 switch (decomp->compression) {
4497#ifdef USE_ZLIB_OR_ZLIBNG
4498 case 1: /* DEFLATE */
4499 decomp->istream.zalloc = ssl_zalloc;
4500 decomp->istream.zfree = ssl_zfree;
4501 decomp->istream.opaque = Z_NULL0;
4502 decomp->istream.next_in = Z_NULL0;
4503 decomp->istream.next_out = Z_NULL0;
4504 decomp->istream.avail_in = 0;
4505 decomp->istream.avail_out = 0;
4506 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3", (int)sizeof(z_stream
));
4507 if (err != Z_OK0) {
4508 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
4509 return NULL((void*)0);
4510 }
4511 break;
4512#endif /* USE_ZLIB_OR_ZLIBNG */
4513 default:
4514 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
4515 return NULL((void*)0);
4516 }
4517 return decomp;
4518}
4519
4520#ifdef USE_ZLIB_OR_ZLIBNG
4521static int
4522ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
4523{
4524 int err;
4525
4526 switch (decomp->compression) {
4527 case 1: /* DEFLATE */
4528 err = Z_OK0;
4529 if (out_str->data_len < 16384) { /* maximal plain length */
4530 ssl_data_realloc(out_str, 16384);
4531 }
4532#ifdef z_constconst
4533 decomp->istream.next_in = in;
4534#else
4535DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
4536 decomp->istream.next_in = (Bytef *)in;
4537DIAG_ON(cast-qual)clang diagnostic pop
4538#endif
4539 decomp->istream.avail_in = inl;
4540 decomp->istream.next_out = out_str->data;
4541 decomp->istream.avail_out = out_str->data_len;
4542 if (inl > 0)
4543 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
4544 if (err != Z_OK0) {
4545 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
4546 return -1;
4547 }
4548 *outl = out_str->data_len - decomp->istream.avail_out;
4549 break;
4550 default:
4551 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4552 return -1;
4553 }
4554 return 0;
4555}
4556#else /* USE_ZLIB_OR_ZLIBNG */
4557int
4558ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
4559{
4560 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4561 return -1;
4562}
4563#endif /* USE_ZLIB_OR_ZLIBNG */
4564/* Record Decompression (after decryption) }}} */
4565
4566/* Create a new structure to store decrypted chunks. {{{ */
4567static SslFlow*
4568ssl_create_flow(void)
4569{
4570 SslFlow *flow;
4571
4572 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
4573 flow->byte_seq = 0;
4574 flow->flags = 0;
4575 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
4576 return flow;
4577}
4578/* }}} */
4579
4580/* Use the negotiated security parameters for decryption. {{{ */
4581void
4582ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
4583{
4584 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
4585 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
4586 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
4587 *new_decoder ? "" : " (No decoder found - retransmission?)");
4588 if (*new_decoder) {
4589 *dest = *new_decoder;
4590 *new_decoder = NULL((void*)0);
4591 }
4592}
4593/* }}} */
4594
4595/* Init cipher state given some security parameters. {{{ */
4596static bool_Bool
4597ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
4598
4599static SslDecoder*
4600ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
4601 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
4602{
4603 SslDecoder *dec;
4604 ssl_cipher_mode_t mode = cipher_suite->mode;
4605
4606 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
4607 /* init mac buffer: mac storage is embedded into decoder struct to save a
4608 memory allocation and waste samo more memory*/
4609 dec->cipher_suite=cipher_suite;
4610 dec->compression = compression;
4611 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4612 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4613 // the special case for NULL ciphers, even if there is insufficiency
4614 // keying material (including MAC key), we will can still create
4615 // decoders since "decryption" is easy for such ciphers.
4616 dec->mac_key.data = dec->_mac_key_or_write_iv;
4617 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4618 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4619 // Input for the nonce, to be used with AEAD ciphers.
4620 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4620, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
4621 dec->write_iv.data = dec->_mac_key_or_write_iv;
4622 ssl_data_set(&dec->write_iv, iv, iv_length);
4623 }
4624 dec->seq = 0;
4625 dec->decomp = ssl_create_decompressor(compression);
4626 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4627
4628 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4629 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4630 cipher_algo, cipher_suite->mode);
4631 return NULL((void*)0);
4632 }
4633
4634 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4635 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4636 mode = MODE_ECB;
4637 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4638 mode = MODE_STREAM;
4639 } else {
4640 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4641 return NULL((void*)0);
4642 }
4643
4644 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4645 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4646 cipher_algo, MODE_ECB);
4647 ssl_cipher_cleanup(&dec->evp);
4648 dec->evp = NULL((void*)0);
4649 return NULL((void*)0);
4650 }
4651 } else {
4652 dec->sn_evp = NULL((void*)0);
4653 }
4654
4655 dec->dtls13_aad.data = NULL((void*)0);
4656 dec->dtls13_aad.data_len = 0;
4657 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4658 return dec;
4659}
4660
4661static bool_Bool
4662ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4663{
4664 SslDecoder *dec = (SslDecoder *) user_data;
4665
4666 if (dec->evp)
4667 ssl_cipher_cleanup(&dec->evp);
4668 if (dec->sn_evp)
4669 ssl_cipher_cleanup(&dec->sn_evp);
4670
4671#ifdef USE_ZLIB_OR_ZLIBNG
4672 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4673 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4674#endif
4675
4676 return false0;
4677}
4678/* }}} */
4679
4680/* (Pre-)master secrets calculations {{{ */
4681#ifdef HAVE_LIBGNUTLS1
4682static bool_Bool
4683ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4684 StringInfo *encrypted_pre_master,
4685 GHashTable *key_hash);
4686#endif /* HAVE_LIBGNUTLS */
4687
4688static bool_Bool
4689ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4690 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4691
4692bool_Bool
4693ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4694 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4695 const char *ssl_psk, packet_info *pinfo,
4696#ifdef HAVE_LIBGNUTLS1
4697 GHashTable *key_hash,
4698#endif
4699 const ssl_master_key_map_t *mk_map)
4700{
4701 /* check for required session data */
4702 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4703 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4704 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4705 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4706 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4707 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4708 return false0;
4709 }
4710
4711 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4712 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4713 return false0;
4714 }
4715
4716 /* check to see if the PMS was provided to us*/
4717 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4718 mk_map->pms, &ssl_session->client_random)) {
4719 return true1;
4720 }
4721
4722 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4723 {
4724 /* calculate pre master secret*/
4725 StringInfo pre_master_secret;
4726 unsigned psk_len, pre_master_len;
4727
4728 if (!ssl_psk || (ssl_psk[0] == 0)) {
4729 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
4730 return false0;
4731 }
4732
4733 /* convert hex string into char*/
4734 if (!from_hex(&ssl_session->psk, ssl_psk, strlen(ssl_psk))) {
4735 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
4736 G_STRFUNC((const char*) (__func__)));
4737 return false0;
4738 }
4739
4740 psk_len = ssl_session->psk.data_len;
4741 if (psk_len >= (2 << 15)) {
4742 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
4743 G_STRFUNC((const char*) (__func__)));
4744 return false0;
4745 }
4746
4747
4748 pre_master_len = psk_len * 2 + 4;
4749
4750 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4751 pre_master_secret.data_len = pre_master_len;
4752 /* 2 bytes psk_len*/
4753 pre_master_secret.data[0] = psk_len >> 8;
4754 pre_master_secret.data[1] = psk_len & 0xFF;
4755 /* psk_len bytes times 0*/
4756 memset(&pre_master_secret.data[2], 0, psk_len);
4757 /* 2 bytes psk_len*/
4758 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4759 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4760 /* psk*/
4761 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4762
4763 ssl_session->pre_master_secret.data = pre_master_secret.data;
4764 ssl_session->pre_master_secret.data_len = pre_master_len;
4765 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4766
4767 /* Remove the master secret if it was there.
4768 This forces keying material regeneration in
4769 case we're renegotiating */
4770 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4771 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4772 return true1;
4773 }
4774 else
4775 {
4776 unsigned encrlen, skip;
4777 encrlen = length;
4778 skip = 0;
4779
4780 /* get encrypted data, on tls1 we have to skip two bytes
4781 * (it's the encrypted len and should be equal to record len - 2)
4782 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4783 */
4784 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4785 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4786 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4787 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4788 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4789 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4790 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4791 {
4792 encrlen = tvb_get_ntohs(tvb, offset);
4793 skip = 2;
4794 if (encrlen > length - 2)
4795 {
4796 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4797 G_STRFUNC((const char*) (__func__)), encrlen, length);
4798 return false0;
4799 }
4800 }
4801 /* the valid lower bound is higher than 8, but it is sufficient for the
4802 * ssl keylog file below */
4803 if (encrlen < 8) {
4804 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4805 G_STRFUNC((const char*) (__func__)), encrlen);
4806 return false0;
4807 }
4808
4809 StringInfo encrypted_pre_master = {
4810 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4811 .data_len = encrlen,
4812 };
4813
4814#ifdef HAVE_LIBGNUTLS1
4815 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4816 if (ssl_session->cert_key_id) {
4817 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4818 return true1;
4819
4820 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4821 G_STRFUNC((const char*) (__func__)));
4822 }
4823#endif /* HAVE_LIBGNUTLS */
4824
4825 /* try to find the pre-master secret from the encrypted one. The
4826 * ssl key logfile stores only the first 8 bytes, so truncate it */
4827 encrypted_pre_master.data_len = 8;
4828 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4829 true1, mk_map->pre_master, &encrypted_pre_master))
4830 return true1;
4831 }
4832 return false0;
4833}
4834
4835/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4836int
4837ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4838{
4839 StringInfo key_block = { NULL((void*)0), 0 };
4840 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4841 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4842 int needed;
4843 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4844 unsigned encr_key_len, write_iv_len = 0;
4845 bool_Bool is_export_cipher;
4846 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4847 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4848 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4849
4850 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4851 if (ssl_session->session.version
7.1
Field 'version' is not equal to TLSV1DOT3_VERSION
 == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
8
←
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
→
9
←
Taking false branch
→
4852 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4853 return -1;
4854 }
4855
4856 /* check for enough info to proceed */
4857 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4858 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4859 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
10
←
Assuming the condition is false
→
11
←
Assuming the condition is false
→
12
←
Taking false branch
→
4860 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4861 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4862 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4863 /* Special case: for NULL encryption, allow dissection of data even if
4864 * the Client Hello is missing (MAC keys are now skipped though). */
4865 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4866 if ((ssl_session->state & need_all) == need_all &&
4867 cipher_suite->enc == ENC_NULL0x3D) {
4868 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4869 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4870 goto create_decoders;
4871 }
4872
4873 return -1;
4874 }
4875
4876 /* if master key is not available, generate is from the pre-master secret */
4877 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
13
←
Assuming the condition is true
→
14
←
Taking true branch
→
4878 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
15
←
Assuming the condition is true
→
16
←
Taking true branch
→
4879 StringInfo handshake_hashed_data;
4880 int ret;
4881
4882 handshake_hashed_data.data = NULL((void*)0);
4883 handshake_hashed_data.data_len = 0;
4884
4885 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4886 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4887 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4887, "ssl_session->handshake_data.data_len > 0"
))));
17
←
Assuming field 'data_len' is > 0
→
18
←
'?' condition is true
→
4888
4889 switch(ssl_session->session.version) {
19
←
Control jumps to 'case 257:' at line 4894
→
4890 case TLSV1_VERSION0x301:
4891 case TLSV1DOT1_VERSION0x302:
4892 case DTLSV1DOT0_VERSION0xfeff:
4893 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4894 case TLCPV1_VERSION0x101:
4895 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
20
←
Calling 'tls_handshake_hash'
→
28
←
Returned allocated memory
→
4896 break;
4897 default:
4898 switch (cipher_suite->dig) {
4899 case DIG_SHA3840x43:
4900 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4901 break;
4902 default:
4903 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4904 break;
4905 }
4906 break;
4907 }
4908 if (ret
29.1
'ret' is -1
) {
29
←
 Execution continues on line 4908
→
30
←
Taking true branch
→
4909 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
31
←
Potential leak of memory pointed to by 'handshake_hashed_data.data'
4910 return -1;
4911 }
4912
4913 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4914 ssl_session->handshake_data.data = NULL((void*)0);
4915 ssl_session->handshake_data.data_len = 0;
4916
4917 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4918 &handshake_hashed_data,
4919 NULL((void*)0), &ssl_session->master_secret,
4920 SSL_MASTER_SECRET_LENGTH48)) {
4921 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4922 g_free(handshake_hashed_data.data);
4923 return -1;
4924 }
4925 g_free(handshake_hashed_data.data);
4926 } else {
4927 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4928 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4929 ssl_print_string("client random",&ssl_session->client_random);
4930 ssl_print_string("server random",&ssl_session->server_random);
4931 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4932 &ssl_session->client_random,
4933 &ssl_session->server_random, &ssl_session->master_secret,
4934 SSL_MASTER_SECRET_LENGTH48)) {
4935 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4936 return -1;
4937 }
4938 }
4939 ssl_print_string("master secret",&ssl_session->master_secret);
4940
4941 /* the pre-master secret has been 'consumed' so we must clear it now */
4942 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4943 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4944 }
4945
4946 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4947 if (cipher_suite->enc != ENC_NULL0x3D) {
4948 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4949 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4950 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4951 if (cipher_algo == 0) {
4952 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4953 return -1;
4954 }
4955 }
4956
4957 /* Export ciphers consume less material from the key block. */
4958 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4959 is_export_cipher = encr_key_len > 0;
4960 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4961 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4962 }
4963
4964 if (cipher_suite->mode == MODE_CBC) {
4965 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4966 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4967 /* account for a four-byte salt for client and server side (from
4968 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4969 write_iv_len = 4;
4970 } else if (cipher_suite->mode == MODE_POLY1305) {
4971 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4972 write_iv_len = 12;
4973 }
4974
4975 /* Compute the key block. First figure out how much data we need */
4976 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4977 needed += 2 * encr_key_len; /* encryption key */
4978 needed += 2 * write_iv_len; /* write IV */
4979
4980 key_block.data = (unsigned char *)g_malloc(needed);
4981 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4982 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4983 &ssl_session->server_random,&ssl_session->client_random,
4984 &key_block, needed)) {
4985 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4986 goto fail;
4987 }
4988 ssl_print_string("key expansion", &key_block);
4989
4990 ptr=key_block.data;
4991 /* client/server write MAC key (for non-AEAD ciphers) */
4992 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4993 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4994 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4995 }
4996 /* client/server write encryption key */
4997 c_wk=ptr; ptr += encr_key_len;
4998 s_wk=ptr; ptr += encr_key_len;
4999 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
5000 if (write_iv_len > 0) {
5001 c_iv=ptr; ptr += write_iv_len;
5002 s_iv=ptr; /* ptr += write_iv_len; */
5003 }
5004
5005 /* export ciphers work with a smaller key length */
5006 if (is_export_cipher) {
5007 if (cipher_suite->mode == MODE_CBC) {
5008
5009 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
5010 all we should need. This is a sanity check */
5011 if (write_iv_len > MAX_BLOCK_SIZE16) {
5012 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
5013 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
5014 goto fail;
5015 }
5016
5017 if(ssl_session->session.version==SSLV3_VERSION0x300){
5018 /* The length of these fields are ignored by this caller */
5019 StringInfo iv_c, iv_s;
5020 iv_c.data = _iv_c;
5021 iv_s.data = _iv_s;
5022
5023 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
5024 if (!ssl3_generate_export_iv(&ssl_session->client_random,
5025 &ssl_session->server_random, &iv_c, write_iv_len)) {
5026 goto fail;
5027 }
5028 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
5029 if (!ssl3_generate_export_iv(&ssl_session->server_random,
5030 &ssl_session->client_random, &iv_s, write_iv_len)) {
5031 goto fail;
5032 }
5033 }
5034 else{
5035 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
5036 StringInfo iv_block;
5037 StringInfo key_null;
5038 uint8_t _key_null;
5039
5040 key_null.data = &_key_null;
5041 key_null.data_len = 0;
5042
5043 iv_block.data = _iv_block;
5044
5045 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
5046 if (!prf(ssl_session, &key_null, "IV block",
5047 &ssl_session->client_random,
5048 &ssl_session->server_random, &iv_block,
5049 write_iv_len * 2)) {
5050 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
5051 goto fail;
5052 }
5053
5054 memcpy(_iv_c, iv_block.data, write_iv_len);
5055 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
5056 }
5057
5058 c_iv=_iv_c;
5059 s_iv=_iv_s;
5060 }
5061
5062 if (ssl_session->session.version==SSLV3_VERSION0x300){
5063
5064 SSL_MD5_CTXgcry_md_hd_t md5;
5065 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
5066
5067 if (ssl_md5_init(&md5) != 0)
5068 goto fail;
5069 ssl_md5_update(&md5,c_wk,encr_key_len);
5070 ssl_md5_update(&md5,ssl_session->client_random.data,
5071 ssl_session->client_random.data_len);
5072 ssl_md5_update(&md5,ssl_session->server_random.data,
5073 ssl_session->server_random.data_len);
5074 ssl_md5_final(_key_c,&md5);
5075 ssl_md5_cleanup(&md5);
5076 c_wk=_key_c;
5077
5078 if (ssl_md5_init(&md5) != 0)
5079 goto fail;
5080 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
5081 ssl_md5_update(&md5,s_wk,encr_key_len);
5082 ssl_md5_update(&md5,ssl_session->server_random.data,
5083 ssl_session->server_random.data_len);
5084 ssl_md5_update(&md5,ssl_session->client_random.data,
5085 ssl_session->client_random.data_len);
5086 ssl_md5_final(_key_s,&md5);
5087 ssl_md5_cleanup(&md5);
5088 s_wk=_key_s;
5089 }
5090 else{
5091 StringInfo key_c, key_s, k;
5092 key_c.data = _key_c;
5093 key_s.data = _key_s;
5094
5095 k.data = c_wk;
5096 k.data_len = encr_key_len;
5097 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
5098 if (!prf(ssl_session, &k, "client write key",
5099 &ssl_session->client_random,
5100 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
5101 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
5102 goto fail;
5103 }
5104 c_wk=_key_c;
5105
5106 k.data = s_wk;
5107 k.data_len = encr_key_len;
5108 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
5109 if (!prf(ssl_session, &k, "server write key",
5110 &ssl_session->client_random,
5111 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
5112 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
5113 goto fail;
5114 }
5115 s_wk=_key_s;
5116 }
5117 }
5118
5119 /* show key material info */
5120 if (c_mk != NULL((void*)0)) {
5121 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5122 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5123 }
5124 ssl_print_data("Client Write key", c_wk, encr_key_len);
5125 ssl_print_data("Server Write key", s_wk, encr_key_len);
5126 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
5127 if (write_iv_len > 0) {
5128 ssl_print_data("Client Write IV", c_iv, write_iv_len);
5129 ssl_print_data("Server Write IV", s_iv, write_iv_len);
5130 }
5131
5132create_decoders:
5133 /* create both client and server ciphers*/
5134 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
5135 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
5136 if (!ssl_session->client_new) {
5137 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
5138 goto fail;
5139 }
5140 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
5141 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
5142 if (!ssl_session->server_new) {
5143 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
5144 goto fail;
5145 }
5146
5147 /* Continue the SSL stream after renegotiation with new keys. */
5148 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5149 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5150
5151 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
5152 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
5153 g_free(key_block.data);
5154 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
5155 return 0;
5156
5157fail:
5158 g_free(key_block.data);
5159 return -1;
5160}
5161
5162/* Generated the key material based on the given secret. */
5163bool_Bool
5164tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
5165{
5166 bool_Bool success = false0;
5167 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
5168 unsigned char *sn_key = NULL((void*)0);
5169 SslDecoder *decoder;
5170 unsigned key_length, iv_length;
5171 int hash_algo;
5172 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
5173 int cipher_algo;
5174
5175 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
5176 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
5177 ssl_session->session.version);
5178 return false0;
5179 }
5180
5181 if (cipher_suite == NULL((void*)0)) {
5182 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
5183 return false0;
5184 }
5185
5186 if (cipher_suite->kex != KEX_TLS130x23) {
5187 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
5188 return false0;
5189 }
5190
5191 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
5192 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
5193 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5194 cipher_algo = ssl_get_cipher_by_name(cipher_name);
5195 if (cipher_algo == 0) {
5196 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5197 return false0;
5198 }
5199
5200 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
5201 hash_algo = ssl_get_digest_by_name(hash_name);
5202 if (!hash_algo) {
5203 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
5204 return false0;
5205 }
5206
5207 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
5208 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
5209 iv_length = 12;
5210 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
5211
5212 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
5213 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
5214 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5215 return false0;
5216 }
5217 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
5218 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
5219 goto end;
5220 }
5221
5222 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5223 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
5224 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5225 goto end;
5226 }
5227 }
5228
5229 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
5230 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
5231 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5232 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
5233 }
5234
5235 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5236 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
5237 if (!decoder) {
5238 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5239 goto end;
5240 }
5241
5242 /* Continue the TLS session with new keys, but reuse old flow to keep things
5243 * like "Follow TLS" working (by linking application data records). */
5244 if (is_from_server) {
5245 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5246 ssl_session->server = decoder;
5247 } else {
5248 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5249 ssl_session->client = decoder;
5250 }
5251 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
5252 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
5253 success = true1;
5254
5255end:
5256 wmem_free(NULL((void*)0), write_key);
5257 wmem_free(NULL((void*)0), write_iv);
5258 if (sn_key)
5259 wmem_free(NULL((void*)0), sn_key);
5260 return success;
5261}
5262/* (Pre-)master secrets calculations }}} */
5263
5264#ifdef HAVE_LIBGNUTLS1
5265/* Decrypt RSA pre-master secret using RSA private key. {{{ */
5266static bool_Bool
5267ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
5268 StringInfo *encrypted_pre_master, GHashTable *key_hash)
5269{
5270 int ret;
5271
5272 if (!encrypted_pre_master)
5273 return false0;
5274
5275 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
5276 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
5277 "(cipher suite 0x%04X %s) and cannot be decrypted "
5278 "using a RSA private key file.\n",
5279 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
5280 val_to_str_ext_const(ssl_session->session.cipher,
5281 &ssl_31_ciphersuite_ext, "unknown"));
5282 return false0;
5283 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
5284 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
5285 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
5286 return false0;
5287 }
5288
5289 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
5290
5291 ssl_print_string("pre master encrypted", encrypted_pre_master);
5292 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
5293 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
5294 gnutls_datum_t pms = { 0 };
5295 if (pk) {
5296 // Try to decrypt using the RSA keys table from (D)TLS preferences.
5297 char *err = NULL((void*)0);
5298 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
5299 if (!private_key) {
5300 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
5301 g_free(err);
5302 return false0;
5303 }
5304
5305 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
5306 rsa_private_key_free(private_key);
5307 if (pms.size == 0) {
5308 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
5309 g_free(err);
5310 return false0;
5311 }
5312 } else {
5313 // Try to decrypt using a hardware token.
5314 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
5315 if (ret < 0) {
5316 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
5317 return false0;
5318 }
5319 }
5320
5321 if (pms.size != 48) {
5322 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
5323 G_STRFUNC((const char*) (__func__)), pms.size, 48);
5324 g_free(pms.data);
5325 return false0;
5326 }
5327
5328 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
5329 ssl_session->pre_master_secret.data_len = 48;
5330 g_free(pms.data);
5331 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
5332
5333 /* Remove the master secret if it was there.
5334 This forces keying material regeneration in
5335 case we're renegotiating */
5336 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
5337 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
5338 return true1;
5339} /* }}} */
5340#endif /* HAVE_LIBGNUTLS */
5341
5342/* Decryption integrity check {{{ */
5343
5344static int
5345tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
5346 uint32_t datalen, uint8_t* mac)
5347{
5348 SSL_HMACgcry_md_hd_t hm;
5349 int md;
5350 uint32_t len;
5351 uint8_t buf[DIGEST_MAX_SIZE48];
5352 int16_t temp;
5353
5354 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5355 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
5356 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5357
5358 if (ssl_hmac_init(&hm,md) != 0)
5359 return -1;
5360 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5361 return -1;
5362
5363 /* hash sequence number */
5364 phtonu64(buf, decoder->seq);
5365
5366 decoder->seq++;
5367
5368 ssl_hmac_update(&hm,buf,8);
5369
5370 /* hash content type */
5371 buf[0]=ct;
5372 ssl_hmac_update(&hm,buf,1);
5373
5374 /* hash version,data length and data*/
5375 /* *((int16_t*)buf) = g_htons(ver); */
5376 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
5377 memcpy(buf, &temp, 2);
5378 ssl_hmac_update(&hm,buf,2);
5379
5380 /* *((int16_t*)buf) = g_htons(datalen); */
5381 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
5382 memcpy(buf, &temp, 2);
5383 ssl_hmac_update(&hm,buf,2);
5384 ssl_hmac_update(&hm,data,datalen);
5385
5386 /* get digest and digest len*/
5387 len = sizeof(buf);
5388 ssl_hmac_final(&hm,buf,&len);
5389 ssl_hmac_cleanup(&hm);
5390 ssl_print_data("Mac", buf, len);
5391 if(memcmp(mac,buf,len))
5392 return -1;
5393
5394 return 0;
5395}
5396
5397static int
5398ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
5399 uint32_t datalen, uint8_t* mac)
5400{
5401 SSL_MDgcry_md_hd_t mc;
5402 int md;
5403 uint32_t len;
5404 uint8_t buf[64],dgst[20];
5405 int pad_ct;
5406 int16_t temp;
5407
5408 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
5409
5410 /* get cipher used for digest computation */
5411 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5412 if (ssl_md_init(&mc,md) !=0)
5413 return -1;
5414
5415 /* do hash computation on data && padding */
5416 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5417
5418 /* hash padding*/
5419 memset(buf,0x36,pad_ct);
5420 ssl_md_update(&mc,buf,pad_ct);
5421
5422 /* hash sequence number */
5423 phtonu64(buf, decoder->seq);
5424 decoder->seq++;
5425 ssl_md_update(&mc,buf,8);
5426
5427 /* hash content type */
5428 buf[0]=ct;
5429 ssl_md_update(&mc,buf,1);
5430
5431 /* hash data length in network byte order and data*/
5432 /* *((int16_t* )buf) = g_htons(datalen); */
5433 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
5434 memcpy(buf, &temp, 2);
5435 ssl_md_update(&mc,buf,2);
5436 ssl_md_update(&mc,data,datalen);
5437
5438 /* get partial digest */
5439 ssl_md_final(&mc,dgst,&len);
5440 ssl_md_reset(&mc);
5441
5442 /* hash mac key */
5443 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5444
5445 /* hash padding and partial digest*/
5446 memset(buf,0x5c,pad_ct);
5447 ssl_md_update(&mc,buf,pad_ct);
5448 ssl_md_update(&mc,dgst,len);
5449
5450 ssl_md_final(&mc,dgst,&len);
5451 ssl_md_cleanup(&mc);
5452
5453 if(memcmp(mac,dgst,len))
5454 return -1;
5455
5456 return 0;
5457}
5458
5459static int
5460dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
5461 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
5462{
5463 SSL_HMACgcry_md_hd_t hm;
5464 int md;
5465 uint32_t len;
5466 uint8_t buf[DIGEST_MAX_SIZE48];
5467 int16_t temp;
5468
5469 int ver = ssl->session.version;
5470 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
5471
5472 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5473 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
5474 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5475
5476 if (ssl_hmac_init(&hm,md) != 0)
5477 return -1;
5478 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5479 return -1;
5480
5481 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
5482
5483 if (is_cid && !ssl->session.deprecated_cid) {
5484 /* hash seq num placeholder */
5485 memset(buf,0xFF,8);
5486 ssl_hmac_update(&hm,buf,8);
5487
5488 /* hash content type + cid length + content type */
5489 buf[0]=ct;
5490 buf[1]=cidl;
5491 buf[2]=ct;
5492 ssl_hmac_update(&hm,buf,3);
5493
5494 /* hash version */
5495 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
5496 memcpy(buf, &temp, 2);
5497 ssl_hmac_update(&hm,buf,2);
5498
5499 /* hash sequence number */
5500 phtonu64(buf, decoder->seq);
5501 buf[0]=decoder->epoch>>8;
5502 buf[1]=(uint8_t)decoder->epoch;
5503 ssl_hmac_update(&hm,buf,8);
5504
5505 /* hash cid */
5506 ssl_hmac_update(&hm,cid,cidl);
5507 } else {
5508 /* hash sequence number */
5509 phtonu64(buf, decoder->seq);
5510 buf[0]=decoder->epoch>>8;
5511 buf[1]=(uint8_t)decoder->epoch;
5512 ssl_hmac_update(&hm,buf,8);
5513
5514 /* hash content type */
5515 buf[0]=ct;
5516 ssl_hmac_update(&hm,buf,1);
5517
5518 /* hash version */
5519 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
5520 memcpy(buf, &temp, 2);
5521 ssl_hmac_update(&hm,buf,2);
5522
5523 if (is_cid && ssl->session.deprecated_cid) {
5524 /* hash cid */
5525 ssl_hmac_update(&hm,cid,cidl);
5526
5527 /* hash cid length */
5528 buf[0] = cidl;
5529 ssl_hmac_update(&hm,buf,1);
5530 }
5531 }
5532
5533 /* data length and data */
5534 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
5535 memcpy(buf, &temp, 2);
5536 ssl_hmac_update(&hm,buf,2);
5537 ssl_hmac_update(&hm,data,datalen);
5538
5539 /* get digest and digest len */
5540 len = sizeof(buf);
5541 ssl_hmac_final(&hm,buf,&len);
5542 ssl_hmac_cleanup(&hm);
5543 ssl_print_data("Mac", buf, len);
5544 if(memcmp(mac,buf,len))
5545 return -1;
5546
5547 return 0;
5548}
5549/* Decryption integrity check }}} */
5550
5551
5552static bool_Bool
5553tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
5554 uint8_t ct, uint16_t record_version,
5555 bool_Bool ignore_mac_failed,
5556 const unsigned char *in, uint16_t inl,
5557 const unsigned char *cid, uint8_t cidl,
5558 StringInfo *out_str, unsigned *outl)
5559{
5560 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
5561 * GenericAEADCipher: { nonce_explicit, [content] }
5562 * In TLS 1.3 this explicit nonce is gone.
