Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 4107, column 17
Potential leak of memory pointed to by 'handshake_hashed_data.data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-09-21-100404-3661-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 { 0x0a0a, "GREASE" },
1539 { 0x1a1a, "GREASE" },
1540 { 0x2a2a, "GREASE" },
1541 { 0x3a3a, "GREASE" },
1542 { 0x4a4a, "GREASE" },
1543 { 0x5a5a, "GREASE" },
1544 { 0x6a6a, "GREASE" },
1545 { 0x7a7a, "GREASE" },
1546 { 0x8a8a, "GREASE" },
1547 { 0x9a9a, "GREASE" },
1548 { 0xaaaa, "GREASE" },
1549 { 0xbaba, "GREASE" },
1550 { 0xcaca, "GREASE" },
1551 { 0xdada, "GREASE" },
1552 { 0xeaea, "GREASE" },
1553 { 0xfafa, "GREASE" },
1554 /* PQC digital signature algorithms from OQS-OpenSSL,
1555 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1556 { 0xfea0, "dilithium2" },
1557 { 0xfea1, "p256_dilithium2" },
1558 { 0xfea2, "rsa3072_dilithium2" },
1559 { 0xfea3, "dilithium3" },
1560 { 0xfea4, "p384_dilithium3" },
1561 { 0xfea5, "dilithium5" },
1562 { 0xfea6, "p521_dilithium5" },
1563 { 0xfea7, "dilithium2_aes" },
1564 { 0xfea8, "p256_dilithium2_aes" },
1565 { 0xfea9, "rsa3072_dilithium2_aes" },
1566 { 0xfeaa, "dilithium3_aes" },
1567 { 0xfeab, "p384_dilithium3_aes" },
1568 { 0xfeac, "dilithium5_aes" },
1569 { 0xfead, "p521_dilithium5_aes" },
1570 { 0xfe0b, "falcon512" },
1571 { 0xfe0c, "p256_falcon512" },
1572 { 0xfe0d, "rsa3072_falcon512" },
1573 { 0xfe0e, "falcon1024" },
1574 { 0xfe0f, "p521_falcon1024" },
1575 { 0xfe96, "picnicl1full" },
1576 { 0xfe97, "p256_picnicl1full" },
1577 { 0xfe98, "rsa3072_picnicl1full" },
1578 { 0xfe1b, "picnic3l1" },
1579 { 0xfe1c, "p256_picnic3l1" },
1580 { 0xfe1d, "rsa3072_picnic3l1" },
1581 { 0xfe27, "rainbowIclassic" },
1582 { 0xfe28, "p256_rainbowIclassic" },
1583 { 0xfe29, "rsa3072_rainbowIclassic" },
1584 { 0xfe3c, "rainbowVclassic" },
1585 { 0xfe3d, "p521_rainbowVclassic" },
1586 { 0xfe42, "sphincsharaka128frobust" },
1587 { 0xfe43, "p256_sphincsharaka128frobust" },
1588 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1589 { 0xfe5e, "sphincssha256128frobust" },
1590 { 0xfe5f, "p256_sphincssha256128frobust" },
1591 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1592 { 0xfe7a, "sphincsshake256128frobust" },
1593 { 0xfe7b, "p256_sphincsshake256128frobust" },
1594 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1595 { 0, NULL((void*)0) }
1596};
1597
1598/* RFC 6091 3.1 */
1599const value_string tls_certificate_type[] = {
1600 { 0, "X.509" },
1601 { 1, "OpenPGP" },
1602 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1603 { 0, NULL((void*)0) }
1604};
1605
1606const value_string tls_cert_chain_type[] = {
1607 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1608 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1609 { 0, NULL((void*)0) }
1610};
1611
1612const value_string tls_cert_status_type[] = {
1613 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1614 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1615 { 0, NULL((void*)0) }
1616};
1617
1618/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1619 * Last-Modified Sat, 19 Sep 2026 14:18:00 GMT, 45 entries. */
1620static const bytes_string ct_logids[] = {
1621 { (const uint8_t[]){
1622 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1623 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1624 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1625 },
1626 32, "Google 'Argon2026h1' log" },
1627 { (const uint8_t[]){
1628 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1629 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1630 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1631 },
1632 32, "Google 'Argon2026h2' log" },
1633 { (const uint8_t[]){
1634 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1635 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1636 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1637 },
1638 32, "Google 'Argon2027h1'" },
1639 { (const uint8_t[]){
1640 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1641 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1642 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1643 },
1644 32, "Google 'Xenon2026h1' log" },
1645 { (const uint8_t[]){
1646 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1647 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1648 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1649 },
1650 32, "Google 'Xenon2026h2' log" },
1651 { (const uint8_t[]){
1652 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1653 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1654 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1655 },
1656 32, "Google 'Xenon2027h1'" },
1657 { (const uint8_t[]){
1658 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1659 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1660 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1661 },
1662 32, "Google 'Submariner' log" },
1663 { (const uint8_t[]){
1664 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1665 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1666 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1667 },
1668 32, "Google 'Daedalus' log" },
1669 { (const uint8_t[]){
1670 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1671 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1672 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1673 },
1674 32, "Google 'Testtube' log" },
1675 { (const uint8_t[]){
1676 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1677 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1678 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1679 },
1680 32, "Google 'Crucible' log" },
1681 { (const uint8_t[]){
1682 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1683 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1684 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1685 },
1686 32, "Google 'Solera2026h1' log" },
1687 { (const uint8_t[]){
1688 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1689 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1690 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1691 },
1692 32, "Google 'Solera2026h2' log" },
1693 { (const uint8_t[]){
1694 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1695 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1696 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1697 },
1698 32, "Google 'Solera2027h1' log" },
1699 { (const uint8_t[]){
1700 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1701 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1702 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1703 },
1704 32, "Cloudflare 'Nimbus2026'" },
1705 { (const uint8_t[]){
1706 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1707 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1708 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1709 },
1710 32, "Cloudflare 'Nimbus2027'" },
1711 { (const uint8_t[]){
1712 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1713 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1714 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1715 },
1716 32, "DigiCert 'Wyvern2026h1'" },
1717 { (const uint8_t[]){
1718 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1719 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1720 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1721 },
1722 32, "DigiCert 'Wyvern2026h2'" },
1723 { (const uint8_t[]){
1724 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1725 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1726 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1727 },
1728 32, "DigiCert 'Wyvern2027h1'" },
1729 { (const uint8_t[]){
1730 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1731 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1732 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1733 },
1734 32, "DigiCert 'Wyvern2027h2'" },
1735 { (const uint8_t[]){
1736 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1737 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1738 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1739 },
1740 32, "DigiCert 'Sphinx2026h1'" },
1741 { (const uint8_t[]){
1742 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1743 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1744 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1745 },
1746 32, "DigiCert 'Sphinx2026h2'" },
1747 { (const uint8_t[]){
1748 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1749 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1750 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1751 },
1752 32, "DigiCert 'sphinx2027h1'" },
1753 { (const uint8_t[]){
1754 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1755 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1756 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1757 },
1758 32, "DigiCert 'sphinx2027h2'" },
1759 { (const uint8_t[]){
1760 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1761 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1762 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1763 },
1764 32, "Sectigo 'Mammoth2026h1'" },
1765 { (const uint8_t[]){
1766 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1767 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1768 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1769 },
1770 32, "Sectigo 'Mammoth2026h2'" },
1771 { (const uint8_t[]){
1772 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1773 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1774 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1775 },
1776 32, "Sectigo 'Sabre2026h1'" },
1777 { (const uint8_t[]){
1778 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1779 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1780 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1781 },
1782 32, "Sectigo 'Sabre2026h2'" },
1783 { (const uint8_t[]){
1784 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1785 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1786 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1787 },
1788 32, "Sectigo 'Elephant2026h1'" },
1789 { (const uint8_t[]){
1790 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1791 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1792 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1793 },
1794 32, "Sectigo 'Elephant2026h2'" },
1795 { (const uint8_t[]){
1796 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1797 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1798 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1799 },
1800 32, "Sectigo 'Elephant2027h1'" },
1801 { (const uint8_t[]){
1802 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1803 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1804 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1805 },
1806 32, "Sectigo 'Elephant2027h2'" },
1807 { (const uint8_t[]){
1808 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1809 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1810 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1811 },
1812 32, "Sectigo 'Tiger2026h1'" },
1813 { (const uint8_t[]){
1814 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1815 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1816 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1817 },
1818 32, "Sectigo 'Tiger2026h2'" },
1819 { (const uint8_t[]){
1820 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1821 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1822 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1823 },
1824 32, "Sectigo 'Tiger2027h1'" },
1825 { (const uint8_t[]){
1826 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1827 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1828 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1829 },
1830 32, "Sectigo 'Tiger2027h2'" },
1831 { (const uint8_t[]){
1832 0x61, 0xa3, 0x5d, 0xc3, 0x98, 0x06, 0x1b, 0x2a, 0x59, 0x5b, 0xfe,
1833 0x34, 0x46, 0x89, 0x95, 0x18, 0xf0, 0xfe, 0xac, 0x14, 0xb0, 0x1b,
1834 0xe0, 0x2a, 0x93, 0xbf, 0x05, 0x21, 0x46, 0x3a, 0x9d, 0xbd,
1835 },
1836 32, "No description (YaNdw5gGGypZW/40RomVGPD+rBSwG+Aqk78FIUY6nb0=)" },
1837 { (const uint8_t[]){
1838 0xbe, 0x31, 0xd3, 0x65, 0x88, 0xdf, 0xd8, 0x05, 0xc8, 0x6d, 0x35,
1839 0x20, 0x29, 0x84, 0xac, 0xc9, 0xaa, 0x44, 0xae, 0xe3, 0x84, 0x08,
1840 0x0b, 0x9f, 0xcf, 0x42, 0xeb, 0xc8, 0x73, 0x55, 0xe4, 0x9b,
1841 },
1842 32, "No description (vjHTZYjf2AXIbTUgKYSsyapEruOECAufz0LryHNV5Js=)" },
1843 { (const uint8_t[]){
1844 0xfa, 0x63, 0x12, 0x74, 0x9a, 0xdc, 0xc8, 0x19, 0x95, 0x4e, 0x3e,
1845 0xf3, 0x01, 0x1d, 0x42, 0x67, 0x76, 0x88, 0xd4, 0x47, 0x1c, 0xfe,
1846 0xf6, 0x35, 0x3f, 0x89, 0x1d, 0xc8, 0x7c, 0x12, 0xac, 0xd4,
1847 },
1848 32, "No description (+mMSdJrcyBmVTj7zAR1CZ3aI1Ecc/vY1P4kdyHwSrNQ=)" },
1849 { (const uint8_t[]){
1850 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1851 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1852 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1853 },
1854 32, "Let's Encrypt 'Oak2026h1'" },
1855 { (const uint8_t[]){
1856 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1857 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1858 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1859 },
1860 32, "Let's Encrypt 'Oak2026h2'" },
1861 { (const uint8_t[]){
1862 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1863 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1864 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1865 },
1866 32, "TrustAsia 'log2026a'" },
1867 { (const uint8_t[]){
1868 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1869 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1870 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1871 },
1872 32, "TrustAsia 'log2026b'" },
1873 { (const uint8_t[]){
1874 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1875 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1876 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1877 },
1878 32, "TrustAsia 'HETU2027'" },
1879 { (const uint8_t[]){
1880 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1881 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1882 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1883 },
1884 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1885 { (const uint8_t[]){
1886 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1887 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1888 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1889 },
1890 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1891 { NULL((void*)0), 0, NULL((void*)0) }
1892};
1893
1894/*
1895 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1896 */
1897static dissector_table_t ssl_alpn_dissector_table;
1898static dissector_table_t dtls_alpn_dissector_table;
1899
1900/*
1901 * Special cases for prefix matching of the ALPN, if the ALPN includes
1902 * a version number for a draft or protocol revision.
1903 */
1904typedef struct ssl_alpn_prefix_match_protocol {
1905 const char *proto_prefix;
1906 const char *dissector_name;
1907} ssl_alpn_prefix_match_protocol_t;
1908
1909static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1910 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1911 * already exists 3.1 as of this writing... match the prefix. */
1912 { "spdy/", "spdy" },
1913 /* draft-ietf-httpbis-http2-16 */
1914 { "h2-", "http2" }, /* draft versions */
1915};
1916
1917const value_string compress_certificate_algorithm_vals[] = {
1918 { 1, "zlib" },
1919 { 2, "brotli" },
1920 { 3, "zstd" },
1921 { 0, NULL((void*)0) }
1922};
1923
1924
1925const val64_string quic_transport_parameter_id[] = {
1926 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1927 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1928 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1929 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1930 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1931 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1932 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1933 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1934 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1935 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1936 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1937 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1938 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1939 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1940 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1941 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1942 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1943 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1944 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1945 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1946 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1947 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1948 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1949 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1950 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1951 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1952 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1953 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1954 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1955 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1956 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1957 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1958 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1959 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1960 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1961 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1962 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1963 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1964 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1965 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1966 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1967 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1968 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1969 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1970 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1971 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1972 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1973 { 0, NULL((void*)0) }
1974};
1975
1976/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1977const val64_string quic_address_discovery_vals[] = {
1978 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1979 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1980 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1981 { 0, NULL((void*)0) }
1982};
1983
1984/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1985const val64_string quic_enable_time_stamp_v2_vals[] = {
1986 { 1, "I would like to receive TIME_STAMP frames" },
1987 { 2, "I am able to generate TIME_STAMP frames" },
1988 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1989 { 0, NULL((void*)0) }
1990};
1991
1992/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1993const val64_string quic_enable_multipath_vals[] = {
1994 { 0, "don't support multipath" },
1995 { 1, "support multipath as defined in this document" },
1996 { 0, NULL((void*)0) }
1997};
1998
1999/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2000const value_string tls_hello_ext_ech_clienthello_types[] = {
2001 { 0, "Outer Client Hello" },
2002 { 1, "Inner Client Hello" },
2003 { 0, NULL((void*)0) }
2004};
2005
2006/* RFC 9180 */
2007const value_string kem_id_type_vals[] = {
2008 { 0x0000, "Reserved" },
2009 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2010 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2011 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2012 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2013 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2014 { 0, NULL((void*)0) }
2015};
2016const value_string kdf_id_type_vals[] = {
2017 { 0x0000, "Reserved" },
2018 { 0x0001, "HKDF-SHA256" },
2019 { 0x0002, "HKDF-SHA384" },
2020 { 0x0003, "HKDF-SHA512" },
2021 { 0, NULL((void*)0) }
2022};
2023const value_string aead_id_type_vals[] = {
2024 { 0x0000, "Reserved" },
2025 { 0x0001, "AES-128-GCM" },
2026 { 0x0002, "AES-256-GCM" },
2027 { 0x0003, "ChaCha20Poly1305" },
2028 { 0xFFFF, "Export-only" },
2029 { 0, NULL((void*)0) }
2030};
2031
2032const value_string token_binding_key_parameter_vals[] = {
2033 { 0, "rsa2048_pkcs1.5" },
2034 { 1, "rsa2048_pss" },
2035 { 2, "ecdsap256" },
2036 { 0, NULL((void*)0) }
2037};
2038
2039/* Lookup tables }}} */
2040
2041void
2042quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2043{
2044 const char *label;
2045 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2046 label = "GREASE";
2047 } else {
2048 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2049 }
2050 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2051}
2052
2053/* we keep this internal to packet-tls-utils, as there should be
2054 no need to access it any other way.
2055
2056 This also allows us to hide the dependency on zlib.
2057*/
2058struct _SslDecompress {
2059 int compression;
2060#ifdef USE_ZLIB_OR_ZLIBNG
2061 zlib_stream istream;
2062#endif
2063};
2064
2065/* To assist in parsing client/server key exchange messages
2066 0 indicates unknown */
2067int ssl_get_keyex_alg(int cipher)
2068{
2069 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2070 switch(cipher) {
2071 case 0x0017:
2072 case 0x0018:
2073 case 0x0019:
2074 case 0x001a:
2075 case 0x001b:
2076 case 0x0034:
2077 case 0x003a:
2078 case 0x0046:
2079 case 0x006c:
2080 case 0x006d:
2081 case 0x0089:
2082 case 0x009b:
2083 case 0x00a6:
2084 case 0x00a7:
2085 case 0x00bf:
2086 case 0x00c5:
2087 case 0xc084:
2088 case 0xc085:
2089 return KEX_DH_ANON0x13;
2090 case 0x000b:
2091 case 0x000c:
2092 case 0x000d:
2093 case 0x0030:
2094 case 0x0036:
2095 case 0x003e:
2096 case 0x0042:
2097 case 0x0068:
2098 case 0x0085:
2099 case 0x0097:
2100 case 0x00a4:
2101 case 0x00a5:
2102 case 0x00bb:
2103 case 0x00c1:
2104 case 0xc082:
2105 case 0xc083:
2106 return KEX_DH_DSS0x14;
2107 case 0x000e:
2108 case 0x000f:
2109 case 0x0010:
2110 case 0x0031:
2111 case 0x0037:
2112 case 0x003f:
2113 case 0x0043:
2114 case 0x0069:
2115 case 0x0086:
2116 case 0x0098:
2117 case 0x00a0:
2118 case 0x00a1:
2119 case 0x00bc:
2120 case 0x00c2:
2121 case 0xc07e:
2122 case 0xc07f:
2123 return KEX_DH_RSA0x15;
2124 case 0x0011:
2125 case 0x0012:
2126 case 0x0013:
2127 case 0x0032:
2128 case 0x0038:
2129 case 0x0040:
2130 case 0x0044:
2131 case 0x0063:
2132 case 0x0065:
2133 case 0x0066:
2134 case 0x006a:
2135 case 0x0087:
2136 case 0x0099:
2137 case 0x00a2:
2138 case 0x00a3:
2139 case 0x00bd:
2140 case 0x00c3:
2141 case 0xc080:
2142 case 0xc081:
2143 return KEX_DHE_DSS0x10;
2144 case 0x002d:
2145 case 0x008e:
2146 case 0x008f:
2147 case 0x0090:
2148 case 0x0091:
2149 case 0x00aa:
2150 case 0x00ab:
2151 case 0x00b2:
2152 case 0x00b3:
2153 case 0x00b4:
2154 case 0x00b5:
2155 case 0xc090:
2156 case 0xc091:
2157 case 0xc096:
2158 case 0xc097:
2159 case 0xc0a6:
2160 case 0xc0a7:
2161 case 0xc0aa:
2162 case 0xc0ab:
2163 case 0xccad:
2164 case 0xe41c:
2165 case 0xe41d:
2166 return KEX_DHE_PSK0x11;
2167 case 0x0014:
2168 case 0x0015:
2169 case 0x0016:
2170 case 0x0033:
2171 case 0x0039:
2172 case 0x0045:
2173 case 0x0067:
2174 case 0x006b:
2175 case 0x0088:
2176 case 0x009a:
2177 case 0x009e:
2178 case 0x009f:
2179 case 0x00be:
2180 case 0x00c4:
2181 case 0xc07c:
2182 case 0xc07d:
2183 case 0xc09e:
2184 case 0xc09f:
2185 case 0xc0a2:
2186 case 0xc0a3:
2187 case 0xccaa:
2188 case 0xe41e:
2189 case 0xe41f:
2190 return KEX_DHE_RSA0x12;
2191 case 0xc015:
2192 case 0xc016:
2193 case 0xc017:
2194 case 0xc018:
2195 case 0xc019:
2196 return KEX_ECDH_ANON0x19;
2197 case 0xc001:
2198 case 0xc002:
2199 case 0xc003:
2200 case 0xc004:
2201 case 0xc005:
2202 case 0xc025:
2203 case 0xc026:
2204 case 0xc02d:
2205 case 0xc02e:
2206 case 0xc074:
2207 case 0xc075:
2208 case 0xc088:
2209 case 0xc089:
2210 return KEX_ECDH_ECDSA0x1a;
2211 case 0xc00b:
2212 case 0xc00c:
2213 case 0xc00d:
2214 case 0xc00e:
2215 case 0xc00f:
2216 case 0xc029:
2217 case 0xc02a:
2218 case 0xc031:
2219 case 0xc032:
2220 case 0xc078:
2221 case 0xc079:
2222 case 0xc08c:
2223 case 0xc08d:
2224 return KEX_ECDH_RSA0x1b;
2225 case 0xc006:
2226 case 0xc007:
2227 case 0xc008:
2228 case 0xc009:
2229 case 0xc00a:
2230 case 0xc023:
2231 case 0xc024:
2232 case 0xc02b:
2233 case 0xc02c:
2234 case 0xc072:
2235 case 0xc073:
2236 case 0xc086:
2237 case 0xc087:
2238 case 0xc0ac:
2239 case 0xc0ad:
2240 case 0xc0ae:
2241 case 0xc0af:
2242 case 0xcca9:
2243 case 0xe414:
2244 case 0xe415:
2245 return KEX_ECDHE_ECDSA0x16;
2246 case 0xc033:
2247 case 0xc034:
2248 case 0xc035:
2249 case 0xc036:
2250 case 0xc037:
2251 case 0xc038:
2252 case 0xc039:
2253 case 0xc03a:
2254 case 0xc03b:
2255 case 0xc09a:
2256 case 0xc09b:
2257 case 0xccac:
2258 case 0xe418:
2259 case 0xe419:
2260 case 0xd001:
2261 case 0xd002:
2262 case 0xd003:
2263 case 0xd005:
2264 return KEX_ECDHE_PSK0x17;
2265 case 0xc010:
2266 case 0xc011:
2267 case 0xc012:
2268 case 0xc013:
2269 case 0xc014:
2270 case 0xc027:
2271 case 0xc028:
2272 case 0xc02f:
2273 case 0xc030:
2274 case 0xc076:
2275 case 0xc077:
2276 case 0xc08a:
2277 case 0xc08b:
2278 case 0xcca8:
2279 case 0xe412:
2280 case 0xe413:
2281 return KEX_ECDHE_RSA0x18;
2282 case 0x001e:
2283 case 0x001f:
2284 case 0x0020:
2285 case 0x0021:
2286 case 0x0022:
2287 case 0x0023:
2288 case 0x0024:
2289 case 0x0025:
2290 case 0x0026:
2291 case 0x0027:
2292 case 0x0028:
2293 case 0x0029:
2294 case 0x002a:
2295 case 0x002b:
2296 return KEX_KRB50x1c;
2297 case 0x002c:
2298 case 0x008a:
2299 case 0x008b:
2300 case 0x008c:
2301 case 0x008d:
2302 case 0x00a8:
2303 case 0x00a9:
2304 case 0x00ae:
2305 case 0x00af:
2306 case 0x00b0:
2307 case 0x00b1:
2308 case 0xc064:
2309 case 0xc065:
2310 case 0xc08e:
2311 case 0xc08f:
2312 case 0xc094:
2313 case 0xc095:
2314 case 0xc0a4:
2315 case 0xc0a5:
2316 case 0xc0a8:
2317 case 0xc0a9:
2318 case 0xccab:
2319 case 0xe416:
2320 case 0xe417:
2321 return KEX_PSK0x1d;
2322 case 0x0001:
2323 case 0x0002:
2324 case 0x0003:
2325 case 0x0004:
2326 case 0x0005:
2327 case 0x0006:
2328 case 0x0007:
2329 case 0x0008:
2330 case 0x0009:
2331 case 0x000a:
2332 case 0x002f:
2333 case 0x0035:
2334 case 0x003b:
2335 case 0x003c:
2336 case 0x003d:
2337 case 0x0041:
2338 case 0x0060:
2339 case 0x0061:
2340 case 0x0062:
2341 case 0x0064:
2342 case 0x0084:
2343 case 0x0096:
2344 case 0x009c:
2345 case 0x009d:
2346 case 0x00ba:
2347 case 0x00c0:
2348 case 0xc07a:
2349 case 0xc07b:
2350 case 0xc09c:
2351 case 0xc09d:
2352 case 0xc0a0:
2353 case 0xc0a1:
2354 case 0xe410:
2355 case 0xe411:
2356 case 0xfefe:
2357 case 0xfeff:
2358 case 0xffe0:
2359 case 0xffe1:
2360 return KEX_RSA0x1e;
2361 case 0x002e:
2362 case 0x0092:
2363 case 0x0093:
2364 case 0x0094:
2365 case 0x0095:
2366 case 0x00ac:
2367 case 0x00ad:
2368 case 0x00b6:
2369 case 0x00b7:
2370 case 0x00b8:
2371 case 0x00b9:
2372 case 0xc092:
2373 case 0xc093:
2374 case 0xc098:
2375 case 0xc099:
2376 case 0xccae:
2377 case 0xe41a:
2378 case 0xe41b:
2379 return KEX_RSA_PSK0x1f;
2380 case 0xc01a:
2381 case 0xc01d:
2382 case 0xc020:
2383 return KEX_SRP_SHA0x20;
2384 case 0xc01c:
2385 case 0xc01f:
2386 case 0xc022:
2387 return KEX_SRP_SHA_DSS0x21;
2388 case 0xc01b:
2389 case 0xc01e:
2390 case 0xc021:
2391 return KEX_SRP_SHA_RSA0x22;
2392 case 0xc0ff:
2393 return KEX_ECJPAKE0x24;
2394 case 0xe003:
2395 case 0xe013:
2396 case 0xe053:
2397 return KEX_ECC_SM20x26;
2398 default:
2399 break;
2400 }
2401
2402 return 0;
2403 /* }}} */
2404}
2405
2406static wmem_list_t *connection_id_session_list;
2407
2408void
2409ssl_init_cid_list(void) {
2410 connection_id_session_list = wmem_list_new(wmem_file_scope());
2411}
2412
2413void
2414ssl_cleanup_cid_list(void) {
2415 wmem_destroy_list(connection_id_session_list);
2416}
2417
2418void
2419ssl_add_session_by_cid(SslDecryptSession *session)
2420{
2421 wmem_list_append(connection_id_session_list, session);
2422}
2423
2424SslDecryptSession *
2425ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2426{
2427 SslDecryptSession * ssl_cid = NULL((void*)0);
2428 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2429
2430 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2431 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2432 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2432, "ssl != ((void*)0)"))));
2433 SslSession *session = &ssl->session;
2434
2435 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2436 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2437 ssl_cid = ssl;
2438 }
2439 }
2440
2441 if (session->server_cid_len > 0) {
2442 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2443 ssl_cid = ssl;
2444 }
2445 }
2446
2447 it = wmem_list_frame_next(it);
2448 }
2449
2450 return ssl_cid;
2451}
2452
2453/* StringInfo structure (len + data) functions {{{ */
2454
2455int
2456ssl_data_alloc(StringInfo* str, size_t len)
2457{
2458 str->data = (unsigned char *)g_malloc(len);
16
←
Memory is allocated
→
2459 /* the allocator can return a null pointer for a size equal to 0,
2460 * and that must be allowed */
2461 if (len
16.1
'len' is > 0
 > 0 && !str->data)
17
←
Assuming field 'data' is non-null
→
18
←
Taking false branch
→
2462 return -1;
2463 str->data_len = (unsigned) len;
2464 return 0;
2465}
2466
2467void
2468ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2469{
2470 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2470, "data"))));
2471 memcpy(str->data, data, len);
2472 str->data_len = len;
2473}
2474
2475static int
2476ssl_data_realloc(StringInfo* str, unsigned len)
2477{
2478 str->data = (unsigned char *)g_realloc(str->data, len);
2479 if (!str->data)
2480 return -1;
2481 str->data_len = len;
2482 return 0;
2483}
2484
2485static StringInfo *
2486ssl_data_clone(StringInfo *str)
2487{
2488 StringInfo *cloned_str;
2489 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2490 sizeof(StringInfo) + str->data_len);
2491 cloned_str->data = (unsigned char *) (cloned_str + 1);
2492 ssl_data_set(cloned_str, str->data, str->data_len);
2493 return cloned_str;
2494}
2495
2496static int
2497ssl_data_copy(StringInfo* dst, StringInfo* src)
2498{
2499 if (dst->data_len < src->data_len) {
2500 if (ssl_data_realloc(dst, src->data_len))
2501 return -1;
2502 }
2503 memcpy(dst->data, src->data, src->data_len);
2504 dst->data_len = src->data_len;
2505 return 0;
2506}
2507
2508/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2509 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2510 * success. */
2511static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2512 size_t i;
2513
2514 if (hex_len & 1)
2515 return false0;
2516
2517 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2518 for (i = 0; i < hex_len / 2; i++) {
2519 int a = ws_xton(in[i*2]);
2520 int b = ws_xton(in[i*2 + 1]);
2521 if (a == -1 || b == -1)
2522 return false0;
2523 out->data[i] = a << 4 | b;
2524 }
2525 out->data_len = (unsigned)hex_len / 2;
2526 return true1;
2527}
2528/* StringInfo structure (len + data) functions }}} */
2529
2530
2531/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2532/* hmac abstraction layer */
2533#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2534
2535static inline int
2536ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2537{
2538 gcry_error_t err;
2539 const char *err_str, *err_src;
2540
2541 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2542 if (err != 0) {
2543 err_str = gcry_strerror(err);
2544 err_src = gcry_strsource(err);
2545 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2546 return -1;
2547 }
2548 return 0;
2549}
2550
2551static inline int
2552ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2553{
2554 gcry_error_t err;
2555 const char *err_str, *err_src;
2556
2557 err = gcry_md_setkey (*(md), key, len);
2558 if (err != 0) {
2559 err_str = gcry_strerror(err);
2560 err_src = gcry_strsource(err);
2561 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2562 return -1;
2563 }
2564 return 0;
2565}
2566
2567static inline int
2568ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2569{
2570 gcry_md_reset(*md);
2571 return 0;
2572}
2573
2574static inline void
2575ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2576{
2577 gcry_md_write(*(md), data, len);
2578}
2579static inline void
2580ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2581{
2582 int algo;
2583 unsigned len;
2584
2585 algo = gcry_md_get_algo (*(md));
2586 len = gcry_md_get_algo_dlen(algo);
2587 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2587, "len <= *datalen"))));
2588 memcpy(data, gcry_md_read(*(md), algo), len);
2589 *datalen = len;
2590}
2591static inline void
2592ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2593{
2594 gcry_md_close(*(md));
2595}
2596
2597/* message digest abstraction layer*/
2598#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2599
2600static inline int
2601ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2602{
2603 gcry_error_t err;
2604 const char *err_str, *err_src;
2605 err = gcry_md_open(md,algo, 0);
2606 if (err != 0) {
2607 err_str = gcry_strerror(err);
2608 err_src = gcry_strsource(err);
2609 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2610 return -1;
2611 }
2612 return 0;
2613}
2614static inline void
2615ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2616{
2617 gcry_md_write(*(md), data, len);
2618}
2619static inline void
2620ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2621{
2622 int algo;
2623 int len;
2624 algo = gcry_md_get_algo (*(md));
2625 len = gcry_md_get_algo_dlen (algo);
2626 memcpy(data, gcry_md_read(*(md), algo), len);
2627 *datalen = len;
2628}
2629static inline void
2630ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2631{
2632 gcry_md_close(*(md));
2633}
2634
2635static inline void
2636ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2637{
2638 gcry_md_reset(*md);
2639}
2640
2641/* md5 /sha abstraction layer */
2642#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2643#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2644
2645static inline int
2646ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2647{
2648 gcry_error_t err;
2649 const char *err_str, *err_src;
2650 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2651 if (err != 0) {
2652 err_str = gcry_strerror(err);
2653 err_src = gcry_strsource(err);
2654 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2655 return -1;
2656 }
2657 return 0;
2658}
2659static inline void
2660ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2661{
2662 gcry_md_write(*(md), data, len);
2663}
2664static inline void
2665ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2666{
2667 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2668 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2669}
2670
2671static inline void
2672ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2673{
2674 gcry_md_reset(*md);
2675}
2676
2677static inline void
2678ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2679{
2680 gcry_md_close(*(md));
2681}
2682
2683static inline int
2684ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2685{
2686 gcry_error_t err;
2687 const char *err_str, *err_src;
2688 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2689 if (err != 0) {
2690 err_str = gcry_strerror(err);
2691 err_src = gcry_strsource(err);
2692 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2693 return -1;
2694 }
2695 return 0;
2696}
2697static inline void
2698ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2699{
2700 gcry_md_write(*(md), data, len);
2701}
2702static inline void
2703ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2704{
2705 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2706 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2707}
2708
2709static inline void
2710ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2711{
2712 gcry_md_reset(*md);
2713}
2714
2715static inline void
2716ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2717{
2718 gcry_md_close(*(md));
2719}
2720/* libgcrypt wrappers for HMAC/message digest operations }}} */
2721
2722/* libgcrypt wrappers for Cipher state manipulation {{{ */
2723int
2724ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2725{
2726 int ret;
2727#if 0
2728 unsigned char *ivp;
2729 int i;
2730 gcry_cipher_hd_t c;
2731 c=(gcry_cipher_hd_t)*cipher;
2732#endif
2733 ssl_debug_printf("--------------------------------------------------------------------");
2734#if 0
2735 for(ivp=c->iv,i=0; i < iv_len; i++ )
2736 {
2737 ssl_debug_printf("%d ",ivp[i]);
2738 i++;
2739 }
2740#endif
2741 ssl_debug_printf("--------------------------------------------------------------------");
2742 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2743#if 0
2744 for(ivp=c->iv,i=0; i < iv_len; i++ )
2745 {
2746 ssl_debug_printf("%d ",ivp[i]);
2747 i++;
2748 }
2749#endif
2750 ssl_debug_printf("--------------------------------------------------------------------");
2751 return ret;
2752}
2753/* stream cipher abstraction layer*/
2754static int
2755ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2756 unsigned char* iv, int mode)
2757{
2758 int gcry_modes[] = {
2759 GCRY_CIPHER_MODE_STREAM,
2760 GCRY_CIPHER_MODE_CBC,
2761 GCRY_CIPHER_MODE_GCM,
2762 GCRY_CIPHER_MODE_CCM,
2763 GCRY_CIPHER_MODE_CCM,
2764 GCRY_CIPHER_MODE_POLY1305,
2765 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2766 };
2767 int err;
2768 if (algo == -1) {
2769 /* NULL mode */
2770 *(cipher) = (gcry_cipher_hd_t)-1;
2771 return 0;
2772 }
2773 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2774 if (err !=0)
2775 return -1;
2776 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2777 if (err != 0)
2778 return -1;
2779 /* AEAD cipher suites will set the nonce later. */
2780 if (mode == MODE_CBC) {
2781 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2782 if (err != 0)
2783 return -1;
2784 }
2785 return 0;
2786}
2787static inline int
2788ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2789 const unsigned char * in, int inl)
2790{
2791 if ((*cipher) == (gcry_cipher_hd_t)-1)
2792 {
2793 if (in && inl)
2794 memcpy(out, in, outl < inl ? outl : inl);
2795 return 0;
2796 }
2797 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2798}
2799static inline int
2800ssl_get_digest_by_name(const char*name)
2801{
2802 return gcry_md_map_name(name);
2803}
2804static inline int
2805ssl_get_cipher_by_name(const char* name)
2806{
2807 return gcry_cipher_map_name(name);
2808}
2809
2810static inline void
2811ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2812{
2813 if ((*cipher) != (gcry_cipher_hd_t)-1)
2814 gcry_cipher_close(*cipher);
2815 *cipher = NULL((void*)0);
2816}
2817/* }}} */
2818
2819/* Digests, Ciphers and Cipher Suites registry {{{ */
2820static const SslDigestAlgo digests[]={
2821 {"MD5", 16},
2822 {"SHA1", 20},
2823 {"SHA256", 32},
2824 {"SHA384", 48},
2825 {"SM3", 32},
2826 {"Not Applicable", 0},
2827};
2828
2829#define DIGEST_MAX_SIZE48 48
2830
2831/* get index digest index */
2832static const SslDigestAlgo *
2833ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2834 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2835 return &digests[DIG_NA0x45 - DIG_MD50x40];
2836 }
2837 return &digests[cs->dig - DIG_MD50x40];
2838}
2839
2840static const char *ciphers[]={
2841 "DES",
2842 "3DES",
2843 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2844 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2845 "IDEA",
2846 "AES",
2847 "AES256",
2848 "CAMELLIA128",
2849 "CAMELLIA256",
2850 "SEED",
2851 "CHACHA20", /* since Libgcrypt 1.7.0 */
2852 "SM1",
2853 "SM4",
2854 "*UNKNOWN*"
2855};
2856
2857static const SslCipherSuite cipher_suites[]={
2858 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2859 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2860 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2861 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2862 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2863 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2864 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2865 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2866 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2867 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2868 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2869 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2870 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2871 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2872 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2873 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2874 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2875 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2876 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2877 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2878 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2879 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2880 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2881 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2882 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2883 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2884 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2885 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2886 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2887 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2888 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2889 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2890 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2891 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2892 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2893 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2894 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2895 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2896 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2897 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2898 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2899 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2900 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2901 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2902 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2903 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2904 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2905 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2906 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2907 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2908 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2909 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2910 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2911 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2912 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2913 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2914 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2915 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2916 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2917 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2918 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2919 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2920 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2921 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2922 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2923 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2924 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2925 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2926 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2927 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2928 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2929 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2930 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2931 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2932 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2933 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2934 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2935 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2936 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2937 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2938 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2939 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2940 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2941 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2942 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2943 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2944 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2945 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2946 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2947 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2948 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2949 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2950 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2951 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2952 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2953 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2954 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2955 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2956 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2957 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2958 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2959 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2960 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2961 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2962 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2963 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2964 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2965 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2966 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2967 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2968 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2969 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2970 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2971 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2972 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2973 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2974 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2975 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2976 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2977 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2978 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2979 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2980 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2981 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2982 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2983 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2984 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2985 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2986 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2987 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2988 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2989 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2990 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2991 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2992
2993 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2994 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2995 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
2996 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
2997 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
2998 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
2999 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3000
3001 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3002 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3003 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3004 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3005 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3006 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3007 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3008 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3009 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3010 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3011 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3012 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3013 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3014 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3015 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3016 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3017 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3018 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3019 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3020 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3021 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3022 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3023 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3024 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3025 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3026 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3027 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3028 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3029 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3030 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3031 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3032 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3033 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3034 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3035 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3036 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3037 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3038 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3039 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3040 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3041 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3042 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3043 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3044 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3045 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3046 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3047 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3048 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3049 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3050 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3051 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3052 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3053 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3054 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3055 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3056 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3057 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3058 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3059 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3060 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3061 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3062 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3063 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3064 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3065 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3066 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3067 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3068 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3069 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3070 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3071 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3072 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3073 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3074 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3075 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3076 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3077 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3078 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3079 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3080 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3081 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3082 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3083 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3084 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3085 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3086 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3087 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3088 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3089 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3090 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3091 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3092 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3093 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3094 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3095 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3096 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3097 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3098 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3099 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3100 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3101 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3102 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3103 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3104 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3105 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3106 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3107 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3108 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3109 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3110 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3111 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3112 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3113 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3114 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3115 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3116 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3117 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3118 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3119 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3120 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3121 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3122 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3123 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3124 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3125 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3126 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3127 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3128 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3129 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3130 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3131 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3132 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3133 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3134 /* GM */
3135 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3136 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3137 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3138 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3139 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3140 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3141 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3142 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3143 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3144 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3145 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3146 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3147 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3148 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3149 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3150 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3151 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3152 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3153 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3154 {-1, 0, 0, 0, MODE_STREAM}
3155};
3156
3157#define MAX_BLOCK_SIZE16 16
3158#define MAX_KEY_SIZE32 32
3159
3160const SslCipherSuite *
3161ssl_find_cipher(int num)
3162{
3163 const SslCipherSuite *c;
3164 for(c=cipher_suites;c->number!=-1;c++){
3165 if(c->number==num){
3166 return c;
3167 }
3168 }
3169
3170 return NULL((void*)0);
3171}
3172
3173int
3174ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3175{
3176 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3177}
3178
3179unsigned
3180ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3181{
3182 int cipher_algo;
3183 if (cipher_suite->mode != MODE_CBC) return 0;
3184 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3185 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3186}
3187
3188static unsigned
3189ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3190{
3191 switch (cipher_suite_num) {
3192 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3193 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3194 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3195 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3196 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3197 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3198 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3199 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3200 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3201 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3202 return 5;
3203
3204 /* not defined in below draft, but "implemented by several vendors",
3205 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3206 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3207 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3208 return 7;
3209
3210 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3211 * used 7. Until a pcap proves 8, let's use the old value. Link:
3212 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3213 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3214 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3215 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3216 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3217 return 7;
3218
3219 default:
3220 return 0;
3221 }
3222}
3223
3224/* Digests, Ciphers and Cipher Suites registry }}} */
3225
3226
3227/* HMAC and the Pseudorandom function {{{ */
3228static int
3229tls_hash(StringInfo *secret, StringInfo *seed, int md,
3230 StringInfo *out, unsigned out_len)
3231{
3232 /* RFC 2246 5. HMAC and the pseudorandom function
3233 * '+' denotes concatenation.
