Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 10614, column 17
Access to field 'dig' results in a dereference of a null pointer (loaded from field 'cipher_suite')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /builds/wireshark/wireshark/epan -isystem /usr/include/libxml2 -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-11-12-100346-3662-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 { 0x0a0a, "GREASE" },
1539 { 0x1a1a, "GREASE" },
1540 { 0x2a2a, "GREASE" },
1541 { 0x3a3a, "GREASE" },
1542 { 0x4a4a, "GREASE" },
1543 { 0x5a5a, "GREASE" },
1544 { 0x6a6a, "GREASE" },
1545 { 0x7a7a, "GREASE" },
1546 { 0x8a8a, "GREASE" },
1547 { 0x9a9a, "GREASE" },
1548 { 0xaaaa, "GREASE" },
1549 { 0xbaba, "GREASE" },
1550 { 0xcaca, "GREASE" },
1551 { 0xdada, "GREASE" },
1552 { 0xeaea, "GREASE" },
1553 { 0xfafa, "GREASE" },
1554 /* PQC digital signature algorithms from OQS-OpenSSL,
1555 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1556 { 0xfea0, "dilithium2" },
1557 { 0xfea1, "p256_dilithium2" },
1558 { 0xfea2, "rsa3072_dilithium2" },
1559 { 0xfea3, "dilithium3" },
1560 { 0xfea4, "p384_dilithium3" },
1561 { 0xfea5, "dilithium5" },
1562 { 0xfea6, "p521_dilithium5" },
1563 { 0xfea7, "dilithium2_aes" },
1564 { 0xfea8, "p256_dilithium2_aes" },
1565 { 0xfea9, "rsa3072_dilithium2_aes" },
1566 { 0xfeaa, "dilithium3_aes" },
1567 { 0xfeab, "p384_dilithium3_aes" },
1568 { 0xfeac, "dilithium5_aes" },
1569 { 0xfead, "p521_dilithium5_aes" },
1570 { 0xfe0b, "falcon512" },
1571 { 0xfe0c, "p256_falcon512" },
1572 { 0xfe0d, "rsa3072_falcon512" },
1573 { 0xfe0e, "falcon1024" },
1574 { 0xfe0f, "p521_falcon1024" },
1575 { 0xfe96, "picnicl1full" },
1576 { 0xfe97, "p256_picnicl1full" },
1577 { 0xfe98, "rsa3072_picnicl1full" },
1578 { 0xfe1b, "picnic3l1" },
1579 { 0xfe1c, "p256_picnic3l1" },
1580 { 0xfe1d, "rsa3072_picnic3l1" },
1581 { 0xfe27, "rainbowIclassic" },
1582 { 0xfe28, "p256_rainbowIclassic" },
1583 { 0xfe29, "rsa3072_rainbowIclassic" },
1584 { 0xfe3c, "rainbowVclassic" },
1585 { 0xfe3d, "p521_rainbowVclassic" },
1586 { 0xfe42, "sphincsharaka128frobust" },
1587 { 0xfe43, "p256_sphincsharaka128frobust" },
1588 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1589 { 0xfe5e, "sphincssha256128frobust" },
1590 { 0xfe5f, "p256_sphincssha256128frobust" },
1591 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1592 { 0xfe7a, "sphincsshake256128frobust" },
1593 { 0xfe7b, "p256_sphincsshake256128frobust" },
1594 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1595 { 0, NULL((void*)0) }
1596};
1597
1598/* RFC 6091 3.1 */
1599const value_string tls_certificate_type[] = {
1600 { 0, "X.509" },
1601 { 1, "OpenPGP" },
1602 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1603 { 0, NULL((void*)0) }
1604};
1605
1606const value_string tls_cert_chain_type[] = {
1607 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1608 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1609 { 0, NULL((void*)0) }
1610};
1611
1612const value_string tls_cert_status_type[] = {
1613 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1614 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1615 { 0, NULL((void*)0) }
1616};
1617
1618/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1619 * Last-Modified Sat, 17 Oct 2026 14:08:00 GMT, 45 entries. */
1620static const bytes_string ct_logids[] = {
1621 { (const uint8_t[]){
1622 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1623 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1624 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1625 },
1626 32, "Google Argon2026h1" },
1627 { (const uint8_t[]){
1628 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1629 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1630 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1631 },
1632 32, "Google Argon2026h2" },
1633 { (const uint8_t[]){
1634 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1635 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1636 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1637 },
1638 32, "Google Argon2027h1" },
1639 { (const uint8_t[]){
1640 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1641 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1642 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1643 },
1644 32, "Google Xenon2026h1" },
1645 { (const uint8_t[]){
1646 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1647 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1648 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1649 },
1650 32, "Google Xenon2026h2" },
1651 { (const uint8_t[]){
1652 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1653 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1654 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1655 },
1656 32, "Google Xenon2027h1" },
1657 { (const uint8_t[]){
1658 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1659 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1660 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1661 },
1662 32, "Google Submariner" },
1663 { (const uint8_t[]){
1664 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1665 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1666 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1667 },
1668 32, "Google Daedalus" },
1669 { (const uint8_t[]){
1670 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1671 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1672 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1673 },
1674 32, "Google Testtube" },
1675 { (const uint8_t[]){
1676 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1677 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1678 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1679 },
1680 32, "Google Crucible" },
1681 { (const uint8_t[]){
1682 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1683 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1684 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1685 },
1686 32, "Google Solera2026h1" },
1687 { (const uint8_t[]){
1688 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1689 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1690 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1691 },
1692 32, "Google Solera2026h2" },
1693 { (const uint8_t[]){
1694 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1695 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1696 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1697 },
1698 32, "Google Solera2027h1" },
1699 { (const uint8_t[]){
1700 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1701 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1702 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1703 },
1704 32, "Cloudflare Nimbus2026" },
1705 { (const uint8_t[]){
1706 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1707 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1708 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1709 },
1710 32, "Cloudflare Nimbus2027" },
1711 { (const uint8_t[]){
1712 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1713 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1714 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1715 },
1716 32, "DigiCert Wyvern2026h1" },
1717 { (const uint8_t[]){
1718 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1719 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1720 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1721 },
1722 32, "DigiCert Wyvern2026h2" },
1723 { (const uint8_t[]){
1724 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1725 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1726 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1727 },
1728 32, "DigiCert Wyvern2027h1" },
1729 { (const uint8_t[]){
1730 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1731 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1732 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1733 },
1734 32, "DigiCert Wyvern2027h2" },
1735 { (const uint8_t[]){
1736 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1737 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1738 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1739 },
1740 32, "DigiCert Sphinx2026h1" },
1741 { (const uint8_t[]){
1742 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1743 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1744 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1745 },
1746 32, "DigiCert Sphinx2026h2" },
1747 { (const uint8_t[]){
1748 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1749 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1750 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1751 },
1752 32, "DigiCert Sphinx2027h1" },
1753 { (const uint8_t[]){
1754 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1755 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1756 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1757 },
1758 32, "DigiCert Sphinx2027h2" },
1759 { (const uint8_t[]){
1760 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1761 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1762 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1763 },
1764 32, "Sectigo Mammoth2026h1" },
1765 { (const uint8_t[]){
1766 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1767 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1768 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1769 },
1770 32, "Sectigo Mammoth2026h2" },
1771 { (const uint8_t[]){
1772 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1773 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1774 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1775 },
1776 32, "Sectigo Sabre2026h1" },
1777 { (const uint8_t[]){
1778 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1779 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1780 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1781 },
1782 32, "Sectigo Sabre2026h2" },
1783 { (const uint8_t[]){
1784 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1785 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1786 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1787 },
1788 32, "Sectigo Elephant2026h1" },
1789 { (const uint8_t[]){
1790 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1791 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1792 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1793 },
1794 32, "Sectigo Elephant2026h2" },
1795 { (const uint8_t[]){
1796 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1797 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1798 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1799 },
1800 32, "Sectigo Elephant2027h1" },
1801 { (const uint8_t[]){
1802 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1803 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1804 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1805 },
1806 32, "Sectigo Elephant2027h2" },
1807 { (const uint8_t[]){
1808 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1809 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1810 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1811 },
1812 32, "Sectigo Tiger2026h1" },
1813 { (const uint8_t[]){
1814 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1815 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1816 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1817 },
1818 32, "Sectigo Tiger2026h2" },
1819 { (const uint8_t[]){
1820 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1821 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1822 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1823 },
1824 32, "Sectigo Tiger2027h1" },
1825 { (const uint8_t[]){
1826 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1827 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1828 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1829 },
1830 32, "Sectigo Tiger2027h2" },
1831 { (const uint8_t[]){
1832 0x61, 0xa3, 0x5d, 0xc3, 0x98, 0x06, 0x1b, 0x2a, 0x59, 0x5b, 0xfe,
1833 0x34, 0x46, 0x89, 0x95, 0x18, 0xf0, 0xfe, 0xac, 0x14, 0xb0, 0x1b,
1834 0xe0, 0x2a, 0x93, 0xbf, 0x05, 0x21, 0x46, 0x3a, 0x9d, 0xbd,
1835 },
1836 32, "Sectigo Dumbo" },
1837 { (const uint8_t[]){
1838 0xbe, 0x31, 0xd3, 0x65, 0x88, 0xdf, 0xd8, 0x05, 0xc8, 0x6d, 0x35,
1839 0x20, 0x29, 0x84, 0xac, 0xc9, 0xaa, 0x44, 0xae, 0xe3, 0x84, 0x08,
1840 0x0b, 0x9f, 0xcf, 0x42, 0xeb, 0xc8, 0x73, 0x55, 0xe4, 0x9b,
1841 },
1842 32, "Sectigo Tigger2026" },
1843 { (const uint8_t[]){
1844 0xfa, 0x63, 0x12, 0x74, 0x9a, 0xdc, 0xc8, 0x19, 0x95, 0x4e, 0x3e,
1845 0xf3, 0x01, 0x1d, 0x42, 0x67, 0x76, 0x88, 0xd4, 0x47, 0x1c, 0xfe,
1846 0xf6, 0x35, 0x3f, 0x89, 0x1d, 0xc8, 0x7c, 0x12, 0xac, 0xd4,
1847 },
1848 32, "Sectigo Tigger2027" },
1849 { (const uint8_t[]){
1850 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1851 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1852 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1853 },
1854 32, "Let's Encrypt Oak2026h1" },
1855 { (const uint8_t[]){
1856 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1857 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1858 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1859 },
1860 32, "Let's Encrypt Oak2026h2" },
1861 { (const uint8_t[]){
1862 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1863 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1864 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1865 },
1866 32, "TrustAsia log2026a" },
1867 { (const uint8_t[]){
1868 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1869 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1870 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1871 },
1872 32, "TrustAsia log2026b" },
1873 { (const uint8_t[]){
1874 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1875 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1876 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1877 },
1878 32, "TrustAsia HETU2027" },
1879 { (const uint8_t[]){
1880 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1881 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1882 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1883 },
1884 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1885 { (const uint8_t[]){
1886 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1887 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1888 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1889 },
1890 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1891 { NULL((void*)0), 0, NULL((void*)0) }
1892};
1893
1894/*
1895 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1896 */
1897static dissector_table_t ssl_alpn_dissector_table;
1898static dissector_table_t dtls_alpn_dissector_table;
1899
1900/*
1901 * Special cases for prefix matching of the ALPN, if the ALPN includes
1902 * a version number for a draft or protocol revision.
1903 */
1904typedef struct ssl_alpn_prefix_match_protocol {
1905 const char *proto_prefix;
1906 const char *dissector_name;
1907} ssl_alpn_prefix_match_protocol_t;
1908
1909static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1910 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1911 * already exists 3.1 as of this writing... match the prefix. */
1912 { "spdy/", "spdy" },
1913 /* draft-ietf-httpbis-http2-16 */
1914 { "h2-", "http2" }, /* draft versions */
1915};
1916
1917const value_string compress_certificate_algorithm_vals[] = {
1918 { 1, "zlib" },
1919 { 2, "brotli" },
1920 { 3, "zstd" },
1921 { 0, NULL((void*)0) }
1922};
1923
1924
1925const val64_string quic_transport_parameter_id[] = {
1926 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1927 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1928 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1929 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1930 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1931 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1932 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1933 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1934 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1935 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1936 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1937 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1938 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1939 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1940 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1941 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1942 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1943 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1944 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1945 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1946 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1947 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1948 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1949 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1950 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1951 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1952 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1953 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1954 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1955 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1956 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1957 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1958 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1959 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1960 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1961 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1962 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1963 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1964 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1965 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1966 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1967 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1968 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1969 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1970 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1971 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1972 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1973 { 0, NULL((void*)0) }
1974};
1975
1976/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1977const val64_string quic_address_discovery_vals[] = {
1978 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1979 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1980 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1981 { 0, NULL((void*)0) }
1982};
1983
1984/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1985const val64_string quic_enable_time_stamp_v2_vals[] = {
1986 { 1, "I would like to receive TIME_STAMP frames" },
1987 { 2, "I am able to generate TIME_STAMP frames" },
1988 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1989 { 0, NULL((void*)0) }
1990};
1991
1992/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1993const val64_string quic_enable_multipath_vals[] = {
1994 { 0, "don't support multipath" },
1995 { 1, "support multipath as defined in this document" },
1996 { 0, NULL((void*)0) }
1997};
1998
1999/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2000const value_string tls_hello_ext_ech_clienthello_types[] = {
2001 { 0, "Outer Client Hello" },
2002 { 1, "Inner Client Hello" },
2003 { 0, NULL((void*)0) }
2004};
2005
2006/* RFC 9180 */
2007const value_string kem_id_type_vals[] = {
2008 { 0x0000, "Reserved" },
2009 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2010 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2011 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2012 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2013 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2014 { 0, NULL((void*)0) }
2015};
2016const value_string kdf_id_type_vals[] = {
2017 { 0x0000, "Reserved" },
2018 { 0x0001, "HKDF-SHA256" },
2019 { 0x0002, "HKDF-SHA384" },
2020 { 0x0003, "HKDF-SHA512" },
2021 { 0, NULL((void*)0) }
2022};
2023const value_string aead_id_type_vals[] = {
2024 { 0x0000, "Reserved" },
2025 { 0x0001, "AES-128-GCM" },
2026 { 0x0002, "AES-256-GCM" },
2027 { 0x0003, "ChaCha20Poly1305" },
2028 { 0xFFFF, "Export-only" },
2029 { 0, NULL((void*)0) }
2030};
2031
2032const value_string token_binding_key_parameter_vals[] = {
2033 { 0, "rsa2048_pkcs1.5" },
2034 { 1, "rsa2048_pss" },
2035 { 2, "ecdsap256" },
2036 { 0, NULL((void*)0) }
2037};
2038
2039/* Lookup tables }}} */
2040
2041void
2042quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2043{
2044 const char *label;
2045 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2046 label = "GREASE";
2047 } else {
2048 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2049 }
2050 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2051}
2052
2053/* we keep this internal to packet-tls-utils, as there should be
2054 no need to access it any other way.
2055
2056 This also allows us to hide the dependency on zlib.
2057*/
2058struct _SslDecompress {
2059 int compression;
2060#ifdef USE_ZLIB_OR_ZLIBNG
2061 zlib_stream istream;
2062#endif
2063};
2064
2065/* To assist in parsing client/server key exchange messages
2066 0 indicates unknown */
2067int ssl_get_keyex_alg(int cipher)
2068{
2069 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2070 switch(cipher) {
2071 case 0x0017:
2072 case 0x0018:
2073 case 0x0019:
2074 case 0x001a:
2075 case 0x001b:
2076 case 0x0034:
2077 case 0x003a:
2078 case 0x0046:
2079 case 0x006c:
2080 case 0x006d:
2081 case 0x0089:
2082 case 0x009b:
2083 case 0x00a6:
2084 case 0x00a7:
2085 case 0x00bf:
2086 case 0x00c5:
2087 case 0xc084:
2088 case 0xc085:
2089 return KEX_DH_ANON0x13;
2090 case 0x000b:
2091 case 0x000c:
2092 case 0x000d:
2093 case 0x0030:
2094 case 0x0036:
2095 case 0x003e:
2096 case 0x0042:
2097 case 0x0068:
2098 case 0x0085:
2099 case 0x0097:
2100 case 0x00a4:
2101 case 0x00a5:
2102 case 0x00bb:
2103 case 0x00c1:
2104 case 0xc082:
2105 case 0xc083:
2106 return KEX_DH_DSS0x14;
2107 case 0x000e:
2108 case 0x000f:
2109 case 0x0010:
2110 case 0x0031:
2111 case 0x0037:
2112 case 0x003f:
2113 case 0x0043:
2114 case 0x0069:
2115 case 0x0086:
2116 case 0x0098:
2117 case 0x00a0:
2118 case 0x00a1:
2119 case 0x00bc:
2120 case 0x00c2:
2121 case 0xc07e:
2122 case 0xc07f:
2123 return KEX_DH_RSA0x15;
2124 case 0x0011:
2125 case 0x0012:
2126 case 0x0013:
2127 case 0x0032:
2128 case 0x0038:
2129 case 0x0040:
2130 case 0x0044:
2131 case 0x0063:
2132 case 0x0065:
2133 case 0x0066:
2134 case 0x006a:
2135 case 0x0087:
2136 case 0x0099:
2137 case 0x00a2:
2138 case 0x00a3:
2139 case 0x00bd:
2140 case 0x00c3:
2141 case 0xc080:
2142 case 0xc081:
2143 return KEX_DHE_DSS0x10;
2144 case 0x002d:
2145 case 0x008e:
2146 case 0x008f:
2147 case 0x0090:
2148 case 0x0091:
2149 case 0x00aa:
2150 case 0x00ab:
2151 case 0x00b2:
2152 case 0x00b3:
2153 case 0x00b4:
2154 case 0x00b5:
2155 case 0xc090:
2156 case 0xc091:
2157 case 0xc096:
2158 case 0xc097:
2159 case 0xc0a6:
2160 case 0xc0a7:
2161 case 0xc0aa:
2162 case 0xc0ab:
2163 case 0xccad:
2164 case 0xe41c:
2165 case 0xe41d:
2166 return KEX_DHE_PSK0x11;
2167 case 0x0014:
2168 case 0x0015:
2169 case 0x0016:
2170 case 0x0033:
2171 case 0x0039:
2172 case 0x0045:
2173 case 0x0067:
2174 case 0x006b:
2175 case 0x0088:
2176 case 0x009a:
2177 case 0x009e:
2178 case 0x009f:
2179 case 0x00be:
2180 case 0x00c4:
2181 case 0xc07c:
2182 case 0xc07d:
2183 case 0xc09e:
2184 case 0xc09f:
2185 case 0xc0a2:
2186 case 0xc0a3:
2187 case 0xccaa:
2188 case 0xe41e:
2189 case 0xe41f:
2190 return KEX_DHE_RSA0x12;
2191 case 0xc015:
2192 case 0xc016:
2193 case 0xc017:
2194 case 0xc018:
2195 case 0xc019:
2196 return KEX_ECDH_ANON0x19;
2197 case 0xc001:
2198 case 0xc002:
2199 case 0xc003:
2200 case 0xc004:
2201 case 0xc005:
2202 case 0xc025:
2203 case 0xc026:
2204 case 0xc02d:
2205 case 0xc02e:
2206 case 0xc074:
2207 case 0xc075:
2208 case 0xc088:
2209 case 0xc089:
2210 return KEX_ECDH_ECDSA0x1a;
2211 case 0xc00b:
2212 case 0xc00c:
2213 case 0xc00d:
2214 case 0xc00e:
2215 case 0xc00f:
2216 case 0xc029:
2217 case 0xc02a:
2218 case 0xc031:
2219 case 0xc032:
2220 case 0xc078:
2221 case 0xc079:
2222 case 0xc08c:
2223 case 0xc08d:
2224 return KEX_ECDH_RSA0x1b;
2225 case 0xc006:
2226 case 0xc007:
2227 case 0xc008:
2228 case 0xc009:
2229 case 0xc00a:
2230 case 0xc023:
2231 case 0xc024:
2232 case 0xc02b:
2233 case 0xc02c:
2234 case 0xc072:
2235 case 0xc073:
2236 case 0xc086:
2237 case 0xc087:
2238 case 0xc0ac:
2239 case 0xc0ad:
2240 case 0xc0ae:
2241 case 0xc0af:
2242 case 0xcca9:
2243 case 0xe414:
2244 case 0xe415:
2245 return KEX_ECDHE_ECDSA0x16;
2246 case 0xc033:
2247 case 0xc034:
2248 case 0xc035:
2249 case 0xc036:
2250 case 0xc037:
2251 case 0xc038:
2252 case 0xc039:
2253 case 0xc03a:
2254 case 0xc03b:
2255 case 0xc09a:
2256 case 0xc09b:
2257 case 0xccac:
2258 case 0xe418:
2259 case 0xe419:
2260 case 0xd001:
2261 case 0xd002:
2262 case 0xd003:
2263 case 0xd005:
2264 return KEX_ECDHE_PSK0x17;
2265 case 0xc010:
2266 case 0xc011:
2267 case 0xc012:
2268 case 0xc013:
2269 case 0xc014:
2270 case 0xc027:
2271 case 0xc028:
2272 case 0xc02f:
2273 case 0xc030:
2274 case 0xc076:
2275 case 0xc077:
2276 case 0xc08a:
2277 case 0xc08b:
2278 case 0xcca8:
2279 case 0xe412:
2280 case 0xe413:
2281 return KEX_ECDHE_RSA0x18;
2282 case 0x001e:
2283 case 0x001f:
2284 case 0x0020:
2285 case 0x0021:
2286 case 0x0022:
2287 case 0x0023:
2288 case 0x0024:
2289 case 0x0025:
2290 case 0x0026:
2291 case 0x0027:
2292 case 0x0028:
2293 case 0x0029:
2294 case 0x002a:
2295 case 0x002b:
2296 return KEX_KRB50x1c;
2297 case 0x002c:
2298 case 0x008a:
2299 case 0x008b:
2300 case 0x008c:
2301 case 0x008d:
2302 case 0x00a8:
2303 case 0x00a9:
2304 case 0x00ae:
2305 case 0x00af:
2306 case 0x00b0:
2307 case 0x00b1:
2308 case 0xc064:
2309 case 0xc065:
2310 case 0xc08e:
2311 case 0xc08f:
2312 case 0xc094:
2313 case 0xc095:
2314 case 0xc0a4:
2315 case 0xc0a5:
2316 case 0xc0a8:
2317 case 0xc0a9:
2318 case 0xccab:
2319 case 0xe416:
2320 case 0xe417:
2321 return KEX_PSK0x1d;
2322 case 0x0001:
2323 case 0x0002:
2324 case 0x0003:
2325 case 0x0004:
2326 case 0x0005:
2327 case 0x0006:
2328 case 0x0007:
2329 case 0x0008:
2330 case 0x0009:
2331 case 0x000a:
2332 case 0x002f:
2333 case 0x0035:
2334 case 0x003b:
2335 case 0x003c:
2336 case 0x003d:
2337 case 0x0041:
2338 case 0x0060:
2339 case 0x0061:
2340 case 0x0062:
2341 case 0x0064:
2342 case 0x0084:
2343 case 0x0096:
2344 case 0x009c:
2345 case 0x009d:
2346 case 0x00ba:
2347 case 0x00c0:
2348 case 0xc07a:
2349 case 0xc07b:
2350 case 0xc09c:
2351 case 0xc09d:
2352 case 0xc0a0:
2353 case 0xc0a1:
2354 case 0xe410:
2355 case 0xe411:
2356 case 0xfefe:
2357 case 0xfeff:
2358 case 0xffe0:
2359 case 0xffe1:
2360 return KEX_RSA0x1e;
2361 case 0x002e:
2362 case 0x0092:
2363 case 0x0093:
2364 case 0x0094:
2365 case 0x0095:
2366 case 0x00ac:
2367 case 0x00ad:
2368 case 0x00b6:
2369 case 0x00b7:
2370 case 0x00b8:
2371 case 0x00b9:
2372 case 0xc092:
2373 case 0xc093:
2374 case 0xc098:
2375 case 0xc099:
2376 case 0xccae:
2377 case 0xe41a:
2378 case 0xe41b:
2379 return KEX_RSA_PSK0x1f;
2380 case 0xc01a:
2381 case 0xc01d:
2382 case 0xc020:
2383 return KEX_SRP_SHA0x20;
2384 case 0xc01c:
2385 case 0xc01f:
2386 case 0xc022:
2387 return KEX_SRP_SHA_DSS0x21;
2388 case 0xc01b:
2389 case 0xc01e:
2390 case 0xc021:
2391 return KEX_SRP_SHA_RSA0x22;
2392 case 0xc0ff:
2393 return KEX_ECJPAKE0x24;
2394 case 0xe003:
2395 case 0xe013:
2396 case 0xe053:
2397 return KEX_ECC_SM20x26;
2398 default:
2399 break;
2400 }
2401
2402 return 0;
2403 /* }}} */
2404}
2405
2406static wmem_list_t *connection_id_session_list;
2407
2408void
2409ssl_init_cid_list(void) {
2410 connection_id_session_list = wmem_list_new(wmem_file_scope());
2411}
2412
2413void
2414ssl_cleanup_cid_list(void) {
2415 wmem_destroy_list(connection_id_session_list);
2416}
2417
2418void
2419ssl_add_session_by_cid(SslDecryptSession *session)
2420{
2421 /* Add each session only once, the list is walked for every DTLS record. */
2422 if (session->session.cid_listed)
2423 return;
2424 session->session.cid_listed = true1;
2425 wmem_list_append(connection_id_session_list, session);
2426}
2427
2428SslDecryptSession *
2429ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2430{
2431 SslDecryptSession * ssl_cid = NULL((void*)0);
2432 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2433
2434 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2435 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2436 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2436, "ssl != ((void*)0)"))));
2437 SslSession *session = &ssl->session;
2438
2439 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2440 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2441 ssl_cid = ssl;
2442 }
2443 }
2444
2445 if (session->server_cid_len > 0) {
2446 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2447 ssl_cid = ssl;
2448 }
2449 }
2450
2451 it = wmem_list_frame_next(it);
2452 }
2453
2454 return ssl_cid;
2455}
2456
2457/* StringInfo structure (len + data) functions {{{ */
2458
2459int
2460ssl_data_alloc(StringInfo* str, size_t len)
2461{
2462 str->data = (unsigned char *)g_malloc(len);
2463 /* the allocator can return a null pointer for a size equal to 0,
2464 * and that must be allowed */
2465 if (len > 0 && !str->data)
2466 return -1;
2467 str->data_len = (unsigned) len;
2468 return 0;
2469}
2470
2471void
2472ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2473{
2474 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2474, "data"))));
2475 memcpy(str->data, data, len);
2476 str->data_len = len;
2477}
2478
2479static int
2480ssl_data_realloc(StringInfo* str, unsigned len)
2481{
2482 str->data = (unsigned char *)g_realloc(str->data, len);
2483 if (!str->data)
2484 return -1;
2485 str->data_len = len;
2486 return 0;
2487}
2488
2489static StringInfo *
2490ssl_data_clone(StringInfo *str)
2491{
2492 StringInfo *cloned_str;
2493 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2494 sizeof(StringInfo) + str->data_len);
2495 cloned_str->data = (unsigned char *) (cloned_str + 1);
2496 ssl_data_set(cloned_str, str->data, str->data_len);
2497 return cloned_str;
2498}
2499
2500static int
2501ssl_data_copy(StringInfo* dst, StringInfo* src)
2502{
2503 if (dst->data_len < src->data_len) {
2504 if (ssl_data_realloc(dst, src->data_len))
2505 return -1;
2506 }
2507 memcpy(dst->data, src->data, src->data_len);
2508 dst->data_len = src->data_len;
2509 return 0;
2510}
2511
2512/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2513 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2514 * success. */
2515static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2516 size_t i;
2517
2518 if (hex_len & 1)
2519 return false0;
2520
2521 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2522 for (i = 0; i < hex_len / 2; i++) {
2523 int a = ws_xton(in[i*2]);
2524 int b = ws_xton(in[i*2 + 1]);
2525 if (a == -1 || b == -1)
2526 return false0;
2527 out->data[i] = a << 4 | b;
2528 }
2529 out->data_len = (unsigned)hex_len / 2;
2530 return true1;
2531}
2532/* StringInfo structure (len + data) functions }}} */
2533
2534
2535/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2536/* hmac abstraction layer */
2537#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2538
2539static inline int
2540ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2541{
2542 gcry_error_t err;
2543 const char *err_str, *err_src;
2544
2545 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2546 if (err != 0) {
2547 err_str = gcry_strerror(err);
2548 err_src = gcry_strsource(err);
2549 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2550 return -1;
2551 }
2552 return 0;
2553}
2554
2555static inline int
2556ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2557{
2558 gcry_error_t err;
2559 const char *err_str, *err_src;
2560
2561 err = gcry_md_setkey (*(md), key, len);
2562 if (err != 0) {
2563 err_str = gcry_strerror(err);
2564 err_src = gcry_strsource(err);
2565 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2566 return -1;
2567 }
2568 return 0;
2569}
2570
2571static inline int
2572ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2573{
2574 gcry_md_reset(*md);
2575 return 0;
2576}
2577
2578static inline void
2579ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2580{
2581 gcry_md_write(*(md), data, len);
2582}
2583static inline void
2584ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2585{
2586 int algo;
2587 unsigned len;
2588
2589 algo = gcry_md_get_algo (*(md));
2590 len = gcry_md_get_algo_dlen(algo);
2591 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2591, "len <= *datalen"))));
2592 memcpy(data, gcry_md_read(*(md), algo), len);
2593 *datalen = len;
2594}
2595static inline void
2596ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2597{
2598 gcry_md_close(*(md));
2599}
2600
2601/* message digest abstraction layer*/
2602#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2603
2604static inline int
2605ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2606{
2607 gcry_error_t err;
2608 const char *err_str, *err_src;
2609 err = gcry_md_open(md,algo, 0);
2610 if (err != 0) {
2611 err_str = gcry_strerror(err);
2612 err_src = gcry_strsource(err);
2613 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2614 return -1;
2615 }
2616 return 0;
2617}
2618static inline void
2619ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2620{
2621 gcry_md_write(*(md), data, len);
2622}
2623static inline void
2624ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2625{
2626 int algo;
2627 int len;
2628 algo = gcry_md_get_algo (*(md));
2629 len = gcry_md_get_algo_dlen (algo);
2630 memcpy(data, gcry_md_read(*(md), algo), len);
2631 *datalen = len;
2632}
2633static inline void
2634ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2635{
2636 gcry_md_close(*(md));
2637}
2638
2639static inline void
2640ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2641{
2642 gcry_md_reset(*md);
2643}
2644
2645/* md5 /sha abstraction layer */
2646#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2647#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2648
2649static inline int
2650ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2651{
2652 gcry_error_t err;
2653 const char *err_str, *err_src;
2654 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2655 if (err != 0) {
2656 err_str = gcry_strerror(err);
2657 err_src = gcry_strsource(err);
2658 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2659 return -1;
2660 }
2661 return 0;
2662}
2663static inline void
2664ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2665{
2666 gcry_md_write(*(md), data, len);
2667}
2668static inline void
2669ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2670{
2671 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2672 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2673}
2674
2675static inline void
2676ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2677{
2678 gcry_md_reset(*md);
2679}
2680
2681static inline void
2682ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2683{
2684 gcry_md_close(*(md));
2685}
2686
2687static inline int
2688ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2689{
2690 gcry_error_t err;
2691 const char *err_str, *err_src;
2692 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2693 if (err != 0) {
2694 err_str = gcry_strerror(err);
2695 err_src = gcry_strsource(err);
2696 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2697 return -1;
2698 }
2699 return 0;
2700}
2701static inline void
2702ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2703{
2704 gcry_md_write(*(md), data, len);
2705}
2706static inline void
2707ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2708{
2709 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2710 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2711}
2712
2713static inline void
2714ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2715{
2716 gcry_md_reset(*md);
2717}
2718
2719static inline void
2720ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2721{
2722 gcry_md_close(*(md));
2723}
2724/* libgcrypt wrappers for HMAC/message digest operations }}} */
2725
2726/* libgcrypt wrappers for Cipher state manipulation {{{ */
2727int
2728ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2729{
2730 int ret;
2731#if 0
2732 unsigned char *ivp;
2733 int i;
2734 gcry_cipher_hd_t c;
2735 c=(gcry_cipher_hd_t)*cipher;
2736#endif
2737 ssl_debug_printf("--------------------------------------------------------------------");
2738#if 0
2739 for(ivp=c->iv,i=0; i < iv_len; i++ )
2740 {
2741 ssl_debug_printf("%d ",ivp[i]);
2742 i++;
2743 }
2744#endif
2745 ssl_debug_printf("--------------------------------------------------------------------");
2746 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2747#if 0
2748 for(ivp=c->iv,i=0; i < iv_len; i++ )
2749 {
2750 ssl_debug_printf("%d ",ivp[i]);
2751 i++;
2752 }
2753#endif
2754 ssl_debug_printf("--------------------------------------------------------------------");
2755 return ret;
2756}
2757/* stream cipher abstraction layer*/
2758static int
2759ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2760 unsigned char* iv, int mode)
2761{
2762 int gcry_modes[] = {
2763 GCRY_CIPHER_MODE_STREAM,
2764 GCRY_CIPHER_MODE_CBC,
2765 GCRY_CIPHER_MODE_GCM,
2766 GCRY_CIPHER_MODE_CCM,
2767 GCRY_CIPHER_MODE_CCM,
2768 GCRY_CIPHER_MODE_POLY1305,
2769 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2770 };
2771 int err;
2772 if (algo == -1) {
2773 /* NULL mode */
2774 *(cipher) = (gcry_cipher_hd_t)-1;
2775 return 0;
2776 }
2777 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2778 if (err !=0)
2779 return -1;
2780 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2781 if (err != 0)
2782 return -1;
2783 /* AEAD cipher suites will set the nonce later. */
2784 if (mode == MODE_CBC) {
2785 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2786 if (err != 0)
2787 return -1;
2788 }
2789 return 0;
2790}
2791static inline int
2792ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2793 const unsigned char * in, int inl)
2794{
2795 if ((*cipher) == (gcry_cipher_hd_t)-1)
2796 {
2797 if (in && inl)
2798 memcpy(out, in, outl < inl ? outl : inl);
2799 return 0;
2800 }
2801 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2802}