5563 * With AES GCM/CCM, "[content]" is actually the concatenation of the
5564 * ciphertext and authentication tag.
5565 */
5566 const uint16_t version = ssl->session.version;
5567 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
5568 gcry_error_t err;
5569 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
5570 unsigned ciphertext_len, auth_tag_len;
5571 unsigned char nonce[12];
5572 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
5573 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
5574 const uint8_t draft_version = ssl->session.tls13_draft_version;
5575 const unsigned char *auth_tag_wire;
5576 unsigned char auth_tag_calc[16];
5577 unsigned char *aad = NULL((void*)0);
5578 unsigned aad_len = 0;
5579
5580 switch (cipher_mode) {
5581 case MODE_GCM:
5582 case MODE_CCM:
5583 case MODE_POLY1305:
5584 auth_tag_len = 16;
5585 break;
5586 case MODE_CCM_8:
5587 auth_tag_len = 8;
5588 break;
5589 default:
5590 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
5591 return false0;
5592 }
5593
5594 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
5595 if (is_v12 && cipher_mode != MODE_POLY1305) {
5596 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
5597 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
5598 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
5599 return false0;
5600 }
5601 explicit_nonce = in;
5602 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
5603 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
5604 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5605 if (inl < auth_tag_len) {
5606 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
5607 return false0;
5608 }
5609 ciphertext = in;
5610 ciphertext_len = inl - auth_tag_len;
5611 } else {
5612 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
5613 return false0;
5614 }
5615 auth_tag_wire = ciphertext + ciphertext_len;
5616
5617 /*
5618 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
5619 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
5620 */
5621 if (is_v12 && cipher_mode != MODE_POLY1305) {
5622 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5622, "decoder->write_iv.data_len == 4"))));
5623 /* Implicit (4) and explicit (8) part of nonce. */
5624 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
5625 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
5626
5627 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5628 /*
5629 * Technically the nonce length must be at least 8 bytes, but for
5630 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5631 */
5632 const unsigned nonce_len = 12;
5633 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5633, "decoder->write_iv.data_len == nonce_len"
))));
5634 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5635 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5636 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
5637 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5638 }
5639
5640 /* Set nonce and additional authentication data */
5641 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
5642 ssl_print_data("nonce", nonce, 12);
5643 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5644 if (err) {
5645 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5646 return false0;
5647 }
5648
5649 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5650 if (is_cid) { /* if connection ID */
5651 if (ssl->session.deprecated_cid) {
5652 aad_len = 14 + cidl;
5653 aad = wmem_alloc(allocator, aad_len);
5654 phtonu64(aad, decoder->seq); /* record sequence number */
5655 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5656 aad[8] = ct; /* TLSCompressed.type */
5657 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5658 memcpy(aad + 11, cid, cidl); /* cid */
5659 aad[11 + cidl] = cidl; /* cid_length */
5660 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5661 } else {
5662 aad_len = 23 + cidl;
5663 aad = wmem_alloc(allocator, aad_len);
5664 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5665 aad[8] = ct; /* TLSCompressed.type */
5666 aad[9] = cidl; /* cid_length */
5667 aad[10] = ct; /* TLSCompressed.type */
5668 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
5669 phtonu64(aad + 13, decoder->seq); /* record sequence number */
5670 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5671 memcpy(aad + 21, cid, cidl); /* cid */
5672 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5673 }
5674 } else if (is_v12) {
5675 aad_len = 13;
5676 aad = wmem_alloc(allocator, aad_len);
5677 phtonu64(aad, decoder->seq); /* record sequence number */
5678 if (version == DTLSV1DOT2_VERSION0xfefd) {
5679 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5680 }
5681 aad[8] = ct; /* TLSCompressed.type */
5682 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5683 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5684 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5685 aad_len = decoder->dtls13_aad.data_len;
5686 aad = decoder->dtls13_aad.data;
5687 } else if (draft_version >= 25 || draft_version == 0) {
5688 aad_len = 5;
5689 aad = wmem_alloc(allocator, aad_len);
5690 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5691 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5692 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
5693 }
5694
5695 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5696 /* size of plaintext, additional authenticated data and auth tag. */
5697 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5698
5699 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5700 }
5701
5702 if (aad && aad_len > 0) {
5703 ssl_print_data("AAD", aad, aad_len);
5704 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5705 if (err) {
5706 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5707 return false0;
5708 }
5709 }
5710
5711 /* Decrypt now that nonce and AAD are set. */
5712 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5713 if (err) {
5714 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5715 return false0;
5716 }
5717
5718 /* Check authentication tag for authenticity (replaces MAC) */
5719 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5720 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5721 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5722 } else {
5723 if (err) {
5724 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5725 } else {
5726 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5727 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5728 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5729 }
5730 if (ignore_mac_failed) {
5731 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5732 } else {
5733 return false0;
5734 }
5735 }
5736
5737 /*
5738 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5739 * after successful authentication to ensure that early data is skipped when
5740 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5741 */
5742 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5743 decoder->seq++;
5744 }
5745
5746 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5747 *outl = ciphertext_len;
5748 return true1;
5749}
5750
5751/* Record decryption glue based on security parameters {{{ */
5752/* Assume that we are called only for a non-NULL decoder which also means that
5753 * we have a non-NULL decoder->cipher_suite. */
5754int
5755ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5756 bool_Bool ignore_mac_failed,
5757 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5758 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5759{
5760 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5761 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5762
5763 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5764 ssl_print_data("Ciphertext",in, inl);
5765
5766 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5767 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5768 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5769 return -1;
5770 }
5771
5772 /* ensure we have enough storage space for decrypted data */
5773 if (inl > out_str->data_len)
5774 {
5775 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5776 inl + 32, out_str->data_len);
5777 ssl_data_realloc(out_str, inl + 32);
5778 }
5779
5780 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5781 * a separate MAC, so use a different routine for simplicity. */
5782 if (decoder->cipher_suite->mode == MODE_GCM ||
5783 decoder->cipher_suite->mode == MODE_CCM ||
5784 decoder->cipher_suite->mode == MODE_CCM_8 ||
5785 decoder->cipher_suite->mode == MODE_POLY1305 ||
5786 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5787 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5788
5789 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5790 /* decryption failed */
5791 return -1;
5792 }
5793
5794 goto skip_mac;
5795 }
5796
5797 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5798 * (notation: { unencrypted, [ encrypted ] })
5799 * GenericStreamCipher: { [content, mac] }
5800 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5801 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5802 * GenericAEADCipher: { nonce_explicit, [content] }
5803 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5804 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5805 */
5806
5807 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5808
5809 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5810 if (decoder->cipher_suite->mode == MODE_CBC) {
5811 unsigned blocksize = 0;
5812
5813 switch (ssl->session.version) {
5814 case TLSV1DOT1_VERSION0x302:
5815 case TLSV1DOT2_VERSION0x303:
5816 case DTLSV1DOT0_VERSION0xfeff:
5817 case DTLSV1DOT2_VERSION0xfefd:
5818 case DTLSV1DOT3_VERSION0xfefc:
5819 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5820 case TLCPV1_VERSION0x101:
5821 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5822 if (inl < blocksize) {
5823 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5824 inl, blocksize);
5825 return -1;
5826 }
5827 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5828 if (pad != 0) {
5829 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5830 gcry_strsource (pad), gcry_strerror (pad));
5831 }
5832
5833 inl -= blocksize;
5834 in += blocksize;
5835 break;
5836 }
5837
5838 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5839 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5840 /*
5841 * MAC is calculated over (IV + ) ENCRYPTED contents:
5842 *
5843 * MAC(MAC_write_key, ... +
5844 * IV + // for TLS 1.1 or greater
5845 * TLSCiphertext.enc_content);
5846 */
5847 if (inl < maclen) {
5848 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5849 G_STRFUNC((const char*) (__func__)), inl, maclen);
5850 return -1;
5851 }
5852 inl -= maclen;
5853 mac = (uint8_t *)in + inl;
5854 mac_frag = (uint8_t *)in - blocksize;
5855 mac_fraglen = blocksize + inl;
5856 }
5857 }
5858
5859 /* First decrypt*/
5860 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5861 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5862 gcry_strerror (pad));
5863 return -1;
5864 }
5865
5866 ssl_print_data("Plaintext", out_str->data, inl);
5867 worklen=inl;
5868
5869
5870 /* strip padding for GenericBlockCipher */
5871 if (decoder->cipher_suite->mode == MODE_CBC) {
5872 if (inl < 1) { /* Should this check happen earlier? */
5873 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5874 return -1;
5875 }
5876 pad=out_str->data[inl-1];
5877 if (worklen <= pad) {
5878 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5879 pad, worklen);
5880 return -1;
5881 }
5882 worklen-=(pad+1);
5883 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5884 pad, worklen);
5885 }
5886
5887 /* MAC for GenericStreamCipher and GenericBlockCipher.
5888 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5889 if (!mac) {
5890 /*
5891 * MAC is calculated over the DECRYPTED contents:
5892 *
5893 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5894 */
5895 if (worklen < maclen) {
5896 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5897 return -1;
5898 }
5899 worklen -= maclen;
5900 mac = out_str->data + worklen;
5901 mac_frag = out_str->data;
5902 mac_fraglen = worklen;
5903 }
5904
5905 /* If NULL encryption active and no keys are available, do not bother
5906 * checking the MAC. We do not have keys for that. */
5907 if (decoder->cipher_suite->mode == MODE_STREAM &&
5908 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5909 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5910 ssl_debug_printf("MAC check skipped due to missing keys\n");
5911 decoder->seq++; // Increment this for display
5912 goto skip_mac;
5913 }
5914
5915 /* Now check the MAC */
5916 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5917 worklen, ssl->session.version, ct, decoder->seq);
5918 if(ssl->session.version==SSLV3_VERSION0x300){
5919 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5920 if(ignore_mac_failed) {
5921 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5922 }
5923 else{
5924 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5925 return -1;
5926 }
5927 }
5928 else{
5929 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5930 }
5931 }
5932 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5933 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5934 if(ignore_mac_failed) {
5935 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5936 }
5937 else{
5938 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5939 return -1;
5940 }
5941 }
5942 else{
5943 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5944 }
5945 }
5946 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5947 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5948 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5949 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5950 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5951 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5952 }
5953 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5954 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5955 }
5956 else if(ignore_mac_failed) {
5957 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5958 }
5959 else{
5960 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5961 return -1;
5962 }
5963 }
5964skip_mac:
5965
5966 *outl = worklen;
5967
5968 if (decoder->compression > 0) {
5969 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5970 ssl_data_copy(comp_str, out_str);
5971 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5972 if (!decoder->decomp) {
5973 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5974 return -1;
5975 }
5976 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5977 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5978 *outl = uncomplen;
5979 }
5980
5981 return 0;
5982}
5983/* Record decryption glue based on security parameters }}} */
5984
5985
5986
5987#ifdef HAVE_LIBGNUTLS1
5988
5989/* RSA private key file processing {{{ */
5990static void
5991ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5992 const gnutls_datum_t *subjectPublicKeyInfo)
5993{
5994 gnutls_pubkey_t pubkey = NULL((void*)0);
5995 cert_key_id_t key_id;
5996 size_t key_id_len = sizeof(key_id);
5997 int r;
5998
5999 if (!subjectPublicKeyInfo->size) {
6000 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
6001 return;
6002 }
6003
6004 r = gnutls_pubkey_init(&pubkey);
6005 if (r < 0) {
6006 ssl_debug_printf("%s: failed to init pubkey: %s\n",
6007 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
6008 return;
6009 }
6010
6011 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
6012 if (r < 0) {
6013 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
6014 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
6015 goto end;
6016 }
6017
6018 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
6019 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
6020 goto end;
6021 }
6022
6023 /* Generate a 20-byte SHA-1 hash. */
6024 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
6025 if (r < 0) {
6026 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
6027 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
6028 goto end;
6029 }
6030
6031 if (key_id_len != sizeof(key_id)) {
6032 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
6033 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
6034 goto end;
6035 }
6036
6037 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
6038 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
6039 *ssl->cert_key_id = key_id;
6040
6041end:
6042 gnutls_pubkey_deinit(pubkey);
6043}
6044
6045/* RSA private key file processing }}} */
6046#endif /* HAVE_LIBGNUTLS */
6047
6048/*--- Start of dissector-related code below ---*/
6049
6050/* This is not a "protocol" but ensures that this gets called during
6051 * the handoff stage. */
6052void proto_reg_handoff_tls_utils(void);
6053
6054static dissector_handle_t base_tls_handle;
6055static dissector_handle_t dtls_handle;
6056
6057void
6058proto_reg_handoff_tls_utils(void)
6059{
6060 base_tls_handle = find_dissector("tls");
6061 dtls_handle = find_dissector("dtls");
6062}
6063
6064/* get ssl data for this session. if no ssl data is found allocate a new one*/
6065SslDecryptSession *
6066ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle)
6067{
6068 void *conv_data;
6069 SslDecryptSession *ssl_session;
6070 int proto_ssl;
6071
6072 /* Note proto_ssl is tls for either the main tls_handle or the
6073 * tls13_handshake handle used by QUIC. */
6074 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
6075 conv_data = conversation_get_proto_data(conversation, proto_ssl);
6076 if (conv_data != NULL((void*)0))
6077 return (SslDecryptSession *)conv_data;
6078
6079 /* no previous SSL conversation info, initialize it. */
6080 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
6081
6082 /* data_len is the part that is meaningful, not the allocated length */
6083 ssl_session->master_secret.data_len = 0;
6084 ssl_session->master_secret.data = ssl_session->_master_secret;
6085 ssl_session->session_id.data_len = 0;
6086 ssl_session->session_id.data = ssl_session->_session_id;
6087 ssl_session->client_random.data_len = 0;
6088 ssl_session->client_random.data = ssl_session->_client_random;
6089 ssl_session->server_random.data_len = 0;
6090 ssl_session->server_random.data = ssl_session->_server_random;
6091 ssl_session->session_ticket.data_len = 0;
6092 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
6093 ssl_session->server_data_for_iv.data_len = 0;
6094 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
6095 ssl_session->client_data_for_iv.data_len = 0;
6096 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
6097 ssl_session->app_data_segment.data = NULL((void*)0);
6098 ssl_session->app_data_segment.data_len = 0;
6099 ssl_session->handshake_data.data=NULL((void*)0);
6100 ssl_session->handshake_data.data_len=0;
6101 ssl_session->ech_transcript.data=NULL((void*)0);
6102 ssl_session->ech_transcript.data_len=0;
6103
6104 /* Initialize parameters which are not necessary specific to decryption. */
6105 ssl_session->session.version = SSL_VER_UNKNOWN0;
6106 clear_address(&ssl_session->session.srv_addr);
6107 ssl_session->session.srv_ptype = PT_NONE;
6108 ssl_session->session.srv_port = 0;
6109 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
6110 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
6111 ssl_session->session.client_random.data_len = 0;
6112 ssl_session->session.client_random.data = ssl_session->session._client_random;
6113 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
6114 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
6115 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
6116 ssl_session->session.ech = false0;
6117 ssl_session->session.hrr_ech_declined = false0;
6118 ssl_session->session.first_ch_ech_frame = 0;
6119
6120 /* We want to increment the stream count for the normal tls handle and
6121 * dtls handle, but presumably not for the tls13_handshake handle used
6122 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
6123 * doesn't get sent to the TLS follow tap.)
6124 */
6125 if (tls_handle == base_tls_handle) {
6126 ssl_session->session.stream = tls_increment_stream_count();
6127 } else if (tls_handle == dtls_handle) {
6128 ssl_session->session.stream = dtls_increment_stream_count();
6129 }
6130
6131 conversation_add_proto_data(conversation, proto_ssl, ssl_session);
6132 return ssl_session;
6133}
6134
6135void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
6136{
6137 if (ssl) {
6138 /* Ensure that secrets are not restored using stale identifiers. Split
6139 * between client and server in case the packets somehow got out of order. */
6140 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
6141
6142 if (is_client) {
6143 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
6144 ssl->session_id.data_len = 0;
6145 ssl->session_ticket.data_len = 0;
6146 ssl->master_secret.data_len = 0;
6147 ssl->client_random.data_len = 0;
6148 ssl->has_early_data = false0;
6149 if (ssl->handshake_data.data_len > 0) {
6150 // The EMS handshake hash starts with at the Client Hello,
6151 // ensure that any messages before it are forgotten.
6152 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
6153 ssl->handshake_data.data = NULL((void*)0);
6154 ssl->handshake_data.data_len = 0;
6155 }
6156 } else {
6157 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
6158 ssl->server_random.data_len = 0;
6159 ssl->pre_master_secret.data_len = 0;
6160#ifdef HAVE_LIBGNUTLS1
6161 ssl->cert_key_id = NULL((void*)0);
6162#endif
6163 ssl->psk.data_len = 0;
6164 }
6165
6166 if (ssl->state & clear_flags) {
6167 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
6168 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
6169 ssl->state &= ~clear_flags;
6170 }
6171 }
6172
6173 /* These flags might be used for non-decryption purposes and may affect the
6174 * dissection, so reset them as well. */
6175 if (is_client) {
6176 session->client_cert_type = 0;
6177 } else {
6178 session->compression = 0;
6179 session->server_cert_type = 0;
6180 /* session->is_session_resumed is already handled in the ServerHello dissection. */
6181 }
6182 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
6183 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
6184}
6185
6186void
6187tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
6188 dissector_handle_t app_handle)
6189{
6190 conversation_t *conversation;
6191 SslSession *session;
6192
6193 /* Ignore if the TLS or other dissector is disabled. */
6194 if (!tls_handle || !app_handle)
6195 return;
6196
6197 conversation = find_or_create_conversation(pinfo);
6198 session = &ssl_get_session(conversation, tls_handle)->session;
6199 session->app_handle = app_handle;
6200}
6201
6202static uint32_t
6203ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
6204 dissector_handle_t app_handle, uint32_t last_nontls_frame)
6205{
6206 conversation_t *conversation;
6207 SslSession *session;
6208
6209 /* Ignore if the TLS dissector is disabled. */
6210 if (!tls_handle)
6211 return 0;
6212 /* The caller should always pass a valid handle to its own dissector. */
6213 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6213, "app_handle"))));
6214
6215 conversation = find_or_create_conversation(pinfo);
6216 session = &ssl_get_session(conversation, tls_handle)->session;
6217
6218 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6219 session->last_nontls_frame,
6220 (void *)session->app_handle,
6221 dissector_handle_get_dissector_name(session->app_handle));
6222 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6223 pinfo->num, (void *)app_handle,
6224 dissector_handle_get_dissector_name(app_handle));
6225
6226 /* Do not switch again if a dissector did it before. */
6227 if (session->last_nontls_frame) {
6228 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
6229 return session->last_nontls_frame;
6230 }
6231
6232 session->app_handle = app_handle;
6233 /* The TLS dissector should be called first for this conversation. */
6234 conversation_set_dissector(conversation, tls_handle);
6235 /* TLS starts after this frame. */
6236 session->last_nontls_frame = last_nontls_frame;
6237 return 0;
6238}
6239
6240/* ssl_starttls_ack: mark future frames as encrypted. */
6241uint32_t
6242ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6243 dissector_handle_t app_handle)
6244{
6245 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
6246}
6247
6248uint32_t
6249ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6250 dissector_handle_t app_handle)
6251{
6252 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
6253}
6254
6255dissector_handle_t
6256ssl_find_appdata_dissector(const char *name)
6257{
6258 /* Accept 'http' for backwards compatibility and sanity. */
6259 if (!strcmp(name, "http"))
6260 name = "http-over-tls";
6261 /* XXX - Should this check to see if the dissector is actually added for
6262 * Decode As in the appropriate table?
6263 */
6264 return find_dissector(name);
6265}
6266
6267/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
6268static int
6269ssl_equal (const void *v, const void *v2)
6270{
6271 const StringInfo *val1;
6272 const StringInfo *val2;
6273 val1 = (const StringInfo *)v;
6274 val2 = (const StringInfo *)v2;
6275
6276 if (val1->data_len == val2->data_len &&
6277 !memcmp(val1->data, val2->data, val2->data_len)) {
6278 return 1;
6279 }
6280 return 0;
6281}
6282
6283static unsigned
6284ssl_hash (const void *v)
6285{
6286 unsigned l,hash;
6287 const StringInfo* id;
6288 const unsigned* cur;
6289 hash = 0;
6290 id = (const StringInfo*) v;
6291
6292 /* id and id->data are mallocated in ssl_save_master_key(). As such 'data'
6293 * should be aligned for any kind of access (for example as a unsigned as
6294 * is done below). The intermediate void* cast is to prevent "cast
6295 * increases required alignment of target type" warnings on CPUs (such
6296 * as SPARCs) that do not allow misaligned memory accesses.
6297 */
6298 cur = (const unsigned*)(void*) id->data;
6299
6300 for (l=4; (l < id->data_len); l+=4, cur++)
6301 hash = hash ^ (*cur);
6302
6303 return hash;
6304}
6305/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
6306
6307/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
6308void
6309ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6310{
6311 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6311, "main_handle"))));
6312 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6312, "subdissector_handle"))));
6313 /* Registration is required for Export PDU feature to work properly. */
6314 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6315, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
6315 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6315, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
6316 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
6317
6318 if (port) {
6319 dissector_add_uint(dissector_table_name, port, subdissector_handle);
6320 if (tcp)
6321 dissector_add_uint("tcp.port", port, main_handle);
6322 else
6323 dissector_add_uint("udp.port", port, main_handle);
6324 dissector_add_uint("sctp.port", port, main_handle);
6325 } else {
6326 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
6327 }
6328}
6329
6330void
6331ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6332{
6333 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
6334 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
6335 if (main_handle) {
6336 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
6337 dissector_delete_uint("sctp.port", port, main_handle);
6338 }
6339
6340 if (port) {
6341 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
6342 }
6343}
6344
6345void
6346ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
6347{
6348 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
6349 session->srv_ptype = ptype;
6350 session->srv_port = port;
6351}
6352
6353int
6354ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
6355{
6356 int ret;
6357 if (session && session->srv_addr.type != AT_NONE) {
6358 ret = (session->srv_ptype == pinfo->ptype) &&
6359 (session->srv_port == pinfo->srcport) &&
6360 addresses_equal(&session->srv_addr, &pinfo->src);
6361 } else {
6362 ret = (dissector_get_uint_handle(table, pinfo->srcport) != 0);
6363 }
6364
6365 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
6366 return ret;
6367}
6368/* Handling of association between tls/dtls ports and clear text protocol. }}} */
6369
6370
6371/* Links SSL records with the real packet data. {{{ */
6372SslPacketInfo *
6373tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
6374{
6375 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6376 if (!pi) {
6377 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
6378 pi->srcport = pinfo->srcport;
6379 pi->destport = pinfo->destport;
6380 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
6381 }
6382
6383 return pi;
6384}
6385
6386/**
6387 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
6388 * avoid the need for a decoder in the second pass. Additionally, it remembers
6389 * sequence numbers (for reassembly and Follow TLS Stream).
6390 *
6391 * @param proto The protocol identifier (proto_ssl or proto_dtls).
6392 * @param pinfo The packet where the record originates from.
6393 * @param plain_data Decrypted plaintext to store in the record.
6394 * @param plain_data_len Total length of the plaintext.
6395 * @param content_len Length of the plaintext section corresponding to the record content.
6396 * @param record_id The identifier for this record within the current packet.
6397 * @param flow Information about sequence numbers, etc.
6398 * @param type TLS Content Type (such as handshake or application_data).
6399 * @param curr_layer_num_ssl The layer identifier for this TLS session.