3234 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3235 * HMAC_hash(secret, A(2) + seed) + ...
3236 * A(0) = seed
3237 * A(i) = HMAC_hash(secret, A(i - 1))
3238 */
3239 uint8_t *ptr;
3240 unsigned left, tocpy;
3241 uint8_t *A;
3242 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3243 unsigned A_l, tmp_l;
3244 SSL_HMACgcry_md_hd_t hm;
3245
3246 ptr = out->data;
3247 left = out_len;
3248
3249 ssl_print_string("tls_hash: hash secret", secret);
3250 ssl_print_string("tls_hash: hash seed", seed);
3251 /* A(0) = seed */
3252 A = seed->data;
3253 A_l = seed->data_len;
3254
3255 if (ssl_hmac_init(&hm, md) != 0) {
3256 return -1;
3257 }
3258 while (left) {
3259 /* A(i) = HMAC_hash(secret, A(i-1)) */
3260 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3261 ssl_hmac_update(&hm, A, A_l);
3262 A_l = sizeof(_A); /* upper bound len for hash output */
3263 ssl_hmac_final(&hm, _A, &A_l);
3264 A = _A;
3265
3266 /* HMAC_hash(secret, A(i) + seed) */
3267 ssl_hmac_reset(&hm);
3268 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3269 ssl_hmac_update(&hm, A, A_l);
3270 ssl_hmac_update(&hm, seed->data, seed->data_len);
3271 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3272 ssl_hmac_final(&hm, tmp, &tmp_l);
3273 ssl_hmac_reset(&hm);
3274
3275 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3276 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3277 memcpy(ptr, tmp, tocpy);
3278 ptr += tocpy;
3279 left -= tocpy;
3280 }
3281 ssl_hmac_cleanup(&hm);
3282 out->data_len = out_len;
3283
3284 ssl_print_string("hash out", out);
3285 return 0;
3286}
3287
3288static bool_Bool
3289tls_prf(StringInfo* secret, const char *usage,
3290 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3291{
3292 StringInfo seed, sha_out, md5_out;
3293 uint8_t *ptr;
3294 StringInfo s1, s2;
3295 unsigned i,s_l;
3296 size_t usage_len, rnd2_len;
3297 bool_Bool success = false0;
3298 usage_len = strlen(usage);
3299 rnd2_len = rnd2 ? rnd2->data_len : 0;
3300
3301 /* initialize buffer for sha, md5 random seed*/
3302 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3303 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3304 return false0;
3305 }
3306 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3307 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3308 goto free_sha;
3309 }
3310 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3311 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3312 (int) (usage_len+rnd1->data_len+rnd2_len));
3313 goto free_md5;
3314 }
3315
3316 ptr=seed.data;
3317 memcpy(ptr,usage,usage_len);
3318 ptr+=usage_len;
3319 memcpy(ptr,rnd1->data,rnd1->data_len);
3320 if (rnd2_len > 0) {
3321 ptr+=rnd1->data_len;
3322 memcpy(ptr,rnd2->data,rnd2->data_len);
3323 /*ptr+=rnd2->data_len;*/
3324 }
3325
3326 /* initialize buffer for client/server seeds*/
3327 s_l=secret->data_len/2 + secret->data_len%2;
3328 if (ssl_data_alloc(&s1, s_l) < 0) {
3329 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3330 goto free_seed;
3331 }
3332 if (ssl_data_alloc(&s2, s_l) < 0) {
3333 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3334 goto free_s1;
3335 }
3336
3337 memcpy(s1.data,secret->data,s_l);
3338 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3339
3340 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3341 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3342 goto free_s2;
3343 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3344 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3345 goto free_s2;
3346
3347 for (i = 0; i < out_len; i++)
3348 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3349 /* success, now store the new meaningful data length */
3350 out->data_len = out_len;
3351 success = true1;
3352
3353 ssl_print_string("PRF out",out);
3354free_s2:
3355 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3356free_s1:
3357 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3358free_seed:
3359 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3360free_md5:
3361 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3362free_sha:
3363 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3364 return success;
3365}
3366
3367static bool_Bool
3368tls12_prf(int md, StringInfo* secret, const char* usage,
3369 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3370{
3371 StringInfo label_seed;
3372 int success;
3373 size_t usage_len, rnd2_len;
3374 rnd2_len = rnd2 ? rnd2->data_len : 0;
3375
3376 usage_len = strlen(usage);
3377 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3378 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3379 return false0;
3380 }
3381 memcpy(label_seed.data, usage, usage_len);
3382 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3383 if (rnd2_len > 0)
3384 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3385
3386 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3387 success = tls_hash(secret, &label_seed, md, out, out_len);
3388 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3389 if(success != -1){
3390 ssl_print_string("PRF out", out);
3391 return true1;
3392 }
3393 return false0;
3394}
3395
3396static bool_Bool
3397ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3398 StringInfo *out, unsigned out_len)
3399{
3400 SSL_MD5_CTXgcry_md_hd_t md5;
3401 uint8_t tmp[16];
3402
3403 if (ssl_md5_init(&md5) != 0) {
3404 return false0;
3405 }
3406 ssl_md5_update(&md5,r1->data,r1->data_len);
3407 ssl_md5_update(&md5,r2->data,r2->data_len);
3408 ssl_md5_final(tmp,&md5);
3409 ssl_md5_cleanup(&md5);
3410
3411 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3411, "out_len <= sizeof(tmp)"))));
3412 ssl_data_set(out, tmp, out_len);
3413 ssl_print_string("export iv", out);
3414 return true1;
3415}
3416
3417static bool_Bool
3418ssl3_prf(StringInfo* secret, const char* usage,
3419 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3420{
3421 SSL_MD5_CTXgcry_md_hd_t md5;
3422 SSL_SHA_CTXgcry_md_hd_t sha;
3423 unsigned off;
3424 int i = 0,j;
3425 uint8_t buf[20];
3426
3427 if (ssl_sha_init(&sha) != 0) {
3428 return false0;
3429 }
3430 if (ssl_md5_init(&md5) != 0) {
3431 ssl_sha_cleanup(&sha);
3432 return false0;
3433 }
3434 for (off = 0; off < out_len; off += 16) {
3435 unsigned char outbuf[16];
3436 i++;
3437
3438 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3439 /* A, BB, CCC, ... */
3440 for(j=0;j<i;j++){
3441 buf[j]=64+i;
3442 }
3443
3444 ssl_sha_update(&sha,buf,i);
3445 ssl_sha_update(&sha,secret->data,secret->data_len);
3446
3447 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3448 if (rnd2)
3449 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3450 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3451 }
3452 else{
3453 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3454 if (rnd2)
3455 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3456 }
3457
3458 ssl_sha_final(buf,&sha);
3459 ssl_sha_reset(&sha);
3460
3461 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3462 secret->data_len);
3463 ssl_md5_update(&md5,secret->data,secret->data_len);
3464 ssl_md5_update(&md5,buf,20);
3465 ssl_md5_final(outbuf,&md5);
3466 ssl_md5_reset(&md5);
3467
3468 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3469 }
3470 ssl_sha_cleanup(&sha);
3471 ssl_md5_cleanup(&md5);
3472 out->data_len = out_len;
3473
3474 return true1;
3475}
3476
3477/* out_len is the wanted output length for the pseudorandom function.
3478 * Ensure that ssl->cipher_suite is set. */
3479static bool_Bool
3480prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3481 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3482{
3483 switch (ssl->session.version) {
3484 case SSLV3_VERSION0x300:
3485 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3486
3487 case TLSV1_VERSION0x301:
3488 case TLSV1DOT1_VERSION0x302:
3489 case DTLSV1DOT0_VERSION0xfeff:
3490 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3491 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3492
3493 default: /* TLSv1.2 */
3494 switch (ssl->cipher_suite->dig) {
3495 case DIG_SM30x44:
3496#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3497 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3498 out, out_len);
3499#else
3500 return false0;
3501#endif
3502 case DIG_SHA3840x43:
3503 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3504 out, out_len);
3505 default:
3506 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3507 out, out_len);
3508 }
3509 }
3510}
3511
3512static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3513{
3514 SSL_MD5_CTXgcry_md_hd_t md5;
3515 SSL_SHA_CTXgcry_md_hd_t sha;
3516
3517 if (ssl_data_alloc(out, 36) < 0)
15
←
Calling 'ssl_data_alloc'
→
19
←
Returned allocated memory
→
20
←
Taking false branch
→
3518 return -1;
3519
3520 if (ssl_md5_init(&md5) != 0)
21
←
Taking true branch
→
3521 return -1;
3522 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
3523 ssl_md5_final(out->data,&md5);
3524 ssl_md5_cleanup(&md5);
3525
3526 if (ssl_sha_init(&sha) != 0)
3527 return -1;
3528 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
3529 ssl_sha_final(out->data+16,&sha);
3530 ssl_sha_cleanup(&sha);
3531 return 0;
3532}
3533
3534static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3535{
3536 SSL_MDgcry_md_hd_t mc;
3537 uint8_t tmp[48];
3538 unsigned len;
3539
3540 if (ssl_md_init(&mc, md) != 0)
3541 return -1;
3542 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
3543 ssl_md_final(&mc, tmp, &len);
3544 ssl_md_cleanup(&mc);
3545
3546 if (ssl_data_alloc(out, len) < 0)
3547 return -1;
3548 memcpy(out->data, tmp, len);
3549 return 0;
3550}
3551
3552bool_Bool
3553tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3554{
3555 if (!tls_psk || (tls_psk[0] == 0)) {
3556 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3557 return false0;
3558 }
3559
3560 wmem_free(wmem_file_scope(), tls_session->psk.data);
3561 /* convert hex string into char*/
3562 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3563 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3564 G_STRFUNC((const char*) (__func__)));
3565 return false0;
3566 }
3567
3568 if (tls_session->psk.data_len >= (2 << 15)) {
3569 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3570 G_STRFUNC((const char*) (__func__)));
3571 wmem_free(wmem_file_scope(), tls_session->psk.data);
3572 tls_session->psk.data = NULL((void*)0);
3573 tls_session->psk.data_len = 0;
3574 return false0;
3575 }
3576
3577 return true1;
3578}
3579
3580/**
3581 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3582 * inlined and removed once support for draft 19 and before is dropped.
3583 */
3584static inline const char *
3585tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3586{
3587 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3588 return "TLS 1.3, ";
3589 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3590 return "dtls13";
3591 } else {
3592 return "tls13 ";
3593 }
3594}
3595
3596/*
3597 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3598 * custom label prefix. If "context_hash" is NULL, then an empty context is
3599 * used. Otherwise it must have the same length as the hash algorithm output.
3600 */
3601bool_Bool
3602tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3603 const char *label_prefix, const char *label,
3604 const uint8_t *context_hash, uint8_t context_length,
3605 uint16_t out_len, unsigned char **out)
3606{
3607 /* RFC 8446 Section 7.1:
3608 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3609 * HKDF-Expand(Secret, HkdfLabel, Length)
3610 * struct {
3611 * uint16 length = Length;
3612 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3613 * opaque context<0..255> = Context;
3614 * } HkdfLabel;
3615 *
3616 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3617 * HKDF-Expand(PRK, info, L) -> OKM
3618 */
3619 gcry_error_t err;
3620 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3621 const unsigned label_length = (unsigned) strlen(label);
3622
3623 /* Some sanity checks */
3624 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3624, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3625
3626 /* info = HkdfLabel { length, label, context } */
3627 GByteArray *info = g_byte_array_new();
3628 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3629 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3630
3631 const uint8_t label_vector_length = label_prefix_length + label_length;
3632 g_byte_array_append(info, &label_vector_length, 1);
3633 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3634 g_byte_array_append(info, (const uint8_t*)label, label_length);
3635
3636 g_byte_array_append(info, &context_length, 1);
3637 if (context_length) {
3638 g_byte_array_append(info, context_hash, context_length);
3639 }
3640
3641 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3642 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3643 g_byte_array_free(info, true1);
3644
3645 if (err) {
3646 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3647 wmem_free(NULL((void*)0), *out);
3648 *out = NULL((void*)0);
3649 return false0;
3650 }
3651
3652 return true1;
3653}
3654
3655bool_Bool
3656tls13_hkdf_expand_label(int md, const StringInfo *secret,
3657 const char *label_prefix, const char *label,
3658 uint16_t out_len, unsigned char **out)
3659{
3660 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3661}
3662
3663static bool_Bool
3664tls13_derive_secret(int md, const StringInfo *secret,
3665 const char *label_prefix, const char *label,
3666 const uint8_t *context, unsigned context_length,
3667 uint16_t out_len, unsigned char **out)
3668{
3669 SSL_MDgcry_md_hd_t mc;
3670 uint8_t context_hash[DIGEST_MAX_SIZE48];
3671 unsigned hash_len;
3672
3673 if (ssl_md_init(&mc, md) != 0)
3674 return false0;
3675 ssl_md_update(&mc, context, context_length);
3676 ssl_md_final(&mc, context_hash, &hash_len);
3677 ssl_md_cleanup(&mc);
3678
3679 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3680}
3681
3682/* HMAC and the Pseudorandom function }}} */
3683
3684/* Record Decompression (after decryption) {{{ */
3685#ifdef USE_ZLIB_OR_ZLIBNG
3686/* memory allocation functions for zlib initialization */
3687static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3688{
3689 return g_malloc0(no*size);
3690}
3691static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3692{
3693 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3694}
3695#endif /* USE_ZLIB_OR_ZLIBNG */
3696
3697static SslDecompress*
3698ssl_create_decompressor(int compression)
3699{
3700 SslDecompress *decomp;
3701#ifdef USE_ZLIB_OR_ZLIBNG
3702 int err;
3703#endif
3704
3705 if (compression == 0) return NULL((void*)0);
3706 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3707 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3708 decomp->compression = compression;
3709 switch (decomp->compression) {
3710#ifdef USE_ZLIB_OR_ZLIBNG
3711 case 1: /* DEFLATE */
3712 decomp->istream.zalloc = ssl_zalloc;
3713 decomp->istream.zfree = ssl_zfree;
3714 decomp->istream.opaque = Z_NULL0;
3715 decomp->istream.next_in = Z_NULL0;
3716 decomp->istream.next_out = Z_NULL0;
3717 decomp->istream.avail_in = 0;
3718 decomp->istream.avail_out = 0;
3719 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3720 if (err != Z_OK0) {
3721 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3722 return NULL((void*)0);
3723 }
3724 break;
3725#endif /* USE_ZLIB_OR_ZLIBNG */
3726 default:
3727 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3728 return NULL((void*)0);
3729 }
3730 return decomp;
3731}
3732
3733#ifdef USE_ZLIB_OR_ZLIBNG
3734static int
3735ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3736{
3737 int err;
3738
3739 switch (decomp->compression) {
3740 case 1: /* DEFLATE */
3741 err = Z_OK0;
3742 if (out_str->data_len < 16384) { /* maximal plain length */
3743 ssl_data_realloc(out_str, 16384);
3744 }
3745#ifdef z_constconst
3746 decomp->istream.next_in = in;
3747#else
3748DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3749 decomp->istream.next_in = (Bytef *)in;
3750DIAG_ON(cast-qual)clang diagnostic pop
3751#endif
3752 decomp->istream.avail_in = inl;
3753 decomp->istream.next_out = out_str->data;
3754 decomp->istream.avail_out = out_str->data_len;
3755 if (inl > 0)
3756 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3757 if (err != Z_OK0) {
3758 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3759 return -1;
3760 }
3761 *outl = out_str->data_len - decomp->istream.avail_out;
3762 break;
3763 default:
3764 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3765 return -1;
3766 }
3767 return 0;
3768}
3769#else /* USE_ZLIB_OR_ZLIBNG */
3770int
3771ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3772{
3773 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3774 return -1;
3775}
3776#endif /* USE_ZLIB_OR_ZLIBNG */
3777/* Record Decompression (after decryption) }}} */
3778
3779/* Create a new structure to store decrypted chunks. {{{ */
3780static SslFlow*
3781ssl_create_flow(void)
3782{
3783 SslFlow *flow;
3784
3785 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3786 flow->byte_seq = 0;
3787 flow->flags = 0;
3788 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3789 return flow;
3790}
3791/* }}} */
3792
3793/* Use the negotiated security parameters for decryption. {{{ */
3794void
3795ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3796{
3797 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3798 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3799 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3800 *new_decoder ? "" : " (No decoder found - retransmission?)");
3801 if (*new_decoder) {
3802 *dest = *new_decoder;
3803 *new_decoder = NULL((void*)0);
3804 }
3805}
3806/* }}} */
3807
3808/* Init cipher state given some security parameters. {{{ */
3809static bool_Bool
3810ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3811
3812static SslDecoder*
3813ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3814 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3815{
3816 SslDecoder *dec;
3817 ssl_cipher_mode_t mode = cipher_suite->mode;
3818
3819 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3820 /* init mac buffer: mac storage is embedded into decoder struct to save a
3821 memory allocation and waste samo more memory*/
3822 dec->cipher_suite=cipher_suite;
3823 dec->compression = compression;
3824 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
3825 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
3826 // the special case for NULL ciphers, even if there is insufficiency
3827 // keying material (including MAC key), we will can still create
3828 // decoders since "decryption" is easy for such ciphers.
3829 dec->mac_key.data = dec->_mac_key_or_write_iv;
3830 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
3831 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
3832 // Input for the nonce, to be used with AEAD ciphers.
3833 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3833, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
3834 dec->write_iv.data = dec->_mac_key_or_write_iv;
3835 ssl_data_set(&dec->write_iv, iv, iv_length);
3836 }
3837 dec->seq = 0;
3838 dec->decomp = ssl_create_decompressor(compression);
3839 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
3840
3841 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
3842 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
3843 cipher_algo, cipher_suite->mode);
3844 return NULL((void*)0);
3845 }
3846
3847 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
3848 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
3849 mode = MODE_ECB;
3850 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
3851 mode = MODE_STREAM;
3852 } else {
3853 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
3854 return NULL((void*)0);
3855 }
3856
3857 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
3858 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
3859 cipher_algo, MODE_ECB);
3860 ssl_cipher_cleanup(&dec->evp);
3861 dec->evp = NULL((void*)0);
3862 return NULL((void*)0);
3863 }
3864 } else {
3865 dec->sn_evp = NULL((void*)0);
3866 }
3867
3868 dec->dtls13_aad.data = NULL((void*)0);
3869 dec->dtls13_aad.data_len = 0;
3870 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
3871 return dec;
3872}
3873
3874static bool_Bool
3875ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
3876{
3877 SslDecoder *dec = (SslDecoder *) user_data;
3878
3879 if (dec->evp)
3880 ssl_cipher_cleanup(&dec->evp);
3881 if (dec->sn_evp)
3882 ssl_cipher_cleanup(&dec->sn_evp);
3883
3884#ifdef USE_ZLIB_OR_ZLIBNG
3885 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
3886 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
3887#endif
3888
3889 return false0;
3890}
3891/* }}} */
3892
3893/* (Pre-)master secrets calculations {{{ */
3894#ifdef HAVE_LIBGNUTLS1
3895static bool_Bool
3896ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
3897 StringInfo *encrypted_pre_master,
3898 GHashTable *key_hash);
3899#endif /* HAVE_LIBGNUTLS */
3900
3901static bool_Bool
3902ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
3903 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
3904
3905bool_Bool
3906ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
3907 uint32_t length, tvbuff_t *tvb, uint32_t offset,
3908 const char *ssl_psk, packet_info *pinfo,
3909#ifdef HAVE_LIBGNUTLS1
3910 GHashTable *key_hash,
3911#endif
3912 const ssl_master_key_map_t *mk_map)
3913{
3914 /* check for required session data */
3915 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
3916 G_STRFUNC((const char*) (__func__)), ssl_session->state);
3917 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
3918 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
3919 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
3920 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
3921 return false0;
3922 }
3923
3924 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
3925 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
3926 return false0;
3927 }
3928
3929 /* check to see if the PMS was provided to us*/
3930 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
3931 mk_map->pms, &ssl_session->client_random)) {
3932 return true1;
3933 }
3934
3935 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
3936 {
3937 /* calculate pre master secret*/
3938 StringInfo pre_master_secret;
3939 unsigned psk_len, pre_master_len;
3940
3941 if (!tls_load_psk(ssl_session, ssl_psk)) {
3942 return false0;
3943 }
3944 psk_len = ssl_session->psk.data_len;
3945
3946 pre_master_len = psk_len * 2 + 4;
3947
3948 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
3949 pre_master_secret.data_len = pre_master_len;
3950 /* 2 bytes psk_len*/
3951 pre_master_secret.data[0] = psk_len >> 8;
3952 pre_master_secret.data[1] = psk_len & 0xFF;
3953 /* psk_len bytes times 0*/
3954 memset(&pre_master_secret.data[2], 0, psk_len);
3955 /* 2 bytes psk_len*/
3956 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
3957 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
3958 /* psk*/
3959 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
3960
3961 ssl_session->pre_master_secret.data = pre_master_secret.data;
3962 ssl_session->pre_master_secret.data_len = pre_master_len;
3963 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
3964
3965 /* Remove the master secret if it was there.
3966 This forces keying material regeneration in
3967 case we're renegotiating */
3968 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
3969 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
3970 return true1;
3971 }
3972 else
3973 {
3974 unsigned encrlen, skip;
3975 encrlen = length;
3976 skip = 0;
3977
3978 /* get encrypted data, on tls1 we have to skip two bytes
3979 * (it's the encrypted len and should be equal to record len - 2)
3980 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
3981 */
3982 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
3983 (ssl_session->session.version == TLSV1_VERSION0x301 ||
3984 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
3985 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
3986 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
3987 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
3988 ssl_session->session.version == TLCPV1_VERSION0x101 ))
3989 {
3990 encrlen = tvb_get_ntohs(tvb, offset);
3991 skip = 2;
3992 if (encrlen > length - 2)
3993 {
3994 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
3995 G_STRFUNC((const char*) (__func__)), encrlen, length);
3996 return false0;
3997 }
3998 }
3999 /* the valid lower bound is higher than 8, but it is sufficient for the
4000 * ssl keylog file below */
4001 if (encrlen < 8) {
4002 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4003 G_STRFUNC((const char*) (__func__)), encrlen);
4004 return false0;
4005 }
4006
4007 StringInfo encrypted_pre_master = {
4008 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4009 .data_len = encrlen,
4010 };
4011
4012#ifdef HAVE_LIBGNUTLS1
4013 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4014 if (ssl_session->cert_key_id) {
4015 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4016 return true1;
4017
4018 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4019 G_STRFUNC((const char*) (__func__)));
4020 }
4021#endif /* HAVE_LIBGNUTLS */
4022
4023 /* try to find the pre-master secret from the encrypted one. The
4024 * ssl key logfile stores only the first 8 bytes, so truncate it */
4025 encrypted_pre_master.data_len = 8;
4026 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4027 true1, mk_map->pre_master, &encrypted_pre_master))
4028 return true1;
4029 }
4030 return false0;
4031}
4032
4033/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4034int
4035ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4036{
4037 StringInfo key_block = { NULL((void*)0), 0 };
4038 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4039 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4040 int needed;
4041 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4042 unsigned encr_key_len, write_iv_len = 0;
4043 bool_Bool is_export_cipher;
4044 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4045 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4046 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4047
4048 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4049 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
1
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
→
2
←
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
→
3
←
Taking false branch
→
4050 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4051 return -1;
4052 }
4053
4054 /* check for enough info to proceed */
4055 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4056 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4057 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4
←
Assuming the condition is false
→
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
4058 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4059 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4060 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4061 /* Special case: for NULL encryption, allow dissection of data even if
4062 * the Client Hello is missing (MAC keys are now skipped though). */
4063 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4064 if ((ssl_session->state & need_all) == need_all &&
4065 cipher_suite->enc == ENC_NULL0x3D) {
4066 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4067 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4068 goto create_decoders;
4069 }
4070
4071 return -1;
4072 }
4073
4074 /* if master key is not available, generate is from the pre-master secret */
4075 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
7
←
Assuming the condition is true
→
8
←
Taking true branch
→
4076 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
9
←
Assuming the condition is true
→
10
←
Taking true branch
→
4077 StringInfo handshake_hashed_data;
4078 int ret;
4079
4080 handshake_hashed_data.data = NULL((void*)0);
4081 handshake_hashed_data.data_len = 0;
4082
4083 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4084 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4085 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4085, "ssl_session->handshake_data.data_len > 0"
))));
11
←
Assuming field 'data_len' is > 0
→
12
←
'?' condition is true
→
4086
4087 switch(ssl_session->session.version) {
13
←
Control jumps to 'case 257:' at line 4092
→
4088 case TLSV1_VERSION0x301:
4089 case TLSV1DOT1_VERSION0x302:
4090 case DTLSV1DOT0_VERSION0xfeff:
4091 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4092 case TLCPV1_VERSION0x101:
4093 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
14
←
Calling 'tls_handshake_hash'
→
22
←
Returned allocated memory
→
4094 break;
4095 default:
4096 switch (cipher_suite->dig) {
4097 case DIG_SHA3840x43:
4098 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4099 break;
4100 default:
4101 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4102 break;
4103 }
4104 break;
4105 }
4106 if (ret
23.1
'ret' is -1
) {
23
←
 Execution continues on line 4106
→
24
←
Taking true branch
→
4107 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
25
←
Potential leak of memory pointed to by 'handshake_hashed_data.data'
4108 return -1;
4109 }
4110
4111 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4112 ssl_session->handshake_data.data = NULL((void*)0);
4113 ssl_session->handshake_data.data_len = 0;
4114
4115 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4116 &handshake_hashed_data,
4117 NULL((void*)0), &ssl_session->master_secret,
4118 SSL_MASTER_SECRET_LENGTH48)) {
4119 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4120 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4121 return -1;
4122 }
4123 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4124 } else {
4125 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4126 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4127 ssl_print_string("client random",&ssl_session->client_random);
4128 ssl_print_string("server random",&ssl_session->server_random);
4129 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4130 &ssl_session->client_random,
4131 &ssl_session->server_random, &ssl_session->master_secret,
4132 SSL_MASTER_SECRET_LENGTH48)) {
4133 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4134 return -1;
4135 }
4136 }
4137 ssl_print_string("master secret",&ssl_session->master_secret);
4138
4139 /* the pre-master secret has been 'consumed' so we must clear it now */
4140 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4141 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4142 }
4143
4144 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4145 if (cipher_suite->enc != ENC_NULL0x3D) {
4146 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4147 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4148 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4149 if (cipher_algo == 0) {
4150 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4151 return -1;
4152 }
4153 }
4154
4155 /* Export ciphers consume less material from the key block. */
4156 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4157 is_export_cipher = encr_key_len > 0;
4158 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4159 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4160 }
4161
4162 if (cipher_suite->mode == MODE_CBC) {
4163 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4164 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4165 /* account for a four-byte salt for client and server side (from
4166 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4167 write_iv_len = 4;
4168 } else if (cipher_suite->mode == MODE_POLY1305) {
4169 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4170 write_iv_len = 12;
4171 }
4172
4173 /* Compute the key block. First figure out how much data we need */
4174 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4175 needed += 2 * encr_key_len; /* encryption key */
4176 needed += 2 * write_iv_len; /* write IV */
4177
4178 key_block.data = (unsigned char *)g_malloc(needed);
4179 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4180 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4181 &ssl_session->server_random,&ssl_session->client_random,
4182 &key_block, needed)) {
4183 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4184 goto fail;
4185 }
4186 ssl_print_string("key expansion", &key_block);
4187
4188 ptr=key_block.data;
4189 /* client/server write MAC key (for non-AEAD ciphers) */
4190 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4191 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4192 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4193 }
4194 /* client/server write encryption key */
4195 c_wk=ptr; ptr += encr_key_len;
4196 s_wk=ptr; ptr += encr_key_len;
4197 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4198 if (write_iv_len > 0) {
4199 c_iv=ptr; ptr += write_iv_len;
4200 s_iv=ptr; /* ptr += write_iv_len; */
4201 }
4202
4203 /* export ciphers work with a smaller key length */
4204 if (is_export_cipher) {
4205 if (cipher_suite->mode == MODE_CBC) {
4206
4207 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4208 all we should need. This is a sanity check */
4209 if (write_iv_len > MAX_BLOCK_SIZE16) {
4210 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4211 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4212 goto fail;
4213 }
4214
4215 if(ssl_session->session.version==SSLV3_VERSION0x300){
4216 /* The length of these fields are ignored by this caller */
4217 StringInfo iv_c, iv_s;
4218 iv_c.data = _iv_c;
4219 iv_s.data = _iv_s;
4220
4221 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4222 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4223 &ssl_session->server_random, &iv_c, write_iv_len)) {
4224 goto fail;
4225 }
4226 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4227 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4228 &ssl_session->client_random, &iv_s, write_iv_len)) {
4229 goto fail;
4230 }
4231 }
4232 else{
4233 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4234 StringInfo iv_block;
4235 StringInfo key_null;
4236 uint8_t _key_null;
4237
4238 key_null.data = &_key_null;
4239 key_null.data_len = 0;
4240
4241 iv_block.data = _iv_block;
4242
4243 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4244 if (!prf(ssl_session, &key_null, "IV block",
4245 &ssl_session->client_random,
4246 &ssl_session->server_random, &iv_block,
4247 write_iv_len * 2)) {
4248 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4249 goto fail;
4250 }
4251
4252 memcpy(_iv_c, iv_block.data, write_iv_len);
4253 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4254 }
4255
4256 c_iv=_iv_c;
4257 s_iv=_iv_s;
4258 }
4259
4260 if (ssl_session->session.version==SSLV3_VERSION0x300){
4261
4262 SSL_MD5_CTXgcry_md_hd_t md5;
4263 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4264
4265 if (ssl_md5_init(&md5) != 0)
4266 goto fail;
4267 ssl_md5_update(&md5,c_wk,encr_key_len);
4268 ssl_md5_update(&md5,ssl_session->client_random.data,
4269 ssl_session->client_random.data_len);
4270 ssl_md5_update(&md5,ssl_session->server_random.data,
4271 ssl_session->server_random.data_len);
4272 ssl_md5_final(_key_c,&md5);
4273 ssl_md5_cleanup(&md5);
4274 c_wk=_key_c;
4275
4276 if (ssl_md5_init(&md5) != 0)
4277 goto fail;
4278 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4279 ssl_md5_update(&md5,s_wk,encr_key_len);
4280 ssl_md5_update(&md5,ssl_session->server_random.data,
4281 ssl_session->server_random.data_len);
4282 ssl_md5_update(&md5,ssl_session->client_random.data,
4283 ssl_session->client_random.data_len);
4284 ssl_md5_final(_key_s,&md5);
4285 ssl_md5_cleanup(&md5);
4286 s_wk=_key_s;
4287 }
4288 else{
4289 StringInfo key_c, key_s, k;
4290 key_c.data = _key_c;
4291 key_s.data = _key_s;
4292
4293 k.data = c_wk;
4294 k.data_len = encr_key_len;
4295 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4296 if (!prf(ssl_session, &k, "client write key",
4297 &ssl_session->client_random,
4298 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4299 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4300 goto fail;
4301 }
4302 c_wk=_key_c;
4303
4304 k.data = s_wk;
4305 k.data_len = encr_key_len;
4306 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4307 if (!prf(ssl_session, &k, "server write key",
4308 &ssl_session->client_random,
4309 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4310 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4311 goto fail;
4312 }
4313 s_wk=_key_s;
4314 }
4315 }
4316
4317 /* show key material info */
4318 if (c_mk != NULL((void*)0)) {
4319 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4320 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4321 }
4322 ssl_print_data("Client Write key", c_wk, encr_key_len);
4323 ssl_print_data("Server Write key", s_wk, encr_key_len);
4324 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4325 if (write_iv_len > 0) {
4326 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4327 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4328 }
4329
4330create_decoders:
4331 /* create both client and server ciphers*/
4332 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4333 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4334 if (!ssl_session->client_new) {
4335 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4336 goto fail;
4337 }
4338 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4339 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4340 if (!ssl_session->server_new) {
4341 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4342 goto fail;
4343 }
4344
4345 /* Continue the SSL stream after renegotiation with new keys. */
4346 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4347 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4348
4349 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4350 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4351 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4352 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4353 return 0;
4354
4355fail:
4356 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4357 return -1;
4358}
4359
4360/* Generated the key material based on the given secret. */
4361bool_Bool
4362tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4363{
4364 bool_Bool success = false0;
4365 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4366 unsigned char *sn_key = NULL((void*)0);
4367 SslDecoder *decoder;
4368 unsigned key_length, iv_length;
4369 int hash_algo;
4370 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4371 int cipher_algo;
4372
4373 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4374 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4375 ssl_session->session.version);
4376 return false0;
4377 }
4378
4379 if (cipher_suite == NULL((void*)0)) {
4380 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4381 return false0;
4382 }
4383
4384 if (cipher_suite->kex != KEX_TLS130x23) {
4385 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4386 return false0;
4387 }
4388
4389 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4390 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4391 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4392 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4393 if (cipher_algo == 0) {
4394 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4395 return false0;
4396 }
4397
4398 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4399 hash_algo = ssl_get_digest_by_name(hash_name);
4400 if (!hash_algo) {
4401 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4402 return false0;
4403 }
4404
4405 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4406 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4407 iv_length = 12;
4408 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4409
4410 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4411 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4412 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4413 return false0;
4414 }
4415 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4416 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4417 goto end;
4418 }
4419
4420 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4421 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4422 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4423 goto end;
4424 }
4425 }
4426
4427 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4428 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4429 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4430 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4431 }
4432
4433 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4434 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4435 if (!decoder) {
4436 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4437 goto end;
4438 }
4439
4440 /* Continue the TLS session with new keys, but reuse old flow to keep things
4441 * like "Follow TLS" working (by linking application data records). */
4442 if (is_from_server) {
4443 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4444 ssl_session->server = decoder;
4445 } else {
4446 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4447 ssl_session->client = decoder;
4448 }
4449 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4450 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4451 success = true1;
4452
4453end:
4454 wmem_free(NULL((void*)0), write_key);
4455 wmem_free(NULL((void*)0), write_iv);
4456 if (sn_key)
4457 wmem_free(NULL((void*)0), sn_key);
4458 return success;
4459}
4460/* (Pre-)master secrets calculations }}} */
4461
4462#ifdef HAVE_LIBGNUTLS1
4463/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4464static bool_Bool
4465ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4466 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4467{
4468 int ret;
4469
4470 if (!encrypted_pre_master)
4471 return false0;
4472
4473 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4474 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4475 "(cipher suite 0x%04X %s) and cannot be decrypted "
4476 "using a RSA private key file.\n",
4477 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4478 val_to_str_ext_const(ssl_session->session.cipher,
4479 &ssl_31_ciphersuite_ext, "unknown"));
4480 return false0;
4481 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4482 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4483 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4484 return false0;
4485 }
4486
4487 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4488
4489 ssl_print_string("pre master encrypted", encrypted_pre_master);
4490 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4491 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4492 gnutls_datum_t pms = { 0 };
4493 if (pk) {
4494 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4495 char *err = NULL((void*)0);
4496 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4497 if (!private_key) {
4498 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4499 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4500 return false0;
4501 }
4502
4503 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4504 rsa_private_key_free(private_key);
4505 if (pms.size == 0) {
4506 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4507 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4508 return false0;
4509 }
4510 } else {
4511 // Try to decrypt using a hardware token.