2803static inline int
2804ssl_get_digest_by_name(const char*name)
2805{
2806 return gcry_md_map_name(name);
2807}
2808static inline int
2809ssl_get_cipher_by_name(const char* name)
2810{
2811 return gcry_cipher_map_name(name);
2812}
2813
2814static inline void
2815ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2816{
2817 if ((*cipher) != (gcry_cipher_hd_t)-1)
2818 gcry_cipher_close(*cipher);
2819 *cipher = NULL((void*)0);
2820}
2821/* }}} */
2822
2823/* Digests, Ciphers and Cipher Suites registry {{{ */
2824static const SslDigestAlgo digests[]={
2825 {"MD5", 16},
2826 {"SHA1", 20},
2827 {"SHA256", 32},
2828 {"SHA384", 48},
2829 {"SM3", 32},
2830 {"Not Applicable", 0},
2831};
2832
2833#define DIGEST_MAX_SIZE48 48
2834
2835/* get index digest index */
2836static const SslDigestAlgo *
2837ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2838 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2839 return &digests[DIG_NA0x45 - DIG_MD50x40];
2840 }
2841 return &digests[cs->dig - DIG_MD50x40];
2842}
2843
2844static const char *ciphers[]={
2845 "DES",
2846 "3DES",
2847 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2848 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2849 "IDEA",
2850 "AES",
2851 "AES256",
2852 "CAMELLIA128",
2853 "CAMELLIA256",
2854 "SEED",
2855 "CHACHA20", /* since Libgcrypt 1.7.0 */
2856 "SM1",
2857 "SM4",
2858 "*UNKNOWN*"
2859};
2860
2861static const SslCipherSuite cipher_suites[]={
2862 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2863 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2864 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2865 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2866 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2867 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2868 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2869 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2870 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2871 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2872 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2873 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2874 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2875 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2876 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2877 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2878 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2879 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2880 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2881 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2882 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2883 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2884 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2885 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2886 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2887 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2888 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2889 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2890 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2891 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2892 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2893 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2894 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2895 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2896 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2897 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2898 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2899 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2900 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2901 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2902 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2903 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2904 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2905 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2906 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2907 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2908 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2909 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2910 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2911 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2912 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2913 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2914 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2915 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2916 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2917 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2918 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2919 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2920 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2921 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2922 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2923 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2924 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2925 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2926 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2927 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2928 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2929 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2930 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2931 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2932 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2933 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2934 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2935 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2936 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2937 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2938 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2939 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2940 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2941 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2942 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2943 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2944 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2945 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2946 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2947 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2948 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2949 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2950 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2951 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2952 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2953 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2954 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2955 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2956 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2957 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2958 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2959 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2960 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2961 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2962 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2963 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2964 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2965 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2966 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2967 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2968 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2969 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2970 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2971 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2972 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2973 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2974 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2975 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2976 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2977 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2978 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2979 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2980 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2981 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2982 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2983 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2984 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2985 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2986 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2987 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2988 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2989 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2990 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2991 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2992 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2993 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2994 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2995 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2996
2997 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2998 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2999 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
3000 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
3001 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
3002 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
3003 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3004
3005 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3006 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3007 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3008 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3009 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3010 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3011 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3012 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3013 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3014 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3015 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3016 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3017 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3018 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3019 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3020 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3021 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3022 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3023 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3024 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3025 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3026 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3027 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3028 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3029 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3030 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3031 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3032 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3033 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3034 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3035 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3036 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3037 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3038 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3039 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3040 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3041 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3042 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3043 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3044 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3045 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3046 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3047 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3048 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3049 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3050 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3051 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3052 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3053 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3054 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3055 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3056 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3057 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3058 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3059 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3060 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3061 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3062 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3063 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3064 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3065 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3066 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3067 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3068 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3069 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3070 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3071 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3072 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3073 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3074 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3075 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3076 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3077 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3078 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3079 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3080 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3081 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3082 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3083 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3084 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3085 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3086 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3087 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3088 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3089 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3090 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3091 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3092 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3093 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3094 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3095 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3096 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3097 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3098 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3099 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3100 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3101 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3102 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3103 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3104 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3105 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3106 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3107 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3108 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3109 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3110 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3111 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3112 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3113 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3114 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3115 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3116 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3117 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3118 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3119 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3120 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3121 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3122 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3123 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3124 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3125 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3126 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3127 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3128 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3129 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3130 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3131 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3132 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3133 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3134 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3135 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3136 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3137 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3138 /* GM */
3139 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3140 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3141 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3142 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3143 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3144 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3145 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3146 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3147 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3148 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3149 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3150 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3151 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3152 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3153 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3154 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3155 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3156 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3157 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3158 {-1, 0, 0, 0, MODE_STREAM}
3159};
3160
3161#define MAX_BLOCK_SIZE16 16
3162#define MAX_KEY_SIZE32 32
3163
3164const SslCipherSuite *
3165ssl_find_cipher(int num)
3166{
3167 const SslCipherSuite *c;
3168 for(c=cipher_suites;c->number!=-1;c++){
9
←
Assuming the condition is false
→
10
←
Loop condition is false. Execution continues on line 3174
→
3169 if(c->number==num){
3170 return c;
3171 }
3172 }
3173
3174 return NULL((void*)0);
11
←
Returning null pointer, which participates in a condition later
→
3175}
3176
3177int
3178ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3179{
3180 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3181}
3182
3183unsigned
3184ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3185{
3186 int cipher_algo;
3187 if (cipher_suite->mode != MODE_CBC) return 0;
3188 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3189 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3190}
3191
3192static unsigned
3193ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3194{
3195 switch (cipher_suite_num) {
3196 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3197 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3198 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3199 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3200 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3201 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3202 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3203 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3204 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3205 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3206 return 5;
3207
3208 /* not defined in below draft, but "implemented by several vendors",
3209 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3210 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3211 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3212 return 7;
3213
3214 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3215 * used 7. Until a pcap proves 8, let's use the old value. Link:
3216 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3217 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3218 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3219 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3220 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3221 return 7;
3222
3223 default:
3224 return 0;
3225 }
3226}
3227
3228/* Digests, Ciphers and Cipher Suites registry }}} */
3229
3230
3231/* HMAC and the Pseudorandom function {{{ */
3232static int
3233tls_hash(StringInfo *secret, StringInfo *seed, int md,
3234 StringInfo *out, unsigned out_len)
3235{
3236 /* RFC 2246 5. HMAC and the pseudorandom function
3237 * '+' denotes concatenation.
3238 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3239 * HMAC_hash(secret, A(2) + seed) + ...
3240 * A(0) = seed
3241 * A(i) = HMAC_hash(secret, A(i - 1))
3242 */
3243 uint8_t *ptr;
3244 unsigned left, tocpy;
3245 uint8_t *A;
3246 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3247 unsigned A_l, tmp_l;
3248 SSL_HMACgcry_md_hd_t hm;
3249
3250 ptr = out->data;
3251 left = out_len;
3252
3253 ssl_print_string("tls_hash: hash secret", secret);
3254 ssl_print_string("tls_hash: hash seed", seed);
3255 /* A(0) = seed */
3256 A = seed->data;
3257 A_l = seed->data_len;
3258
3259 if (ssl_hmac_init(&hm, md) != 0) {
3260 return -1;
3261 }
3262 while (left) {
3263 /* A(i) = HMAC_hash(secret, A(i-1)) */
3264 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3265 ssl_hmac_update(&hm, A, A_l);
3266 A_l = sizeof(_A); /* upper bound len for hash output */
3267 ssl_hmac_final(&hm, _A, &A_l);
3268 A = _A;
3269
3270 /* HMAC_hash(secret, A(i) + seed) */
3271 ssl_hmac_reset(&hm);
3272 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3273 ssl_hmac_update(&hm, A, A_l);
3274 ssl_hmac_update(&hm, seed->data, seed->data_len);
3275 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3276 ssl_hmac_final(&hm, tmp, &tmp_l);
3277 ssl_hmac_reset(&hm);
3278
3279 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3280 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3281 memcpy(ptr, tmp, tocpy);
3282 ptr += tocpy;
3283 left -= tocpy;
3284 }
3285 ssl_hmac_cleanup(&hm);
3286 out->data_len = out_len;
3287
3288 ssl_print_string("hash out", out);
3289 return 0;
3290}
3291
3292static bool_Bool
3293tls_prf(StringInfo* secret, const char *usage,
3294 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3295{
3296 StringInfo seed, sha_out, md5_out;
3297 uint8_t *ptr;
3298 StringInfo s1, s2;
3299 unsigned i,s_l;
3300 size_t usage_len, rnd2_len;
3301 bool_Bool success = false0;
3302 usage_len = strlen(usage);
3303 rnd2_len = rnd2 ? rnd2->data_len : 0;
3304
3305 /* initialize buffer for sha, md5 random seed*/
3306 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3307 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3308 return false0;
3309 }
3310 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3311 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3312 goto free_sha;
3313 }
3314 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3315 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3316 (int) (usage_len+rnd1->data_len+rnd2_len));
3317 goto free_md5;
3318 }
3319
3320 ptr=seed.data;
3321 memcpy(ptr,usage,usage_len);
3322 ptr+=usage_len;
3323 memcpy(ptr,rnd1->data,rnd1->data_len);
3324 if (rnd2_len > 0) {
3325 ptr+=rnd1->data_len;
3326 memcpy(ptr,rnd2->data,rnd2->data_len);
3327 /*ptr+=rnd2->data_len;*/
3328 }
3329
3330 /* initialize buffer for client/server seeds*/
3331 s_l=secret->data_len/2 + secret->data_len%2;
3332 if (ssl_data_alloc(&s1, s_l) < 0) {
3333 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3334 goto free_seed;
3335 }
3336 if (ssl_data_alloc(&s2, s_l) < 0) {
3337 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3338 goto free_s1;
3339 }
3340
3341 memcpy(s1.data,secret->data,s_l);
3342 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3343
3344 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3345 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3346 goto free_s2;
3347 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3348 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3349 goto free_s2;
3350
3351 for (i = 0; i < out_len; i++)
3352 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3353 /* success, now store the new meaningful data length */
3354 out->data_len = out_len;
3355 success = true1;
3356
3357 ssl_print_string("PRF out",out);
3358free_s2:
3359 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3360free_s1:
3361 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3362free_seed:
3363 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3364free_md5:
3365 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3366free_sha:
3367 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3368 return success;
3369}
3370
3371static bool_Bool
3372tls12_prf(int md, StringInfo* secret, const char* usage,
3373 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3374{
3375 StringInfo label_seed;
3376 int success;
3377 size_t usage_len, rnd2_len;
3378 rnd2_len = rnd2 ? rnd2->data_len : 0;
3379
3380 usage_len = strlen(usage);
3381 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3382 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3383 return false0;
3384 }
3385 memcpy(label_seed.data, usage, usage_len);
3386 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3387 if (rnd2_len > 0)
3388 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3389
3390 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3391 success = tls_hash(secret, &label_seed, md, out, out_len);
3392 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3393 if(success != -1){
3394 ssl_print_string("PRF out", out);
3395 return true1;
3396 }
3397 return false0;
3398}
3399
3400static bool_Bool
3401ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3402 StringInfo *out, unsigned out_len)
3403{
3404 SSL_MD5_CTXgcry_md_hd_t md5;
3405 uint8_t tmp[16];
3406
3407 if (ssl_md5_init(&md5) != 0) {
3408 return false0;
3409 }
3410 ssl_md5_update(&md5,r1->data,r1->data_len);
3411 ssl_md5_update(&md5,r2->data,r2->data_len);
3412 ssl_md5_final(tmp,&md5);
3413 ssl_md5_cleanup(&md5);
3414
3415 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3415, "out_len <= sizeof(tmp)"))));
3416 ssl_data_set(out, tmp, out_len);
3417 ssl_print_string("export iv", out);
3418 return true1;
3419}
3420
3421static bool_Bool
3422ssl3_prf(StringInfo* secret, const char* usage,
3423 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3424{
3425 SSL_MD5_CTXgcry_md_hd_t md5;
3426 SSL_SHA_CTXgcry_md_hd_t sha;
3427 unsigned off;
3428 int i = 0,j;
3429 uint8_t buf[20];
3430
3431 if (ssl_sha_init(&sha) != 0) {
3432 return false0;
3433 }
3434 if (ssl_md5_init(&md5) != 0) {
3435 ssl_sha_cleanup(&sha);
3436 return false0;
3437 }
3438 for (off = 0; off < out_len; off += 16) {
3439 unsigned char outbuf[16];
3440 i++;
3441
3442 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3443 /* A, BB, CCC, ... */
3444 for(j=0;j<i;j++){
3445 buf[j]=64+i;
3446 }
3447
3448 ssl_sha_update(&sha,buf,i);
3449 ssl_sha_update(&sha,secret->data,secret->data_len);
3450
3451 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3452 if (rnd2)
3453 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3454 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3455 }
3456 else{
3457 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3458 if (rnd2)
3459 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3460 }
3461
3462 ssl_sha_final(buf,&sha);
3463 ssl_sha_reset(&sha);
3464
3465 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3466 secret->data_len);
3467 ssl_md5_update(&md5,secret->data,secret->data_len);
3468 ssl_md5_update(&md5,buf,20);
3469 ssl_md5_final(outbuf,&md5);
3470 ssl_md5_reset(&md5);
3471
3472 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3473 }
3474 ssl_sha_cleanup(&sha);
3475 ssl_md5_cleanup(&md5);
3476 out->data_len = out_len;
3477
3478 return true1;
3479}
3480
3481/* out_len is the wanted output length for the pseudorandom function.
3482 * Ensure that ssl->cipher_suite is set. */
3483static bool_Bool
3484prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3485 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3486{
3487 switch (ssl->session.version) {
3488 case SSLV3_VERSION0x300:
3489 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3490
3491 case TLSV1_VERSION0x301:
3492 case TLSV1DOT1_VERSION0x302:
3493 case DTLSV1DOT0_VERSION0xfeff:
3494 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3495 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3496
3497 default: /* TLSv1.2 */
3498 switch (ssl->cipher_suite->dig) {
3499 case DIG_SM30x44:
3500#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3501 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3502 out, out_len);
3503#else
3504 return false0;
3505#endif
3506 case DIG_SHA3840x43:
3507 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3508 out, out_len);
3509 default:
3510 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3511 out, out_len);
3512 }
3513 }
3514}
3515
3516/* Handshake transcript {{{ */
3517
3518/* Only the messages before the hash function is known (the ClientHello and
3519 * the ServerHello or HelloRetryRequest, each at most 2^24 + 11 bytes) are
3520 * buffered, so this should only be reached with bogus messages, such as
3521 * repeated ClientHellos after a TLS 1.3 draft HelloRetryRequest. */
3522#define TLS_TRANSCRIPT_MAX_BUFFER(64 * 1024 * 1024) (64 * 1024 * 1024)
3523
3524static void
3525tls_transcript_close(tls_transcript_t *transcript)
3526{
3527 if (transcript->md) {
3528 gcry_md_close(transcript->md);
3529 transcript->md = NULL((void*)0);
3530 }
3531}
3532
3533void
3534tls_transcript_reset(tls_transcript_t *transcript)
3535{
3536 wmem_free(wmem_file_scope(), transcript->buffer.data);
3537 transcript->buffer.data = NULL((void*)0);
3538 transcript->buffer.data_len = 0;
3539 tls_transcript_close(transcript);
3540 transcript->failed = false0;
3541}
3542
3543/* Gives up on the transcript until it is reset. */
3544static void
3545tls_transcript_fail(tls_transcript_t *transcript)
3546{
3547 tls_transcript_reset(transcript);
3548 transcript->failed = true1;
3549}
3550
3551static bool_Bool
3552tls_transcript_is_empty(const tls_transcript_t *transcript)
3553{
3554 return transcript->md == NULL((void*)0) && transcript->buffer.data_len == 0;
3555}
3556
3557static void
3558tls_transcript_add(tls_transcript_t *transcript, const uint8_t *data, unsigned len)
3559{
3560 if (transcript->failed || len == 0)
3561 return;
3562
3563 if (transcript->md) {
3564 gcry_md_write(transcript->md, data, len);
3565 return;
3566 }
3567
3568 if (len > TLS_TRANSCRIPT_MAX_BUFFER(64 * 1024 * 1024) - transcript->buffer.data_len) {
3569 ssl_debug_printf("%s transcript too long before the hash is known\n", G_STRFUNC((const char*) (__func__)));
3570 tls_transcript_fail(transcript);
3571 return;
3572 }
3573 transcript->buffer.data = (unsigned char *)wmem_realloc(wmem_file_scope(), transcript->buffer.data,
3574 transcript->buffer.data_len + len);
3575 memcpy(transcript->buffer.data + transcript->buffer.data_len, data, len);
3576 transcript->buffer.data_len += len;
3577}
3578
3579/* Returns a new digest handle (which must be closed) with the transcript so
3580 * far for the given hash function(s), or NULL. algo2 is 0 or a second hash
3581 * function, for the concatenated MD5 and SHA-1 of TLS 1.0 and 1.1. */
3582static gcry_md_hd_t
3583tls_transcript_copy(const tls_transcript_t *transcript, int algo, int algo2)
3584{
3585 gcry_md_hd_t md = NULL((void*)0);
3586
3587 if (transcript->failed)
3588 return NULL((void*)0);
3589
3590 if (transcript->md) {
3591 if (!gcry_md_is_enabled(transcript->md, algo) ||
3592 (algo2 && !gcry_md_is_enabled(transcript->md, algo2))) {
3593 ssl_debug_printf("%s transcript uses a different hash\n", G_STRFUNC((const char*) (__func__)));
3594 return NULL((void*)0);
3595 }
3596 if (gcry_md_copy(&md, transcript->md) != 0)
3597 return NULL((void*)0);
3598 } else {
3599 if (gcry_md_open(&md, algo, 0) != 0)
3600 return NULL((void*)0);
3601 if (algo2 && gcry_md_enable(md, algo2) != 0) {
3602 gcry_md_close(md);
3603 return NULL((void*)0);
3604 }
3605 gcry_md_write(md, transcript->buffer.data, transcript->buffer.data_len);
3606 }
3607 return md;
3608}
3609
3610/* Gets the hash of the transcript so far, which can be continued. */
3611static bool_Bool
3612tls_transcript_hash(const tls_transcript_t *transcript, int algo,
3613 uint8_t *out, unsigned *out_len)
3614{
3615 gcry_md_hd_t md = tls_transcript_copy(transcript, algo, 0);
3616
3617 if (!md)
3618 return false0;
3619 *out_len = gcry_md_get_algo_dlen(algo);
3620 memcpy(out, gcry_md_read(md, algo), *out_len);
3621 gcry_md_close(md);
3622 return true1;
3623}
3624
3625/* Starts hashing the transcript with the given hash function(s) (see
3626 * tls_transcript_copy), keeping only the digest state from now on. */
3627static bool_Bool
3628tls_transcript_set_hash(tls_transcript_t *transcript, int algo, int algo2)
3629{
3630 if (transcript->failed)
3631 return false0;
3632
3633 if (transcript->md) {
3634 /* Already started, e.g. after a HelloRetryRequest. */
3635 if (gcry_md_is_enabled(transcript->md, algo) &&
3636 (!algo2 || gcry_md_is_enabled(transcript->md, algo2))) {
3637 return true1;
3638 }
3639 ssl_debug_printf("%s hash function changed\n", G_STRFUNC((const char*) (__func__)));
3640 tls_transcript_fail(transcript);
3641 return false0;
3642 }
3643
3644 gcry_md_hd_t md = tls_transcript_copy(transcript, algo, algo2);
3645 if (!md) {
3646 tls_transcript_fail(transcript);
3647 return false0;
3648 }
3649 tls_transcript_reset(transcript);
3650 transcript->md = md;
3651 return true1;
3652}
3653
3654/* RFC 8446 4.4.1: After a HelloRetryRequest, ClientHello1 is replaced in
3655 * the transcript by a message_hash message containing its hash. Everything
3656 * in the transcript except the last keep_len bytes (the HelloRetryRequest,
3657 * if it has already been added) is replaced. */
3658static bool_Bool
3659tls_transcript_hello_retry(tls_transcript_t *transcript, int algo, unsigned keep_len)
3660{
3661 uint8_t message_hash[4 + DIGEST_MAX_SIZE48];
3662 uint8_t *keep = NULL((void*)0);
3663 gcry_md_hd_t md;
3664
3665 if (transcript->failed)
3666 return false0;
3667
3668 if (keep_len > 0) {
3669 /* The start of the HelloRetryRequest isn't known after a previous one
3670 * (which isn't allowed anyway.) */
3671 if (transcript->md || keep_len > transcript->buffer.data_len) {
3672 tls_transcript_fail(transcript);
3673 return false0;
3674 }
3675 transcript->buffer.data_len -= keep_len;
3676 keep = transcript->buffer.data + transcript->buffer.data_len;
3677 }
3678
3679 md = tls_transcript_copy(transcript, algo, 0);
3680 if (!md) {
3681 tls_transcript_fail(transcript);
3682 return false0;
3683 }
3684 message_hash[0] = SSL_HND_MESSAGE_HASH;
3685 message_hash[1] = 0;
3686 message_hash[2] = 0;
3687 message_hash[3] = gcry_md_get_algo_dlen(algo);
3688 memcpy(message_hash + 4, gcry_md_read(md, algo), message_hash[3]);
3689 gcry_md_reset(md);
3690 gcry_md_write(md, message_hash, 4 + message_hash[3]);
3691 if (keep_len > 0)
3692 gcry_md_write(md, keep, keep_len);
3693
3694 tls_transcript_reset(transcript);
3695 transcript->md = md;
3696 return true1;
3697}
3698/* Handshake transcript }}} */
3699
3700static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3701{
3702 gcry_md_hd_t md;
3703
3704 md = tls_transcript_copy(&ssl->handshake_transcript, GCRY_MD_MD5, GCRY_MD_SHA1);
3705 if (!md)
3706 return -1;
3707 if (ssl_data_alloc(out, 36) < 0) {
3708 gcry_md_close(md);
3709 return -1;
3710 }
3711 memcpy(out->data, gcry_md_read(md, GCRY_MD_MD5), 16);
3712 memcpy(out->data + 16, gcry_md_read(md, GCRY_MD_SHA1), 20);
3713 gcry_md_close(md);
3714 return 0;
3715}
3716
3717static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3718{
3719 uint8_t tmp[DIGEST_MAX_SIZE48];
3720 unsigned len;
3721
3722 if (!tls_transcript_hash(&ssl->handshake_transcript, md, tmp, &len))
3723 return -1;
3724
3725 if (ssl_data_alloc(out, len) < 0)
3726 return -1;
3727 memcpy(out->data, tmp, len);
3728 return 0;
3729}
3730
3731bool_Bool
3732tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3733{
3734 if (!tls_psk || (tls_psk[0] == 0)) {
3735 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3736 return false0;
3737 }
3738
3739 wmem_free(wmem_file_scope(), tls_session->psk.data);
3740 /* convert hex string into char*/
3741 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3742 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3743 G_STRFUNC((const char*) (__func__)));
3744 return false0;
3745 }
3746
3747 if (tls_session->psk.data_len >= (2 << 15)) {
3748 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3749 G_STRFUNC((const char*) (__func__)));
3750 wmem_free(wmem_file_scope(), tls_session->psk.data);
3751 tls_session->psk.data = NULL((void*)0);
3752 tls_session->psk.data_len = 0;
3753 return false0;
3754 }
3755
3756 return true1;
3757}
3758
3759/**
3760 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3761 * inlined and removed once support for draft 19 and before is dropped.
3762 */
3763static inline const char *
3764tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3765{
3766 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3767 return "TLS 1.3, ";
3768 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3769 return "dtls13";
3770 } else {
3771 return "tls13 ";
3772 }
3773}
3774
3775/*
3776 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3777 * custom label prefix. If "context_hash" is NULL, then an empty context is
3778 * used. Otherwise it must have the same length as the hash algorithm output.