6400 */
6401void
6402ssl_add_record_info(int proto, packet_info *pinfo,
6403 const unsigned char *plain_data, int plain_data_len, int content_len,
6404 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
6405 uint64_t record_seq)
6406{
6407 SslRecordInfo* rec, **prec;
6408 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
6409
6410 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 6410
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
6411
6412 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
6413 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
6414 rec->plain_data_len = plain_data_len;
6415 rec->content_len = content_len;
6416 rec->id = record_id;
6417 rec->type = type;
6418 rec->next = NULL((void*)0);
6419 rec->record_seq = record_seq;
6420
6421 if (flow && type == SSL_ID_APP_DATA) {
6422 rec->seq = flow->byte_seq;
6423 rec->flow = flow;
6424 flow->byte_seq += content_len;
6425 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
6426 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
6427 }
6428
6429 /* Remember decrypted records. */
6430 prec = &pi->records;
6431 while (*prec) prec = &(*prec)->next;
6432 *prec = rec;
6433}
6434
6435/* search in packet data for the specified id; return a newly created tvb for the associated data */
6436tvbuff_t*
6437ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
6438{
6439 SslRecordInfo* rec;
6440 SslPacketInfo* pi;
6441 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6442
6443 if (!pi)
6444 return NULL((void*)0);
6445
6446 for (rec = pi->records; rec; rec = rec->next)
6447 if (rec->id == record_id) {
6448 *matched_record = rec;
6449 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
6450 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
6451 }
6452
6453 return NULL((void*)0);
6454}
6455/* Links SSL records with the real packet data. }}} */
6456
6457/* initialize/reset per capture state data (ssl sessions cache). {{{ */
6458void
6459ssl_common_init(ssl_master_key_map_t *mk_map,
6460 StringInfo *decrypted_data, StringInfo *compressed_data)
6461{
6462 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
6463 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
6464 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
6465 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
6466 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
6467 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
6468 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6469 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6470 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6471 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6472 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6473 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6474
6475 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
6476 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
6477
6478 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
6479
6480 ssl_data_alloc(decrypted_data, 32);
6481 ssl_data_alloc(compressed_data, 32);
6482}
6483
6484void
6485ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
6486 StringInfo *decrypted_data, StringInfo *compressed_data)
6487{
6488 g_hash_table_destroy(mk_map->session);
6489 g_hash_table_destroy(mk_map->tickets);
6490 g_hash_table_destroy(mk_map->crandom);
6491 g_hash_table_destroy(mk_map->pre_master);
6492 g_hash_table_destroy(mk_map->pms);
6493 g_hash_table_destroy(mk_map->tls13_client_early);
6494 g_hash_table_destroy(mk_map->tls13_client_handshake);
6495 g_hash_table_destroy(mk_map->tls13_server_handshake);
6496 g_hash_table_destroy(mk_map->tls13_client_appdata);
6497 g_hash_table_destroy(mk_map->tls13_server_appdata);
6498 g_hash_table_destroy(mk_map->tls13_early_exporter);
6499 g_hash_table_destroy(mk_map->tls13_exporter);
6500
6501 g_hash_table_destroy(mk_map->ech_secret);
6502 g_hash_table_destroy(mk_map->ech_config);
6503
6504 g_hash_table_destroy(mk_map->used_crandom);
6505
6506 g_free(decrypted_data->data);
6507 g_free(compressed_data->data);
6508
6509 /* close the previous keylog file now that the cache are cleared, this
6510 * allows the cache to be filled with the full keylog file contents. */
6511 if (*ssl_keylog_file) {
6512 fclose(*ssl_keylog_file);
6513 *ssl_keylog_file = NULL((void*)0);
6514 }
6515}
6516/* }}} */
6517
6518/* parse ssl related preferences (private keys and ports association strings) */
6519#if defined(HAVE_LIBGNUTLS1)
6520/* Load a single RSA key file item from preferences. {{{ */
6521void
6522ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
6523{
6524 gnutls_x509_privkey_t x509_priv_key;
6525 gnutls_privkey_t priv_key = NULL((void*)0);
6526 FILE* fp = NULL((void*)0);
6527 int ret;
6528 size_t key_id_len = 20;
6529 unsigned char *key_id = NULL((void*)0);
6530 char *err = NULL((void*)0);
6531 dissector_handle_t handle;
6532 /* try to load keys file first */
6533 fp = ws_fopenfopen(uats->keyfile, "rb");
6534 if (!fp) {
6535 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
6536 return;
6537 }
6538
6539 if ((int)strlen(uats->password) == 0) {
6540 x509_priv_key = rsa_load_pem_key(fp, &err);
6541 } else {
6542 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
6543 }
6544 fclose(fp);
6545
6546 if (!x509_priv_key) {
6547 if (err) {
6548 report_failure("Can't load private key from %s: %s",
6549 uats->keyfile, err);
6550 g_free(err);
6551 } else
6552 report_failure("Can't load private key from %s: unknown error",
6553 uats->keyfile);
6554 return;
6555 }
6556 if (err) {
6557 report_failure("Load of private key from %s \"succeeded\" with error %s",
6558 uats->keyfile, err);
6559 g_free(err);
6560 }
6561
6562 gnutls_privkey_init(&priv_key);
6563 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6564 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6565 if (ret < 0) {
6566 report_failure("Can't convert private key %s: %s",
6567 uats->keyfile, gnutls_strerror(ret));
6568 goto end;
6569 }
6570
6571 key_id = (unsigned char *) g_malloc0(key_id_len);
6572 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6573 if (ret < 0) {
6574 report_failure("Can't calculate public key ID for %s: %s",
6575 uats->keyfile, gnutls_strerror(ret));
6576 goto end;
6577 }
6578 ssl_print_data("KeyID", key_id, key_id_len);
6579 if (key_id_len != 20) {
6580 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6581 uats->keyfile, key_id_len);
6582 goto end;
6583 }
6584
6585 g_hash_table_replace(key_hash, key_id, priv_key);
6586 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6587 priv_key = NULL((void*)0);
6588 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6589
6590 handle = ssl_find_appdata_dissector(uats->protocol);
6591 if (handle) {
6592 /* Port to subprotocol mapping */
6593 uint16_t port = 0;
6594 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6595 if (port > 0) {
6596 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6597 port, uats->keyfile, uats->password);
6598
6599 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6600 }
6601 } else {
6602 if (strcmp(uats->port, "start_tls"))
6603 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6604 }
6605 }
6606
6607end:
6608 gnutls_x509_privkey_deinit(x509_priv_key);
6609 gnutls_privkey_deinit(priv_key);
6610 g_free(key_id);
6611}
6612/* }}} */
6613#endif
6614
6615
6616/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6617/** store a known (pre-)master secret into cache */
6618static void
6619ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6620 StringInfo *mk)
6621{
6622 StringInfo *ht_key, *master_secret;
6623
6624 if (key->data_len == 0) {
6625 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6626 return;
6627 }
6628
6629 if (mk->data_len == 0) {
6630 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6631 G_STRFUNC((const char*) (__func__)), label);
6632 return;
6633 }
6634
6635 /* ssl_hash() depends on session_ticket->data being aligned for unsigned access
6636 * so be careful in changing how it is allocated. */
6637 ht_key = ssl_data_clone(key);
6638 master_secret = ssl_data_clone(mk);
6639 g_hash_table_insert(ht, ht_key, master_secret);
6640
6641 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6642 ssl_print_string("stored key", ht_key);
6643 ssl_print_string("stored (pre-)master secret", master_secret);
6644}
6645
6646/** restore a (pre-)master secret given some key in the cache */
6647static bool_Bool
6648ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6649 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6650{
6651 StringInfo *ms;
6652
6653 if (key->data_len == 0) {
6654 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6655 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6656 return false0;
6657 }
6658
6659 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6660 if (!ms) {
6661 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6662 is_pre_master ? "pre-" : "", label);
6663 return false0;
6664 }
6665
6666 /* (pre)master secret found, clear knowledge of other keys and set it in the
6667 * current conversation */
6668 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6669 SSL_HAVE_SESSION_KEY(1<<3));
6670 if (is_pre_master) {
6671 /* unlike master secret, pre-master secret has a variable size (48 for
6672 * RSA, varying for PSK) and is therefore not statically allocated */
6673 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6674 ms->data_len);
6675 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6676 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6677 } else {
6678 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6679 ssl->state |= SSL_MASTER_SECRET(1<<5);
6680 }
6681 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6682 is_pre_master ? "pre-" : "", label);
6683 ssl_print_string(label, key);
6684 ssl_print_string("(pre-)master secret", ms);
6685 return true1;
6686}
6687/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6688
6689/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6690 * the decoder should be attempted to be initialized. {{{*/
6691void
6692ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6693{
6694 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
1
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
→
2
←
Taking false branch
→
6695 /* TLS 1.3 implementations only provide secrets derived from the master
6696 * secret which are loaded in tls13_change_key. No master secrets can be
6697 * loaded here, so just return. */
6698 return;
6699 }
6700 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6701 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
6702 ssl_debug_printf(" session key already available, nothing to do.\n");
6703 return;
6704 }
6705 if (!(ssl->state & SSL_CIPHER(1<<2))) {
5
←
Assuming the condition is false
→
6706 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6707 return;
6708 }
6709
6710 /* for decryption, there needs to be a master secret (which can be derived
6711 * from pre-master secret). If missing, try to pick a master key from cache
6712 * (an earlier packet in the capture or key logfile). */
6713 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6
←
Assuming the condition is false
→
6714 !ssl_restore_master_key(ssl, "Session ID", false0,
6715 mk_map->session, &ssl->session_id) &&
6716 (!ssl->session.is_session_resumed ||
6717 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6718 mk_map->tickets, &ssl->session_ticket)) &&
6719 !ssl_restore_master_key(ssl, "Client Random", false0,
6720 mk_map->crandom, &ssl->client_random)) {
6721 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6722 /* how unfortunate, the master secret could not be found */
6723 ssl_debug_printf(" Cannot find master secret\n");
6724 return;
6725 } else {
6726 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6727 "because of a NULL cipher\n");
6728 }
6729 }
6730
6731 if (ssl_generate_keyring_material(ssl) < 0) {
7
←
Calling 'ssl_generate_keyring_material'
→
6732 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6733 return;
6734 }
6735 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6736 ssl_save_master_key("Client Random", mk_map->crandom,
6737 &ssl->client_random, &ssl->master_secret);
6738 ssl_save_master_key("Session ID", mk_map->session,
6739 &ssl->session_id, &ssl->master_secret);
6740 /* Only save the new secrets if the server sent the ticket. The client
6741 * ticket might have become stale. */
6742 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6743 ssl_save_master_key("Session Ticket", mk_map->tickets,
6744 &ssl->session_ticket, &ssl->master_secret);
6745 }
6746} /* }}} */
6747
6748/* Load the traffic key secret from the keylog file. */
6749StringInfo *
6750tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6751 bool_Bool is_from_server, TLSRecordType type)
6752{
6753 GHashTable *key_map;
6754 const char *label;
6755
6756 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6757 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6758 return NULL((void*)0);
6759 }
6760
6761 if (ssl->client_random.data_len == 0) {
6762 /* May happen if Hello message is missing and Finished is found. */
6763 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6764 return NULL((void*)0);
6765 }
6766
6767 switch (type) {
6768 case TLS_SECRET_0RTT_APP:
6769 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6769, "!is_from_server"))));
6770 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6771 key_map = mk_map->tls13_client_early;
6772 break;
6773 case TLS_SECRET_HANDSHAKE:
6774 if (is_from_server) {
6775 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6776 key_map = mk_map->tls13_server_handshake;
6777 } else {
6778 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6779 key_map = mk_map->tls13_client_handshake;
6780 }
6781 break;
6782 case TLS_SECRET_APP:
6783 if (is_from_server) {
6784 label = "SERVER_TRAFFIC_SECRET_0";
6785 key_map = mk_map->tls13_server_appdata;
6786 } else {
6787 label = "CLIENT_TRAFFIC_SECRET_0";
6788 key_map = mk_map->tls13_client_appdata;
6789 }
6790 break;
6791 default:
6792 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6792, __func__, "assertion \"not reached\" failed");
6793 }
6794
6795 /* Transitioning to new keys, mark old ones as unusable. */
6796 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6797 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6798
6799 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6800 if (!secret) {
6801 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6802 /* Disable decryption, the keys are invalid. */
6803 if (is_from_server) {
6804 ssl->server = NULL((void*)0);
6805 } else {
6806 ssl->client = NULL((void*)0);
6807 }
6808 return NULL((void*)0);
6809 }
6810
6811 /* TLS 1.3 secret found, set new keys. */
6812 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6813 ssl_print_string("Client Random", &ssl->client_random);
6814 ssl_print_string(label, secret);
6815 return secret;
6816}
6817
6818/* Load the new key. */
6819void
6820tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6821 bool_Bool is_from_server, TLSRecordType type)
6822{
6823 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6824 /*
6825 * QUIC does not use the TLS record layer for message protection.
6826 * The required keys will be extracted later by QUIC.
6827 */
6828 return;
6829 }
6830
6831 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6832 if (!secret) {
6833 if (type != TLS_SECRET_HANDSHAKE) {
6834 return;
6835 }
6836 /*
6837 * Workaround for when for some reason we don't have the handshake
6838 * secret but do have the application traffic secret. (#20240)
6839 * If we can't find the handshake secret, we'll never decrypt the
6840 * Finished message, so we won't know when to change to the app
6841 * traffic key, so we do so now.
6842 */
6843 type = TLS_SECRET_APP;
6844 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6845 if (!secret) {
6846 return;
6847 }
6848 }
6849
6850 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6851 /*
6852 * Remember the application traffic secret to support Key Update. The
6853 * other secrets cannot be used for this purpose, so free them.
6854 */
6855 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6856 StringInfo *app_secret = &decoder->app_traffic_secret;
6857 if (type == TLS_SECRET_APP) {
6858 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6859 app_secret->data,
6860 secret->data_len);
6861 ssl_data_set(app_secret, secret->data, secret->data_len);
6862 } else {
6863 wmem_free(wmem_file_scope(), app_secret->data);
6864 app_secret->data = NULL((void*)0);
6865 app_secret->data_len = 0;
6866 }
6867 }
6868}
6869
6870/**
6871 * Update to next application data traffic secret for TLS 1.3. The previous
6872 * secret should have been set by tls13_change_key.
6873 */
6874void
6875tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6876{
6877 /* RFC 8446 Section 7.2:
6878 * application_traffic_secret_N+1 =
6879 * HKDF-Expand-Label(application_traffic_secret_N,
6880 * "traffic upd", "", Hash.length)
6881 *
6882 * Both application_traffic_secret_N are of the same length (Hash.length).
6883 */
6884 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6885 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6886 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6887 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6888
6889 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6890 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6891 return;
6892 }
6893
6894 /*
6895 * Previous traffic secret is available, so find the hash function,
6896 * expand the new traffic secret and generate new keys.
6897 */
6898 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6899 int hash_algo = ssl_get_digest_by_name(hash_name);
6900 const unsigned hash_len = app_secret->data_len;
6901 unsigned char *new_secret;
6902 const char *label = "traffic upd";
6903 if (tls13_draft_version && tls13_draft_version < 20) {
6904 label = "application traffic secret";
6905 }
6906 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6907 tls13_hkdf_label_prefix(ssl),
6908 label, hash_len, &new_secret)) {
6909 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6910 return;
6911 }
6912 ssl_data_set(app_secret, new_secret, hash_len);
6913 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6914 /*
6915 * Remember the application traffic secret on the new decoder to
6916 * support another Key Update.
6917 */
6918 decoder = is_from_server ? ssl->server : ssl->client;
6919 app_secret = &decoder->app_traffic_secret;
6920 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6921 app_secret->data,
6922 hash_len);
6923 ssl_data_set(app_secret, new_secret, hash_len);
6924 }
6925 wmem_free(NULL((void*)0), new_secret);
6926}
6927
6928void
6929tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6930{
6931 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6932 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6933 }
6934}
6935
6936/** SSL keylog file handling. {{{ */
6937
6938static GRegex *
6939ssl_compile_keyfile_regex(void)
6940{
6941#define OCTET "(?:[[:xdigit:]]{2})"
6942 const char *pattern =
6943 "(?:"
6944 /* Matches Client Hellos having this Client Random */
6945 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6946 /* Matches first part of encrypted RSA pre-master secret */
6947 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6948 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6949 but it can be of any length for DHE */
6950 ")(?<pms>" OCTET "+)"
6951 "|(?:"
6952 /* Matches Server Hellos having a Session ID */
6953 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6954 /* Matches Client Hellos having this Client Random */
6955 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6956 /* Master-Secret is given, its length is fixed */
6957 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6958 "|(?"
6959 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6960 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6961 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6962 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6963 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6964 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6965 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6966 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6967 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6968 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6969 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6970 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6971 ") (?<derived_secret>" OCTET "+)";
6972#undef OCTET
6973 static GRegex *regex = NULL((void*)0);
6974 GError *gerr = NULL((void*)0);
6975
6976 if (!regex) {
6977 regex = g_regex_new(pattern,
6978 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6979 G_REGEX_MATCH_ANCHORED, &gerr);
6980 if (gerr) {
6981 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6982 gerr->message);
6983 g_error_free(gerr);
6984 regex = NULL((void*)0);
6985 }
6986 }
6987
6988 return regex;
6989}
6990
6991typedef struct ssl_master_key_match_group {
6992 const char *re_group_name;
6993 GHashTable *master_key_ht;
6994} ssl_master_key_match_group_t;
6995
6996void
6997tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6998{
6999 ssl_master_key_match_group_t mk_groups[] = {
7000 { "encrypted_pmk", mk_map->pre_master },
7001 { "session_id", mk_map->session },
7002 { "client_random", mk_map->crandom },
7003 { "client_random_pms", mk_map->pms },
7004 /* TLS 1.3 map from Client Random to derived secret. */
7005 { "client_early", mk_map->tls13_client_early },
7006 { "client_handshake", mk_map->tls13_client_handshake },
7007 { "server_handshake", mk_map->tls13_server_handshake },
7008 { "client_appdata", mk_map->tls13_client_appdata },
7009 { "server_appdata", mk_map->tls13_server_appdata },
7010 { "early_exporter", mk_map->tls13_early_exporter },
7011 { "exporter", mk_map->tls13_exporter },
7012 { "ech_secret", mk_map->ech_secret },
7013 { "ech_config", mk_map->ech_config },
7014 };
7015
7016 /* The format of the file is a series of records with one of the following formats:
7017 * - "RSA xxxx yyyy"
7018 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
7019 * Where yyyy is the cleartext pre-master secret (hex-encoded)
7020 * (this is the original format introduced with bug 4349)
7021 *
7022 * - "RSA Session-ID:xxxx Master-Key:yyyy"
7023 * Where xxxx is the SSL session ID (hex-encoded)
7024 * Where yyyy is the cleartext master secret (hex-encoded)
7025 * (added to support openssl s_client Master-Key output)
7026 * This is somewhat is a misnomer because there's nothing RSA specific
7027 * about this.
7028 *
7029 * - "PMS_CLIENT_RANDOM xxxx yyyy"
7030 * Where xxxx is the client_random from the ClientHello (hex-encoded)
7031 * Where yyyy is the cleartext pre-master secret (hex-encoded)
7032 * (This format allows SSL connections to be decrypted, if a user can
7033 * capture the PMS but could not recover the MS for a specific session
7034 * with a SSL Server.)
7035 *
7036 * - "CLIENT_RANDOM xxxx yyyy"
7037 * Where xxxx is the client_random from the ClientHello (hex-encoded)
7038 * Where yyyy is the cleartext master secret (hex-encoded)
7039 * (This format allows non-RSA SSL connections to be decrypted, i.e.
7040 * ECDHE-RSA.)
7041 *
7042 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
7043 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
7044 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
7045 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
7046 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
7047 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
7048 * - "EXPORTER_SECRET xxxx yyyy"
7049 * Where xxxx is the client_random from the ClientHello (hex-encoded)
7050 * Where yyyy is the secret (hex-encoded) derived from the early,
7051 * handshake or master secrets. (This format is introduced with TLS 1.3
7052 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
7053 */
7054 GRegex *regex = ssl_compile_keyfile_regex();
7055 if (!regex)
7056 return;
7057
7058 const char *next_line = (const char *)data;
7059 const char *line_end = next_line + datalen;
7060 while (next_line && next_line < line_end) {
7061 const char *line = next_line;
7062 next_line = (const char *)memchr(line, '\n', line_end - line);
7063 ssize_t linelen;
7064
7065 if (next_line) {
7066 linelen = next_line - line;
7067 next_line++; /* drop LF */
7068 } else {
7069 linelen = (ssize_t)(line_end - line);
7070 }
7071 if (linelen > 0 && line[linelen - 1] == '\r') {
7072 linelen--; /* drop CR */
7073 }
7074
7075 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
7076 GMatchInfo *mi;
7077 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
7078 char *hex_key, *hex_pre_ms_or_ms;
7079 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
7080 StringInfo *pre_ms_or_ms = NULL((void*)0);
7081 GHashTable *ht = NULL((void*)0);
7082
7083 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
7084 * otherwise we will use the Master Secret
7085 */
7086 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
7087 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
7088 g_free(hex_pre_ms_or_ms);
7089 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
7090 }
7091 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
7092 g_free(hex_pre_ms_or_ms);
7093 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
7094 }
7095 /* There is always a match, otherwise the regex is wrong. */
7096 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 7096, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
7097
7098 /* convert from hex to bytes and save to hashtable */
7099 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
7100 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
7101 g_free(hex_pre_ms_or_ms);
7102
7103 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
7104 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
7105 ssl_master_key_match_group_t *g = &mk_groups[i];
7106 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
7107 if (hex_key && *hex_key) {
7108 ssl_debug_printf(" matched %s\n", g->re_group_name);
7109 ht = g->master_key_ht;
7110 from_hex(key, hex_key, strlen(hex_key));
7111 g_free(hex_key);
7112 break;
7113 }
7114 g_free(hex_key);
7115 }
7116 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 7116, "ht")))); /* Cannot be reached, or regex is wrong. */
7117
7118 g_hash_table_insert(ht, key, pre_ms_or_ms);
7119
7120 } else if (linelen > 0 && line[0] != '#') {
7121 ssl_debug_printf(" unrecognized line\n");
7122 }
7123 /* always free match info even if there is no match. */
7124 g_match_info_free(mi);
7125 }
7126}
7127
7128void
7129ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
7130 const ssl_master_key_map_t *mk_map)
7131{
7132 /* no need to try if no key log file is configured. */
7133 if (!tls_keylog_filename || !*tls_keylog_filename) {
7134 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
7135 G_STRFUNC((const char*) (__func__)));
7136 return;
7137 }
7138
7139 /* Validate regexes before even trying to use it. */
7140 if (!ssl_compile_keyfile_regex()) {
7141 return;
7142 }
7143
7144 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
7145
7146 /* if the keylog file was deleted/overwritten, re-open it */
7147 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
7148 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
7149 fclose(*keylog_file);
7150 *keylog_file = NULL((void*)0);
7151 }
7152
7153 if (*keylog_file == NULL((void*)0)) {
7154 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
7155 if (!*keylog_file) {
7156 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
7157 return;
7158 }
7159 }
7160
7161 for (;;) {
7162 char buf[1110], *line;
7163 line = fgets(buf, sizeof(buf), *keylog_file);
7164 if (!line) {
7165 if (feof(*keylog_file)) {
7166 /* Ensure that newly appended keys can be read in the future. */
7167 clearerr(*keylog_file);
7168 } else if (ferror(*keylog_file)) {
7169 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
7170 fclose(*keylog_file);
7171 *keylog_file = NULL((void*)0);
7172 }
7173 break;
7174 }
7175 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
7176 }
7177}
7178/** SSL keylog file handling. }}} */
7179
7180#ifdef SSL_DECRYPT_DEBUG /* {{{ */
7181
7182static FILE* ssl_debug_file;
7183
7184void
7185ssl_set_debug(const char* name)
7186{
7187 static int debug_file_must_be_closed;
7188 int use_stderr;
7189
7190 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
7191
7192 if (debug_file_must_be_closed)
7193 fclose(ssl_debug_file);
7194
7195 if (use_stderr)
7196 ssl_debug_file = stderrstderr;
7197 else if (!name || (strcmp(name, "") ==0))
7198 ssl_debug_file = NULL((void*)0);
7199 else
7200 ssl_debug_file = ws_fopenfopen(name, "w");
7201
7202 if (!use_stderr && ssl_debug_file)
7203 debug_file_must_be_closed = 1;
7204 else
7205 debug_file_must_be_closed = 0;
7206
7207 ssl_debug_printf("Wireshark SSL debug log \n\n");
7208#ifdef HAVE_LIBGNUTLS1
7209 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
7210#endif
7211 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
7212 ssl_debug_printf("\n");
7213}
7214
7215void
7216ssl_debug_flush(void)
7217{
7218 if (ssl_debug_file)
7219 fflush(ssl_debug_file);
7220}
7221
7222void
7223ssl_debug_printf(const char* fmt, ...)
7224{
7225 va_list ap;
7226
7227 if (!ssl_debug_file)
7228 return;
7229
7230 va_start(ap, fmt)__builtin_va_start(ap, fmt);
7231 vfprintf(ssl_debug_file, fmt, ap);
7232 va_end(ap)__builtin_va_end(ap);
7233}
7234
7235void
7236ssl_print_data(const char* name, const unsigned char* data, size_t len)
7237{
7238 size_t i, j, k;
7239 if (!ssl_debug_file)
7240 return;
7241 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
7242 for (i=0; i<len; i+=16) {
7243 fprintf(ssl_debug_file,"| ");
7244 for (j=i, k=0; k<16 && j<len; ++j, ++k)
7245 fprintf(ssl_debug_file,"%.2x ",data[j]);
7246 for (; k<16; ++k)
7247 fprintf(ssl_debug_file," ");
7248 fputc('|', ssl_debug_file);
7249 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
7250 unsigned char c = data[j];
7251 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
7252 fputc(c, ssl_debug_file);
7253 }
7254 for (; k<16; ++k)
7255 fputc(' ', ssl_debug_file);
7256 fprintf(ssl_debug_file,"|\n");
7257 }
7258}
7259
7260void
7261ssl_print_string(const char* name, const StringInfo* data)
7262{
7263 ssl_print_data(name, data->data, data->data_len);
7264}
7265#endif /* SSL_DECRYPT_DEBUG }}} */
7266
7267/* UAT preferences callbacks. {{{ */
7268/* checks for SSL and DTLS UAT key list fields */
7269
7270bool_Bool
7271ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7272{
7273 // This should be removed in favor of Decode As. Make it optional.
7274 *err = NULL((void*)0);
7275 return true1;
7276}
7277
7278bool_Bool
7279ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7280{
7281 if (!p || strlen(p) == 0u) {
7282 // This should be removed in favor of Decode As. Make it optional.
7283 *err = NULL((void*)0);
7284 return true1;
7285 }
7286
7287 if (strcmp(p, "start_tls") != 0){
7288 uint16_t port;
7289 if (!ws_strtou16(p, NULL((void*)0), &port)) {
7290 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
7291 return false0;
7292 }
7293 }
7294
7295 *err = NULL((void*)0);
7296 return true1;
7297}
7298
7299bool_Bool
7300ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7301{
7302 ws_statb64struct stat st;
7303
7304 if (!p || strlen(p) == 0u) {
7305 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
7306 return false0;
7307 } else {
7308 if (ws_stat64stat(p, &st) != 0) {
7309 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
7310 return false0;
7311 }
7312 }
7313
7314 *err = NULL((void*)0);
7315 return true1;
7316}
7317
7318bool_Bool
7319ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
7320{
7321#if defined(HAVE_LIBGNUTLS1)
7322 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
7323 FILE *fp = NULL((void*)0);
7324
7325 if (p && (strlen(p) > 0u)) {
7326 fp = ws_fopenfopen(f->keyfile, "rb");
7327 if (fp) {
7328 char *msg = NULL((void*)0);
7329 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
7330 if (!priv_key) {
7331 fclose(fp);
7332 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
7333 g_free(msg);
7334 return false0;
7335 }
7336 g_free(msg);
7337 gnutls_x509_privkey_deinit(priv_key);
7338 fclose(fp);
7339 } else {
7340 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
7341 return false0;
7342 }
7343 }
7344
7345 *err = NULL((void*)0);
7346 return true1;
7347#else
7348 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
7349 return false0;
7350#endif
7351}
7352/* UAT preferences callbacks. }}} */
7353
7354/** maximum size of ssl_association_info() string */
7355#define SSL_ASSOC_MAX_LEN8192 8192
7356
7357typedef struct ssl_association_info_callback_data
7358{
7359 char *str;
7360 const char *table_protocol;
7361} ssl_association_info_callback_data_t;
7362
7363/**
7364 * callback function used by ssl_association_info() to traverse the SSL associations.
7365 */
7366static void
7367ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
7368{
7369 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
7370 const int l = (const int)strlen(data->str);
7371 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
7372}
7373
7374/**
7375 * @return an information string on the SSL protocol associations. The string must be freed.
7376 */
7377char*
7378ssl_association_info(const char* dissector_table_name, const char* table_protocol)
7379{
7380 ssl_association_info_callback_data_t data;
7381
7382 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
7383 data.table_protocol = table_protocol;
7384 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
7385 return data.str;
7386}
7387
7388
7389/** Begin of code related to dissection of wire data. */
7390
7391/* Helpers for dissecting Variable-Length Vectors. {{{ */
7392bool_Bool
7393ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7394 unsigned offset, unsigned offset_end, uint32_t *ret_length,
7395 int hf_length, uint32_t min_value, uint32_t max_value)
7396{
7397 unsigned veclen_size;
7398 uint32_t veclen_value;
7399 proto_item *pi;
7400
7401 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 7401, (uint64_t)min_value, (uint64_t)max_value))));
7402 if (offset > offset_end) {
7403 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
7404 "Vector offset is past buffer end offset (%u > %u)",
7405 offset, offset_end);
7406 *ret_length = 0;
7407 return false0; /* Cannot read length. */
7408 }
7409
7410 if (max_value > 0xffffff) {
7411 veclen_size = 4;
7412 } else if (max_value > 0xffff) {
7413 veclen_size = 3;
7414 } else if (max_value > 0xff) {
7415 veclen_size = 2;
7416 } else {
7417 veclen_size = 1;
7418 }
7419
7420 if (offset_end - offset < veclen_size) {
7421 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7422 tvb, offset, offset_end - offset,
7423 "No more room for vector of length %u",
7424 veclen_size);
7425 *ret_length = 0;
7426 return false0; /* Cannot read length. */
7427 }
7428
7429 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
7430 offset += veclen_size;
7431
7432 if (veclen_value < min_value) {
7433 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7434 "Vector length %u is smaller than minimum %u",
7435 veclen_value, min_value);
7436 } else if (veclen_value > max_value) {
7437 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7438 "Vector length %u is larger than maximum %u",
7439 veclen_value, max_value);
7440 }
7441
7442 if (offset_end - offset < veclen_value) {
7443 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
7444 "Vector length %u is too large, truncating it to %u",
7445 veclen_value, offset_end - offset);
7446 *ret_length = offset_end - offset;
7447 return false0; /* Length is truncated to avoid overflow. */
7448 }
7449
7450 *ret_length = veclen_value;
7451 return true1; /* Length is OK. */
7452}
7453
7454bool_Bool
7455ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7456 unsigned offset, unsigned offset_end)
7457{
7458 if (offset < offset_end) {
7459 unsigned trailing = offset_end - offset;
7460 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7461 tvb, offset, trailing,
7462 "%u trailing byte%s unprocessed",
7463 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7464 return false0; /* unprocessed data warning */
7465 } else if (offset > offset_end) {
7466 /*
7467 * Returned offset runs past the end. This should not happen and is
7468 * possibly a dissector bug.