4512 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4513 if (ret < 0) {
4514 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4515 return false0;
4516 }
4517 }
4518
4519 if (pms.size != 48) {
4520 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4521 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4522 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4523 return false0;
4524 }
4525
4526 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4527 ssl_session->pre_master_secret.data_len = 48;
4528 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4529 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4530
4531 /* Remove the master secret if it was there.
4532 This forces keying material regeneration in
4533 case we're renegotiating */
4534 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4535 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4536 return true1;
4537} /* }}} */
4538#endif /* HAVE_LIBGNUTLS */
4539
4540/* Decryption integrity check {{{ */
4541
4542static int
4543tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4544 uint32_t datalen, uint8_t* mac)
4545{
4546 SSL_HMACgcry_md_hd_t hm;
4547 int md;
4548 uint32_t len;
4549 uint8_t buf[DIGEST_MAX_SIZE48];
4550 int16_t temp;
4551
4552 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4553 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4554 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4555
4556 if (ssl_hmac_init(&hm,md) != 0)
4557 return -1;
4558 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4559 return -1;
4560
4561 /* hash sequence number */
4562 phtonu64(buf, decoder->seq);
4563
4564 decoder->seq++;
4565
4566 ssl_hmac_update(&hm,buf,8);
4567
4568 /* hash content type */
4569 buf[0]=ct;
4570 ssl_hmac_update(&hm,buf,1);
4571
4572 /* hash version,data length and data*/
4573 /* *((int16_t*)buf) = g_htons(ver); */
4574 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4575 memcpy(buf, &temp, 2);
4576 ssl_hmac_update(&hm,buf,2);
4577
4578 /* *((int16_t*)buf) = g_htons(datalen); */
4579 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4580 memcpy(buf, &temp, 2);
4581 ssl_hmac_update(&hm,buf,2);
4582 ssl_hmac_update(&hm,data,datalen);
4583
4584 /* get digest and digest len*/
4585 len = sizeof(buf);
4586 ssl_hmac_final(&hm,buf,&len);
4587 ssl_hmac_cleanup(&hm);
4588 ssl_print_data("Mac", buf, len);
4589 if(memcmp(mac,buf,len))
4590 return -1;
4591
4592 return 0;
4593}
4594
4595static int
4596ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4597 uint32_t datalen, uint8_t* mac)
4598{
4599 SSL_MDgcry_md_hd_t mc;
4600 int md;
4601 uint32_t len;
4602 uint8_t buf[64],dgst[20];
4603 int pad_ct;
4604 int16_t temp;
4605
4606 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4607
4608 /* get cipher used for digest computation */
4609 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4610 if (ssl_md_init(&mc,md) !=0)
4611 return -1;
4612
4613 /* do hash computation on data && padding */
4614 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4615
4616 /* hash padding*/
4617 memset(buf,0x36,pad_ct);
4618 ssl_md_update(&mc,buf,pad_ct);
4619
4620 /* hash sequence number */
4621 phtonu64(buf, decoder->seq);
4622 decoder->seq++;
4623 ssl_md_update(&mc,buf,8);
4624
4625 /* hash content type */
4626 buf[0]=ct;
4627 ssl_md_update(&mc,buf,1);
4628
4629 /* hash data length in network byte order and data*/
4630 /* *((int16_t* )buf) = g_htons(datalen); */
4631 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4632 memcpy(buf, &temp, 2);
4633 ssl_md_update(&mc,buf,2);
4634 ssl_md_update(&mc,data,datalen);
4635
4636 /* get partial digest */
4637 ssl_md_final(&mc,dgst,&len);
4638 ssl_md_reset(&mc);
4639
4640 /* hash mac key */
4641 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4642
4643 /* hash padding and partial digest*/
4644 memset(buf,0x5c,pad_ct);
4645 ssl_md_update(&mc,buf,pad_ct);
4646 ssl_md_update(&mc,dgst,len);
4647
4648 ssl_md_final(&mc,dgst,&len);
4649 ssl_md_cleanup(&mc);
4650
4651 if(memcmp(mac,dgst,len))
4652 return -1;
4653
4654 return 0;
4655}
4656
4657static int
4658dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4659 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4660{
4661 SSL_HMACgcry_md_hd_t hm;
4662 int md;
4663 uint32_t len;
4664 uint8_t buf[DIGEST_MAX_SIZE48];
4665 int16_t temp;
4666
4667 int ver = ssl->session.version;
4668 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4669
4670 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4671 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4672 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4673
4674 if (ssl_hmac_init(&hm,md) != 0)
4675 return -1;
4676 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4677 return -1;
4678
4679 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4680
4681 if (is_cid && !ssl->session.deprecated_cid) {
4682 /* hash seq num placeholder */
4683 memset(buf,0xFF,8);
4684 ssl_hmac_update(&hm,buf,8);
4685
4686 /* hash content type + cid length + content type */
4687 buf[0]=ct;
4688 buf[1]=cidl;
4689 buf[2]=ct;
4690 ssl_hmac_update(&hm,buf,3);
4691
4692 /* hash version */
4693 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4694 memcpy(buf, &temp, 2);
4695 ssl_hmac_update(&hm,buf,2);
4696
4697 /* hash sequence number */
4698 phtonu64(buf, decoder->seq);
4699 buf[0]=decoder->epoch>>8;
4700 buf[1]=(uint8_t)decoder->epoch;
4701 ssl_hmac_update(&hm,buf,8);
4702
4703 /* hash cid */
4704 ssl_hmac_update(&hm,cid,cidl);
4705 } else {
4706 /* hash sequence number */
4707 phtonu64(buf, decoder->seq);
4708 buf[0]=decoder->epoch>>8;
4709 buf[1]=(uint8_t)decoder->epoch;
4710 ssl_hmac_update(&hm,buf,8);
4711
4712 /* hash content type */
4713 buf[0]=ct;
4714 ssl_hmac_update(&hm,buf,1);
4715
4716 /* hash version */
4717 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4718 memcpy(buf, &temp, 2);
4719 ssl_hmac_update(&hm,buf,2);
4720
4721 if (is_cid && ssl->session.deprecated_cid) {
4722 /* hash cid */
4723 ssl_hmac_update(&hm,cid,cidl);
4724
4725 /* hash cid length */
4726 buf[0] = cidl;
4727 ssl_hmac_update(&hm,buf,1);
4728 }
4729 }
4730
4731 /* data length and data */
4732 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4733 memcpy(buf, &temp, 2);
4734 ssl_hmac_update(&hm,buf,2);
4735 ssl_hmac_update(&hm,data,datalen);
4736
4737 /* get digest and digest len */
4738 len = sizeof(buf);
4739 ssl_hmac_final(&hm,buf,&len);
4740 ssl_hmac_cleanup(&hm);
4741 ssl_print_data("Mac", buf, len);
4742 if(memcmp(mac,buf,len))
4743 return -1;
4744
4745 return 0;
4746}
4747/* Decryption integrity check }}} */
4748
4749
4750static bool_Bool
4751tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4752 uint8_t ct, uint16_t record_version,
4753 bool_Bool ignore_mac_failed,
4754 const unsigned char *in, uint16_t inl,
4755 const unsigned char *cid, uint8_t cidl,
4756 StringInfo *out_str, unsigned *outl)
4757{
4758 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4759 * GenericAEADCipher: { nonce_explicit, [content] }
4760 * In TLS 1.3 this explicit nonce is gone.
4761 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4762 * ciphertext and authentication tag.
4763 */
4764 const uint16_t version = ssl->session.version;
4765 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4766 gcry_error_t err;
4767 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4768 unsigned ciphertext_len, auth_tag_len;
4769 unsigned char nonce[12];
4770 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4771 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4772 const uint8_t draft_version = ssl->session.tls13_draft_version;
4773 const unsigned char *auth_tag_wire;
4774 unsigned char auth_tag_calc[16];
4775 unsigned char *aad = NULL((void*)0);
4776 unsigned aad_len = 0;
4777
4778 switch (cipher_mode) {
4779 case MODE_GCM:
4780 case MODE_CCM:
4781 case MODE_POLY1305:
4782 auth_tag_len = 16;
4783 break;
4784 case MODE_CCM_8:
4785 auth_tag_len = 8;
4786 break;
4787 default:
4788 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4789 return false0;
4790 }
4791
4792 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4793 if (is_v12 && cipher_mode != MODE_POLY1305) {
4794 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4795 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4796 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4797 return false0;
4798 }
4799 explicit_nonce = in;
4800 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4801 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4802 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4803 if (inl < auth_tag_len) {
4804 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4805 return false0;
4806 }
4807 ciphertext = in;
4808 ciphertext_len = inl - auth_tag_len;
4809 } else {
4810 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4811 return false0;
4812 }
4813 auth_tag_wire = ciphertext + ciphertext_len;
4814
4815 /*
4816 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4817 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4818 */
4819 if (is_v12 && cipher_mode != MODE_POLY1305) {
4820 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4820, "decoder->write_iv.data_len == 4"))));
4821 /* Implicit (4) and explicit (8) part of nonce. */
4822 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4823 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
4824
4825 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4826 /*
4827 * Technically the nonce length must be at least 8 bytes, but for
4828 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
4829 */
4830 const unsigned nonce_len = 12;
4831 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4831, "decoder->write_iv.data_len == nonce_len"
))));
4832 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
4833 /* Sequence number is left-padded with zeroes and XORed with write_iv */
4834 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
4835 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
4836 }
4837
4838 /* Set nonce and additional authentication data */
4839 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
4840 ssl_print_data("nonce", nonce, 12);
4841 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
4842 if (err) {
4843 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4844 return false0;
4845 }
4846
4847 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
4848 if (is_cid) { /* if connection ID */
4849 if (ssl->session.deprecated_cid) {
4850 aad_len = 14 + cidl;
4851 aad = wmem_alloc(allocator, aad_len);
4852 phtonu64(aad, decoder->seq); /* record sequence number */
4853 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4854 aad[8] = ct; /* TLSCompressed.type */
4855 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4856 memcpy(aad + 11, cid, cidl); /* cid */
4857 aad[11 + cidl] = cidl; /* cid_length */
4858 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
4859 } else {
4860 aad_len = 23 + cidl;
4861 aad = wmem_alloc(allocator, aad_len);
4862 memset(aad, 0xFF, 8); /* seq_num_placeholder */
4863 aad[8] = ct; /* TLSCompressed.type */
4864 aad[9] = cidl; /* cid_length */
4865 aad[10] = ct; /* TLSCompressed.type */
4866 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
4867 phtonu64(aad + 13, decoder->seq); /* record sequence number */
4868 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
4869 memcpy(aad + 21, cid, cidl); /* cid */
4870 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
4871 }
4872 } else if (is_v12) {
4873 aad_len = 13;
4874 aad = wmem_alloc(allocator, aad_len);
4875 phtonu64(aad, decoder->seq); /* record sequence number */
4876 if (version == DTLSV1DOT2_VERSION0xfefd) {
4877 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4878 }
4879 aad[8] = ct; /* TLSCompressed.type */
4880 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4881 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
4882 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
4883 aad_len = decoder->dtls13_aad.data_len;
4884 aad = decoder->dtls13_aad.data;
4885 } else if (draft_version >= 25 || draft_version == 0) {
4886 aad_len = 5;
4887 aad = wmem_alloc(allocator, aad_len);
4888 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
4889 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
4890 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
4891 }
4892
4893 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
4894 /* size of plaintext, additional authenticated data and auth tag. */
4895 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
4896
4897 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
4898 }
4899
4900 if (aad && aad_len > 0) {
4901 ssl_print_data("AAD", aad, aad_len);
4902 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
4903 if (err) {
4904 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4905 return false0;
4906 }
4907 }
4908
4909 /* Decrypt now that nonce and AAD are set. */
4910 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
4911 if (err) {
4912 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4913 return false0;
4914 }
4915
4916 /* Check authentication tag for authenticity (replaces MAC) */
4917 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
4918 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
4919 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
4920 } else {
4921 if (err) {
4922 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4923 } else {
4924 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
4925 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
4926 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
4927 }
4928 if (ignore_mac_failed) {
4929 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
4930 } else {
4931 return false0;
4932 }
4933 }
4934
4935 /*
4936 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
4937 * after successful authentication to ensure that early data is skipped when
4938 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
4939 */
4940 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
4941 decoder->seq++;
4942 }
4943
4944 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
4945 *outl = ciphertext_len;
4946 return true1;
4947}
4948
4949/* Record decryption glue based on security parameters {{{ */
4950/* Assume that we are called only for a non-NULL decoder which also means that
4951 * we have a non-NULL decoder->cipher_suite. */
4952int
4953ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
4954 bool_Bool ignore_mac_failed,
4955 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
4956 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
4957{
4958 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
4959 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
4960
4961 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
4962 ssl_print_data("Ciphertext",in, inl);
4963
4964 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
4965 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
4966 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
4967 return -1;
4968 }
4969
4970 /* ensure we have enough storage space for decrypted data */
4971 if (inl > out_str->data_len)
4972 {
4973 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
4974 inl + 32, out_str->data_len);
4975 ssl_data_realloc(out_str, inl + 32);
4976 }
4977
4978 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
4979 * a separate MAC, so use a different routine for simplicity. */
4980 if (decoder->cipher_suite->mode == MODE_GCM ||
4981 decoder->cipher_suite->mode == MODE_CCM ||
4982 decoder->cipher_suite->mode == MODE_CCM_8 ||
4983 decoder->cipher_suite->mode == MODE_POLY1305 ||
4984 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
4985 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
4986
4987 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
4988 /* decryption failed */
4989 return -1;
4990 }
4991
4992 goto skip_mac;
4993 }
4994
4995 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
4996 * (notation: { unencrypted, [ encrypted ] })
4997 * GenericStreamCipher: { [content, mac] }
4998 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
4999 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5000 * GenericAEADCipher: { nonce_explicit, [content] }
5001 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5002 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5003 */
5004
5005 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5006
5007 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5008 if (decoder->cipher_suite->mode == MODE_CBC) {
5009 unsigned blocksize = 0;
5010
5011 switch (ssl->session.version) {
5012 case TLSV1DOT1_VERSION0x302:
5013 case TLSV1DOT2_VERSION0x303:
5014 case DTLSV1DOT0_VERSION0xfeff:
5015 case DTLSV1DOT2_VERSION0xfefd:
5016 case DTLSV1DOT3_VERSION0xfefc:
5017 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5018 case TLCPV1_VERSION0x101:
5019 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5020 if (inl < blocksize) {
5021 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5022 inl, blocksize);
5023 return -1;
5024 }
5025 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5026 if (pad != 0) {
5027 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5028 gcry_strsource (pad), gcry_strerror (pad));
5029 }
5030
5031 inl -= blocksize;
5032 in += blocksize;
5033 break;
5034 }
5035
5036 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5037 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5038 /*
5039 * MAC is calculated over (IV + ) ENCRYPTED contents:
5040 *
5041 * MAC(MAC_write_key, ... +
5042 * IV + // for TLS 1.1 or greater
5043 * TLSCiphertext.enc_content);
5044 */
5045 if (inl < maclen) {
5046 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5047 G_STRFUNC((const char*) (__func__)), inl, maclen);
5048 return -1;
5049 }
5050 inl -= maclen;
5051 mac = (uint8_t *)in + inl;
5052 mac_frag = (uint8_t *)in - blocksize;
5053 mac_fraglen = blocksize + inl;
5054 }
5055 }
5056
5057 /* First decrypt*/
5058 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5059 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5060 gcry_strerror (pad));
5061 return -1;
5062 }
5063
5064 ssl_print_data("Plaintext", out_str->data, inl);
5065 worklen=inl;
5066
5067
5068 /* strip padding for GenericBlockCipher */
5069 if (decoder->cipher_suite->mode == MODE_CBC) {
5070 if (inl < 1) { /* Should this check happen earlier? */
5071 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5072 return -1;
5073 }
5074 pad=out_str->data[inl-1];
5075 if (worklen <= pad) {
5076 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5077 pad, worklen);
5078 return -1;
5079 }
5080 worklen-=(pad+1);
5081 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5082 pad, worklen);
5083 }
5084
5085 /* MAC for GenericStreamCipher and GenericBlockCipher.
5086 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5087 if (!mac) {
5088 /*
5089 * MAC is calculated over the DECRYPTED contents:
5090 *
5091 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5092 */
5093 if (worklen < maclen) {
5094 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5095 return -1;
5096 }
5097 worklen -= maclen;
5098 mac = out_str->data + worklen;
5099 mac_frag = out_str->data;
5100 mac_fraglen = worklen;
5101 }
5102
5103 /* If NULL encryption active and no keys are available, do not bother
5104 * checking the MAC. We do not have keys for that. */
5105 if (decoder->cipher_suite->mode == MODE_STREAM &&
5106 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5107 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5108 ssl_debug_printf("MAC check skipped due to missing keys\n");
5109 decoder->seq++; // Increment this for display
5110 goto skip_mac;
5111 }
5112
5113 /* Now check the MAC */
5114 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5115 worklen, ssl->session.version, ct, decoder->seq);
5116 if(ssl->session.version==SSLV3_VERSION0x300){
5117 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5118 if(ignore_mac_failed) {
5119 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5120 }
5121 else{
5122 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5123 return -1;
5124 }
5125 }
5126 else{
5127 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5128 }
5129 }
5130 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5131 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5132 if(ignore_mac_failed) {
5133 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5134 }
5135 else{
5136 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5137 return -1;
5138 }
5139 }
5140 else{
5141 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5142 }
5143 }
5144 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5145 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5146 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5147 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5148 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5149 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5150 }
5151 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5152 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5153 }
5154 else if(ignore_mac_failed) {
5155 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5156 }
5157 else{
5158 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5159 return -1;
5160 }
5161 }
5162skip_mac:
5163
5164 *outl = worklen;
5165
5166 if (decoder->compression > 0) {
5167 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5168 ssl_data_copy(comp_str, out_str);
5169 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5170 if (!decoder->decomp) {
5171 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5172 return -1;
5173 }
5174 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5175 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5176 *outl = uncomplen;
5177 }
5178
5179 return 0;
5180}
5181/* Record decryption glue based on security parameters }}} */
5182
5183
5184
5185#ifdef HAVE_LIBGNUTLS1
5186
5187/* RSA private key file processing {{{ */
5188static void
5189ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5190 const gnutls_datum_t *subjectPublicKeyInfo)
5191{
5192 gnutls_pubkey_t pubkey = NULL((void*)0);
5193 cert_key_id_t key_id;
5194 size_t key_id_len = sizeof(key_id);
5195 int r;
5196
5197 if (!subjectPublicKeyInfo->size) {
5198 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5199 return;
5200 }
5201
5202 r = gnutls_pubkey_init(&pubkey);
5203 if (r < 0) {
5204 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5205 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5206 return;
5207 }
5208
5209 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5210 if (r < 0) {
5211 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5212 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5213 goto end;
5214 }
5215
5216 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5217 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5218 goto end;
5219 }
5220
5221 /* Generate a 20-byte SHA-1 hash. */
5222 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5223 if (r < 0) {
5224 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5225 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5226 goto end;
5227 }
5228
5229 if (key_id_len != sizeof(key_id)) {
5230 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5231 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5232 goto end;
5233 }
5234
5235 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5236 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5237 *ssl->cert_key_id = key_id;
5238
5239end:
5240 gnutls_pubkey_deinit(pubkey);
5241}
5242
5243/* RSA private key file processing }}} */
5244#endif /* HAVE_LIBGNUTLS */
5245
5246/*--- Start of dissector-related code below ---*/
5247
5248/* This is not a "protocol" but ensures that this gets called during
5249 * the handoff stage. */
5250void proto_reg_handoff_tls_utils(void);
5251
5252static dissector_handle_t base_tls_handle;
5253static dissector_handle_t dtls_handle;
5254
5255void
5256proto_reg_handoff_tls_utils(void)
5257{
5258 base_tls_handle = find_dissector("tls");
5259 dtls_handle = find_dissector("dtls");
5260}
5261
5262/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5263 * no session exists. */
5264SslDecryptSession *
5265tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5266{
5267 void *conv_data;
5268 wmem_map_t *session_map;
5269
5270 if (!conversation)
5271 return NULL((void*)0);
5272
5273 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5274 if (conv_data == NULL((void*)0))
5275 return NULL((void*)0);
5276
5277 session_map = (wmem_map_t *)conv_data;
5278
5279 return (SslDecryptSession *)wmem_map_lookup(session_map,
5280 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5281
5282}
5283
5284/* get ssl data for this session. if no ssl data is found allocate a new one*/
5285SslDecryptSession *
5286ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5287{
5288 void *conv_data;
5289 SslDecryptSession *ssl_session;
5290 int proto_ssl;
5291 wmem_map_t *session_map;
5292
5293 /* Note proto_ssl is tls for either the main tls_handle or the
5294 * tls13_handshake handle used by QUIC. */
5295 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5296 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5297
5298 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5299 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5300 * preventing memory leaks on capture reload. */
5301 if (conv_data != NULL((void*)0)) {
5302 session_map = (wmem_map_t *)conv_data;
5303 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5304 if (ssl_session != NULL((void*)0)) {
5305 return ssl_session;
5306 }
5307 } else {
5308 /* Create a new wmem map to store sessions by layer number */
5309 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5310 conversation_add_proto_data(conversation, proto_ssl, session_map);
5311 }
5312
5313 /* no previous SSL conversation info for this layer, initialize it. */
5314 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5315
5316 /* data_len is the part that is meaningful, not the allocated length */
5317 ssl_session->master_secret.data_len = 0;
5318 ssl_session->master_secret.data = ssl_session->_master_secret;
5319 ssl_session->session_id.data_len = 0;
5320 ssl_session->session_id.data = ssl_session->_session_id;
5321 ssl_session->client_random.data_len = 0;
5322 ssl_session->client_random.data = ssl_session->_client_random;
5323 ssl_session->server_random.data_len = 0;
5324 ssl_session->server_random.data = ssl_session->_server_random;
5325 ssl_session->session_ticket.data_len = 0;
5326 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5327 ssl_session->server_data_for_iv.data_len = 0;
5328 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5329 ssl_session->client_data_for_iv.data_len = 0;
5330 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5331 ssl_session->app_data_segment.data = NULL((void*)0);
5332 ssl_session->app_data_segment.data_len = 0;
5333 ssl_session->handshake_data.data=NULL((void*)0);
5334 ssl_session->handshake_data.data_len=0;
5335 ssl_session->ech_transcript.data=NULL((void*)0);
5336 ssl_session->ech_transcript.data_len=0;
5337
5338 /* Initialize parameters which are not necessary specific to decryption. */
5339 ssl_session->session.version = SSL_VER_UNKNOWN0;
5340 clear_address(&ssl_session->session.srv_addr);
5341 ssl_session->session.srv_ptype = PT_NONE;
5342 ssl_session->session.srv_port = 0;
5343 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5344 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5345 ssl_session->session.client_random.data_len = 0;
5346 ssl_session->session.client_random.data = ssl_session->session._client_random;
5347 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5348 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5349 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5350 ssl_session->session.ech = false0;
5351 ssl_session->session.hrr_ech_declined = false0;
5352 ssl_session->session.first_ch_ech_frame = 0;
5353
5354 /* We want to increment the stream count for the normal tls handle and
5355 * dtls handle, but presumably not for the tls13_handshake handle used
5356 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5357 * doesn't get sent to the TLS follow tap.)
5358 */
5359 if (tls_handle == base_tls_handle) {
5360 ssl_session->session.stream = tls_increment_stream_count();
5361 } else if (tls_handle == dtls_handle) {
5362 ssl_session->session.stream = dtls_increment_stream_count();
5363 }
5364
5365 /* Store the session in the wmem map indexed by layer number */
5366 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5367
5368 return ssl_session;
5369}
5370
5371void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5372{
5373 if (ssl) {
5374 /* Ensure that secrets are not restored using stale identifiers. Split
5375 * between client and server in case the packets somehow got out of order. */
5376 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5377
5378 if (is_client) {
5379 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5380 ssl->session_id.data_len = 0;
5381 ssl->session_ticket.data_len = 0;
5382 ssl->master_secret.data_len = 0;
5383 ssl->client_random.data_len = 0;
5384 ssl->has_early_data = false0;
5385 if (ssl->handshake_data.data_len > 0) {
5386 // The EMS handshake hash starts with at the Client Hello,
5387 // ensure that any messages before it are forgotten.
5388 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
5389 ssl->handshake_data.data = NULL((void*)0);
5390 ssl->handshake_data.data_len = 0;
5391 }
5392 } else {
5393 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5394 ssl->server_random.data_len = 0;
5395 ssl->pre_master_secret.data_len = 0;
5396#ifdef HAVE_LIBGNUTLS1
5397 ssl->cert_key_id = NULL((void*)0);
5398#endif
5399 ssl->has_psk = false0;
5400 ssl->has_key_share = false0;
5401 // There is no point in clearing the PSK when resetting the session,
5402 // we only store one global PSK in the prefs.
5403 //ssl->psk.data_len = 0;
5404 }
5405
5406 if (ssl->state & clear_flags) {
5407 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5408 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5409 ssl->state &= ~clear_flags;
5410 }
5411 }
5412
5413 /* These flags might be used for non-decryption purposes and may affect the
5414 * dissection, so reset them as well. */
5415 if (is_client) {
5416 session->client_cert_type = 0;
5417 } else {
5418 session->compression = 0;
5419 session->server_cert_type = 0;
5420 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5421 }
5422 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5423 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5424}
5425
5426void
5427tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5428 dissector_handle_t app_handle)
5429{
5430 conversation_t *conversation;
5431 SslSession *session;
5432
5433 /* Ignore if the TLS or other dissector is disabled. */
5434 /* XXX - find_dissector still works if a dissector is disabled,
5435 * this would be if the dissector isn't registered at all or the
5436 * caller is calling this with explicit NULL. */
5437 if (!tls_handle || !app_handle)
5438 return;
5439
5440 int proto = dissector_handle_get_protocol_index(tls_handle);
5441 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5442
5443 conversation = find_or_create_conversation(pinfo);
5444 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5445 session->app_handle = app_handle;
5446}
5447
5448static uint32_t
5449ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5450 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5451{
5452
5453 conversation_t *conversation;
5454 SslSession *session;
5455
5456 /* Ignore if the TLS dissector is disabled. */
5457 /* XXX - find_dissector still works if a dissector is disabled,
5458 * this would be if the dissector isn't registered at all (or the
5459 * caller has an error.) */
5460 if (!tls_handle)
5461 return 0;
5462
5463 int proto = dissector_handle_get_protocol_index(tls_handle);
5464 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5465
5466 /* The caller should always pass a valid handle to its own dissector. */
5467 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5467, "app_handle"))));
5468
5469 conversation = find_or_create_conversation(pinfo);
5470 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5471
5472 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5473 session->last_nontls_frame,
5474 (void *)session->app_handle,
5475 dissector_handle_get_dissector_name(session->app_handle));
5476 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5477 pinfo->num, (void *)app_handle,
5478 dissector_handle_get_dissector_name(app_handle));
5479
5480 /* Do not switch again if a dissector did it before. */
5481 if (session->last_nontls_frame) {
5482 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5483 return session->last_nontls_frame;
5484 }
5485
5486 session->app_handle = app_handle;
5487 /* The TLS dissector should be called first for this conversation. */
5488 conversation_set_dissector(conversation, tls_handle);
5489 /* TLS starts after this frame. */
5490 session->last_nontls_frame = last_nontls_frame;
5491 return 0;
5492}
5493
5494/* ssl_starttls_ack: mark future frames as encrypted. */
5495uint32_t
5496ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5497 dissector_handle_t app_handle)
5498{
5499 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5500}
5501
5502uint32_t
5503ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5504 dissector_handle_t app_handle)
5505{
5506 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5507}
5508
5509dissector_handle_t
5510ssl_find_appdata_dissector(const char *name)
5511{
5512 /* Accept 'http' for backwards compatibility and sanity. */
5513 if (!strcmp(name, "http"))
5514 name = "http-over-tls";
5515 /* XXX - Should this check to see if the dissector is actually added for
5516 * Decode As in the appropriate table?
5517 */
5518 return find_dissector(name);
5519}
5520
5521/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5522static int
5523ssl_equal (const void *v, const void *v2)
5524{
5525 const StringInfo *val1;
5526 const StringInfo *val2;
5527 val1 = (const StringInfo *)v;
5528 val2 = (const StringInfo *)v2;
5529
5530 if (val1->data_len == val2->data_len &&
5531 !memcmp(val1->data, val2->data, val2->data_len)) {
5532 return 1;
5533 }
5534 return 0;
5535}
5536
5537static unsigned
5538ssl_hash(const void *v)
5539{
5540 const StringInfo* id;
5541 id = (const StringInfo*) v;
5542
5543 return wmem_strong_hash(id->data, id->data_len);
5544}
5545/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5546
5547/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5548void
5549ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5550{
5551 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5551, "main_handle"))));
5552 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5552, "subdissector_handle"))));
5553 /* Registration is required for Export PDU feature to work properly. */
5554 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5555, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5555 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5555, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5556 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5557
5558 if (port) {
5559 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5560 if (tcp)
5561 dissector_add_uint("tcp.port", port, main_handle);
5562 else
5563 dissector_add_uint("udp.port", port, main_handle);
5564 dissector_add_uint("sctp.port", port, main_handle);
5565 } else {
5566 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5567 }
5568}
5569
5570void
5571ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5572{
5573 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5574 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5575 if (main_handle) {
5576 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5577 dissector_delete_uint("sctp.port", port, main_handle);
5578 }
5579
5580 if (port) {
5581 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5582 }
5583}
5584
5585void
5586ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5587{
5588 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5589 session->srv_ptype = ptype;
5590 session->srv_port = port;
5591}
5592
5593int
5594ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5595{
5596 int ret;
5597 if (session && session->srv_addr.type != AT_NONE) {
5598 ret = (session->srv_ptype == pinfo->ptype) &&
5599 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5600 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5601 } else {
5602 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5603 }
5604
5605 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5606 return ret;
5607}
5608/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5609
5610
5611/* Links SSL records with the real packet data. {{{ */
5612SslPacketInfo *
5613tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5614{
5615 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5616 if (!pi) {
5617 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5618 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5619 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5620 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5621 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5622 if (ssl_session) {
5623 /* This can also be called by the QUIC TLS1.3 handshake only
5624 * dissector. That is not associated with a session, or a stream,
5625 * and doesn't need the information for Follow or Decode As. */
5626 pi->stream = ssl_session->session.stream;
5627 }
5628 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5629 }
5630
5631 return pi;
5632}
5633
5634/**
5635 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5636 * avoid the need for a decoder in the second pass. Additionally, it remembers
5637 * sequence numbers (for reassembly and Follow TLS Stream).