3779 */
3780bool_Bool
3781tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3782 const char *label_prefix, const char *label,
3783 const uint8_t *context_hash, uint8_t context_length,
3784 uint16_t out_len, unsigned char **out)
3785{
3786 /* RFC 8446 Section 7.1:
3787 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3788 * HKDF-Expand(Secret, HkdfLabel, Length)
3789 * struct {
3790 * uint16 length = Length;
3791 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3792 * opaque context<0..255> = Context;
3793 * } HkdfLabel;
3794 *
3795 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3796 * HKDF-Expand(PRK, info, L) -> OKM
3797 */
3798 gcry_error_t err;
3799 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3800 const unsigned label_length = (unsigned) strlen(label);
3801
3802 /* Some sanity checks */
3803 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3803, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3804
3805 /* info = HkdfLabel { length, label, context } */
3806 GByteArray *info = g_byte_array_new();
3807 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3808 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3809
3810 const uint8_t label_vector_length = label_prefix_length + label_length;
3811 g_byte_array_append(info, &label_vector_length, 1);
3812 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3813 g_byte_array_append(info, (const uint8_t*)label, label_length);
3814
3815 g_byte_array_append(info, &context_length, 1);
3816 if (context_length) {
3817 g_byte_array_append(info, context_hash, context_length);
3818 }
3819
3820 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3821 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3822 g_byte_array_free(info, true1);
3823
3824 if (err) {
3825 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3826 wmem_free(NULL((void*)0), *out);
3827 *out = NULL((void*)0);
3828 return false0;
3829 }
3830
3831 return true1;
3832}
3833
3834bool_Bool
3835tls13_hkdf_expand_label(int md, const StringInfo *secret,
3836 const char *label_prefix, const char *label,
3837 uint16_t out_len, unsigned char **out)
3838{
3839 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3840}
3841
3842static bool_Bool
3843tls13_derive_secret(int md, const StringInfo *secret,
3844 const char *label_prefix, const char *label,
3845 const uint8_t *context, unsigned context_length,
3846 uint16_t out_len, unsigned char **out)
3847{
3848 SSL_MDgcry_md_hd_t mc;
3849 uint8_t context_hash[DIGEST_MAX_SIZE48];
3850 unsigned hash_len;
3851
3852 if (ssl_md_init(&mc, md) != 0)
3853 return false0;
3854 ssl_md_update(&mc, context, context_length);
3855 ssl_md_final(&mc, context_hash, &hash_len);
3856 ssl_md_cleanup(&mc);
3857
3858 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3859}
3860
3861/* HMAC and the Pseudorandom function }}} */
3862
3863/* Record Decompression (after decryption) {{{ */
3864#ifdef USE_ZLIB_OR_ZLIBNG
3865/* memory allocation functions for zlib initialization */
3866static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3867{
3868 return g_malloc0(no*size);
3869}
3870static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3871{
3872 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3873}
3874#endif /* USE_ZLIB_OR_ZLIBNG */
3875
3876static SslDecompress*
3877ssl_create_decompressor(int compression)
3878{
3879 SslDecompress *decomp;
3880#ifdef USE_ZLIB_OR_ZLIBNG
3881 int err;
3882#endif
3883
3884 if (compression == 0) return NULL((void*)0);
3885 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3886 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3887 decomp->compression = compression;
3888 switch (decomp->compression) {
3889#ifdef USE_ZLIB_OR_ZLIBNG
3890 case 1: /* DEFLATE */
3891 decomp->istream.zalloc = ssl_zalloc;
3892 decomp->istream.zfree = ssl_zfree;
3893 decomp->istream.opaque = Z_NULL0;
3894 decomp->istream.next_in = Z_NULL0;
3895 decomp->istream.next_out = Z_NULL0;
3896 decomp->istream.avail_in = 0;
3897 decomp->istream.avail_out = 0;
3898 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3899 if (err != Z_OK0) {
3900 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3901 return NULL((void*)0);
3902 }
3903 break;
3904#endif /* USE_ZLIB_OR_ZLIBNG */
3905 default:
3906 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3907 return NULL((void*)0);
3908 }
3909 return decomp;
3910}
3911
3912#ifdef USE_ZLIB_OR_ZLIBNG
3913static int
3914ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3915{
3916 int err;
3917
3918 switch (decomp->compression) {
3919 case 1: /* DEFLATE */
3920 err = Z_OK0;
3921 if (out_str->data_len < 16384) { /* maximal plain length */
3922 ssl_data_realloc(out_str, 16384);
3923 }
3924#ifdef z_constconst
3925 decomp->istream.next_in = in;
3926#else
3927DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3928 decomp->istream.next_in = (Bytef *)in;
3929DIAG_ON(cast-qual)clang diagnostic pop
3930#endif
3931 decomp->istream.avail_in = inl;
3932 decomp->istream.next_out = out_str->data;
3933 decomp->istream.avail_out = out_str->data_len;
3934 if (inl > 0)
3935 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3936 if (err != Z_OK0) {
3937 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3938 return -1;
3939 }
3940 *outl = out_str->data_len - decomp->istream.avail_out;
3941 break;
3942 default:
3943 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3944 return -1;
3945 }
3946 return 0;
3947}
3948#else /* USE_ZLIB_OR_ZLIBNG */
3949int
3950ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3951{
3952 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3953 return -1;
3954}
3955#endif /* USE_ZLIB_OR_ZLIBNG */
3956/* Record Decompression (after decryption) }}} */
3957
3958/* Create a new structure to store decrypted chunks. {{{ */
3959static SslFlow*
3960ssl_create_flow(void)
3961{
3962 SslFlow *flow;
3963
3964 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3965 flow->byte_seq = 0;
3966 flow->flags = 0;
3967 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3968 return flow;
3969}
3970/* }}} */
3971
3972/* Use the negotiated security parameters for decryption. {{{ */
3973void
3974ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3975{
3976 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3977 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3978 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3979 *new_decoder ? "" : " (No decoder found - retransmission?)");
3980 if (*new_decoder) {
3981 *dest = *new_decoder;
3982 *new_decoder = NULL((void*)0);
3983 }
3984}
3985/* }}} */
3986
3987/* Init cipher state given some security parameters. {{{ */
3988static bool_Bool
3989ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3990
3991static SslDecoder*
3992ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3993 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3994{
3995 SslDecoder *dec;
3996 ssl_cipher_mode_t mode = cipher_suite->mode;
3997
3998 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3999 /* init mac buffer: mac storage is embedded into decoder struct to save a
4000 memory allocation and waste samo more memory*/
4001 dec->cipher_suite=cipher_suite;
4002 dec->compression = compression;
4003 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4004 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4005 // the special case for NULL ciphers, even if there is insufficiency
4006 // keying material (including MAC key), we will can still create
4007 // decoders since "decryption" is easy for such ciphers.
4008 dec->mac_key.data = dec->_mac_key_or_write_iv;
4009 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4010 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4011 // Input for the nonce, to be used with AEAD ciphers.
4012 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4012, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
4013 dec->write_iv.data = dec->_mac_key_or_write_iv;
4014 ssl_data_set(&dec->write_iv, iv, iv_length);
4015 }
4016 dec->seq = 0;
4017 dec->decomp = ssl_create_decompressor(compression);
4018 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4019
4020 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4021 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4022 cipher_algo, cipher_suite->mode);
4023 return NULL((void*)0);
4024 }
4025
4026 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4027 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4028 mode = MODE_ECB;
4029 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4030 mode = MODE_STREAM;
4031 } else {
4032 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4033 return NULL((void*)0);
4034 }
4035
4036 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4037 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4038 cipher_algo, MODE_ECB);
4039 ssl_cipher_cleanup(&dec->evp);
4040 dec->evp = NULL((void*)0);
4041 return NULL((void*)0);
4042 }
4043 } else {
4044 dec->sn_evp = NULL((void*)0);
4045 }
4046
4047 dec->dtls13_aad.data = NULL((void*)0);
4048 dec->dtls13_aad.data_len = 0;
4049 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4050 return dec;
4051}
4052
4053static bool_Bool
4054ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4055{
4056 SslDecoder *dec = (SslDecoder *) user_data;
4057
4058 if (dec->evp)
4059 ssl_cipher_cleanup(&dec->evp);
4060 if (dec->sn_evp)
4061 ssl_cipher_cleanup(&dec->sn_evp);
4062
4063#ifdef USE_ZLIB_OR_ZLIBNG
4064 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4065 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4066#endif
4067
4068 return false0;
4069}
4070/* }}} */
4071
4072/* (Pre-)master secrets calculations {{{ */
4073#ifdef HAVE_LIBGNUTLS1
4074static bool_Bool
4075ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4076 StringInfo *encrypted_pre_master,
4077 GHashTable *key_hash);
4078#endif /* HAVE_LIBGNUTLS */
4079
4080static bool_Bool
4081ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4082 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4083
4084bool_Bool
4085ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4086 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4087 const char *ssl_psk, packet_info *pinfo,
4088#ifdef HAVE_LIBGNUTLS1
4089 GHashTable *key_hash,
4090#endif
4091 const ssl_master_key_map_t *mk_map)
4092{
4093 /* check for required session data */
4094 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4095 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4096 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4097 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4098 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4099 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4100 return false0;
4101 }
4102
4103 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4104 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4105 return false0;
4106 }
4107
4108 /* check to see if the PMS was provided to us*/
4109 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4110 mk_map->pms, &ssl_session->client_random)) {
4111 return true1;
4112 }
4113
4114 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4115 {
4116 /* calculate pre master secret*/
4117 StringInfo pre_master_secret;
4118 unsigned psk_len, pre_master_len;
4119
4120 if (!tls_load_psk(ssl_session, ssl_psk)) {
4121 return false0;
4122 }
4123 psk_len = ssl_session->psk.data_len;
4124
4125 pre_master_len = psk_len * 2 + 4;
4126
4127 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4128 pre_master_secret.data_len = pre_master_len;
4129 /* 2 bytes psk_len*/
4130 pre_master_secret.data[0] = psk_len >> 8;
4131 pre_master_secret.data[1] = psk_len & 0xFF;
4132 /* psk_len bytes times 0*/
4133 memset(&pre_master_secret.data[2], 0, psk_len);
4134 /* 2 bytes psk_len*/
4135 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4136 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4137 /* psk*/
4138 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4139
4140 ssl_session->pre_master_secret.data = pre_master_secret.data;
4141 ssl_session->pre_master_secret.data_len = pre_master_len;
4142 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4143
4144 /* Remove the master secret if it was there.
4145 This forces keying material regeneration in
4146 case we're renegotiating */
4147 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4148 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4149 return true1;
4150 }
4151 else
4152 {
4153 unsigned encrlen, skip;
4154 encrlen = length;
4155 skip = 0;
4156
4157 /* get encrypted data, on tls1 we have to skip two bytes
4158 * (it's the encrypted len and should be equal to record len - 2)
4159 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4160 */
4161 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4162 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4163 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4164 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4165 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4166 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4167 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4168 {
4169 encrlen = tvb_get_ntohs(tvb, offset);
4170 skip = 2;
4171 if (encrlen > length - 2)
4172 {
4173 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4174 G_STRFUNC((const char*) (__func__)), encrlen, length);
4175 return false0;
4176 }
4177 }
4178 /* the valid lower bound is higher than 8, but it is sufficient for the
4179 * ssl keylog file below */
4180 if (encrlen < 8) {
4181 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4182 G_STRFUNC((const char*) (__func__)), encrlen);
4183 return false0;
4184 }
4185
4186 StringInfo encrypted_pre_master = {
4187 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4188 .data_len = encrlen,
4189 };
4190
4191#ifdef HAVE_LIBGNUTLS1
4192 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4193 if (ssl_session->cert_key_id) {
4194 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4195 return true1;
4196
4197 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4198 G_STRFUNC((const char*) (__func__)));
4199 }
4200#endif /* HAVE_LIBGNUTLS */
4201
4202 /* try to find the pre-master secret from the encrypted one. The
4203 * ssl key logfile stores only the first 8 bytes, so truncate it */
4204 encrypted_pre_master.data_len = 8;
4205 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4206 true1, mk_map->pre_master, &encrypted_pre_master))
4207 return true1;
4208 }
4209 return false0;
4210}
4211
4212/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4213int
4214ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4215{
4216 StringInfo key_block = { NULL((void*)0), 0 };
4217 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4218 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4219 int needed;
4220 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4221 unsigned encr_key_len, write_iv_len = 0;
4222 bool_Bool is_export_cipher;
4223 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4224 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4225 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4226
4227 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4228 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4229 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4230 return -1;
4231 }
4232
4233 /* check for enough info to proceed */
4234 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4235 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4236 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4237 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4238 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4239 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4240 /* Special case: for NULL encryption, allow dissection of data even if
4241 * the Client Hello is missing (MAC keys are now skipped though). */
4242 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4243 if ((ssl_session->state & need_all) == need_all &&
4244 cipher_suite->enc == ENC_NULL0x3D) {
4245 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4246 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4247 goto create_decoders;
4248 }
4249
4250 return -1;
4251 }
4252
4253 /* if master key is not available, generate is from the pre-master secret */
4254 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
4255 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
4256 StringInfo handshake_hashed_data;
4257 int ret;
4258
4259 handshake_hashed_data.data = NULL((void*)0);
4260 handshake_hashed_data.data_len = 0;
4261
4262 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4263 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4264
4265 switch(ssl_session->session.version) {
4266 case TLSV1_VERSION0x301:
4267 case TLSV1DOT1_VERSION0x302:
4268 case DTLSV1DOT0_VERSION0xfeff:
4269 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4270 case TLCPV1_VERSION0x101:
4271 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
4272 break;
4273 default:
4274 switch (cipher_suite->dig) {
4275 case DIG_SHA3840x43:
4276 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4277 break;
4278 default:
4279 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4280 break;
4281 }
4282 break;
4283 }
4284 if (ret) {
4285 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
4286 return -1;
4287 }
4288
4289 tls_transcript_reset(&ssl_session->handshake_transcript);
4290
4291 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4292 &handshake_hashed_data,
4293 NULL((void*)0), &ssl_session->master_secret,
4294 SSL_MASTER_SECRET_LENGTH48)) {
4295 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4296 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4297 return -1;
4298 }
4299 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4300 } else {
4301 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4302 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4303 ssl_print_string("client random",&ssl_session->client_random);
4304 ssl_print_string("server random",&ssl_session->server_random);
4305 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4306 &ssl_session->client_random,
4307 &ssl_session->server_random, &ssl_session->master_secret,
4308 SSL_MASTER_SECRET_LENGTH48)) {
4309 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4310 return -1;
4311 }
4312 }
4313 ssl_print_string("master secret",&ssl_session->master_secret);
4314
4315 /* the pre-master secret has been 'consumed' so we must clear it now */
4316 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4317 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4318 }
4319
4320 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4321 if (cipher_suite->enc != ENC_NULL0x3D) {
4322 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4323 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4324 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4325 if (cipher_algo == 0) {
4326 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4327 return -1;
4328 }
4329 }
4330
4331 /* Export ciphers consume less material from the key block. */
4332 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4333 is_export_cipher = encr_key_len > 0;
4334 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4335 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4336 }
4337
4338 if (cipher_suite->mode == MODE_CBC) {
4339 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4340 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4341 /* account for a four-byte salt for client and server side (from
4342 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4343 write_iv_len = 4;
4344 } else if (cipher_suite->mode == MODE_POLY1305) {
4345 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4346 write_iv_len = 12;
4347 }
4348
4349 /* Compute the key block. First figure out how much data we need */
4350 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4351 needed += 2 * encr_key_len; /* encryption key */
4352 needed += 2 * write_iv_len; /* write IV */
4353
4354 key_block.data = (unsigned char *)g_malloc(needed);
4355 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4356 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4357 &ssl_session->server_random,&ssl_session->client_random,
4358 &key_block, needed)) {
4359 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4360 goto fail;
4361 }
4362 ssl_print_string("key expansion", &key_block);
4363
4364 ptr=key_block.data;
4365 /* client/server write MAC key (for non-AEAD ciphers) */
4366 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4367 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4368 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4369 }
4370 /* client/server write encryption key */
4371 c_wk=ptr; ptr += encr_key_len;
4372 s_wk=ptr; ptr += encr_key_len;
4373 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4374 if (write_iv_len > 0) {
4375 c_iv=ptr; ptr += write_iv_len;
4376 s_iv=ptr; /* ptr += write_iv_len; */
4377 }
4378
4379 /* export ciphers work with a smaller key length */
4380 if (is_export_cipher) {
4381 if (cipher_suite->mode == MODE_CBC) {
4382
4383 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4384 all we should need. This is a sanity check */
4385 if (write_iv_len > MAX_BLOCK_SIZE16) {
4386 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4387 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4388 goto fail;
4389 }
4390
4391 if(ssl_session->session.version==SSLV3_VERSION0x300){
4392 /* The length of these fields are ignored by this caller */
4393 StringInfo iv_c, iv_s;
4394 iv_c.data = _iv_c;
4395 iv_s.data = _iv_s;
4396
4397 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4398 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4399 &ssl_session->server_random, &iv_c, write_iv_len)) {
4400 goto fail;
4401 }
4402 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4403 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4404 &ssl_session->client_random, &iv_s, write_iv_len)) {
4405 goto fail;
4406 }
4407 }
4408 else{
4409 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4410 StringInfo iv_block;
4411 StringInfo key_null;
4412 uint8_t _key_null;
4413
4414 key_null.data = &_key_null;
4415 key_null.data_len = 0;
4416
4417 iv_block.data = _iv_block;
4418
4419 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4420 if (!prf(ssl_session, &key_null, "IV block",
4421 &ssl_session->client_random,
4422 &ssl_session->server_random, &iv_block,
4423 write_iv_len * 2)) {
4424 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4425 goto fail;
4426 }
4427
4428 memcpy(_iv_c, iv_block.data, write_iv_len);
4429 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4430 }
4431
4432 c_iv=_iv_c;
4433 s_iv=_iv_s;
4434 }
4435
4436 if (ssl_session->session.version==SSLV3_VERSION0x300){
4437
4438 SSL_MD5_CTXgcry_md_hd_t md5;
4439 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4440
4441 if (ssl_md5_init(&md5) != 0)
4442 goto fail;
4443 ssl_md5_update(&md5,c_wk,encr_key_len);
4444 ssl_md5_update(&md5,ssl_session->client_random.data,
4445 ssl_session->client_random.data_len);
4446 ssl_md5_update(&md5,ssl_session->server_random.data,
4447 ssl_session->server_random.data_len);
4448 ssl_md5_final(_key_c,&md5);
4449 ssl_md5_cleanup(&md5);
4450 c_wk=_key_c;
4451
4452 if (ssl_md5_init(&md5) != 0)
4453 goto fail;
4454 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4455 ssl_md5_update(&md5,s_wk,encr_key_len);
4456 ssl_md5_update(&md5,ssl_session->server_random.data,
4457 ssl_session->server_random.data_len);
4458 ssl_md5_update(&md5,ssl_session->client_random.data,
4459 ssl_session->client_random.data_len);
4460 ssl_md5_final(_key_s,&md5);
4461 ssl_md5_cleanup(&md5);
4462 s_wk=_key_s;
4463 }
4464 else{
4465 StringInfo key_c, key_s, k;
4466 key_c.data = _key_c;
4467 key_s.data = _key_s;
4468
4469 k.data = c_wk;
4470 k.data_len = encr_key_len;
4471 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4472 if (!prf(ssl_session, &k, "client write key",
4473 &ssl_session->client_random,
4474 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4475 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4476 goto fail;
4477 }
4478 c_wk=_key_c;
4479
4480 k.data = s_wk;
4481 k.data_len = encr_key_len;
4482 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4483 if (!prf(ssl_session, &k, "server write key",
4484 &ssl_session->client_random,
4485 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4486 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4487 goto fail;
4488 }
4489 s_wk=_key_s;
4490 }
4491 }
4492
4493 /* show key material info */
4494 if (c_mk != NULL((void*)0)) {
4495 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4496 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4497 }
4498 ssl_print_data("Client Write key", c_wk, encr_key_len);
4499 ssl_print_data("Server Write key", s_wk, encr_key_len);
4500 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4501 if (write_iv_len > 0) {
4502 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4503 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4504 }
4505
4506create_decoders:
4507 /* create both client and server ciphers*/
4508 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4509 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4510 if (!ssl_session->client_new) {
4511 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4512 goto fail;
4513 }
4514 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4515 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4516 if (!ssl_session->server_new) {
4517 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4518 goto fail;
4519 }
4520
4521 /* Continue the SSL stream after renegotiation with new keys. */
4522 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4523 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4524
4525 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4526 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4527 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4528 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4529 return 0;
4530
4531fail:
4532 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4533 return -1;
4534}
4535
4536/* Generated the key material based on the given secret. */
4537bool_Bool
4538tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4539{
4540 bool_Bool success = false0;
4541 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4542 unsigned char *sn_key = NULL((void*)0);
4543 SslDecoder *decoder;
4544 unsigned key_length, iv_length;
4545 int hash_algo;
4546 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4547 int cipher_algo;
4548
4549 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4550 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4551 ssl_session->session.version);
4552 return false0;
4553 }
4554
4555 if (cipher_suite == NULL((void*)0)) {
4556 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4557 return false0;
4558 }
4559
4560 if (cipher_suite->kex != KEX_TLS130x23) {
4561 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4562 return false0;
4563 }
4564
4565 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4566 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4567 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4568 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4569 if (cipher_algo == 0) {
4570 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4571 return false0;
4572 }
4573
4574 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4575 hash_algo = ssl_get_digest_by_name(hash_name);
4576 if (!hash_algo) {
4577 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4578 return false0;
4579 }
4580
4581 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4582 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4583 iv_length = 12;
4584 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4585
4586 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4587 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4588 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4589 return false0;
4590 }
4591 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4592 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4593 goto end;
4594 }
4595
4596 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4597 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4598 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4599 goto end;
4600 }
4601 }
4602
4603 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4604 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4605 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4606 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4607 }
4608
4609 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4610 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4611 if (!decoder) {
4612 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4613 goto end;
4614 }
4615
4616 /* Continue the TLS session with new keys, but reuse old flow to keep things
4617 * like "Follow TLS" working (by linking application data records). */
4618 if (is_from_server) {
4619 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4620 ssl_session->server = decoder;
4621 } else {
4622 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4623 ssl_session->client = decoder;
4624 }
4625 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4626 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4627 success = true1;
4628
4629end:
4630 wmem_free(NULL((void*)0), write_key);
4631 wmem_free(NULL((void*)0), write_iv);
4632 if (sn_key)
4633 wmem_free(NULL((void*)0), sn_key);
4634 return success;
4635}
4636/* (Pre-)master secrets calculations }}} */
4637
4638#ifdef HAVE_LIBGNUTLS1
4639/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4640static bool_Bool
4641ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4642 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4643{
4644 int ret;
4645
4646 if (!encrypted_pre_master)
4647 return false0;
4648
4649 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4650 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4651 "(cipher suite 0x%04X %s) and cannot be decrypted "
4652 "using a RSA private key file.\n",
4653 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4654 val_to_str_ext_const(ssl_session->session.cipher,
4655 &ssl_31_ciphersuite_ext, "unknown"));
4656 return false0;
4657 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4658 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4659 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4660 return false0;
4661 }
4662
4663 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4664
4665 ssl_print_string("pre master encrypted", encrypted_pre_master);
4666 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4667 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4668 gnutls_datum_t pms = { 0 };
4669 if (pk) {
4670 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4671 char *err = NULL((void*)0);
4672 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4673 if (!private_key) {
4674 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4675 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4676 return false0;
4677 }
4678
4679 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4680 rsa_private_key_free(private_key);
4681 if (pms.size == 0) {
4682 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4683 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4684 return false0;
4685 }
4686 } else {
4687 // Try to decrypt using a hardware token.
4688 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4689 if (ret < 0) {
4690 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4691 return false0;
4692 }
4693 }
4694
4695 if (pms.size != 48) {
4696 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4697 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4698 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4699 return false0;
4700 }
4701
4702 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4703 ssl_session->pre_master_secret.data_len = 48;
4704 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4705 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4706
4707 /* Remove the master secret if it was there.
4708 This forces keying material regeneration in
4709 case we're renegotiating */
4710 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4711 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4712 return true1;
4713} /* }}} */
4714#endif /* HAVE_LIBGNUTLS */
4715
4716/* Decryption integrity check {{{ */
4717
4718static int
4719tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4720 uint32_t datalen, uint8_t* mac)
4721{
4722 SSL_HMACgcry_md_hd_t hm;
4723 int md;
4724 uint32_t len;
4725 uint8_t buf[DIGEST_MAX_SIZE48];
4726 int16_t temp;
4727
4728 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4729 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4730 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4731
4732 if (ssl_hmac_init(&hm,md) != 0)
4733 return -1;
4734 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4735 return -1;
4736
4737 /* hash sequence number */
4738 phtonu64(buf, decoder->seq);
4739
4740 decoder->seq++;
4741
4742 ssl_hmac_update(&hm,buf,8);
4743
4744 /* hash content type */
4745 buf[0]=ct;
4746 ssl_hmac_update(&hm,buf,1);
4747
4748 /* hash version,data length and data*/
4749 /* *((int16_t*)buf) = g_htons(ver); */
4750 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4751 memcpy(buf, &temp, 2);
4752 ssl_hmac_update(&hm,buf,2);
4753
4754 /* *((int16_t*)buf) = g_htons(datalen); */
4755 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4756 memcpy(buf, &temp, 2);
4757 ssl_hmac_update(&hm,buf,2);
4758 ssl_hmac_update(&hm,data,datalen);
4759
4760 /* get digest and digest len*/
4761 len = sizeof(buf);
4762 ssl_hmac_final(&hm,buf,&len);
4763 ssl_hmac_cleanup(&hm);
4764 ssl_print_data("Mac", buf, len);
4765 if(memcmp(mac,buf,len))
4766 return -1;
4767
4768 return 0;
4769}
4770
4771static int
4772ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4773 uint32_t datalen, uint8_t* mac)
4774{
4775 SSL_MDgcry_md_hd_t mc;
4776 int md;
4777 uint32_t len;
4778 uint8_t buf[64],dgst[20];
4779 int pad_ct;
4780 int16_t temp;
4781
4782 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4783
4784 /* get cipher used for digest computation */
4785 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4786 if (ssl_md_init(&mc,md) !=0)
4787 return -1;
4788
4789 /* do hash computation on data && padding */
4790 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4791
4792 /* hash padding*/
4793 memset(buf,0x36,pad_ct);
4794 ssl_md_update(&mc,buf,pad_ct);
4795
4796 /* hash sequence number */
4797 phtonu64(buf, decoder->seq);
4798 decoder->seq++;
4799 ssl_md_update(&mc,buf,8);
4800
4801 /* hash content type */
4802 buf[0]=ct;
4803 ssl_md_update(&mc,buf,1);
4804
4805 /* hash data length in network byte order and data*/
4806 /* *((int16_t* )buf) = g_htons(datalen); */
4807 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4808 memcpy(buf, &temp, 2);
4809 ssl_md_update(&mc,buf,2);
4810 ssl_md_update(&mc,data,datalen);
4811
4812 /* get partial digest */
4813 ssl_md_final(&mc,dgst,&len);
4814 ssl_md_reset(&mc);
4815
4816 /* hash mac key */
4817 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4818
4819 /* hash padding and partial digest*/
4820 memset(buf,0x5c,pad_ct);
4821 ssl_md_update(&mc,buf,pad_ct);
4822 ssl_md_update(&mc,dgst,len);
4823
4824 ssl_md_final(&mc,dgst,&len);
4825 ssl_md_cleanup(&mc);
4826
4827 if(memcmp(mac,dgst,len))
4828 return -1;
4829
4830 return 0;
4831}
4832
4833static int
4834dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4835 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4836{
4837 SSL_HMACgcry_md_hd_t hm;
4838 int md;
4839 uint32_t len;
4840 uint8_t buf[DIGEST_MAX_SIZE48];
4841 int16_t temp;
4842
4843 int ver = ssl->session.version;
4844 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4845
4846 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4847 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4848 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4849
4850 if (ssl_hmac_init(&hm,md) != 0)
4851 return -1;
4852 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4853 return -1;
4854
4855 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4856
4857 if (is_cid && !ssl->session.deprecated_cid) {
4858 /* hash seq num placeholder */
4859 memset(buf,0xFF,8);
4860 ssl_hmac_update(&hm,buf,8);
4861
4862 /* hash content type + cid length + content type */
4863 buf[0]=ct;
4864 buf[1]=cidl;
4865 buf[2]=ct;
4866 ssl_hmac_update(&hm,buf,3);
4867
4868 /* hash version */
4869 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4870 memcpy(buf, &temp, 2);
4871 ssl_hmac_update(&hm,buf,2);
4872
4873 /* hash sequence number */
4874 phtonu64(buf, decoder->seq);
4875 buf[0]=decoder->epoch>>8;
4876 buf[1]=(uint8_t)decoder->epoch;
4877 ssl_hmac_update(&hm,buf,8);
4878
4879 /* hash cid */
4880 ssl_hmac_update(&hm,cid,cidl);
4881 } else {
4882 /* hash sequence number */
4883 phtonu64(buf, decoder->seq);
4884 buf[0]=decoder->epoch>>8;
4885 buf[1]=(uint8_t)decoder->epoch;
4886 ssl_hmac_update(&hm,buf,8);
4887
4888 /* hash content type */
4889 buf[0]=ct;
4890 ssl_hmac_update(&hm,buf,1);
4891
4892 /* hash version */
4893 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4894 memcpy(buf, &temp, 2);
4895 ssl_hmac_update(&hm,buf,2);
4896
4897 if (is_cid && ssl->session.deprecated_cid) {
4898 /* hash cid */
4899 ssl_hmac_update(&hm,cid,cidl);
4900
4901 /* hash cid length */
4902 buf[0] = cidl;
4903 ssl_hmac_update(&hm,buf,1);
4904 }
4905 }
4906
4907 /* data length and data */
4908 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4909 memcpy(buf, &temp, 2);
4910 ssl_hmac_update(&hm,buf,2);
4911 ssl_hmac_update(&hm,data,datalen);
4912
4913 /* get digest and digest len */
4914 len = sizeof(buf);
4915 ssl_hmac_final(&hm,buf,&len);
4916 ssl_hmac_cleanup(&hm);
4917 ssl_print_data("Mac", buf, len);
4918 if(memcmp(mac,buf,len))
4919 return -1;
4920
4921 return 0;
4922}
4923/* Decryption integrity check }}} */
4924
4925
4926static bool_Bool
4927tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4928 uint8_t ct, uint16_t record_version,
4929 bool_Bool ignore_mac_failed,
4930 const unsigned char *in, uint16_t inl,
4931 const unsigned char *cid, uint8_t cidl,
4932 StringInfo *out_str, unsigned *outl)
4933{
4934 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4935 * GenericAEADCipher: { nonce_explicit, [content] }
4936 * In TLS 1.3 this explicit nonce is gone.
4937 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4938 * ciphertext and authentication tag.