7469 */
7470 unsigned excess = offset - offset_end;
7471 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7472 tvb, offset_end, excess,
7473 "Dissector processed too much data (%u byte%s)",
7474 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7475 return false0; /* overflow error */
7476 }
7477
7478 return true1; /* OK, offset matches. */
7479}
7480/** }}} */
7481
7482
7483static uint32_t
7484ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7485 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7486 uint16_t version, int hf_sig_len, int hf_sig);
7487
7488/* change_cipher_spec(20) dissection */
7489void
7490ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7491 packet_info *pinfo, proto_tree *tree,
7492 uint32_t offset, SslSession *session,
7493 bool_Bool is_from_server,
7494 const SslDecryptSession *ssl)
7495{
7496 /*
7497 * struct {
7498 * enum { change_cipher_spec(1), (255) } type;
7499 * } ChangeCipherSpec;
7500 */
7501 proto_item *ti;
7502 proto_item_set_text(tree,
7503 "%s Record Layer: %s Protocol: Change Cipher Spec",
7504 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7505 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7506 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7507
7508 if (session->version == TLSV1DOT3_VERSION0x304) {
7509 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7510 return;
7511 }
7512
7513 /* Remember frame number of first CCS */
7514 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7515 if (*ccs_frame == 0)
7516 *ccs_frame = pinfo->num;
7517
7518 /* Use heuristics to detect an abbreviated handshake, assume that missing
7519 * ServerHelloDone implies reusing previously negotiating keys. Then when
7520 * a Session ID or ticket is present, it must be a resumed session.
7521 * Normally this should be done at the Finished message, but that may be
7522 * encrypted so we do it here, at the last cleartext message. */
7523 if (is_from_server && ssl) {
7524 if (session->is_session_resumed) {
7525 const char *resumed = NULL((void*)0);
7526 if (ssl->session_ticket.data_len) {
7527 resumed = "Session Ticket";
7528 } else if (ssl->session_id.data_len) {
7529 resumed = "Session ID";
7530 }
7531 if (resumed) {
7532 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7533 } else {
7534 /* Can happen if the capture somehow starts in the middle */
7535 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7536 }
7537 } else {
7538 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7539 }
7540 }
7541 if (is_from_server && session->is_session_resumed)
7542 expert_add_info(pinfo, ti, &hf->ei.resumed);
7543}
7544
7545/** Begin of handshake(22) record dissections */
7546
7547/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7548 * {{{ */
7549static void
7550tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7551{
7552 uint32_t sighash, hashalg, sigalg;
7553 proto_item *ti_sigalg;
7554 proto_tree *sigalg_tree;
7555
7556 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7557 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7558 if (ja4_data) {
7559 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7560 }
7561
7562 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7563
7564 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7565 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7566 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7567 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7568 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7569
7570 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7571 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7572 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7573 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7574 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7575 sighash);
7576 }
7577} /* }}} */
7578
7579/* dissect a list of hash algorithms, return the number of bytes dissected
7580 this is used for the signature algorithms extension and for the
7581 TLS1.2 certificate request. {{{ */
7582static int
7583ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7584 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7585{
7586 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7587 * struct {
7588 * HashAlgorithm hash;
7589 * SignatureAlgorithm signature;
7590 * } SignatureAndHashAlgorithm;
7591 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7592 */
7593 proto_tree *subtree;
7594 proto_item *ti;
7595 unsigned sh_alg_length;
7596 uint32_t next_offset;
7597
7598 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7599 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7600 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7601 return offset_end;
7602 }
7603 offset += 2;
7604 next_offset = offset + sh_alg_length;
7605
7606 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7607 "Signature Hash Algorithms (%u algorithm%s)",
7608 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7609 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7610
7611 while (offset + 2 <= next_offset) {
7612 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7613 offset += 2;
7614 }
7615
7616 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7617 offset = next_offset;
7618 }
7619
7620 return offset;
7621} /* }}} */
7622
7623/* Dissection of DistinguishedName (for CertificateRequest and
7624 * certificate_authorities extension). {{{ */
7625static uint32_t
7626tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7627 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7628{
7629 proto_item *ti;
7630 proto_tree *subtree;
7631 uint32_t dnames_length, next_offset;
7632 asn1_ctx_t asn1_ctx;
7633 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7634
7635 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7636 /* DistinguishedName certificate_authorities<0..2^16-1> */
7637 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7638 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7639 return offset_end;
7640 }
7641 offset += 2;
7642 next_offset = offset + dnames_length;
7643
7644 if (dnames_length > 0) {
7645 ti = proto_tree_add_none_format(tree,
7646 hf->hf.hs_dnames,
7647 tvb, offset, dnames_length,
7648 "Distinguished Names (%d byte%s)",
7649 dnames_length,
7650 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7651 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7652
7653 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7654
7655 while (offset < next_offset) {
7656 /* get the length of the current certificate */
7657 uint32_t name_length;
7658
7659 if (dnames_count-- == 0) {
7660 /* stop adding to tree when the list is considered too large
7661 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7662 Note: dnames_count must be set low enough not to hit the
7663 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7664 */
7665 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7666 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7667 proto_item_set_generated(ti);
7668 return next_offset;
7669 }
7670
7671 /* opaque DistinguishedName<1..2^16-1> */
7672 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7673 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7674 return next_offset;
7675 }
7676 offset += 2;
7677
7678 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7679 subtree, hf->hf.hs_dname);
7680 offset += name_length;
7681 }
7682 }
7683 return offset;
7684} /* }}} */
7685
7686
7687/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7688static int
7689ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7690 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7691{
7692 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7693}
7694
7695static int
7696ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7697 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7698{
7699 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7700 hnd_type == SSL_HND_CERT_REQUEST) {
7701 /*
7702 * struct {
7703 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7704 * } SignatureSchemeList;
7705 */
7706
7707 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7708 } else {
7709 asn1_ctx_t asn1_ctx;
7710 unsigned pubkey_length, sign_length;
7711
7712 /*
7713 * struct {
7714 * uint32 valid_time;
7715 * SignatureScheme expected_cert_verify_algorithm;
7716 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7717 * } Credential;
7718 *
7719 * struct {
7720 * Credential cred;
7721 * SignatureScheme algorithm;
7722 * opaque signature<0..2^16-1>;
7723 * } DelegatedCredential;
7724 */
7725
7726 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7727
7728 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7729 offset += 4;
7730
7731 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7732 offset += 2;
7733
7734 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7735 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7736 return offset_end;
7737 }
7738 offset += 3;
7739 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7740 offset += pubkey_length;
7741
7742 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7743 offset += 2;
7744
7745 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7746 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7747 return offset_end;
7748 }
7749 offset += 2;
7750 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7751 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7752 offset += sign_length;
7753
7754 return offset;
7755 }
7756}
7757
7758static int
7759ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7760 packet_info *pinfo, proto_tree *tree,
7761 uint32_t offset, uint32_t offset_end,
7762 uint8_t hnd_type)
7763{
7764
7765 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7766
7767 switch (hnd_type) {
7768 case SSL_HND_CLIENT_HELLO: {
7769 proto_tree *alps_tree;
7770 proto_item *ti;
7771 uint32_t next_offset, alps_length, name_length;
7772
7773 /*
7774 * opaque ProtocolName<1..2^8-1>;
7775 * struct {
7776 * ProtocolName supported_protocols<2..2^16-1>
7777 * } ApplicationSettingsSupport;
7778 */
7779
7780 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7781 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7782 return offset_end;
7783 }
7784 offset += 2;
7785 next_offset = offset + alps_length;
7786
7787 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7788 tvb, offset, alps_length, ENC_NA0x00000000);
7789 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7790
7791 /* Parse list (note missing check for end of vector, ssl_add_vector below
7792 * ensures that data is always available.) */
7793 while (offset < next_offset) {
7794 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7795 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7796 return next_offset;
7797 }
7798 offset++;
7799
7800 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7801 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7802 offset += name_length;
7803 }
7804
7805 return offset;
7806 }
7807 case SSL_HND_ENCRYPTED_EXTS:
7808 /* Opaque blob */
7809 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7810 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7811 break;
7812 }
7813
7814 return offset_end;
7815}
7816
7817static int
7818ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7819 packet_info *pinfo, proto_tree *tree,
7820 uint32_t offset, uint32_t offset_end,
7821 uint8_t hnd_type, SslSession *session,
7822 bool_Bool is_dtls, ja4_data_t *ja4_data)
7823{
7824
7825 /* https://tools.ietf.org/html/rfc7301#section-3.1
7826 * opaque ProtocolName<1..2^8-1>;
7827 * struct {
7828 * ProtocolName protocol_name_list<2..2^16-1>
7829 * } ProtocolNameList;
7830 */
7831 proto_tree *alpn_tree;
7832 proto_item *ti;
7833 uint32_t next_offset, alpn_length, name_length;
7834 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7835
7836 /* ProtocolName protocol_name_list<2..2^16-1> */
7837 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7838 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7839 return offset_end;
7840 }
7841 offset += 2;
7842 next_offset = offset + alpn_length;
7843
7844 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7845 tvb, offset, alpn_length, ENC_NA0x00000000);
7846 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7847
7848 /* Parse list (note missing check for end of vector, ssl_add_vector below
7849 * ensures that data is always available.) */
7850 while (offset < next_offset) {
7851 /* opaque ProtocolName<1..2^8-1> */
7852 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7853 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7854 return next_offset;
7855 }
7856 offset++;
7857
7858 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7859 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7860 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7861 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7862 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7863 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7864 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7865 }
7866 else {
7867 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7868 alpn_last_char & 0x0F);
7869 }
7870 }
7871 /* Remember first ALPN ProtocolName entry for server. */
7872 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7873 /* '\0'-terminated string for dissector table match and prefix
7874 * comparison purposes. */
7875 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7876 name_length, ENC_ASCII0x00000000);
7877 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7878 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7879 name_length, ENC_ASCII0x00000000);
7880 }
7881 offset += name_length;
7882 }
7883
7884 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7885 * exactly one "ProtocolName". */
7886 if (proto_name) {
7887 dissector_handle_t handle;
7888
7889 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7890
7891 if (is_dtls) {
7892 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7893 proto_name);
7894 } else {
7895 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7896 proto_name);
7897 if (handle == NULL((void*)0)) {
7898 /* Try prefix matching */
7899 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7900 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7901
7902 /* string_string is inappropriate as it compares strings
7903 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7904 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7905 handle = find_dissector(alpn_proto->dissector_name);
7906 break;
7907 }
7908 }
7909 }
7910 }
7911 if (handle != NULL((void*)0)) {
7912 /* ProtocolName match, so set the App data dissector handle.
7913 * This may override protocols given via the UAT dialog, but
7914 * since the ALPN hint is precise, do it anyway. */
7915 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7916 (void *)session->app_handle,
7917 (void *)handle,
7918 dissector_handle_get_dissector_name(handle));
7919 session->app_handle = handle;
7920 }
7921 } else if (client_proto_name) {
7922 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7923 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7924 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7925 }
7926
7927 return offset;
7928}
7929
7930static int
7931ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7932 packet_info *pinfo, proto_tree *tree,
7933 uint32_t offset, uint32_t offset_end)
7934{
7935 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7936 * The "extension_data" field of a "next_protocol_negotiation" extension
7937 * in a "ServerHello" contains an optional list of protocols advertised
7938 * by the server. Protocols are named by opaque, non-empty byte strings
7939 * and the list of protocols is serialized as a concatenation of 8-bit,
7940 * length prefixed byte strings. Implementations MUST ensure that the
7941 * empty string is not included and that no byte strings are truncated.
7942 */
7943 uint32_t npn_length;
7944 proto_tree *npn_tree;
7945
7946 /* List is optional, do not add tree if there are no entries. */
7947 if (offset == offset_end) {
7948 return offset;
7949 }
7950
7951 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7952
7953 while (offset < offset_end) {
7954 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7955 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7956 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7957 return offset_end;
7958 }
7959 offset++;
7960
7961 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7962 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7963 offset += npn_length;
7964 }
7965
7966 return offset;
7967}
7968
7969static int
7970ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7971 packet_info *pinfo, proto_tree *tree,
7972 uint32_t offset, uint32_t offset_end)
7973{
7974 /* https://tools.ietf.org/html/rfc5746#section-3.2
7975 * struct {
7976 * opaque renegotiated_connection<0..255>;
7977 * } RenegotiationInfo;
7978 *
7979 */
7980 proto_tree *reneg_info_tree;
7981 uint32_t reneg_info_length;
7982
7983 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7984
7985 /* opaque renegotiated_connection<0..255> */
7986 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7987 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7988 return offset_end;
7989 }
7990 offset++;
7991
7992 if (reneg_info_length > 0) {
7993 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7994 offset += reneg_info_length;
7995 }
7996
7997 return offset;
7998}
7999
8000static int
8001ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8002 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8003 const char **group_name_out)
8004{
8005 /* RFC 8446 Section 4.2.8
8006 * struct {
8007 * NamedGroup group;
8008 * opaque key_exchange<1..2^16-1>;
8009 * } KeyShareEntry;
8010 */
8011 uint32_t key_exchange_length, group;
8012 proto_tree *ks_tree;
8013
8014 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
8015
8016 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
8017 offset += 2;
8018 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
8019 proto_item_append_text(ks_tree, ": Group: %s", group_name);
8020 if (group_name_out) {
8021 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
8022 }
8023
8024 /* opaque key_exchange<1..2^16-1> */
8025 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
8026 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
8027 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
8028 }
8029 offset += 2;
8030 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
8031 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
8032
8033 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
8034 offset += key_exchange_length;
8035
8036 return offset;
8037}
8038
8039static int
8040ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8041 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8042 uint8_t hnd_type)
8043{
8044 proto_tree *key_share_tree;
8045 uint32_t next_offset;
8046 uint32_t client_shares_length;
8047 uint32_t group;
8048 const char *group_name = NULL((void*)0);
8049
8050 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
8051 return offset;
8052 }
8053
8054 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
8055
8056 switch(hnd_type){
8057 case SSL_HND_CLIENT_HELLO:
8058 /* KeyShareEntry client_shares<0..2^16-1> */
8059 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
8060 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
8061 return offset_end;
8062 }
8063 offset += 2;
8064 next_offset = offset + client_shares_length;
8065 const char *sep = " ";
8066 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
8067 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
8068 if (group_name) {
8069 proto_item_append_text(tree, "%s%s", sep, group_name);
8070 sep = ", ";
8071 }
8072 }
8073 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
8074 return next_offset;
8075 }
8076 break;
8077 case SSL_HND_SERVER_HELLO:
8078 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
8079 if (group_name) {
8080 proto_item_append_text(tree, " %s", group_name);
8081 }
8082 break;
8083 case SSL_HND_HELLO_RETRY_REQUEST:
8084 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
8085 offset += 2;
8086 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
8087 proto_item_append_text(tree, " %s", group_name);
8088 break;
8089 default: /* no default */
8090 break;
8091 }
8092
8093 return offset;
8094}
8095
8096static int
8097ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8098 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8099 uint8_t hnd_type)
8100{
8101 /* RFC 8446 Section 4.2.11
8102 * struct {
8103 * opaque identity<1..2^16-1>;
8104 * uint32 obfuscated_ticket_age;
8105 * } PskIdentity;
8106 * opaque PskBinderEntry<32..255>;
8107 * struct {
8108 * select (Handshake.msg_type) {
8109 * case client_hello:
8110 * PskIdentity identities<7..2^16-1>;
8111 * PskBinderEntry binders<33..2^16-1>;
8112 * case server_hello:
8113 * uint16 selected_identity;
8114 * };
8115 * } PreSharedKeyExtension;
8116 */
8117
8118 proto_tree *psk_tree;
8119
8120 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
8121
8122 switch (hnd_type){
8123 case SSL_HND_CLIENT_HELLO: {
8124 uint32_t identities_length, identities_end, binders_length;
8125
8126 /* PskIdentity identities<7..2^16-1> */
8127 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
8128 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
8129 return offset_end;
8130 }
8131 offset += 2;
8132 identities_end = offset + identities_length;
8133
8134 while (offset < identities_end) {
8135 uint32_t identity_length;
8136 proto_tree *identity_tree;
8137
8138 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
8139
8140 /* opaque identity<1..2^16-1> */
8141 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
8142 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
8143 return identities_end;
8144 }
8145 offset += 2;
8146 proto_item_append_text(identity_tree, "length: %u)", identity_length);
8147
8148 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
8149 offset += identity_length;
8150
8151 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8152 offset += 4;
8153
8154 proto_item_set_len(identity_tree, 2 + identity_length + 4);
8155 }
8156 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
8157 offset = identities_end;
8158 }
8159
8160 /* PskBinderEntry binders<33..2^16-1> */
8161 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
8162 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
8163 return offset_end;
8164 }
8165 offset += 2;
8166
8167 proto_item *binders_item;
8168 proto_tree *binders_tree;
8169 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
8170 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
8171 uint32_t binders_end = offset + binders_length;
8172 while (offset < binders_end) {
8173 uint32_t binder_length;
8174 proto_item *binder_item;
8175 proto_tree *binder_tree;
8176
8177 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
8178 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
8179
8180 /* opaque PskBinderEntry<32..255>; */
8181 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
8182 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
8183 return binders_end;
8184 }
8185 offset += 1;
8186 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
8187
8188 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
8189 offset += binder_length;
8190
8191 proto_item_set_end(binder_item, tvb, offset);
8192 }
8193 }
8194 break;
8195 case SSL_HND_SERVER_HELLO: {
8196 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8197 offset += 2;
8198 }
8199 break;
8200 default:
8201 break;
8202 }
8203
8204 return offset;
8205}
8206
8207static uint32_t
8208ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
8209 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
8210 uint8_t hnd_type, SslDecryptSession *ssl)
8211{
8212 /* RFC 8446 Section 4.2.10
8213 * struct {} Empty;
8214 * struct {
8215 * select (Handshake.msg_type) {
8216 * case new_session_ticket: uint32 max_early_data_size;
8217 * case client_hello: Empty;
8218 * case encrypted_extensions: Empty;
8219 * };
8220 * } EarlyDataIndication;
8221 */
8222 switch (hnd_type) {
8223 case SSL_HND_CLIENT_HELLO:
8224 /* Remember that early_data will follow the handshake. */
8225 if (ssl) {
8226 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
8227 ssl->has_early_data = true1;
8228 }
8229 break;
8230 case SSL_HND_NEWSESSION_TICKET:
8231 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8232 offset += 4;
8233 break;
8234 default:
8235 break;
8236 }
8237 return offset;
8238}
8239
8240static uint16_t
8241tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
8242{
8243 if (draft_version) {
8244 *draft_version = 0;
8245 }
8246 if (!is_dtls) {
8247 uint8_t tls13_draft = extract_tls13_draft_version(version);
8248 if (tls13_draft != 0) {
8249 /* This is TLS 1.3 (a draft version). */
8250 if (draft_version) {
8251 *draft_version = tls13_draft;
8252 }
8253 version = TLSV1DOT3_VERSION0x304;
8254 }
8255 if (version == 0xfb17 || version == 0xfb1a) {
8256 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
8257 tls13_draft = (uint8_t)version;
8258 if (draft_version) {
8259 *draft_version = tls13_draft;
8260 }
8261 version = TLSV1DOT3_VERSION0x304;
8262 }
8263 }
8264
8265 switch (version) {
8266 case SSLV3_VERSION0x300:
8267 case TLSV1_VERSION0x301:
8268 case TLSV1DOT1_VERSION0x302:
8269 case TLSV1DOT2_VERSION0x303:
8270 case TLSV1DOT3_VERSION0x304:
8271 case TLCPV1_VERSION0x101:
8272 if (is_dtls)
8273 return SSL_VER_UNKNOWN0;
8274 break;
8275
8276 case DTLSV1DOT0_VERSION0xfeff:
8277 case DTLSV1DOT0_OPENSSL_VERSION0x100:
8278 case DTLSV1DOT2_VERSION0xfefd:
8279 case DTLSV1DOT3_VERSION0xfefc:
8280 if (!is_dtls)
8281 return SSL_VER_UNKNOWN0;
8282 break;
8283
8284 default: /* invalid version number */
8285 return SSL_VER_UNKNOWN0;
8286 }
8287
8288 return version;
8289}
8290
8291static int
8292ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8293 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8294 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
8295{
8296
8297 /* RFC 8446 Section 4.2.1
8298 * struct {
8299 * ProtocolVersion versions<2..254>; // ClientHello
8300 * } SupportedVersions;
8301 * Note that ServerHello and HelloRetryRequest are handled by the caller.
8302 */
8303 uint32_t versions_length, next_offset;
8304 /* ProtocolVersion versions<2..254> */
8305 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
8306 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
8307 return offset_end;
8308 }
8309 offset++;
8310 next_offset = offset + versions_length;
8311
8312 unsigned version;
8313 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
8314 uint8_t draft_version, max_draft_version = 0;
8315 const char *sep = " ";
8316 while (offset + 2 <= next_offset) {
8317 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
8318 offset += 2;
8319
8320 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
8321 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
8322 sep = ", ";
8323 }
8324
8325 current_version = tls_try_get_version(is_dtls, version, &draft_version);
8326 if (session->version == SSL_VER_UNKNOWN0) {
8327 if (lowest_version == SSL_VER_UNKNOWN0) {
8328 lowest_version = current_version;
8329 } else if (current_version != SSL_VER_UNKNOWN0) {
8330 if (!is_dtls) {
8331 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
8332 } else {
8333 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
8334 }
8335 }
8336 }
8337 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
8338 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
8339 /* The DTLS version numbers get mapped to "00" for unknown per
8340 * JA4 spec, but if JA4 ever does support DTLS we'll probably
8341 * need to take the MIN instead of MAX here for DTLS.
8342 */
8343 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
8344 }
8345 }
8346 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
8347 col_set_str(pinfo->cinfo, COL_PROTOCOL,
8348 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
8349 }
8350 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
8351 offset = next_offset;
8352 }
8353
8354 /* XXX remove this when draft 19 support is dropped,
8355 * this is only required for early data decryption. */
8356 if (max_draft_version) {
8357 session->tls13_draft_version = max_draft_version;
8358 }
8359
8360 return offset;
8361}
8362
8363static int
8364ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8365 packet_info *pinfo, proto_tree *tree,
8366 uint32_t offset, uint32_t offset_end)
8367{
8368 /* RFC 8446 Section 4.2.2
8369 * struct {
8370 * opaque cookie<1..2^16-1>;
8371 * } Cookie;
8372 */
8373 uint32_t cookie_length;
8374 /* opaque cookie<1..2^16-1> */
8375 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
8376 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
8377 return offset_end;
8378 }
8379 offset += 2;
8380
8381 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
8382 offset += cookie_length;
8383
8384 return offset;
8385}
8386
8387static int
8388ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8389 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8390{
8391 /* RFC 8446 Section 4.2.9
8392 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
8393 *
8394 * struct {
8395 * PskKeyExchangeMode ke_modes<1..255>;
8396 * } PskKeyExchangeModes;
8397 */
8398 uint32_t ke_modes_length, next_offset;
8399
8400 /* PskKeyExchangeMode ke_modes<1..255> */
8401 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
8402 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
8403 return offset_end;
8404 }
8405 offset++;
8406 next_offset = offset + ke_modes_length;
8407
8408 while (offset < next_offset) {
8409 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
8410 offset++;
8411 }
8412
8413 return offset;
8414}
8415
8416static uint32_t
8417ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8418 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8419{
8420 /* RFC 8446 Section 4.2.4
8421 * opaque DistinguishedName<1..2^16-1>;
8422 * struct {
8423 * DistinguishedName authorities<3..2^16-1>;
8424 * } CertificateAuthoritiesExtension;
8425 */
8426 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
8427}
8428
8429static int
8430ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8431 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8432{
8433 /* RFC 8446 Section 4.2.5
8434 * struct {
8435 * opaque certificate_extension_oid<1..2^8-1>;
8436 * opaque certificate_extension_values<0..2^16-1>;
8437 * } OIDFilter;
8438 * struct {
8439 * OIDFilter filters<0..2^16-1>;
8440 * } OIDFilterExtension;
8441 */
8442 proto_tree *subtree;
8443 uint32_t filters_length, oid_length, values_length, value_offset;
8444 asn1_ctx_t asn1_ctx;
8445 const char *oid, *name;
8446
8447 /* OIDFilter filters<0..2^16-1> */
8448 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8449 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8450 return offset_end;
8451 }
8452 offset += 2;
8453 offset_end = offset + filters_length;
8454
8455 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8456
8457 while (offset < offset_end) {
8458 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8459 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8460
8461 /* opaque certificate_extension_oid<1..2^8-1> */
8462 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8463 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8464 return offset_end;
8465 }
8466 offset++;
8467 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8468 hf->hf.hs_ext_oid_filters_oid, &oid);
8469 offset += oid_length;
8470
8471 /* Append OID to tree label */
8472 name = oid_resolved_from_string(pinfo->pool, oid);
8473 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8474
8475 /* opaque certificate_extension_values<0..2^16-1> */
8476 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8477 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8478 return offset_end;
8479 }
8480 offset += 2;
8481 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8482 if (values_length > 0) {
8483 value_offset = offset;
8484 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8485 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8486 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8487 }
8488 offset += values_length;
8489 }
8490
8491 return offset;
8492}
8493
8494static int
8495ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8496 packet_info *pinfo, proto_tree *tree,
8497 uint32_t offset, uint32_t offset_end)
8498{
8499 /* https://tools.ietf.org/html/rfc6066#section-3
8500 *
8501 * struct {
8502 * NameType name_type;
8503 * select (name_type) {
8504 * case host_name: HostName;
8505 * } name;
8506 * } ServerName;
8507 *
8508 * enum {
8509 * host_name(0), (255)
8510 * } NameType;
8511 *
8512 * opaque HostName<1..2^16-1>;
8513 *
8514 * struct {
8515 * ServerName server_name_list<1..2^16-1>
8516 * } ServerNameList;
8517 */
8518 proto_tree *server_name_tree;
8519 uint32_t list_length, server_name_length, next_offset;
8520
8521 /* The server SHALL include "server_name" extension with empty data. */
8522 if (offset == offset_end) {
8523 return offset;
8524 }
8525
8526 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8527
8528 /* ServerName server_name_list<1..2^16-1> */
8529 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8530 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8531 return offset_end;
8532 }
8533 offset += 2;
8534 next_offset = offset + list_length;
8535
8536 while (offset < next_offset) {
8537 uint32_t name_type;
8538 const char *server_name = NULL((void*)0);
8539 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8540 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8541 offset++;
8542
8543 /* opaque HostName<1..2^16-1> */
8544 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8545 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8546 return next_offset;
8547 }
8548 offset += 2;
8549
8550 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8551 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8552 pinfo->pool, (const uint8_t**)&server_name);
8553 offset += server_name_length;
8554 // Each type must only occur once, so we don't check for duplicates.