5638 *
5639 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5640 * @param pinfo The packet where the record originates from.
5641 * @param plain_data Decrypted plaintext to store in the record.
5642 * @param plain_data_len Total length of the plaintext.
5643 * @param content_len Length of the plaintext section corresponding to the record content.
5644 * @param record_id The identifier for this record within the current packet.
5645 * @param flow Information about sequence numbers, etc.
5646 * @param type TLS Content Type (such as handshake or application_data).
5647 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5648 */
5649void
5650ssl_add_record_info(int proto, packet_info *pinfo,
5651 const unsigned char *plain_data, int plain_data_len, int content_len,
5652 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5653 uint64_t record_seq)
5654{
5655 SslRecordInfo* rec, **prec;
5656 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5657
5658 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5658
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5659
5660 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5661 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5662 rec->plain_data_len = plain_data_len;
5663 rec->content_len = content_len;
5664 rec->id = record_id;
5665 rec->type = type;
5666 rec->next = NULL((void*)0);
5667 rec->record_seq = record_seq;
5668
5669 if (flow && type == SSL_ID_APP_DATA) {
5670 rec->seq = flow->byte_seq;
5671 rec->flow = flow;
5672 flow->byte_seq += content_len;
5673 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5674 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5675 }
5676
5677 /* Remember decrypted records. */
5678 prec = &pi->records;
5679 while (*prec) prec = &(*prec)->next;
5680 *prec = rec;
5681}
5682
5683/* search in packet data for the specified id; return a newly created tvb for the associated data */
5684tvbuff_t*
5685ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5686{
5687 SslRecordInfo* rec;
5688 SslPacketInfo* pi;
5689 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5690
5691 if (!pi)
5692 return NULL((void*)0);
5693
5694 for (rec = pi->records; rec; rec = rec->next)
5695 if (rec->id == record_id) {
5696 *matched_record = rec;
5697 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5698 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5699 }
5700
5701 return NULL((void*)0);
5702}
5703/* Links SSL records with the real packet data. }}} */
5704
5705/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5706void
5707ssl_common_init(ssl_master_key_map_t *mk_map,
5708 StringInfo *decrypted_data, StringInfo *compressed_data)
5709{
5710 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5711 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5712 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5713 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5714 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5715 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5716 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5717 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5718 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5719 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5720 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5721 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5722
5723 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5724 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5725
5726 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5727
5728 ssl_data_alloc(decrypted_data, 32);
5729 ssl_data_alloc(compressed_data, 32);
5730}
5731
5732void
5733ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5734 StringInfo *decrypted_data, StringInfo *compressed_data)
5735{
5736 g_hash_table_destroy(mk_map->session);
5737 g_hash_table_destroy(mk_map->tickets);
5738 g_hash_table_destroy(mk_map->crandom);
5739 g_hash_table_destroy(mk_map->pre_master);
5740 g_hash_table_destroy(mk_map->pms);
5741 g_hash_table_destroy(mk_map->tls13_client_early);
5742 g_hash_table_destroy(mk_map->tls13_client_handshake);
5743 g_hash_table_destroy(mk_map->tls13_server_handshake);
5744 g_hash_table_destroy(mk_map->tls13_client_appdata);
5745 g_hash_table_destroy(mk_map->tls13_server_appdata);
5746 g_hash_table_destroy(mk_map->tls13_early_exporter);
5747 g_hash_table_destroy(mk_map->tls13_exporter);
5748
5749 g_hash_table_destroy(mk_map->ech_secret);
5750 g_hash_table_destroy(mk_map->ech_config);
5751
5752 g_hash_table_destroy(mk_map->used_crandom);
5753
5754 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5755 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5756
5757 /* close the previous keylog file now that the cache are cleared, this
5758 * allows the cache to be filled with the full keylog file contents. */
5759 if (*ssl_keylog_file) {
5760 fclose(*ssl_keylog_file);
5761 *ssl_keylog_file = NULL((void*)0);
5762 }
5763}
5764/* }}} */
5765
5766/* parse ssl related preferences (private keys and ports association strings) */
5767#if defined(HAVE_LIBGNUTLS1)
5768/* Load a single RSA key file item from preferences. {{{ */
5769void
5770ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5771{
5772 gnutls_x509_privkey_t x509_priv_key;
5773 gnutls_privkey_t priv_key = NULL((void*)0);
5774 FILE* fp = NULL((void*)0);
5775 int ret;
5776 size_t key_id_len = 20;
5777 unsigned char *key_id = NULL((void*)0);
5778 char *err = NULL((void*)0);
5779 dissector_handle_t handle;
5780 /* try to load keys file first */
5781 fp = ws_fopenfopen(uats->keyfile, "rb");
5782 if (!fp) {
5783 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5784 return;
5785 }
5786
5787 if ((int)strlen(uats->password) == 0) {
5788 x509_priv_key = rsa_load_pem_key(fp, &err);
5789 } else {
5790 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
5791 }
5792 fclose(fp);
5793
5794 if (!x509_priv_key) {
5795 if (err) {
5796 report_failure("Can't load private key from %s: %s",
5797 uats->keyfile, err);
5798 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5799 } else
5800 report_failure("Can't load private key from %s: unknown error",
5801 uats->keyfile);
5802 return;
5803 }
5804 if (err) {
5805 report_failure("Load of private key from %s \"succeeded\" with error %s",
5806 uats->keyfile, err);
5807 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5808 }
5809
5810 gnutls_privkey_init(&priv_key);
5811 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
5812 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
5813 if (ret < 0) {
5814 report_failure("Can't convert private key %s: %s",
5815 uats->keyfile, gnutls_strerror(ret));
5816 goto end;
5817 }
5818
5819 key_id = (unsigned char *) g_malloc0(key_id_len);
5820 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
5821 if (ret < 0) {
5822 report_failure("Can't calculate public key ID for %s: %s",
5823 uats->keyfile, gnutls_strerror(ret));
5824 goto end;
5825 }
5826 ssl_print_data("KeyID", key_id, key_id_len);
5827 if (key_id_len != 20) {
5828 report_failure("Expected Key ID size %u for %s, got %zu", 20,
5829 uats->keyfile, key_id_len);
5830 goto end;
5831 }
5832
5833 g_hash_table_replace(key_hash, key_id, priv_key);
5834 key_id = NULL((void*)0); /* used in key_hash, do not free. */
5835 priv_key = NULL((void*)0);
5836 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
5837
5838 handle = ssl_find_appdata_dissector(uats->protocol);
5839 if (handle) {
5840 /* Port to subprotocol mapping */
5841 uint16_t port = 0;
5842 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
5843 if (port > 0) {
5844 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
5845 port, uats->keyfile, uats->password);
5846
5847 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
5848 }
5849 } else {
5850 if (strcmp(uats->port, "start_tls"))
5851 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
5852 }
5853 }
5854
5855end:
5856 gnutls_x509_privkey_deinit(x509_priv_key);
5857 gnutls_privkey_deinit(priv_key);
5858 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
5859}
5860/* }}} */
5861#endif
5862
5863
5864/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
5865/** store a known (pre-)master secret into cache */
5866static void
5867ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
5868 StringInfo *mk)
5869{
5870 StringInfo *ht_key, *master_secret;
5871
5872 if (key->data_len == 0) {
5873 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
5874 return;
5875 }
5876
5877 if (mk->data_len == 0) {
5878 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
5879 G_STRFUNC((const char*) (__func__)), label);
5880 return;
5881 }
5882
5883 ht_key = ssl_data_clone(key);
5884 master_secret = ssl_data_clone(mk);
5885 g_hash_table_insert(ht, ht_key, master_secret);
5886
5887 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
5888 ssl_print_string("stored key", ht_key);
5889 ssl_print_string("stored (pre-)master secret", master_secret);
5890}
5891
5892/** restore a (pre-)master secret given some key in the cache */
5893static bool_Bool
5894ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
5895 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
5896{
5897 StringInfo *ms;
5898
5899 if (key->data_len == 0) {
5900 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
5901 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
5902 return false0;
5903 }
5904
5905 ms = (StringInfo *)g_hash_table_lookup(ht, key);
5906 if (!ms) {
5907 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
5908 is_pre_master ? "pre-" : "", label);
5909 return false0;
5910 }
5911
5912 /* (pre)master secret found, clear knowledge of other keys and set it in the
5913 * current conversation */
5914 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
5915 SSL_HAVE_SESSION_KEY(1<<3));
5916 if (is_pre_master) {
5917 /* unlike master secret, pre-master secret has a variable size (48 for
5918 * RSA, varying for PSK) and is therefore not statically allocated */
5919 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
5920 ms->data_len);
5921 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
5922 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
5923 } else {
5924 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
5925 ssl->state |= SSL_MASTER_SECRET(1<<5);
5926 }
5927 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
5928 is_pre_master ? "pre-" : "", label);
5929 ssl_print_string(label, key);
5930 ssl_print_string("(pre-)master secret", ms);
5931 return true1;
5932}
5933/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
5934
5935/* Should be called when all parameters are ready (after ChangeCipherSpec), and
5936 * the decoder should be attempted to be initialized. {{{*/
5937void
5938ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
5939{
5940 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
5941 /* TLS 1.3 implementations only provide secrets derived from the master
5942 * secret which are loaded in tls13_change_key. No master secrets can be
5943 * loaded here, so just return. */
5944 return;
5945 }
5946 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
5947 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
5948 ssl_debug_printf(" session key already available, nothing to do.\n");
5949 return;
5950 }
5951 if (!(ssl->state & SSL_CIPHER(1<<2))) {
5952 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
5953 return;
5954 }
5955
5956 /* for decryption, there needs to be a master secret (which can be derived
5957 * from pre-master secret). If missing, try to pick a master key from cache
5958 * (an earlier packet in the capture or key logfile). */
5959 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
5960 !ssl_restore_master_key(ssl, "Session ID", false0,
5961 mk_map->session, &ssl->session_id) &&
5962 (!ssl->session.is_session_resumed ||
5963 !ssl_restore_master_key(ssl, "Session Ticket", false0,
5964 mk_map->tickets, &ssl->session_ticket)) &&
5965 !ssl_restore_master_key(ssl, "Client Random", false0,
5966 mk_map->crandom, &ssl->client_random)) {
5967 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
5968 /* how unfortunate, the master secret could not be found */
5969 ssl_debug_printf(" Cannot find master secret\n");
5970 return;
5971 } else {
5972 ssl_debug_printf(" Cannot find master secret, continuing anyway "
5973 "because of a NULL cipher\n");
5974 }
5975 }
5976
5977 if (ssl_generate_keyring_material(ssl) < 0) {
5978 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
5979 return;
5980 }
5981 /* Save Client Random/ Session ID for "SSL Export Session keys" */
5982 ssl_save_master_key("Client Random", mk_map->crandom,
5983 &ssl->client_random, &ssl->master_secret);
5984 ssl_save_master_key("Session ID", mk_map->session,
5985 &ssl->session_id, &ssl->master_secret);
5986 /* Only save the new secrets if the server sent the ticket. The client
5987 * ticket might have become stale. */
5988 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
5989 ssl_save_master_key("Session Ticket", mk_map->tickets,
5990 &ssl->session_ticket, &ssl->master_secret);
5991 }
5992} /* }}} */
5993
5994static StringInfo*
5995tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
5996 TLSRecordType type)
5997{
5998 /* XXX - In addition to an out-of-bound PSK, we could also save the
5999 * PSK from a NewSessionTicket; we would also need to compute the
6000 * resumption_master_secret. */
6001 if (tls->psk.data_len == 0)
6002 return NULL((void*)0);
6003
6004 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
6005 * a UAT instead of a single global PSK string preference, preferably
6006 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
6007 * SHOULD be used. We will try the negotiated hash algorithm regardless
6008 * with the PSK, but fall back to SHA-256 for the Early Secret, since
6009 * that's before the Server Hello completes negotiation.
6010 */
6011 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
6012 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
6013 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
6014 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6015 }
6016
6017 int hash_algo = ssl_get_digest_by_name(dig->name);
6018 if (!hash_algo) {
6019 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6020 return NULL((void*)0);
6021 }
6022
6023 /* We can re-use this to store the Pseudo Random Key for each epoch. */
6024 uint8_t prk[DIGEST_MAX_SIZE48];
6025 StringInfo prk_string = { prk, dig->len };
6026 uint8_t *derived_secret;
6027
6028 uint8_t zeroes[DIGEST_MAX_SIZE48];
6029 memset(zeroes, 0, dig->len);
6030
6031 StringInfo *secret = NULL((void*)0);
6032 const char *label;
6033
6034 /* PRK = Early Secret */
6035 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6036
6037 if (type == TLS_SECRET_0RTT_APP) {
6038 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6038, "!is_from_server"))));
6039 label = "c e traffic";
6040 } else {
6041 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6042 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6043 return NULL((void*)0);
6044
6045 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6046 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6047 wmem_free(NULL((void*)0), derived_secret);
6048
6049 if (type == TLS_SECRET_HANDSHAKE) {
6050 label = is_from_server ? "s hs traffic" : "c hs traffic";
6051 } else {
6052 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6053 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6054 return NULL((void*)0);
6055
6056 /* PRK = Master Secret */
6057 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6058 wmem_free(NULL((void*)0), derived_secret);
6059
6060 label = is_from_server ? "s ap traffic" : "c ap traffic";
6061 }
6062 }
6063
6064 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6065 * support ECHO with psk_ke?) then we should use ech_transcript instead
6066 * of handshake_data. Perhaps we should consolidate some of that handling,
6067 * though note that we would have to keep both transcripts around after
6068 * the ClientHello until the ServerHello indicated whether ECHO was
6069 * accepted or not. */
6070 if (!tls13_derive_secret(hash_algo, &prk_string,
6071 tls13_hkdf_label_prefix(tls), label,
6072 tls->handshake_data.data, tls->handshake_data.data_len,
6073 dig->len, &derived_secret))
6074 return NULL((void*)0);
6075
6076 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6077 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6078 secret->data_len = dig->len;
6079 wmem_free(NULL((void*)0), derived_secret);
6080 return secret;
6081}
6082
6083/* Load the traffic key secret from the keylog file. */
6084StringInfo *
6085tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6086 bool_Bool is_from_server, TLSRecordType type)
6087{
6088 GHashTable *key_map;
6089 const char *label;
6090
6091 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6092 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6093 return NULL((void*)0);
6094 }
6095
6096 if (ssl->client_random.data_len == 0) {
6097 /* May happen if Hello message is missing and Finished is found. */
6098 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6099 return NULL((void*)0);
6100 }
6101
6102 switch (type) {
6103 case TLS_SECRET_0RTT_APP:
6104 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6104, "!is_from_server"))));
6105 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6106 key_map = mk_map->tls13_client_early;
6107 break;
6108 case TLS_SECRET_HANDSHAKE:
6109 if (is_from_server) {
6110 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6111 key_map = mk_map->tls13_server_handshake;
6112 } else {
6113 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6114 key_map = mk_map->tls13_client_handshake;
6115 }
6116 break;
6117 case TLS_SECRET_APP:
6118 if (is_from_server) {
6119 label = "SERVER_TRAFFIC_SECRET_0";
6120 key_map = mk_map->tls13_server_appdata;
6121 } else {
6122 label = "CLIENT_TRAFFIC_SECRET_0";
6123 key_map = mk_map->tls13_client_appdata;
6124 }
6125 break;
6126 default:
6127 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6127, __func__, "assertion \"not reached\" failed");
6128 }
6129
6130 /* Transitioning to new keys, mark old ones as unusable. */
6131 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6132 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6133
6134 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6135 if (!secret) {
6136 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6137 if (secret) {
6138 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6139 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6140 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6141 }
6142 }
6143 if (!secret) {
6144 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6145 /* Disable decryption, the keys are invalid. */
6146 if (is_from_server) {
6147 ssl->server = NULL((void*)0);
6148 } else {
6149 ssl->client = NULL((void*)0);
6150 }
6151 return NULL((void*)0);
6152 }
6153
6154 /* TLS 1.3 secret found, set new keys. */
6155 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6156 ssl_print_string("Client Random", &ssl->client_random);
6157 ssl_print_string(label, secret);
6158 return secret;
6159}
6160
6161/* Load the new key. */
6162void
6163tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6164 bool_Bool is_from_server, TLSRecordType type)
6165{
6166 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6167 /*
6168 * QUIC does not use the TLS record layer for message protection.
6169 * The required keys will be extracted later by QUIC.
6170 */
6171 return;
6172 }
6173
6174 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6175 if (!secret) {
6176 if (type != TLS_SECRET_HANDSHAKE) {
6177 return;
6178 }
6179 /*
6180 * Workaround for when for some reason we don't have the handshake
6181 * secret but do have the application traffic secret. (#20240)
6182 * If we can't find the handshake secret, we'll never decrypt the
6183 * Finished message, so we won't know when to change to the app
6184 * traffic key, so we do so now.
6185 */
6186 type = TLS_SECRET_APP;
6187 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6188 if (!secret) {
6189 return;
6190 }
6191 }
6192
6193 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6194 /*
6195 * Remember the application traffic secret to support Key Update. The
6196 * other secrets cannot be used for this purpose, so free them.
6197 */
6198 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6199 StringInfo *app_secret = &decoder->app_traffic_secret;
6200 if (type == TLS_SECRET_APP) {
6201 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6202 app_secret->data,
6203 secret->data_len);
6204 ssl_data_set(app_secret, secret->data, secret->data_len);
6205 } else {
6206 wmem_free(wmem_file_scope(), app_secret->data);
6207 app_secret->data = NULL((void*)0);
6208 app_secret->data_len = 0;
6209 }
6210 }
6211}
6212
6213/**
6214 * Update to next application data traffic secret for TLS 1.3. The previous
6215 * secret should have been set by tls13_change_key.
6216 */
6217void
6218tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6219{
6220 /* RFC 8446 Section 7.2:
6221 * application_traffic_secret_N+1 =
6222 * HKDF-Expand-Label(application_traffic_secret_N,
6223 * "traffic upd", "", Hash.length)
6224 *
6225 * Both application_traffic_secret_N are of the same length (Hash.length).
6226 */
6227 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6228 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6229 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6230 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6231
6232 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6233 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6234 return;
6235 }
6236
6237 /*
6238 * Previous traffic secret is available, so find the hash function,
6239 * expand the new traffic secret and generate new keys.
6240 */
6241 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6242 int hash_algo = ssl_get_digest_by_name(hash_name);
6243 const unsigned hash_len = app_secret->data_len;
6244 unsigned char *new_secret;
6245 const char *label = "traffic upd";
6246 if (tls13_draft_version && tls13_draft_version < 20) {
6247 label = "application traffic secret";
6248 }
6249 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6250 tls13_hkdf_label_prefix(ssl),
6251 label, hash_len, &new_secret)) {
6252 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6253 return;
6254 }
6255 ssl_data_set(app_secret, new_secret, hash_len);
6256 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6257 /*
6258 * Remember the application traffic secret on the new decoder to
6259 * support another Key Update.
6260 */
6261 decoder = is_from_server ? ssl->server : ssl->client;
6262 app_secret = &decoder->app_traffic_secret;
6263 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6264 app_secret->data,
6265 hash_len);
6266 ssl_data_set(app_secret, new_secret, hash_len);
6267 }
6268 wmem_free(NULL((void*)0), new_secret);
6269}
6270
6271void
6272tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6273{
6274 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6275 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6276 }
6277}
6278
6279/** SSL keylog file handling. {{{ */
6280
6281static GRegex *
6282ssl_compile_keyfile_regex(void)
6283{
6284#define OCTET "(?:[[:xdigit:]]{2})"
6285 const char *pattern =
6286 "(?:"
6287 /* Matches Client Hellos having this Client Random */
6288 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6289 /* Matches first part of encrypted RSA pre-master secret */
6290 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6291 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6292 but it can be of any length for DHE */
6293 ")(?<pms>" OCTET "+)"
6294 "|(?:"
6295 /* Matches Server Hellos having a Session ID */
6296 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6297 /* Matches Client Hellos having this Client Random */
6298 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6299 /* Master-Secret is given, its length is fixed */
6300 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6301 "|(?"
6302 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6303 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6304 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6305 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6306 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6307 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6308 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6309 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6310 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6311 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6312 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6313 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6314 ") (?<derived_secret>" OCTET "+)";
6315#undef OCTET
6316 static GRegex *regex = NULL((void*)0);
6317 GError *gerr = NULL((void*)0);
6318
6319 if (!regex) {
6320 regex = g_regex_new(pattern,
6321 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6322 G_REGEX_MATCH_ANCHORED, &gerr);
6323 if (gerr) {
6324 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6325 gerr->message);
6326 g_error_free(gerr);
6327 regex = NULL((void*)0);
6328 }
6329 }
6330
6331 return regex;
6332}
6333
6334typedef struct ssl_master_key_match_group {
6335 const char *re_group_name;
6336 GHashTable *master_key_ht;
6337} ssl_master_key_match_group_t;
6338
6339void
6340tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6341{
6342 ssl_master_key_match_group_t mk_groups[] = {
6343 { "encrypted_pmk", mk_map->pre_master },
6344 { "session_id", mk_map->session },
6345 { "client_random", mk_map->crandom },
6346 { "client_random_pms", mk_map->pms },
6347 /* TLS 1.3 map from Client Random to derived secret. */
6348 { "client_early", mk_map->tls13_client_early },
6349 { "client_handshake", mk_map->tls13_client_handshake },
6350 { "server_handshake", mk_map->tls13_server_handshake },
6351 { "client_appdata", mk_map->tls13_client_appdata },
6352 { "server_appdata", mk_map->tls13_server_appdata },
6353 { "early_exporter", mk_map->tls13_early_exporter },
6354 { "exporter", mk_map->tls13_exporter },
6355 { "ech_secret", mk_map->ech_secret },
6356 { "ech_config", mk_map->ech_config },
6357 };
6358
6359 /* The format of the file is a series of records with one of the following formats:
6360 * - "RSA xxxx yyyy"
6361 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6362 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6363 * (this is the original format introduced with bug 4349)
6364 *
6365 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6366 * Where xxxx is the SSL session ID (hex-encoded)
6367 * Where yyyy is the cleartext master secret (hex-encoded)
6368 * (added to support openssl s_client Master-Key output)
6369 * This is somewhat is a misnomer because there's nothing RSA specific
6370 * about this.
6371 *
6372 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6373 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6374 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6375 * (This format allows SSL connections to be decrypted, if a user can
6376 * capture the PMS but could not recover the MS for a specific session
6377 * with a SSL Server.)
6378 *
6379 * - "CLIENT_RANDOM xxxx yyyy"
6380 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6381 * Where yyyy is the cleartext master secret (hex-encoded)
6382 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6383 * ECDHE-RSA.)
6384 *
6385 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6386 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6387 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6388 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6389 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6390 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6391 * - "EXPORTER_SECRET xxxx yyyy"
6392 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6393 * Where yyyy is the secret (hex-encoded) derived from the early,
6394 * handshake or master secrets. (This format is introduced with TLS 1.3
6395 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6396 */
6397 GRegex *regex = ssl_compile_keyfile_regex();
6398 if (!regex)
6399 return;
6400
6401 const char *next_line = (const char *)data;
6402 const char *line_end = next_line + datalen;
6403 while (next_line && next_line < line_end) {
6404 const char *line = next_line;
6405 next_line = (const char *)memchr(line, '\n', line_end - line);
6406 ssize_t linelen;
6407
6408 if (next_line) {
6409 linelen = next_line - line;
6410 next_line++; /* drop LF */
6411 } else {
6412 linelen = (ssize_t)(line_end - line);
6413 }
6414 if (linelen > 0 && line[linelen - 1] == '\r') {
6415 linelen--; /* drop CR */
6416 }
6417
6418 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6419 GMatchInfo *mi;
6420 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6421 char *hex_key, *hex_pre_ms_or_ms;
6422 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6423 StringInfo *pre_ms_or_ms = NULL((void*)0);
6424 GHashTable *ht = NULL((void*)0);
6425
6426 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6427 * otherwise we will use the Master Secret
6428 */
6429 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6430 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6431 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6432 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6433 }
6434 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6435 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6436 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6437 }
6438 /* There is always a match, otherwise the regex is wrong. */
6439 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6439, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6440
6441 /* convert from hex to bytes and save to hashtable */
6442 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6443 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6444 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6445
6446 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6447 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6448 ssl_master_key_match_group_t *g = &mk_groups[i];
6449 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6450 if (hex_key && *hex_key) {
6451 ssl_debug_printf(" matched %s\n", g->re_group_name);
6452 ht = g->master_key_ht;
6453 from_hex(key, hex_key, strlen(hex_key));
6454 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6455 break;
6456 }
6457 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6458 }
6459 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6459, "ht")))); /* Cannot be reached, or regex is wrong. */
6460
6461 g_hash_table_insert(ht, key, pre_ms_or_ms);
6462
6463 } else if (linelen > 0 && line[0] != '#') {
6464 ssl_debug_printf(" unrecognized line\n");
6465 }
6466 /* always free match info even if there is no match. */
6467 g_match_info_free(mi);
6468 }
6469}
6470
6471void
6472ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6473 const ssl_master_key_map_t *mk_map)
6474{
6475 /* no need to try if no key log file is configured. */
6476 if (!tls_keylog_filename || !*tls_keylog_filename) {
6477 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6478 G_STRFUNC((const char*) (__func__)));
6479 return;
6480 }
6481
6482 /* Validate regexes before even trying to use it. */
6483 if (!ssl_compile_keyfile_regex()) {
6484 return;
6485 }
6486
6487 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6488
6489 /* if the keylog file was deleted/overwritten, re-open it */
6490 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6491 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6492 fclose(*keylog_file);
6493 *keylog_file = NULL((void*)0);
6494 }
6495
6496 if (*keylog_file == NULL((void*)0)) {
6497 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6498 if (!*keylog_file) {
6499 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6500 return;
6501 }
6502 }
6503
6504 for (;;) {
6505 char buf[1110], *line;
6506 line = fgets(buf, sizeof(buf), *keylog_file);
6507 if (!line) {
6508 if (feof(*keylog_file)) {
6509 /* Ensure that newly appended keys can be read in the future. */
6510 clearerr(*keylog_file);
6511 } else if (ferror(*keylog_file)) {
6512 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6513 fclose(*keylog_file);
6514 *keylog_file = NULL((void*)0);
6515 }
6516 break;
6517 }
6518 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6519 }
6520}
6521/** SSL keylog file handling. }}} */
6522
6523#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6524
6525static FILE* ssl_debug_file;
6526
6527void
6528ssl_set_debug(const char* name)
6529{
6530 static int debug_file_must_be_closed;
6531 int use_stderr;
6532
6533 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6534
6535 if (debug_file_must_be_closed)
6536 fclose(ssl_debug_file);
6537
6538 if (use_stderr)
6539 ssl_debug_file = stderrstderr;
6540 else if (!name || (strcmp(name, "") ==0))
6541 ssl_debug_file = NULL((void*)0);
6542 else
6543 ssl_debug_file = ws_fopenfopen(name, "w");
6544
6545 if (!use_stderr && ssl_debug_file)
6546 debug_file_must_be_closed = 1;
6547 else
6548 debug_file_must_be_closed = 0;
6549
6550 ssl_debug_printf("Wireshark SSL debug log \n\n");
6551#ifdef HAVE_LIBGNUTLS1
6552 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6553#endif
6554 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6555 ssl_debug_printf("\n");
6556}
6557
6558void
6559ssl_debug_flush(void)
6560{
6561 if (ssl_debug_file)
6562 fflush(ssl_debug_file);
6563}
6564
6565void
6566ssl_debug_printf(const char* fmt, ...)
6567{
6568 va_list ap;
6569
6570 if (!ssl_debug_file)
6571 return;
6572
6573 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6574 vfprintf(ssl_debug_file, fmt, ap);
6575 va_end(ap)__builtin_va_end(ap);
6576}
6577
6578void
6579ssl_print_data(const char* name, const unsigned char* data, size_t len)
6580{
6581 size_t i, j, k;
6582 if (!ssl_debug_file)
6583 return;
6584 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6585 for (i=0; i<len; i+=16) {
6586 fprintf(ssl_debug_file,"| ");
6587 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6588 fprintf(ssl_debug_file,"%.2x ",data[j]);
6589 for (; k<16; ++k)
6590 fprintf(ssl_debug_file," ");
6591 fputc('|', ssl_debug_file);
6592 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6593 unsigned char c = data[j];
6594 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6595 fputc(c, ssl_debug_file);
6596 }
6597 for (; k<16; ++k)
6598 fputc(' ', ssl_debug_file);
6599 fprintf(ssl_debug_file,"|\n");
6600 }
6601}
6602
6603void
6604ssl_print_string(const char* name, const StringInfo* data)
6605{
6606 ssl_print_data(name, data->data, data->data_len);
6607}
6608#endif /* SSL_DECRYPT_DEBUG }}} */
6609
6610/* UAT preferences callbacks. {{{ */
6611/* checks for SSL and DTLS UAT key list fields */
6612
6613bool_Bool
6614ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6615{
6616 // This should be removed in favor of Decode As. Make it optional.
6617 *err = NULL((void*)0);
6618 return true1;
6619}
6620
6621bool_Bool
6622ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6623{
6624 if (!p || strlen(p) == 0u) {
6625 // This should be removed in favor of Decode As. Make it optional.
6626 *err = NULL((void*)0);
6627 return true1;
6628 }
6629
6630 if (strcmp(p, "start_tls") != 0){
6631 uint16_t port;
6632 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6633 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6634 return false0;
6635 }
6636 }
6637
6638 *err = NULL((void*)0);
6639 return true1;
6640}
6641
6642bool_Bool
6643ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6644{
6645 ws_statb64struct stat st;
6646
6647 if (!p || strlen(p) == 0u) {
6648 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6649 return false0;
6650 } else {
6651 if (ws_stat64stat(p, &st) != 0) {
6652 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6653 return false0;
6654 }
6655 }
6656
6657 *err = NULL((void*)0);
6658 return true1;
6659}
6660
6661bool_Bool
6662ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6663{
6664#if defined(HAVE_LIBGNUTLS1)
6665 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6666 FILE *fp = NULL((void*)0);
6667
6668 if (p && (strlen(p) > 0u)) {
6669 fp = ws_fopenfopen(f->keyfile, "rb");
6670 if (fp) {
6671 char *msg = NULL((void*)0);
6672 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6673 if (!priv_key) {
6674 fclose(fp);
6675 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6676 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6677 return false0;
6678 }
6679 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6680 gnutls_x509_privkey_deinit(priv_key);
6681 fclose(fp);
6682 } else {
6683 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6684 return false0;
6685 }
6686 }
6687
6688 *err = NULL((void*)0);
6689 return true1;
6690#else
6691 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6692 return false0;
6693#endif
6694}
6695/* UAT preferences callbacks. }}} */
6696
6697/** maximum size of ssl_association_info() string */
6698#define SSL_ASSOC_MAX_LEN8192 8192
6699
6700typedef struct ssl_association_info_callback_data
6701{
6702 char *str;
6703 const char *table_protocol;
6704} ssl_association_info_callback_data_t;
6705
6706/**
6707 * callback function used by ssl_association_info() to traverse the SSL associations.
6708 */
6709static void
6710ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6711{
6712 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6713 const int l = (const int)strlen(data->str);
6714 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6715}
6716
6717/**
6718 * @return an information string on the SSL protocol associations. The string must be freed.
6719 */
6720char*
6721ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6722{
6723 ssl_association_info_callback_data_t data;
6724
6725 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6726 data.table_protocol = table_protocol;
6727 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6728 return data.str;
6729}
6730
6731
6732/** Begin of code related to dissection of wire data. */
6733
6734/* Helpers for dissecting Variable-Length Vectors. {{{ */
6735bool_Bool
6736ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6737 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6738 int hf_length, uint32_t min_value, uint32_t max_value)
6739{
6740 unsigned veclen_size;
6741 uint32_t veclen_value;
6742 proto_item *pi;
6743
6744 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6744, (uint64_t)min_value, (uint64_t)max_value))));
6745 if (offset > offset_end) {
6746 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6747 "Vector offset is past buffer end offset (%u > %u)",
6748 offset, offset_end);
6749 *ret_length = 0;
6750 return false0; /* Cannot read length. */
6751 }
6752
6753 if (max_value > 0xffffff) {
6754 veclen_size = 4;
6755 } else if (max_value > 0xffff) {
6756 veclen_size = 3;
6757 } else if (max_value > 0xff) {
6758 veclen_size = 2;
6759 } else {
6760 veclen_size = 1;
6761 }
6762
6763 if (offset_end - offset < veclen_size) {
6764 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6765 tvb, offset, offset_end - offset,
6766 "No more room for vector of length %u",
6767 veclen_size);
6768 *ret_length = 0;
6769 return false0; /* Cannot read length. */
6770 }
6771
6772 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6773 offset += veclen_size;
6774
6775 if (veclen_value < min_value) {
6776 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6777 "Vector length %u is smaller than minimum %u",
6778 veclen_value, min_value);
6779 } else if (veclen_value > max_value) {
6780 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6781 "Vector length %u is larger than maximum %u",
6782 veclen_value, max_value);
6783 }
6784
6785 if (offset_end - offset < veclen_value) {
6786 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
6787 "Vector length %u is too large, truncating it to %u",
6788 veclen_value, offset_end - offset);
6789 *ret_length = offset_end - offset;
6790 return false0; /* Length is truncated to avoid overflow. */
6791 }
6792
6793 *ret_length = veclen_value;
6794 return true1; /* Length is OK. */
6795}
6796
6797bool_Bool
6798ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6799 unsigned offset, unsigned offset_end)
6800{
6801 if (offset < offset_end) {
6802 unsigned trailing = offset_end - offset;
6803 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
6804 tvb, offset, trailing,
6805 "%u trailing byte%s unprocessed",
6806 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
6807 return false0; /* unprocessed data warning */
6808 } else if (offset > offset_end) {
6809 /*
6810 * Returned offset runs past the end. This should not happen and is
6811 * possibly a dissector bug.