4939 */
4940 const uint16_t version = ssl->session.version;
4941 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4942 gcry_error_t err;
4943 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4944 unsigned ciphertext_len, auth_tag_len;
4945 unsigned char nonce[12];
4946 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4947 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4948 const uint8_t draft_version = ssl->session.tls13_draft_version;
4949 const unsigned char *auth_tag_wire;
4950 unsigned char auth_tag_calc[16];
4951 unsigned char *aad = NULL((void*)0);
4952 unsigned aad_len = 0;
4953
4954 switch (cipher_mode) {
4955 case MODE_GCM:
4956 case MODE_CCM:
4957 case MODE_POLY1305:
4958 auth_tag_len = 16;
4959 break;
4960 case MODE_CCM_8:
4961 auth_tag_len = 8;
4962 break;
4963 default:
4964 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4965 return false0;
4966 }
4967
4968 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4969 if (is_v12 && cipher_mode != MODE_POLY1305) {
4970 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4971 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4972 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4973 return false0;
4974 }
4975 explicit_nonce = in;
4976 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4977 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4978 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4979 if (inl < auth_tag_len) {
4980 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4981 return false0;
4982 }
4983 ciphertext = in;
4984 ciphertext_len = inl - auth_tag_len;
4985 } else {
4986 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4987 return false0;
4988 }
4989 auth_tag_wire = ciphertext + ciphertext_len;
4990
4991 /*
4992 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4993 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4994 */
4995 if (is_v12 && cipher_mode != MODE_POLY1305) {
4996 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4996, "decoder->write_iv.data_len == 4"))));
4997 /* Implicit (4) and explicit (8) part of nonce. */
4998 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4999 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
5000
5001 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5002 /*
5003 * Technically the nonce length must be at least 8 bytes, but for
5004 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5005 */
5006 const unsigned nonce_len = 12;
5007 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5007, "decoder->write_iv.data_len == nonce_len"
))));
5008 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5009 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5010 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
5011 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5012 }
5013
5014 /* Set nonce and additional authentication data */
5015 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
5016 ssl_print_data("nonce", nonce, 12);
5017 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5018 if (err) {
5019 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5020 return false0;
5021 }
5022
5023 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5024 if (is_cid) { /* if connection ID */
5025 if (ssl->session.deprecated_cid) {
5026 aad_len = 14 + cidl;
5027 aad = wmem_alloc(allocator, aad_len);
5028 phtonu64(aad, decoder->seq); /* record sequence number */
5029 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5030 aad[8] = ct; /* TLSCompressed.type */
5031 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5032 memcpy(aad + 11, cid, cidl); /* cid */
5033 aad[11 + cidl] = cidl; /* cid_length */
5034 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5035 } else {
5036 aad_len = 23 + cidl;
5037 aad = wmem_alloc(allocator, aad_len);
5038 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5039 aad[8] = ct; /* TLSCompressed.type */
5040 aad[9] = cidl; /* cid_length */
5041 aad[10] = ct; /* TLSCompressed.type */
5042 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
5043 phtonu64(aad + 13, decoder->seq); /* record sequence number */
5044 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5045 memcpy(aad + 21, cid, cidl); /* cid */
5046 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5047 }
5048 } else if (is_v12) {
5049 aad_len = 13;
5050 aad = wmem_alloc(allocator, aad_len);
5051 phtonu64(aad, decoder->seq); /* record sequence number */
5052 if (version == DTLSV1DOT2_VERSION0xfefd) {
5053 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5054 }
5055 aad[8] = ct; /* TLSCompressed.type */
5056 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5057 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5058 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5059 aad_len = decoder->dtls13_aad.data_len;
5060 aad = decoder->dtls13_aad.data;
5061 } else if (draft_version >= 25 || draft_version == 0) {
5062 aad_len = 5;
5063 aad = wmem_alloc(allocator, aad_len);
5064 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5065 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5066 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
5067 }
5068
5069 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5070 /* size of plaintext, additional authenticated data and auth tag. */
5071 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5072
5073 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5074 }
5075
5076 if (aad && aad_len > 0) {
5077 ssl_print_data("AAD", aad, aad_len);
5078 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5079 if (err) {
5080 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5081 return false0;
5082 }
5083 }
5084
5085 /* Decrypt now that nonce and AAD are set. */
5086 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5087 if (err) {
5088 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5089 return false0;
5090 }
5091
5092 /* Check authentication tag for authenticity (replaces MAC) */
5093 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5094 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5095 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5096 } else {
5097 if (err) {
5098 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5099 } else {
5100 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5101 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5102 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5103 }
5104 if (ignore_mac_failed) {
5105 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5106 } else {
5107 return false0;
5108 }
5109 }
5110
5111 /*
5112 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5113 * after successful authentication to ensure that early data is skipped when
5114 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5115 */
5116 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5117 decoder->seq++;
5118 }
5119
5120 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5121 *outl = ciphertext_len;
5122 return true1;
5123}
5124
5125/* Record decryption glue based on security parameters {{{ */
5126/* Assume that we are called only for a non-NULL decoder which also means that
5127 * we have a non-NULL decoder->cipher_suite. */
5128int
5129ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5130 bool_Bool ignore_mac_failed,
5131 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5132 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5133{
5134 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5135 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5136
5137 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5138 ssl_print_data("Ciphertext",in, inl);
5139
5140 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5141 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5142 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5143 return -1;
5144 }
5145
5146 /* ensure we have enough storage space for decrypted data */
5147 if (inl > out_str->data_len)
5148 {
5149 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5150 inl + 32, out_str->data_len);
5151 ssl_data_realloc(out_str, inl + 32);
5152 }
5153
5154 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5155 * a separate MAC, so use a different routine for simplicity. */
5156 if (decoder->cipher_suite->mode == MODE_GCM ||
5157 decoder->cipher_suite->mode == MODE_CCM ||
5158 decoder->cipher_suite->mode == MODE_CCM_8 ||
5159 decoder->cipher_suite->mode == MODE_POLY1305 ||
5160 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5161 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5162
5163 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5164 /* decryption failed */
5165 return -1;
5166 }
5167
5168 goto skip_mac;
5169 }
5170
5171 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5172 * (notation: { unencrypted, [ encrypted ] })
5173 * GenericStreamCipher: { [content, mac] }
5174 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5175 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5176 * GenericAEADCipher: { nonce_explicit, [content] }
5177 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5178 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5179 */
5180
5181 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5182
5183 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5184 if (decoder->cipher_suite->mode == MODE_CBC) {
5185 unsigned blocksize = 0;
5186
5187 switch (ssl->session.version) {
5188 case TLSV1DOT1_VERSION0x302:
5189 case TLSV1DOT2_VERSION0x303:
5190 case DTLSV1DOT0_VERSION0xfeff:
5191 case DTLSV1DOT2_VERSION0xfefd:
5192 case DTLSV1DOT3_VERSION0xfefc:
5193 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5194 case TLCPV1_VERSION0x101:
5195 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5196 if (inl < blocksize) {
5197 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5198 inl, blocksize);
5199 return -1;
5200 }
5201 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5202 if (pad != 0) {
5203 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5204 gcry_strsource (pad), gcry_strerror (pad));
5205 }
5206
5207 inl -= blocksize;
5208 in += blocksize;
5209 break;
5210 }
5211
5212 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5213 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5214 /*
5215 * MAC is calculated over (IV + ) ENCRYPTED contents:
5216 *
5217 * MAC(MAC_write_key, ... +
5218 * IV + // for TLS 1.1 or greater
5219 * TLSCiphertext.enc_content);
5220 */
5221 if (inl < maclen) {
5222 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5223 G_STRFUNC((const char*) (__func__)), inl, maclen);
5224 return -1;
5225 }
5226 inl -= maclen;
5227 mac = (uint8_t *)in + inl;
5228 mac_frag = (uint8_t *)in - blocksize;
5229 mac_fraglen = blocksize + inl;
5230 }
5231 }
5232
5233 /* First decrypt*/
5234 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5235 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5236 gcry_strerror (pad));
5237 return -1;
5238 }
5239
5240 ssl_print_data("Plaintext", out_str->data, inl);
5241 worklen=inl;
5242
5243
5244 /* strip padding for GenericBlockCipher */
5245 if (decoder->cipher_suite->mode == MODE_CBC) {
5246 if (inl < 1) { /* Should this check happen earlier? */
5247 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5248 return -1;
5249 }
5250 pad=out_str->data[inl-1];
5251 if (worklen <= pad) {
5252 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5253 pad, worklen);
5254 return -1;
5255 }
5256 worklen-=(pad+1);
5257 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5258 pad, worklen);
5259 }
5260
5261 /* MAC for GenericStreamCipher and GenericBlockCipher.
5262 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5263 if (!mac) {
5264 /*
5265 * MAC is calculated over the DECRYPTED contents:
5266 *
5267 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5268 */
5269 if (worklen < maclen) {
5270 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5271 return -1;
5272 }
5273 worklen -= maclen;
5274 mac = out_str->data + worklen;
5275 mac_frag = out_str->data;
5276 mac_fraglen = worklen;
5277 }
5278
5279 /* If NULL encryption active and no keys are available, do not bother
5280 * checking the MAC. We do not have keys for that. */
5281 if (decoder->cipher_suite->mode == MODE_STREAM &&
5282 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5283 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5284 ssl_debug_printf("MAC check skipped due to missing keys\n");
5285 decoder->seq++; // Increment this for display
5286 goto skip_mac;
5287 }
5288
5289 /* Now check the MAC */
5290 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5291 worklen, ssl->session.version, ct, decoder->seq);
5292 if(ssl->session.version==SSLV3_VERSION0x300){
5293 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5294 if(ignore_mac_failed) {
5295 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5296 }
5297 else{
5298 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5299 return -1;
5300 }
5301 }
5302 else{
5303 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5304 }
5305 }
5306 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5307 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5308 if(ignore_mac_failed) {
5309 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5310 }
5311 else{
5312 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5313 return -1;
5314 }
5315 }
5316 else{
5317 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5318 }
5319 }
5320 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5321 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5322 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5323 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5324 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5325 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5326 }
5327 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5328 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5329 }
5330 else if(ignore_mac_failed) {
5331 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5332 }
5333 else{
5334 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5335 return -1;
5336 }
5337 }
5338skip_mac:
5339
5340 *outl = worklen;
5341
5342 if (decoder->compression > 0) {
5343 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5344 ssl_data_copy(comp_str, out_str);
5345 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5346 if (!decoder->decomp) {
5347 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5348 return -1;
5349 }
5350 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5351 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5352 *outl = uncomplen;
5353 }
5354
5355 return 0;
5356}
5357/* Record decryption glue based on security parameters }}} */
5358
5359
5360
5361#ifdef HAVE_LIBGNUTLS1
5362
5363/* RSA private key file processing {{{ */
5364static void
5365ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5366 const gnutls_datum_t *subjectPublicKeyInfo)
5367{
5368 gnutls_pubkey_t pubkey = NULL((void*)0);
5369 cert_key_id_t key_id;
5370 size_t key_id_len = sizeof(key_id);
5371 int r;
5372
5373 if (!subjectPublicKeyInfo->size) {
5374 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5375 return;
5376 }
5377
5378 r = gnutls_pubkey_init(&pubkey);
5379 if (r < 0) {
5380 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5381 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5382 return;
5383 }
5384
5385 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5386 if (r < 0) {
5387 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5388 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5389 goto end;
5390 }
5391
5392 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5393 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5394 goto end;
5395 }
5396
5397 /* Generate a 20-byte SHA-1 hash. */
5398 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5399 if (r < 0) {
5400 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5401 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5402 goto end;
5403 }
5404
5405 if (key_id_len != sizeof(key_id)) {
5406 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5407 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5408 goto end;
5409 }
5410
5411 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5412 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5413 *ssl->cert_key_id = key_id;
5414
5415end:
5416 gnutls_pubkey_deinit(pubkey);
5417}
5418
5419/* RSA private key file processing }}} */
5420#endif /* HAVE_LIBGNUTLS */
5421
5422/*--- Start of dissector-related code below ---*/
5423
5424/* This is not a "protocol" but ensures that this gets called during
5425 * the handoff stage. */
5426void proto_reg_handoff_tls_utils(void);
5427
5428static dissector_handle_t base_tls_handle;
5429static dissector_handle_t dtls_handle;
5430
5431void
5432proto_reg_handoff_tls_utils(void)
5433{
5434 base_tls_handle = find_dissector("tls");
5435 dtls_handle = find_dissector("dtls");
5436}
5437
5438/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5439 * no session exists. */
5440SslDecryptSession *
5441tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5442{
5443 void *conv_data;
5444 wmem_map_t *session_map;
5445
5446 if (!conversation)
5447 return NULL((void*)0);
5448
5449 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5450 if (conv_data == NULL((void*)0))
5451 return NULL((void*)0);
5452
5453 session_map = (wmem_map_t *)conv_data;
5454
5455 return (SslDecryptSession *)wmem_map_lookup(session_map,
5456 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5457
5458}
5459
5460static bool_Bool
5461ssl_session_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
5462{
5463 SslDecryptSession *ssl_session = (SslDecryptSession *) user_data;
5464
5465 tls_transcript_close(&ssl_session->handshake_transcript);
5466 tls_transcript_close(&ssl_session->ech_transcript);
5467
5468 return false0;
5469}
5470
5471/* get ssl data for this session. if no ssl data is found allocate a new one*/
5472SslDecryptSession *
5473ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5474{
5475 void *conv_data;
5476 SslDecryptSession *ssl_session;
5477 int proto_ssl;
5478 wmem_map_t *session_map;
5479
5480 /* Note proto_ssl is tls for either the main tls_handle or the
5481 * tls13_handshake handle used by QUIC. */
5482 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5483 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5484
5485 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5486 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5487 * preventing memory leaks on capture reload. */
5488 if (conv_data != NULL((void*)0)) {
5489 session_map = (wmem_map_t *)conv_data;
5490 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5491 if (ssl_session != NULL((void*)0)) {
5492 return ssl_session;
5493 }
5494 } else {
5495 /* Create a new wmem map to store sessions by layer number */
5496 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5497 conversation_add_proto_data(conversation, proto_ssl, session_map);
5498 }
5499
5500 /* no previous SSL conversation info for this layer, initialize it. */
5501 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5502
5503 /* data_len is the part that is meaningful, not the allocated length */
5504 ssl_session->master_secret.data_len = 0;
5505 ssl_session->master_secret.data = ssl_session->_master_secret;
5506 ssl_session->session_id.data_len = 0;
5507 ssl_session->session_id.data = ssl_session->_session_id;
5508 ssl_session->client_random.data_len = 0;
5509 ssl_session->client_random.data = ssl_session->_client_random;
5510 ssl_session->server_random.data_len = 0;
5511 ssl_session->server_random.data = ssl_session->_server_random;
5512 ssl_session->session_ticket.data_len = 0;
5513 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5514 ssl_session->server_data_for_iv.data_len = 0;
5515 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5516 ssl_session->client_data_for_iv.data_len = 0;
5517 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5518 ssl_session->app_data_segment.data = NULL((void*)0);
5519 ssl_session->app_data_segment.data_len = 0;
5520 /* The transcripts were zeroed by wmem_new0. */
5521 wmem_register_callback(wmem_file_scope(), ssl_session_destroy_cb, ssl_session);
5522
5523 /* Initialize parameters which are not necessary specific to decryption. */
5524 ssl_session->session.version = SSL_VER_UNKNOWN0;
5525 clear_address(&ssl_session->session.srv_addr);
5526 ssl_session->session.srv_ptype = PT_NONE;
5527 ssl_session->session.srv_port = 0;
5528 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5529 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5530 ssl_session->session.client_random.data_len = 0;
5531 ssl_session->session.client_random.data = ssl_session->session._client_random;
5532 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5533 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5534 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5535 ssl_session->session.ech = false0;
5536 ssl_session->session.hrr_ech_declined = false0;
5537 ssl_session->session.first_ch_ech_frame = 0;
5538
5539 /* We want to increment the stream count for the normal tls handle and
5540 * dtls handle, but presumably not for the tls13_handshake handle used
5541 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5542 * doesn't get sent to the TLS follow tap.)
5543 */
5544 if (tls_handle == base_tls_handle) {
5545 ssl_session->session.stream = tls_increment_stream_count();
5546 } else if (tls_handle == dtls_handle) {
5547 ssl_session->session.stream = dtls_increment_stream_count();
5548 }
5549
5550 /* Store the session in the wmem map indexed by layer number */
5551 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5552
5553 return ssl_session;
5554}
5555
5556void
5557tls_check_client_hello_random(SslDecryptSession *ssl, tvbuff_t *tvb, uint32_t offset)
5558{
5559 /* RFC 8446 4.1.2: After a HelloRetryRequest, the client sends the same
5560 * ClientHello with only certain changes, which don't include the random.
5561 * A different random means this is a new handshake, e.g. a new connection
5562 * reusing the addresses and ports with the TCP handshake missing. */
5563 if (!ssl || !tvb_bytes_exist(tvb, offset + 2, 32))
5564 return;
5565
5566 if ((ssl->state & SSL_HELLO_RETRY_REQUEST(1<<14)) &&
5567 tvb_memeql(tvb, offset + 2, ssl->last_client_hello_random, 32) != 0) {
5568 ssl_debug_printf("%s ClientHello after a HelloRetryRequest has a new random, assuming a new handshake\n", G_STRFUNC((const char*) (__func__)));
5569 ssl->state &= ~SSL_HELLO_RETRY_REQUEST(1<<14);
5570 }
5571 tvb_memcpy(tvb, ssl->last_client_hello_random, offset + 2, 32);
5572}
5573
5574void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5575{
5576 /* TLS 1.3 forbids renegotiation (and the version cannot change upon
5577 * renegotiation, in particular TLS 1.3 MUST NOT be [re]negotiated if a
5578 * prior version was negotiated.) However, we can get here in valid TLS
5579 * 1.3 for ClientHello or ServerHello following a HelloRetryRequest.
5580 */
5581 if (ssl) {
5582 /* Ensure that secrets are not restored using stale identifiers. Split
5583 * between client and server in case the packets somehow got out of order. */
5584 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5585
5586 if (is_client) {
5587 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5588 ssl->session_id.data_len = 0;
5589 ssl->session_ticket.data_len = 0;
5590 ssl->master_secret.data_len = 0;
5591 ssl->client_random.data_len = 0;
5592 ssl->has_early_data = false0;
5593 if (!(ssl->state & SSL_HELLO_RETRY_REQUEST(1<<14))) {
5594 // The transcript starts with the Client Hello, ensure that
5595 // any messages before it are forgotten. After a Hello Retry
5596 // Request, the transcript continues with ClientHello2 (see
5597 // tls_check_client_hello_random.)
5598 tls_transcript_reset(&ssl->handshake_transcript);
5599 tls_transcript_reset(&ssl->ech_transcript);
5600 }
5601 } else {
5602 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5603 ssl->server_random.data_len = 0;
5604 ssl->pre_master_secret.data_len = 0;
5605#ifdef HAVE_LIBGNUTLS1
5606 ssl->cert_key_id = NULL((void*)0);
5607#endif
5608 ssl->has_psk = false0;
5609 ssl->has_key_share = false0;
5610 // There is no point in clearing the PSK when resetting the session,
5611 // we only store one global PSK in the prefs.
5612 //ssl->psk.data_len = 0;
5613 }
5614
5615 if (ssl->state & clear_flags) {
5616 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5617 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5618 ssl->state &= ~clear_flags;
5619 }
5620 }
5621
5622 /* These flags might be used for non-decryption purposes and may affect the
5623 * dissection, so reset them as well. */
5624 if (is_client) {
5625 session->client_cert_type = 0;
5626 } else {
5627 session->compression = 0;
5628 session->server_cert_type = 0;
5629 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5630 }
5631 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5632 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5633}
5634
5635void
5636tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5637 dissector_handle_t app_handle)
5638{
5639 conversation_t *conversation;
5640 SslSession *session;
5641
5642 /* Ignore if the TLS or other dissector is disabled. */
5643 /* XXX - find_dissector still works if a dissector is disabled,
5644 * this would be if the dissector isn't registered at all or the
5645 * caller is calling this with explicit NULL. */
5646 if (!tls_handle || !app_handle)
5647 return;
5648
5649 int proto = dissector_handle_get_protocol_index(tls_handle);
5650 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5651
5652 conversation = find_or_create_conversation(pinfo);
5653 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5654 session->app_handle = app_handle;
5655}
5656
5657static uint32_t
5658ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5659 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5660{
5661
5662 conversation_t *conversation;
5663 SslSession *session;
5664
5665 /* Ignore if the TLS dissector is disabled. */
5666 /* XXX - find_dissector still works if a dissector is disabled,
5667 * this would be if the dissector isn't registered at all (or the
5668 * caller has an error.) */
5669 if (!tls_handle)
5670 return 0;
5671
5672 int proto = dissector_handle_get_protocol_index(tls_handle);
5673 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5674
5675 /* The caller should always pass a valid handle to its own dissector. */
5676 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5676, "app_handle"))));
5677
5678 conversation = find_or_create_conversation(pinfo);
5679 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5680
5681 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5682 session->last_nontls_frame,
5683 (void *)session->app_handle,
5684 dissector_handle_get_dissector_name(session->app_handle));
5685 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5686 pinfo->num, (void *)app_handle,
5687 dissector_handle_get_dissector_name(app_handle));
5688
5689 /* Do not switch again if a dissector did it before. */
5690 if (session->last_nontls_frame) {
5691 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5692 return session->last_nontls_frame;
5693 }
5694
5695 session->app_handle = app_handle;
5696 /* The TLS dissector should be called first for this conversation. */
5697 conversation_set_dissector(conversation, tls_handle);
5698 /* TLS starts after this frame. */
5699 session->last_nontls_frame = last_nontls_frame;
5700 return 0;
5701}
5702
5703/* ssl_starttls_ack: mark future frames as encrypted. */
5704uint32_t
5705ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5706 dissector_handle_t app_handle)
5707{
5708 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5709}
5710
5711uint32_t
5712ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5713 dissector_handle_t app_handle)
5714{
5715 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5716}
5717
5718dissector_handle_t
5719ssl_find_appdata_dissector(const char *name)
5720{
5721 /* Accept 'http' for backwards compatibility and sanity. */
5722 if (!strcmp(name, "http"))
5723 name = "http-over-tls";
5724 /* XXX - Should this check to see if the dissector is actually added for
5725 * Decode As in the appropriate table?
5726 */
5727 return find_dissector(name);
5728}
5729
5730/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5731static int
5732ssl_equal (const void *v, const void *v2)
5733{
5734 const StringInfo *val1;
5735 const StringInfo *val2;
5736 val1 = (const StringInfo *)v;
5737 val2 = (const StringInfo *)v2;
5738
5739 if (val1->data_len == val2->data_len &&
5740 !memcmp(val1->data, val2->data, val2->data_len)) {
5741 return 1;
5742 }
5743 return 0;
5744}
5745
5746static unsigned
5747ssl_hash(const void *v)
5748{
5749 const StringInfo* id;
5750 id = (const StringInfo*) v;
5751
5752 return wmem_strong_hash(id->data, id->data_len);
5753}
5754/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5755
5756/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5757void
5758ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5759{
5760 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5760, "main_handle"))));
5761 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5761, "subdissector_handle"))));
5762 /* Registration is required for Export PDU feature to work properly. */
5763 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5764, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5764 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5764, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5765 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5766
5767 if (port) {
5768 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5769 if (tcp)
5770 dissector_add_uint("tcp.port", port, main_handle);
5771 else
5772 dissector_add_uint("udp.port", port, main_handle);
5773 dissector_add_uint("sctp.port", port, main_handle);
5774 } else {
5775 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5776 }
5777}
5778
5779void
5780ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5781{
5782 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5783 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5784 if (main_handle) {
5785 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5786 dissector_delete_uint("sctp.port", port, main_handle);
5787 }
5788
5789 if (port) {
5790 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5791 }
5792}
5793
5794void
5795ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5796{
5797 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5798 session->srv_ptype = ptype;
5799 session->srv_port = port;
5800}
5801
5802int
5803ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5804{
5805 int ret;
5806 if (session && session->srv_addr.type != AT_NONE) {
5807 ret = (session->srv_ptype == pinfo->ptype) &&
5808 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5809 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5810 } else {
5811 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5812 }
5813
5814 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5815 return ret;
5816}
5817/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5818
5819
5820/* Links SSL records with the real packet data. {{{ */
5821SslPacketInfo *
5822tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5823{
5824 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5825 if (!pi) {
5826 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5827 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5828 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5829 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5830 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5831 if (ssl_session) {
5832 /* This can also be called by the QUIC TLS1.3 handshake only
5833 * dissector. That is not associated with a session, or a stream,
5834 * and doesn't need the information for Follow or Decode As. */
5835 pi->stream = ssl_session->session.stream;
5836 }
5837 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5838 }
5839
5840 return pi;
5841}
5842
5843/**
5844 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5845 * avoid the need for a decoder in the second pass. Additionally, it remembers
5846 * sequence numbers (for reassembly and Follow TLS Stream).
5847 *
5848 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5849 * @param pinfo The packet where the record originates from.
5850 * @param plain_data Decrypted plaintext to store in the record.
5851 * @param plain_data_len Total length of the plaintext.
5852 * @param content_len Length of the plaintext section corresponding to the record content.
5853 * @param record_id The identifier for this record within the current packet.
5854 * @param flow Information about sequence numbers, etc.
5855 * @param type TLS Content Type (such as handshake or application_data).
5856 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5857 */
5858void
5859ssl_add_record_info(int proto, packet_info *pinfo,
5860 const unsigned char *plain_data, int plain_data_len, int content_len,
5861 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5862 uint64_t record_seq)
5863{
5864 SslRecordInfo* rec, **prec;
5865 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5866
5867 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5867
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5868
5869 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5870 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5871 rec->plain_data_len = plain_data_len;
5872 rec->content_len = content_len;
5873 rec->id = record_id;
5874 rec->type = type;
5875 rec->next = NULL((void*)0);
5876 rec->record_seq = record_seq;
5877
5878 if (flow && type == SSL_ID_APP_DATA) {
5879 rec->seq = flow->byte_seq;
5880 rec->flow = flow;
5881 flow->byte_seq += content_len;
5882 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5883 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5884 }
5885
5886 /* Remember decrypted records. */
5887 prec = &pi->records;
5888 while (*prec) prec = &(*prec)->next;
5889 *prec = rec;
5890}
5891
5892/* search in packet data for the specified id; return a newly created tvb for the associated data */
5893tvbuff_t*
5894ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5895{
5896 SslRecordInfo* rec;
5897 SslPacketInfo* pi;
5898 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5899
5900 if (!pi)
5901 return NULL((void*)0);
5902
5903 for (rec = pi->records; rec; rec = rec->next)
5904 if (rec->id == record_id) {
5905 *matched_record = rec;
5906 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5907 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5908 }
5909
5910 return NULL((void*)0);
5911}
5912/* Links SSL records with the real packet data. }}} */
5913
5914/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5915void
5916ssl_common_init(ssl_master_key_map_t *mk_map,
5917 StringInfo *decrypted_data, StringInfo *compressed_data)
5918{
5919 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5920 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5921 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5922 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5923 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5924 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5925 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5926 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5927 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5928 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5929 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5930 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5931
5932 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5933 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5934
5935 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5936
5937 ssl_data_alloc(decrypted_data, 32);
5938 ssl_data_alloc(compressed_data, 32);
5939}
5940
5941void
5942ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5943 StringInfo *decrypted_data, StringInfo *compressed_data)
5944{
5945 g_hash_table_destroy(mk_map->session);
5946 g_hash_table_destroy(mk_map->tickets);
5947 g_hash_table_destroy(mk_map->crandom);
5948 g_hash_table_destroy(mk_map->pre_master);
5949 g_hash_table_destroy(mk_map->pms);
5950 g_hash_table_destroy(mk_map->tls13_client_early);
5951 g_hash_table_destroy(mk_map->tls13_client_handshake);
5952 g_hash_table_destroy(mk_map->tls13_server_handshake);
5953 g_hash_table_destroy(mk_map->tls13_client_appdata);
5954 g_hash_table_destroy(mk_map->tls13_server_appdata);
5955 g_hash_table_destroy(mk_map->tls13_early_exporter);
5956 g_hash_table_destroy(mk_map->tls13_exporter);
5957
5958 g_hash_table_destroy(mk_map->ech_secret);
5959 g_hash_table_destroy(mk_map->ech_config);
5960
5961 g_hash_table_destroy(mk_map->used_crandom);
5962
5963 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5964 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5965
5966 /* close the previous keylog file now that the cache are cleared, this
5967 * allows the cache to be filled with the full keylog file contents. */
5968 if (*ssl_keylog_file) {
5969 fclose(*ssl_keylog_file);
5970 *ssl_keylog_file = NULL((void*)0);
5971 }
5972}
5973/* }}} */
5974
5975/* parse ssl related preferences (private keys and ports association strings) */
5976#if defined(HAVE_LIBGNUTLS1)
5977/* Load a single RSA key file item from preferences. {{{ */
5978void
5979ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5980{
5981 gnutls_x509_privkey_t x509_priv_key;
5982 gnutls_privkey_t priv_key = NULL((void*)0);
5983 FILE* fp = NULL((void*)0);
5984 int ret;
5985 size_t key_id_len = 20;
5986 unsigned char *key_id = NULL((void*)0);
5987 char *err = NULL((void*)0);
5988 dissector_handle_t handle;
5989 /* try to load keys file first */
5990 fp = ws_fopenfopen(uats->keyfile, "rb");
5991 if (!fp) {
5992 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5993 return;
5994 }
5995
5996 if ((int)strlen(uats->password) == 0) {
5997 x509_priv_key = rsa_load_pem_key(fp, &err);
5998 } else {
5999 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
6000 }
6001 fclose(fp);
6002
6003 if (!x509_priv_key) {
6004 if (err) {
6005 report_failure("Can't load private key from %s: %s",
6006 uats->keyfile, err);
6007 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
6008 } else
6009 report_failure("Can't load private key from %s: unknown error",
6010 uats->keyfile);
6011 return;
6012 }
6013 if (err) {
6014 report_failure("Load of private key from %s \"succeeded\" with error %s",
6015 uats->keyfile, err);
6016 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
6017 }
6018
6019 gnutls_privkey_init(&priv_key);
6020 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6021 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6022 if (ret < 0) {
6023 report_failure("Can't convert private key %s: %s",
6024 uats->keyfile, gnutls_strerror(ret));
6025 goto end;
6026 }
6027
6028 key_id = (unsigned char *) g_malloc0(key_id_len);
6029 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6030 if (ret < 0) {
6031 report_failure("Can't calculate public key ID for %s: %s",
6032 uats->keyfile, gnutls_strerror(ret));
6033 goto end;
6034 }
6035 ssl_print_data("KeyID", key_id, key_id_len);
6036 if (key_id_len != 20) {
6037 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6038 uats->keyfile, key_id_len);
6039 goto end;
6040 }
6041
6042 g_hash_table_replace(key_hash, key_id, priv_key);
6043 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6044 priv_key = NULL((void*)0);
6045 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6046
6047 handle = ssl_find_appdata_dissector(uats->protocol);
6048 if (handle) {
6049 /* Port to subprotocol mapping */
6050 uint16_t port = 0;
6051 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6052 if (port > 0) {
6053 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6054 port, uats->keyfile, uats->password);
6055
6056 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6057 }
6058 } else {
6059 if (strcmp(uats->port, "start_tls"))
6060 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6061 }
6062 }
6063
6064end:
6065 gnutls_x509_privkey_deinit(x509_priv_key);
6066 gnutls_privkey_deinit(priv_key);
6067 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
6068}
6069/* }}} */
6070#endif
6071
6072
6073/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6074/** store a known (pre-)master secret into cache */
6075static void
6076ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6077 StringInfo *mk)
6078{
6079 StringInfo *ht_key, *master_secret;
6080
6081 if (key->data_len == 0) {
6082 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6083 return;
6084 }
6085
6086 if (mk->data_len == 0) {
6087 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6088 G_STRFUNC((const char*) (__func__)), label);
6089 return;
6090 }
6091
6092 ht_key = ssl_data_clone(key);
6093 master_secret = ssl_data_clone(mk);
6094 g_hash_table_insert(ht, ht_key, master_secret);
6095
6096 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6097 ssl_print_string("stored key", ht_key);
6098 ssl_print_string("stored (pre-)master secret", master_secret);
6099}
6100
6101/** restore a (pre-)master secret given some key in the cache */
6102static bool_Bool
6103ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6104 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6105{
6106 StringInfo *ms;
6107
6108 if (key->data_len == 0) {
6109 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6110 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6111 return false0;
6112 }
6113
6114 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6115 if (!ms) {
6116 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6117 is_pre_master ? "pre-" : "", label);
6118 return false0;
6119 }
6120
6121 /* (pre)master secret found, clear knowledge of other keys and set it in the
6122 * current conversation */
6123 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6124 SSL_HAVE_SESSION_KEY(1<<3));
6125 if (is_pre_master) {
6126 /* unlike master secret, pre-master secret has a variable size (48 for
6127 * RSA, varying for PSK) and is therefore not statically allocated */
6128 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6129 ms->data_len);
6130 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6131 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6132 } else {
6133 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6134 ssl->state |= SSL_MASTER_SECRET(1<<5);
6135 }
6136 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6137 is_pre_master ? "pre-" : "", label);
6138 ssl_print_string(label, key);
6139 ssl_print_string("(pre-)master secret", ms);
6140 return true1;
6141}
6142/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6143
6144/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6145 * the decoder should be attempted to be initialized. {{{*/
6146void
6147ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6148{
6149 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
6150 /* TLS 1.3 implementations only provide secrets derived from the master
6151 * secret which are loaded in tls13_change_key. No master secrets can be
6152 * loaded here, so just return. */
6153 return;
6154 }
6155 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6156 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
6157 ssl_debug_printf(" session key already available, nothing to do.\n");
6158 return;
6159 }
6160 if (!(ssl->state & SSL_CIPHER(1<<2))) {
6161 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6162 return;
6163 }
6164
6165 /* for decryption, there needs to be a master secret (which can be derived
6166 * from pre-master secret). If missing, try to pick a master key from cache
6167 * (an earlier packet in the capture or key logfile). */
6168 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6169 !ssl_restore_master_key(ssl, "Session ID", false0,
6170 mk_map->session, &ssl->session_id) &&
6171 (!ssl->session.is_session_resumed ||
6172 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6173 mk_map->tickets, &ssl->session_ticket)) &&
6174 !ssl_restore_master_key(ssl, "Client Random", false0,
6175 mk_map->crandom, &ssl->client_random)) {
6176 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6177 /* how unfortunate, the master secret could not be found */
6178 ssl_debug_printf(" Cannot find master secret\n");
6179 return;
6180 } else {
6181 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6182 "because of a NULL cipher\n");
6183 }
6184 }
6185
6186 if (ssl_generate_keyring_material(ssl) < 0) {
6187 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6188 return;
6189 }
6190 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6191 ssl_save_master_key("Client Random", mk_map->crandom,
6192 &ssl->client_random, &ssl->master_secret);
6193 ssl_save_master_key("Session ID", mk_map->session,
6194 &ssl->session_id, &ssl->master_secret);
6195 /* Only save the new secrets if the server sent the ticket. The client
6196 * ticket might have become stale. */
6197 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6198 ssl_save_master_key("Session Ticket", mk_map->tickets,
6199 &ssl->session_ticket, &ssl->master_secret);
6200 }
6201} /* }}} */
6202
6203static StringInfo*
6204tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
6205 TLSRecordType type)
6206{
6207 /* XXX - In addition to an out-of-bound PSK, we could also save the
6208 * PSK from a NewSessionTicket; we would also need to compute the
6209 * resumption_master_secret. */
6210 if (tls->psk.data_len == 0)
6211 return NULL((void*)0);
6212
6213 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
6214 * a UAT instead of a single global PSK string preference, preferably
6215 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
6216 * SHOULD be used. We will try the negotiated hash algorithm regardless
6217 * with the PSK, but fall back to SHA-256 for the Early Secret, since
6218 * that's before the Server Hello completes negotiation.