8555 if (name_type == 0) {
8556 proto_item_append_text(tree, " name=%s", server_name);
8557 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8558
8559 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8560 // Client Hello: Client (Src) -> Server (Dst)
8561 switch (pinfo->dst.type) {
8562 case AT_IPv4:
8563 if (pinfo->dst.len == sizeof(uint32_t)) {
8564 add_ipv4_name(*(uint32_t *)pinfo->dst.data, server_name, false0);
8565 }
8566 break;
8567 case AT_IPv6:
8568 if (pinfo->dst.len == sizeof(ws_in6_addr)) {
8569 add_ipv6_name(pinfo->dst.data, server_name, false0);
8570 }
8571 break;
8572 }
8573 }
8574 }
8575 }
8576 return offset;
8577}
8578
8579static int
8580ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8581 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8582{
8583 unsigned ext_len = offset_end - offset;
8584 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8585 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8586 /* Save the Session Ticket such that it can be used as identifier for
8587 * restoring a previous Master Secret (in ChangeCipherSpec) */
8588 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8589 ssl->session_ticket.data, ext_len);
8590 ssl->session_ticket.data_len = ext_len;
8591 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8592 }
8593 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8594 tvb, offset, ext_len, ENC_NA0x00000000);
8595 return offset + ext_len;
8596}
8597
8598static int
8599ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8600 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8601 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8602{
8603 uint8_t cert_list_length;
8604 uint8_t cert_type;
8605 proto_tree *cert_list_tree;
8606 proto_item *ti;
8607
8608 switch(hnd_type){
8609 case SSL_HND_CLIENT_HELLO:
8610 cert_list_length = tvb_get_uint8(tvb, offset);
8611 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8612 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8613 offset += 1;
8614 if (offset_end - offset != (uint32_t)cert_list_length)
8615 return offset;
8616
8617 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8618 cert_list_length, cert_list_length);
8619 proto_item_append_text(ti, " (%d)", cert_list_length);
8620
8621 /* make this a subtree */
8622 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8623
8624 /* loop over all point formats */
8625 while (cert_list_length > 0)
8626 {
8627 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8628 offset++;
8629 cert_list_length--;
8630 }
8631 break;
8632 case SSL_HND_SERVER_HELLO:
8633 case SSL_HND_ENCRYPTED_EXTENSIONS:
8634 case SSL_HND_CERTIFICATE:
8635 cert_type = tvb_get_uint8(tvb, offset);
8636 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8637 offset += 1;
8638 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8639 session->client_cert_type = cert_type;
8640 }
8641 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8642 session->server_cert_type = cert_type;
8643 }
8644 break;
8645 default: /* no default */
8646 break;
8647 }
8648
8649 return offset;
8650}
8651
8652static uint32_t
8653ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8654 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8655 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8656{
8657 uint32_t compress_certificate_algorithms_length, next_offset;
8658
8659 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8660 * enum {
8661 * zlib(1),
8662 * brotli(2),
8663 * (65535)
8664 * } CertificateCompressionAlgorithm;
8665 *
8666 * struct {
8667 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8668 * } CertificateCompressionAlgorithms;
8669 */
8670 switch (hnd_type) {
8671 case SSL_HND_CLIENT_HELLO:
8672 case SSL_HND_CERT_REQUEST:
8673 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8674 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8675 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8676 return offset_end;
8677 }
8678 offset += 1;
8679 next_offset = offset + compress_certificate_algorithms_length;
8680
8681 while (offset < next_offset) {
8682 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8683 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8684 offset += 2;
8685 }
8686 break;
8687 default:
8688 break;
8689 }
8690
8691 return offset;
8692}
8693
8694static uint32_t
8695ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8696 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8697 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8698{
8699 uint32_t key_parameters_length, next_offset;
8700 proto_item *p_ti;
8701 proto_tree *p_tree;
8702
8703 /* RFC 8472
8704 *
8705 * struct {
8706 * uint8 major;
8707 * uint8 minor;
8708 * } TB_ProtocolVersion;
8709 *
8710 * enum {
8711 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8712 * } TokenBindingKeyParameters;
8713 *
8714 * struct {
8715 * TB_ProtocolVersion token_binding_version;
8716 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8717 * } TokenBindingParameters;
8718 */
8719
8720 switch (hnd_type) {
8721 case SSL_HND_CLIENT_HELLO:
8722 case SSL_HND_SERVER_HELLO:
8723 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8724 offset += 1;
8725 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8726 offset += 1;
8727
8728 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8729 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8730 return offset_end;
8731 }
8732 offset += 1;
8733 next_offset = offset + key_parameters_length;
8734
8735 p_ti = proto_tree_add_none_format(tree,
8736 hf->hf.hs_ext_token_binding_key_parameters,
8737 tvb, offset, key_parameters_length,
8738 "Key parameters identifiers (%d identifier%s)",
8739 key_parameters_length,
8740 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8741 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8742
8743 while (offset < next_offset) {
8744 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8745 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8746 offset += 1;
8747 }
8748
8749 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8750 offset = next_offset;
8751 }
8752
8753 break;
8754 default:
8755 break;
8756 }
8757
8758 return offset;
8759}
8760
8761static uint32_t
8762ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8763 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8764 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8765{
8766 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8767 uint32_t next_offset;
8768
8769 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8770 *
8771 * Note: the following structures are not literally defined in the spec,
8772 * they instead use an ASCII diagram.
8773 *
8774 * struct {
8775 * uint16 id;
8776 * opaque value<0..2^16-1>;
8777 * } TransportParameter; // before draft -27
8778 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8779 *
8780 * struct {
8781 * opaque ipv4Address[4];
8782 * uint16 ipv4Port;
8783 * opaque ipv6Address[16];
8784 * uint16 ipv6Port;
8785 * opaque connectionId<0..18>;
8786 * opaque statelessResetToken[16];
8787 * } PreferredAddress;
8788 */
8789
8790 if (offset_end - offset >= 6 &&
8791 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8792 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8793 // Assume encoding of Transport Parameters draft -26 or older with at
8794 // least one transport parameter that has a valid length.
8795 use_varint_encoding = false0;
8796 }
8797
8798 if (use_varint_encoding) {
8799 next_offset = offset_end;
8800 } else {
8801 uint32_t quic_length;
8802 // Assume draft -26 or earlier.
8803 /* TransportParameter TransportParameters<0..2^16-1>; */
8804 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8805 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8806 return offset_end;
8807 }
8808 offset += 2;
8809 next_offset = offset + quic_length;
8810 }
8811
8812 while (offset < next_offset) {
8813 uint64_t parameter_type; /* 62-bit space */
8814 uint32_t parameter_length;
8815 proto_tree *parameter_tree;
8816 uint32_t parameter_end_offset;
8817 uint64_t value;
8818 uint32_t i;
8819 int len = 0;
8820
8821 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8822 NULL((void*)0), "Parameter");
8823 /* TransportParameter ID and Length. */
8824 if (use_varint_encoding) {
8825 uint64_t parameter_length64;
8826 int type_len = 0;
8827
8828 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8829 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8830 offset += type_len;
8831
8832 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8833 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8834 parameter_length = (uint32_t)parameter_length64;
8835 offset += len;
8836
8837 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8838 } else {
8839 parameter_type = tvb_get_ntohs(tvb, offset);
8840 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8841 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8842 offset += 2;
8843
8844 /* opaque value<0..2^16-1> */
8845 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8846 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8847 return next_offset;
8848 }
8849 offset += 2;
8850
8851 proto_item_set_len(parameter_tree, 4 + parameter_length);
8852 }
8853
8854 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8855 proto_item_append_text(parameter_tree, ": GREASE");
8856 } else {
8857 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8858 }
8859
8860 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8861 parameter_end_offset = offset + parameter_length;
8862
8863 /* Omit the value field if the parameter's length is 0. */
8864 if (parameter_length != 0) {
8865 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8866 tvb, offset, parameter_length, ENC_NA0x00000000);
8867 }
8868
8869 switch (parameter_type) {
8870 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8871 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8872 tvb, offset, parameter_length, ENC_NA0x00000000);
8873 offset += parameter_length;
8874 break;
8875 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8876 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8877 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8878 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8879 offset += len;
8880 break;
8881 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8882 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8883 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8884 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8885 offset += 16;
8886 break;
8887 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8888 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8889 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8890 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8891 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8892 offset += len;
8893 break;
8894 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8895 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8896 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8897 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8898 offset += len;
8899 break;
8900 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8901 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8902 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8903 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8904 offset += len;
8905 break;
8906 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8907 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8908 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8909 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8910 offset += len;
8911 break;
8912 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8913 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8914 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8915 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8916 offset += len;
8917 break;
8918 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8919 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8920 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8921 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8922 offset += len;
8923 break;
8924 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8925 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8926 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8927 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8928 offset += len;
8929 break;
8930 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8931 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8932 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8933 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8934 offset += len;
8935 break;
8936 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8937 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8938 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8939 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8940 offset += len;
8941 break;
8942 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8943 /* No Payload */
8944 break;
8945 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8946 uint32_t connectionid_length;
8947 quic_cid_t cid;
8948
8949 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8950 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8951 offset += 4;
8952 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8953 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8954 offset += 2;
8955 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8956 tvb, offset, 16, ENC_NA0x00000000);
8957 offset += 16;
8958 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8959 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8960 offset += 2;
8961 /* XXX - Should we add these addresses and ports as addresses that the client
8962 * is allowed / expected to migrate the server address to? Right now we don't
8963 * enforce that (see RFC 9000 Section 9, which implies that while the client
8964 * can migrate to whatever address it wants, it can only migrate the server
8965 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8966 */
8967
8968 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8969 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8970 break;
8971 }
8972 offset += 1;
8973
8974 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8975 tvb, offset, connectionid_length, ENC_NA0x00000000);
8976 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8977 cid.len = connectionid_length;
8978 // RFC 9000 5.1.1 "If the preferred_address transport
8979 // parameter is sent, the sequence number of the supplied
8980 // connection ID is 1."
8981 cid.seq_num = 1;
8982 // Multipath draft-07 "Also, the Path Identifier for the
8983 // connection ID specified in the "preferred address"
8984 // transport parameter is 0."
8985 cid.path_id = 0;
8986 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8987 quic_add_connection(pinfo, &cid);
8988 }
8989 offset += connectionid_length;
8990
8991 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8992 tvb, offset, 16, ENC_NA0x00000000);
8993 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8994 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8995 }
8996 offset += 16;
8997 }
8998 break;
8999 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
9000 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
9001 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9002 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
9003 offset += len;
9004 break;
9005 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
9006 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
9007 tvb, offset, parameter_length, ENC_NA0x00000000);
9008 offset += parameter_length;
9009 break;
9010 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
9011 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
9012 tvb, offset, parameter_length, ENC_NA0x00000000);
9013 offset += parameter_length;
9014 break;
9015 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
9016 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
9017 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9018 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
9019 offset += len;
9020 break;
9021 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
9022 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
9023 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9024 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
9025 offset += len;
9026 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
9027 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9028 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
9029 offset += len;
9030 break;
9031 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
9032 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
9033 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9034 if (len > 0) {
9035 quic_add_loss_bits(pinfo, value);
9036 }
9037 offset += 1;
9038 break;
9039 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
9040 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
9041 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
9042 offset += len;
9043 break;
9044 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
9045 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
9046 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
9047 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
9048 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
9049 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9050 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
9051 offset += len;
9052 break;
9053 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
9054 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
9055 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
9056 offset += parameter_length;
9057 break;
9058 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
9059 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
9060 tvb, offset, parameter_length, ENC_NA0x00000000);
9061 offset += parameter_length;
9062 break;
9063 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
9064 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
9065 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
9066 offset += 4;
9067 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
9068 uint32_t versions_length;
9069
9070 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
9071 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
9072 offset += 1;
9073 for (i = 0; i < versions_length / 4; i++) {
9074 quic_proto_tree_add_version(tvb, parameter_tree,
9075 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
9076 offset += 4;
9077 }
9078 }
9079 break;
9080 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
9081 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
9082 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9083 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
9084 offset += len;
9085 break;
9086 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
9087 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
9088 tvb, offset, parameter_length, ENC_NA0x00000000);
9089 offset += parameter_length;
9090 break;
9091 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
9092 /* This field was used for non-standard Google-specific parameters encoded as a
9093 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
9094 * parameters. Report it as a bytes blob... */
9095 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
9096 tvb, offset, parameter_length, ENC_NA0x00000000);
9097 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
9098 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
9099 tvb, offset, 4, ENC_NA0x00000000);
9100 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
9101 offset += parameter_length;
9102 break;
9103 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
9104 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
9105 tvb, offset, parameter_length, ENC_NA0x00000000);
9106 offset += parameter_length;
9107 break;
9108 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
9109 /* No Payload */
9110 break;
9111 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
9112 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
9113 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9114 offset += parameter_length;
9115 break;
9116 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
9117 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
9118 quic_proto_tree_add_version(tvb, parameter_tree,
9119 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
9120 offset += 4;
9121 for (i = 4; i < parameter_length; i += 4) {
9122 quic_proto_tree_add_version(tvb, parameter_tree,
9123 hf->hf.hs_ext_quictp_parameter_other_version, offset);
9124 offset += 4;
9125 }
9126 break;
9127 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
9128 /* No Payload */
9129 quic_add_grease_quic_bit(pinfo);
9130 break;
9131 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
9132 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
9133 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9134 offset += parameter_length;
9135 break;
9136 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
9137 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
9138 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9139 if (value == 1) {
9140 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
9141 }
9142 offset += parameter_length;
9143 break;
9144 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
9145 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
9146 /* No Payload */
9147 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
9148 break;
9149 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
9150 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
9151 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9152 if (value > 1) {
9153 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9154 }
9155 /* multipath draft-07: "The value of the initial_max_paths
9156 * parameter MUST be at least 2." TODO: Expert Info? */
9157 offset += parameter_length;
9158 break;
9159 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
9160 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
9161 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
9162 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
9163 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
9164 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
9165 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9166 /* multipath draft-09 and later: "If an endpoint receives an
9167 * initial_max_path_id transport parameter with value 0, the
9168 * peer aims to enable the multipath extension without allowing
9169 * extra paths immediately."
9170 */
9171 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9172 offset += parameter_length;
9173 break;
9174 default:
9175 offset += parameter_length;
9176 /*TODO display expert info about unknown ? */
9177 break;
9178 }
9179
9180 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
9181 /* Dissection did not end at expected location, fix it. */
9182 offset = parameter_end_offset;
9183 }
9184 }
9185
9186 return offset;
9187}
9188
9189static int
9190ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9191 proto_tree *tree, uint32_t offset,
9192 SslSession *session, SslDecryptSession *ssl,
9193 bool_Bool from_server, bool_Bool is_hrr)
9194{
9195 uint8_t sessid_length;
9196 proto_item *ti;
9197 proto_tree *rnd_tree;
9198 proto_tree *ti_rnd;
9199 proto_tree *ech_confirm_tree;
9200 uint8_t draft_version = session->tls13_draft_version;
9201
9202 if (ssl) {
9203 StringInfo *rnd;
9204 if (from_server)
9205 rnd = &ssl->server_random;
9206 else
9207 rnd = &ssl->client_random;
9208
9209 /* save provided random for later keyring generation */
9210 tvb_memcpy(tvb, rnd->data, offset, 32);
9211 rnd->data_len = 32;
9212 if (from_server)
9213 ssl->state |= SSL_SERVER_RANDOM(1<<1);
9214 else
9215 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
9216 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
9217 from_server ? "SERVER" : "CLIENT", ssl->state);
9218 }
9219
9220 if (!from_server && session->client_random.data_len == 0) {
9221 session->client_random.data_len = 32;
9222 tvb_memcpy(tvb, session->client_random.data, offset, 32);
9223 }
9224
9225 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
9226
9227 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
9228
9229 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9230 /* show the time */
9231 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
9232 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
9233 offset += 4;
9234
9235 /* show the random bytes */
9236 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
9237 tvb, offset, 28, ENC_NA0x00000000);
9238 offset += 28;
9239 } else {
9240 if (is_hrr) {
9241 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
9242 } else if (from_server && session->ech) {
9243 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9244 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
9245 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
9246 session->ech_confirmation, 8);
9247 proto_item_set_generated(ti);
9248 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
9249 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9250 } else {
9251 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9252 }
9253 }
9254
9255 offset += 32;
9256 }
9257
9258 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
9259 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
9260 /* show the session id (length followed by actual Session ID) */
9261 sessid_length = tvb_get_uint8(tvb, offset);
9262 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
9263 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9264 offset++;
9265
9266 if (ssl) {
9267 /* save the authoritative SID for later use in ChangeCipherSpec.
9268 * (D)TLS restricts the SID to 32 chars, it does not make sense to
9269 * save more, so ignore larger ones. To support ECH, also save
9270 * the SID from the ClientHelloOuter. */
9271 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
9272 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
9273 ssl->session_id.data_len = sessid_length;
9274 }
9275 }
9276 if (sessid_length > 0) {
9277 proto_tree_add_item(tree, hf->hf.hs_session_id,
9278 tvb, offset, sessid_length, ENC_NA0x00000000);
9279 offset += sessid_length;
9280 }
9281 }
9282
9283 return offset;
9284}
9285
9286static int
9287ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9288 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9289 bool_Bool has_length)
9290{
9291 /* TLS 1.2/1.3 status_request Client Hello Extension.
9292 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
9293 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
9294 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
9295 * struct {
9296 * CertificateStatusType status_type;
9297 * uint16 request_length; // for status_request_v2
9298 * select (status_type) {
9299 * case ocsp: OCSPStatusRequest;
9300 * case ocsp_multi: OCSPStatusRequest;
9301 * } request;
9302 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
9303 *
9304 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
9305 * struct {
9306 * ResponderID responder_id_list<0..2^16-1>;
9307 * Extensions request_extensions;
9308 * } OCSPStatusRequest;
9309 * opaque ResponderID<1..2^16-1>;
9310 * opaque Extensions<0..2^16-1>;
9311 */
9312 unsigned cert_status_type;
9313
9314 cert_status_type = tvb_get_uint8(tvb, offset);
9315 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
9316 tvb, offset, 1, ENC_NA0x00000000);
9317 offset++;
9318
9319 if (has_length) {
9320 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
9321 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9322 offset += 2;
9323 }
9324
9325 switch (cert_status_type) {
9326 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9327 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9328 {
9329 uint32_t responder_id_list_len;
9330 uint32_t request_extensions_len;
9331
9332 /* ResponderID responder_id_list<0..2^16-1> */
9333 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
9334 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
9335 return offset_end;
9336 }
9337 offset += 2;
9338 if (responder_id_list_len != 0) {
9339 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9340 tvb, offset, responder_id_list_len,
9341 "Responder ID list is not implemented, contact Wireshark"
9342 " developers if you want this to be supported");
9343 }
9344 offset += responder_id_list_len;
9345
9346 /* opaque Extensions<0..2^16-1> */
9347 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
9348 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
9349 return offset_end;
9350 }
9351 offset += 2;
9352 if (request_extensions_len != 0) {
9353 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9354 tvb, offset, request_extensions_len,
9355 "Request Extensions are not implemented, contact"
9356 " Wireshark developers if you want this to be supported");
9357 }
9358 offset += request_extensions_len;
9359 break;
9360 }
9361 }
9362
9363 return offset;
9364}
9365
9366static unsigned
9367ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9368 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9369{
9370 /* https://tools.ietf.org/html/rfc6961#section-2.2
9371 * struct {
9372 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
9373 * } CertificateStatusRequestListV2;
9374 */
9375 uint32_t req_list_length, next_offset;
9376
9377 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
9378 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
9379 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
9380 return offset_end;
9381 }
9382 offset += 2;
9383 next_offset = offset + req_list_length;
9384
9385 while (offset < next_offset) {
9386 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
9387 }
9388
9389 return offset;
9390}
9391
9392static uint32_t
9393tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9394 uint32_t offset, uint32_t offset_end)
9395{
9396 uint32_t response_length;
9397 proto_item *ocsp_resp;
9398 proto_tree *ocsp_resp_tree;
9399 asn1_ctx_t asn1_ctx;
9400
9401 /* opaque OCSPResponse<1..2^24-1>; */
9402 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
9403 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9404 return offset_end;
9405 }
9406 offset += 3;
9407
9408 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
9409 response_length, ENC_BIG_ENDIAN0x00000000);
9410 proto_item_set_text(ocsp_resp, "OCSP Response");
9411 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
9412 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
9413 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9414 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
9415 }
9416 offset += response_length;
9417
9418 return offset;
9419}
9420
9421uint32_t
9422tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9423 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9424{
9425 /* TLS 1.2 "CertificateStatus" handshake message.
9426 * TLS 1.3 "status_request" Certificate extension.
9427 * struct {
9428 * CertificateStatusType status_type;
9429 * select (status_type) {
9430 * case ocsp: OCSPResponse;
9431 * case ocsp_multi: OCSPResponseList; // status_request_v2
9432 * } response;
9433 * } CertificateStatus;
9434 * opaque OCSPResponse<1..2^24-1>;
9435 * struct {
9436 * OCSPResponse ocsp_response_list<1..2^24-1>;
9437 * } OCSPResponseList; // status_request_v2
9438 */
9439 uint32_t status_type, resp_list_length, next_offset;
9440
9441 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9442 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9443 offset += 1;
9444
9445 switch (status_type) {
9446 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9447 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9448 break;
9449
9450 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9451 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9452 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9453 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9454 return offset_end;
9455 }
9456 offset += 3;
9457 next_offset = offset + resp_list_length;
9458
9459 while (offset < next_offset) {
9460 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9461 }
9462 break;
9463 }
9464
9465 return offset;
9466}
9467
9468static unsigned
9469ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9470 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9471 wmem_strbuf_t *ja3)
9472{
9473 /* RFC 8446 Section 4.2.7
9474 * enum { ..., (0xFFFF) } NamedGroup;
9475 * struct {
9476 * NamedGroup named_group_list<2..2^16-1>
9477 * } NamedGroupList;
9478 *
9479 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9480 * the extension itself from "elliptic_curves" to "supported_groups".
9481 */
9482 uint32_t groups_length, next_offset;
9483 proto_tree *groups_tree;
9484 proto_item *ti;
9485 char *ja3_dash = "";
9486
9487 /* NamedGroup named_group_list<2..2^16-1> */
9488 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9489 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9490 return offset_end;
9491 }
9492 offset += 2;
9493 next_offset = offset + groups_length;
9494
9495 ti = proto_tree_add_none_format(tree,
9496 hf->hf.hs_ext_supported_groups,
9497 tvb, offset, groups_length,
9498 "Supported Groups (%d group%s)",
9499 groups_length / 2,
9500 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9501
9502 /* make this a subtree */
9503 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9504
9505 if (ja3) {
9506 wmem_strbuf_append_c(ja3, ',');
9507 }
9508 /* loop over all groups */
9509 while (offset + 2 <= offset_end) {
9510 uint32_t ext_supported_group;
9511
9512 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9513 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9514 offset += 2;
9515 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
9516 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9517 ja3_dash = "-";
9518 }
9519 }
9520 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9521 offset = next_offset;
9522 }
9523
9524 return offset;
9525}
9526
9527static int
9528ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9529 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9530{
9531 uint8_t ecpf_length;
9532 proto_tree *ecpf_tree;
9533 proto_item *ti;
9534
9535 ecpf_length = tvb_get_uint8(tvb, offset);
9536 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9537 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9538
9539 offset += 1;
9540 ti = proto_tree_add_none_format(tree,
9541 hf->hf.hs_ext_ec_point_formats,
9542 tvb, offset, ecpf_length,
9543 "Elliptic curves point formats (%d)",
9544 ecpf_length);
9545
9546 /* make this a subtree */
9547 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9548
9549 if (ja3) {
9550 wmem_strbuf_append_c(ja3, ',');
9551 }
9552
9553 /* loop over all point formats */
9554 while (ecpf_length > 0)
9555 {
9556 uint32_t ext_ec_point_format;
9557
9558 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9559 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9560 offset++;
9561 ecpf_length--;
9562 if (ja3) {
9563 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9564 if (ecpf_length > 0) {
9565 wmem_strbuf_append_c(ja3, '-');
9566 }
9567 }
9568 }
9569
9570 return offset;
9571}
9572
9573static int
9574ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9575 packet_info *pinfo, proto_tree *tree,
9576 uint32_t offset, uint32_t next_offset)
9577{
9578 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9579 * opaque srp_I<1..2^8-1>;
9580 */
9581 uint32_t username_len;
9582
9583 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9584 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9585 return next_offset;
9586 }
9587 offset++;
9588
9589 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9590 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9591 offset += username_len;
9592
9593 return offset;
9594}
9595
9596static uint32_t
9597tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9598 uint32_t offset, uint32_t offset_end, uint16_t version)
9599{
9600 /* https://tools.ietf.org/html/rfc6962#section-3.2
9601 * enum { v1(0), (255) } Version;
9602 * struct {
9603 * opaque key_id[32];
9604 * } LogID;
9605 * opaque CtExtensions<0..2^16-1>;
9606 * struct {
9607 * Version sct_version;
9608 * LogID id;
9609 * uint64 timestamp;
9610 * CtExtensions extensions;
9611 * digitally-signed struct { ... };
9612 * } SignedCertificateTimestamp;
9613 */
9614 uint32_t sct_version;
9615 uint64_t sct_timestamp_ms;
9616 nstime_t sct_timestamp;
9617 uint32_t exts_len;
9618 const char *log_name;
9619
9620 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9621 offset++;
9622 if (sct_version != 0) {
9623 // TODO expert info about unknown SCT version?