6812 */
6813 unsigned excess = offset - offset_end;
6814 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6815 tvb, offset_end, excess,
6816 "Dissector processed too much data (%u byte%s)",
6817 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
6818 return false0; /* overflow error */
6819 }
6820
6821 return true1; /* OK, offset matches. */
6822}
6823/** }}} */
6824
6825
6826static uint32_t
6827ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6828 proto_tree *tree, uint32_t offset, uint32_t offset_end,
6829 uint16_t version, int hf_sig_len, int hf_sig);
6830
6831/* change_cipher_spec(20) dissection */
6832void
6833ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
6834 packet_info *pinfo, proto_tree *tree,
6835 uint32_t offset, SslSession *session,
6836 bool_Bool is_from_server,
6837 const SslDecryptSession *ssl)
6838{
6839 /*
6840 * struct {
6841 * enum { change_cipher_spec(1), (255) } type;
6842 * } ChangeCipherSpec;
6843 */
6844 proto_item *ti;
6845 proto_item_set_text(tree,
6846 "%s Record Layer: %s Protocol: Change Cipher Spec",
6847 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
6848 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
6849 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
6850
6851 if (session->version == TLSV1DOT3_VERSION0x304) {
6852 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
6853 return;
6854 }
6855
6856 /* Remember frame number of first CCS */
6857 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
6858 if (*ccs_frame == 0)
6859 *ccs_frame = pinfo->num;
6860
6861 /* Use heuristics to detect an abbreviated handshake, assume that missing
6862 * ServerHelloDone implies reusing previously negotiating keys. Then when
6863 * a Session ID or ticket is present, it must be a resumed session.
6864 * Normally this should be done at the Finished message, but that may be
6865 * encrypted so we do it here, at the last cleartext message. */
6866 if (is_from_server && ssl) {
6867 if (session->is_session_resumed) {
6868 const char *resumed = NULL((void*)0);
6869 if (ssl->session_ticket.data_len) {
6870 resumed = "Session Ticket";
6871 } else if (ssl->session_id.data_len) {
6872 resumed = "Session ID";
6873 }
6874 if (resumed) {
6875 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
6876 } else {
6877 /* Can happen if the capture somehow starts in the middle */
6878 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
6879 }
6880 } else {
6881 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
6882 }
6883 }
6884 if (is_from_server && session->is_session_resumed)
6885 expert_add_info(pinfo, ti, &hf->ei.resumed);
6886}
6887
6888/** Begin of handshake(22) record dissections */
6889
6890/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
6891 * {{{ */
6892static void
6893tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
6894{
6895 uint32_t sighash, hashalg, sigalg;
6896 proto_item *ti_sigalg;
6897 proto_tree *sigalg_tree;
6898
6899 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
6900 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
6901 if (ja4_data && !IS_GREASE_TLS(sighash)((((sighash) & 0x0f0f) == 0x0a0a) && (((sighash) &
0xff) == (((sighash)>>8) & 0xff)))) {
6902 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
6903 }
6904
6905 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
6906
6907 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
6908 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
6909 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
6910 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
6911 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
6912
6913 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
6914 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
6915 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
6916 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
6917 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
6918 sighash);
6919 }
6920} /* }}} */
6921
6922/* dissect a list of hash algorithms, return the number of bytes dissected
6923 this is used for the signature algorithms extension and for the
6924 TLS1.2 certificate request. {{{ */
6925static int
6926ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
6927 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
6928{
6929 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
6930 * struct {
6931 * HashAlgorithm hash;
6932 * SignatureAlgorithm signature;
6933 * } SignatureAndHashAlgorithm;
6934 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
6935 */
6936 proto_tree *subtree;
6937 proto_item *ti;
6938 unsigned sh_alg_length;
6939 uint32_t next_offset;
6940
6941 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
6942 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
6943 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
6944 return offset_end;
6945 }
6946 offset += 2;
6947 next_offset = offset + sh_alg_length;
6948
6949 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
6950 "Signature Hash Algorithms (%u algorithm%s)",
6951 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
6952 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
6953
6954 while (offset + 2 <= next_offset) {
6955 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
6956 offset += 2;
6957 }
6958
6959 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
6960 offset = next_offset;
6961 }
6962
6963 return offset;
6964} /* }}} */
6965
6966/* Dissection of DistinguishedName (for CertificateRequest and
6967 * certificate_authorities extension). {{{ */
6968static uint32_t
6969tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6970 proto_tree *tree, uint32_t offset, uint32_t offset_end)
6971{
6972 proto_item *ti;
6973 proto_tree *subtree;
6974 uint32_t dnames_length, next_offset;
6975 asn1_ctx_t asn1_ctx;
6976 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
6977
6978 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
6979 /* DistinguishedName certificate_authorities<0..2^16-1> */
6980 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
6981 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
6982 return offset_end;
6983 }
6984 offset += 2;
6985 next_offset = offset + dnames_length;
6986
6987 if (dnames_length > 0) {
6988 ti = proto_tree_add_none_format(tree,
6989 hf->hf.hs_dnames,
6990 tvb, offset, dnames_length,
6991 "Distinguished Names (%d byte%s)",
6992 dnames_length,
6993 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
6994 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
6995
6996 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
6997
6998 while (offset < next_offset) {
6999 /* get the length of the current certificate */
7000 uint32_t name_length;
7001
7002 if (dnames_count-- == 0) {
7003 /* stop adding to tree when the list is considered too large
7004 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7005 Note: dnames_count must be set low enough not to hit the
7006 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7007 */
7008 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7009 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7010 proto_item_set_generated(ti);
7011 return next_offset;
7012 }
7013
7014 /* opaque DistinguishedName<1..2^16-1> */
7015 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7016 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7017 return next_offset;
7018 }
7019 offset += 2;
7020
7021 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7022 subtree, hf->hf.hs_dname);
7023 offset += name_length;
7024 }
7025 }
7026 return offset;
7027} /* }}} */
7028
7029
7030/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7031static int
7032ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7033 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7034{
7035 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7036}
7037
7038static int
7039ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7040 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7041{
7042 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7043 hnd_type == SSL_HND_CERT_REQUEST) {
7044 /*
7045 * struct {
7046 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7047 * } SignatureSchemeList;
7048 */
7049
7050 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7051 } else {
7052 asn1_ctx_t asn1_ctx;
7053 unsigned pubkey_length, sign_length;
7054
7055 /*
7056 * struct {
7057 * uint32 valid_time;
7058 * SignatureScheme expected_cert_verify_algorithm;
7059 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7060 * } Credential;
7061 *
7062 * struct {
7063 * Credential cred;
7064 * SignatureScheme algorithm;
7065 * opaque signature<0..2^16-1>;
7066 * } DelegatedCredential;
7067 */
7068
7069 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7070
7071 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7072 offset += 4;
7073
7074 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7075 offset += 2;
7076
7077 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7078 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7079 return offset_end;
7080 }
7081 offset += 3;
7082 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7083 offset += pubkey_length;
7084
7085 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7086 offset += 2;
7087
7088 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7089 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7090 return offset_end;
7091 }
7092 offset += 2;
7093 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7094 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7095 offset += sign_length;
7096
7097 return offset;
7098 }
7099}
7100
7101static int
7102ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7103 packet_info *pinfo, proto_tree *tree,
7104 uint32_t offset, uint32_t offset_end,
7105 uint8_t hnd_type)
7106{
7107
7108 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7109
7110 switch (hnd_type) {
7111 case SSL_HND_CLIENT_HELLO: {
7112 proto_tree *alps_tree;
7113 proto_item *ti;
7114 uint32_t next_offset, alps_length, name_length;
7115
7116 /*
7117 * opaque ProtocolName<1..2^8-1>;
7118 * struct {
7119 * ProtocolName supported_protocols<2..2^16-1>
7120 * } ApplicationSettingsSupport;
7121 */
7122
7123 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7124 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7125 return offset_end;
7126 }
7127 offset += 2;
7128 next_offset = offset + alps_length;
7129
7130 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7131 tvb, offset, alps_length, ENC_NA0x00000000);
7132 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7133
7134 /* Parse list (note missing check for end of vector, ssl_add_vector below
7135 * ensures that data is always available.) */
7136 while (offset < next_offset) {
7137 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7138 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7139 return next_offset;
7140 }
7141 offset++;
7142
7143 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7144 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7145 offset += name_length;
7146 }
7147
7148 return offset;
7149 }
7150 case SSL_HND_ENCRYPTED_EXTS:
7151 /* Opaque blob */
7152 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7153 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7154 break;
7155 }
7156
7157 return offset_end;
7158}
7159
7160static int
7161ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7162 packet_info *pinfo, proto_tree *tree,
7163 uint32_t offset, uint32_t offset_end,
7164 uint8_t hnd_type, SslSession *session,
7165 bool_Bool is_dtls, ja4_data_t *ja4_data)
7166{
7167
7168 /* https://tools.ietf.org/html/rfc7301#section-3.1
7169 * opaque ProtocolName<1..2^8-1>;
7170 * struct {
7171 * ProtocolName protocol_name_list<2..2^16-1>
7172 * } ProtocolNameList;
7173 */
7174 proto_tree *alpn_tree;
7175 proto_item *ti;
7176 uint32_t next_offset, alpn_length, name_length;
7177 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7178
7179 /* ProtocolName protocol_name_list<2..2^16-1> */
7180 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7181 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7182 return offset_end;
7183 }
7184 offset += 2;
7185 next_offset = offset + alpn_length;
7186
7187 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7188 tvb, offset, alpn_length, ENC_NA0x00000000);
7189 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7190
7191 /* Parse list (note missing check for end of vector, ssl_add_vector below
7192 * ensures that data is always available.) */
7193 while (offset < next_offset) {
7194 /* opaque ProtocolName<1..2^8-1> */
7195 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7196 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7197 return next_offset;
7198 }
7199 offset++;
7200
7201 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7202 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7203 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7204 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7205 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7206 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7207 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7208 }
7209 else {
7210 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7211 alpn_last_char & 0x0F);
7212 }
7213 }
7214 /* Remember first ALPN ProtocolName entry for server. */
7215 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7216 /* '\0'-terminated string for dissector table match and prefix
7217 * comparison purposes. */
7218 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7219 name_length, ENC_ASCII0x00000000);
7220 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7221 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7222 name_length, ENC_ASCII0x00000000);
7223 }
7224 offset += name_length;
7225 }
7226
7227 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7228 * exactly one "ProtocolName". */
7229 if (proto_name) {
7230 dissector_handle_t handle;
7231
7232 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7233
7234 if (is_dtls) {
7235 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7236 proto_name);
7237 } else {
7238 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7239 proto_name);
7240 if (handle == NULL((void*)0)) {
7241 /* Try prefix matching */
7242 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7243 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7244
7245 /* string_string is inappropriate as it compares strings
7246 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7247 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7248 handle = find_dissector(alpn_proto->dissector_name);
7249 break;
7250 }
7251 }
7252 }
7253 }
7254 if (handle != NULL((void*)0)) {
7255 /* ProtocolName match, so set the App data dissector handle.
7256 * This may override protocols given via the UAT dialog, but
7257 * since the ALPN hint is precise, do it anyway. */
7258 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7259 (void *)session->app_handle,
7260 (void *)handle,
7261 dissector_handle_get_dissector_name(handle));
7262 session->app_handle = handle;
7263 }
7264 } else if (client_proto_name) {
7265 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7266 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7267 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7268 }
7269
7270 return offset;
7271}
7272
7273static int
7274ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7275 packet_info *pinfo, proto_tree *tree,
7276 uint32_t offset, uint32_t offset_end)
7277{
7278 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7279 * The "extension_data" field of a "next_protocol_negotiation" extension
7280 * in a "ServerHello" contains an optional list of protocols advertised
7281 * by the server. Protocols are named by opaque, non-empty byte strings
7282 * and the list of protocols is serialized as a concatenation of 8-bit,
7283 * length prefixed byte strings. Implementations MUST ensure that the
7284 * empty string is not included and that no byte strings are truncated.
7285 */
7286 uint32_t npn_length;
7287 proto_tree *npn_tree;
7288
7289 /* List is optional, do not add tree if there are no entries. */
7290 if (offset == offset_end) {
7291 return offset;
7292 }
7293
7294 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7295
7296 while (offset < offset_end) {
7297 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7298 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7299 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7300 return offset_end;
7301 }
7302 offset++;
7303
7304 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7305 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7306 offset += npn_length;
7307 }
7308
7309 return offset;
7310}
7311
7312static int
7313ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7314 packet_info *pinfo, proto_tree *tree,
7315 uint32_t offset, uint32_t offset_end)
7316{
7317 /* https://tools.ietf.org/html/rfc5746#section-3.2
7318 * struct {
7319 * opaque renegotiated_connection<0..255>;
7320 * } RenegotiationInfo;
7321 *
7322 */
7323 proto_tree *reneg_info_tree;
7324 uint32_t reneg_info_length;
7325
7326 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7327
7328 /* opaque renegotiated_connection<0..255> */
7329 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7330 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7331 return offset_end;
7332 }
7333 offset++;
7334
7335 if (reneg_info_length > 0) {
7336 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7337 offset += reneg_info_length;
7338 }
7339
7340 return offset;
7341}
7342
7343static int
7344ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7345 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7346 const char **group_name_out)
7347{
7348 /* RFC 8446 Section 4.2.8
7349 * struct {
7350 * NamedGroup group;
7351 * opaque key_exchange<1..2^16-1>;
7352 * } KeyShareEntry;
7353 */
7354 uint32_t key_exchange_length, group;
7355 proto_tree *ks_tree;
7356
7357 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7358
7359 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7360 offset += 2;
7361 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7362 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7363 if (group_name_out) {
7364 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7365 }
7366
7367 /* opaque key_exchange<1..2^16-1> */
7368 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7369 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7370 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7371 }
7372 offset += 2;
7373 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7374 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7375
7376 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7377 offset += key_exchange_length;
7378
7379 return offset;
7380}
7381
7382static int
7383ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7384 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7385 uint8_t hnd_type, SslDecryptSession *ssl)
7386{
7387 proto_tree *key_share_tree;
7388 uint32_t next_offset;
7389 uint32_t client_shares_length;
7390 uint32_t group;
7391 const char *group_name = NULL((void*)0);
7392
7393 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7394 return offset;
7395 }
7396
7397 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7398
7399 switch(hnd_type){
7400 case SSL_HND_CLIENT_HELLO:
7401 /* KeyShareEntry client_shares<0..2^16-1> */
7402 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7403 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7404 return offset_end;
7405 }
7406 offset += 2;
7407 next_offset = offset + client_shares_length;
7408 const char *sep = " ";
7409 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7410 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7411 if (group_name) {
7412 proto_item_append_text(tree, "%s%s", sep, group_name);
7413 sep = ", ";
7414 }
7415 }
7416 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7417 return next_offset;
7418 }
7419 break;
7420 case SSL_HND_SERVER_HELLO:
7421 if (ssl) {
7422 ssl->has_key_share = true1;
7423 }
7424 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7425 if (group_name) {
7426 proto_item_append_text(tree, " %s", group_name);
7427 }
7428 break;
7429 case SSL_HND_HELLO_RETRY_REQUEST:
7430 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7431 offset += 2;
7432 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7433 proto_item_append_text(tree, " %s", group_name);
7434 break;
7435 default: /* no default */
7436 break;
7437 }
7438
7439 return offset;
7440}
7441
7442static int
7443ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7444 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7445 uint8_t hnd_type, SslDecryptSession *ssl)
7446{
7447 /* RFC 8446 Section 4.2.11
7448 * struct {
7449 * opaque identity<1..2^16-1>;
7450 * uint32 obfuscated_ticket_age;
7451 * } PskIdentity;
7452 * opaque PskBinderEntry<32..255>;
7453 * struct {
7454 * select (Handshake.msg_type) {
7455 * case client_hello:
7456 * PskIdentity identities<7..2^16-1>;
7457 * PskBinderEntry binders<33..2^16-1>;
7458 * case server_hello:
7459 * uint16 selected_identity;
7460 * };
7461 * } PreSharedKeyExtension;
7462 */
7463
7464 proto_tree *psk_tree;
7465
7466 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7467
7468 switch (hnd_type){
7469 case SSL_HND_CLIENT_HELLO: {
7470 uint32_t identities_length, identities_end, binders_length;
7471
7472 /* PskIdentity identities<7..2^16-1> */
7473 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7474 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7475 return offset_end;
7476 }
7477 offset += 2;
7478 identities_end = offset + identities_length;
7479
7480 while (offset < identities_end) {
7481 uint32_t identity_length;
7482 proto_tree *identity_tree;
7483
7484 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7485
7486 /* opaque identity<1..2^16-1> */
7487 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7488 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7489 return identities_end;
7490 }
7491 offset += 2;
7492 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7493
7494 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7495 offset += identity_length;
7496
7497 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7498 offset += 4;
7499
7500 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7501 }
7502 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7503 offset = identities_end;
7504 }
7505
7506 /* PskBinderEntry binders<33..2^16-1> */
7507 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7508 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7509 return offset_end;
7510 }
7511 offset += 2;
7512
7513 proto_item *binders_item;
7514 proto_tree *binders_tree;
7515 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7516 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7517 uint32_t binders_end = offset + binders_length;
7518 while (offset < binders_end) {
7519 uint32_t binder_length;
7520 proto_item *binder_item;
7521 proto_tree *binder_tree;
7522
7523 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7524 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7525
7526 /* opaque PskBinderEntry<32..255>; */
7527 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7528 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7529 return binders_end;
7530 }
7531 offset += 1;
7532 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7533
7534 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7535 offset += binder_length;
7536
7537 proto_item_set_end(binder_item, tvb, offset);
7538 }
7539 }
7540 break;
7541 case SSL_HND_SERVER_HELLO: {
7542 if (ssl) {
7543 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7544 ssl->has_psk = true1;
7545 }
7546 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7547 offset += 2;
7548 }
7549 break;
7550 default:
7551 break;
7552 }
7553
7554 return offset;
7555}
7556
7557static uint32_t
7558ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7559 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7560 uint8_t hnd_type, SslDecryptSession *ssl)
7561{
7562 /* RFC 8446 Section 4.2.10
7563 * struct {} Empty;
7564 * struct {
7565 * select (Handshake.msg_type) {
7566 * case new_session_ticket: uint32 max_early_data_size;
7567 * case client_hello: Empty;
7568 * case encrypted_extensions: Empty;
7569 * };
7570 * } EarlyDataIndication;
7571 */
7572 switch (hnd_type) {
7573 case SSL_HND_CLIENT_HELLO:
7574 /* Remember that early_data will follow the handshake. */
7575 if (ssl) {
7576 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7577 ssl->has_early_data = true1;
7578 }
7579 break;
7580 case SSL_HND_NEWSESSION_TICKET:
7581 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7582 offset += 4;
7583 break;
7584 default:
7585 break;
7586 }
7587 return offset;
7588}
7589
7590static uint16_t
7591tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7592{
7593 if (draft_version) {
7594 *draft_version = 0;
7595 }
7596 if (!is_dtls) {
7597 uint8_t tls13_draft = extract_tls13_draft_version(version);
7598 if (tls13_draft != 0) {
7599 /* This is TLS 1.3 (a draft version). */
7600 if (draft_version) {
7601 *draft_version = tls13_draft;
7602 }
7603 version = TLSV1DOT3_VERSION0x304;
7604 }
7605 if (version == 0xfb17 || version == 0xfb1a) {
7606 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7607 tls13_draft = (uint8_t)version;
7608 if (draft_version) {
7609 *draft_version = tls13_draft;
7610 }
7611 version = TLSV1DOT3_VERSION0x304;
7612 }
7613 }
7614
7615 switch (version) {
7616 case SSLV3_VERSION0x300:
7617 case TLSV1_VERSION0x301:
7618 case TLSV1DOT1_VERSION0x302:
7619 case TLSV1DOT2_VERSION0x303:
7620 case TLSV1DOT3_VERSION0x304:
7621 case TLCPV1_VERSION0x101:
7622 if (is_dtls)
7623 return SSL_VER_UNKNOWN0;
7624 break;
7625
7626 case DTLSV1DOT0_VERSION0xfeff:
7627 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7628 case DTLSV1DOT2_VERSION0xfefd:
7629 case DTLSV1DOT3_VERSION0xfefc:
7630 if (!is_dtls)
7631 return SSL_VER_UNKNOWN0;
7632 break;
7633
7634 default: /* invalid version number */
7635 return SSL_VER_UNKNOWN0;
7636 }
7637
7638 return version;
7639}
7640
7641static int
7642ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7643 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7644 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7645{
7646
7647 /* RFC 8446 Section 4.2.1
7648 * struct {
7649 * ProtocolVersion versions<2..254>; // ClientHello
7650 * } SupportedVersions;
7651 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7652 */
7653 uint32_t versions_length, next_offset;
7654 /* ProtocolVersion versions<2..254> */
7655 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7656 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7657 return offset_end;
7658 }
7659 offset++;
7660 next_offset = offset + versions_length;
7661
7662 unsigned version;
7663 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7664 uint8_t draft_version, max_draft_version = 0;
7665 const char *sep = " ";
7666 while (offset + 2 <= next_offset) {
7667 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7668 offset += 2;
7669
7670 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7671 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7672 sep = ", ";
7673 }
7674
7675 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7676 if (session->version == SSL_VER_UNKNOWN0) {
7677 if (lowest_version == SSL_VER_UNKNOWN0) {
7678 lowest_version = current_version;
7679 } else if (current_version != SSL_VER_UNKNOWN0) {
7680 if (!is_dtls) {
7681 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7682 } else {
7683 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7684 }
7685 }
7686 }
7687 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7688 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7689 /* The DTLS version numbers get mapped to "00" for unknown per
7690 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7691 * need to take the MIN instead of MAX here for DTLS.
7692 */
7693 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7694 }
7695 }
7696 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7697 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7698 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7699 }
7700 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7701 offset = next_offset;
7702 }
7703
7704 /* XXX remove this when draft 19 support is dropped,
7705 * this is only required for early data decryption. */
7706 if (max_draft_version) {
7707 session->tls13_draft_version = max_draft_version;
7708 }
7709
7710 return offset;
7711}
7712
7713static int
7714ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7715 packet_info *pinfo, proto_tree *tree,
7716 uint32_t offset, uint32_t offset_end)
7717{
7718 /* RFC 8446 Section 4.2.2
7719 * struct {
7720 * opaque cookie<1..2^16-1>;
7721 * } Cookie;
7722 */
7723 uint32_t cookie_length;
7724 /* opaque cookie<1..2^16-1> */
7725 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7726 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7727 return offset_end;
7728 }
7729 offset += 2;
7730
7731 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7732 offset += cookie_length;
7733
7734 return offset;
7735}
7736
7737static int
7738ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7739 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7740{
7741 /* RFC 8446 Section 4.2.9
7742 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7743 *
7744 * struct {
7745 * PskKeyExchangeMode ke_modes<1..255>;
7746 * } PskKeyExchangeModes;
7747 */
7748 uint32_t ke_modes_length, next_offset;
7749
7750 /* PskKeyExchangeMode ke_modes<1..255> */
7751 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7752 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7753 return offset_end;
7754 }
7755 offset++;
7756 next_offset = offset + ke_modes_length;
7757
7758 while (offset < next_offset) {
7759 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7760 offset++;
7761 }
7762
7763 return offset;
7764}
7765
7766static uint32_t
7767ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7768 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7769{
7770 /* RFC 8446 Section 4.2.4
7771 * opaque DistinguishedName<1..2^16-1>;
7772 * struct {
7773 * DistinguishedName authorities<3..2^16-1>;
7774 * } CertificateAuthoritiesExtension;
7775 */
7776 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7777}
7778
7779static int
7780ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7781 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7782{
7783 /* RFC 8446 Section 4.2.5
7784 * struct {
7785 * opaque certificate_extension_oid<1..2^8-1>;
7786 * opaque certificate_extension_values<0..2^16-1>;
7787 * } OIDFilter;
7788 * struct {
7789 * OIDFilter filters<0..2^16-1>;
7790 * } OIDFilterExtension;
7791 */
7792 proto_tree *subtree;
7793 uint32_t filters_length, oid_length, values_length, value_offset;
7794 asn1_ctx_t asn1_ctx;
7795 const char *oid, *name;
7796
7797 /* OIDFilter filters<0..2^16-1> */
7798 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
7799 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
7800 return offset_end;
7801 }
7802 offset += 2;
7803 offset_end = offset + filters_length;
7804
7805 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7806
7807 while (offset < offset_end) {
7808 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
7809 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
7810
7811 /* opaque certificate_extension_oid<1..2^8-1> */
7812 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
7813 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
7814 return offset_end;
7815 }
7816 offset++;
7817 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
7818 hf->hf.hs_ext_oid_filters_oid, &oid);
7819 offset += oid_length;
7820
7821 /* Append OID to tree label */
7822 name = oid_resolved_from_string(pinfo->pool, oid);
7823 proto_item_append_text(subtree, " (%s)", name ? name : oid);
7824
7825 /* opaque certificate_extension_values<0..2^16-1> */
7826 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
7827 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
7828 return offset_end;
7829 }
7830 offset += 2;
7831 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
7832 if (values_length > 0) {
7833 value_offset = offset;
7834 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
7835 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
7836 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
7837 }
7838 offset += values_length;
7839 }
7840
7841 return offset;
7842}
7843
7844static int
7845ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7846 packet_info *pinfo, proto_tree *tree,
7847 uint32_t offset, uint32_t offset_end)
7848{
7849 /* https://tools.ietf.org/html/rfc6066#section-3
7850 *
7851 * struct {
7852 * NameType name_type;
7853 * select (name_type) {
7854 * case host_name: HostName;
7855 * } name;
7856 * } ServerName;
7857 *
7858 * enum {
7859 * host_name(0), (255)
7860 * } NameType;
7861 *
7862 * opaque HostName<1..2^16-1>;
7863 *
7864 * struct {
7865 * ServerName server_name_list<1..2^16-1>
7866 * } ServerNameList;
7867 */
7868 proto_tree *server_name_tree;
7869 uint32_t list_length, server_name_length, next_offset;
7870
7871 /* The server SHALL include "server_name" extension with empty data. */
7872 if (offset == offset_end) {
7873 return offset;
7874 }
7875
7876 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
7877
7878 /* ServerName server_name_list<1..2^16-1> */
7879 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
7880 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
7881 return offset_end;
7882 }
7883 offset += 2;
7884 next_offset = offset + list_length;
7885
7886 while (offset < next_offset) {
7887 uint32_t name_type;
7888 const char *server_name = NULL((void*)0);
7889 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
7890 tvb, offset, 1, ENC_NA0x00000000, &name_type);
7891 offset++;
7892
7893 /* opaque HostName<1..2^16-1> */
7894 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
7895 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
7896 return next_offset;
7897 }
7898 offset += 2;
7899
7900 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
7901 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
7902 pinfo->pool, (const uint8_t**)&server_name);
7903 offset += server_name_length;
7904 // Each type must only occur once, so we don't check for duplicates.
7905 if (name_type == 0) {
7906 proto_item_append_text(tree, " name=%s", server_name);
7907 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
7908
7909 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
7910 // Client Hello: Client (Src) -> Server (Dst)
7911 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
7912 case AT_IPv4:
7913 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
7914 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7915 }
7916 break;
7917 case AT_IPv6:
7918 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
7919 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7920 }
7921 break;
7922 }
7923 }
7924 }
7925 }
7926 return offset;
7927}
7928
7929static int
7930ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7931 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
7932{
7933 unsigned ext_len = offset_end - offset;
7934 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
7935 tvb_ensure_bytes_exist(tvb, offset, ext_len);
7936 /* Save the Session Ticket such that it can be used as identifier for
7937 * restoring a previous Master Secret (in ChangeCipherSpec) */
7938 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
7939 ssl->session_ticket.data, ext_len);
7940 ssl->session_ticket.data_len = ext_len;
7941 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
7942 }
7943 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
7944 tvb, offset, ext_len, ENC_NA0x00000000);
7945 return offset + ext_len;
7946}
7947
7948static int
7949ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7950 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7951 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
7952{
7953 uint8_t cert_list_length;
7954 uint8_t cert_type;
7955 proto_tree *cert_list_tree;
7956 proto_item *ti;
7957
7958 switch(hnd_type){
7959 case SSL_HND_CLIENT_HELLO:
7960 cert_list_length = tvb_get_uint8(tvb, offset);
7961 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
7962 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7963 offset += 1;
7964 if (offset_end - offset != (uint32_t)cert_list_length)
7965 return offset;
7966
7967 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
7968 cert_list_length, cert_list_length);
7969 proto_item_append_text(ti, " (%d)", cert_list_length);
7970
7971 /* make this a subtree */
7972 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
7973
7974 /* loop over all point formats */
7975 while (cert_list_length > 0)
7976 {
7977 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7978 offset++;
7979 cert_list_length--;
7980 }
7981 break;
7982 case SSL_HND_SERVER_HELLO:
7983 case SSL_HND_ENCRYPTED_EXTENSIONS:
7984 case SSL_HND_CERTIFICATE:
7985 cert_type = tvb_get_uint8(tvb, offset);
7986 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7987 offset += 1;
7988 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
7989 session->client_cert_type = cert_type;
7990 }
7991 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
7992 session->server_cert_type = cert_type;
7993 }
7994 break;
7995 default: /* no default */
7996 break;
7997 }
7998
7999 return offset;
8000}
8001
8002static uint32_t
8003ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8004 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8005 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8006{
8007 uint32_t compress_certificate_algorithms_length, next_offset;
8008
8009 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8010 * enum {
8011 * zlib(1),
8012 * brotli(2),
8013 * (65535)
8014 * } CertificateCompressionAlgorithm;
8015 *
8016 * struct {
8017 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8018 * } CertificateCompressionAlgorithms;
8019 */
8020 switch (hnd_type) {
8021 case SSL_HND_CLIENT_HELLO:
8022 case SSL_HND_CERT_REQUEST:
8023 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8024 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8025 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8026 return offset_end;
8027 }
8028 offset += 1;
8029 next_offset = offset + compress_certificate_algorithms_length;
8030
8031 while (offset < next_offset) {
8032 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8033 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8034 offset += 2;
8035 }
8036 break;
8037 default:
8038 break;
8039 }
8040
8041 return offset;
8042}
8043
8044static uint32_t
8045ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8046 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8047 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8048{
8049 uint32_t key_parameters_length, next_offset;
8050 proto_item *p_ti;
8051 proto_tree *p_tree;
8052
8053 /* RFC 8472
8054 *
8055 * struct {
8056 * uint8 major;
8057 * uint8 minor;
8058 * } TB_ProtocolVersion;
8059 *
8060 * enum {
8061 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8062 * } TokenBindingKeyParameters;
8063 *
8064 * struct {
8065 * TB_ProtocolVersion token_binding_version;
8066 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8067 * } TokenBindingParameters;
8068 */
8069
8070 switch (hnd_type) {
8071 case SSL_HND_CLIENT_HELLO:
8072 case SSL_HND_SERVER_HELLO:
8073 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8074 offset += 1;
8075 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8076 offset += 1;
8077
8078 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8079 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8080 return offset_end;
8081 }
8082 offset += 1;
8083 next_offset = offset + key_parameters_length;
8084
8085 p_ti = proto_tree_add_none_format(tree,
8086 hf->hf.hs_ext_token_binding_key_parameters,
8087 tvb, offset, key_parameters_length,
8088 "Key parameters identifiers (%d identifier%s)",
8089 key_parameters_length,
8090 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8091 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8092
8093 while (offset < next_offset) {
8094 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8095 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8096 offset += 1;
8097 }
8098
8099 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8100 offset = next_offset;
8101 }
8102
8103 break;
8104 default:
8105 break;
8106 }
8107
8108 return offset;
8109}
8110
8111static uint32_t
8112ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8113 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8114 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8115{
8116 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8117 uint32_t next_offset;
8118
8119 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8120 *
8121 * Note: the following structures are not literally defined in the spec,
8122 * they instead use an ASCII diagram.
8123 *
8124 * struct {
8125 * uint16 id;
8126 * opaque value<0..2^16-1>;
8127 * } TransportParameter; // before draft -27
8128 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8129 *
8130 * struct {
8131 * opaque ipv4Address[4];
8132 * uint16 ipv4Port;
8133 * opaque ipv6Address[16];
8134 * uint16 ipv6Port;
8135 * opaque connectionId<0..18>;
8136 * opaque statelessResetToken[16];
8137 * } PreferredAddress;
8138 */
8139
8140 if (offset_end - offset >= 6 &&
8141 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8142 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8143 // Assume encoding of Transport Parameters draft -26 or older with at
8144 // least one transport parameter that has a valid length.
8145 use_varint_encoding = false0;
8146 }
8147
8148 if (use_varint_encoding) {
8149 next_offset = offset_end;
8150 } else {
8151 uint32_t quic_length;
8152 // Assume draft -26 or earlier.
8153 /* TransportParameter TransportParameters<0..2^16-1>; */
8154 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8155 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8156 return offset_end;
8157 }
8158 offset += 2;
8159 next_offset = offset + quic_length;
8160 }
8161
8162 while (offset < next_offset) {
8163 uint64_t parameter_type; /* 62-bit space */
8164 uint32_t parameter_length;
8165 proto_tree *parameter_tree;
8166 uint32_t parameter_end_offset;
8167 uint64_t value;
8168 uint32_t i;
8169 unsigned len = 0;
8170
8171 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8172 NULL((void*)0), "Parameter");
8173 /* TransportParameter ID and Length. */
8174 if (use_varint_encoding) {
8175 uint64_t parameter_length64;
8176 unsigned type_len = 0;
8177
8178 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8179 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8180 offset += type_len;
8181
8182 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8183 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8184 parameter_length = (uint32_t)parameter_length64;
8185 offset += len;
8186
8187 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8188 } else {
8189 parameter_type = tvb_get_ntohs(tvb, offset);
8190 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8191 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8192 offset += 2;
8193
8194 /* opaque value<0..2^16-1> */
8195 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8196 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8197 return next_offset;
8198 }
8199 offset += 2;
8200
8201 proto_item_set_len(parameter_tree, 4 + parameter_length);
8202 }
8203
8204 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8205 proto_item_append_text(parameter_tree, ": GREASE");
8206 } else {
8207 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8208 }
8209
8210 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8211 parameter_end_offset = offset + parameter_length;
8212
8213 /* Omit the value field if the parameter's length is 0. */
8214 if (parameter_length != 0) {
8215 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8216 tvb, offset, parameter_length, ENC_NA0x00000000);
8217 }
8218
8219 switch (parameter_type) {
8220 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8221 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8222 tvb, offset, parameter_length, ENC_NA0x00000000);
8223 offset += parameter_length;
8224 break;
8225 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8226 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8227 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8228 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8229 offset += len;
8230 break;
8231 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8232 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8233 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8234 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8235 offset += 16;
8236 break;
8237 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8238 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8239 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8240 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8241 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8242 offset += len;
8243 break;
8244 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8245 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8246 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8247 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8248 offset += len;
8249 break;
8250 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8251 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8252 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8253 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8254 offset += len;
8255 break;
8256 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8257 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8258 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8259 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8260 offset += len;
8261 break;
8262 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8263 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8264 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8265 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8266 offset += len;
8267 break;
8268 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8269 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8270 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8271 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8272 offset += len;
8273 break;
8274 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8275 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8276 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8277 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8278 offset += len;
8279 break;
8280 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8281 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8282 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8283 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8284 offset += len;
8285 break;
8286 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8287 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8288 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8289 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8290 offset += len;
8291 break;
8292 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8293 /* No Payload */
8294 break;
8295 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8296 uint32_t connectionid_length;
8297 quic_cid_t cid;
8298
8299 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8300 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8301 offset += 4;
8302 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8303 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8304 offset += 2;
8305 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8306 tvb, offset, 16, ENC_NA0x00000000);
8307 offset += 16;
8308 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8309 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8310 offset += 2;
8311 /* XXX - Should we add these addresses and ports as addresses that the client
8312 * is allowed / expected to migrate the server address to? Right now we don't
8313 * enforce that (see RFC 9000 Section 9, which implies that while the client
8314 * can migrate to whatever address it wants, it can only migrate the server
8315 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8316 */
8317
8318 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8319 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8320 break;
8321 }
8322 offset += 1;
8323
8324 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8325 tvb, offset, connectionid_length, ENC_NA0x00000000);
8326 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8327 cid.len = connectionid_length;
8328 // RFC 9000 5.1.1 "If the preferred_address transport
8329 // parameter is sent, the sequence number of the supplied
8330 // connection ID is 1."