6219 */
6220 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
6221 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
6222 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
6223 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6224 }
6225
6226 int hash_algo = ssl_get_digest_by_name(dig->name);
6227 if (!hash_algo) {
6228 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6229 return NULL((void*)0);
6230 }
6231
6232 /* We can re-use this to store the Pseudo Random Key for each epoch. */
6233 uint8_t prk[DIGEST_MAX_SIZE48];
6234 StringInfo prk_string = { prk, dig->len };
6235 uint8_t *derived_secret;
6236
6237 uint8_t zeroes[DIGEST_MAX_SIZE48];
6238 memset(zeroes, 0, dig->len);
6239
6240 StringInfo *secret = NULL((void*)0);
6241 const char *label;
6242
6243 /* PRK = Early Secret */
6244 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6245
6246 if (type == TLS_SECRET_0RTT_APP) {
6247 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6247, "!is_from_server"))));
6248 label = "c e traffic";
6249 } else {
6250 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6251 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6252 return NULL((void*)0);
6253
6254 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6255 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6256 wmem_free(NULL((void*)0), derived_secret);
6257
6258 if (type == TLS_SECRET_HANDSHAKE) {
6259 label = is_from_server ? "s hs traffic" : "c hs traffic";
6260 } else {
6261 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6262 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6263 return NULL((void*)0);
6264
6265 /* PRK = Master Secret */
6266 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6267 wmem_free(NULL((void*)0), derived_secret);
6268
6269 label = is_from_server ? "s ap traffic" : "c ap traffic";
6270 }
6271 }
6272
6273 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6274 * support ECHO with psk_ke?) then we should use ech_transcript instead
6275 * of handshake_transcript. Both are kept until the ServerHello indicates
6276 * whether ECHO was accepted or not, though the ECH transcript doesn't
6277 * currently get the messages after the ServerHello. */
6278 uint8_t transcript_hash[DIGEST_MAX_SIZE48];
6279 unsigned transcript_hash_len;
6280 if (!tls_transcript_hash(&tls->handshake_transcript, hash_algo, transcript_hash, &transcript_hash_len)) {
6281 ssl_debug_printf("%s can't get the transcript hash\n", G_STRFUNC((const char*) (__func__)));
6282 return NULL((void*)0);
6283 }
6284 if (!tls13_hkdf_expand_label_context(hash_algo, &prk_string,
6285 tls13_hkdf_label_prefix(tls), label,
6286 transcript_hash, transcript_hash_len,
6287 dig->len, &derived_secret))
6288 return NULL((void*)0);
6289
6290 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6291 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6292 secret->data_len = dig->len;
6293 wmem_free(NULL((void*)0), derived_secret);
6294 return secret;
6295}
6296
6297/* Load the traffic key secret from the keylog file. */
6298StringInfo *
6299tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6300 bool_Bool is_from_server, TLSRecordType type)
6301{
6302 GHashTable *key_map;
6303 const char *label;
6304
6305 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6306 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6307 return NULL((void*)0);
6308 }
6309
6310 if (ssl->client_random.data_len == 0) {
6311 /* May happen if Hello message is missing and Finished is found. */
6312 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6313 return NULL((void*)0);
6314 }
6315
6316 switch (type) {
6317 case TLS_SECRET_0RTT_APP:
6318 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6318, "!is_from_server"))));
6319 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6320 key_map = mk_map->tls13_client_early;
6321 break;
6322 case TLS_SECRET_HANDSHAKE:
6323 if (is_from_server) {
6324 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6325 key_map = mk_map->tls13_server_handshake;
6326 } else {
6327 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6328 key_map = mk_map->tls13_client_handshake;
6329 }
6330 break;
6331 case TLS_SECRET_APP:
6332 if (is_from_server) {
6333 label = "SERVER_TRAFFIC_SECRET_0";
6334 key_map = mk_map->tls13_server_appdata;
6335 } else {
6336 label = "CLIENT_TRAFFIC_SECRET_0";
6337 key_map = mk_map->tls13_client_appdata;
6338 }
6339 break;
6340 default:
6341 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6341, __func__, "assertion \"not reached\" failed");
6342 }
6343
6344 /* Transitioning to new keys, mark old ones as unusable. */
6345 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6346 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6347
6348 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6349 if (!secret) {
6350 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6351 if (secret) {
6352 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6353 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6354 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6355 }
6356 }
6357 if (!secret) {
6358 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6359 /* Disable decryption, the keys are invalid. */
6360 if (is_from_server) {
6361 ssl->server = NULL((void*)0);
6362 } else {
6363 ssl->client = NULL((void*)0);
6364 }
6365 return NULL((void*)0);
6366 }
6367
6368 /* TLS 1.3 secret found, set new keys. */
6369 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6370 ssl_print_string("Client Random", &ssl->client_random);
6371 ssl_print_string(label, secret);
6372 return secret;
6373}
6374
6375/* Load the new key. */
6376void
6377tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6378 bool_Bool is_from_server, TLSRecordType type)
6379{
6380 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6381 /*
6382 * QUIC does not use the TLS record layer for message protection.
6383 * The required keys will be extracted later by QUIC.
6384 */
6385 return;
6386 }
6387
6388 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6389 if (!secret) {
6390 if (type != TLS_SECRET_HANDSHAKE) {
6391 return;
6392 }
6393 /*
6394 * Workaround for when for some reason we don't have the handshake
6395 * secret but do have the application traffic secret. (#20240)
6396 * If we can't find the handshake secret, we'll never decrypt the
6397 * Finished message, so we won't know when to change to the app
6398 * traffic key, so we do so now.
6399 */
6400 type = TLS_SECRET_APP;
6401 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6402 if (!secret) {
6403 return;
6404 }
6405 }
6406
6407 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6408 /*
6409 * Remember the application traffic secret to support Key Update. The
6410 * other secrets cannot be used for this purpose, so free them.
6411 */
6412 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6413 StringInfo *app_secret = &decoder->app_traffic_secret;
6414 if (type == TLS_SECRET_APP) {
6415 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6416 app_secret->data,
6417 secret->data_len);
6418 ssl_data_set(app_secret, secret->data, secret->data_len);
6419 } else {
6420 wmem_free(wmem_file_scope(), app_secret->data);
6421 app_secret->data = NULL((void*)0);
6422 app_secret->data_len = 0;
6423 }
6424 }
6425}
6426
6427/**
6428 * Update to next application data traffic secret for TLS 1.3. The previous
6429 * secret should have been set by tls13_change_key.
6430 */
6431void
6432tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6433{
6434 /* RFC 8446 Section 7.2:
6435 * application_traffic_secret_N+1 =
6436 * HKDF-Expand-Label(application_traffic_secret_N,
6437 * "traffic upd", "", Hash.length)
6438 *
6439 * Both application_traffic_secret_N are of the same length (Hash.length).
6440 */
6441 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6442 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6443 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6444 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6445
6446 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6447 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6448 return;
6449 }
6450
6451 /*
6452 * Previous traffic secret is available, so find the hash function,
6453 * expand the new traffic secret and generate new keys.
6454 */
6455 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6456 int hash_algo = ssl_get_digest_by_name(hash_name);
6457 const unsigned hash_len = app_secret->data_len;
6458 unsigned char *new_secret;
6459 const char *label = "traffic upd";
6460 if (tls13_draft_version && tls13_draft_version < 20) {
6461 label = "application traffic secret";
6462 }
6463 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6464 tls13_hkdf_label_prefix(ssl),
6465 label, hash_len, &new_secret)) {
6466 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6467 return;
6468 }
6469 ssl_data_set(app_secret, new_secret, hash_len);
6470 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6471 /*
6472 * Remember the application traffic secret on the new decoder to
6473 * support another Key Update.
6474 */
6475 decoder = is_from_server ? ssl->server : ssl->client;
6476 app_secret = &decoder->app_traffic_secret;
6477 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6478 app_secret->data,
6479 hash_len);
6480 ssl_data_set(app_secret, new_secret, hash_len);
6481 }
6482 wmem_free(NULL((void*)0), new_secret);
6483}
6484
6485void
6486tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6487{
6488 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6489 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6490 }
6491}
6492
6493/** SSL keylog file handling. {{{ */
6494
6495static GRegex *
6496ssl_compile_keyfile_regex(void)
6497{
6498#define OCTET "(?:[[:xdigit:]]{2})"
6499 const char *pattern =
6500 "(?:"
6501 /* Matches Client Hellos having this Client Random */
6502 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6503 /* Matches first part of encrypted RSA pre-master secret */
6504 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6505 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6506 but it can be of any length for DHE */
6507 ")(?<pms>" OCTET "+)"
6508 "|(?:"
6509 /* Matches Server Hellos having a Session ID */
6510 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6511 /* Matches Client Hellos having this Client Random */
6512 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6513 /* Master-Secret is given, its length is fixed */
6514 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6515 "|(?"
6516 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6517 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6518 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6519 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6520 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6521 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6522 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6523 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6524 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6525 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6526 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6527 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6528 ") (?<derived_secret>" OCTET "+)";
6529#undef OCTET
6530 static GRegex *regex = NULL((void*)0);
6531 GError *gerr = NULL((void*)0);
6532
6533 if (!regex) {
6534 regex = g_regex_new(pattern,
6535 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6536 G_REGEX_MATCH_ANCHORED, &gerr);
6537 if (gerr) {
6538 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6539 gerr->message);
6540 g_error_free(gerr);
6541 regex = NULL((void*)0);
6542 }
6543 }
6544
6545 return regex;
6546}
6547
6548typedef struct ssl_master_key_match_group {
6549 const char *re_group_name;
6550 GHashTable *master_key_ht;
6551} ssl_master_key_match_group_t;
6552
6553void
6554tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6555{
6556 ssl_master_key_match_group_t mk_groups[] = {
6557 { "encrypted_pmk", mk_map->pre_master },
6558 { "session_id", mk_map->session },
6559 { "client_random", mk_map->crandom },
6560 { "client_random_pms", mk_map->pms },
6561 /* TLS 1.3 map from Client Random to derived secret. */
6562 { "client_early", mk_map->tls13_client_early },
6563 { "client_handshake", mk_map->tls13_client_handshake },
6564 { "server_handshake", mk_map->tls13_server_handshake },
6565 { "client_appdata", mk_map->tls13_client_appdata },
6566 { "server_appdata", mk_map->tls13_server_appdata },
6567 { "early_exporter", mk_map->tls13_early_exporter },
6568 { "exporter", mk_map->tls13_exporter },
6569 { "ech_secret", mk_map->ech_secret },
6570 { "ech_config", mk_map->ech_config },
6571 };
6572
6573 /* The format of the file is a series of records with one of the following formats:
6574 * - "RSA xxxx yyyy"
6575 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6576 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6577 * (this is the original format introduced with bug 4349)
6578 *
6579 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6580 * Where xxxx is the SSL session ID (hex-encoded)
6581 * Where yyyy is the cleartext master secret (hex-encoded)
6582 * (added to support openssl s_client Master-Key output)
6583 * This is somewhat is a misnomer because there's nothing RSA specific
6584 * about this.
6585 *
6586 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6587 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6588 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6589 * (This format allows SSL connections to be decrypted, if a user can
6590 * capture the PMS but could not recover the MS for a specific session
6591 * with a SSL Server.)
6592 *
6593 * - "CLIENT_RANDOM xxxx yyyy"
6594 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6595 * Where yyyy is the cleartext master secret (hex-encoded)
6596 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6597 * ECDHE-RSA.)
6598 *
6599 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6600 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6601 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6602 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6603 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6604 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6605 * - "EXPORTER_SECRET xxxx yyyy"
6606 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6607 * Where yyyy is the secret (hex-encoded) derived from the early,
6608 * handshake or master secrets. (This format is introduced with TLS 1.3
6609 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6610 */
6611 GRegex *regex = ssl_compile_keyfile_regex();
6612 if (!regex)
6613 return;
6614
6615 const char *next_line = (const char *)data;
6616 const char *line_end = next_line + datalen;
6617 while (next_line && next_line < line_end) {
6618 const char *line = next_line;
6619 next_line = (const char *)memchr(line, '\n', line_end - line);
6620 ssize_t linelen;
6621
6622 if (next_line) {
6623 linelen = next_line - line;
6624 next_line++; /* drop LF */
6625 } else {
6626 linelen = (ssize_t)(line_end - line);
6627 }
6628 if (linelen > 0 && line[linelen - 1] == '\r') {
6629 linelen--; /* drop CR */
6630 }
6631
6632 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6633 GMatchInfo *mi;
6634 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6635 char *hex_key, *hex_pre_ms_or_ms;
6636 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6637 StringInfo *pre_ms_or_ms = NULL((void*)0);
6638 GHashTable *ht = NULL((void*)0);
6639
6640 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6641 * otherwise we will use the Master Secret
6642 */
6643 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6644 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6645 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6646 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6647 }
6648 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6649 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6650 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6651 }
6652 /* There is always a match, otherwise the regex is wrong. */
6653 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6653, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6654
6655 /* convert from hex to bytes and save to hashtable */
6656 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6657 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6658 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6659
6660 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6661 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6662 ssl_master_key_match_group_t *g = &mk_groups[i];
6663 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6664 if (hex_key && *hex_key) {
6665 ssl_debug_printf(" matched %s\n", g->re_group_name);
6666 ht = g->master_key_ht;
6667 from_hex(key, hex_key, strlen(hex_key));
6668 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6669 break;
6670 }
6671 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6672 }
6673 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6673, "ht")))); /* Cannot be reached, or regex is wrong. */
6674
6675 g_hash_table_insert(ht, key, pre_ms_or_ms);
6676
6677 } else if (linelen > 0 && line[0] != '#') {
6678 ssl_debug_printf(" unrecognized line\n");
6679 }
6680 /* always free match info even if there is no match. */
6681 g_match_info_free(mi);
6682 }
6683}
6684
6685void
6686ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6687 const ssl_master_key_map_t *mk_map)
6688{
6689 /* no need to try if no key log file is configured. */
6690 if (!tls_keylog_filename || !*tls_keylog_filename) {
6691 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6692 G_STRFUNC((const char*) (__func__)));
6693 return;
6694 }
6695
6696 /* Validate regexes before even trying to use it. */
6697 if (!ssl_compile_keyfile_regex()) {
6698 return;
6699 }
6700
6701 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6702
6703 /* if the keylog file was deleted/overwritten, re-open it */
6704 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6705 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6706 fclose(*keylog_file);
6707 *keylog_file = NULL((void*)0);
6708 }
6709
6710 if (*keylog_file == NULL((void*)0)) {
6711 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6712 if (!*keylog_file) {
6713 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6714 return;
6715 }
6716 }
6717
6718 for (;;) {
6719 char buf[1110], *line;
6720 line = fgets(buf, sizeof(buf), *keylog_file);
6721 if (!line) {
6722 if (feof(*keylog_file)) {
6723 /* Ensure that newly appended keys can be read in the future. */
6724 clearerr(*keylog_file);
6725 } else if (ferror(*keylog_file)) {
6726 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6727 fclose(*keylog_file);
6728 *keylog_file = NULL((void*)0);
6729 }
6730 break;
6731 }
6732 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6733 }
6734}
6735/** SSL keylog file handling. }}} */
6736
6737#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6738
6739static FILE* ssl_debug_file;
6740
6741void
6742ssl_set_debug(const char* name)
6743{
6744 static int debug_file_must_be_closed;
6745 int use_stderr;
6746
6747 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6748
6749 if (debug_file_must_be_closed)
6750 fclose(ssl_debug_file);
6751
6752 if (use_stderr)
6753 ssl_debug_file = stderrstderr;
6754 else if (!name || (strcmp(name, "") ==0))
6755 ssl_debug_file = NULL((void*)0);
6756 else
6757 ssl_debug_file = ws_fopenfopen(name, "w");
6758
6759 if (!use_stderr && ssl_debug_file)
6760 debug_file_must_be_closed = 1;
6761 else
6762 debug_file_must_be_closed = 0;
6763
6764 ssl_debug_printf("Wireshark SSL debug log \n\n");
6765#ifdef HAVE_LIBGNUTLS1
6766 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6767#endif
6768 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6769 ssl_debug_printf("\n");
6770}
6771
6772void
6773ssl_debug_flush(void)
6774{
6775 if (ssl_debug_file)
6776 fflush(ssl_debug_file);
6777}
6778
6779void
6780ssl_debug_printf(const char* fmt, ...)
6781{
6782 va_list ap;
6783
6784 if (!ssl_debug_file)
6785 return;
6786
6787 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6788 vfprintf(ssl_debug_file, fmt, ap);
6789 va_end(ap)__builtin_va_end(ap);
6790}
6791
6792void
6793ssl_print_data(const char* name, const unsigned char* data, size_t len)
6794{
6795 size_t i, j, k;
6796 if (!ssl_debug_file)
6797 return;
6798 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6799 for (i=0; i<len; i+=16) {
6800 fprintf(ssl_debug_file,"| ");
6801 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6802 fprintf(ssl_debug_file,"%.2x ",data[j]);
6803 for (; k<16; ++k)
6804 fprintf(ssl_debug_file," ");
6805 fputc('|', ssl_debug_file);
6806 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6807 unsigned char c = data[j];
6808 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6809 fputc(c, ssl_debug_file);
6810 }
6811 for (; k<16; ++k)
6812 fputc(' ', ssl_debug_file);
6813 fprintf(ssl_debug_file,"|\n");
6814 }
6815}
6816
6817void
6818ssl_print_string(const char* name, const StringInfo* data)
6819{
6820 ssl_print_data(name, data->data, data->data_len);
6821}
6822#endif /* SSL_DECRYPT_DEBUG }}} */
6823
6824/* UAT preferences callbacks. {{{ */
6825/* checks for SSL and DTLS UAT key list fields */
6826
6827bool_Bool
6828ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6829{
6830 // This should be removed in favor of Decode As. Make it optional.
6831 *err = NULL((void*)0);
6832 return true1;
6833}
6834
6835bool_Bool
6836ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6837{
6838 if (!p || strlen(p) == 0u) {
6839 // This should be removed in favor of Decode As. Make it optional.
6840 *err = NULL((void*)0);
6841 return true1;
6842 }
6843
6844 if (strcmp(p, "start_tls") != 0){
6845 uint16_t port;
6846 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6847 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6848 return false0;
6849 }
6850 }
6851
6852 *err = NULL((void*)0);
6853 return true1;
6854}
6855
6856bool_Bool
6857ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6858{
6859 ws_statb64struct stat st;
6860
6861 if (!p || strlen(p) == 0u) {
6862 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6863 return false0;
6864 } else {
6865 if (ws_stat64stat(p, &st) != 0) {
6866 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6867 return false0;
6868 }
6869 }
6870
6871 *err = NULL((void*)0);
6872 return true1;
6873}
6874
6875bool_Bool
6876ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6877{
6878#if defined(HAVE_LIBGNUTLS1)
6879 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6880 FILE *fp = NULL((void*)0);
6881
6882 if (p && (strlen(p) > 0u)) {
6883 fp = ws_fopenfopen(f->keyfile, "rb");
6884 if (fp) {
6885 char *msg = NULL((void*)0);
6886 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6887 if (!priv_key) {
6888 fclose(fp);
6889 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6890 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6891 return false0;
6892 }
6893 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6894 gnutls_x509_privkey_deinit(priv_key);
6895 fclose(fp);
6896 } else {
6897 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6898 return false0;
6899 }
6900 }
6901
6902 *err = NULL((void*)0);
6903 return true1;
6904#else
6905 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6906 return false0;
6907#endif
6908}
6909/* UAT preferences callbacks. }}} */
6910
6911/** maximum size of ssl_association_info() string */
6912#define SSL_ASSOC_MAX_LEN8192 8192
6913
6914typedef struct ssl_association_info_callback_data
6915{
6916 char *str;
6917 const char *table_protocol;
6918} ssl_association_info_callback_data_t;
6919
6920/**
6921 * callback function used by ssl_association_info() to traverse the SSL associations.
6922 */
6923static void
6924ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6925{
6926 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6927 const int l = (const int)strlen(data->str);
6928 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6929}
6930
6931/**
6932 * @return an information string on the SSL protocol associations. The string must be freed.
6933 */
6934char*
6935ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6936{
6937 ssl_association_info_callback_data_t data;
6938
6939 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6940 data.table_protocol = table_protocol;
6941 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6942 return data.str;
6943}
6944
6945
6946/** Begin of code related to dissection of wire data. */
6947
6948/* Helpers for dissecting Variable-Length Vectors. {{{ */
6949bool_Bool
6950ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6951 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6952 int hf_length, uint32_t min_value, uint32_t max_value)
6953{
6954 unsigned veclen_size;
6955 uint32_t veclen_value;
6956 proto_item *pi;
6957
6958 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6958, (uint64_t)min_value, (uint64_t)max_value))));
6959 if (offset > offset_end) {
6960 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6961 "Vector offset is past buffer end offset (%u > %u)",
6962 offset, offset_end);
6963 *ret_length = 0;
6964 return false0; /* Cannot read length. */
6965 }
6966
6967 if (max_value > 0xffffff) {
6968 veclen_size = 4;
6969 } else if (max_value > 0xffff) {
6970 veclen_size = 3;
6971 } else if (max_value > 0xff) {
6972 veclen_size = 2;
6973 } else {
6974 veclen_size = 1;
6975 }
6976
6977 if (offset_end - offset < veclen_size) {
6978 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6979 tvb, offset, offset_end - offset,
6980 "No more room for vector of length %u",
6981 veclen_size);
6982 *ret_length = 0;
6983 return false0; /* Cannot read length. */
6984 }
6985
6986 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6987 offset += veclen_size;
6988
6989 if (veclen_value < min_value) {
6990 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6991 "Vector length %u is smaller than minimum %u",
6992 veclen_value, min_value);
6993 } else if (veclen_value > max_value) {
6994 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6995 "Vector length %u is larger than maximum %u",
6996 veclen_value, max_value);
6997 }
6998
6999 if (offset_end - offset < veclen_value) {
7000 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
7001 "Vector length %u is too large, truncating it to %u",
7002 veclen_value, offset_end - offset);
7003 *ret_length = offset_end - offset;
7004 return false0; /* Length is truncated to avoid overflow. */
7005 }
7006
7007 *ret_length = veclen_value;
7008 return true1; /* Length is OK. */
7009}
7010
7011bool_Bool
7012ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7013 unsigned offset, unsigned offset_end)
7014{
7015 if (offset < offset_end) {
7016 unsigned trailing = offset_end - offset;
7017 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7018 tvb, offset, trailing,
7019 "%u trailing byte%s unprocessed",
7020 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7021 return false0; /* unprocessed data warning */
7022 } else if (offset > offset_end) {
7023 /*
7024 * Returned offset runs past the end. This should not happen and is
7025 * possibly a dissector bug.
7026 */
7027 unsigned excess = offset - offset_end;
7028 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7029 tvb, offset_end, excess,
7030 "Dissector processed too much data (%u byte%s)",
7031 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7032 return false0; /* overflow error */
7033 }
7034
7035 return true1; /* OK, offset matches. */
7036}
7037/** }}} */
7038
7039
7040static uint32_t
7041ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7042 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7043 uint16_t version, int hf_sig_len, int hf_sig);
7044
7045/* change_cipher_spec(20) dissection */
7046void
7047ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7048 packet_info *pinfo, proto_tree *tree,
7049 uint32_t offset, SslSession *session,
7050 bool_Bool is_from_server,
7051 const SslDecryptSession *ssl)
7052{
7053 /*
7054 * struct {
7055 * enum { change_cipher_spec(1), (255) } type;
7056 * } ChangeCipherSpec;
7057 */
7058 proto_item *ti;
7059 proto_item_set_text(tree,
7060 "%s Record Layer: %s Protocol: Change Cipher Spec",
7061 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7062 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7063 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7064
7065 if (session->version == TLSV1DOT3_VERSION0x304) {
7066 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7067 return;
7068 }
7069
7070 /* Remember frame number of first CCS */
7071 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7072 if (*ccs_frame == 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited))
7073 *ccs_frame = pinfo->num;
7074
7075 /* Use heuristics to detect an abbreviated handshake, assume that missing
7076 * ServerHelloDone implies reusing previously negotiating keys. Then when
7077 * a Session ID or ticket is present, it must be a resumed session.