9624 return offset;
9625 }
9626 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9627 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9628 proto_item_append_text(tree, " (%s)", log_name);
9629 offset += 32;
9630 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9631 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9632 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9633 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9634 offset += 8;
9635 /* opaque CtExtensions<0..2^16-1> */
9636 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9637 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9638 return offset_end;
9639 }
9640 offset += 2;
9641 if (exts_len > 0) {
9642 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9643 offset += exts_len;
9644 }
9645 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9646 hf->hf.sct_sct_signature_length,
9647 hf->hf.sct_sct_signature);
9648 return offset;
9649}
9650
9651uint32_t
9652tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9653 uint32_t offset, uint32_t offset_end, uint16_t version)
9654{
9655 /* https://tools.ietf.org/html/rfc6962#section-3.3
9656 * opaque SerializedSCT<1..2^16-1>;
9657 * struct {
9658 * SerializedSCT sct_list <1..2^16-1>;
9659 * } SignedCertificateTimestampList;
9660 */
9661 uint32_t list_length, sct_length, next_offset;
9662 proto_tree *subtree;
9663
9664 /* SerializedSCT sct_list <1..2^16-1> */
9665 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9666 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9667 return offset_end;
9668 }
9669 offset += 2;
9670
9671 while (offset < offset_end) {
9672 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9673
9674 /* opaque SerializedSCT<1..2^16-1> */
9675 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9676 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9677 return offset_end;
9678 }
9679 offset += 2;
9680 next_offset = offset + sct_length;
9681 proto_item_set_len(subtree, 2 + sct_length);
9682 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9683 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9684 offset = next_offset;
9685 }
9686 }
9687
9688 return offset;
9689}
9690
9691static int
9692dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9693 proto_tree *tree, uint32_t offset)
9694{
9695 uint32_t kdf_id, aead_id;
9696 proto_item *cs_ti;
9697 proto_tree *cs_tree;
9698
9699 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9700 tvb, offset, 4, ENC_NA0x00000000);
9701 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9702
9703 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9704 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9705 offset += 2;
9706 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9707 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9708 offset += 2;
9709
9710 proto_item_append_text(cs_ti, ": %s/%s",
9711 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9712 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9713 return offset;
9714}
9715
9716static int
9717dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9718 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9719 uint32_t *config_id)
9720{
9721 uint32_t length, cipher_suite_length;
9722 proto_item *kc_ti, *css_ti;
9723 proto_tree *kc_tree, *css_tree;
9724 uint32_t original_offset = offset, next_offset;
9725
9726 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9727 tvb, offset, -1, ENC_NA0x00000000);
9728 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9729
9730 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9731 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9732 offset += 1;
9733 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9734 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9735 offset += 2;
9736 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9737 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9738 offset += 2;
9739 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9740 tvb, offset, length, ENC_NA0x00000000);
9741 offset += length;
9742
9743 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9744 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9745 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9746 return offset_end;
9747 }
9748 offset += 2;
9749 next_offset = offset + cipher_suite_length;
9750
9751 css_ti = proto_tree_add_none_format(kc_tree,
9752 hf->hf.ech_hpke_keyconfig_cipher_suites,
9753 tvb, offset, cipher_suite_length,
9754 "Cipher Suites (%d suite%s)",
9755 cipher_suite_length / 4,
9756 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9757 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9758
9759
9760 while (offset + 4 <= next_offset) {
9761 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9762 }
9763
9764 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9765 offset = next_offset;
9766 }
9767
9768 proto_item_set_len(kc_ti, offset - original_offset);
9769
9770 return offset;
9771}
9772
9773static int
9774dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9775 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9776 const uint8_t **public_name, uint32_t *config_id)
9777{
9778 uint32_t public_name_length, extensions_length, next_offset;
9779
9780 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9781 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9782 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9783 offset += 1;
9784 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9785 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9786 offset += 1;
9787 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9788 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9789 offset += public_name_length;
9790
9791 /* Extension extensions<0..2^16-1>; */
9792 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9793 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9794 return offset_end;
9795 }
9796 offset += 2;
9797 next_offset = offset + extensions_length;
9798
9799 if (extensions_length > 0) {
9800 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9801 tvb, offset, extensions_length, ENC_NA0x00000000);
9802 }
9803 offset += extensions_length;
9804
9805 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9806 offset = next_offset;
9807 }
9808
9809 return offset;
9810}
9811
9812static int
9813dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9814 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9815{
9816 uint32_t version, length;
9817 proto_item *ech_ti;
9818 proto_tree *ech_tree;
9819 const uint8_t *public_name = NULL((void*)0);
9820 uint32_t config_id = 0;
9821
9822 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9823 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9824
9825 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9826 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9827 offset += 2;
9828 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9829 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9830 offset += 2;
9831
9832 proto_item_set_len(ech_ti, 4 + length);
9833
9834 switch(version) {
9835 case 0xfe0d:
9836 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9837 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9838 break;
9839
9840 default:
9841 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9842 }
9843
9844 return 4 + length;
9845}
9846
9847uint32_t
9848ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9849 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9850{
9851 uint32_t echconfiglist_length, next_offset;
9852
9853 /* ECHConfig ECHConfigList<1..2^16-1>; */
9854 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9855 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9856 return offset_end;
9857 }
9858 offset += 2;
9859 next_offset = offset + echconfiglist_length;
9860
9861 while (offset < next_offset) {
9862 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9863 }
9864
9865 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9866 offset = next_offset;
9867 }
9868
9869 return offset;
9870}
9871
9872static uint32_t
9873ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9874 uint32_t offset, uint32_t offset_end)
9875{
9876 uint32_t ext_length, next_offset;
9877 proto_tree *ext_tree;
9878 proto_item *ti;
9879
9880 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9881 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9882 return offset_end;
9883 }
9884 offset += 1;
9885 next_offset = offset + ext_length;
9886
9887 ti = proto_tree_add_none_format(tree,
9888 hf->hf.hs_ext_ech_outer_ext,
9889 tvb, offset, ext_length,
9890 "Outer Extensions (%d extension%s)",
9891 ext_length / 2,
9892 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9893
9894 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9895
9896 while (offset + 2 <= offset_end) {
9897 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9898 offset += 2;
9899 }
9900
9901 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9902 offset = next_offset;
9903 }
9904
9905 return offset;
9906}
9907
9908static uint32_t
9909// NOLINTNEXTLINE(misc-no-recursion)
9910ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9911 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9912 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9913{
9914 uint32_t ch_type, length;
9915 proto_item *ti, *payload_ti;
9916 proto_tree *retry_tree, *payload_tree;
9917 uint32_t hello_length = tvb_reported_length(tvb);
9918
9919 switch (hnd_type) {
9920 case SSL_HND_CLIENT_HELLO:
9921 /*
9922 * enum { outer(0), inner(1) } ECHClientHelloType;
9923 *
9924 * struct {
9925 * ECHClientHelloType type;
9926 * select (ECHClientHello.type) {
9927 * case outer:
9928 * HpkeSymmetricCipherSuite cipher_suite;
9929 * uint8 config_id;
9930 * opaque enc<0..2^16-1>;
9931 * opaque payload<1..2^16-1>;
9932 * case inner:
9933 * Empty;
9934 * };
9935 * } ECHClientHello;
9936 */
9937
9938 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9939 offset += 1;
9940 switch (ch_type) {
9941 case 0: /* outer */
9942 if (ssl && session->first_ch_ech_frame == 0) {
9943 session->first_ch_ech_frame = pinfo->num;
9944 }
9945 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9946 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9947 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9948
9949 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9950 uint8_t config_id = tvb_get_uint8(tvb, offset);
9951 offset += 1;
9952 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9953 offset += 2;
9954 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9955 offset += length;
9956 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9957 offset += 2;
9958 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9959 offset += length;
9960
9961 if (!mk_map) {
9962 break;
9963 }
9964 if (session->client_random.data_len == 0) {
9965 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9966 break;
9967 }
9968 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9969 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9970 if (!ech_secret || !ech_config) {
9971 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9972 G_STRFUNC((const char*) (__func__)));
9973 break;
9974 }
9975
9976 if (hpke_hkdf_len(kdf_id) == 0) {
9977 ssl_debug_printf("Unsupported KDF\n");
9978 break;
9979 }
9980
9981 if (hpke_aead_key_len(aead_id) == 0) {
9982 ssl_debug_printf("Unsupported AEAD\n");
9983 break;
9984 }
9985
9986 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9987
9988 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9989 if (length < aead_auth_tag_len) {
9990 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9991 break;
9992 }
9993 unsigned decrypted_len = length - aead_auth_tag_len;
9994
9995 uint16_t version = GUINT16_FROM_BE(*(uint16_t *)ech_config->data)(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)ech_config
->data) >> 8) | (guint16) ((guint16) (*(uint16_t *)ech_config
->data) << 8))))));
9996 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9997 ssl_debug_printf("Unexpected version in ECH Config\n");
9998 break;
9999 }
10000 uint32_t ech_config_offset = 2;
10001 if (GUINT16_FROM_BE(*(uint16_t *)(ech_config->data + ech_config_offset))(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)(ech_config
->data + ech_config_offset)) >> 8) | (guint16) ((guint16
) (*(uint16_t *)(ech_config->data + ech_config_offset)) <<
8)))))) != ech_config->data_len - 4) {
10002 ssl_debug_printf("Malformed ECH Config, invalid length\n");
10003 break;
10004 }
10005 ech_config_offset += 2;
10006 if (*(ech_config->data + ech_config_offset) != config_id) {
10007 ssl_debug_printf("ECH Config version mismatch\n");
10008 break;
10009 }
10010 ech_config_offset += 1;
10011 uint16_t kem_id_be = *(uint16_t *)(ech_config->data + ech_config_offset);
10012 uint16_t kem_id = GUINT16_FROM_BE(kem_id_be)(((((guint16) ( (guint16) ((guint16) (kem_id_be) >> 8) |
(guint16) ((guint16) (kem_id_be) << 8))))));
10013 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
10014 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
10015 GByteArray *info = g_byte_array_new();
10016 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
10017 g_byte_array_append(info, ech_config->data, ech_config->data_len);
10018 uint8_t key[AEAD_MAX_KEY_LENGTH32];
10019 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
10020 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
10021 key, base_nonce)) {
10022 g_byte_array_free(info, TRUE(!(0)));
10023 break;
10024 }
10025 g_byte_array_free(info, TRUE(!(0)));
10026 gcry_cipher_hd_t cipher;
10027 if (hpke_setup_aead(&cipher, aead_id, key) ||
10028 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
10029 gcry_cipher_close(cipher);
10030 break;
10031 }
10032 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
10033 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
10034 tvb_memcpy(tvb, ech_aad, 0, hello_length);
10035 memset(ech_aad + offset - length, 0, length);
10036 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
10037 gcry_cipher_close(cipher);
10038 wmem_free(NULL((void*)0), ech_aad);
10039 break;
10040 }
10041 wmem_free(NULL((void*)0), ech_aad);
10042 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
10043 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
10044 gcry_cipher_close(cipher);
10045 break;
10046 }
10047 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
10048 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
10049 gcry_cipher_close(cipher);
10050 break;
10051 }
10052 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
10053 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
10054 gcry_cipher_close(cipher);
10055 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
10056 payload + decrypted_len, aead_auth_tag_len)) {
10057 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
10058 } else {
10059 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
10060 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
10061 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
10062 if (ssl) {
10063 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
10064 uint32_t len_offset = ssl->ech_transcript.data_len;
10065 if (ssl->ech_transcript.data_len > 0)
10066 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10067 ssl->ech_transcript.data_len + hello_length + 4);
10068 else
10069 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
10070 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
10071 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
10072 /* Copy ClientHelloInner up to the legacy_session_id field. */
10073 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
10074 ssl->ech_transcript.data_len += 38;
10075 /* Now copy the legacy_session_id field from ClientHelloOuter. */
10076 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = ssl->session_id.data_len;
10077 ssl->ech_transcript.data_len++;
10078 memcpy(&ssl->ech_transcript.data[ssl->ech_transcript.data_len], ssl->session_id.data, ssl->session_id.data_len);
10079 ssl->ech_transcript.data_len += ssl->session_id.data_len;
10080 /* Skip past the legacy_session_id field in ClientHelloInner
10081 * (which should be the empty string, i.e. just a 0 size.) */
10082 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
10083 /* Copy the Cipher Suites from ClientHelloInner. */
10084 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
10085 2 + tvb_get_ntohs(ech_tvb, ech_offset));
10086 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
10087 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
10088 /* Copy the Compression Methods */
10089 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
10090 1 + tvb_get_uint8(ech_tvb, ech_offset));
10091 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
10092 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
10093 /* Now replace extensions in ech_outer_extensions with the
10094 * data from ClientHelloOuter. */
10095 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
10096 ssl->ech_transcript.data_len += 2;
10097 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
10098 ech_offset += 2;
10099 while (extensions_end - ech_offset >= 4) {
10100 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
10101 ech_offset += 2;
10102 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
10103 ech_offset += 2;
10104 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
10105 /* Copy this extension directly */
10106 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len,
10107 ech_offset - 4, 4 + ext_len);
10108 ssl->ech_transcript.data_len += 4 + ext_len;
10109 ech_offset += ext_len;
10110 } else if (ext_len > 0) {
10111 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
10112 ech_offset += 1;
10113 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
10114 /* In ClientHelloOuter, skip past the legacy_session_id */
10115 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
10116 /* Skip past Cipher Suites */
10117 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
10118 /* Skip past Compression Methods */
10119 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
10120 /* Now at the start of ClientHelloOuter's extensions */
10121 while (ech_outer_extensions_end - ech_offset >= 2) {
10122 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
10123 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
10124 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
10125 /* This could lead to a buffer overflow by
10126 * making the post-copying ClientHelloInner
10127 * longer than ClientHelloOuter and is
10128 * illegal, so don't copy. */
10129 break;
10130 }
10131 bool_Bool found = false0;
10132 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
10133 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
10134 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
10135 if (ext_type == outer_ext_type) {
10136 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
10137 4 + outer_ext_len);
10138 ssl->ech_transcript.data_len += 4 + outer_ext_len;
10139 outer_offset += 4 + outer_ext_len;
10140 found = true1;
10141 break;
10142 } else {
10143 outer_offset += 4 + outer_ext_len;
10144 }
10145 }
10146 if (!found) {
10147 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
10148 }
10149 ech_offset += 2;
10150 }
10151 }
10152 }
10153 uint16_t ech_extensions_len_be = GUINT16_TO_BE(ssl->ech_transcript.data_len - ech_extensions_len_offset - 2)((((guint16) ( (guint16) ((guint16) (ssl->ech_transcript.data_len
- ech_extensions_len_offset - 2) >> 8) | (guint16) ((guint16
) (ssl->ech_transcript.data_len - ech_extensions_len_offset
- 2) << 8)))));
10154 *(ssl->ech_transcript.data + ech_extensions_len_offset) = ech_extensions_len_be & 0xff;
10155 *(ssl->ech_transcript.data + ech_extensions_len_offset + 1) = (ech_extensions_len_be >> 8);
10156 *(ssl->ech_transcript.data + len_offset + 2) = ((ssl->ech_transcript.data_len - len_offset - 4) >> 8);
10157 *(ssl->ech_transcript.data + len_offset + 3) = (ssl->ech_transcript.data_len - len_offset - 4) & 0xff;
10158 }
10159 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
10160 ssl, NULL((void*)0), mk_map);
10161 if (ech_padding_begin < decrypted_len) {
10162 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
10163 ENC_NA0x00000000);
10164 }
10165 }
10166
10167 break;
10168 case 1: /* inner */
10169 break;
10170 }
10171 break;
10172
10173 case SSL_HND_ENCRYPTED_EXTENSIONS:
10174 /*
10175 * struct {
10176 * ECHConfigList retry_configs;
10177 * } ECHEncryptedExtensions;
10178 */
10179
10180 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
10181 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
10182 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
10183 break;
10184
10185 case SSL_HND_HELLO_RETRY_REQUEST:
10186 /*
10187 * struct {
10188 * opaque confirmation[8];
10189 * } ECHHelloRetryRequest;
10190 */
10191
10192 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
10193 if (session->ech) {
10194 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
10195 proto_item_set_generated(ti);
10196 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
10197 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10198 } else {
10199 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10200 }
10201 }
10202 offset += 8;
10203 break;
10204 }
10205
10206 return offset;
10207}
10208
10209static uint32_t
10210ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10211 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10212 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
10213{
10214 uint32_t record_digest_length, encrypted_sni_length;
10215
10216 switch (hnd_type) {
10217 case SSL_HND_CLIENT_HELLO:
10218 /*
10219 * struct {
10220 * CipherSuite suite;
10221 * KeyShareEntry key_share;
10222 * opaque record_digest<0..2^16-1>;
10223 * opaque encrypted_sni<0..2^16-1>;
10224 * } ClientEncryptedSNI;
10225 */
10226 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10227 offset += 2;
10228 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
10229
10230 /* opaque record_digest<0..2^16-1> */
10231 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
10232 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
10233 return offset_end;
10234 }
10235 offset += 2;
10236 if (record_digest_length > 0) {
10237 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
10238 offset += record_digest_length;
10239 }
10240
10241 /* opaque encrypted_sni<0..2^16-1> */
10242 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
10243 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
10244 return offset_end;
10245 }
10246 offset += 2;
10247 if (encrypted_sni_length > 0) {
10248 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
10249 offset += encrypted_sni_length;
10250 }
10251 break;
10252
10253 case SSL_HND_ENCRYPTED_EXTENSIONS:
10254 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
10255 offset += 16;
10256 break;
10257 }
10258
10259 return offset;
10260}
10261/** TLS Extensions (in Client Hello and Server Hello). }}} */
10262
10263/* Connection ID dissection. {{{ */
10264static uint32_t
10265ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10266 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
10267 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
10268{
10269 /* keep track of the decrypt session only for the first pass */
10270 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
10271 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
10272 *session_cidl = cidl;
10273 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
10274 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
10275 if (ssl) {
10276 ssl_add_session_by_cid(ssl);
10277 }
10278 }
10279
10280 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
10281 tvb, offset, 1, ENC_NA0x00000000);
10282 offset++;
10283
10284 if (cidl > 0) {
10285 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
10286 tvb, offset, cidl, ENC_NA0x00000000);
10287 offset += cidl;
10288 }
10289
10290 return offset;
10291}
10292
10293static uint32_t
10294ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10295 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
10296 SslSession *session, SslDecryptSession *ssl)
10297{
10298 uint8_t cidl = tvb_get_uint8(tvb, offset);
10299
10300 switch (hnd_type) {
10301 case SSL_HND_CLIENT_HELLO:
10302 session->client_cid_len_present = true1;
10303 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10304 cidl, &session->client_cid, &session->client_cid_len);
10305 case SSL_HND_SERVER_HELLO:
10306 session->server_cid_len_present = true1;
10307 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10308 cidl, &session->server_cid, &session->server_cid_len);
10309 default:
10310 return offset;
10311 }
10312} /* }}} */
10313
10314/* Trusted CA dissection. {{{ */
10315static uint32_t
10316ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
10317 uint32_t offset, uint32_t offset_end)
10318{
10319 proto_item *ti;
10320 proto_tree *subtree;
10321 uint32_t keys_length, next_offset;
10322
10323 /*
10324 * struct {
10325 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
10326 * } TrustedAuthorities;
10327 *
10328 * struct {
10329 * IdentifierType identifier_type;
10330 * select (identifier_type) {
10331 * case pre_agreed: struct {};
10332 * case key_sha1_hash: SHA1Hash;
10333 * case x509_name: DistinguishedName;
10334 * case cert_sha1_hash: SHA1Hash;
10335 * } identifier;
10336 * } TrustedAuthority;
10337 *
10338 * enum {
10339 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10340 * cert_sha1_hash(3), (255)
10341 * } IdentifierType;
10342 *
10343 * opaque DistinguishedName<1..2^16-1>;
10344 *
10345 */
10346
10347
10348 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
10349 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
10350 0, UINT16_MAX(65535)))
10351 {
10352 return offset_end;
10353 }
10354 offset += 2;
10355 next_offset = offset + keys_length;
10356
10357 if (keys_length > 0)
10358 {
10359 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
10360 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
10361 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
10362
10363 while (offset < next_offset)
10364 {
10365 uint32_t identifier_type;
10366 proto_tree *trusted_key_tree;
10367 proto_item *trusted_key_item;
10368 asn1_ctx_t asn1_ctx;
10369 uint32_t key_len = 0;
10370
10371 identifier_type = tvb_get_uint8(tvb, offset);
10372
10373 // Use 0 as length for now as we'll only know the size when we decode the identifier
10374 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
10375 offset, 0, "Trusted CA Key");
10376 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
10377
10378 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
10379 offset, 1, identifier_type);
10380 offset++;
10381
10382 /*
10383 * enum {
10384 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10385 * cert_sha1_hash(3), (255)
10386 * } IdentifierType;
10387 */
10388 switch (identifier_type)
10389 {
10390 case 0:
10391 key_len = 0;
10392 break;
10393 case 2:
10394 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10395
10396 uint32_t name_length;
10397 /* opaque DistinguishedName<1..2^16-1> */
10398 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
10399 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
10400 return next_offset;
10401 }
10402 offset += 2;
10403
10404 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
10405 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
10406 offset += name_length;
10407 break;
10408 case 1:
10409 case 3:
10410 key_len = 20;
10411 /* opaque SHA1Hash[20]; */
10412 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
10413 offset, 20, ENC_NA0x00000000);
10414 break;
10415
10416 default:
10417 key_len = 0;
10418 /*TODO display expert info about unknown ? */
10419 break;
10420 }
10421 proto_item_set_len(trusted_key_item, 1 + key_len);
10422 offset += key_len;
10423 }
10424 }
10425
10426 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10427 {
10428 offset = next_offset;
10429 }
10430
10431 return offset;
10432} /* }}} */
10433
10434
10435/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10436bool_Bool
10437ssl_is_valid_content_type(uint8_t type)
10438{
10439 switch ((ContentType) type) {
10440 case SSL_ID_CHG_CIPHER_SPEC:
10441 case SSL_ID_ALERT:
10442 case SSL_ID_HANDSHAKE:
10443 case SSL_ID_APP_DATA:
10444 case SSL_ID_HEARTBEAT:
10445 case SSL_ID_TLS12_CID:
10446 case SSL_ID_DTLS13_ACK:
10447 return true1;
10448 }
10449 return false0;
10450}
10451
10452bool_Bool
10453ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10454{
10455 switch ((HandshakeType) hs_type) {
10456 case SSL_HND_HELLO_VERIFY_REQUEST:
10457 /* hello_verify_request is DTLS-only */
10458 return is_dtls;
10459
10460 case SSL_HND_HELLO_REQUEST:
10461 case SSL_HND_CLIENT_HELLO:
10462 case SSL_HND_SERVER_HELLO:
10463 case SSL_HND_NEWSESSION_TICKET:
10464 case SSL_HND_END_OF_EARLY_DATA:
10465 case SSL_HND_HELLO_RETRY_REQUEST:
10466 case SSL_HND_ENCRYPTED_EXTENSIONS:
10467 case SSL_HND_CERTIFICATE:
10468 case SSL_HND_SERVER_KEY_EXCHG:
10469 case SSL_HND_CERT_REQUEST:
10470 case SSL_HND_SVR_HELLO_DONE:
10471 case SSL_HND_CERT_VERIFY:
10472 case SSL_HND_CLIENT_KEY_EXCHG:
10473 case SSL_HND_FINISHED:
10474 case SSL_HND_CERT_URL:
10475 case SSL_HND_CERT_STATUS:
10476 case SSL_HND_SUPPLEMENTAL_DATA:
10477 case SSL_HND_KEY_UPDATE:
10478 case SSL_HND_COMPRESSED_CERTIFICATE:
10479 case SSL_HND_ENCRYPTED_EXTS:
10480 return true1;
10481 case SSL_HND_MESSAGE_HASH:
10482 return false0;
10483 }
10484 return false0;
10485}
10486
10487static bool_Bool
10488ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10489 bool_Bool is_dtls)
10490{
10491 /* Consider all valid Handshake messages (except for Client Hello) and
10492 * all other valid record types (other than Handshake) */
10493 return (content_type == SSL_ID_HANDSHAKE &&
10494 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10495 handshake_type != SSL_HND_CLIENT_HELLO) ||
10496 (content_type != SSL_ID_HANDSHAKE &&
10497 ssl_is_valid_content_type(content_type));
10498}
10499
10500/**
10501 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10502 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10503 * Returns true if the supported_versions extension was found, false if not.
10504 */
10505bool_Bool
10506tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10507 uint16_t *server_version, bool_Bool *is_hrr)
10508{
10509 /* SHA256("HelloRetryRequest") */
10510 static const uint8_t tls13_hrr_random_magic[] = {
10511 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10512 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10513 };
10514 uint8_t session_id_length;
10515
10516 *server_version = tvb_get_ntohs(tvb, offset);
10517
10518 /*
10519 * Try to look for supported_versions extension. Minimum length:
10520 * 2 + 32 + 1 = 35 (version, random, session id length)
10521 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10522 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10523 *
10524 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10525 * there's a separate expert info warning for that.
10526 */
10527 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10528 offset += 2;
10529 if (is_hrr) {
10530 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10531 }
10532 offset += 32;
10533 session_id_length = tvb_get_uint8(tvb, offset);
10534 offset++;
10535 if (offset_end - offset < session_id_length + 5u) {
10536 return false0;
10537 }
10538 offset += session_id_length + 5;
10539
10540 while (offset_end - offset >= 6) {
10541 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10542 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10543 if (offset_end - offset < 4u + ext_len) {
10544 break; /* not enough data for type, length and data */
10545 }
10546 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10547 if (ext_len == 2) {
10548 *server_version = tvb_get_ntohs(tvb, offset + 4);
10549 }
10550 return true1;
10551 }
10552 offset += 4 + ext_len;
10553 }
10554 } else {
10555 if (is_hrr) {
10556 *is_hrr = false0;
10557 }
10558 }
10559 return false0;
10560}
10561
10562/**
10563 * Scan a Client Hello handshake message to see if the supported_versions
10564 * extension is found, in which case the version field is legacy_version.
10565 */
10566static bool_Bool
10567tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10568{
10569 uint8_t session_id_length;
10570
10571 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10572
10573 /*
10574 * Try to look for supported_versions extension. Minimum length:
10575 * 2 + 32 + 1 = 35 (version, random, session id length)
10576 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10577 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10578 *
10579 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10580 * there's a separate expert info warning for that.
10581 */
10582 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10583 offset += 2;
10584 offset += 32;
10585 session_id_length = tvb_get_uint8(tvb, offset);
10586 offset++;
10587 if (offset_end - offset < session_id_length + 2u) {
10588 return false0;
10589 }
10590 offset += session_id_length;
10591 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10592 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10593 offset++;
10594 if (offset_end - offset < cookie_length + 2u) {
10595 return false0;
10596 }
10597 }
10598 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10599 offset += 2;
10600 if (offset_end - offset < cipher_suites_length + 1u) {
10601 return false0;
10602 }
10603 offset += cipher_suites_length;
10604 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10605 offset++;
10606 if (offset_end - offset < compression_methods_length + 2u) {
10607 return false0;
10608 }
10609 offset += compression_methods_length + 2;
10610
10611 while (offset_end - offset >= 6) {
10612 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10613 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10614 if (offset_end - offset < 4u + ext_len) {
10615 break; /* not enough data for type, length and data */
10616 }
10617 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10618 return true1;
10619 }
10620 offset += 4 + ext_len;
10621 }
10622 }
10623 return false0;
10624}
10625void
10626ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10627 uint8_t content_type, uint8_t handshake_type,
10628 bool_Bool is_dtls, uint16_t version)
10629{
10630 uint8_t tls13_draft = 0;
10631
10632 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10633 is_dtls))
10634 return;
10635
10636 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10637 if (version == SSL_VER_UNKNOWN0) {
10638 return;
10639 }
10640
10641 session->tls13_draft_version = tls13_draft;
10642 session->version = version;
10643 if (ssl) {
10644 ssl->state |= SSL_VERSION(1<<4);
10645 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10646 }
10647}
10648
10649void
10650ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10651 ContentType content_type,
10652 unsigned record_length, proto_item *length_pi,
10653 uint16_t version, tvbuff_t *decrypted_tvb)
10654{
10655 unsigned max_expansion;
10656 if (version == TLSV1DOT3_VERSION0x304) {
10657 /* TLS 1.3: Max length is 2^14 + 256 */
10658 max_expansion = 256;
10659 } else {
10660 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10661 max_expansion = 2048;
10662 }
10663 /*
10664 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10665 * and ChangeCipherSpec.
10666 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10667 * so assume it is permitted.
10668 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10669 * assume TLS 1.2 requirements.
10670 */
10671 if (record_length == 0 &&
10672 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10673 content_type == SSL_ID_ALERT ||
10674 content_type == SSL_ID_HANDSHAKE)) {
10675 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10676 "Zero-length %s fragments are not allowed",
10677 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10678 }
10679 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10680 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10681 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10682 }
10683 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10684 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10685 "TLSPlaintext length MUST NOT exceed 2^14");
10686 }
10687}
10688
10689static void
10690ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10691{
10692 /* store selected cipher suite for decryption */
10693 ssl->session.cipher = cipher;
10694
10695 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10696 if (!cs) {
10697 ssl->cipher_suite = NULL((void*)0);
10698 ssl->state &= ~SSL_CIPHER(1<<2);
10699 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10700 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10701 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10702 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10703 * to avoid a potential buffer overflow in ssl3_check_mac. */
10704 ssl->cipher_suite = NULL((void*)0);
10705 ssl->state &= ~SSL_CIPHER(1<<2);
10706 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10707 } else {
10708 /* Cipher found, save this for the delayed decoder init */
10709 ssl->cipher_suite = cs;
10710 ssl->state |= SSL_CIPHER(1<<2);
10711 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10712 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10713 ssl->state);
10714 }
10715}
10716/* }}} */
10717
10718
10719/* Client Hello and Server Hello dissections. {{{ */
10720static int
10721ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10722 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10723 SslSession *session, SslDecryptSession *ssl,
10724 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10725 ssl_master_key_map_t *mk_map);
10726int
10727// NOLINTNEXTLINE(misc-no-recursion)
10728ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10729 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10730 uint32_t offset_end, SslSession *session,
10731 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10732{
10733 /* struct {
10734 * ProtocolVersion client_version;
10735 * Random random;
10736 * SessionID session_id;
10737 * opaque cookie<0..32>; //new field for DTLS
10738 * CipherSuite cipher_suites<2..2^16-1>;
10739 * CompressionMethod compression_methods<1..2^8-1>;
10740 * Extension client_hello_extension_list<0..2^16-1>;
10741 * } ClientHello;
10742 */
10743 proto_item *ti;
10744 proto_tree *cs_tree;
10745 uint32_t client_version;
10746 uint32_t cipher_suite_length;
10747 uint32_t compression_methods_length;
10748 uint8_t compression_method;
10749 uint32_t next_offset;
10750 uint32_t initial_offset = offset;
10751 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10752 char *ja3_hash;
10753 char *ja3_dash = "";
10754 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10755 ja4_data_t ja4_data;
10756 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10757 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10758 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10759 wmem_list_frame_t *curr_entry;
10760
10761 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10761, (int64_t)initial_offset, (int64_t)offset_end))));
10762 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10763 offset = 0;
10764 offset_end = tvb_reported_length(hello_tvb);
10765
10766 ja4_data.max_version = 0;
10767 ja4_data.server_name_present = false0;
10768 ja4_data.num_cipher_suites = 0;
10769 ja4_data.num_extensions = 0;
10770 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10771 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10772 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10773 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10774
10775 /* show the client version */
10776 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10777 offset, 2, ENC_BIG_ENDIAN0x00000000,
10778 &client_version);
10779 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10780 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10781 }
10782 offset += 2;
10783 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10784
10785 /*
10786 * Is it version 1.3?
10787 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10788 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10789 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10790 * Hello".