8331 cid.seq_num = 1;
8332 // Multipath draft-07 "Also, the Path Identifier for the
8333 // connection ID specified in the "preferred address"
8334 // transport parameter is 0."
8335 cid.path_id = 0;
8336 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8337 quic_add_connection(pinfo, &cid);
8338 }
8339 offset += connectionid_length;
8340
8341 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8342 tvb, offset, 16, ENC_NA0x00000000);
8343 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8344 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8345 }
8346 offset += 16;
8347 }
8348 break;
8349 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8350 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8351 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8352 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8353 offset += len;
8354 break;
8355 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8356 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8357 tvb, offset, parameter_length, ENC_NA0x00000000);
8358 offset += parameter_length;
8359 break;
8360 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8361 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8362 tvb, offset, parameter_length, ENC_NA0x00000000);
8363 offset += parameter_length;
8364 break;
8365 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8366 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8367 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8368 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8369 offset += len;
8370 break;
8371 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8372 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8373 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8374 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8375 offset += len;
8376 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8377 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8378 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8379 offset += len;
8380 break;
8381 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8382 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8383 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8384 if (len > 0) {
8385 quic_add_loss_bits(pinfo, value);
8386 }
8387 offset += 1;
8388 break;
8389 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8390 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8391 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8392 offset += len;
8393 break;
8394 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8395 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8396 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8397 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8398 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8399 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8400 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8401 offset += len;
8402 break;
8403 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8404 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8405 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8406 offset += parameter_length;
8407 break;
8408 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8409 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8410 tvb, offset, parameter_length, ENC_NA0x00000000);
8411 offset += parameter_length;
8412 break;
8413 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8414 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8415 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8416 offset += 4;
8417 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8418 uint32_t versions_length;
8419
8420 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8421 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8422 offset += 1;
8423 for (i = 0; i < versions_length / 4; i++) {
8424 quic_proto_tree_add_version(tvb, parameter_tree,
8425 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8426 offset += 4;
8427 }
8428 }
8429 break;
8430 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8431 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8432 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8433 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8434 offset += len;
8435 break;
8436 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8437 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8438 tvb, offset, parameter_length, ENC_NA0x00000000);
8439 offset += parameter_length;
8440 break;
8441 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8442 /* This field was used for non-standard Google-specific parameters encoded as a
8443 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8444 * parameters. Report it as a bytes blob... */
8445 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8446 tvb, offset, parameter_length, ENC_NA0x00000000);
8447 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8448 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8449 tvb, offset, 4, ENC_NA0x00000000);
8450 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8451 offset += parameter_length;
8452 break;
8453 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8454 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8455 tvb, offset, parameter_length, ENC_NA0x00000000);
8456 offset += parameter_length;
8457 break;
8458 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8459 /* No Payload */
8460 break;
8461 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8462 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8463 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8464 offset += parameter_length;
8465 break;
8466 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8467 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8468 quic_proto_tree_add_version(tvb, parameter_tree,
8469 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8470 offset += 4;
8471 for (i = 4; i < parameter_length; i += 4) {
8472 quic_proto_tree_add_version(tvb, parameter_tree,
8473 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8474 offset += 4;
8475 }
8476 break;
8477 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8478 /* No Payload */
8479 quic_add_grease_quic_bit(pinfo);
8480 break;
8481 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8482 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8483 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8484 offset += parameter_length;
8485 break;
8486 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8487 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8488 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8489 if (value == 1) {
8490 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8491 }
8492 offset += parameter_length;
8493 break;
8494 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8495 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8496 /* No Payload */
8497 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8498 break;
8499 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8500 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8501 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8502 if (value > 1) {
8503 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8504 }
8505 /* multipath draft-07: "The value of the initial_max_paths
8506 * parameter MUST be at least 2." TODO: Expert Info? */
8507 offset += parameter_length;
8508 break;
8509 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8510 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8511 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8512 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8513 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8514 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8515 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8516 /* multipath draft-09 and later: "If an endpoint receives an
8517 * initial_max_path_id transport parameter with value 0, the
8518 * peer aims to enable the multipath extension without allowing
8519 * extra paths immediately."
8520 */
8521 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8522 offset += parameter_length;
8523 break;
8524 default:
8525 offset += parameter_length;
8526 /*TODO display expert info about unknown ? */
8527 break;
8528 }
8529
8530 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8531 /* Dissection did not end at expected location, fix it. */
8532 offset = parameter_end_offset;
8533 }
8534 }
8535
8536 return offset;
8537}
8538
8539static int
8540ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8541 proto_tree *tree, uint32_t offset,
8542 SslSession *session, SslDecryptSession *ssl,
8543 bool_Bool from_server, bool_Bool is_hrr)
8544{
8545 uint8_t sessid_length;
8546 proto_item *ti;
8547 proto_tree *rnd_tree;
8548 proto_tree *ti_rnd;
8549 proto_tree *ech_confirm_tree;
8550 uint8_t draft_version = session->tls13_draft_version;
8551
8552 if (ssl) {
8553 StringInfo *rnd;
8554 if (from_server)
8555 rnd = &ssl->server_random;
8556 else
8557 rnd = &ssl->client_random;
8558
8559 /* save provided random for later keyring generation */
8560 tvb_memcpy(tvb, rnd->data, offset, 32);
8561 rnd->data_len = 32;
8562 if (from_server)
8563 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8564 else
8565 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8566 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8567 from_server ? "SERVER" : "CLIENT", ssl->state);
8568 }
8569
8570 if (!from_server && session->client_random.data_len == 0) {
8571 session->client_random.data_len = 32;
8572 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8573 }
8574
8575 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8576
8577 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8578
8579 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8580 /* show the time */
8581 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8582 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8583 offset += 4;
8584
8585 /* show the random bytes */
8586 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8587 tvb, offset, 28, ENC_NA0x00000000);
8588 offset += 28;
8589 } else {
8590 if (is_hrr) {
8591 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8592 } else if (from_server && session->ech) {
8593 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8594 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
8595 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
8596 session->ech_confirmation, 8);
8597 proto_item_set_generated(ti);
8598 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
8599 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
8600 } else {
8601 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
8602 }
8603 }
8604
8605 offset += 32;
8606 }
8607
8608 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8609 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8610 /* show the session id (length followed by actual Session ID) */
8611 sessid_length = tvb_get_uint8(tvb, offset);
8612 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8613 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8614 offset++;
8615
8616 if (ssl) {
8617 /* save the authoritative SID for later use in ChangeCipherSpec.
8618 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8619 * save more, so ignore larger ones. To support ECH, also save
8620 * the SID from the ClientHelloOuter. */
8621 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8622 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8623 ssl->session_id.data_len = sessid_length;
8624 }
8625 }
8626 if (sessid_length > 0) {
8627 proto_tree_add_item(tree, hf->hf.hs_session_id,
8628 tvb, offset, sessid_length, ENC_NA0x00000000);
8629 offset += sessid_length;
8630 }
8631 }
8632
8633 return offset;
8634}
8635
8636static int
8637ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8638 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8639 bool_Bool has_length)
8640{
8641 /* TLS 1.2/1.3 status_request Client Hello Extension.
8642 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8643 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8644 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8645 * struct {
8646 * CertificateStatusType status_type;
8647 * uint16 request_length; // for status_request_v2
8648 * select (status_type) {
8649 * case ocsp: OCSPStatusRequest;
8650 * case ocsp_multi: OCSPStatusRequest;
8651 * } request;
8652 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8653 *
8654 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8655 * struct {
8656 * ResponderID responder_id_list<0..2^16-1>;
8657 * Extensions request_extensions;
8658 * } OCSPStatusRequest;
8659 * opaque ResponderID<1..2^16-1>;
8660 * opaque Extensions<0..2^16-1>;
8661 */
8662 unsigned cert_status_type;
8663
8664 cert_status_type = tvb_get_uint8(tvb, offset);
8665 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8666 tvb, offset, 1, ENC_NA0x00000000);
8667 offset++;
8668
8669 if (has_length) {
8670 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8671 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8672 offset += 2;
8673 }
8674
8675 switch (cert_status_type) {
8676 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8677 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8678 {
8679 uint32_t responder_id_list_len;
8680 uint32_t request_extensions_len;
8681
8682 /* ResponderID responder_id_list<0..2^16-1> */
8683 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8684 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8685 return offset_end;
8686 }
8687 offset += 2;
8688 if (responder_id_list_len != 0) {
8689 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8690 tvb, offset, responder_id_list_len,
8691 "Responder ID list is not implemented, contact Wireshark"
8692 " developers if you want this to be supported");
8693 }
8694 offset += responder_id_list_len;
8695
8696 /* opaque Extensions<0..2^16-1> */
8697 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8698 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8699 return offset_end;
8700 }
8701 offset += 2;
8702 if (request_extensions_len != 0) {
8703 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8704 tvb, offset, request_extensions_len,
8705 "Request Extensions are not implemented, contact"
8706 " Wireshark developers if you want this to be supported");
8707 }
8708 offset += request_extensions_len;
8709 break;
8710 }
8711 }
8712
8713 return offset;
8714}
8715
8716static unsigned
8717ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8718 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8719{
8720 /* https://tools.ietf.org/html/rfc6961#section-2.2
8721 * struct {
8722 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8723 * } CertificateStatusRequestListV2;
8724 */
8725 uint32_t req_list_length, next_offset;
8726
8727 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8728 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8729 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8730 return offset_end;
8731 }
8732 offset += 2;
8733 next_offset = offset + req_list_length;
8734
8735 while (offset < next_offset) {
8736 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8737 }
8738
8739 return offset;
8740}
8741
8742static uint32_t
8743tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8744 uint32_t offset, uint32_t offset_end)
8745{
8746 uint32_t response_length;
8747 proto_item *ocsp_resp;
8748 proto_tree *ocsp_resp_tree;
8749 asn1_ctx_t asn1_ctx;
8750
8751 /* opaque OCSPResponse<1..2^24-1>; */
8752 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8753 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8754 return offset_end;
8755 }
8756 offset += 3;
8757
8758 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8759 response_length, ENC_BIG_ENDIAN0x00000000);
8760 proto_item_set_text(ocsp_resp, "OCSP Response");
8761 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8762 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8763 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8764 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8765 }
8766 offset += response_length;
8767
8768 return offset;
8769}
8770
8771uint32_t
8772tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8773 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8774{
8775 /* TLS 1.2 "CertificateStatus" handshake message.
8776 * TLS 1.3 "status_request" Certificate extension.
8777 * struct {
8778 * CertificateStatusType status_type;
8779 * select (status_type) {
8780 * case ocsp: OCSPResponse;
8781 * case ocsp_multi: OCSPResponseList; // status_request_v2
8782 * } response;
8783 * } CertificateStatus;
8784 * opaque OCSPResponse<1..2^24-1>;
8785 * struct {
8786 * OCSPResponse ocsp_response_list<1..2^24-1>;
8787 * } OCSPResponseList; // status_request_v2
8788 */
8789 uint32_t status_type, resp_list_length, next_offset;
8790
8791 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
8792 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
8793 offset += 1;
8794
8795 switch (status_type) {
8796 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8797 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
8798 break;
8799
8800 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8801 /* OCSPResponse ocsp_response_list<1..2^24-1> */
8802 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
8803 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8804 return offset_end;
8805 }
8806 offset += 3;
8807 next_offset = offset + resp_list_length;
8808
8809 while (offset < next_offset) {
8810 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
8811 }
8812 break;
8813 }
8814
8815 return offset;
8816}
8817
8818static unsigned
8819ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8820 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8821 wmem_strbuf_t *ja3)
8822{
8823 /* RFC 8446 Section 4.2.7
8824 * enum { ..., (0xFFFF) } NamedGroup;
8825 * struct {
8826 * NamedGroup named_group_list<2..2^16-1>
8827 * } NamedGroupList;
8828 *
8829 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
8830 * the extension itself from "elliptic_curves" to "supported_groups".
8831 */
8832 uint32_t groups_length, next_offset;
8833 proto_tree *groups_tree;
8834 proto_item *ti;
8835 char *ja3_dash = "";
8836
8837 /* NamedGroup named_group_list<2..2^16-1> */
8838 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
8839 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
8840 return offset_end;
8841 }
8842 offset += 2;
8843 next_offset = offset + groups_length;
8844
8845 ti = proto_tree_add_none_format(tree,
8846 hf->hf.hs_ext_supported_groups,
8847 tvb, offset, groups_length,
8848 "Supported Groups (%d group%s)",
8849 groups_length / 2,
8850 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
8851
8852 /* make this a subtree */
8853 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
8854
8855 if (ja3) {
8856 wmem_strbuf_append_c(ja3, ',');
8857 }
8858 /* loop over all groups */
8859 while (offset + 2 <= offset_end) {
8860 uint32_t ext_supported_group;
8861
8862 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
8863 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
8864 offset += 2;
8865 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
8866 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
8867 ja3_dash = "-";
8868 }
8869 }
8870 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
8871 offset = next_offset;
8872 }
8873
8874 return offset;
8875}
8876
8877static int
8878ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8879 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
8880{
8881 uint8_t ecpf_length;
8882 proto_tree *ecpf_tree;
8883 proto_item *ti;
8884
8885 ecpf_length = tvb_get_uint8(tvb, offset);
8886 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
8887 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8888
8889 offset += 1;
8890 ti = proto_tree_add_none_format(tree,
8891 hf->hf.hs_ext_ec_point_formats,
8892 tvb, offset, ecpf_length,
8893 "Elliptic curves point formats (%d)",
8894 ecpf_length);
8895
8896 /* make this a subtree */
8897 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
8898
8899 if (ja3) {
8900 wmem_strbuf_append_c(ja3, ',');
8901 }
8902
8903 /* loop over all point formats */
8904 while (ecpf_length > 0)
8905 {
8906 uint32_t ext_ec_point_format;
8907
8908 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
8909 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
8910 offset++;
8911 ecpf_length--;
8912 if (ja3) {
8913 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
8914 if (ecpf_length > 0) {
8915 wmem_strbuf_append_c(ja3, '-');
8916 }
8917 }
8918 }
8919
8920 return offset;
8921}
8922
8923static int
8924ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8925 packet_info *pinfo, proto_tree *tree,
8926 uint32_t offset, uint32_t next_offset)
8927{
8928 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
8929 * opaque srp_I<1..2^8-1>;
8930 */
8931 uint32_t username_len;
8932
8933 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
8934 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
8935 return next_offset;
8936 }
8937 offset++;
8938
8939 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
8940 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
8941 offset += username_len;
8942
8943 return offset;
8944}
8945
8946static uint32_t
8947tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8948 uint32_t offset, uint32_t offset_end, uint16_t version)
8949{
8950 /* https://tools.ietf.org/html/rfc6962#section-3.2
8951 * enum { v1(0), (255) } Version;
8952 * struct {
8953 * opaque key_id[32];
8954 * } LogID;
8955 * opaque CtExtensions<0..2^16-1>;
8956 * struct {
8957 * Version sct_version;
8958 * LogID id;
8959 * uint64 timestamp;
8960 * CtExtensions extensions;
8961 * digitally-signed struct { ... };
8962 * } SignedCertificateTimestamp;
8963 */
8964 uint32_t sct_version;
8965 uint64_t sct_timestamp_ms;
8966 nstime_t sct_timestamp;
8967 uint32_t exts_len;
8968 const char *log_name;
8969
8970 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
8971 offset++;
8972 if (sct_version != 0) {
8973 // TODO expert info about unknown SCT version?
8974 return offset;
8975 }
8976 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
8977 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
8978 proto_item_append_text(tree, " (%s)", log_name);
8979 offset += 32;
8980 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
8981 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
8982 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
8983 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
8984 offset += 8;
8985 /* opaque CtExtensions<0..2^16-1> */
8986 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
8987 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
8988 return offset_end;
8989 }
8990 offset += 2;
8991 if (exts_len > 0) {
8992 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
8993 offset += exts_len;
8994 }
8995 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
8996 hf->hf.sct_sct_signature_length,
8997 hf->hf.sct_sct_signature);
8998 return offset;
8999}
9000
9001uint32_t
9002tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9003 uint32_t offset, uint32_t offset_end, uint16_t version)
9004{
9005 /* https://tools.ietf.org/html/rfc6962#section-3.3
9006 * opaque SerializedSCT<1..2^16-1>;
9007 * struct {
9008 * SerializedSCT sct_list <1..2^16-1>;
9009 * } SignedCertificateTimestampList;
9010 */
9011 uint32_t list_length, sct_length, next_offset;
9012 proto_tree *subtree;
9013
9014 /* SerializedSCT sct_list <1..2^16-1> */
9015 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9016 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9017 return offset_end;
9018 }
9019 offset += 2;
9020
9021 while (offset < offset_end) {
9022 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9023
9024 /* opaque SerializedSCT<1..2^16-1> */
9025 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9026 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9027 return offset_end;
9028 }
9029 offset += 2;
9030 next_offset = offset + sct_length;
9031 proto_item_set_len(subtree, 2 + sct_length);
9032 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9033 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9034 offset = next_offset;
9035 }
9036 }
9037
9038 return offset;
9039}
9040
9041static int
9042dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9043 proto_tree *tree, uint32_t offset)
9044{
9045 uint32_t kdf_id, aead_id;
9046 proto_item *cs_ti;
9047 proto_tree *cs_tree;
9048
9049 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9050 tvb, offset, 4, ENC_NA0x00000000);
9051 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9052
9053 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9054 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9055 offset += 2;
9056 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9057 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9058 offset += 2;
9059
9060 proto_item_append_text(cs_ti, ": %s/%s",
9061 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9062 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9063 return offset;
9064}
9065
9066static int
9067dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9068 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9069 uint32_t *config_id)
9070{
9071 uint32_t length, cipher_suite_length;
9072 proto_item *kc_ti, *css_ti;
9073 proto_tree *kc_tree, *css_tree;
9074 uint32_t original_offset = offset, next_offset;
9075
9076 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9077 tvb, offset, -1, ENC_NA0x00000000);
9078 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9079
9080 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9081 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9082 offset += 1;
9083 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9084 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9085 offset += 2;
9086 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9087 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9088 offset += 2;
9089 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9090 tvb, offset, length, ENC_NA0x00000000);
9091 offset += length;
9092
9093 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9094 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9095 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9096 return offset_end;
9097 }
9098 offset += 2;
9099 next_offset = offset + cipher_suite_length;
9100
9101 css_ti = proto_tree_add_none_format(kc_tree,
9102 hf->hf.ech_hpke_keyconfig_cipher_suites,
9103 tvb, offset, cipher_suite_length,
9104 "Cipher Suites (%d suite%s)",
9105 cipher_suite_length / 4,
9106 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9107 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9108
9109
9110 while (offset + 4 <= next_offset) {
9111 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9112 }
9113
9114 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9115 offset = next_offset;
9116 }
9117
9118 proto_item_set_len(kc_ti, offset - original_offset);
9119
9120 return offset;
9121}
9122
9123static int
9124dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9125 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9126 const uint8_t **public_name, uint32_t *config_id)
9127{
9128 uint32_t public_name_length, extensions_length, next_offset;
9129
9130 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9131 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9132 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9133 offset += 1;
9134 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9135 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9136 offset += 1;
9137 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9138 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9139 offset += public_name_length;
9140
9141 /* Extension extensions<0..2^16-1>; */
9142 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9143 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9144 return offset_end;
9145 }
9146 offset += 2;
9147 next_offset = offset + extensions_length;
9148
9149 if (extensions_length > 0) {
9150 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9151 tvb, offset, extensions_length, ENC_NA0x00000000);
9152 }
9153 offset += extensions_length;
9154
9155 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9156 offset = next_offset;
9157 }
9158
9159 return offset;
9160}
9161
9162static int
9163dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9164 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9165{
9166 uint32_t version, length;
9167 proto_item *ech_ti;
9168 proto_tree *ech_tree;
9169 const uint8_t *public_name = NULL((void*)0);
9170 uint32_t config_id = 0;
9171
9172 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9173 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9174
9175 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9176 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9177 offset += 2;
9178 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9179 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9180 offset += 2;
9181
9182 proto_item_set_len(ech_ti, 4 + length);
9183
9184 switch(version) {
9185 case 0xfe0d:
9186 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9187 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9188 break;
9189
9190 default:
9191 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9192 }
9193
9194 return 4 + length;
9195}
9196
9197uint32_t
9198ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9199 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9200{
9201 uint32_t echconfiglist_length, next_offset;
9202
9203 /* ECHConfig ECHConfigList<1..2^16-1>; */
9204 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9205 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9206 return offset_end;
9207 }
9208 offset += 2;
9209 next_offset = offset + echconfiglist_length;
9210
9211 while (offset < next_offset) {
9212 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9213 }
9214
9215 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9216 offset = next_offset;
9217 }
9218
9219 return offset;
9220}
9221
9222static uint32_t
9223ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9224 uint32_t offset, uint32_t offset_end)
9225{
9226 uint32_t ext_length, next_offset;
9227 proto_tree *ext_tree;
9228 proto_item *ti;
9229
9230 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9231 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9232 return offset_end;
9233 }
9234 offset += 1;
9235 next_offset = offset + ext_length;
9236
9237 ti = proto_tree_add_none_format(tree,
9238 hf->hf.hs_ext_ech_outer_ext,
9239 tvb, offset, ext_length,
9240 "Outer Extensions (%d extension%s)",
9241 ext_length / 2,
9242 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9243
9244 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9245
9246 while (offset + 2 <= offset_end) {
9247 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9248 offset += 2;
9249 }
9250
9251 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9252 offset = next_offset;
9253 }
9254
9255 return offset;
9256}
9257
9258static uint32_t
9259// NOLINTNEXTLINE(misc-no-recursion)
9260ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9261 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9262 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9263{
9264 uint32_t ch_type, length;
9265 proto_item *ti, *payload_ti;
9266 proto_tree *retry_tree, *payload_tree;
9267 uint32_t hello_length = tvb_reported_length(tvb);
9268
9269 switch (hnd_type) {
9270 case SSL_HND_CLIENT_HELLO:
9271 /*
9272 * enum { outer(0), inner(1) } ECHClientHelloType;
9273 *
9274 * struct {
9275 * ECHClientHelloType type;
9276 * select (ECHClientHello.type) {
9277 * case outer:
9278 * HpkeSymmetricCipherSuite cipher_suite;
9279 * uint8 config_id;
9280 * opaque enc<0..2^16-1>;
9281 * opaque payload<1..2^16-1>;
9282 * case inner:
9283 * Empty;
9284 * };
9285 * } ECHClientHello;
9286 */
9287
9288 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9289 offset += 1;
9290 switch (ch_type) {
9291 case 0: /* outer */
9292 if (ssl && session->first_ch_ech_frame == 0) {
9293 session->first_ch_ech_frame = pinfo->num;
9294 }
9295 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9296 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9297 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9298
9299 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9300 uint8_t config_id = tvb_get_uint8(tvb, offset);
9301 offset += 1;
9302 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9303 offset += 2;
9304 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9305 offset += length;
9306 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9307 offset += 2;
9308 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9309 offset += length;
9310
9311 if (!mk_map) {
9312 break;
9313 }
9314 if (session->client_random.data_len == 0) {
9315 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9316 break;
9317 }
9318 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9319 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9320 if (!ech_secret || !ech_config) {
9321 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9322 G_STRFUNC((const char*) (__func__)));
9323 break;
9324 }
9325
9326 if (hpke_hkdf_len(kdf_id) == 0) {
9327 ssl_debug_printf("Unsupported KDF\n");
9328 break;
9329 }
9330
9331 if (hpke_aead_key_len(aead_id) == 0) {
9332 ssl_debug_printf("Unsupported AEAD\n");
9333 break;
9334 }
9335
9336 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9337
9338 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9339 if (length < aead_auth_tag_len) {
9340 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9341 break;
9342 }
9343 unsigned decrypted_len = length - aead_auth_tag_len;
9344
9345 uint16_t version = pntohu16(ech_config->data);
9346 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9347 ssl_debug_printf("Unexpected version in ECH Config\n");
9348 break;
9349 }
9350 uint32_t ech_config_offset = 2;
9351 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9352 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9353 break;
9354 }
9355 ech_config_offset += 2;
9356 if (*(ech_config->data + ech_config_offset) != config_id) {
9357 ssl_debug_printf("ECH Config version mismatch\n");
9358 break;
9359 }
9360 ech_config_offset += 1;
9361 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9362 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9363 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9364 GByteArray *info = g_byte_array_new();
9365 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9366 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9367 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9368 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9369 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9370 key, base_nonce)) {
9371 g_byte_array_free(info, TRUE(!(0)));
9372 break;
9373 }
9374 g_byte_array_free(info, TRUE(!(0)));
9375 gcry_cipher_hd_t cipher;
9376 if (hpke_setup_aead(&cipher, aead_id, key) ||
9377 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9378 gcry_cipher_close(cipher);
9379 break;
9380 }
9381 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9382 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9383 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9384 memset(ech_aad + offset - length, 0, length);
9385 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9386 gcry_cipher_close(cipher);
9387 wmem_free(NULL((void*)0), ech_aad);
9388 break;
9389 }
9390 wmem_free(NULL((void*)0), ech_aad);
9391 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9392 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9393 gcry_cipher_close(cipher);
9394 break;
9395 }
9396 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9397 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9398 gcry_cipher_close(cipher);
9399 break;
9400 }
9401 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9402 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9403 gcry_cipher_close(cipher);
9404 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9405 payload + decrypted_len, aead_auth_tag_len)) {
9406 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9407 } else {
9408 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9409 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9410 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9411 if (ssl) {
9412 /* Note the Outer Client Random for Inject TLS Secrets */
9413 tls_save_crandom(ssl, mk_map);
9414
9415 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9416 uint32_t len_offset = ssl->ech_transcript.data_len;
9417 if (ssl->ech_transcript.data_len > 0)
9418 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9419 ssl->ech_transcript.data_len + hello_length + 4);
9420 else
9421 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9422 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9423 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9424 /* Copy ClientHelloInner up to the legacy_session_id field. */
9425 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9426 ssl->ech_transcript.data_len += 38;
9427 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9428 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = ssl->session_id.data_len;
9429 ssl->ech_transcript.data_len++;
9430 memcpy(&ssl->ech_transcript.data[ssl->ech_transcript.data_len], ssl->session_id.data, ssl->session_id.data_len);
9431 ssl->ech_transcript.data_len += ssl->session_id.data_len;
9432 /* Skip past the legacy_session_id field in ClientHelloInner
9433 * (which should be the empty string, i.e. just a 0 size.) */
9434 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9435 /* Copy the Cipher Suites from ClientHelloInner. */
9436 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9437 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9438 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9439 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9440 /* Copy the Compression Methods */
9441 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9442 1 + tvb_get_uint8(ech_tvb, ech_offset));
9443 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9444 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9445 /* Now replace extensions in ech_outer_extensions with the
9446 * data from ClientHelloOuter. */
9447 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9448 ssl->ech_transcript.data_len += 2;
9449 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9450 ech_offset += 2;
9451 bool_Bool ech_outer_extensions_found = false0;
9452 while (extensions_end - ech_offset >= 4) {
9453 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9454 ech_offset += 2;
9455 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9456 ech_offset += 2;
9457 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9458 /* Copy this extension directly */
9459 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len,
9460 ech_offset - 4, 4 + ext_len);
9461 ssl->ech_transcript.data_len += 4 + ext_len;
9462 ech_offset += ext_len;
9463 } else if (ext_len > 0) {
9464 if (ech_outer_extensions_found) {
9465 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9466 /* This could lead to a buffer overflow by
9467 * making the post-copying ClientHelloInner
9468 * longer than ClientHelloOuter and is
9469 * illegal, so skip this and don't copy. */
9470 ech_offset += ext_len;
9471 continue;
9472 }
9473 ech_outer_extensions_found = true1;
9474 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9475 ech_offset += 1;
9476 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9477 /* In ClientHelloOuter, skip past the legacy_session_id */
9478 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9479 /* Skip past Cipher Suites */
9480 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9481 /* Skip past Compression Methods */
9482 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9483 /* Now at the start of ClientHelloOuter's extensions */
9484 while (ech_outer_extensions_end - ech_offset >= 2) {
9485 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9486 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9487 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9488 /* This could lead to a buffer overflow by
9489 * making the post-copying ClientHelloInner
9490 * longer than ClientHelloOuter and is
9491 * illegal, so don't copy. */
9492 break;
9493 }
9494 bool_Bool found = false0;
9495 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9496 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9497 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9498 if (ext_type == outer_ext_type) {
9499 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9500 4 + outer_ext_len);
9501 ssl->ech_transcript.data_len += 4 + outer_ext_len;
9502 outer_offset += 4 + outer_ext_len;
9503 found = true1;
9504 break;
9505 } else {
9506 outer_offset += 4 + outer_ext_len;
9507 }
9508 }
9509 if (!found) {
9510 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9511 }
9512 ech_offset += 2;
9513 }
9514 }
9515 }
9516 uint16_t ech_extensions_len = ssl->ech_transcript.data_len - ech_extensions_len_offset - 2;
9517 phtonu16(&ssl->ech_transcript.data[ech_extensions_len_offset], ech_extensions_len);
9518 phtonu16(&ssl->ech_transcript.data[len_offset + 2], ssl->ech_transcript.data_len - len_offset - 4);
9519 }
9520 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9521 ssl, NULL((void*)0), mk_map);
9522 if (ech_padding_begin < decrypted_len) {
9523 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9524 ENC_NA0x00000000);
9525 }
9526 }
9527
9528 break;
9529 case 1: /* inner */
9530 break;
9531 }
9532 break;
9533
9534 case SSL_HND_ENCRYPTED_EXTENSIONS:
9535 /*
9536 * struct {
9537 * ECHConfigList retry_configs;
9538 * } ECHEncryptedExtensions;
9539 */
9540
9541 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9542 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9543 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9544 break;
9545
9546 case SSL_HND_HELLO_RETRY_REQUEST:
9547 /*
9548 * struct {
9549 * opaque confirmation[8];
9550 * } ECHHelloRetryRequest;
9551 */
9552
9553 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9554 if (session->ech) {
9555 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9556 proto_item_set_generated(ti);
9557 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
9558 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9559 } else {
9560 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9561 }
9562 }
9563 offset += 8;
9564 break;
9565 }
9566
9567 return offset;
9568}
9569
9570static uint32_t
9571ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9572 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9573 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9574{
9575 uint32_t record_digest_length, encrypted_sni_length;
9576
9577 switch (hnd_type) {
9578 case SSL_HND_CLIENT_HELLO:
9579 /*
9580 * struct {
9581 * CipherSuite suite;
9582 * KeyShareEntry key_share;
9583 * opaque record_digest<0..2^16-1>;
9584 * opaque encrypted_sni<0..2^16-1>;
9585 * } ClientEncryptedSNI;
9586 */
9587 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9588 offset += 2;
9589 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9590
9591 /* opaque record_digest<0..2^16-1> */
9592 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9593 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9594 return offset_end;
9595 }
9596 offset += 2;
9597 if (record_digest_length > 0) {
9598 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9599 offset += record_digest_length;
9600 }
9601
9602 /* opaque encrypted_sni<0..2^16-1> */
9603 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9604 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9605 return offset_end;
9606 }
9607 offset += 2;
9608 if (encrypted_sni_length > 0) {
9609 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9610 offset += encrypted_sni_length;
9611 }
9612 break;
9613
9614 case SSL_HND_ENCRYPTED_EXTENSIONS:
9615 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9616 offset += 16;
9617 break;
9618 }
9619
9620 return offset;
9621}
9622/** TLS Extensions (in Client Hello and Server Hello). }}} */
9623
9624/* Connection ID dissection. {{{ */
9625static uint32_t
9626ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9627 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9628 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9629{
9630 /* keep track of the decrypt session only for the first pass */
9631 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9632 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9633 *session_cidl = cidl;
9634 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9635 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9636 if (ssl) {
9637 ssl_add_session_by_cid(ssl);
9638 }
9639 }
9640
9641 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9642 tvb, offset, 1, ENC_NA0x00000000);
9643 offset++;
9644
9645 if (cidl > 0) {
9646 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9647 tvb, offset, cidl, ENC_NA0x00000000);
9648 offset += cidl;
9649 }
9650
9651 return offset;
9652}
9653
9654static uint32_t
9655ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9656 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9657 SslSession *session, SslDecryptSession *ssl)
9658{
9659 uint8_t cidl = tvb_get_uint8(tvb, offset);
9660
9661 switch (hnd_type) {
9662 case SSL_HND_CLIENT_HELLO:
9663 session->client_cid_len_present = true1;
9664 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9665 cidl, &session->client_cid, &session->client_cid_len);
9666 case SSL_HND_SERVER_HELLO:
9667 session->server_cid_len_present = true1;
9668 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9669 cidl, &session->server_cid, &session->server_cid_len);
9670 default:
9671 return offset;
9672 }
9673} /* }}} */
9674
9675/* Trusted CA dissection. {{{ */
9676static uint32_t
9677ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9678 uint32_t offset, uint32_t offset_end)
9679{
9680 proto_item *ti;
9681 proto_tree *subtree;
9682 uint32_t keys_length, next_offset;
9683
9684 /*
9685 * struct {
9686 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9687 * } TrustedAuthorities;
9688 *
9689 * struct {
9690 * IdentifierType identifier_type;
9691 * select (identifier_type) {
9692 * case pre_agreed: struct {};
9693 * case key_sha1_hash: SHA1Hash;
9694 * case x509_name: DistinguishedName;
9695 * case cert_sha1_hash: SHA1Hash;
9696 * } identifier;
9697 * } TrustedAuthority;
9698 *
9699 * enum {
9700 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9701 * cert_sha1_hash(3), (255)
9702 * } IdentifierType;
9703 *
9704 * opaque DistinguishedName<1..2^16-1>;
9705 *
9706 */
9707
9708
9709 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9710 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9711 0, UINT16_MAX(65535)))
9712 {
9713 return offset_end;
9714 }
9715 offset += 2;
9716 next_offset = offset + keys_length;
9717
9718 if (keys_length > 0)
9719 {
9720 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9721 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9722 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9723
9724 while (offset < next_offset)
9725 {
9726 uint32_t identifier_type;
9727 proto_tree *trusted_key_tree;
9728 proto_item *trusted_key_item;
9729 asn1_ctx_t asn1_ctx;
9730 uint32_t key_len = 0;
9731
9732 identifier_type = tvb_get_uint8(tvb, offset);
9733
9734 // Use 0 as length for now as we'll only know the size when we decode the identifier
9735 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9736 offset, 0, "Trusted CA Key");
9737 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9738
9739 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9740 offset, 1, identifier_type);
9741 offset++;
9742
9743 /*
9744 * enum {
9745 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9746 * cert_sha1_hash(3), (255)
9747 * } IdentifierType;
9748 */
9749 switch (identifier_type)
9750 {
9751 case 0:
9752 key_len = 0;
9753 break;
9754 case 2:
9755 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9756
9757 uint32_t name_length;
9758 /* opaque DistinguishedName<1..2^16-1> */
9759 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9760 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9761 return next_offset;
9762 }
9763 offset += 2;
9764
9765 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9766 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9767 offset += name_length;
9768 break;
9769 case 1:
9770 case 3:
9771 key_len = 20;
9772 /* opaque SHA1Hash[20]; */
9773 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
9774 offset, 20, ENC_NA0x00000000);
9775 break;
9776
9777 default:
9778 key_len = 0;
9779 /*TODO display expert info about unknown ? */
9780 break;
9781 }
9782 proto_item_set_len(trusted_key_item, 1 + key_len);
9783 offset += key_len;
9784 }
9785 }
9786
9787 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
9788 {
9789 offset = next_offset;
9790 }
9791
9792 return offset;
9793} /* }}} */
9794
9795
9796/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
9797bool_Bool
9798ssl_is_valid_content_type(uint8_t type)
9799{
9800 switch ((ContentType) type) {
9801 case SSL_ID_CHG_CIPHER_SPEC:
9802 case SSL_ID_ALERT:
9803 case SSL_ID_HANDSHAKE:
9804 case SSL_ID_APP_DATA:
9805 case SSL_ID_HEARTBEAT:
9806 case SSL_ID_TLS12_CID:
9807 case SSL_ID_DTLS13_ACK:
9808 return true1;
9809 }
9810 return false0;
9811}
9812
9813bool_Bool
9814ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
9815{
9816 switch ((HandshakeType) hs_type) {
9817 case SSL_HND_HELLO_VERIFY_REQUEST:
9818 /* hello_verify_request is DTLS-only */
9819 return is_dtls;
9820
9821 case SSL_HND_HELLO_REQUEST:
9822 case SSL_HND_CLIENT_HELLO:
9823 case SSL_HND_SERVER_HELLO:
9824 case SSL_HND_NEWSESSION_TICKET:
9825 case SSL_HND_END_OF_EARLY_DATA:
9826 case SSL_HND_HELLO_RETRY_REQUEST:
9827 case SSL_HND_ENCRYPTED_EXTENSIONS:
9828 case SSL_HND_CERTIFICATE:
9829 case SSL_HND_SERVER_KEY_EXCHG:
9830 case SSL_HND_CERT_REQUEST:
9831 case SSL_HND_SVR_HELLO_DONE:
9832 case SSL_HND_CERT_VERIFY:
9833 case SSL_HND_CLIENT_KEY_EXCHG:
9834 case SSL_HND_FINISHED:
9835 case SSL_HND_CERT_URL:
9836 case SSL_HND_CERT_STATUS:
9837 case SSL_HND_SUPPLEMENTAL_DATA:
9838 case SSL_HND_KEY_UPDATE:
9839 case SSL_HND_COMPRESSED_CERTIFICATE:
9840 case SSL_HND_ENCRYPTED_EXTS:
9841 return true1;
9842 case SSL_HND_MESSAGE_HASH:
9843 return false0;
9844 }
9845 return false0;
9846}
9847
9848static bool_Bool
9849ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
9850 bool_Bool is_dtls)
9851{
9852 /* Consider all valid Handshake messages (except for Client Hello) and
9853 * all other valid record types (other than Handshake) */
9854 return (content_type == SSL_ID_HANDSHAKE &&
9855 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
9856 handshake_type != SSL_HND_CLIENT_HELLO) ||
9857 (content_type != SSL_ID_HANDSHAKE &&
9858 ssl_is_valid_content_type(content_type));
9859}
9860
9861/**
9862 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
9863 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
9864 * Returns true if the supported_versions extension was found, false if not.