7078 * Normally this should be done at the Finished message, but that may be
7079 * encrypted so we do it here, at the last cleartext message. */
7080 if (is_from_server && ssl) {
7081 if (session->is_session_resumed) {
7082 const char *resumed = NULL((void*)0);
7083 if (ssl->session_ticket.data_len) {
7084 resumed = "Session Ticket";
7085 } else if (ssl->session_id.data_len) {
7086 resumed = "Session ID";
7087 }
7088 if (resumed) {
7089 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7090 } else {
7091 /* Can happen if the capture somehow starts in the middle */
7092 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7093 }
7094 } else {
7095 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7096 }
7097 }
7098 if (is_from_server && session->is_session_resumed)
7099 expert_add_info(pinfo, ti, &hf->ei.resumed);
7100}
7101
7102/** Begin of handshake(22) record dissections */
7103
7104/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7105 * {{{ */
7106static void
7107tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7108{
7109 uint32_t sighash, hashalg, sigalg;
7110 proto_item *ti_sigalg;
7111 proto_tree *sigalg_tree;
7112
7113 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7114 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7115 if (ja4_data && !IS_GREASE_TLS(sighash)((((sighash) & 0x0f0f) == 0x0a0a) && (((sighash) &
0xff) == (((sighash)>>8) & 0xff)))) {
7116 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7117 }
7118
7119 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7120
7121 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7122 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7123 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7124 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7125 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7126
7127 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7128 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7129 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7130 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7131 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7132 sighash);
7133 }
7134} /* }}} */
7135
7136/* dissect a list of hash algorithms, return the number of bytes dissected
7137 this is used for the signature algorithms extension and for the
7138 TLS1.2 certificate request. {{{ */
7139static int
7140ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7141 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7142{
7143 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7144 * struct {
7145 * HashAlgorithm hash;
7146 * SignatureAlgorithm signature;
7147 * } SignatureAndHashAlgorithm;
7148 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7149 */
7150 proto_tree *subtree;
7151 proto_item *ti;
7152 unsigned sh_alg_length;
7153 uint32_t next_offset;
7154
7155 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7156 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7157 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7158 return offset_end;
7159 }
7160 offset += 2;
7161 next_offset = offset + sh_alg_length;
7162
7163 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7164 "Signature Hash Algorithms (%u algorithm%s)",
7165 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7166 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7167
7168 while (offset + 2 <= next_offset) {
7169 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7170 offset += 2;
7171 }
7172
7173 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7174 offset = next_offset;
7175 }
7176
7177 return offset;
7178} /* }}} */
7179
7180/* Dissection of DistinguishedName (for CertificateRequest and
7181 * certificate_authorities extension). {{{ */
7182static uint32_t
7183tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7184 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7185{
7186 proto_item *ti;
7187 proto_tree *subtree;
7188 uint32_t dnames_length, next_offset;
7189 asn1_ctx_t asn1_ctx;
7190 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7191
7192 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7193 /* DistinguishedName certificate_authorities<0..2^16-1> */
7194 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7195 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7196 return offset_end;
7197 }
7198 offset += 2;
7199 next_offset = offset + dnames_length;
7200
7201 if (dnames_length > 0) {
7202 ti = proto_tree_add_none_format(tree,
7203 hf->hf.hs_dnames,
7204 tvb, offset, dnames_length,
7205 "Distinguished Names (%d byte%s)",
7206 dnames_length,
7207 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7208 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7209
7210 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7211
7212 while (offset < next_offset) {
7213 /* get the length of the current certificate */
7214 uint32_t name_length;
7215
7216 if (dnames_count-- == 0) {
7217 /* stop adding to tree when the list is considered too large
7218 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7219 Note: dnames_count must be set low enough not to hit the
7220 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7221 */
7222 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7223 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7224 proto_item_set_generated(ti);
7225 return next_offset;
7226 }
7227
7228 /* opaque DistinguishedName<1..2^16-1> */
7229 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7230 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7231 return next_offset;
7232 }
7233 offset += 2;
7234
7235 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7236 subtree, hf->hf.hs_dname);
7237 offset += name_length;
7238 }
7239 }
7240 return offset;
7241} /* }}} */
7242
7243
7244/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7245static int
7246ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7247 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7248{
7249 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7250}
7251
7252static int
7253ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7254 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7255{
7256 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7257 hnd_type == SSL_HND_CERT_REQUEST) {
7258 /*
7259 * struct {
7260 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7261 * } SignatureSchemeList;
7262 */
7263
7264 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7265 } else {
7266 asn1_ctx_t asn1_ctx;
7267 unsigned pubkey_length, sign_length;
7268
7269 /*
7270 * struct {
7271 * uint32 valid_time;
7272 * SignatureScheme expected_cert_verify_algorithm;
7273 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7274 * } Credential;
7275 *
7276 * struct {
7277 * Credential cred;
7278 * SignatureScheme algorithm;
7279 * opaque signature<0..2^16-1>;
7280 * } DelegatedCredential;
7281 */
7282
7283 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7284
7285 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7286 offset += 4;
7287
7288 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7289 offset += 2;
7290
7291 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7292 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7293 return offset_end;
7294 }
7295 offset += 3;
7296 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7297 offset += pubkey_length;
7298
7299 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7300 offset += 2;
7301
7302 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7303 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7304 return offset_end;
7305 }
7306 offset += 2;
7307 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7308 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7309 offset += sign_length;
7310
7311 return offset;
7312 }
7313}
7314
7315static int
7316ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7317 packet_info *pinfo, proto_tree *tree,
7318 uint32_t offset, uint32_t offset_end,
7319 uint8_t hnd_type)
7320{
7321
7322 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7323
7324 switch (hnd_type) {
7325 case SSL_HND_CLIENT_HELLO: {
7326 proto_tree *alps_tree;
7327 proto_item *ti;
7328 uint32_t next_offset, alps_length, name_length;
7329
7330 /*
7331 * opaque ProtocolName<1..2^8-1>;
7332 * struct {
7333 * ProtocolName supported_protocols<2..2^16-1>
7334 * } ApplicationSettingsSupport;
7335 */
7336
7337 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7338 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7339 return offset_end;
7340 }
7341 offset += 2;
7342 next_offset = offset + alps_length;
7343
7344 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7345 tvb, offset, alps_length, ENC_NA0x00000000);
7346 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7347
7348 /* Parse list (note missing check for end of vector, ssl_add_vector below
7349 * ensures that data is always available.) */
7350 while (offset < next_offset) {
7351 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7352 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7353 return next_offset;
7354 }
7355 offset++;
7356
7357 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7358 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7359 offset += name_length;
7360 }
7361
7362 return offset;
7363 }
7364 case SSL_HND_ENCRYPTED_EXTS:
7365 /* Opaque blob */
7366 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7367 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7368 break;
7369 }
7370
7371 return offset_end;
7372}
7373
7374static int
7375ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7376 packet_info *pinfo, proto_tree *tree,
7377 uint32_t offset, uint32_t offset_end,
7378 uint8_t hnd_type, SslSession *session,
7379 bool_Bool is_dtls, ja4_data_t *ja4_data)
7380{
7381
7382 /* https://tools.ietf.org/html/rfc7301#section-3.1
7383 * opaque ProtocolName<1..2^8-1>;
7384 * struct {
7385 * ProtocolName protocol_name_list<2..2^16-1>
7386 * } ProtocolNameList;
7387 */
7388 proto_tree *alpn_tree;
7389 proto_item *ti;
7390 uint32_t next_offset, alpn_length, name_length;
7391 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7392
7393 /* ProtocolName protocol_name_list<2..2^16-1> */
7394 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7395 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7396 return offset_end;
7397 }
7398 offset += 2;
7399 next_offset = offset + alpn_length;
7400
7401 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7402 tvb, offset, alpn_length, ENC_NA0x00000000);
7403 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7404
7405 /* Parse list (note missing check for end of vector, ssl_add_vector below
7406 * ensures that data is always available.) */
7407 while (offset < next_offset) {
7408 /* opaque ProtocolName<1..2^8-1> */
7409 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7410 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7411 return next_offset;
7412 }
7413 offset++;
7414
7415 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7416 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7417 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7418 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7419 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7420 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7421 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7422 }
7423 else {
7424 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7425 alpn_last_char & 0x0F);
7426 }
7427 }
7428 /* Remember first ALPN ProtocolName entry for server. */
7429 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7430 /* '\0'-terminated string for dissector table match and prefix
7431 * comparison purposes. */
7432 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7433 name_length, ENC_ASCII0x00000000);
7434 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7435 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7436 name_length, ENC_ASCII0x00000000);
7437 }
7438 offset += name_length;
7439 }
7440
7441 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7442 * exactly one "ProtocolName". */
7443 if (proto_name) {
7444 dissector_handle_t handle;
7445
7446 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited))
7447 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7448
7449 if (is_dtls) {
7450 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7451 proto_name);
7452 } else {
7453 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7454 proto_name);
7455 if (handle == NULL((void*)0)) {
7456 /* Try prefix matching */
7457 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7458 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7459
7460 /* string_string is inappropriate as it compares strings
7461 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7462 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7463 handle = find_dissector(alpn_proto->dissector_name);
7464 break;
7465 }
7466 }
7467 }
7468 }
7469 if (handle != NULL((void*)0) && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
7470 /* ProtocolName match, so set the App data dissector handle.
7471 * This may override protocols given via the UAT dialog, but
7472 * since the ALPN hint is precise, do it anyway. */
7473 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7474 (void *)session->app_handle,
7475 (void *)handle,
7476 dissector_handle_get_dissector_name(handle));
7477 session->app_handle = handle;
7478 }
7479 } else if (client_proto_name && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
7480 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7481 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7482 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7483 }
7484
7485 return offset;
7486}
7487
7488static int
7489ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7490 packet_info *pinfo, proto_tree *tree,
7491 uint32_t offset, uint32_t offset_end)
7492{
7493 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7494 * The "extension_data" field of a "next_protocol_negotiation" extension
7495 * in a "ServerHello" contains an optional list of protocols advertised
7496 * by the server. Protocols are named by opaque, non-empty byte strings
7497 * and the list of protocols is serialized as a concatenation of 8-bit,
7498 * length prefixed byte strings. Implementations MUST ensure that the
7499 * empty string is not included and that no byte strings are truncated.
7500 */
7501 uint32_t npn_length;
7502 proto_tree *npn_tree;
7503
7504 /* List is optional, do not add tree if there are no entries. */
7505 if (offset == offset_end) {
7506 return offset;
7507 }
7508
7509 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7510
7511 while (offset < offset_end) {
7512 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7513 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7514 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7515 return offset_end;
7516 }
7517 offset++;
7518
7519 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7520 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7521 offset += npn_length;
7522 }
7523
7524 return offset;
7525}
7526
7527static int
7528ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7529 packet_info *pinfo, proto_tree *tree,
7530 uint32_t offset, uint32_t offset_end)
7531{
7532 /* https://tools.ietf.org/html/rfc5746#section-3.2
7533 * struct {
7534 * opaque renegotiated_connection<0..255>;
7535 * } RenegotiationInfo;
7536 *
7537 */
7538 proto_tree *reneg_info_tree;
7539 uint32_t reneg_info_length;
7540
7541 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7542
7543 /* opaque renegotiated_connection<0..255> */
7544 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7545 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7546 return offset_end;
7547 }
7548 offset++;
7549
7550 if (reneg_info_length > 0) {
7551 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7552 offset += reneg_info_length;
7553 }
7554
7555 return offset;
7556}
7557
7558static int
7559ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7560 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7561 const char **group_name_out)
7562{
7563 /* RFC 8446 Section 4.2.8
7564 * struct {
7565 * NamedGroup group;
7566 * opaque key_exchange<1..2^16-1>;
7567 * } KeyShareEntry;
7568 */
7569 uint32_t key_exchange_length, group;
7570 proto_tree *ks_tree;
7571
7572 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7573
7574 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7575 offset += 2;
7576 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7577 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7578 if (group_name_out) {
7579 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7580 }
7581
7582 /* opaque key_exchange<1..2^16-1> */
7583 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7584 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7585 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7586 }
7587 offset += 2;
7588 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7589 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7590
7591 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7592 offset += key_exchange_length;
7593
7594 return offset;
7595}
7596
7597static int
7598ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7599 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7600 uint8_t hnd_type, SslDecryptSession *ssl)
7601{
7602 proto_tree *key_share_tree;
7603 uint32_t next_offset;
7604 uint32_t client_shares_length;
7605 uint32_t group;
7606 const char *group_name = NULL((void*)0);
7607
7608 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7609 return offset;
7610 }
7611
7612 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7613
7614 switch(hnd_type){
7615 case SSL_HND_CLIENT_HELLO:
7616 /* KeyShareEntry client_shares<0..2^16-1> */
7617 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7618 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7619 return offset_end;
7620 }
7621 offset += 2;
7622 next_offset = offset + client_shares_length;
7623 const char *sep = " ";
7624 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7625 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7626 if (group_name) {
7627 proto_item_append_text(tree, "%s%s", sep, group_name);
7628 sep = ", ";
7629 }
7630 }
7631 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7632 return next_offset;
7633 }
7634 break;
7635 case SSL_HND_SERVER_HELLO:
7636 if (ssl) {
7637 ssl->has_key_share = true1;
7638 }
7639 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7640 if (group_name) {
7641 proto_item_append_text(tree, " %s", group_name);
7642 }
7643 break;
7644 case SSL_HND_HELLO_RETRY_REQUEST:
7645 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7646 offset += 2;
7647 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7648 proto_item_append_text(tree, " %s", group_name);
7649 break;
7650 default: /* no default */
7651 break;
7652 }
7653
7654 return offset;
7655}
7656
7657static int
7658ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7659 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7660 uint8_t hnd_type, SslDecryptSession *ssl)
7661{
7662 /* RFC 8446 Section 4.2.11
7663 * struct {
7664 * opaque identity<1..2^16-1>;
7665 * uint32 obfuscated_ticket_age;
7666 * } PskIdentity;
7667 * opaque PskBinderEntry<32..255>;
7668 * struct {
7669 * select (Handshake.msg_type) {
7670 * case client_hello:
7671 * PskIdentity identities<7..2^16-1>;
7672 * PskBinderEntry binders<33..2^16-1>;
7673 * case server_hello:
7674 * uint16 selected_identity;
7675 * };
7676 * } PreSharedKeyExtension;
7677 */
7678
7679 proto_tree *psk_tree;
7680
7681 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7682
7683 switch (hnd_type){
7684 case SSL_HND_CLIENT_HELLO: {
7685 uint32_t identities_length, identities_end, binders_length;
7686
7687 /* PskIdentity identities<7..2^16-1> */
7688 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7689 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7690 return offset_end;
7691 }
7692 offset += 2;
7693 identities_end = offset + identities_length;
7694
7695 while (offset < identities_end) {
7696 uint32_t identity_length;
7697 proto_tree *identity_tree;
7698
7699 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7700
7701 /* opaque identity<1..2^16-1> */
7702 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7703 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7704 return identities_end;
7705 }
7706 offset += 2;
7707 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7708
7709 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7710 offset += identity_length;
7711
7712 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7713 offset += 4;
7714
7715 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7716 }
7717 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7718 offset = identities_end;
7719 }
7720
7721 /* PskBinderEntry binders<33..2^16-1> */
7722 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7723 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7724 return offset_end;
7725 }
7726 offset += 2;
7727
7728 proto_item *binders_item;
7729 proto_tree *binders_tree;
7730 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7731 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7732 uint32_t binders_end = offset + binders_length;
7733 while (offset < binders_end) {
7734 uint32_t binder_length;
7735 proto_item *binder_item;
7736 proto_tree *binder_tree;
7737
7738 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7739 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7740
7741 /* opaque PskBinderEntry<32..255>; */
7742 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7743 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7744 return binders_end;
7745 }
7746 offset += 1;
7747 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7748
7749 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7750 offset += binder_length;
7751
7752 proto_item_set_end(binder_item, tvb, offset);
7753 }
7754 }
7755 break;
7756 case SSL_HND_SERVER_HELLO: {
7757 if (ssl) {
7758 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7759 ssl->has_psk = true1;
7760 }
7761 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7762 offset += 2;
7763 }
7764 break;
7765 default:
7766 break;
7767 }
7768
7769 return offset;
7770}
7771
7772static uint32_t
7773ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7774 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7775 uint8_t hnd_type, SslDecryptSession *ssl)
7776{
7777 /* RFC 8446 Section 4.2.10
7778 * struct {} Empty;
7779 * struct {
7780 * select (Handshake.msg_type) {
7781 * case new_session_ticket: uint32 max_early_data_size;
7782 * case client_hello: Empty;
7783 * case encrypted_extensions: Empty;
7784 * };
7785 * } EarlyDataIndication;
7786 */
7787 switch (hnd_type) {
7788 case SSL_HND_CLIENT_HELLO:
7789 /* Remember that early_data will follow the handshake. */
7790 if (ssl) {
7791 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7792 ssl->has_early_data = true1;
7793 }
7794 break;
7795 case SSL_HND_NEWSESSION_TICKET:
7796 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7797 offset += 4;
7798 break;
7799 default:
7800 break;
7801 }
7802 return offset;
7803}
7804
7805static uint16_t
7806tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7807{
7808 if (draft_version) {
7809 *draft_version = 0;
7810 }
7811 if (!is_dtls) {
7812 uint8_t tls13_draft = extract_tls13_draft_version(version);
7813 if (tls13_draft != 0) {
7814 /* This is TLS 1.3 (a draft version). */
7815 if (draft_version) {
7816 *draft_version = tls13_draft;
7817 }
7818 version = TLSV1DOT3_VERSION0x304;
7819 }
7820 if (version == 0xfb17 || version == 0xfb1a) {
7821 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7822 tls13_draft = (uint8_t)version;
7823 if (draft_version) {
7824 *draft_version = tls13_draft;
7825 }
7826 version = TLSV1DOT3_VERSION0x304;
7827 }
7828 }
7829
7830 switch (version) {
7831 case SSLV3_VERSION0x300:
7832 case TLSV1_VERSION0x301:
7833 case TLSV1DOT1_VERSION0x302:
7834 case TLSV1DOT2_VERSION0x303:
7835 case TLSV1DOT3_VERSION0x304:
7836 case TLCPV1_VERSION0x101:
7837 if (is_dtls)
7838 return SSL_VER_UNKNOWN0;
7839 break;
7840
7841 case DTLSV1DOT0_VERSION0xfeff:
7842 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7843 case DTLSV1DOT2_VERSION0xfefd:
7844 case DTLSV1DOT3_VERSION0xfefc:
7845 if (!is_dtls)
7846 return SSL_VER_UNKNOWN0;
7847 break;
7848
7849 default: /* invalid version number */
7850 return SSL_VER_UNKNOWN0;
7851 }
7852
7853 return version;
7854}
7855
7856static int
7857ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7858 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7859 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7860{
7861
7862 /* RFC 8446 Section 4.2.1
7863 * struct {
7864 * ProtocolVersion versions<2..254>; // ClientHello
7865 * } SupportedVersions;
7866 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7867 */
7868 uint32_t versions_length, next_offset;
7869 /* ProtocolVersion versions<2..254> */
7870 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7871 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7872 return offset_end;
7873 }
7874 offset++;
7875 next_offset = offset + versions_length;
7876
7877 unsigned version;
7878 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7879 uint8_t draft_version, max_draft_version = 0;
7880 const char *sep = " ";
7881 while (offset + 2 <= next_offset) {
7882 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7883 offset += 2;
7884
7885 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7886 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7887 sep = ", ";
7888 }
7889
7890 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7891 if (session->version == SSL_VER_UNKNOWN0) {
7892 if (lowest_version == SSL_VER_UNKNOWN0) {
7893 lowest_version = current_version;
7894 } else if (current_version != SSL_VER_UNKNOWN0) {
7895 if (!is_dtls) {
7896 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7897 } else {
7898 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7899 }
7900 }
7901 }
7902 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7903 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7904 /* The DTLS version numbers get mapped to "00" for unknown per
7905 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7906 * need to take the MIN instead of MAX here for DTLS.
7907 */
7908 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7909 }
7910 }
7911 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7912 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7913 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7914 }
7915 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7916 offset = next_offset;
7917 }
7918
7919 /* XXX remove this when draft 19 support is dropped,
7920 * this is only required for early data decryption. */
7921 if (max_draft_version) {
7922 session->tls13_draft_version = max_draft_version;
7923 }
7924
7925 return offset;
7926}
7927
7928static int
7929ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7930 packet_info *pinfo, proto_tree *tree,
7931 uint32_t offset, uint32_t offset_end)
7932{
7933 /* RFC 8446 Section 4.2.2
7934 * struct {
7935 * opaque cookie<1..2^16-1>;
7936 * } Cookie;
7937 */
7938 uint32_t cookie_length;
7939 /* opaque cookie<1..2^16-1> */
7940 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7941 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7942 return offset_end;
7943 }
7944 offset += 2;
7945
7946 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7947 offset += cookie_length;
7948
7949 return offset;
7950}
7951
7952static int
7953ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7954 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7955{
7956 /* RFC 8446 Section 4.2.9
7957 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7958 *
7959 * struct {
7960 * PskKeyExchangeMode ke_modes<1..255>;
7961 * } PskKeyExchangeModes;
7962 */
7963 uint32_t ke_modes_length, next_offset;
7964
7965 /* PskKeyExchangeMode ke_modes<1..255> */
7966 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7967 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7968 return offset_end;
7969 }
7970 offset++;
7971 next_offset = offset + ke_modes_length;
7972
7973 while (offset < next_offset) {
7974 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7975 offset++;
7976 }
7977
7978 return offset;
7979}
7980
7981static uint32_t
7982ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7983 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7984{
7985 /* RFC 8446 Section 4.2.4
7986 * opaque DistinguishedName<1..2^16-1>;
7987 * struct {
7988 * DistinguishedName authorities<3..2^16-1>;
7989 * } CertificateAuthoritiesExtension;
7990 */
7991 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7992}
7993
7994static int
7995ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7996 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7997{
7998 /* RFC 8446 Section 4.2.5
7999 * struct {
8000 * opaque certificate_extension_oid<1..2^8-1>;
8001 * opaque certificate_extension_values<0..2^16-1>;
8002 * } OIDFilter;
8003 * struct {
8004 * OIDFilter filters<0..2^16-1>;
8005 * } OIDFilterExtension;
8006 */
8007 proto_tree *subtree;
8008 uint32_t filters_length, oid_length, values_length, value_offset;
8009 asn1_ctx_t asn1_ctx;
8010 const char *oid, *name;
8011
8012 /* OIDFilter filters<0..2^16-1> */
8013 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8014 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8015 return offset_end;
8016 }
8017 offset += 2;
8018 offset_end = offset + filters_length;
8019
8020 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8021
8022 while (offset < offset_end) {
8023 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8024 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8025
8026 /* opaque certificate_extension_oid<1..2^8-1> */
8027 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8028 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8029 return offset_end;
8030 }
8031 offset++;
8032 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8033 hf->hf.hs_ext_oid_filters_oid, &oid);
8034 offset += oid_length;
8035
8036 /* Append OID to tree label */
8037 name = oid_resolved_from_string(pinfo->pool, oid);
8038 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8039
8040 /* opaque certificate_extension_values<0..2^16-1> */
8041 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8042 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8043 return offset_end;
8044 }
8045 offset += 2;
8046 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8047 if (values_length > 0) {
8048 value_offset = offset;
8049 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8050 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8051 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8052 }
8053 offset += values_length;
8054 }
8055
8056 return offset;
8057}
8058
8059static int
8060ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8061 packet_info *pinfo, proto_tree *tree,
8062 uint32_t offset, uint32_t offset_end)
8063{
8064 /* https://tools.ietf.org/html/rfc6066#section-3
8065 *
8066 * struct {
8067 * NameType name_type;
8068 * select (name_type) {
8069 * case host_name: HostName;
8070 * } name;
8071 * } ServerName;
8072 *
8073 * enum {
8074 * host_name(0), (255)
8075 * } NameType;
8076 *
8077 * opaque HostName<1..2^16-1>;
8078 *
8079 * struct {
8080 * ServerName server_name_list<1..2^16-1>
8081 * } ServerNameList;
8082 */
8083 proto_tree *server_name_tree;
8084 uint32_t list_length, server_name_length, next_offset;
8085
8086 /* The server SHALL include "server_name" extension with empty data. */
8087 if (offset == offset_end) {
8088 return offset;
8089 }
8090
8091 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8092
8093 /* ServerName server_name_list<1..2^16-1> */
8094 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8095 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8096 return offset_end;
8097 }
8098 offset += 2;
8099 next_offset = offset + list_length;
8100
8101 while (offset < next_offset) {
8102 uint32_t name_type;
8103 const char *server_name = NULL((void*)0);
8104 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8105 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8106 offset++;
8107
8108 /* opaque HostName<1..2^16-1> */
8109 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8110 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8111 return next_offset;
8112 }
8113 offset += 2;
8114
8115 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8116 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8117 pinfo->pool, (const uint8_t**)&server_name);
8118 offset += server_name_length;
8119 // Each type must only occur once, so we don't check for duplicates.
8120 if (name_type == 0) {
8121 proto_item_append_text(tree, " name=%s", server_name);
8122 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8123
8124 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8125 // Client Hello: Client (Src) -> Server (Dst)
8126 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
8127 case AT_IPv4:
8128 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
8129 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
8130 }
8131 break;
8132 case AT_IPv6:
8133 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
8134 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
8135 }
8136 break;
8137 }
8138 }
8139 }
8140 }
8141 return offset;
8142}
8143
8144static int
8145ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8146 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8147{
8148 unsigned ext_len = offset_end - offset;
8149 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8150 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8151 /* Save the Session Ticket such that it can be used as identifier for
8152 * restoring a previous Master Secret (in ChangeCipherSpec) */
8153 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8154 ssl->session_ticket.data, ext_len);
8155 ssl->session_ticket.data_len = ext_len;
8156 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8157 }
8158 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8159 tvb, offset, ext_len, ENC_NA0x00000000);
8160 return offset + ext_len;
8161}
8162
8163static int
8164ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8165 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8166 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8167{
8168 uint8_t cert_list_length;
8169 uint8_t cert_type;
8170 proto_tree *cert_list_tree;
8171 proto_item *ti;
8172
8173 switch(hnd_type){
8174 case SSL_HND_CLIENT_HELLO:
8175 cert_list_length = tvb_get_uint8(tvb, offset);
8176 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8177 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8178 offset += 1;
8179 if (offset_end - offset != (uint32_t)cert_list_length)
8180 return offset;
8181
8182 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8183 cert_list_length, ENC_NA0x00000000);
8184 proto_item_append_text(ti, " (%d)", cert_list_length);
8185
8186 /* make this a subtree */
8187 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8188
8189 /* loop over all point formats */
8190 while (cert_list_length > 0)
8191 {
8192 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8193 offset++;
8194 cert_list_length--;
8195 }
8196 break;
8197 case SSL_HND_SERVER_HELLO:
8198 case SSL_HND_ENCRYPTED_EXTENSIONS:
8199 case SSL_HND_CERTIFICATE:
8200 cert_type = tvb_get_uint8(tvb, offset);
8201 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8202 offset += 1;
8203 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8204 session->client_cert_type = cert_type;
8205 }
8206 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8207 session->server_cert_type = cert_type;
8208 }
8209 break;
8210 default: /* no default */
8211 break;
8212 }
8213
8214 return offset;
8215}
8216
8217static uint32_t
8218ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8219 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8220 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8221{
8222 uint32_t compress_certificate_algorithms_length, next_offset;
8223
8224 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8225 * enum {
8226 * zlib(1),
8227 * brotli(2),
8228 * (65535)
8229 * } CertificateCompressionAlgorithm;
8230 *
8231 * struct {
8232 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8233 * } CertificateCompressionAlgorithms;
8234 */
8235 switch (hnd_type) {
8236 case SSL_HND_CLIENT_HELLO:
8237 case SSL_HND_CERT_REQUEST:
8238 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8239 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8240 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8241 return offset_end;
8242 }
8243 offset += 1;
8244 next_offset = offset + compress_certificate_algorithms_length;
8245
8246 while (offset < next_offset) {
8247 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8248 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8249 offset += 2;
8250 }
8251 break;
8252 default:
8253 break;
8254 }
8255
8256 return offset;
8257}
8258
8259static uint32_t
8260ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8261 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8262 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8263{
8264 uint32_t key_parameters_length, next_offset;
8265 proto_item *p_ti;
8266 proto_tree *p_tree;
8267
8268 /* RFC 8472
8269 *
8270 * struct {
8271 * uint8 major;
8272 * uint8 minor;
8273 * } TB_ProtocolVersion;
8274 *
8275 * enum {
8276 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8277 * } TokenBindingKeyParameters;
8278 *
8279 * struct {
8280 * TB_ProtocolVersion token_binding_version;
8281 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8282 * } TokenBindingParameters;
8283 */
8284
8285 switch (hnd_type) {
8286 case SSL_HND_CLIENT_HELLO:
8287 case SSL_HND_SERVER_HELLO:
8288 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8289 offset += 1;
8290 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8291 offset += 1;
8292
8293 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8294 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8295 return offset_end;
8296 }
8297 offset += 1;
8298 next_offset = offset + key_parameters_length;
8299
8300 p_ti = proto_tree_add_none_format(tree,
8301 hf->hf.hs_ext_token_binding_key_parameters,
8302 tvb, offset, key_parameters_length,
8303 "Key parameters identifiers (%d identifier%s)",
8304 key_parameters_length,
8305 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8306 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8307
8308 while (offset < next_offset) {
8309 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8310 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8311 offset += 1;
8312 }
8313
8314 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8315 offset = next_offset;
8316 }
8317
8318 break;
8319 default:
8320 break;
8321 }
8322
8323 return offset;
8324}
8325
8326static uint32_t
8327ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8328 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8329 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8330{
8331 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8332 uint32_t next_offset;
8333
8334 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8335 *
8336 * Note: the following structures are not literally defined in the spec,
8337 * they instead use an ASCII diagram.
8338 *
8339 * struct {
8340 * uint16 id;
8341 * opaque value<0..2^16-1>;
8342 * } TransportParameter; // before draft -27
8343 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8344 *
8345 * struct {
8346 * opaque ipv4Address[4];
8347 * uint16 ipv4Port;
8348 * opaque ipv6Address[16];
8349 * uint16 ipv6Port;
8350 * opaque connectionId<0..18>;
8351 * opaque statelessResetToken[16];
8352 * } PreferredAddress;
8353 */
8354
8355 if (offset_end - offset >= 6 &&
8356 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8357 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8358 // Assume encoding of Transport Parameters draft -26 or older with at
8359 // least one transport parameter that has a valid length.
8360 use_varint_encoding = false0;
8361 }
8362
8363 if (use_varint_encoding) {
8364 next_offset = offset_end;
8365 } else {
8366 uint32_t quic_length;
8367 // Assume draft -26 or earlier.