10791 */
10792 if (dtls_hfs != NULL((void*)0)) {
10793 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10794 /* Don't do that. */
10795 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10796 }
10797 } else {
10798 if (client_version == TLSV1DOT3_VERSION0x304) {
10799 /* Don't do that. */
10800 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10801 }
10802 }
10803
10804 /* dissect fields that are present in both ClientHello and ServerHello */
10805 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10806
10807 /* fields specific for DTLS (cookie_len, cookie) */
10808 if (dtls_hfs != NULL((void*)0)) {
10809 uint32_t cookie_length;
10810 /* opaque cookie<0..32> (for DTLS only) */
10811 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10812 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10813 return offset;
10814 }
10815 offset++;
10816 if (cookie_length > 0) {
10817 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10818 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10819 offset += cookie_length;
10820 }
10821 }
10822
10823 /* CipherSuite cipher_suites<2..2^16-1> */
10824 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10825 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10826 return offset;
10827 }
10828 offset += 2;
10829 next_offset = offset + cipher_suite_length;
10830 ti = proto_tree_add_none_format(tree,
10831 hf->hf.hs_cipher_suites,
10832 hello_tvb, offset, cipher_suite_length,
10833 "Cipher Suites (%d suite%s)",
10834 cipher_suite_length / 2,
10835 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10836 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10837 while (offset + 2 <= next_offset) {
10838 uint32_t cipher_suite;
10839
10840 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10841 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10842 offset += 2;
10843 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10844 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10845 ja3_dash = "-";
10846 ja4_data.num_cipher_suites += 1;
10847 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10848 }
10849 }
10850 wmem_strbuf_append_c(ja3, ',');
10851 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10852 offset = next_offset;
10853 }
10854
10855 /* CompressionMethod compression_methods<1..2^8-1> */
10856 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10857 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10858 return offset;
10859 }
10860 offset++;
10861 next_offset = offset + compression_methods_length;
10862 ti = proto_tree_add_none_format(tree,
10863 hf->hf.hs_comp_methods,
10864 hello_tvb, offset, compression_methods_length,
10865 "Compression Methods (%u method%s)",
10866 compression_methods_length,
10867 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10868 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10869 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10870 while (offset < next_offset) {
10871 compression_method = tvb_get_uint8(hello_tvb, offset);
10872 /* TODO: make reserved/private comp meth. fields selectable */
10873 if (compression_method < 64)
10874 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10875 hello_tvb, offset, 1, compression_method);
10876 else if (compression_method > 63 && compression_method < 193)
10877 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10878 compression_method, "Reserved - to be assigned by IANA (%u)",
10879 compression_method);
10880 else
10881 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10882 compression_method, "Private use range (%u)",
10883 compression_method);
10884 offset++;
10885 }
10886
10887 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10888 if (offset < offset_end) {
10889 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10890 offset_end, SSL_HND_CLIENT_HELLO,
10891 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10892 if (ja4_data.max_version > 0) {
10893 client_version = ja4_data.max_version;
10894 }
10895 } else {
10896 wmem_strbuf_append_printf(ja3, ",,");
10897 }
10898
10899 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10900 wmem_strbuf_append(ja4_a, "t");
10901 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10902 wmem_strbuf_append(ja4_a, "q");
10903 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10904 wmem_strbuf_append(ja4_a, "d");
10905 }
10906 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10907 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10908 if (ja4_data.num_cipher_suites > 99) {
10909 wmem_strbuf_append(ja4_a, "99");
10910 } else {
10911 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10912 }
10913 if (ja4_data.num_extensions > 99) {
10914 wmem_strbuf_append(ja4_a, "99");
10915 } else {
10916 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10917 }
10918 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10919 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10920 } else {
10921 wmem_strbuf_append(ja4_a, "00");
10922 }
10923
10924 curr_entry = wmem_list_head(ja4_data.cipher_list);
10925 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10926 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10927 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10928 wmem_strbuf_append(ja4_br, ",");
10929 }
10930 curr_entry = wmem_list_frame_next(curr_entry);
10931 }
10932
10933 curr_entry = wmem_list_head(ja4_data.extension_list);
10934 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10935 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10936 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10937 wmem_strbuf_append(ja4_cr, ",");
10938 }
10939 curr_entry = wmem_list_frame_next(curr_entry);
10940 }
10941
10942 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10943 wmem_strbuf_append(ja4_cr, "_");
10944 curr_entry = wmem_list_head(ja4_data.sighash_list);
10945 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10946 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10947 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10948 wmem_strbuf_append(ja4_cr, ",");
10949 }
10950 curr_entry = wmem_list_frame_next(curr_entry);
10951 }
10952 }
10953 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10954 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10955 } else {
10956 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10957 }
10958 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10959
10960 g_free(ja4_hash);
10961 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10962 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10963 } else {
10964 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10965 }
10966 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10967 g_free(ja4_hash);
10968
10969 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10970 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10971
10972 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10973 proto_item_set_generated(ti);
10974 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10975 proto_item_set_generated(ti);
10976
10977 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10978 wmem_strbuf_get_len(ja3));
10979 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10980 proto_item_set_generated(ti);
10981 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10982 proto_item_set_generated(ti);
10983 g_free(ja3_hash);
10984 return initial_offset + offset;
10985}
10986
10987void
10988ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10989 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10990 SslSession *session, SslDecryptSession *ssl,
10991 bool_Bool is_dtls, bool_Bool is_hrr)
10992{
10993 /* struct {
10994 * ProtocolVersion server_version;
10995 * Random random;
10996 * SessionID session_id; // TLS 1.2 and before
10997 * CipherSuite cipher_suite;
10998 * CompressionMethod compression_method; // TLS 1.2 and before
10999 * Extension server_hello_extension_list<0..2^16-1>;
11000 * } ServerHello;
11001 */
11002 uint8_t draft_version = session->tls13_draft_version;
11003 proto_item *ti;
11004 uint32_t server_version;
11005 uint32_t cipher_suite;
11006 uint32_t initial_offset = offset;
11007 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
11008 char *ja3_hash;
11009
11010 col_set_str(pinfo->cinfo, COL_PROTOCOL,
11011 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
11012
11013 /* Initially assume that the session is resumed. If this is not the case, a
11014 * ServerHelloDone will be observed before the ChangeCipherSpec message
11015 * which will reset this flag. */
11016 session->is_session_resumed = true1;
11017
11018 /* show the server version */
11019 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11020 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
11021
11022 uint16_t supported_server_version;
11023 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
11024 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
11025 }
11026 /*
11027 * Is it version 1.3?
11028 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
11029 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
11030 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
11031 * Hello".
11032 */
11033 if (is_dtls) {
11034 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
11035 /* Don't do that. */
11036 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
11037 }
11038 } else {
11039 if (server_version == TLSV1DOT3_VERSION0x304) {
11040 /* Don't do that. */
11041 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
11042 }
11043 }
11044
11045 offset += 2;
11046 wmem_strbuf_append_printf(ja3, "%i", server_version);
11047
11048 /* dissect fields that are present in both ClientHello and ServerHello */
11049 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
11050
11051 if (ssl) {
11052 /* store selected cipher suite for decryption */
11053 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
11054 }
11055
11056 /* now the server-selected cipher suite */
11057 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
11058 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
11059 offset += 2;
11060 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
11061
11062 /* No compression with TLS 1.3 before draft -22 */
11063 if (!(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
11064 if (ssl) {
11065 /* store selected compression method for decryption */
11066 ssl->session.compression = tvb_get_uint8(tvb, offset);
11067 }
11068 /* and the server-selected compression method */
11069 proto_tree_add_item(tree, hf->hf.hs_comp_method,
11070 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11071 offset++;
11072 }
11073
11074 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
11075 if (offset < offset_end) {
11076 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11077 offset_end,
11078 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
11079 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
11080 }
11081
11082 if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
11083 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
11084 if (hash_algo) {
11085 SSL_MDgcry_md_hd_t mc;
11086 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
11087 unsigned char prk[DIGEST_MAX_SIZE48];
11088 unsigned char *ech_verify_out = NULL((void*)0);
11089 unsigned int len;
11090 ssl_md_init(&mc, hash_algo);
11091 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
11092 if (is_hrr) {
11093 ssl_md_final(&mc, transcript_hash, &len);
11094 ssl_md_cleanup(&mc);
11095 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
11096 ssl->ech_transcript.data_len = 4 + len;
11097 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
11098 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
11099 ssl->ech_transcript.data[1] = 0;
11100 ssl->ech_transcript.data[2] = 0;
11101 ssl->ech_transcript.data[3] = len;
11102 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
11103 ssl_md_init(&mc, hash_algo);
11104 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
11105 } else {
11106 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
11107 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
11108 }
11109 if (initial_offset > 4) {
11110 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
11111 4 + offset_end - initial_offset);
11112 if (is_hrr)
11113 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 38), 38);
11114 else
11115 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 30), 30);
11116 } else {
11117 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
11118 prefix[2] = ((offset - initial_offset) >> 8);
11119 prefix[3] = (offset - initial_offset) & 0xff;
11120 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
11121 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
11122 offset_end - initial_offset);
11123 ssl_md_update(&mc, prefix, 4);
11124 if (is_hrr)
11125 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 34), 34);
11126 else
11127 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 26), 26);
11128 }
11129 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
11130 uint8_t zeros[8] = { 0 };
11131 uint32_t confirmation_offset = initial_offset + 26;
11132 if (is_hrr) {
11133 uint32_t hrr_offset = initial_offset + 34;
11134 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset,
11135 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
11136 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
11137 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 3), 3);
11138 hrr_offset += 3;
11139 uint32_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
11140 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 2), 2);
11141 hrr_offset += 2;
11142 while (extensions_end - hrr_offset >= 4) {
11143 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
11144 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
11145 confirmation_offset = hrr_offset + 4;
11146 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 4), 4);
11147 ssl_md_update(&mc, zeros, 8);
11148 hrr_offset += 12;
11149 } else {
11150 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
11151 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
11152 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
11153 }
11154 }
11155 } else {
11156 ssl_md_update(&mc, zeros, 8);
11157 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
11158 offset - initial_offset - 34);
11159 }
11160 ssl_md_final(&mc, transcript_hash, &len);
11161 ssl_md_cleanup(&mc);
11162 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
11163 StringInfo prk_string = {prk, len};
11164 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
11165 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
11166 transcript_hash, len, 8, &ech_verify_out)) {
11167 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
11168 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
11169 if (is_hrr) {
11170 ssl->session.hrr_ech_declined = true1;
11171 ssl->session.first_ch_ech_frame = 0;
11172 }
11173 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
11174 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
11175 }
11176 wmem_free(NULL((void*)0), ech_verify_out);
11177 }
11178 ssl->session.ech = true1;
11179 }
11180 }
11181
11182 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
11183 wmem_strbuf_get_len(ja3));
11184 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
11185 proto_item_set_generated(ti);
11186 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
11187 proto_item_set_generated(ti);
11188 g_free(ja3_hash);
11189}
11190/* Client Hello and Server Hello dissections. }}} */
11191
11192/* New Session Ticket dissection. {{{ */
11193void
11194ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11195 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11196 SslSession *session, SslDecryptSession *ssl,
11197 bool_Bool is_dtls, GHashTable *session_hash)
11198{
11199 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
11200 * struct {
11201 * uint32 ticket_lifetime_hint;
11202 * opaque ticket<0..2^16-1>;
11203 * } NewSessionTicket;
11204 *
11205 * RFC 8446 Section 4.6.1 (TLS 1.3):
11206 * struct {
11207 * uint32 ticket_lifetime;
11208 * uint32 ticket_age_add;
11209 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
11210 * opaque ticket<1..2^16-1>;
11211 * Extension extensions<0..2^16-2>;
11212 * } NewSessionTicket;
11213 */
11214 proto_tree *subtree;
11215 proto_item *subitem;
11216 uint32_t ticket_len;
11217 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
11218 unsigned char draft_version = session->tls13_draft_version;
11219 uint32_t lifetime_hint;
11220
11221 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11222 hf->ett.session_ticket, NULL((void*)0),
11223 "TLS Session Ticket");
11224
11225 /* ticket lifetime hint */
11226 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
11227 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
11228 offset += 4;
11229
11230 if (lifetime_hint >= 60) {
11231 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
11232 proto_item_append_text(subitem, " (%s)", time_str);
11233 }
11234
11235 if (is_tls13) {
11236
11237 /* for TLS 1.3: ticket_age_add */
11238 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
11239 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
11240 offset += 4;
11241
11242 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
11243 if (draft_version == 0 || draft_version >= 21) {
11244 uint32_t ticket_nonce_len;
11245
11246 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
11247 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
11248 return;
11249 }
11250 offset++;
11251
11252 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
11253 offset += ticket_nonce_len;
11254 }
11255
11256 }
11257
11258 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
11259 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
11260 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
11261 return;
11262 }
11263 offset += 2;
11264
11265 /* Content depends on implementation, so just show data! */
11266 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
11267 tvb, offset, ticket_len, ENC_NA0x00000000);
11268 /* save the session ticket to cache for ssl_finalize_decryption */
11269 if (ssl && !is_tls13) {
11270 if (ssl->session.is_session_resumed) {
11271 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
11272 * (Abbreviated Handshake Using New Session Ticket).
11273 * Restore the master key for this session ticket before saving
11274 * it to the new session ticket. */
11275 ssl_restore_master_key(ssl, "Session Ticket", false0,
11276 session_hash, &ssl->session_ticket);
11277 }
11278 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
11279 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
11280 ssl->session_ticket.data, ticket_len);
11281 ssl->session_ticket.data_len = ticket_len;
11282 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
11283 /* NewSessionTicket is received after the first (client)
11284 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
11285 * Since the second CCS has already the session key available it will
11286 * just return. To ensure that the session ticket is mapped to a
11287 * master key (from the first CCS), save the ticket here too. */
11288 ssl_save_master_key("Session Ticket", session_hash,
11289 &ssl->session_ticket, &ssl->master_secret);
11290 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
11291 }
11292 offset += ticket_len;
11293
11294 if (is_tls13) {
11295 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11296 offset_end, SSL_HND_NEWSESSION_TICKET,
11297 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11298 }
11299} /* }}} */
11300
11301void
11302ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11303 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11304 SslSession *session, SslDecryptSession *ssl,
11305 bool_Bool is_dtls)
11306{
11307 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
11308 * struct {
11309 * ProtocolVersion server_version;
11310 * CipherSuite cipher_suite; // not before draft -19
11311 * Extension extensions<2..2^16-1>;
11312 * } HelloRetryRequest;
11313 * Note: no longer used since draft -22
11314 */
11315 uint32_t version;
11316 uint8_t draft_version;
11317
11318 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11319 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
11320 draft_version = extract_tls13_draft_version(version);
11321 offset += 2;
11322
11323 if (draft_version == 0 || draft_version >= 19) {
11324 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
11325 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11326 offset += 2;
11327 }
11328
11329 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11330 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11331 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11332}
11333
11334void
11335ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11336 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11337 SslSession *session, SslDecryptSession *ssl,
11338 bool_Bool is_dtls)
11339{
11340 /* RFC 8446 Section 4.3.1
11341 * struct {
11342 * Extension extensions<0..2^16-1>;
11343 * } EncryptedExtensions;
11344 */
11345 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11346 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11347 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11348}
11349
11350/* Certificate and Certificate Request dissections. {{{ */
11351void
11352ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11353 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11354 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11355 bool_Bool is_from_server, bool_Bool is_dtls)
11356{
11357 /* opaque ASN.1Cert<1..2^24-1>;
11358 *
11359 * Before RFC 8446 (TLS <= 1.2):
11360 * struct {
11361 * select(certificate_type) {
11362 *
11363 * // certificate type defined in RFC 7250
11364 * case RawPublicKey:
11365 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11366 *
11367 * // X.509 certificate defined in RFC 5246
11368 * case X.509:
11369 * ASN.1Cert certificate_list<0..2^24-1>;
11370 * };
11371 * } Certificate;
11372 *
11373 * RFC 8446 (since draft -20):
11374 * struct {
11375 * select(certificate_type){
11376 * case RawPublicKey:
11377 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11378 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11379 *
11380 * case X.509:
11381 * opaque cert_data<1..2^24-1>;
11382 * }
11383 * Extension extensions<0..2^16-1>;
11384 * } CertificateEntry;
11385 * struct {
11386 * opaque certificate_request_context<0..2^8-1>;
11387 * CertificateEntry certificate_list<0..2^24-1>;
11388 * } Certificate;
11389 */
11390 enum { CERT_X509, CERT_RPK } cert_type;
11391 asn1_ctx_t asn1_ctx;
11392#if defined(HAVE_LIBGNUTLS1)
11393 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11394 unsigned certificate_index = 0;
11395#endif
11396 uint32_t next_offset, certificate_list_length, cert_length;
11397 proto_tree *subtree = tree;
11398
11399 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11400
11401 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11402 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11403 cert_type = CERT_RPK;
11404 } else {
11405 cert_type = CERT_X509;
11406 }
11407
11408#if defined(HAVE_LIBGNUTLS1)
11409 /* Ask the pkcs1 dissector to return the public key details */
11410 if (ssl)
11411 asn1_ctx.private_data = &subjectPublicKeyInfo;
11412#endif
11413
11414 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11415 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11416 uint32_t context_length;
11417 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11418 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11419 return;
11420 }
11421 offset++;
11422 if (context_length > 0) {
11423 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11424 tvb, offset, context_length, ENC_NA0x00000000);
11425 offset += context_length;
11426 }
11427 }
11428
11429 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11430 /* For RPK before TLS 1.3, the single RPK is stored directly without
11431 * another "certificate_list" field. */
11432 certificate_list_length = offset_end - offset;
11433 next_offset = offset_end;
11434 } else {
11435 /* CertificateEntry certificate_list<0..2^24-1> */
11436 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11437 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11438 return;
11439 }
11440 offset += 3; /* 24-bit length value */
11441 next_offset = offset + certificate_list_length;
11442 }
11443
11444 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11445 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11446 proto_item *ti;
11447
11448 ti = proto_tree_add_none_format(tree,
11449 hf->hf.hs_certificates,
11450 tvb, offset, certificate_list_length,
11451 "Certificates (%u bytes)",
11452 certificate_list_length);
11453
11454 /* make it a subtree */
11455 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11456 }
11457
11458 while (offset < next_offset) {
11459 switch (cert_type) {
11460 case CERT_RPK:
11461 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11462 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11463 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11464 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11465 return;
11466 }
11467 offset += 3;
11468
11469 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11470 offset += cert_length;
11471 break;
11472 case CERT_X509:
11473 /* opaque ASN1Cert<1..2^24-1> */
11474 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11475 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11476 return;
11477 }
11478 offset += 3;
11479
11480 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11481#if defined(HAVE_LIBGNUTLS1)
11482 if (is_from_server && ssl && certificate_index == 0) {
11483 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11484 /* Only attempt to get the RSA modulus for the first cert. */
11485 asn1_ctx.private_data = NULL((void*)0);
11486 }
11487#endif
11488 offset += cert_length;
11489 break;
11490 }
11491
11492 /* TLS 1.3: Extension extensions<0..2^16-1> */
11493 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11494 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11495 next_offset, SSL_HND_CERTIFICATE,
11496 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11497 }
11498
11499#if defined(HAVE_LIBGNUTLS1)
11500 certificate_index++;
11501#endif
11502 }
11503}
11504
11505void
11506ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11507 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11508 SslSession *session, bool_Bool is_dtls)
11509{
11510 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11511 * enum {
11512 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11513 * (255)
11514 * } ClientCertificateType;
11515 *
11516 * opaque DistinguishedName<1..2^16-1>;
11517 *
11518 * struct {
11519 * ClientCertificateType certificate_types<1..2^8-1>;
11520 * DistinguishedName certificate_authorities<3..2^16-1>;
11521 * } CertificateRequest;
11522 *
11523 *
11524 * As per TLSv1.2 (RFC 5246) the format has changed to:
11525 *
11526 * enum {
11527 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11528 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11529 * fortezza_dms_RESERVED(20), (255)
11530 * } ClientCertificateType;
11531 *
11532 * enum {
11533 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11534 * sha512(6), (255)
11535 * } HashAlgorithm;
11536 *
11537 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11538 * SignatureAlgorithm;
11539 *
11540 * struct {
11541 * HashAlgorithm hash;
11542 * SignatureAlgorithm signature;
11543 * } SignatureAndHashAlgorithm;
11544 *
11545 * SignatureAndHashAlgorithm
11546 * supported_signature_algorithms<2..2^16-2>;
11547 *
11548 * opaque DistinguishedName<1..2^16-1>;
11549 *
11550 * struct {
11551 * ClientCertificateType certificate_types<1..2^8-1>;
11552 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11553 * DistinguishedName certificate_authorities<0..2^16-1>;
11554 * } CertificateRequest;
11555 *
11556 * draft-ietf-tls-tls13-18:
11557 * struct {
11558 * opaque certificate_request_context<0..2^8-1>;
11559 * SignatureScheme
11560 * supported_signature_algorithms<2..2^16-2>;
11561 * DistinguishedName certificate_authorities<0..2^16-1>;
11562 * CertificateExtension certificate_extensions<0..2^16-1>;
11563 * } CertificateRequest;
11564 *
11565 * RFC 8446 (since draft-ietf-tls-tls13-19):
11566 *
11567 * struct {
11568 * opaque certificate_request_context<0..2^8-1>;
11569 * Extension extensions<2..2^16-1>;
11570 * } CertificateRequest;
11571 */
11572 proto_item *ti;
11573 proto_tree *subtree;
11574 uint32_t next_offset;
11575 asn1_ctx_t asn1_ctx;
11576 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11577 unsigned char draft_version = session->tls13_draft_version;
11578
11579 if (!tree)
11580 return;
11581
11582 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11583
11584 if (is_tls13) {
11585 uint32_t context_length;
11586 /* opaque certificate_request_context<0..2^8-1> */
11587 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11588 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11589 return;
11590 }
11591 offset++;
11592 if (context_length > 0) {
11593 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11594 tvb, offset, context_length, ENC_NA0x00000000);
11595 offset += context_length;
11596 }
11597 } else {
11598 uint32_t cert_types_count;
11599 /* ClientCertificateType certificate_types<1..2^8-1> */
11600 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11601 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11602 return;
11603 }
11604 offset++;
11605 next_offset = offset + cert_types_count;
11606
11607 ti = proto_tree_add_none_format(tree,
11608 hf->hf.hs_cert_types,
11609 tvb, offset, cert_types_count,
11610 "Certificate types (%u type%s)",
11611 cert_types_count,
11612 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11613 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11614
11615 while (offset < next_offset) {
11616 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11617 offset++;
11618 }
11619 }
11620
11621 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11622 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11623 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11624 }
11625
11626 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11627 /*
11628 * TLS 1.3 draft 19 and newer: Extensions.
11629 * SslDecryptSession pointer is NULL because Certificate Extensions
11630 * should not influence decryption state.
11631 */
11632 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11633 offset_end, SSL_HND_CERT_REQUEST,
11634 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11635 } else if (is_tls13 && draft_version <= 18) {
11636 /*
11637 * TLS 1.3 draft 18 and older: certificate_authorities and
11638 * certificate_extensions (a vector of OID mappings).