9865 */
9866bool_Bool
9867tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
9868 uint16_t *server_version, bool_Bool *is_hrr)
9869{
9870 /* SHA256("HelloRetryRequest") */
9871 static const uint8_t tls13_hrr_random_magic[] = {
9872 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
9873 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
9874 };
9875 uint8_t session_id_length;
9876
9877 *server_version = tvb_get_ntohs(tvb, offset);
9878
9879 /*
9880 * Try to look for supported_versions extension. Minimum length:
9881 * 2 + 32 + 1 = 35 (version, random, session id length)
9882 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9883 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9884 *
9885 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9886 * there's a separate expert info warning for that.
9887 */
9888 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9889 offset += 2;
9890 if (is_hrr) {
9891 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
9892 }
9893 offset += 32;
9894 session_id_length = tvb_get_uint8(tvb, offset);
9895 offset++;
9896 if (offset_end - offset < session_id_length + 5u) {
9897 return false0;
9898 }
9899 offset += session_id_length + 5;
9900
9901 while (offset_end - offset >= 6) {
9902 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9903 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9904 if (offset_end - offset < 4u + ext_len) {
9905 break; /* not enough data for type, length and data */
9906 }
9907 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9908 if (ext_len == 2) {
9909 *server_version = tvb_get_ntohs(tvb, offset + 4);
9910 }
9911 return true1;
9912 }
9913 offset += 4 + ext_len;
9914 }
9915 } else {
9916 if (is_hrr) {
9917 *is_hrr = false0;
9918 }
9919 }
9920 return false0;
9921}
9922
9923/**
9924 * Scan a Client Hello handshake message to see if the supported_versions
9925 * extension is found, in which case the version field is legacy_version.
9926 */
9927static bool_Bool
9928tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
9929{
9930 uint8_t session_id_length;
9931
9932 uint16_t client_version = tvb_get_ntohs(tvb, offset);
9933
9934 /*
9935 * Try to look for supported_versions extension. Minimum length:
9936 * 2 + 32 + 1 = 35 (version, random, session id length)
9937 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9938 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9939 *
9940 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9941 * there's a separate expert info warning for that.
9942 */
9943 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9944 offset += 2;
9945 offset += 32;
9946 session_id_length = tvb_get_uint8(tvb, offset);
9947 offset++;
9948 if (offset_end - offset < session_id_length + 2u) {
9949 return false0;
9950 }
9951 offset += session_id_length;
9952 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
9953 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
9954 offset++;
9955 if (offset_end - offset < cookie_length + 2u) {
9956 return false0;
9957 }
9958 }
9959 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
9960 offset += 2;
9961 if (offset_end - offset < cipher_suites_length + 1u) {
9962 return false0;
9963 }
9964 offset += cipher_suites_length;
9965 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
9966 offset++;
9967 if (offset_end - offset < compression_methods_length + 2u) {
9968 return false0;
9969 }
9970 offset += compression_methods_length + 2;
9971
9972 while (offset_end - offset >= 6) {
9973 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9974 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9975 if (offset_end - offset < 4u + ext_len) {
9976 break; /* not enough data for type, length and data */
9977 }
9978 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9979 return true1;
9980 }
9981 offset += 4 + ext_len;
9982 }
9983 }
9984 return false0;
9985}
9986void
9987ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
9988 uint8_t content_type, uint8_t handshake_type,
9989 bool_Bool is_dtls, uint16_t version)
9990{
9991 uint8_t tls13_draft = 0;
9992
9993 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
9994 is_dtls))
9995 return;
9996
9997 version = tls_try_get_version(is_dtls, version, &tls13_draft);
9998 if (version == SSL_VER_UNKNOWN0) {
9999 return;
10000 }
10001
10002 session->tls13_draft_version = tls13_draft;
10003 session->version = version;
10004 if (ssl) {
10005 ssl->state |= SSL_VERSION(1<<4);
10006 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10007 }
10008}
10009
10010void
10011ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10012 ContentType content_type,
10013 unsigned record_length, proto_item *length_pi,
10014 uint16_t version, tvbuff_t *decrypted_tvb)
10015{
10016 unsigned max_expansion;
10017 if (version == TLSV1DOT3_VERSION0x304) {
10018 /* TLS 1.3: Max length is 2^14 + 256 */
10019 max_expansion = 256;
10020 } else {
10021 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10022 max_expansion = 2048;
10023 }
10024 /*
10025 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10026 * and ChangeCipherSpec.
10027 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10028 * so assume it is permitted.
10029 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10030 * assume TLS 1.2 requirements.
10031 */
10032 if (record_length == 0 &&
10033 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10034 content_type == SSL_ID_ALERT ||
10035 content_type == SSL_ID_HANDSHAKE)) {
10036 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10037 "Zero-length %s fragments are not allowed",
10038 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10039 }
10040 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10041 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10042 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10043 }
10044 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10045 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10046 "TLSPlaintext length MUST NOT exceed 2^14");
10047 }
10048}
10049
10050static void
10051ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10052{
10053 /* store selected cipher suite for decryption */
10054 ssl->session.cipher = cipher;
10055
10056 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10057 if (!cs) {
10058 ssl->cipher_suite = NULL((void*)0);
10059 ssl->state &= ~SSL_CIPHER(1<<2);
10060 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10061 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10062 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10063 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10064 * to avoid a potential buffer overflow in ssl3_check_mac. */
10065 ssl->cipher_suite = NULL((void*)0);
10066 ssl->state &= ~SSL_CIPHER(1<<2);
10067 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10068 } else {
10069 /* Cipher found, save this for the delayed decoder init */
10070 ssl->cipher_suite = cs;
10071 ssl->state |= SSL_CIPHER(1<<2);
10072 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10073 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10074 ssl->state);
10075 }
10076}
10077/* }}} */
10078
10079
10080/* Client Hello and Server Hello dissections. {{{ */
10081static int
10082ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10083 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10084 SslSession *session, SslDecryptSession *ssl,
10085 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10086 ssl_master_key_map_t *mk_map);
10087int
10088// NOLINTNEXTLINE(misc-no-recursion)
10089ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10090 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10091 uint32_t offset_end, SslSession *session,
10092 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10093{
10094 /* struct {
10095 * ProtocolVersion client_version;
10096 * Random random;
10097 * SessionID session_id;
10098 * opaque cookie<0..32>; //new field for DTLS
10099 * CipherSuite cipher_suites<2..2^16-1>;
10100 * CompressionMethod compression_methods<1..2^8-1>;
10101 * Extension client_hello_extension_list<0..2^16-1>;
10102 * } ClientHello;
10103 */
10104 proto_item *ti;
10105 proto_tree *cs_tree;
10106 uint32_t client_version;
10107 uint32_t cipher_suite_length;
10108 uint32_t compression_methods_length;
10109 uint8_t compression_method;
10110 uint32_t next_offset;
10111 uint32_t initial_offset = offset;
10112 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10113 char *ja3_hash;
10114 char *ja3_dash = "";
10115 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10116 ja4_data_t ja4_data;
10117 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10118 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10119 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10120 wmem_list_frame_t *curr_entry;
10121
10122 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10122, (int64_t)initial_offset, (int64_t)offset_end))));
10123 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10124 offset = 0;
10125 offset_end = tvb_reported_length(hello_tvb);
10126
10127 ja4_data.max_version = 0;
10128 ja4_data.server_name_present = false0;
10129 ja4_data.num_cipher_suites = 0;
10130 ja4_data.num_extensions = 0;
10131 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10132 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10133 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10134 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10135
10136 /* show the client version */
10137 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10138 offset, 2, ENC_BIG_ENDIAN0x00000000,
10139 &client_version);
10140 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10141 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10142 }
10143 offset += 2;
10144 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10145
10146 /*
10147 * Is it version 1.3?
10148 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10149 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10150 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10151 * Hello".
10152 */
10153 if (dtls_hfs != NULL((void*)0)) {
10154 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10155 /* Don't do that. */
10156 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10157 }
10158 } else {
10159 if (client_version == TLSV1DOT3_VERSION0x304) {
10160 /* Don't do that. */
10161 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10162 }
10163 }
10164
10165 /* dissect fields that are present in both ClientHello and ServerHello */
10166 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10167
10168 /* fields specific for DTLS (cookie_len, cookie) */
10169 if (dtls_hfs != NULL((void*)0)) {
10170 uint32_t cookie_length;
10171 /* opaque cookie<0..32> (for DTLS only) */
10172 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10173 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10174 return offset;
10175 }
10176 offset++;
10177 if (cookie_length > 0) {
10178 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10179 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10180 offset += cookie_length;
10181 }
10182 }
10183
10184 /* CipherSuite cipher_suites<2..2^16-1> */
10185 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10186 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10187 return offset;
10188 }
10189 offset += 2;
10190 next_offset = offset + cipher_suite_length;
10191 ti = proto_tree_add_none_format(tree,
10192 hf->hf.hs_cipher_suites,
10193 hello_tvb, offset, cipher_suite_length,
10194 "Cipher Suites (%d suite%s)",
10195 cipher_suite_length / 2,
10196 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10197 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10198 while (offset + 2 <= next_offset) {
10199 uint32_t cipher_suite;
10200
10201 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10202 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10203 offset += 2;
10204 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10205 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10206 ja3_dash = "-";
10207 ja4_data.num_cipher_suites += 1;
10208 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10209 }
10210 }
10211 wmem_strbuf_append_c(ja3, ',');
10212 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10213 offset = next_offset;
10214 }
10215
10216 /* CompressionMethod compression_methods<1..2^8-1> */
10217 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10218 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10219 return offset;
10220 }
10221 offset++;
10222 next_offset = offset + compression_methods_length;
10223 ti = proto_tree_add_none_format(tree,
10224 hf->hf.hs_comp_methods,
10225 hello_tvb, offset, compression_methods_length,
10226 "Compression Methods (%u method%s)",
10227 compression_methods_length,
10228 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10229 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10230 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10231 while (offset < next_offset) {
10232 compression_method = tvb_get_uint8(hello_tvb, offset);
10233 /* TODO: make reserved/private comp meth. fields selectable */
10234 if (compression_method < 64)
10235 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10236 hello_tvb, offset, 1, compression_method);
10237 else if (compression_method < 193)
10238 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10239 compression_method, "Reserved - to be assigned by IANA (%u)",
10240 compression_method);
10241 else
10242 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10243 compression_method, "Private use range (%u)",
10244 compression_method);
10245 offset++;
10246 }
10247
10248 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10249 if (offset < offset_end) {
10250 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10251 offset_end, SSL_HND_CLIENT_HELLO,
10252 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10253 if (ja4_data.max_version > 0) {
10254 client_version = ja4_data.max_version;
10255 }
10256 } else {
10257 wmem_strbuf_append_printf(ja3, ",,");
10258 }
10259
10260 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10261 wmem_strbuf_append(ja4_a, "t");
10262 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10263 wmem_strbuf_append(ja4_a, "q");
10264 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10265 wmem_strbuf_append(ja4_a, "d");
10266 }
10267 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10268 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10269 if (ja4_data.num_cipher_suites > 99) {
10270 wmem_strbuf_append(ja4_a, "99");
10271 } else {
10272 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10273 }
10274 if (ja4_data.num_extensions > 99) {
10275 wmem_strbuf_append(ja4_a, "99");
10276 } else {
10277 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10278 }
10279 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10280 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10281 } else {
10282 wmem_strbuf_append(ja4_a, "00");
10283 }
10284
10285 curr_entry = wmem_list_head(ja4_data.cipher_list);
10286 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10287 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10288 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10289 wmem_strbuf_append(ja4_br, ",");
10290 }
10291 curr_entry = wmem_list_frame_next(curr_entry);
10292 }
10293
10294 curr_entry = wmem_list_head(ja4_data.extension_list);
10295 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10296 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10297 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10298 wmem_strbuf_append(ja4_cr, ",");
10299 }
10300 curr_entry = wmem_list_frame_next(curr_entry);
10301 }
10302
10303 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10304 wmem_strbuf_append(ja4_cr, "_");
10305 curr_entry = wmem_list_head(ja4_data.sighash_list);
10306 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10307 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10308 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10309 wmem_strbuf_append(ja4_cr, ",");
10310 }
10311 curr_entry = wmem_list_frame_next(curr_entry);
10312 }
10313 }
10314 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10315 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10316 } else {
10317 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10318 }
10319 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10320
10321 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10322 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10323 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10324 } else {
10325 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10326 }
10327 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10328 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10329
10330 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10331 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10332
10333 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10334 proto_item_set_generated(ti);
10335 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10336 proto_item_set_generated(ti);
10337
10338 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10339 wmem_strbuf_get_len(ja3));
10340 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10341 proto_item_set_generated(ti);
10342 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10343 proto_item_set_generated(ti);
10344 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10345 return initial_offset + offset;
10346}
10347
10348void
10349ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10350 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10351 SslSession *session, SslDecryptSession *ssl,
10352 bool_Bool is_dtls, bool_Bool is_hrr)
10353{
10354 /* struct {
10355 * ProtocolVersion server_version;
10356 * Random random;
10357 * SessionID session_id; // TLS 1.2 and before
10358 * CipherSuite cipher_suite;
10359 * CompressionMethod compression_method; // TLS 1.2 and before
10360 * Extension server_hello_extension_list<0..2^16-1>;
10361 * } ServerHello;
10362 */
10363 uint8_t draft_version = session->tls13_draft_version;
10364 proto_item *ti;
10365 uint32_t server_version;
10366 uint32_t cipher_suite;
10367 uint32_t initial_offset = offset;
10368 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10369 char *ja3_hash;
10370
10371 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10372 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10373
10374 /* Initially assume that the session is resumed. If this is not the case, a
10375 * ServerHelloDone will be observed before the ChangeCipherSpec message
10376 * which will reset this flag. */
10377 session->is_session_resumed = true1;
10378
10379 /* show the server version */
10380 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10381 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10382
10383 uint16_t supported_server_version;
10384 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
10385 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10386 }
10387 /*
10388 * Is it version 1.3?
10389 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10390 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10391 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10392 * Hello".
10393 */
10394 if (is_dtls) {
10395 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10396 /* Don't do that. */
10397 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10398 }
10399 } else {
10400 if (server_version == TLSV1DOT3_VERSION0x304) {
10401 /* Don't do that. */
10402 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10403 }
10404 }
10405
10406 offset += 2;
10407 wmem_strbuf_append_printf(ja3, "%i", server_version);
10408
10409 /* dissect fields that are present in both ClientHello and ServerHello */
10410 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10411
10412 if (ssl) {
10413 /* store selected cipher suite for decryption */
10414 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10415 }
10416
10417 /* now the server-selected cipher suite */
10418 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10419 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10420 offset += 2;
10421 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10422
10423 /* No compression with TLS 1.3 before draft -22 */
10424 if (!(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
10425 if (ssl) {
10426 /* store selected compression method for decryption */
10427 ssl->session.compression = tvb_get_uint8(tvb, offset);
10428 }
10429 /* and the server-selected compression method */
10430 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10431 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10432 offset++;
10433 }
10434
10435 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10436 if (offset < offset_end) {
10437 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10438 offset_end,
10439 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10440 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10441 }
10442
10443 if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
10444 /* RFC 9849 7.2 Backend Server */
10445 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10446 SSL_MDgcry_md_hd_t mc;
10447 if (hash_algo && ssl_md_init(&mc, hash_algo) == 0) {
10448 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10449 unsigned char prk[DIGEST_MAX_SIZE48];
10450 unsigned char *ech_verify_out = NULL((void*)0);
10451 unsigned int len;
10452 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10453 if (is_hrr) {
10454 /* RFC 8446 4.4.1 The Transcript Hash
10455 * Special synthetic handshake following a HelloRetryRequest */
10456 ssl_md_final(&mc, transcript_hash, &len);
10457 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10458 ssl->ech_transcript.data_len = 4 + len;
10459 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10460 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10461 ssl->ech_transcript.data[1] = 0;
10462 ssl->ech_transcript.data[2] = 0;
10463 ssl->ech_transcript.data[3] = len;
10464 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10465 ssl_md_reset(&mc);
10466 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10467 } else {
10468 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10469 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10470 }
10471 if (initial_offset > 4) {
10472 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10473 4 + offset_end - initial_offset);
10474 if (is_hrr)
10475 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10476 else
10477 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10478 } else {
10479 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10480 prefix[2] = ((offset - initial_offset) >> 8);
10481 prefix[3] = (offset - initial_offset) & 0xff;
10482 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10483 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
10484 offset_end - initial_offset);
10485 ssl_md_update(&mc, prefix, 4);
10486 if (is_hrr)
10487 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 34), 34);
10488 else
10489 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 26), 26);
10490 }
10491 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
10492 uint8_t zeros[8] = { 0 };
10493 uint32_t confirmation_offset = initial_offset + 26;
10494 if (is_hrr) {
10495 uint32_t hrr_offset = initial_offset + 34;
10496 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset,
10497 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
10498 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
10499 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 3), 3);
10500 hrr_offset += 3;
10501 uint32_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
10502 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 2), 2);
10503 hrr_offset += 2;
10504 while (extensions_end - hrr_offset >= 4) {
10505 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
10506 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
10507 confirmation_offset = hrr_offset + 4;
10508 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 4), 4);
10509 ssl_md_update(&mc, zeros, 8);
10510 hrr_offset += 12;
10511 } else {
10512 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
10513 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
10514 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
10515 }
10516 }
10517 } else {
10518 ssl_md_update(&mc, zeros, 8);
10519 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
10520 offset - initial_offset - 34);
10521 }
10522 ssl_md_final(&mc, transcript_hash, &len);
10523 ssl_md_cleanup(&mc);
10524 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10525 StringInfo prk_string = {prk, len};
10526 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10527 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10528 transcript_hash, len, 8, &ech_verify_out)) {
10529 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10530 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10531 if (is_hrr) {
10532 ssl->session.hrr_ech_declined = true1;
10533 ssl->session.first_ch_ech_frame = 0;
10534 }
10535 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10536 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10537 }
10538 wmem_free(NULL((void*)0), ech_verify_out);
10539 }
10540 ssl->session.ech = true1;
10541 }
10542 }
10543
10544 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10545 wmem_strbuf_get_len(ja3));
10546 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10547 proto_item_set_generated(ti);
10548 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10549 proto_item_set_generated(ti);
10550 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10551}
10552/* Client Hello and Server Hello dissections. }}} */
10553
10554/* New Session Ticket dissection. {{{ */
10555void
10556ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10557 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10558 SslSession *session, SslDecryptSession *ssl,
10559 bool_Bool is_dtls, GHashTable *session_hash)
10560{
10561 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10562 * struct {
10563 * uint32 ticket_lifetime_hint;
10564 * opaque ticket<0..2^16-1>;
10565 * } NewSessionTicket;
10566 *
10567 * RFC 8446 Section 4.6.1 (TLS 1.3):
10568 * struct {
10569 * uint32 ticket_lifetime;
10570 * uint32 ticket_age_add;
10571 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10572 * opaque ticket<1..2^16-1>;
10573 * Extension extensions<0..2^16-2>;
10574 * } NewSessionTicket;
10575 */
10576 proto_tree *subtree;
10577 proto_item *subitem;
10578 uint32_t ticket_len;
10579 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10580 unsigned char draft_version = session->tls13_draft_version;
10581 uint32_t lifetime_hint;
10582
10583 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10584 hf->ett.session_ticket, NULL((void*)0),
10585 "TLS Session Ticket");
10586
10587 /* ticket lifetime hint */
10588 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10589 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10590 offset += 4;
10591
10592 if (lifetime_hint >= 60) {
10593 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10594 proto_item_append_text(subitem, " (%s)", time_str);
10595 }
10596
10597 if (is_tls13) {
10598
10599 /* for TLS 1.3: ticket_age_add */
10600 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10601 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10602 offset += 4;
10603
10604 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10605 if (draft_version == 0 || draft_version >= 21) {
10606 uint32_t ticket_nonce_len;
10607
10608 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10609 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10610 return;
10611 }
10612 offset++;
10613
10614 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10615 offset += ticket_nonce_len;
10616 }
10617
10618 }
10619
10620 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10621 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10622 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10623 return;
10624 }
10625 offset += 2;
10626
10627 /* Content depends on implementation, so just show data! */
10628 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10629 tvb, offset, ticket_len, ENC_NA0x00000000);
10630 /* save the session ticket to cache for ssl_finalize_decryption */
10631 if (ssl && !is_tls13) {
10632 if (ssl->session.is_session_resumed) {
10633 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10634 * (Abbreviated Handshake Using New Session Ticket).
10635 * Restore the master key for this session ticket before saving
10636 * it to the new session ticket. */
10637 ssl_restore_master_key(ssl, "Session Ticket", false0,
10638 session_hash, &ssl->session_ticket);
10639 }
10640 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10641 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10642 ssl->session_ticket.data, ticket_len);
10643 ssl->session_ticket.data_len = ticket_len;
10644 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10645 /* NewSessionTicket is received after the first (client)
10646 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10647 * Since the second CCS has already the session key available it will
10648 * just return. To ensure that the session ticket is mapped to a
10649 * master key (from the first CCS), save the ticket here too. */
10650 ssl_save_master_key("Session Ticket", session_hash,
10651 &ssl->session_ticket, &ssl->master_secret);
10652 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10653 }
10654 offset += ticket_len;
10655
10656 if (is_tls13) {
10657 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10658 offset_end, SSL_HND_NEWSESSION_TICKET,
10659 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10660 }
10661} /* }}} */
10662
10663void
10664ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10665 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10666 SslSession *session, SslDecryptSession *ssl,
10667 bool_Bool is_dtls)
10668{
10669 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10670 * struct {
10671 * ProtocolVersion server_version;
10672 * CipherSuite cipher_suite; // not before draft -19
10673 * Extension extensions<2..2^16-1>;
10674 * } HelloRetryRequest;
10675 * Note: no longer used since draft -22
10676 */
10677 uint32_t version;
10678 uint8_t draft_version;
10679
10680 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10681 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
10682 draft_version = extract_tls13_draft_version(version);
10683 offset += 2;
10684
10685 if (draft_version == 0 || draft_version >= 19) {
10686 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
10687 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10688 offset += 2;
10689 }
10690
10691 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10692 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
10693 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10694}
10695
10696void
10697ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10698 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10699 SslSession *session, SslDecryptSession *ssl,
10700 bool_Bool is_dtls)
10701{
10702 /* RFC 8446 Section 4.3.1
10703 * struct {
10704 * Extension extensions<0..2^16-1>;
10705 * } EncryptedExtensions;
10706 */
10707 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10708 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
10709 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10710}
10711
10712/* Certificate and Certificate Request dissections. {{{ */
10713void
10714ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10715 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
10716 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
10717 bool_Bool is_from_server, bool_Bool is_dtls)
10718{
10719 /* opaque ASN.1Cert<1..2^24-1>;
10720 *
10721 * Before RFC 8446 (TLS <= 1.2):
10722 * struct {
10723 * select(certificate_type) {
10724 *
10725 * // certificate type defined in RFC 7250
10726 * case RawPublicKey:
10727 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
10728 *
10729 * // X.509 certificate defined in RFC 5246
10730 * case X.509:
10731 * ASN.1Cert certificate_list<0..2^24-1>;
10732 * };
10733 * } Certificate;
10734 *
10735 * RFC 8446 (since draft -20):
10736 * struct {
10737 * select(certificate_type){
10738 * case RawPublicKey:
10739 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
10740 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
10741 *
10742 * case X.509:
10743 * opaque cert_data<1..2^24-1>;
10744 * }
10745 * Extension extensions<0..2^16-1>;
10746 * } CertificateEntry;
10747 * struct {
10748 * opaque certificate_request_context<0..2^8-1>;
10749 * CertificateEntry certificate_list<0..2^24-1>;
10750 * } Certificate;
10751 */
10752 enum { CERT_X509, CERT_RPK } cert_type;
10753 asn1_ctx_t asn1_ctx;
10754#if defined(HAVE_LIBGNUTLS1)
10755 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
10756 unsigned certificate_index = 0;
10757#endif
10758 uint32_t next_offset, certificate_list_length, cert_length;
10759 proto_tree *subtree = tree;
10760
10761 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10762
10763 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
10764 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
10765 cert_type = CERT_RPK;
10766 } else {
10767 cert_type = CERT_X509;
10768 }
10769
10770#if defined(HAVE_LIBGNUTLS1)
10771 /* Ask the pkcs1 dissector to return the public key details */
10772 if (ssl)
10773 asn1_ctx.private_data = &subjectPublicKeyInfo;
10774#endif
10775
10776 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
10777 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
10778 uint32_t context_length;
10779 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10780 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10781 return;
10782 }
10783 offset++;
10784 if (context_length > 0) {
10785 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10786 tvb, offset, context_length, ENC_NA0x00000000);
10787 offset += context_length;
10788 }
10789 }
10790
10791 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
10792 /* For RPK before TLS 1.3, the single RPK is stored directly without
10793 * another "certificate_list" field. */
10794 certificate_list_length = offset_end - offset;
10795 next_offset = offset_end;
10796 } else {
10797 /* CertificateEntry certificate_list<0..2^24-1> */
10798 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
10799 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
10800 return;
10801 }
10802 offset += 3; /* 24-bit length value */
10803 next_offset = offset + certificate_list_length;
10804 }
10805
10806 /* RawPublicKey must have one cert, but X.509 can have multiple. */
10807 if (certificate_list_length > 0 && cert_type == CERT_X509) {
10808 proto_item *ti;
10809
10810 ti = proto_tree_add_none_format(tree,
10811 hf->hf.hs_certificates,
10812 tvb, offset, certificate_list_length,
10813 "Certificates (%u bytes)",
10814 certificate_list_length);
10815
10816 /* make it a subtree */
10817 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
10818 }
10819
10820 while (offset < next_offset) {
10821 switch (cert_type) {
10822 case CERT_RPK:
10823 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
10824 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
10825 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10826 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10827 return;
10828 }
10829 offset += 3;
10830
10831 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10832 offset += cert_length;
10833 break;
10834 case CERT_X509:
10835 /* opaque ASN1Cert<1..2^24-1> */
10836 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10837 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10838 return;
10839 }
10840 offset += 3;
10841
10842 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10843#if defined(HAVE_LIBGNUTLS1)
10844 if (is_from_server && ssl && certificate_index == 0) {
10845 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
10846 /* Only attempt to get the RSA modulus for the first cert. */
10847 asn1_ctx.private_data = NULL((void*)0);
10848 }
10849#endif
10850 offset += cert_length;
10851 break;
10852 }
10853
10854 /* TLS 1.3: Extension extensions<0..2^16-1> */
10855 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
10856 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10857 next_offset, SSL_HND_CERTIFICATE,
10858 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10859 }
10860
10861#if defined(HAVE_LIBGNUTLS1)
10862 certificate_index++;
10863#endif
10864 }
10865}
10866
10867void
10868ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10869 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10870 SslSession *session, bool_Bool is_dtls)
10871{
10872 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
10873 * enum {
10874 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10875 * (255)
10876 * } ClientCertificateType;
10877 *
10878 * opaque DistinguishedName<1..2^16-1>;
10879 *
10880 * struct {
10881 * ClientCertificateType certificate_types<1..2^8-1>;
10882 * DistinguishedName certificate_authorities<3..2^16-1>;
10883 * } CertificateRequest;
10884 *
10885 *
10886 * As per TLSv1.2 (RFC 5246) the format has changed to:
10887 *
10888 * enum {
10889 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10890 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
10891 * fortezza_dms_RESERVED(20), (255)
10892 * } ClientCertificateType;
10893 *
10894 * enum {
10895 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
10896 * sha512(6), (255)
10897 * } HashAlgorithm;
10898 *
10899 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
10900 * SignatureAlgorithm;
10901 *
10902 * struct {
10903 * HashAlgorithm hash;
10904 * SignatureAlgorithm signature;
10905 * } SignatureAndHashAlgorithm;
10906 *
10907 * SignatureAndHashAlgorithm
10908 * supported_signature_algorithms<2..2^16-2>;
10909 *
10910 * opaque DistinguishedName<1..2^16-1>;
10911 *
10912 * struct {
10913 * ClientCertificateType certificate_types<1..2^8-1>;
10914 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
10915 * DistinguishedName certificate_authorities<0..2^16-1>;
10916 * } CertificateRequest;
10917 *
10918 * draft-ietf-tls-tls13-18:
10919 * struct {
10920 * opaque certificate_request_context<0..2^8-1>;
10921 * SignatureScheme
10922 * supported_signature_algorithms<2..2^16-2>;
10923 * DistinguishedName certificate_authorities<0..2^16-1>;
10924 * CertificateExtension certificate_extensions<0..2^16-1>;
10925 * } CertificateRequest;
10926 *
10927 * RFC 8446 (since draft-ietf-tls-tls13-19):
10928 *
10929 * struct {
10930 * opaque certificate_request_context<0..2^8-1>;
10931 * Extension extensions<2..2^16-1>;
10932 * } CertificateRequest;
10933 */
10934 proto_item *ti;
10935 proto_tree *subtree;
10936 uint32_t next_offset;
10937 asn1_ctx_t asn1_ctx;
10938 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
10939 unsigned char draft_version = session->tls13_draft_version;
10940
10941 if (!tree)
10942 return;
10943
10944 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10945
10946 if (is_tls13) {
10947 uint32_t context_length;
10948 /* opaque certificate_request_context<0..2^8-1> */
10949 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10950 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10951 return;
10952 }
10953 offset++;
10954 if (context_length > 0) {
10955 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10956 tvb, offset, context_length, ENC_NA0x00000000);
10957 offset += context_length;
10958 }
10959 } else {
10960 uint32_t cert_types_count;
10961 /* ClientCertificateType certificate_types<1..2^8-1> */
10962 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
10963 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
10964 return;
10965 }
10966 offset++;
10967 next_offset = offset + cert_types_count;
10968
10969 ti = proto_tree_add_none_format(tree,
10970 hf->hf.hs_cert_types,
10971 tvb, offset, cert_types_count,
10972 "Certificate types (%u type%s)",
10973 cert_types_count,
10974 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
10975 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
10976
10977 while (offset < next_offset) {
10978 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10979 offset++;
10980 }
10981 }
10982
10983 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
10984 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
10985 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
10986 }
10987
10988 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
10989 /*
10990 * TLS 1.3 draft 19 and newer: Extensions.
10991 * SslDecryptSession pointer is NULL because Certificate Extensions
10992 * should not influence decryption state.
10993 */
10994 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10995 offset_end, SSL_HND_CERT_REQUEST,
10996 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10997 } else if (is_tls13 && draft_version <= 18) {
10998 /*
10999 * TLS 1.3 draft 18 and older: certificate_authorities and
11000 * certificate_extensions (a vector of OID mappings).