11639 */
11640 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11641 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11642 } else {
11643 /* for TLS 1.2 and older, the certificate_authorities field. */
11644 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11645 }
11646}
11647/* Certificate and Certificate Request dissections. }}} */
11648
11649void
11650ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11651 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11652{
11653 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11654 hf->hf.hs_client_cert_vrfy_sig_len,
11655 hf->hf.hs_client_cert_vrfy_sig);
11656}
11657
11658/* Finished dissection. {{{ */
11659void
11660ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11661 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11662 const SslSession *session, ssl_hfs_t *ssl_hfs)
11663{
11664 /* For SSLv3:
11665 * struct {
11666 * opaque md5_hash[16];
11667 * opaque sha_hash[20];
11668 * } Finished;
11669 *
11670 * For (D)TLS:
11671 * struct {
11672 * opaque verify_data[12];
11673 * } Finished;
11674 *
11675 * For TLS 1.3:
11676 * struct {
11677 * opaque verify_data[Hash.length];
11678 * }
11679 */
11680 if (!tree)
11681 return;
11682
11683 if (session->version == SSLV3_VERSION0x300) {
11684 if (ssl_hfs != NULL((void*)0)) {
11685 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11686 tvb, offset, 16, ENC_NA0x00000000);
11687 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11688 tvb, offset + 16, 20, ENC_NA0x00000000);
11689 }
11690 } else {
11691 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11692 proto_tree_add_item(tree, hf->hf.hs_finished,
11693 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11694 }
11695} /* }}} */
11696
11697/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11698void
11699ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11700{
11701 uint16_t url_hash_len;
11702
11703 /* enum {
11704 * individual_certs(0), pkipath(1), (255)
11705 * } CertChainType;
11706 *
11707 * struct {
11708 * CertChainType type;
11709 * URLAndHash url_and_hash_list<1..2^16-1>;
11710 * } CertificateURL;
11711 *
11712 * struct {
11713 * opaque url<1..2^16-1>;
11714 * uint8 padding;
11715 * opaque SHA1Hash[20];
11716 * } URLAndHash;
11717 */
11718
11719 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11720 tvb, offset, 1, ENC_NA0x00000000);
11721 offset++;
11722
11723 url_hash_len = tvb_get_ntohs(tvb, offset);
11724 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11725 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11726 offset += 2;
11727 while (url_hash_len-- > 0) {
11728 proto_item *urlhash_item;
11729 proto_tree *urlhash_tree;
11730 uint16_t url_len;
11731
11732 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11733 tvb, offset, -1, ENC_NA0x00000000);
11734 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11735
11736 url_len = tvb_get_ntohs(tvb, offset);
11737 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11738 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11739 offset += 2;
11740
11741 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11742 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11743 offset += url_len;
11744
11745 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11746 tvb, offset, 1, ENC_NA0x00000000);
11747 offset++;
11748 /* Note: RFC 6066 says that padding must be 0x01 */
11749
11750 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11751 tvb, offset, 20, ENC_NA0x00000000);
11752 offset += 20;
11753 }
11754} /* }}} */
11755
11756void
11757ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11758 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11759 SslSession *session, SslDecryptSession *ssl,
11760 bool_Bool is_from_server, bool_Bool is_dtls)
11761{
11762 uint32_t algorithm, uncompressed_length;
11763 uint32_t compressed_certificate_message_length;
11764 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11765 proto_item *ti;
11766 /*
11767 * enum {
11768 * zlib(1),
11769 * brotli(2),
11770 * zstd(3),
11771 * (65535)
11772 * } CertificateCompressionAlgorithm;
11773 *
11774 * struct {
11775 * CertificateCompressionAlgorithm algorithm;
11776 * uint24 uncompressed_length;
11777 * opaque compressed_certificate_message<1..2^24-1>;
11778 * } CompressedCertificate;
11779 */
11780
11781 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11782 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11783 offset += 2;
11784
11785 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11786 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11787 offset += 3;
11788
11789 /* opaque compressed_certificate_message<1..2^24-1>; */
11790 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11791 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11792 return;
11793 }
11794 offset += 3;
11795
11796 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11797 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11798
11799 /* Certificate decompression following algorithm */
11800 switch (algorithm) {
11801 case 1: /* zlib */
11802 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11803 break;
11804 case 2: /* brotli */
11805 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11806 break;
11807 case 3: /* zstd */
11808 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11809 break;
11810 }
11811
11812 if (uncompressed_tvb) {
11813 proto_tree *uncompressed_tree;
11814
11815 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11816 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11817 tvb, offset, offset_end - offset,
11818 "Invalid uncompressed length %u (expected %u)",
11819 tvb_captured_length(uncompressed_tvb),
11820 uncompressed_length);
11821 } else {
11822 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11823 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11824 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11825 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11826 }
11827 }
11828}
11829
11830/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11831static int
11832// NOLINTNEXTLINE(misc-no-recursion)
11833ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11834 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11835 SslSession *session, SslDecryptSession *ssl,
11836 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11837 ssl_master_key_map_t *mk_map)
11838{
11839 uint32_t exts_len;
11840 uint16_t ext_type;
11841 uint32_t ext_len;
11842 uint32_t next_offset;
11843 proto_item *ext_item;
11844 proto_tree *ext_tree;
11845 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11846 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11847 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11848 char *ja3_dash = "";
11849 unsigned supported_version;
11850
11851 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11852 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11853 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11854 return offset_end;
11855 }
11856 offset += 2;
11857 offset_end = offset + exts_len;
11858
11859 if (ja4_data) {
11860 ja4_data->num_extensions = 0;
11861 }
11862 while (offset_end - offset >= 4)
11863 {
11864 ext_type = tvb_get_ntohs(tvb, offset);
11865 ext_len = tvb_get_ntohs(tvb, offset + 2);
11866
11867 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11868 ja4_data->num_extensions += 1;
11869 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11870 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11871 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11872 }
11873 }
11874
11875 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11876 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11877 tls_hello_extension_types,
11878 "Unknown type %u"), ext_len);
11879 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11880
11881 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11882 tvb, offset, 2, ext_type);
11883 offset += 2;
11884 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11885 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11886 ja3_dash = "-";
11887 }
11888
11889 /* opaque extension_data<0..2^16-1> */
11890 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11891 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11892 return offset_end;
11893 }
11894 offset += 2;
11895 next_offset = offset + ext_len;
11896
11897 switch (ext_type) {
11898 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11899 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11900 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11901 if (ja4_data) {
11902 ja4_data->server_name_present = true1;
11903 }
11904 }
11905 break;
11906 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11907 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11908 offset += 1;
11909 break;
11910 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11911 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11912 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11913 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11914 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11915 }
11916 break;
11917 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11918 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11919 offset, next_offset,
11920 hnd_type, ext_type,
11921 session);
11922 break;
11923 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11924 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11925 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11926 next_offset, ja3_sg);
11927 } else {
11928 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11929 next_offset, NULL((void*)0));
11930 }
11931 break;
11932 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11933 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11934 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11935 } else {
11936 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11937 }
11938 break;
11939 break;
11940 case SSL_HND_HELLO_EXT_SRP12:
11941 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11942 break;
11943 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11944 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11945 break;
11946 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11947 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11948 break;
11949 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11950 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11951 break;
11952 case SSL_HND_HELLO_EXT_USE_SRTP14:
11953 if (is_dtls) {
11954 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11955 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11956 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11957 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11958 }
11959 } else {
11960 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11961 }
11962 break;
11963 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11964 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11965 break;
11966 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11967 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11968 break;
11969 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11970 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11971 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11972 offset++;
11973 break;
11974 case SSL_HND_HELLO_EXT_ALPN16:
11975 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11976 break;
11977 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11978 if (hnd_type == SSL_HND_CLIENT_HELLO)
11979 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11980 break;
11981 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11982 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11983 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11984 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11985 break;
11986 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11987 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11988 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11989 offset, next_offset,
11990 hnd_type, ext_type,
11991 session);
11992 break;
11993 case SSL_HND_HELLO_EXT_PADDING21:
11994 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11995 offset += ext_len;
11996 break;
11997 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11998 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11999 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
12000 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
12001 }
12002 break;
12003 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
12004 if (ssl) {
12005 switch (hnd_type) {
12006 case SSL_HND_CLIENT_HELLO:
12007 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
12008 break;
12009 case SSL_HND_SERVER_HELLO:
12010 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
12011 break;
12012 default: /* no default */
12013 break;
12014 }
12015 }
12016 break;
12017 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
12018 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
12019 break;
12020 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
12021 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
12022 break;
12023 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
12024 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
12025 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12026 offset += 2;
12027 break;
12028 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
12029 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
12030 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
12031 break;
12032 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
12033 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
12034 break;
12035 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
12036 case SSL_HND_HELLO_EXT_KEY_SHARE51:
12037 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
12038 break;
12039 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
12040 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
12041 break;
12042 case SSL_HND_HELLO_EXT_EARLY_DATA42:
12043 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
12044 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
12045 break;
12046 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
12047 switch (hnd_type) {
12048 case SSL_HND_CLIENT_HELLO:
12049 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
12050 break;
12051 case SSL_HND_SERVER_HELLO:
12052 case SSL_HND_HELLO_RETRY_REQUEST:
12053 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
12054 offset += 2;
12055 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
12056 break;
12057 }
12058 break;
12059 case SSL_HND_HELLO_EXT_COOKIE44:
12060 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
12061 break;
12062 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
12063 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
12064 break;
12065 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
12066 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
12067 break;
12068 case SSL_HND_HELLO_EXT_OID_FILTERS48:
12069 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
12070 break;
12071 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
12072 break;
12073 case SSL_HND_HELLO_EXT_NPN13172:
12074 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
12075 break;
12076 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
12077 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
12078 break;
12079 case SSL_HND_HELLO_EXT_ALPS17613:
12080 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
12081 break;
12082 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
12083 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
12084 break;
12085 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
12086 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
12087 break;
12088 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
12089 session->deprecated_cid = true1;
12090 /* FALLTHRU */
12091 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
12092 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
12093 break;
12094 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
12095 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
12096 break;
12097 default:
12098 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
12099 tvb, offset, ext_len, ENC_NA0x00000000);
12100 offset += ext_len;
12101 break;
12102 }
12103
12104 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
12105 /* Dissection did not end at expected location, fix it. */
12106 offset = next_offset;
12107 }
12108 }
12109
12110 if (ja3) {
12111 if (hnd_type == SSL_HND_CLIENT_HELLO) {
12112 if(wmem_strbuf_get_len(ja3_sg) > 0) {
12113 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
12114 } else {
12115 wmem_strbuf_append_c(ja3, ',');
12116 }
12117 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
12118 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
12119 } else {
12120 wmem_strbuf_append_c(ja3, ',');
12121 }
12122 }
12123 }
12124
12125 /* Check if Extensions vector is correctly terminated. */
12126 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
12127 offset = offset_end;
12128 }
12129
12130 return offset;
12131} /* }}} */
12132
12133
12134/* ClientKeyExchange algo-specific dissectors. {{{ */
12135
12136static void
12137dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12138 proto_tree *tree, uint32_t offset,
12139 uint32_t length)
12140{
12141 int point_len;
12142 proto_tree *ssl_ecdh_tree;
12143
12144 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12145 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
12146
12147 /* point */
12148 point_len = tvb_get_uint8(tvb, offset);
12149 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
12150 offset, 1, ENC_BIG_ENDIAN0x00000000);
12151 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
12152 offset + 1, point_len, ENC_NA0x00000000);
12153}
12154
12155static void
12156dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12157 proto_tree *tree, uint32_t offset, uint32_t length)
12158{
12159 int yc_len;
12160 proto_tree *ssl_dh_tree;
12161
12162 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12163 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
12164
12165 /* ClientDiffieHellmanPublic.dh_public (explicit) */
12166 yc_len = tvb_get_ntohs(tvb, offset);
12167 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
12168 offset, 2, ENC_BIG_ENDIAN0x00000000);
12169 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
12170 offset + 2, yc_len, ENC_NA0x00000000);
12171}
12172
12173static void
12174dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12175 proto_tree *tree, uint32_t offset,
12176 uint32_t length, const SslSession *session)
12177{
12178 int epms_len;
12179 proto_tree *ssl_rsa_tree;
12180
12181 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12182 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
12183
12184 /* EncryptedPreMasterSecret.pre_master_secret */
12185 switch (session->version) {
12186 case SSLV2_VERSION0x0002:
12187 case SSLV3_VERSION0x300:
12188 case DTLSV1DOT0_OPENSSL_VERSION0x100:
12189 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
12190 * not present. The handshake contents represents the EPMS, see:
12191 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
12192 epms_len = length;
12193 break;
12194
12195 default:
12196 /* TLS and DTLS include vector length before EPMS */
12197 epms_len = tvb_get_ntohs(tvb, offset);
12198 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12199 offset, 2, ENC_BIG_ENDIAN0x00000000);
12200 offset += 2;
12201 break;
12202 }
12203 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
12204 offset, epms_len, ENC_NA0x00000000);
12205}
12206
12207/* Used in PSK cipher suites */
12208static uint32_t
12209dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12210 proto_tree *tree, uint32_t offset)
12211{
12212 unsigned identity_len;
12213 proto_tree *ssl_psk_tree;
12214
12215 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12216 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
12217 /* identity */
12218 identity_len = tvb_get_ntohs(tvb, offset);
12219 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
12220 offset, 2, ENC_BIG_ENDIAN0x00000000);
12221 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
12222 offset + 2, identity_len, ENC_NA0x00000000);
12223
12224 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
12225 return 2 + identity_len;
12226}
12227
12228/* Used in RSA PSK cipher suites */
12229static void
12230dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12231 proto_tree *tree, uint32_t offset,
12232 uint32_t length)
12233{
12234 int identity_len, epms_len;
12235 proto_tree *ssl_psk_tree;
12236
12237 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12238 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
12239
12240 /* identity */
12241 identity_len = tvb_get_ntohs(tvb, offset);
12242 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
12243 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12244 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
12245 tvb, offset + 2, identity_len, ENC_NA0x00000000);
12246 offset += 2 + identity_len;
12247
12248 /* Yc */
12249 epms_len = tvb_get_ntohs(tvb, offset);
12250 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12251 offset, 2, ENC_BIG_ENDIAN0x00000000);
12252 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
12253 offset + 2, epms_len, ENC_NA0x00000000);
12254}
12255
12256/* Used in Diffie-Hellman PSK cipher suites */
12257static void
12258dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12259 proto_tree *tree, uint32_t offset, uint32_t length)
12260{
12261 /*
12262 * struct {
12263 * select (KeyExchangeAlgorithm) {
12264 * case diffie_hellman_psk:
12265 * opaque psk_identity<0..2^16-1>;
12266 * ClientDiffieHellmanPublic public;
12267 * } exchange_keys;
12268 * } ClientKeyExchange;
12269 */
12270
12271 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12272 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
12273}
12274
12275/* Used in EC Diffie-Hellman PSK cipher suites */
12276static void
12277dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12278 proto_tree *tree, uint32_t offset, uint32_t length)
12279{
12280 /*
12281 * struct {
12282 * select (KeyExchangeAlgorithm) {
12283 * case ec_diffie_hellman_psk:
12284 * opaque psk_identity<0..2^16-1>;
12285 * ClientECDiffieHellmanPublic public;
12286 * } exchange_keys;
12287 * } ClientKeyExchange;
12288 */
12289
12290 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12291 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
12292}
12293
12294/* Used in EC J-PAKE cipher suites */
12295static void
12296dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12297 proto_tree *tree, uint32_t offset,
12298 uint32_t length)
12299{
12300 /*
12301 * struct {
12302 * ECPoint V;
12303 * opaque r<1..2^8-1>;
12304 * } ECSchnorrZKP;
12305 *
12306 * struct {
12307 * ECPoint X;
12308 * ECSchnorrZKP zkp;
12309 * } ECJPAKEKeyKP;
12310 *
12311 * struct {
12312 * ECJPAKEKeyKP ecjpake_key_kp;
12313 * } ClientECJPAKEParams;
12314 *
12315 * select (KeyExchangeAlgorithm) {
12316 * case ecjpake:
12317 * ClientECJPAKEParams params;
12318 * } ClientKeyExchange;
12319 */
12320
12321 int point_len;
12322 proto_tree *ssl_ecjpake_tree;
12323
12324 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12325 hf->ett.keyex_params, NULL((void*)0),
12326 "EC J-PAKE Client Params");
12327
12328 /* ECJPAKEKeyKP.X */
12329 point_len = tvb_get_uint8(tvb, offset);
12330 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12331 offset, 1, ENC_BIG_ENDIAN0x00000000);
12332 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12333 offset + 1, point_len, ENC_NA0x00000000);
12334 offset += 1 + point_len;
12335
12336 /* ECJPAKEKeyKP.zkp.V */
12337 point_len = tvb_get_uint8(tvb, offset);
12338 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12339 offset, 1, ENC_BIG_ENDIAN0x00000000);
12340 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12341 offset + 1, point_len, ENC_NA0x00000000);
12342 offset += 1 + point_len;
12343
12344 /* ECJPAKEKeyKP.zkp.r */
12345 point_len = tvb_get_uint8(tvb, offset);
12346 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12347 offset, 1, ENC_BIG_ENDIAN0x00000000);
12348 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12349 offset + 1, point_len, ENC_NA0x00000000);
12350}
12351
12352static void
12353dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12354 proto_tree *tree, uint32_t offset,
12355 uint32_t length)
12356{
12357 int epms_len;
12358 proto_tree *ssl_ecc_sm2_tree;
12359
12360 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12361 hf->ett.keyex_params, NULL((void*)0),
12362 "ECC-SM2 Encrypted PreMaster Secret");
12363
12364 epms_len = tvb_get_ntohs(tvb, offset);
12365 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12366 offset, 2, ENC_BIG_ENDIAN0x00000000);
12367 offset += 2;
12368 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12369 offset, epms_len, ENC_NA0x00000000);
12370}
12371/* ClientKeyExchange algo-specific dissectors. }}} */
12372
12373
12374/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12375static uint32_t
12376ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12377 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12378 uint16_t version, int hf_sig_len, int hf_sig)
12379{
12380 uint32_t sig_len;
12381
12382 switch (version) {
12383 case TLSV1DOT2_VERSION0x303:
12384 case DTLSV1DOT2_VERSION0xfefd:
12385 case TLSV1DOT3_VERSION0x304:
12386 case DTLSV1DOT3_VERSION0xfefc:
12387 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12388 offset += 2;
12389 break;
12390
12391 default:
12392 break;
12393 }
12394
12395 /* Sig */
12396 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12397 hf_sig_len, 0, UINT16_MAX(65535))) {
12398 return offset_end;
12399 }
12400 offset += 2;
12401 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12402 offset += sig_len;
12403 return offset;
12404} /* }}} */
12405
12406/* ServerKeyExchange algo-specific dissectors. {{{ */
12407
12408/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12409static void
12410dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12411 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12412 uint16_t version)
12413{
12414 /*
12415 * TLSv1.2 (RFC 5246 sec 7.4.8)
12416 * struct {
12417 * digitally-signed struct {
12418 * opaque handshake_messages[handshake_messages_length];
12419 * }
12420 * } CertificateVerify;
12421 *
12422 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12423 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12424 *
12425 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12426 * does more hashing including the master secret and padding.
12427 */
12428 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12429 hf->hf.hs_server_keyex_sig_len,
12430 hf->hf.hs_server_keyex_sig);
12431}
12432
12433static uint32_t
12434dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12435{
12436 /*
12437 * RFC 4492 ECC cipher suites for TLS
12438 *
12439 * struct {
12440 * ECCurveType curve_type;
12441 * select (curve_type) {
12442 * case explicit_prime:
12443 * ...
12444 * case explicit_char2:
12445 * ...
12446 * case named_curve:
12447 * NamedCurve namedcurve;
12448 * };
12449 * } ECParameters;
12450 */
12451
12452 int curve_type;
12453
12454 /* ECParameters.curve_type */
12455 curve_type = tvb_get_uint8(tvb, offset);
12456 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12457 offset, 1, ENC_BIG_ENDIAN0x00000000);
12458 offset++;
12459
12460 if (curve_type != 3)
12461 return offset_end; /* only named_curves are supported */
12462
12463 /* case curve_type == named_curve; ECParameters.namedcurve */
12464 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12465 offset, 2, ENC_BIG_ENDIAN0x00000000);
12466 offset += 2;
12467
12468 return offset;
12469}
12470
12471static void
12472dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12473 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12474 uint16_t version, bool_Bool anon)
12475{
12476 /*
12477 * RFC 4492 ECC cipher suites for TLS
12478 *
12479 * struct {
12480 * opaque point <1..2^8-1>;
12481 * } ECPoint;
12482 *
12483 * struct {
12484 * ECParameters curve_params;
12485 * ECPoint public;
12486 * } ServerECDHParams;
12487 *
12488 * select (KeyExchangeAlgorithm) {
12489 * case ec_diffie_hellman:
12490 * ServerECDHParams params;
12491 * Signature signed_params;
12492 * } ServerKeyExchange;
12493 */
12494
12495 int point_len;
12496 proto_tree *ssl_ecdh_tree;
12497
12498 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12499 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12500
12501 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12502 if (offset >= offset_end)
12503 return; /* only named_curves are supported */
12504
12505 /* ECPoint.point */
12506 point_len = tvb_get_uint8(tvb, offset);
12507 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12508 offset, 1, ENC_BIG_ENDIAN0x00000000);
12509 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12510 offset + 1, point_len, ENC_NA0x00000000);
12511 offset += 1 + point_len;
12512
12513 /* Signature (if non-anonymous KEX) */
12514 if (!anon) {
12515 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12516 }
12517}
12518
12519static void
12520dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12521 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12522 uint16_t version, bool_Bool anon)
12523{
12524 int p_len, g_len, ys_len;
12525 proto_tree *ssl_dh_tree;
12526
12527 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12528 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12529
12530 /* p */
12531 p_len = tvb_get_ntohs(tvb, offset);
12532 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12533 offset, 2, ENC_BIG_ENDIAN0x00000000);
12534 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12535 offset + 2, p_len, ENC_NA0x00000000);
12536 offset += 2 + p_len;
12537
12538 /* g */
12539 g_len = tvb_get_ntohs(tvb, offset);
12540 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12541 offset, 2, ENC_BIG_ENDIAN0x00000000);
12542 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12543 offset + 2, g_len, ENC_NA0x00000000);
12544 offset += 2 + g_len;
12545
12546 /* Ys */
12547 ys_len = tvb_get_ntohs(tvb, offset);
12548 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12549 offset, 2, ys_len);
12550 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12551 offset + 2, ys_len, ENC_NA0x00000000);
12552 offset += 2 + ys_len;
12553
12554 /* Signature (if non-anonymous KEX) */
12555 if (!anon) {
12556 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12557 }
12558}
12559
12560/* Only used in RSA-EXPORT cipher suites */
12561static void
12562dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12563 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12564 uint16_t version)
12565{
12566 int modulus_len, exponent_len;
12567 proto_tree *ssl_rsa_tree;
12568
12569 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12570 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12571
12572 /* modulus */
12573 modulus_len = tvb_get_ntohs(tvb, offset);
12574 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12575 offset, 2, ENC_BIG_ENDIAN0x00000000);
12576 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12577 offset + 2, modulus_len, ENC_NA0x00000000);
12578 offset += 2 + modulus_len;
12579
12580 /* exponent */
12581 exponent_len = tvb_get_ntohs(tvb, offset);
12582 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12583 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12584 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12585 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12586 offset += 2 + exponent_len;
12587
12588 /* Signature */
12589 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12590}
12591
12592/* Used in RSA PSK and PSK cipher suites */
12593static uint32_t
12594dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12595 proto_tree *tree, uint32_t offset)
12596{
12597 unsigned hint_len;
12598 proto_tree *ssl_psk_tree;
12599
12600 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12601 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12602
12603 /* hint */
12604 hint_len = tvb_get_ntohs(tvb, offset);
12605 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12606 offset, 2, ENC_BIG_ENDIAN0x00000000);
12607 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12608 offset + 2, hint_len, ENC_NA0x00000000);
12609
12610 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12611 return 2 + hint_len;
12612}
12613
12614/* Used in Diffie-Hellman PSK cipher suites */
12615static void
12616dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12617 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12618{
12619 /*
12620 * struct {
12621 * select (KeyExchangeAlgorithm) {
12622 * case diffie_hellman_psk:
12623 * opaque psk_identity_hint<0..2^16-1>;
12624 * ServerDHParams params;
12625 * };
12626 * } ServerKeyExchange;
12627 */
12628
12629 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12630 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12631}
12632
12633/* Used in EC Diffie-Hellman PSK cipher suites */
12634static void
12635dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12636 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12637{
12638 /*
12639 * struct {
12640 * select (KeyExchangeAlgorithm) {
12641 * case ec_diffie_hellman_psk:
12642 * opaque psk_identity_hint<0..2^16-1>;
12643 * ServerECDHParams params;
12644 * };
12645 * } ServerKeyExchange;
12646 */
12647
12648 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12649 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12650}
12651
12652/* Used in EC J-PAKE cipher suites */
12653static void
12654dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12655 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12656{
12657 /*
12658 * struct {
12659 * ECPoint V;
12660 * opaque r<1..2^8-1>;
12661 * } ECSchnorrZKP;
12662 *
12663 * struct {
12664 * ECPoint X;
12665 * ECSchnorrZKP zkp;
12666 * } ECJPAKEKeyKP;
12667 *
12668 * struct {
12669 * ECParameters curve_params;
12670 * ECJPAKEKeyKP ecjpake_key_kp;
12671 * } ServerECJPAKEParams;
12672 *
12673 * select (KeyExchangeAlgorithm) {
12674 * case ecjpake:
12675 * ServerECJPAKEParams params;
12676 * } ServerKeyExchange;
12677 */
12678
12679 int point_len;
12680 proto_tree *ssl_ecjpake_tree;
12681
12682 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12683 hf->ett.keyex_params, NULL((void*)0),
12684 "EC J-PAKE Server Params");
12685
12686 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12687 if (offset >= offset_end)
12688 return; /* only named_curves are supported */
12689
12690 /* ECJPAKEKeyKP.X */
12691 point_len = tvb_get_uint8(tvb, offset);
12692 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12693 offset, 1, ENC_BIG_ENDIAN0x00000000);
12694 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12695 offset + 1, point_len, ENC_NA0x00000000);
12696 offset += 1 + point_len;
12697
12698 /* ECJPAKEKeyKP.zkp.V */
12699 point_len = tvb_get_uint8(tvb, offset);
12700 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12701 offset, 1, ENC_BIG_ENDIAN0x00000000);
12702 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12703 offset + 1, point_len, ENC_NA0x00000000);
12704 offset += 1 + point_len;
12705
12706 /* ECJPAKEKeyKP.zkp.r */
12707 point_len = tvb_get_uint8(tvb, offset);
12708 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12709 offset, 1, ENC_BIG_ENDIAN0x00000000);
12710 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12711 offset + 1, point_len, ENC_NA0x00000000);
12712}
12713
12714/* Only used in ECC-SM2-EXPORT cipher suites */
12715static void
12716dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12717 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12718 uint16_t version)
12719{
12720 proto_tree *ssl_ecc_sm2_tree;
12721
12722 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12723 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12724
12725 /* Signature */
12726 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12727}
12728/* ServerKeyExchange algo-specific dissectors. }}} */
12729
12730/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12731void
12732ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12733 proto_tree *tree, uint32_t offset, uint32_t length,
12734 const SslSession *session)
12735{
12736 switch (ssl_get_keyex_alg(session->cipher)) {
12737 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12738 case KEX_DH_DSS0x14:
12739 case KEX_DH_RSA0x15:
12740 case KEX_DHE_DSS0x10:
12741 case KEX_DHE_RSA0x12:
12742 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12743 break;
12744 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12745 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12746 break;
12747 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12748 case KEX_ECDH_ECDSA0x1a:
12749 case KEX_ECDH_RSA0x1b:
12750 case KEX_ECDHE_ECDSA0x16:
12751 case KEX_ECDHE_RSA0x18:
12752 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12753 break;
12754 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12755 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12756 break;
12757 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12758 /* XXX: implement support for KRB5 */
12759 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12760 tvb, offset, length,
12761 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12762 " developers if you want them to be supported");
12763 break;
12764 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12765 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12766 break;
12767 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12768 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12769 break;
12770 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12771 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12772 break;
12773 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12774 case KEX_SRP_SHA_DSS0x21:
12775 case KEX_SRP_SHA_RSA0x22:
12776 /* XXX: implement support for SRP_SHA* */
12777 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12778 tvb, offset, length,
12779 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12780 " developers if you want them to be supported");
12781 break;
12782 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12783 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12784 break;
12785 case KEX_ECC_SM20x26: /* GB/T 38636 */
12786 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12787 break;
12788 default:
12789 if (session->cipher == 0) {
12790 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12791 tvb, offset, length,
12792 "Cipher Suite not found");
12793 } else {
12794 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12795 tvb, offset, length,
12796 "Cipher Suite 0x%04x is not implemented, "
12797 "contact Wireshark developers if you want this to be supported",
12798 session->cipher);
12799 }
12800 break;
12801 }
12802}
12803
12804void
12805ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12806 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12807 const SslSession *session)
12808{
12809 switch (ssl_get_keyex_alg(session->cipher)) {
12810 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12811 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12812 break;
12813 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12814 case KEX_DH_RSA0x15:
12815 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12816 tvb, offset, offset_end - offset);
12817 break;
12818 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12819 case KEX_DHE_RSA0x12:
12820 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12821 break;
12822 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12823 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12824 break;
12825 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12826 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12827 break;
12828 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12829 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12830 break;
12831 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12832 case KEX_ECDH_RSA0x1b:
12833 case KEX_ECDHE_ECDSA0x16:
12834 case KEX_ECDHE_RSA0x18:
12835 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12836 break;
12837 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12838 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12839 tvb, offset, offset_end - offset);
12840 break;
12841 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12842 case KEX_RSA_PSK0x1f:
12843 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12844 break;
12845 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12846 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12847 break;
12848 case KEX_ECC_SM20x26: /* GB/T 38636 */
12849 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12850 break;
12851 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12852 case KEX_SRP_SHA_DSS0x21:
12853 case KEX_SRP_SHA_RSA0x22:
12854 /* XXX: implement support for SRP_SHA* */
12855 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12856 tvb, offset, offset_end - offset,
12857 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12858 " developers if you want them to be supported");
12859 break;
12860 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12861 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12862 break;
12863 default:
12864 if (session->cipher == 0) {
12865 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12866 tvb, offset, offset_end - offset,
12867 "Cipher Suite not found");
12868 } else {
12869 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12870 tvb, offset, offset_end - offset,
12871 "Cipher Suite 0x%04x is not implemented, "
12872 "contact Wireshark developers if you want this to be supported",
12873 session->cipher);
12874 }
12875 break;
12876 }
12877}
12878/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12879
12880void
12881tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12882 proto_tree *tree, uint32_t offset)
12883{
12884 /* RFC 8446 Section 4.6.3
12885 * enum {
12886 * update_not_requested(0), update_requested(1), (255)
12887 * } KeyUpdateRequest;
12888 *
12889 * struct {
12890 * KeyUpdateRequest request_update;
12891 * } KeyUpdate;
12892 */
12893 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12894}
12895
12896void
12897ssl_common_register_ssl_alpn_dissector_table(const char *name,
12898 const char *ui_name, const int proto)
12899{
12900 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12901 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12902 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12903}
12904
12905void
12906ssl_common_register_dtls_alpn_dissector_table(const char *name,
12907 const char *ui_name, const int proto)
12908{
12909 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12910 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12911 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12912}
12913
12914void
12915ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12916{
12917 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12918 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12919 &(options->psk));
12920
12921 if (is_dtls) {
12922 prefs_register_obsolete_preference(module, "keylog_file");
12923 prefs_register_static_text_preference(module, "keylog_file_removed",
12924 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12925 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12926 return;
12927 }
12928
12929 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12930 "The name of a file which contains a list of \n"
12931 "(pre-)master secrets in one of the following formats:\n"
12932 "\n"
12933 "RSA <EPMS> <PMS>\n"
12934 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12935 "CLIENT_RANDOM <CRAND> <MS>\n"
12936 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12937 "\n"
12938 "Where:\n"
12939 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12940 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12941 "<SSLID> = The SSL Session ID\n"
12942 "<MS> = The Master-Secret (MS)\n"
12943 "<CRAND> = The Client's random number from the ClientHello message\n"
12944 "\n"
12945 "(All fields are in hex notation)",
12946 &(options->keylog_filename), false0);
12947}
12948
12949void
12950ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length)
12951{
12952 if (ssl_session && ssl_session->session.version != TLSV1DOT3_VERSION0x304 && !(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
12953 uint32_t old_length = ssl_session->handshake_data.data_len;
12954 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12955 if (tvb) {
12956 if (tvb_bytes_exist(tvb, offset, length)) {
12957 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12958 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12959 ssl_session->handshake_data.data_len += length;
12960 }
12961 } else {
12962 /* DTLS calculates the hash as if each handshake message had been
12963 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12964 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12965 */
12966 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12966, (int64_t)length, (int64_t)4))));
12967 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12968 memset(ssl_session->handshake_data.data + old_length, 0, length);
12969 ssl_session->handshake_data.data_len += length;
12970 }
12971 }
12972}
12973
12974
12975/*
12976 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12977 *
12978 * Local variables:
12979 * c-basic-offset: 4
12980 * tab-width: 8
12981 * indent-tabs-mode: nil
12982 * End:
12983 *
12984 * vi: set shiftwidth=4 tabstop=8 expandtab:
12985 * :indentSize=4:tabSize=8:noTabs=true:
12986 */