11001 */
11002 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11003 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11004 } else {
11005 /* for TLS 1.2 and older, the certificate_authorities field. */
11006 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11007 }
11008}
11009/* Certificate and Certificate Request dissections. }}} */
11010
11011void
11012ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11013 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11014{
11015 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11016 hf->hf.hs_client_cert_vrfy_sig_len,
11017 hf->hf.hs_client_cert_vrfy_sig);
11018}
11019
11020/* Finished dissection. {{{ */
11021void
11022ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11023 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11024 const SslSession *session, ssl_hfs_t *ssl_hfs)
11025{
11026 /* For SSLv3:
11027 * struct {
11028 * opaque md5_hash[16];
11029 * opaque sha_hash[20];
11030 * } Finished;
11031 *
11032 * For (D)TLS:
11033 * struct {
11034 * opaque verify_data[12];
11035 * } Finished;
11036 *
11037 * For TLS 1.3:
11038 * struct {
11039 * opaque verify_data[Hash.length];
11040 * }
11041 */
11042 if (!tree)
11043 return;
11044
11045 if (session->version == SSLV3_VERSION0x300) {
11046 if (ssl_hfs != NULL((void*)0)) {
11047 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11048 tvb, offset, 16, ENC_NA0x00000000);
11049 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11050 tvb, offset + 16, 20, ENC_NA0x00000000);
11051 }
11052 } else {
11053 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11054 proto_tree_add_item(tree, hf->hf.hs_finished,
11055 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11056 }
11057} /* }}} */
11058
11059/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11060void
11061ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11062{
11063 uint16_t url_hash_len;
11064
11065 /* enum {
11066 * individual_certs(0), pkipath(1), (255)
11067 * } CertChainType;
11068 *
11069 * struct {
11070 * CertChainType type;
11071 * URLAndHash url_and_hash_list<1..2^16-1>;
11072 * } CertificateURL;
11073 *
11074 * struct {
11075 * opaque url<1..2^16-1>;
11076 * uint8 padding;
11077 * opaque SHA1Hash[20];
11078 * } URLAndHash;
11079 */
11080
11081 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11082 tvb, offset, 1, ENC_NA0x00000000);
11083 offset++;
11084
11085 url_hash_len = tvb_get_ntohs(tvb, offset);
11086 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11087 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11088 offset += 2;
11089 while (url_hash_len-- > 0) {
11090 proto_item *urlhash_item;
11091 proto_tree *urlhash_tree;
11092 uint16_t url_len;
11093
11094 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11095 tvb, offset, -1, ENC_NA0x00000000);
11096 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11097
11098 url_len = tvb_get_ntohs(tvb, offset);
11099 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11100 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11101 offset += 2;
11102
11103 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11104 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11105 offset += url_len;
11106
11107 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11108 tvb, offset, 1, ENC_NA0x00000000);
11109 offset++;
11110 /* Note: RFC 6066 says that padding must be 0x01 */
11111
11112 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11113 tvb, offset, 20, ENC_NA0x00000000);
11114 offset += 20;
11115 }
11116} /* }}} */
11117
11118void
11119ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11120 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11121 SslSession *session, SslDecryptSession *ssl,
11122 bool_Bool is_from_server, bool_Bool is_dtls)
11123{
11124 uint32_t algorithm, uncompressed_length;
11125 uint32_t compressed_certificate_message_length;
11126 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11127 proto_item *ti;
11128 /*
11129 * enum {
11130 * zlib(1),
11131 * brotli(2),
11132 * zstd(3),
11133 * (65535)
11134 * } CertificateCompressionAlgorithm;
11135 *
11136 * struct {
11137 * CertificateCompressionAlgorithm algorithm;
11138 * uint24 uncompressed_length;
11139 * opaque compressed_certificate_message<1..2^24-1>;
11140 * } CompressedCertificate;
11141 */
11142
11143 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11144 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11145 offset += 2;
11146
11147 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11148 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11149 offset += 3;
11150
11151 /* opaque compressed_certificate_message<1..2^24-1>; */
11152 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11153 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11154 return;
11155 }
11156 offset += 3;
11157
11158 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11159 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11160
11161 /* Certificate decompression following algorithm */
11162 switch (algorithm) {
11163 case 1: /* zlib */
11164 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11165 break;
11166 case 2: /* brotli */
11167 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11168 break;
11169 case 3: /* zstd */
11170 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11171 break;
11172 }
11173
11174 if (uncompressed_tvb) {
11175 proto_tree *uncompressed_tree;
11176
11177 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11178 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11179 tvb, offset, offset_end - offset,
11180 "Invalid uncompressed length %u (expected %u)",
11181 tvb_captured_length(uncompressed_tvb),
11182 uncompressed_length);
11183 } else {
11184 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11185 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11186 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11187 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11188 }
11189 }
11190}
11191
11192/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11193static int
11194// NOLINTNEXTLINE(misc-no-recursion)
11195ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11196 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11197 SslSession *session, SslDecryptSession *ssl,
11198 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11199 ssl_master_key_map_t *mk_map)
11200{
11201 uint32_t exts_len;
11202 uint16_t ext_type;
11203 uint32_t ext_len;
11204 uint32_t next_offset;
11205 proto_item *ext_item;
11206 proto_tree *ext_tree;
11207 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11208 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11209 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11210 char *ja3_dash = "";
11211 unsigned supported_version;
11212
11213 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11214 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11215 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11216 return offset_end;
11217 }
11218 offset += 2;
11219 offset_end = offset + exts_len;
11220
11221 if (ja4_data) {
11222 ja4_data->num_extensions = 0;
11223 }
11224 while (offset_end - offset >= 4)
11225 {
11226 ext_type = tvb_get_ntohs(tvb, offset);
11227 ext_len = tvb_get_ntohs(tvb, offset + 2);
11228
11229 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11230 ja4_data->num_extensions += 1;
11231 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11232 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11233 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11234 }
11235 }
11236
11237 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11238 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11239 tls_hello_extension_types,
11240 "Unknown type %u"), ext_len);
11241 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11242
11243 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11244 tvb, offset, 2, ext_type);
11245 offset += 2;
11246 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11247 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11248 ja3_dash = "-";
11249 }
11250
11251 /* opaque extension_data<0..2^16-1> */
11252 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11253 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11254 return offset_end;
11255 }
11256 offset += 2;
11257 next_offset = offset + ext_len;
11258
11259 switch (ext_type) {
11260 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11261 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11262 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11263 if (ja4_data) {
11264 ja4_data->server_name_present = true1;
11265 }
11266 }
11267 break;
11268 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11269 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11270 offset += 1;
11271 break;
11272 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11273 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11274 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11275 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11276 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11277 }
11278 break;
11279 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11280 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11281 offset, next_offset,
11282 hnd_type, ext_type,
11283 session);
11284 break;
11285 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11286 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11287 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11288 next_offset, ja3_sg);
11289 } else {
11290 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11291 next_offset, NULL((void*)0));
11292 }
11293 break;
11294 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11295 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11296 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11297 } else {
11298 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11299 }
11300 break;
11301 case SSL_HND_HELLO_EXT_SRP12:
11302 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11303 break;
11304 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11305 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11306 break;
11307 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11308 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11309 break;
11310 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11311 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11312 break;
11313 case SSL_HND_HELLO_EXT_USE_SRTP14:
11314 if (is_dtls) {
11315 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11316 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11317 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11318 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11319 }
11320 } else {
11321 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11322 }
11323 break;
11324 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11325 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11326 break;
11327 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11328 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11329 break;
11330 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11331 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11332 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11333 offset++;
11334 break;
11335 case SSL_HND_HELLO_EXT_ALPN16:
11336 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11337 break;
11338 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11339 if (hnd_type == SSL_HND_CLIENT_HELLO)
11340 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11341 break;
11342 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11343 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11344 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11345 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11346 break;
11347 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11348 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11349 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11350 offset, next_offset,
11351 hnd_type, ext_type,
11352 session);
11353 break;
11354 case SSL_HND_HELLO_EXT_PADDING21:
11355 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11356 offset += ext_len;
11357 break;
11358 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11359 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11360 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11361 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11362 }
11363 break;
11364 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11365 if (ssl) {
11366 switch (hnd_type) {
11367 case SSL_HND_CLIENT_HELLO:
11368 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11369 break;
11370 case SSL_HND_SERVER_HELLO:
11371 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11372 break;
11373 default: /* no default */
11374 break;
11375 }
11376 }
11377 break;
11378 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11379 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11380 break;
11381 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11382 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11383 break;
11384 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11385 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11386 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11387 offset += 2;
11388 break;
11389 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11390 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11391 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11392 break;
11393 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11394 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11395 break;
11396 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11397 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11398 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11399 break;
11400 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11401 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11402 break;
11403 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11404 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11405 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11406 break;
11407 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11408 switch (hnd_type) {
11409 case SSL_HND_CLIENT_HELLO:
11410 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11411 break;
11412 case SSL_HND_SERVER_HELLO:
11413 case SSL_HND_HELLO_RETRY_REQUEST:
11414 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11415 offset += 2;
11416 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11417 break;
11418 }
11419 break;
11420 case SSL_HND_HELLO_EXT_COOKIE44:
11421 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11422 break;
11423 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11424 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11425 break;
11426 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11427 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11428 break;
11429 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11430 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11431 break;
11432 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11433 break;
11434 case SSL_HND_HELLO_EXT_NPN13172:
11435 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11436 break;
11437 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11438 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11439 break;
11440 case SSL_HND_HELLO_EXT_ALPS17613:
11441 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11442 break;
11443 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11444 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11445 break;
11446 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11447 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11448 break;
11449 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11450 session->deprecated_cid = true1;
11451 /* FALLTHRU */
11452 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11453 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11454 break;
11455 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11456 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11457 break;
11458 default:
11459 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11460 tvb, offset, ext_len, ENC_NA0x00000000);
11461 offset += ext_len;
11462 break;
11463 }
11464
11465 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11466 /* Dissection did not end at expected location, fix it. */
11467 offset = next_offset;
11468 }
11469 }
11470
11471 if (ja3) {
11472 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11473 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11474 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11475 } else {
11476 wmem_strbuf_append_c(ja3, ',');
11477 }
11478 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11479 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11480 } else {
11481 wmem_strbuf_append_c(ja3, ',');
11482 }
11483 }
11484 }
11485
11486 /* Check if Extensions vector is correctly terminated. */
11487 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11488 offset = offset_end;
11489 }
11490
11491 return offset;
11492} /* }}} */
11493
11494
11495/* ClientKeyExchange algo-specific dissectors. {{{ */
11496
11497static void
11498dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11499 proto_tree *tree, uint32_t offset,
11500 uint32_t length)
11501{
11502 int point_len;
11503 proto_tree *ssl_ecdh_tree;
11504
11505 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11506 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11507
11508 /* point */
11509 point_len = tvb_get_uint8(tvb, offset);
11510 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11511 offset, 1, ENC_BIG_ENDIAN0x00000000);
11512 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11513 offset + 1, point_len, ENC_NA0x00000000);
11514}
11515
11516static void
11517dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11518 proto_tree *tree, uint32_t offset, uint32_t length)
11519{
11520 int yc_len;
11521 proto_tree *ssl_dh_tree;
11522
11523 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11524 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11525
11526 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11527 yc_len = tvb_get_ntohs(tvb, offset);
11528 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11529 offset, 2, ENC_BIG_ENDIAN0x00000000);
11530 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11531 offset + 2, yc_len, ENC_NA0x00000000);
11532}
11533
11534static void
11535dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11536 proto_tree *tree, uint32_t offset,
11537 uint32_t length, const SslSession *session)
11538{
11539 int epms_len;
11540 proto_tree *ssl_rsa_tree;
11541
11542 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11543 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11544
11545 /* EncryptedPreMasterSecret.pre_master_secret */
11546 switch (session->version) {
11547 case SSLV2_VERSION0x0002:
11548 case SSLV3_VERSION0x300:
11549 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11550 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11551 * not present. The handshake contents represents the EPMS, see:
11552 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11553 epms_len = length;
11554 break;
11555
11556 default:
11557 /* TLS and DTLS include vector length before EPMS */
11558 epms_len = tvb_get_ntohs(tvb, offset);
11559 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11560 offset, 2, ENC_BIG_ENDIAN0x00000000);
11561 offset += 2;
11562 break;
11563 }
11564 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11565 offset, epms_len, ENC_NA0x00000000);
11566}
11567
11568/* Used in PSK cipher suites */
11569static uint32_t
11570dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11571 proto_tree *tree, uint32_t offset)
11572{
11573 unsigned identity_len;
11574 proto_tree *ssl_psk_tree;
11575
11576 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11577 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11578 /* identity */
11579 identity_len = tvb_get_ntohs(tvb, offset);
11580 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11581 offset, 2, ENC_BIG_ENDIAN0x00000000);
11582 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11583 offset + 2, identity_len, ENC_NA0x00000000);
11584
11585 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11586 return 2 + identity_len;
11587}
11588
11589/* Used in RSA PSK cipher suites */
11590static void
11591dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11592 proto_tree *tree, uint32_t offset,
11593 uint32_t length)
11594{
11595 int identity_len, epms_len;
11596 proto_tree *ssl_psk_tree;
11597
11598 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11599 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11600
11601 /* identity */
11602 identity_len = tvb_get_ntohs(tvb, offset);
11603 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11604 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11605 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11606 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11607 offset += 2 + identity_len;
11608
11609 /* Yc */
11610 epms_len = tvb_get_ntohs(tvb, offset);
11611 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11612 offset, 2, ENC_BIG_ENDIAN0x00000000);
11613 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11614 offset + 2, epms_len, ENC_NA0x00000000);
11615}
11616
11617/* Used in Diffie-Hellman PSK cipher suites */
11618static void
11619dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11620 proto_tree *tree, uint32_t offset, uint32_t length)
11621{
11622 /*
11623 * struct {
11624 * select (KeyExchangeAlgorithm) {
11625 * case diffie_hellman_psk:
11626 * opaque psk_identity<0..2^16-1>;
11627 * ClientDiffieHellmanPublic public;
11628 * } exchange_keys;
11629 * } ClientKeyExchange;
11630 */
11631
11632 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11633 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11634}
11635
11636/* Used in EC Diffie-Hellman PSK cipher suites */
11637static void
11638dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11639 proto_tree *tree, uint32_t offset, uint32_t length)
11640{
11641 /*
11642 * struct {
11643 * select (KeyExchangeAlgorithm) {
11644 * case ec_diffie_hellman_psk:
11645 * opaque psk_identity<0..2^16-1>;
11646 * ClientECDiffieHellmanPublic public;
11647 * } exchange_keys;
11648 * } ClientKeyExchange;
11649 */
11650
11651 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11652 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11653}
11654
11655/* Used in EC J-PAKE cipher suites */
11656static void
11657dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11658 proto_tree *tree, uint32_t offset,
11659 uint32_t length)
11660{
11661 /*
11662 * struct {
11663 * ECPoint V;
11664 * opaque r<1..2^8-1>;
11665 * } ECSchnorrZKP;
11666 *
11667 * struct {
11668 * ECPoint X;
11669 * ECSchnorrZKP zkp;
11670 * } ECJPAKEKeyKP;
11671 *
11672 * struct {
11673 * ECJPAKEKeyKP ecjpake_key_kp;
11674 * } ClientECJPAKEParams;
11675 *
11676 * select (KeyExchangeAlgorithm) {
11677 * case ecjpake:
11678 * ClientECJPAKEParams params;
11679 * } ClientKeyExchange;
11680 */
11681
11682 int point_len;
11683 proto_tree *ssl_ecjpake_tree;
11684
11685 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11686 hf->ett.keyex_params, NULL((void*)0),
11687 "EC J-PAKE Client Params");
11688
11689 /* ECJPAKEKeyKP.X */
11690 point_len = tvb_get_uint8(tvb, offset);
11691 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
11692 offset, 1, ENC_BIG_ENDIAN0x00000000);
11693 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
11694 offset + 1, point_len, ENC_NA0x00000000);
11695 offset += 1 + point_len;
11696
11697 /* ECJPAKEKeyKP.zkp.V */
11698 point_len = tvb_get_uint8(tvb, offset);
11699 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
11700 offset, 1, ENC_BIG_ENDIAN0x00000000);
11701 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
11702 offset + 1, point_len, ENC_NA0x00000000);
11703 offset += 1 + point_len;
11704
11705 /* ECJPAKEKeyKP.zkp.r */
11706 point_len = tvb_get_uint8(tvb, offset);
11707 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
11708 offset, 1, ENC_BIG_ENDIAN0x00000000);
11709 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
11710 offset + 1, point_len, ENC_NA0x00000000);
11711}
11712
11713static void
11714dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11715 proto_tree *tree, uint32_t offset,
11716 uint32_t length)
11717{
11718 int epms_len;
11719 proto_tree *ssl_ecc_sm2_tree;
11720
11721 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11722 hf->ett.keyex_params, NULL((void*)0),
11723 "ECC-SM2 Encrypted PreMaster Secret");
11724
11725 epms_len = tvb_get_ntohs(tvb, offset);
11726 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11727 offset, 2, ENC_BIG_ENDIAN0x00000000);
11728 offset += 2;
11729 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
11730 offset, epms_len, ENC_NA0x00000000);
11731}
11732/* ClientKeyExchange algo-specific dissectors. }}} */
11733
11734
11735/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
11736static uint32_t
11737ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11738 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11739 uint16_t version, int hf_sig_len, int hf_sig)
11740{
11741 uint32_t sig_len;
11742
11743 switch (version) {
11744 case TLSV1DOT2_VERSION0x303:
11745 case DTLSV1DOT2_VERSION0xfefd:
11746 case TLSV1DOT3_VERSION0x304:
11747 case DTLSV1DOT3_VERSION0xfefc:
11748 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
11749 offset += 2;
11750 break;
11751
11752 default:
11753 break;
11754 }
11755
11756 /* Sig */
11757 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
11758 hf_sig_len, 0, UINT16_MAX(65535))) {
11759 return offset_end;
11760 }
11761 offset += 2;
11762 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
11763 offset += sig_len;
11764 return offset;
11765} /* }}} */
11766
11767/* ServerKeyExchange algo-specific dissectors. {{{ */
11768
11769/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
11770static void
11771dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11772 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11773 uint16_t version)
11774{
11775 /*
11776 * TLSv1.2 (RFC 5246 sec 7.4.8)
11777 * struct {
11778 * digitally-signed struct {
11779 * opaque handshake_messages[handshake_messages_length];
11780 * }
11781 * } CertificateVerify;
11782 *
11783 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
11784 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
11785 *
11786 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
11787 * does more hashing including the master secret and padding.
11788 */
11789 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11790 hf->hf.hs_server_keyex_sig_len,
11791 hf->hf.hs_server_keyex_sig);
11792}
11793
11794static uint32_t
11795dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
11796{
11797 /*
11798 * RFC 4492 ECC cipher suites for TLS
11799 *
11800 * struct {
11801 * ECCurveType curve_type;
11802 * select (curve_type) {
11803 * case explicit_prime:
11804 * ...
11805 * case explicit_char2:
11806 * ...
11807 * case named_curve:
11808 * NamedCurve namedcurve;
11809 * };
11810 * } ECParameters;
11811 */
11812
11813 int curve_type;
11814
11815 /* ECParameters.curve_type */
11816 curve_type = tvb_get_uint8(tvb, offset);
11817 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
11818 offset, 1, ENC_BIG_ENDIAN0x00000000);
11819 offset++;
11820
11821 if (curve_type != 3)
11822 return offset_end; /* only named_curves are supported */
11823
11824 /* case curve_type == named_curve; ECParameters.namedcurve */
11825 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
11826 offset, 2, ENC_BIG_ENDIAN0x00000000);
11827 offset += 2;
11828
11829 return offset;
11830}
11831
11832static void
11833dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11834 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11835 uint16_t version, bool_Bool anon)
11836{
11837 /*
11838 * RFC 4492 ECC cipher suites for TLS
11839 *
11840 * struct {
11841 * opaque point <1..2^8-1>;
11842 * } ECPoint;
11843 *
11844 * struct {
11845 * ECParameters curve_params;
11846 * ECPoint public;
11847 * } ServerECDHParams;
11848 *
11849 * select (KeyExchangeAlgorithm) {
11850 * case ec_diffie_hellman:
11851 * ServerECDHParams params;
11852 * Signature signed_params;
11853 * } ServerKeyExchange;
11854 */
11855
11856 int point_len;
11857 proto_tree *ssl_ecdh_tree;
11858
11859 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11860 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
11861
11862 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
11863 if (offset >= offset_end)
11864 return; /* only named_curves are supported */
11865
11866 /* ECPoint.point */
11867 point_len = tvb_get_uint8(tvb, offset);
11868 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
11869 offset, 1, ENC_BIG_ENDIAN0x00000000);
11870 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
11871 offset + 1, point_len, ENC_NA0x00000000);
11872 offset += 1 + point_len;
11873
11874 /* Signature (if non-anonymous KEX) */
11875 if (!anon) {
11876 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
11877 }
11878}
11879
11880static void
11881dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11882 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11883 uint16_t version, bool_Bool anon)
11884{
11885 int p_len, g_len, ys_len;
11886 proto_tree *ssl_dh_tree;
11887
11888 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11889 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
11890
11891 /* p */
11892 p_len = tvb_get_ntohs(tvb, offset);
11893 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
11894 offset, 2, ENC_BIG_ENDIAN0x00000000);
11895 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
11896 offset + 2, p_len, ENC_NA0x00000000);
11897 offset += 2 + p_len;
11898
11899 /* g */
11900 g_len = tvb_get_ntohs(tvb, offset);
11901 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
11902 offset, 2, ENC_BIG_ENDIAN0x00000000);
11903 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
11904 offset + 2, g_len, ENC_NA0x00000000);
11905 offset += 2 + g_len;
11906
11907 /* Ys */
11908 ys_len = tvb_get_ntohs(tvb, offset);
11909 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
11910 offset, 2, ys_len);
11911 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
11912 offset + 2, ys_len, ENC_NA0x00000000);
11913 offset += 2 + ys_len;
11914
11915 /* Signature (if non-anonymous KEX) */
11916 if (!anon) {
11917 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
11918 }
11919}
11920
11921/* Only used in RSA-EXPORT cipher suites */
11922static void
11923dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11924 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11925 uint16_t version)
11926{
11927 int modulus_len, exponent_len;
11928 proto_tree *ssl_rsa_tree;
11929
11930 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11931 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
11932
11933 /* modulus */
11934 modulus_len = tvb_get_ntohs(tvb, offset);
11935 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
11936 offset, 2, ENC_BIG_ENDIAN0x00000000);
11937 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
11938 offset + 2, modulus_len, ENC_NA0x00000000);
11939 offset += 2 + modulus_len;
11940
11941 /* exponent */
11942 exponent_len = tvb_get_ntohs(tvb, offset);
11943 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
11944 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11945 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
11946 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
11947 offset += 2 + exponent_len;
11948
11949 /* Signature */
11950 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
11951}
11952
11953/* Used in RSA PSK and PSK cipher suites */
11954static uint32_t
11955dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11956 proto_tree *tree, uint32_t offset)
11957{
11958 unsigned hint_len;
11959 proto_tree *ssl_psk_tree;
11960
11961 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11962 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
11963
11964 /* hint */
11965 hint_len = tvb_get_ntohs(tvb, offset);
11966 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
11967 offset, 2, ENC_BIG_ENDIAN0x00000000);
11968 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
11969 offset + 2, hint_len, ENC_NA0x00000000);
11970
11971 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
11972 return 2 + hint_len;
11973}
11974
11975/* Used in Diffie-Hellman PSK cipher suites */
11976static void
11977dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11978 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11979{
11980 /*
11981 * struct {
11982 * select (KeyExchangeAlgorithm) {
11983 * case diffie_hellman_psk:
11984 * opaque psk_identity_hint<0..2^16-1>;
11985 * ServerDHParams params;
11986 * };
11987 * } ServerKeyExchange;
11988 */
11989
11990 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
11991 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
11992}
11993
11994/* Used in EC Diffie-Hellman PSK cipher suites */
11995static void
11996dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11997 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11998{
11999 /*
12000 * struct {
12001 * select (KeyExchangeAlgorithm) {
12002 * case ec_diffie_hellman_psk:
12003 * opaque psk_identity_hint<0..2^16-1>;
12004 * ServerECDHParams params;
12005 * };
12006 * } ServerKeyExchange;
12007 */
12008
12009 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12010 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12011}
12012
12013/* Used in EC J-PAKE cipher suites */
12014static void
12015dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12016 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12017{
12018 /*
12019 * struct {
12020 * ECPoint V;
12021 * opaque r<1..2^8-1>;
12022 * } ECSchnorrZKP;
12023 *
12024 * struct {
12025 * ECPoint X;
12026 * ECSchnorrZKP zkp;
12027 * } ECJPAKEKeyKP;
12028 *
12029 * struct {
12030 * ECParameters curve_params;
12031 * ECJPAKEKeyKP ecjpake_key_kp;
12032 * } ServerECJPAKEParams;
12033 *
12034 * select (KeyExchangeAlgorithm) {
12035 * case ecjpake:
12036 * ServerECJPAKEParams params;
12037 * } ServerKeyExchange;
12038 */
12039
12040 int point_len;
12041 proto_tree *ssl_ecjpake_tree;
12042
12043 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12044 hf->ett.keyex_params, NULL((void*)0),
12045 "EC J-PAKE Server Params");
12046
12047 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12048 if (offset >= offset_end)
12049 return; /* only named_curves are supported */
12050
12051 /* ECJPAKEKeyKP.X */
12052 point_len = tvb_get_uint8(tvb, offset);
12053 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12054 offset, 1, ENC_BIG_ENDIAN0x00000000);
12055 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12056 offset + 1, point_len, ENC_NA0x00000000);
12057 offset += 1 + point_len;
12058
12059 /* ECJPAKEKeyKP.zkp.V */
12060 point_len = tvb_get_uint8(tvb, offset);
12061 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12062 offset, 1, ENC_BIG_ENDIAN0x00000000);
12063 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12064 offset + 1, point_len, ENC_NA0x00000000);
12065 offset += 1 + point_len;
12066
12067 /* ECJPAKEKeyKP.zkp.r */
12068 point_len = tvb_get_uint8(tvb, offset);
12069 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12070 offset, 1, ENC_BIG_ENDIAN0x00000000);
12071 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12072 offset + 1, point_len, ENC_NA0x00000000);
12073}
12074
12075/* Only used in ECC-SM2-EXPORT cipher suites */
12076static void
12077dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12078 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12079 uint16_t version)
12080{
12081 proto_tree *ssl_ecc_sm2_tree;
12082
12083 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12084 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12085
12086 /* Signature */
12087 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12088}
12089/* ServerKeyExchange algo-specific dissectors. }}} */
12090
12091/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12092void
12093ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12094 proto_tree *tree, uint32_t offset, uint32_t length,
12095 const SslSession *session)
12096{
12097 switch (ssl_get_keyex_alg(session->cipher)) {
12098 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12099 case KEX_DH_DSS0x14:
12100 case KEX_DH_RSA0x15:
12101 case KEX_DHE_DSS0x10:
12102 case KEX_DHE_RSA0x12:
12103 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12104 break;
12105 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12106 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12107 break;
12108 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12109 case KEX_ECDH_ECDSA0x1a:
12110 case KEX_ECDH_RSA0x1b:
12111 case KEX_ECDHE_ECDSA0x16:
12112 case KEX_ECDHE_RSA0x18:
12113 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12114 break;
12115 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12116 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12117 break;
12118 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12119 /* XXX: implement support for KRB5 */
12120 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12121 tvb, offset, length,
12122 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12123 " developers if you want them to be supported");
12124 break;
12125 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12126 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12127 break;
12128 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12129 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12130 break;
12131 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12132 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12133 break;
12134 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12135 case KEX_SRP_SHA_DSS0x21:
12136 case KEX_SRP_SHA_RSA0x22:
12137 /* XXX: implement support for SRP_SHA* */
12138 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12139 tvb, offset, length,
12140 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12141 " developers if you want them to be supported");
12142 break;
12143 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12144 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12145 break;
12146 case KEX_ECC_SM20x26: /* GB/T 38636 */
12147 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12148 break;
12149 default:
12150 if (session->cipher == 0) {
12151 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12152 tvb, offset, length,
12153 "Cipher Suite not found");
12154 } else {
12155 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12156 tvb, offset, length,
12157 "Cipher Suite 0x%04x is not implemented, "
12158 "contact Wireshark developers if you want this to be supported",
12159 session->cipher);
12160 }
12161 break;
12162 }
12163}
12164
12165void
12166ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12167 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12168 const SslSession *session)
12169{
12170 switch (ssl_get_keyex_alg(session->cipher)) {
12171 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12172 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12173 break;
12174 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12175 case KEX_DH_RSA0x15:
12176 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12177 tvb, offset, offset_end - offset);
12178 break;
12179 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12180 case KEX_DHE_RSA0x12:
12181 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12182 break;
12183 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12184 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12185 break;
12186 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12187 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12188 break;
12189 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12190 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12191 break;
12192 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12193 case KEX_ECDH_RSA0x1b:
12194 case KEX_ECDHE_ECDSA0x16:
12195 case KEX_ECDHE_RSA0x18:
12196 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12197 break;
12198 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12199 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12200 tvb, offset, offset_end - offset);
12201 break;
12202 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12203 case KEX_RSA_PSK0x1f:
12204 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12205 break;
12206 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12207 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12208 break;
12209 case KEX_ECC_SM20x26: /* GB/T 38636 */
12210 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12211 break;
12212 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12213 case KEX_SRP_SHA_DSS0x21:
12214 case KEX_SRP_SHA_RSA0x22:
12215 /* XXX: implement support for SRP_SHA* */
12216 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12217 tvb, offset, offset_end - offset,
12218 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12219 " developers if you want them to be supported");
12220 break;
12221 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12222 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12223 break;
12224 default:
12225 if (session->cipher == 0) {
12226 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12227 tvb, offset, offset_end - offset,
12228 "Cipher Suite not found");
12229 } else {
12230 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12231 tvb, offset, offset_end - offset,
12232 "Cipher Suite 0x%04x is not implemented, "
12233 "contact Wireshark developers if you want this to be supported",
12234 session->cipher);
12235 }
12236 break;
12237 }
12238}
12239/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12240
12241void
12242tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12243 proto_tree *tree, uint32_t offset)
12244{
12245 /* RFC 8446 Section 4.6.3
12246 * enum {
12247 * update_not_requested(0), update_requested(1), (255)
12248 * } KeyUpdateRequest;
12249 *
12250 * struct {
12251 * KeyUpdateRequest request_update;
12252 * } KeyUpdate;
12253 */
12254 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12255}
12256
12257void
12258ssl_common_register_ssl_alpn_dissector_table(const char *name,
12259 const char *ui_name, const int proto)
12260{
12261 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12262 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12263 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12264}
12265
12266void
12267ssl_common_register_dtls_alpn_dissector_table(const char *name,
12268 const char *ui_name, const int proto)
12269{
12270 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12271 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12272 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12273}
12274
12275void
12276ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12277{
12278 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12279 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12280 &(options->psk));
12281
12282 if (is_dtls) {
12283 prefs_register_obsolete_preference(module, "keylog_file");
12284 prefs_register_static_text_preference(module, "keylog_file_removed",
12285 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12286 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12287 return;
12288 }
12289
12290 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12291 "The name of a file which contains a list of \n"
12292 "(pre-)master secrets in one of the following formats:\n"
12293 "\n"
12294 "RSA <EPMS> <PMS>\n"
12295 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12296 "CLIENT_RANDOM <CRAND> <MS>\n"
12297 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12298 "\n"
12299 "Where:\n"
12300 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12301 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12302 "<SSLID> = The SSL Session ID\n"
12303 "<MS> = The Master-Secret (MS)\n"
12304 "<CRAND> = The Client's random number from the ClientHello message\n"
12305 "\n"
12306 "(All fields are in hex notation)",
12307 &(options->keylog_filename), false0);
12308}
12309
12310void
12311ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12312{
12313 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12314 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12315 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12316 * negotiated. */
12317 if (!ssl_session)
12318 return;
12319
12320 switch (ssl_session->session.version) {
12321 /* The handshake message types used in the handshake hash are different
12322 * in different versions. [D]TLS 1.3 tracks the messages up to the
12323 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12324 * at the ClientHello and include the messages up to the ServerHello, at
12325 * which point we know the version.
12326 *
12327 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12328 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12329 * format as TLS 1.3). We don't know at the point of the ClientHello which
12330 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12331 *
12332 * XXX - When the server responds with a HelloRetryRequest, for subsequent
12333 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12334 * replaced with a synthentic handhsake message of type "message_hash",
12335 * per RFC 8446 4.4.1. We aren't concerned with that now, as a HRR generally
12336 * rules out PSK-only key exchange, which is what we calculate the hash for
12337 * here. (The possible exception is when a server sends a HRR to reject
12338 * early data but the server and client otherwise agree on psk_ke, if
12339 * any client/server pairs support that.) We do support that in the context
12340 * of computing the hash for Encrypted Client Hello; see elsewhere.
12341 */
12342 case TLSV1DOT3_VERSION0x304:
12343 case DTLSV1DOT3_VERSION0xfefc:
12344 /* In [D]TLS 1.3 only the following handshake messages are used in the
12345 * handshake transcript. EndOfEarlyData and the Client Certificate,
12346 * Certificate Verify, and Finished are used in deriving the
12347 * resumption_master_secret but not the other secrets derived from
12348 * the master secret (client or server app traffic secret, exporter
12349 * secret). We don't yet support calculating a PSK to resume via
12350 * the resumption_master_secret, so we simply stop the transcript
12351 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12352 switch (msg_type) {
12353 case SSL_HND_CLIENT_HELLO:
12354 case SSL_HND_SERVER_HELLO:
12355 case SSL_HND_HELLO_RETRY_REQUEST:
12356 case SSL_HND_ENCRYPTED_EXTENSIONS:
12357 case SSL_HND_CERT_REQUEST:
12358 break;
12359 case SSL_HND_CERTIFICATE:
12360 case SSL_HND_CERT_VERIFY:
12361 case SSL_HND_FINISHED:
12362 if (!is_from_server)
12363 return;
12364 break;
12365 case SSL_HND_END_OF_EARLY_DATA:
12366 default:
12367 return;
12368 }
12369 break;
12370 default:
12371 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12372 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12373 * but the keys are not retrieved until ChangeCipherSpec later. If
12374 * mutual authentication is requested by the server, an intervening
12375 * CertificateVerify message can be sent but is not to be included
12376 * in the hash. */
12377 if (msg_type == SSL_HND_CERT_VERIFY)
12378 return;
12379 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12380 return;
12381 break;
12382 }
12383
12384 uint32_t old_length = ssl_session->handshake_data.data_len;
12385 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12386 if (tvb) {
12387 if (tvb_bytes_exist(tvb, offset, length)) {
12388 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12389 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12390 ssl_session->handshake_data.data_len += length;
12391 }
12392 } else {
12393 /* DTLS calculates the hash as if each handshake message had been
12394 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12395 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12396 */
12397 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12397, (int64_t)length, (int64_t)4))));
12398 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12399 memset(ssl_session->handshake_data.data + old_length, 0, length);
12400 ssl_session->handshake_data.data_len += length;
12401 }
12402}
12403
12404
12405/*
12406 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12407 *
12408 * Local variables:
12409 * c-basic-offset: 4
12410 * tab-width: 8
12411 * indent-tabs-mode: nil
12412 * End:
12413 *
12414 * vi: set shiftwidth=4 tabstop=8 expandtab:
12415 * :indentSize=4:tabSize=8:noTabs=true:
12416 */