8368 /* TransportParameter TransportParameters<0..2^16-1>; */
8369 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8370 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8371 return offset_end;
8372 }
8373 offset += 2;
8374 next_offset = offset + quic_length;
8375 }
8376
8377 while (offset < next_offset) {
8378 uint64_t parameter_type; /* 62-bit space */
8379 uint32_t parameter_length;
8380 proto_tree *parameter_tree;
8381 uint32_t parameter_end_offset;
8382 uint64_t value;
8383 uint32_t i;
8384 unsigned len = 0;
8385
8386 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8387 NULL((void*)0), "Parameter");
8388 /* TransportParameter ID and Length. */
8389 if (use_varint_encoding) {
8390 uint64_t parameter_length64;
8391 unsigned type_len = 0;
8392
8393 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8394 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8395 offset += type_len;
8396
8397 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8398 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8399 parameter_length = (uint32_t)parameter_length64;
8400 offset += len;
8401
8402 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8403 } else {
8404 parameter_type = tvb_get_ntohs(tvb, offset);
8405 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8406 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8407 offset += 2;
8408
8409 /* opaque value<0..2^16-1> */
8410 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8411 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8412 return next_offset;
8413 }
8414 offset += 2;
8415
8416 proto_item_set_len(parameter_tree, 4 + parameter_length);
8417 }
8418
8419 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8420 proto_item_append_text(parameter_tree, ": GREASE");
8421 } else {
8422 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8423 }
8424
8425 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8426 parameter_end_offset = offset + parameter_length;
8427
8428 /* Omit the value field if the parameter's length is 0. */
8429 if (parameter_length != 0) {
8430 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8431 tvb, offset, parameter_length, ENC_NA0x00000000);
8432 }
8433
8434 switch (parameter_type) {
8435 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8436 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8437 tvb, offset, parameter_length, ENC_NA0x00000000);
8438 offset += parameter_length;
8439 break;
8440 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8441 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8442 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8443 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8444 offset += len;
8445 break;
8446 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8447 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8448 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8449 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8450 offset += 16;
8451 break;
8452 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8453 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8454 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8455 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8456 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8457 offset += len;
8458 break;
8459 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8460 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8461 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8462 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8463 offset += len;
8464 break;
8465 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8466 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8467 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8468 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8469 offset += len;
8470 break;
8471 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8472 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8473 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8474 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8475 offset += len;
8476 break;
8477 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8478 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8479 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8480 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8481 offset += len;
8482 break;
8483 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8484 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8485 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8486 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8487 offset += len;
8488 break;
8489 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8490 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8491 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8492 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8493 offset += len;
8494 break;
8495 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8496 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8497 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8498 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8499 offset += len;
8500 break;
8501 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8502 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8503 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8504 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8505 offset += len;
8506 break;
8507 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8508 /* No Payload */
8509 break;
8510 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8511 uint32_t connectionid_length;
8512 quic_cid_t cid;
8513
8514 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8515 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8516 offset += 4;
8517 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8518 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8519 offset += 2;
8520 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8521 tvb, offset, 16, ENC_NA0x00000000);
8522 offset += 16;
8523 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8524 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8525 offset += 2;
8526 /* XXX - Should we add these addresses and ports as addresses that the client
8527 * is allowed / expected to migrate the server address to? Right now we don't
8528 * enforce that (see RFC 9000 Section 9, which implies that while the client
8529 * can migrate to whatever address it wants, it can only migrate the server
8530 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8531 */
8532
8533 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8534 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8535 break;
8536 }
8537 offset += 1;
8538
8539 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8540 tvb, offset, connectionid_length, ENC_NA0x00000000);
8541 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8542 cid.len = connectionid_length;
8543 // RFC 9000 5.1.1 "If the preferred_address transport
8544 // parameter is sent, the sequence number of the supplied
8545 // connection ID is 1."
8546 cid.seq_num = 1;
8547 // Multipath draft-07 "Also, the Path Identifier for the
8548 // connection ID specified in the "preferred address"
8549 // transport parameter is 0."
8550 cid.path_id = 0;
8551 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8552 quic_add_connection(pinfo, &cid);
8553 }
8554 offset += connectionid_length;
8555
8556 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8557 tvb, offset, 16, ENC_NA0x00000000);
8558 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8559 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8560 }
8561 offset += 16;
8562 }
8563 break;
8564 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8565 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8566 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8567 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8568 offset += len;
8569 break;
8570 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8571 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8572 tvb, offset, parameter_length, ENC_NA0x00000000);
8573 offset += parameter_length;
8574 break;
8575 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8576 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8577 tvb, offset, parameter_length, ENC_NA0x00000000);
8578 offset += parameter_length;
8579 break;
8580 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8581 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8582 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8583 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8584 offset += len;
8585 break;
8586 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8587 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8588 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8589 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8590 offset += len;
8591 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8592 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8593 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8594 offset += len;
8595 break;
8596 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8597 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8598 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8599 if (len > 0) {
8600 quic_add_loss_bits(pinfo, value);
8601 }
8602 offset += 1;
8603 break;
8604 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8605 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8606 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8607 offset += len;
8608 break;
8609 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8610 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8611 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8612 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8613 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8614 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8615 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8616 offset += len;
8617 break;
8618 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8619 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8620 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8621 offset += parameter_length;
8622 break;
8623 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8624 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8625 tvb, offset, parameter_length, ENC_NA0x00000000);
8626 offset += parameter_length;
8627 break;
8628 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8629 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8630 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8631 offset += 4;
8632 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8633 uint32_t versions_length;
8634
8635 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8636 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8637 offset += 1;
8638 for (i = 0; i < versions_length / 4; i++) {
8639 quic_proto_tree_add_version(tvb, parameter_tree,
8640 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8641 offset += 4;
8642 }
8643 }
8644 break;
8645 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8646 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8647 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8648 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8649 offset += len;
8650 break;
8651 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8652 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8653 tvb, offset, parameter_length, ENC_NA0x00000000);
8654 offset += parameter_length;
8655 break;
8656 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8657 /* This field was used for non-standard Google-specific parameters encoded as a
8658 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8659 * parameters. Report it as a bytes blob... */
8660 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8661 tvb, offset, parameter_length, ENC_NA0x00000000);
8662 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8663 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8664 tvb, offset, 4, ENC_NA0x00000000);
8665 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8666 offset += parameter_length;
8667 break;
8668 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8669 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8670 tvb, offset, parameter_length, ENC_NA0x00000000);
8671 offset += parameter_length;
8672 break;
8673 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8674 /* No Payload */
8675 break;
8676 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8677 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8678 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8679 offset += parameter_length;
8680 break;
8681 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8682 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8683 quic_proto_tree_add_version(tvb, parameter_tree,
8684 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8685 offset += 4;
8686 for (i = 4; i < parameter_length; i += 4) {
8687 quic_proto_tree_add_version(tvb, parameter_tree,
8688 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8689 offset += 4;
8690 }
8691 break;
8692 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8693 /* No Payload */
8694 quic_add_grease_quic_bit(pinfo);
8695 break;
8696 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8697 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8698 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8699 offset += parameter_length;
8700 break;
8701 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8702 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8703 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8704 if (value == 1) {
8705 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8706 }
8707 offset += parameter_length;
8708 break;
8709 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8710 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8711 /* No Payload */
8712 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8713 break;
8714 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8715 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8716 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8717 if (value > 1) {
8718 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8719 }
8720 /* multipath draft-07: "The value of the initial_max_paths
8721 * parameter MUST be at least 2." TODO: Expert Info? */
8722 offset += parameter_length;
8723 break;
8724 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8725 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8726 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8727 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8728 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8729 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8730 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8731 /* multipath draft-09 and later: "If an endpoint receives an
8732 * initial_max_path_id transport parameter with value 0, the
8733 * peer aims to enable the multipath extension without allowing
8734 * extra paths immediately."
8735 */
8736 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8737 offset += parameter_length;
8738 break;
8739 default:
8740 offset += parameter_length;
8741 /*TODO display expert info about unknown ? */
8742 break;
8743 }
8744
8745 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8746 /* Dissection did not end at expected location, fix it. */
8747 offset = parameter_end_offset;
8748 }
8749 }
8750
8751 return offset;
8752}
8753
8754typedef struct tls_ech_confirm {
8755 tvbuff_t *confirm_tvb;
8756 proto_item *parent_item;
8757} tls_ech_confirm_t;
8758
8759static int
8760ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8761 proto_tree *tree, uint32_t offset,
8762 SslSession *session, SslDecryptSession *ssl,
8763 bool_Bool from_server, bool_Bool is_hrr)
8764{
8765 uint8_t sessid_length;
8766 proto_tree *rnd_tree;
8767 proto_tree *ti_rnd;
8768 uint8_t draft_version = session->tls13_draft_version;
8769
8770 if (ssl) {
8771 StringInfo *rnd;
8772 if (from_server)
8773 rnd = &ssl->server_random;
8774 else
8775 rnd = &ssl->client_random;
8776
8777 /* save provided random for later keyring generation */
8778 tvb_memcpy(tvb, rnd->data, offset, 32);
8779 rnd->data_len = 32;
8780 if (from_server)
8781 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8782 else
8783 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8784 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8785 from_server ? "SERVER" : "CLIENT", ssl->state);
8786
8787 if (is_hrr) {
8788 ssl->state |= SSL_HELLO_RETRY_REQUEST(1<<14);
8789 }
8790 }
8791
8792 if (!from_server && session->client_random.data_len == 0) {
8793 session->client_random.data_len = 32;
8794 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8795 }
8796
8797 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8798
8799 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8800
8801 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8802 /* show the time */
8803 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8804 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8805 offset += 4;
8806
8807 /* show the random bytes */
8808 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8809 tvb, offset, 28, ENC_NA0x00000000);
8810 offset += 28;
8811 } else {
8812 if (is_hrr) {
8813 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8814 } else if (from_server && (session->ech || (ssl && !tls_transcript_is_empty(&ssl->ech_transcript)))) {
8815 /* We can't calculate the transcript hash until we have the Cipher
8816 * Suite, which comes later, so save this so we can show it in the
8817 * tree on the first pass. */
8818 tls_ech_confirm_t *ech_confirm = wmem_new(pinfo->pool, tls_ech_confirm_t)((tls_ech_confirm_t*)wmem_alloc((pinfo->pool), sizeof(tls_ech_confirm_t
)));
8819 ech_confirm->parent_item = ti_rnd;
8820 ech_confirm->confirm_tvb = tvb_new_subset_length(tvb, offset + 24, 8);
8821 /* We can use a hf id instead of a proto id (they're allocated from
8822 * the same pool and the latter are just a subset of the former),
8823 * which is convenient as we don't seem to store the proto id (TLS v
8824 * DTLS) in ssl_common_dissect_t or anywhere else. Arguably it
8825 * relies on undocumented behavior, though using it as the key too
8826 * means that the chance of collision is ~zero even if behavior
8827 * changes.
8828 */
8829 p_add_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm, ech_confirm);
8830 }
8831
8832 offset += 32;
8833 }
8834
8835 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8836 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8837 /* show the session id (length followed by actual Session ID) */
8838 sessid_length = tvb_get_uint8(tvb, offset);
8839 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8840 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8841 offset++;
8842
8843 if (ssl) {
8844 /* save the authoritative SID for later use in ChangeCipherSpec.
8845 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8846 * save more, so ignore larger ones. To support ECH, also save
8847 * the SID from the ClientHelloOuter. */
8848 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8849 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8850 ssl->session_id.data_len = sessid_length;
8851 }
8852 }
8853 if (sessid_length > 0) {
8854 proto_tree_add_item(tree, hf->hf.hs_session_id,
8855 tvb, offset, sessid_length, ENC_NA0x00000000);
8856 offset += sessid_length;
8857 }
8858 }
8859
8860 return offset;
8861}
8862
8863static int
8864ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8865 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8866 bool_Bool has_length)
8867{
8868 /* TLS 1.2/1.3 status_request Client Hello Extension.
8869 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8870 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8871 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8872 * struct {
8873 * CertificateStatusType status_type;
8874 * uint16 request_length; // for status_request_v2
8875 * select (status_type) {
8876 * case ocsp: OCSPStatusRequest;
8877 * case ocsp_multi: OCSPStatusRequest;
8878 * } request;
8879 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8880 *
8881 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8882 * struct {
8883 * ResponderID responder_id_list<0..2^16-1>;
8884 * Extensions request_extensions;
8885 * } OCSPStatusRequest;
8886 * opaque ResponderID<1..2^16-1>;
8887 * opaque Extensions<0..2^16-1>;
8888 */
8889 unsigned cert_status_type;
8890
8891 cert_status_type = tvb_get_uint8(tvb, offset);
8892 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8893 tvb, offset, 1, ENC_NA0x00000000);
8894 offset++;
8895
8896 if (has_length) {
8897 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8898 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8899 offset += 2;
8900 }
8901
8902 switch (cert_status_type) {
8903 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8904 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8905 {
8906 uint32_t responder_id_list_len;
8907 uint32_t request_extensions_len;
8908
8909 /* ResponderID responder_id_list<0..2^16-1> */
8910 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8911 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8912 return offset_end;
8913 }
8914 offset += 2;
8915 if (responder_id_list_len != 0) {
8916 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8917 tvb, offset, responder_id_list_len,
8918 "Responder ID list is not implemented, contact Wireshark"
8919 " developers if you want this to be supported");
8920 }
8921 offset += responder_id_list_len;
8922
8923 /* opaque Extensions<0..2^16-1> */
8924 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8925 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8926 return offset_end;
8927 }
8928 offset += 2;
8929 if (request_extensions_len != 0) {
8930 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8931 tvb, offset, request_extensions_len,
8932 "Request Extensions are not implemented, contact"
8933 " Wireshark developers if you want this to be supported");
8934 }
8935 offset += request_extensions_len;
8936 break;
8937 }
8938 }
8939
8940 return offset;
8941}
8942
8943static unsigned
8944ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8945 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8946{
8947 /* https://tools.ietf.org/html/rfc6961#section-2.2
8948 * struct {
8949 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8950 * } CertificateStatusRequestListV2;
8951 */
8952 uint32_t req_list_length, next_offset;
8953
8954 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8955 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8956 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8957 return offset_end;
8958 }
8959 offset += 2;
8960 next_offset = offset + req_list_length;
8961
8962 while (offset < next_offset) {
8963 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8964 }
8965
8966 return offset;
8967}
8968
8969static uint32_t
8970tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8971 uint32_t offset, uint32_t offset_end)
8972{
8973 uint32_t response_length;
8974 proto_item *ocsp_resp;
8975 proto_tree *ocsp_resp_tree;
8976 asn1_ctx_t asn1_ctx;
8977
8978 /* opaque OCSPResponse<1..2^24-1>; */
8979 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8980 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8981 return offset_end;
8982 }
8983 offset += 3;
8984
8985 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8986 response_length, ENC_BIG_ENDIAN0x00000000);
8987 proto_item_set_text(ocsp_resp, "OCSP Response");
8988 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8989 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8990 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8991 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8992 }
8993 offset += response_length;
8994
8995 return offset;
8996}
8997
8998uint32_t
8999tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9000 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9001{
9002 /* TLS 1.2 "CertificateStatus" handshake message.
9003 * TLS 1.3 "status_request" Certificate extension.
9004 * struct {
9005 * CertificateStatusType status_type;
9006 * select (status_type) {
9007 * case ocsp: OCSPResponse;
9008 * case ocsp_multi: OCSPResponseList; // status_request_v2
9009 * } response;
9010 * } CertificateStatus;
9011 * opaque OCSPResponse<1..2^24-1>;
9012 * struct {
9013 * OCSPResponse ocsp_response_list<1..2^24-1>;
9014 * } OCSPResponseList; // status_request_v2
9015 */
9016 uint32_t status_type, resp_list_length, next_offset;
9017
9018 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9019 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9020 offset += 1;
9021
9022 switch (status_type) {
9023 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9024 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9025 break;
9026
9027 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9028 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9029 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9030 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9031 return offset_end;
9032 }
9033 offset += 3;
9034 next_offset = offset + resp_list_length;
9035
9036 while (offset < next_offset) {
9037 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9038 }
9039 break;
9040 }
9041
9042 return offset;
9043}
9044
9045static unsigned
9046ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9047 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9048 wmem_strbuf_t *ja3)
9049{
9050 /* RFC 8446 Section 4.2.7
9051 * enum { ..., (0xFFFF) } NamedGroup;
9052 * struct {
9053 * NamedGroup named_group_list<2..2^16-1>
9054 * } NamedGroupList;
9055 *
9056 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9057 * the extension itself from "elliptic_curves" to "supported_groups".
9058 */
9059 uint32_t groups_length, next_offset;
9060 proto_tree *groups_tree;
9061 proto_item *ti;
9062 char *ja3_dash = "";
9063
9064 /* NamedGroup named_group_list<2..2^16-1> */
9065 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9066 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9067 return offset_end;
9068 }
9069 offset += 2;
9070 next_offset = offset + groups_length;
9071
9072 ti = proto_tree_add_none_format(tree,
9073 hf->hf.hs_ext_supported_groups,
9074 tvb, offset, groups_length,
9075 "Supported Groups (%d group%s)",
9076 groups_length / 2,
9077 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9078
9079 /* make this a subtree */
9080 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9081
9082 if (ja3) {
9083 wmem_strbuf_append_c(ja3, ',');
9084 }
9085 /* loop over all groups */
9086 while (offset + 2 <= next_offset) {
9087 uint32_t ext_supported_group;
9088
9089 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9090 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9091 offset += 2;
9092 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
9093 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9094 ja3_dash = "-";
9095 }
9096 }
9097 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9098 offset = next_offset;
9099 }
9100
9101 return offset;
9102}
9103
9104static int
9105ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9106 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9107{
9108 uint8_t ecpf_length;
9109 proto_tree *ecpf_tree;
9110 proto_item *ti;
9111
9112 ecpf_length = tvb_get_uint8(tvb, offset);
9113 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9114 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9115
9116 offset += 1;
9117 ti = proto_tree_add_none_format(tree,
9118 hf->hf.hs_ext_ec_point_formats,
9119 tvb, offset, ecpf_length,
9120 "Elliptic curves point formats (%d)",
9121 ecpf_length);
9122
9123 /* make this a subtree */
9124 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9125
9126 if (ja3) {
9127 wmem_strbuf_append_c(ja3, ',');
9128 }
9129
9130 /* loop over all point formats */
9131 while (ecpf_length > 0)
9132 {
9133 uint32_t ext_ec_point_format;
9134
9135 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9136 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9137 offset++;
9138 ecpf_length--;
9139 if (ja3) {
9140 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9141 if (ecpf_length > 0) {
9142 wmem_strbuf_append_c(ja3, '-');
9143 }
9144 }
9145 }
9146
9147 return offset;
9148}
9149
9150static int
9151ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9152 packet_info *pinfo, proto_tree *tree,
9153 uint32_t offset, uint32_t next_offset)
9154{
9155 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9156 * opaque srp_I<1..2^8-1>;
9157 */
9158 uint32_t username_len;
9159
9160 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9161 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9162 return next_offset;
9163 }
9164 offset++;
9165
9166 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9167 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9168 offset += username_len;
9169
9170 return offset;
9171}
9172
9173static uint32_t
9174tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9175 uint32_t offset, uint32_t offset_end, uint16_t version)
9176{
9177 /* https://tools.ietf.org/html/rfc6962#section-3.2
9178 * enum { v1(0), (255) } Version;
9179 * struct {
9180 * opaque key_id[32];
9181 * } LogID;
9182 * opaque CtExtensions<0..2^16-1>;
9183 * struct {
9184 * Version sct_version;
9185 * LogID id;
9186 * uint64 timestamp;
9187 * CtExtensions extensions;
9188 * digitally-signed struct { ... };
9189 * } SignedCertificateTimestamp;
9190 */
9191 uint32_t sct_version;
9192 uint64_t sct_timestamp_ms;
9193 nstime_t sct_timestamp;
9194 uint32_t exts_len;
9195 const char *log_name;
9196
9197 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9198 offset++;
9199 if (sct_version != 0) {
9200 // TODO expert info about unknown SCT version?
9201 return offset;
9202 }
9203 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9204 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9205 proto_item_append_text(tree, " (%s)", log_name);
9206 offset += 32;
9207 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9208 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9209 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9210 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9211 offset += 8;
9212 /* opaque CtExtensions<0..2^16-1> */
9213 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9214 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9215 return offset_end;
9216 }
9217 offset += 2;
9218 if (exts_len > 0) {
9219 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9220 offset += exts_len;
9221 }
9222 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9223 hf->hf.sct_sct_signature_length,
9224 hf->hf.sct_sct_signature);
9225 return offset;
9226}
9227
9228uint32_t
9229tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9230 uint32_t offset, uint32_t offset_end, uint16_t version)
9231{
9232 /* https://tools.ietf.org/html/rfc6962#section-3.3
9233 * opaque SerializedSCT<1..2^16-1>;
9234 * struct {
9235 * SerializedSCT sct_list <1..2^16-1>;
9236 * } SignedCertificateTimestampList;
9237 */
9238 uint32_t list_length, sct_length, next_offset;
9239 proto_tree *subtree;
9240
9241 /* SerializedSCT sct_list <1..2^16-1> */
9242 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9243 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9244 return offset_end;
9245 }
9246 offset += 2;
9247
9248 while (offset < offset_end) {
9249 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9250
9251 /* opaque SerializedSCT<1..2^16-1> */
9252 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9253 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9254 return offset_end;
9255 }
9256 offset += 2;
9257 next_offset = offset + sct_length;
9258 proto_item_set_len(subtree, 2 + sct_length);
9259 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9260 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9261 offset = next_offset;
9262 }
9263 }
9264
9265 return offset;
9266}
9267
9268static int
9269dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9270 proto_tree *tree, uint32_t offset)
9271{
9272 uint32_t kdf_id, aead_id;
9273 proto_item *cs_ti;
9274 proto_tree *cs_tree;
9275
9276 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9277 tvb, offset, 4, ENC_NA0x00000000);
9278 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9279
9280 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9281 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9282 offset += 2;
9283 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9284 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9285 offset += 2;
9286
9287 proto_item_append_text(cs_ti, ": %s/%s",
9288 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9289 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9290 return offset;
9291}
9292
9293static int
9294dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9295 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9296 uint32_t *config_id)
9297{
9298 uint32_t length, cipher_suite_length;
9299 proto_item *kc_ti, *css_ti;
9300 proto_tree *kc_tree, *css_tree;
9301 uint32_t original_offset = offset, next_offset;
9302
9303 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9304 tvb, offset, -1, ENC_NA0x00000000);
9305 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9306
9307 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9308 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9309 offset += 1;
9310 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9311 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9312 offset += 2;
9313 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9314 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9315 offset += 2;
9316 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9317 tvb, offset, length, ENC_NA0x00000000);
9318 offset += length;
9319
9320 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9321 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9322 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9323 return offset_end;
9324 }
9325 offset += 2;
9326 next_offset = offset + cipher_suite_length;
9327
9328 css_ti = proto_tree_add_none_format(kc_tree,
9329 hf->hf.ech_hpke_keyconfig_cipher_suites,
9330 tvb, offset, cipher_suite_length,
9331 "Cipher Suites (%d suite%s)",
9332 cipher_suite_length / 4,
9333 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9334 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9335
9336
9337 while (offset + 4 <= next_offset) {
9338 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9339 }
9340
9341 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9342 offset = next_offset;
9343 }
9344
9345 proto_item_set_len(kc_ti, offset - original_offset);
9346
9347 return offset;
9348}
9349
9350static int
9351dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9352 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9353 const uint8_t **public_name, uint32_t *config_id)
9354{
9355 uint32_t public_name_length, extensions_length, next_offset;
9356
9357 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9358 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9359 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9360 offset += 1;
9361 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9362 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9363 offset += 1;
9364 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9365 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9366 offset += public_name_length;
9367
9368 /* Extension extensions<0..2^16-1>; */
9369 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9370 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9371 return offset_end;
9372 }
9373 offset += 2;
9374 next_offset = offset + extensions_length;
9375
9376 if (extensions_length > 0) {
9377 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9378 tvb, offset, extensions_length, ENC_NA0x00000000);
9379 }
9380 offset += extensions_length;
9381
9382 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9383 offset = next_offset;
9384 }
9385
9386 return offset;
9387}
9388
9389static int
9390dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9391 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9392{
9393 uint32_t version, length;
9394 proto_item *ech_ti;
9395 proto_tree *ech_tree;
9396 const uint8_t *public_name = NULL((void*)0);
9397 uint32_t config_id = 0;
9398
9399 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9400 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9401
9402 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9403 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9404 offset += 2;
9405 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9406 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9407 offset += 2;
9408
9409 proto_item_set_len(ech_ti, 4 + length);
9410
9411 switch(version) {
9412 case 0xfe0d:
9413 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, MIN(offset_end, offset + length)(((offset_end) < (offset + length)) ? (offset_end) : (offset
+ length)), &public_name, &config_id);
9414 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9415 break;
9416
9417 default:
9418 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9419 }
9420
9421 return 4 + length;
9422}
9423
9424uint32_t
9425ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9426 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9427{
9428 uint32_t echconfiglist_length, next_offset;
9429
9430 /* ECHConfig ECHConfigList<1..2^16-1>; */
9431 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9432 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9433 return offset_end;
9434 }
9435 offset += 2;
9436 next_offset = offset + echconfiglist_length;
9437
9438 while (offset < next_offset) {
9439 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9440 }
9441
9442 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9443 offset = next_offset;
9444 }
9445
9446 return offset;
9447}
9448
9449static uint32_t
9450ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9451 uint32_t offset, uint32_t offset_end)
9452{
9453 uint32_t ext_length, next_offset;
9454 proto_tree *ext_tree;
9455 proto_item *ti;
9456
9457 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9458 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9459 return offset_end;
9460 }
9461 offset += 1;
9462 next_offset = offset + ext_length;
9463
9464 ti = proto_tree_add_none_format(tree,
9465 hf->hf.hs_ext_ech_outer_ext,
9466 tvb, offset, ext_length,
9467 "Outer Extensions (%d extension%s)",
9468 ext_length / 2,
9469 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9470
9471 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9472
9473 while (offset + 2 <= next_offset) {
9474 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9475 offset += 2;
9476 }
9477
9478 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9479 offset = next_offset;
9480 }
9481
9482 return offset;
9483}
9484
9485static uint32_t
9486// NOLINTNEXTLINE(misc-no-recursion)
9487ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9488 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9489 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9490{
9491 uint32_t ch_type, length;
9492 proto_item *ti, *payload_ti;
9493 proto_tree *retry_tree, *payload_tree;
9494 uint32_t hello_length = tvb_reported_length(tvb);
9495
9496 switch (hnd_type) {
9497 case SSL_HND_CLIENT_HELLO:
9498 /*
9499 * enum { outer(0), inner(1) } ECHClientHelloType;
9500 *
9501 * struct {
9502 * ECHClientHelloType type;
9503 * select (ECHClientHello.type) {
9504 * case outer:
9505 * HpkeSymmetricCipherSuite cipher_suite;
9506 * uint8 config_id;
9507 * opaque enc<0..2^16-1>;
9508 * opaque payload<1..2^16-1>;
9509 * case inner:
9510 * Empty;
9511 * };
9512 * } ECHClientHello;
9513 */
9514
9515 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9516 offset += 1;
9517 switch (ch_type) {
9518 case 0: /* outer */
9519 if (ssl && session->first_ch_ech_frame == 0) {
9520 session->first_ch_ech_frame = pinfo->num;
9521 }
9522 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9523 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9524 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9525
9526 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9527 uint8_t config_id = tvb_get_uint8(tvb, offset);
9528 offset += 1;
9529 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9530 offset += 2;
9531 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9532 offset += length;
9533 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9534 offset += 2;
9535 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9536 offset += length;
9537
9538 /* XXX - We could save the decrypted Client Hello instead of
9539 * recalculating it every pass, similar to what is done with
9540 * normal encrypted records. Normally there shouldn't be many
9541 * ECH so it doesn't make much difference either way. */
9542 if (!mk_map) {
9543 break;
9544 }
9545 if (session->client_random.data_len == 0) {
9546 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9547 break;
9548 }
9549 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9550 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9551 if (!ech_secret || !ech_config) {
9552 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9553 G_STRFUNC((const char*) (__func__)));
9554 break;
9555 }
9556
9557 if (hpke_hkdf_len(kdf_id) == 0) {
9558 ssl_debug_printf("Unsupported KDF\n");
9559 break;
9560 }
9561
9562 if (hpke_aead_key_len(aead_id) == 0) {
9563 ssl_debug_printf("Unsupported AEAD\n");
9564 break;
9565 }
9566
9567 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9568
9569 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9570 if (length < aead_auth_tag_len) {
9571 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9572 break;
9573 }
9574 unsigned decrypted_len = length - aead_auth_tag_len;
9575
9576 uint16_t version = pntohu16(ech_config->data);
9577 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9578 ssl_debug_printf("Unexpected version in ECH Config\n");
9579 break;
9580 }
9581 uint32_t ech_config_offset = 2;
9582 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9583 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9584 break;
9585 }
9586 ech_config_offset += 2;
9587 if (*(ech_config->data + ech_config_offset) != config_id) {
9588 ssl_debug_printf("ECH Config version mismatch\n");
9589 break;
9590 }
9591 ech_config_offset += 1;
9592 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9593 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9594 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9595 GByteArray *info = g_byte_array_new();
9596 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9597 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9598 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9599 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9600 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9601 key, base_nonce)) {
9602 g_byte_array_free(info, TRUE(!(0)));
9603 break;
9604 }
9605 g_byte_array_free(info, TRUE(!(0)));
9606 gcry_cipher_hd_t cipher;
9607 if (hpke_setup_aead(&cipher, aead_id, key) ||
9608 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9609 gcry_cipher_close(cipher);
9610 break;
9611 }
9612 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9613 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9614 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9615 memset(ech_aad + offset - length, 0, length);
9616 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9617 gcry_cipher_close(cipher);
9618 wmem_free(NULL((void*)0), ech_aad);
9619 break;
9620 }
9621 wmem_free(NULL((void*)0), ech_aad);
9622 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9623 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9624 gcry_cipher_close(cipher);
9625 break;
9626 }
9627 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9628 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9629 gcry_cipher_close(cipher);
9630 break;
9631 }
9632 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9633 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9634 gcry_cipher_close(cipher);
9635 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9636 payload + decrypted_len, aead_auth_tag_len)) {
9637 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9638 } else {
9639 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9640 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9641 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9642 if (ssl) {
9643 /* Note the Outer Client Random for Inject TLS Secrets */
9644 tls_save_crandom(ssl, mk_map);
9645
9646 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9647 /* Build ClientHelloInner here and then add it to the
9648 * transcript, which might only keep the digest state. */
9649 unsigned char *inner = (unsigned char*)wmem_alloc(pinfo->pool, hello_length + 4);
9650 uint32_t inner_len;
9651 inner[0] = SSL_HND_CLIENT_HELLO;
9652 inner[1] = 0;
9653 /* Copy ClientHelloInner up to the legacy_session_id field. */
9654 tvb_memcpy(ech_tvb, inner + 4, 0, 34);
9655 inner_len = 38;
9656 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9657 inner[inner_len] = ssl->session_id.data_len;
9658 inner_len++;
9659 memcpy(&inner[inner_len], ssl->session_id.data, ssl->session_id.data_len);
9660 inner_len += ssl->session_id.data_len;
9661 /* Skip past the legacy_session_id field in ClientHelloInner
9662 * (which should be the empty string, i.e. just a 0 size.) */
9663 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9664 /* Copy the Cipher Suites from ClientHelloInner. */
9665 tvb_memcpy(ech_tvb, inner + inner_len, ech_offset,
9666 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9667 inner_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9668 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9669 /* Copy the Compression Methods */
9670 tvb_memcpy(ech_tvb, inner + inner_len, ech_offset,
9671 1 + tvb_get_uint8(ech_tvb, ech_offset));
9672 inner_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9673 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9674 /* Now replace extensions in ech_outer_extensions with the
9675 * data from ClientHelloOuter. */
9676 uint32_t ech_extensions_len_offset = inner_len;
9677 inner_len += 2;
9678 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9679 ech_offset += 2;
9680 bool_Bool ech_outer_extensions_found = false0;
9681 while (extensions_end - ech_offset >= 4) {
9682 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9683 ech_offset += 2;
9684 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9685 ech_offset += 2;
9686 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9687 /* Copy this extension directly */
9688 tvb_memcpy(ech_tvb, inner + inner_len,
9689 ech_offset - 4, 4 + ext_len);
9690 inner_len += 4 + ext_len;
9691 ech_offset += ext_len;
9692 } else if (ext_len > 0) {
9693 if (ech_outer_extensions_found) {
9694 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9695 /* This could lead to a buffer overflow by
9696 * making the post-copying ClientHelloInner
9697 * longer than ClientHelloOuter and is
9698 * illegal, so skip this and don't copy. */
9699 ech_offset += ext_len;
9700 continue;
9701 }
9702 ech_outer_extensions_found = true1;
9703 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9704 ech_offset += 1;
9705 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9706 /* In ClientHelloOuter, skip past the legacy_session_id */
9707 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9708 /* Skip past Cipher Suites */
9709 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9710 /* Skip past Compression Methods */
9711 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9712 /* Now at the start of ClientHelloOuter's extensions */
9713 while (ech_outer_extensions_end - ech_offset >= 2) {
9714 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9715 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9716 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9717 /* This could lead to a buffer overflow by
9718 * making the post-copying ClientHelloInner
9719 * longer than ClientHelloOuter and is
9720 * illegal, so don't copy. */
9721 break;
9722 }
9723 bool_Bool found = false0;
9724 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9725 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9726 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9727 if (ext_type == outer_ext_type) {
9728 tvb_memcpy(tvb, inner + inner_len, outer_offset,
9729 4 + outer_ext_len);
9730 inner_len += 4 + outer_ext_len;
9731 outer_offset += 4 + outer_ext_len;
9732 found = true1;
9733 break;
9734 } else {
9735 outer_offset += 4 + outer_ext_len;
9736 }
9737 }
9738 if (!found) {
9739 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9740 }
9741 ech_offset += 2;
9742 }
9743 }
9744 }
9745 uint16_t ech_extensions_len = inner_len - ech_extensions_len_offset - 2;
9746 phtonu16(&inner[ech_extensions_len_offset], ech_extensions_len);
9747 phtonu16(&inner[2], inner_len - 4);
9748 tls_transcript_add(&ssl->ech_transcript, inner, inner_len);
9749 }
9750 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9751 ssl, NULL((void*)0), mk_map);
9752 if (ech_padding_begin < decrypted_len) {
9753 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9754 ENC_NA0x00000000);
9755 }
9756 }
9757
9758 break;
9759 case 1: /* inner */
9760 break;
9761 }
9762 break;
9763
9764 case SSL_HND_ENCRYPTED_EXTENSIONS:
9765 /*
9766 * struct {
9767 * ECHConfigList retry_configs;
9768 * } ECHEncryptedExtensions;
9769 */
9770
9771 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9772 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9773 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9774 break;
9775
9776 case SSL_HND_HELLO_RETRY_REQUEST:
9777 /*
9778 * struct {
9779 * opaque confirmation[8];
9780 * } ECHHelloRetryRequest;
9781 */
9782
9783 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9784 if (session->ech) {
9785 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9786 proto_item_set_generated(ti);
9787 if (tvb_memeql(tvb, offset, session->hrr_ech_confirmation, 8) != 0) {
9788 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9789 } else {
9790 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9791 }
9792 }
9793 offset += 8;
9794 break;
9795 }
9796
9797 return offset;
9798}
9799
9800static uint32_t
9801ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9802 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9803 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9804{
9805 uint32_t record_digest_length, encrypted_sni_length;
9806
9807 switch (hnd_type) {
9808 case SSL_HND_CLIENT_HELLO:
9809 /*
9810 * struct {
9811 * CipherSuite suite;
9812 * KeyShareEntry key_share;
9813 * opaque record_digest<0..2^16-1>;
9814 * opaque encrypted_sni<0..2^16-1>;
9815 * } ClientEncryptedSNI;
9816 */
9817 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9818 offset += 2;
9819 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9820
9821 /* opaque record_digest<0..2^16-1> */
9822 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9823 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9824 return offset_end;
9825 }
9826 offset += 2;
9827 if (record_digest_length > 0) {
9828 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9829 offset += record_digest_length;
9830 }
9831
9832 /* opaque encrypted_sni<0..2^16-1> */
9833 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9834 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9835 return offset_end;
9836 }
9837 offset += 2;
9838 if (encrypted_sni_length > 0) {
9839 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9840 offset += encrypted_sni_length;
9841 }
9842 break;
9843
9844 case SSL_HND_ENCRYPTED_EXTENSIONS:
9845 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9846 offset += 16;
9847 break;
9848 }
9849
9850 return offset;
9851}
9852/** TLS Extensions (in Client Hello and Server Hello). }}} */
9853
9854/* Connection ID dissection. {{{ */
9855static uint32_t
9856ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9857 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9858 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9859{
9860 /* keep track of the decrypt session only for the first pass */
9861 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9862 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9863 *session_cidl = cidl;
9864 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9865 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9866 if (ssl) {
9867 ssl_add_session_by_cid(ssl);
9868 }
9869 }
9870
9871 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9872 tvb, offset, 1, ENC_NA0x00000000);
9873 offset++;
9874
9875 if (cidl > 0) {
9876 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9877 tvb, offset, cidl, ENC_NA0x00000000);
9878 offset += cidl;
9879 }
9880
9881 return offset;
9882}
9883
9884static uint32_t
9885ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9886 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9887 SslSession *session, SslDecryptSession *ssl)
9888{
9889 uint8_t cidl = tvb_get_uint8(tvb, offset);
9890
9891 switch (hnd_type) {
9892 case SSL_HND_CLIENT_HELLO:
9893 session->client_cid_len_present = true1;
9894 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9895 cidl, &session->client_cid, &session->client_cid_len);
9896 case SSL_HND_SERVER_HELLO:
9897 session->server_cid_len_present = true1;
9898 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9899 cidl, &session->server_cid, &session->server_cid_len);
9900 default:
9901 return offset;
9902 }
9903} /* }}} */
9904
9905/* Trusted CA dissection. {{{ */
9906static uint32_t
9907ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9908 uint32_t offset, uint32_t offset_end)
9909{
9910 proto_item *ti;
9911 proto_tree *subtree;
9912 uint32_t keys_length, next_offset;
9913
9914 /*
9915 * struct {
9916 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9917 * } TrustedAuthorities;
9918 *
9919 * struct {
9920 * IdentifierType identifier_type;
9921 * select (identifier_type) {
9922 * case pre_agreed: struct {};
9923 * case key_sha1_hash: SHA1Hash;
9924 * case x509_name: DistinguishedName;
9925 * case cert_sha1_hash: SHA1Hash;
9926 * } identifier;
9927 * } TrustedAuthority;
9928 *
9929 * enum {
9930 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9931 * cert_sha1_hash(3), (255)
9932 * } IdentifierType;
9933 *
9934 * opaque DistinguishedName<1..2^16-1>;
9935 *
9936 */
9937
9938
9939 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9940 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9941 0, UINT16_MAX(65535)))
9942 {
9943 return offset_end;
9944 }
9945 offset += 2;
9946 next_offset = offset + keys_length;
9947
9948 if (keys_length > 0)
9949 {
9950 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9951 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9952 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9953
9954 while (offset < next_offset)
9955 {
9956 uint32_t identifier_type;
9957 proto_tree *trusted_key_tree;
9958 proto_item *trusted_key_item;
9959 asn1_ctx_t asn1_ctx;
9960 uint32_t key_len = 0;
9961
9962 identifier_type = tvb_get_uint8(tvb, offset);
9963
9964 // Use 0 as length for now as we'll only know the size when we decode the identifier
9965 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9966 offset, 0, "Trusted CA Key");
9967 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9968
9969 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9970 offset, 1, identifier_type);
9971 offset++;
9972
9973 /*
9974 * enum {
9975 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9976 * cert_sha1_hash(3), (255)
9977 * } IdentifierType;
9978 */
9979 switch (identifier_type)
9980 {
9981 case 0:
9982 key_len = 0;
9983 break;
9984 case 2:
9985 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9986
9987 uint32_t name_length;
9988 /* opaque DistinguishedName<1..2^16-1> */
9989 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9990 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9991 return next_offset;
9992 }
9993 offset += 2;
9994
9995 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9996 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9997 offset += name_length;
9998 break;
9999 case 1:
10000 case 3:
10001 key_len = 20;
10002 /* opaque SHA1Hash[20]; */
10003 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
10004 offset, 20, ENC_NA0x00000000);
10005 break;
10006
10007 default:
10008 key_len = 0;
10009 /*TODO display expert info about unknown ? */
10010 break;
10011 }
10012 proto_item_set_len(trusted_key_item, 1 + key_len);
10013 offset += key_len;
10014 }
10015 }
10016
10017 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10018 {
10019 offset = next_offset;
10020 }
10021
10022 return offset;
10023} /* }}} */
10024
10025
10026/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10027bool_Bool
10028ssl_is_valid_content_type(uint8_t type)
10029{
10030 switch ((ContentType) type) {
10031 case SSL_ID_CHG_CIPHER_SPEC:
10032 case SSL_ID_ALERT:
10033 case SSL_ID_HANDSHAKE:
10034 case SSL_ID_APP_DATA:
10035 case SSL_ID_HEARTBEAT:
10036 case SSL_ID_TLS12_CID:
10037 case SSL_ID_DTLS13_ACK:
10038 return true1;
10039 }
10040 return false0;
10041}
10042
10043bool_Bool
10044ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10045{
10046 switch ((HandshakeType) hs_type) {
10047 case SSL_HND_HELLO_VERIFY_REQUEST:
10048 /* hello_verify_request is DTLS-only */
10049 return is_dtls;
10050
10051 case SSL_HND_HELLO_REQUEST:
10052 case SSL_HND_CLIENT_HELLO:
10053 case SSL_HND_SERVER_HELLO:
10054 case SSL_HND_NEWSESSION_TICKET:
10055 case SSL_HND_END_OF_EARLY_DATA:
10056 case SSL_HND_HELLO_RETRY_REQUEST:
10057 case SSL_HND_ENCRYPTED_EXTENSIONS:
10058 case SSL_HND_CERTIFICATE:
10059 case SSL_HND_SERVER_KEY_EXCHG:
10060 case SSL_HND_CERT_REQUEST:
10061 case SSL_HND_SVR_HELLO_DONE:
10062 case SSL_HND_CERT_VERIFY:
10063 case SSL_HND_CLIENT_KEY_EXCHG:
10064 case SSL_HND_FINISHED:
10065 case SSL_HND_CERT_URL:
10066 case SSL_HND_CERT_STATUS:
10067 case SSL_HND_SUPPLEMENTAL_DATA:
10068 case SSL_HND_KEY_UPDATE:
10069 case SSL_HND_COMPRESSED_CERTIFICATE:
10070 case SSL_HND_ENCRYPTED_EXTS:
10071 return true1;
10072 case SSL_HND_MESSAGE_HASH:
10073 return false0;
10074 }
10075 return false0;
10076}
10077
10078static bool_Bool
10079ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10080 bool_Bool is_dtls)
10081{
10082 /* Consider all valid Handshake messages (except for Client Hello) and
10083 * all other valid record types (other than Handshake) */
10084 return (content_type == SSL_ID_HANDSHAKE &&
10085 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10086 handshake_type != SSL_HND_CLIENT_HELLO) ||
10087 (content_type != SSL_ID_HANDSHAKE &&
10088 ssl_is_valid_content_type(content_type));
10089}
10090
10091/**
10092 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10093 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10094 * Returns true if the supported_versions extension was found, false if not.
10095 */
10096bool_Bool
10097tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10098 uint16_t *server_version, bool_Bool *is_hrr)
10099{
10100 /* SHA256("HelloRetryRequest") */
10101 static const uint8_t tls13_hrr_random_magic[] = {
10102 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10103 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10104 };
10105 uint8_t session_id_length;
10106
10107 *server_version = tvb_get_ntohs(tvb, offset);
10108
10109 /*
10110 * Try to look for supported_versions extension. Minimum length:
10111 * 2 + 32 + 1 = 35 (version, random, session id length)
10112 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10113 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10114 *
10115 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10116 * there's a separate expert info warning for that.
10117 */
10118 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10119 offset += 2;
10120 if (is_hrr) {
10121 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10122 }
10123 offset += 32;
10124 session_id_length = tvb_get_uint8(tvb, offset);
10125 offset++;
10126 if (offset_end - offset < session_id_length + 5u) {
10127 return false0;
10128 }
10129 offset += session_id_length + 5;
10130
10131 while (offset_end - offset >= 6) {
10132 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10133 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10134 if (offset_end - offset < 4u + ext_len) {
10135 break; /* not enough data for type, length and data */
10136 }
10137 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10138 if (ext_len == 2) {
10139 *server_version = tvb_get_ntohs(tvb, offset + 4);
10140 }
10141 return true1;
10142 }
10143 offset += 4 + ext_len;
10144 }
10145 } else {
10146 if (is_hrr) {
10147 *is_hrr = false0;
10148 }
10149 }
10150 return false0;
10151}
10152
10153/**
10154 * Scan a Client Hello handshake message to see if the supported_versions
10155 * extension is found, in which case the version field is legacy_version.
10156 */
10157static bool_Bool
10158tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10159{
10160 uint8_t session_id_length;
10161
10162 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10163
10164 /*
10165 * Try to look for supported_versions extension. Minimum length:
10166 * 2 + 32 + 1 = 35 (version, random, session id length)
10167 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10168 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10169 *
10170 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10171 * there's a separate expert info warning for that.
10172 */
10173 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10174 offset += 2;
10175 offset += 32;
10176 session_id_length = tvb_get_uint8(tvb, offset);
10177 offset++;
10178 if (offset_end - offset < session_id_length + 2u) {
10179 return false0;
10180 }
10181 offset += session_id_length;
10182 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10183 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10184 offset++;
10185 if (offset_end - offset < cookie_length + 2u) {
10186 return false0;
10187 }
10188 }
10189 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10190 offset += 2;
10191 if (offset_end - offset < cipher_suites_length + 1u) {
10192 return false0;
10193 }
10194 offset += cipher_suites_length;
10195 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10196 offset++;
10197 if (offset_end - offset < compression_methods_length + 2u) {
10198 return false0;
10199 }
10200 offset += compression_methods_length + 2;
10201
10202 while (offset_end - offset >= 6) {
10203 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10204 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10205 if (offset_end - offset < 4u + ext_len) {
10206 break; /* not enough data for type, length and data */
10207 }
10208 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10209 return true1;
10210 }
10211 offset += 4 + ext_len;
10212 }
10213 }
10214 return false0;
10215}
10216void
10217ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10218 uint8_t content_type, uint8_t handshake_type,
10219 bool_Bool is_dtls, uint16_t version)
10220{
10221 uint8_t tls13_draft = 0;
10222
10223 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10224 is_dtls))
10225 return;
10226
10227 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10228 if (version == SSL_VER_UNKNOWN0) {
10229 return;
10230 }
10231
10232 session->tls13_draft_version = tls13_draft;
10233 session->version = version;
10234 if (ssl) {
10235 ssl->state |= SSL_VERSION(1<<4);
10236 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10237 }
10238}
10239
10240void
10241ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10242 ContentType content_type,
10243 unsigned record_length, proto_item *length_pi,
10244 uint16_t version, tvbuff_t *decrypted_tvb)
10245{
10246 unsigned max_expansion;
10247 if (version == TLSV1DOT3_VERSION0x304) {
10248 /* TLS 1.3: Max length is 2^14 + 256 */
10249 max_expansion = 256;
10250 } else {
10251 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10252 max_expansion = 2048;
10253 }
10254 /*
10255 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10256 * and ChangeCipherSpec.
10257 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10258 * so assume it is permitted.
10259 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10260 * assume TLS 1.2 requirements.
10261 */
10262 if (record_length == 0 &&
10263 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10264 content_type == SSL_ID_ALERT ||
10265 content_type == SSL_ID_HANDSHAKE)) {
10266 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10267 "Zero-length %s fragments are not allowed",
10268 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10269 }
10270 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10271 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10272 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10273 }
10274 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10275 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10276 "TLSPlaintext length MUST NOT exceed 2^14");
10277 }
10278}
10279
10280static void
10281ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10282{
10283 /* store selected cipher suite for decryption */
10284 ssl->session.cipher = cipher;
10285
10286 const SslCipherSuite *cs = ssl_find_cipher(cipher);
8
←
Calling 'ssl_find_cipher'
→
12
←
Returning from 'ssl_find_cipher'
→
10287 if (!cs
12.1
'cs' is null
) {
13
←
Taking true branch
→
10288 ssl->cipher_suite = NULL((void*)0);
14
←
Null pointer value stored to field 'cipher_suite'
→
10289 ssl->state &= ~SSL_CIPHER(1<<2);
10290 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10291 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10292 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10293 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10294 * to avoid a potential buffer overflow in ssl3_check_mac. */
10295 ssl->cipher_suite = NULL((void*)0);
10296 ssl->state &= ~SSL_CIPHER(1<<2);
10297 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10298 } else {
10299 /* Cipher found, save this for the delayed decoder init */
10300 ssl->cipher_suite = cs;
10301 ssl->state |= SSL_CIPHER(1<<2);
10302 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10303 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10304 ssl->state);
10305 }
10306}
10307/* }}} */
10308
10309
10310/* Client Hello and Server Hello dissections. {{{ */
10311static int
10312ja4_compare_uint16(const void *a, const void *b)
10313{
10314 uint16_t va = *(const uint16_t *)a;
10315 uint16_t vb = *(const uint16_t *)b;
10316 return (va > vb) - (va < vb);
10317}
10318
10319static int
10320ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10321 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10322 SslSession *session, SslDecryptSession *ssl,
10323 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10324 ssl_master_key_map_t *mk_map);
10325int
10326// NOLINTNEXTLINE(misc-no-recursion)
10327ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10328 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10329 uint32_t offset_end, SslSession *session,
10330 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10331{
10332 /* struct {
10333 * ProtocolVersion client_version;
10334 * Random random;
10335 * SessionID session_id;
10336 * opaque cookie<0..32>; //new field for DTLS
10337 * CipherSuite cipher_suites<2..2^16-1>;
10338 * CompressionMethod compression_methods<1..2^8-1>;
10339 * Extension client_hello_extension_list<0..2^16-1>;
10340 * } ClientHello;
10341 */
10342 proto_item *ti;
10343 proto_tree *cs_tree;
10344 uint32_t client_version;
10345 uint32_t cipher_suite_length;
10346 uint32_t compression_methods_length;
10347 uint8_t compression_method;
10348 uint32_t next_offset;
10349 uint32_t initial_offset = offset;
10350 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10351 char *ja3_hash;
10352 char *ja3_dash = "";
10353 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10354 ja4_data_t ja4_data;
10355 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10356 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10357 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10358 wmem_list_frame_t *curr_entry;
10359
10360 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10360, (int64_t)initial_offset, (int64_t)offset_end))));
10361 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10362 offset = 0;
10363 offset_end = tvb_reported_length(hello_tvb);
10364
10365 ja4_data.max_version = 0;
10366 ja4_data.server_name_present = false0;
10367 ja4_data.num_cipher_suites = 0;
10368 ja4_data.num_extensions = 0;
10369 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10370 ja4_data.cipher_array = wmem_array_new(pinfo->pool, sizeof(uint16_t));
10371 ja4_data.extension_array = wmem_array_new(pinfo->pool, sizeof(uint16_t));
10372 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10373
10374 /* show the client version */
10375 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10376 offset, 2, ENC_BIG_ENDIAN0x00000000,
10377 &client_version);
10378 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10379 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10380 }
10381 offset += 2;
10382 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10383
10384 /*
10385 * Is it version 1.3?
10386 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10387 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10388 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10389 * Hello".
10390 */
10391 if (dtls_hfs != NULL((void*)0)) {
10392 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10393 /* Don't do that. */
10394 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10395 }
10396 } else {
10397 if (client_version == TLSV1DOT3_VERSION0x304) {
10398 /* Don't do that. */
10399 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10400 }
10401 }
10402
10403 /* dissect fields that are present in both ClientHello and ServerHello */
10404 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10405
10406 /* fields specific for DTLS (cookie_len, cookie) */
10407 if (dtls_hfs != NULL((void*)0)) {
10408 uint32_t cookie_length;
10409 /* opaque cookie<0..32> (for DTLS only) */
10410 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10411 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10412 return offset;
10413 }
10414 offset++;
10415 if (cookie_length > 0) {
10416 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10417 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10418 offset += cookie_length;
10419 }
10420 }
10421
10422 /* CipherSuite cipher_suites<2..2^16-1> */
10423 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10424 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10425 return offset;
10426 }
10427 offset += 2;
10428 next_offset = offset + cipher_suite_length;
10429 ti = proto_tree_add_none_format(tree,
10430 hf->hf.hs_cipher_suites,
10431 hello_tvb, offset, cipher_suite_length,
10432 "Cipher Suites (%d suite%s)",
10433 cipher_suite_length / 2,
10434 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10435 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10436 while (offset + 2 <= next_offset) {
10437 uint32_t cipher_suite;
10438
10439 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10440 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10441 offset += 2;
10442 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10443 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10444 ja3_dash = "-";
10445 ja4_data.num_cipher_suites += 1;
10446 uint16_t cs16 = (uint16_t)cipher_suite;
10447 wmem_array_append_one(ja4_data.cipher_array, cs16)wmem_array_append((ja4_data.cipher_array), &(cs16), 1);
10448 }
10449 }
10450 wmem_strbuf_append_c(ja3, ',');
10451 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10452 offset = next_offset;
10453 }
10454
10455 /* CompressionMethod compression_methods<1..2^8-1> */
10456 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10457 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10458 return offset;
10459 }
10460 offset++;
10461 next_offset = offset + compression_methods_length;
10462 ti = proto_tree_add_none_format(tree,
10463 hf->hf.hs_comp_methods,
10464 hello_tvb, offset, compression_methods_length,
10465 "Compression Methods (%u method%s)",
10466 compression_methods_length,
10467 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10468 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10469 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10470 while (offset < next_offset) {
10471 compression_method = tvb_get_uint8(hello_tvb, offset);
10472 /* TODO: make reserved/private comp meth. fields selectable */
10473 if (compression_method < 64)
10474 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10475 hello_tvb, offset, 1, compression_method);
10476 else if (compression_method < 193)
10477 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10478 compression_method, "Reserved - to be assigned by IANA (%u)",
10479 compression_method);
10480 else
10481 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10482 compression_method, "Private use range (%u)",
10483 compression_method);
10484 offset++;
10485 }
10486
10487 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10488 if (offset < offset_end) {
10489 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10490 offset_end, SSL_HND_CLIENT_HELLO,
10491 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10492 if (ja4_data.max_version > 0) {
10493 client_version = ja4_data.max_version;
10494 }
10495 } else {
10496 wmem_strbuf_append_printf(ja3, ",,");
10497 }
10498
10499 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10500 wmem_strbuf_append(ja4_a, "t");
10501 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10502 wmem_strbuf_append(ja4_a, "q");
10503 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10504 wmem_strbuf_append(ja4_a, "d");
10505 }
10506 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10507 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10508 if (ja4_data.num_cipher_suites > 99) {
10509 wmem_strbuf_append(ja4_a, "99");
10510 } else {
10511 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10512 }
10513 if (ja4_data.num_extensions > 99) {
10514 wmem_strbuf_append(ja4_a, "99");
10515 } else {
10516 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10517 }
10518 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10519 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10520 } else {
10521 wmem_strbuf_append(ja4_a, "00");
10522 }
10523
10524 /* Sort once instead of inserting in sorted order (quadratic). */
10525 wmem_array_sort(ja4_data.cipher_array, ja4_compare_uint16);
10526 for (unsigned i = 0; i < wmem_array_get_count(ja4_data.cipher_array); i++) {
10527 wmem_strbuf_append_printf(ja4_br, "%04x", *(uint16_t *)wmem_array_index(ja4_data.cipher_array, i));
10528 if (i < wmem_array_get_count(ja4_data.cipher_array) - 1) {
10529 wmem_strbuf_append(ja4_br, ",");
10530 }
10531 }
10532
10533 wmem_array_sort(ja4_data.extension_array, ja4_compare_uint16);
10534 for (unsigned i = 0; i < wmem_array_get_count(ja4_data.extension_array); i++) {
10535 wmem_strbuf_append_printf(ja4_cr, "%04x", *(uint16_t *)wmem_array_index(ja4_data.extension_array, i));
10536 if (i < wmem_array_get_count(ja4_data.extension_array) - 1) {
10537 wmem_strbuf_append(ja4_cr, ",");
10538 }
10539 }
10540
10541 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10542 wmem_strbuf_append(ja4_cr, "_");
10543 curr_entry = wmem_list_head(ja4_data.sighash_list);
10544 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10545 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10546 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10547 wmem_strbuf_append(ja4_cr, ",");
10548 }
10549 curr_entry = wmem_list_frame_next(curr_entry);
10550 }
10551 }
10552 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10553 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10554 } else {
10555 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10556 }
10557 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10558
10559 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10560 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10561 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10562 } else {
10563 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10564 }
10565 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10566 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10567
10568 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10569 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10570
10571 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10572 proto_item_set_generated(ti);
10573 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10574 proto_item_set_generated(ti);
10575
10576 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10577 wmem_strbuf_get_len(ja3));
10578 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10579 proto_item_set_generated(ti);
10580 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10581 proto_item_set_generated(ti);
10582 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10583 return initial_offset + offset;
10584}
10585
10586/* The hash function(s) for the handshake transcript, matching what
10587 * ssl_generate_keyring_material and tls13_load_secret_from_psk use. */
10588static bool_Bool
10589tls_transcript_hash_algos(SslDecryptSession *ssl, int *algo, int *algo2)
10590{
10591 *algo2 = 0;
10592 switch (ssl->session.version) {
30
←
Control jumps to the 'default' case at line 10601
→
10593 case TLSV1_VERSION0x301:
10594 case TLSV1DOT1_VERSION0x302:
10595 case DTLSV1DOT0_VERSION0xfeff:
10596 case DTLSV1DOT0_OPENSSL_VERSION0x100:
10597 case TLCPV1_VERSION0x101:
10598 *algo = GCRY_MD_MD5;
10599 *algo2 = GCRY_MD_SHA1;
10600 return true1;
10601 default:
10602 break;
10603 }
10604
10605 if (!(ssl->state & SSL_CIPHER(1<<2)))
31
←
 Execution continues on line 10605
→
32
←
Taking false branch
→
10606 return false0;
10607
10608 switch (ssl->session.version) {
33
←
Control jumps to the 'default' case at line 10613
→
10609 case TLSV1DOT3_VERSION0x304:
10610 case DTLSV1DOT3_VERSION0xfefc:
10611 *algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10612 return *algo != 0;
10613 default:
10614 *algo = ssl->cipher_suite->dig == DIG_SHA3840x43 ? GCRY_MD_SHA384 : GCRY_MD_SHA256;
34
←
Access to field 'dig' results in a dereference of a null pointer (loaded from field 'cipher_suite')
10615 return true1;
10616 }
10617}
10618
10619static void
10620tls_calculate_ech_handshake_hash(packet_info *pinfo, SslDecryptSession *ssl, tvbuff_t *tvb, uint32_t offset, uint32_t length, bool_Bool is_hrr)
10621{
10622 /* Note length here, unlike ssl_calculate_handshake_hash, does *not* include
10623 * the 4 bytes for the handshake type and length fields themselves. */
10624 if (!ssl
16.1
'ssl' is non-null
 || tls_transcript_is_empty(&ssl->ech_transcript) || !(ssl->state & SSL_CIPHER(1<<2)) || ssl->client_random.data_len == 0)
17
←
Assuming the condition is false
→
18
←
Assuming field 'data_len' is not equal to 0
→
19
←
Taking false branch
→
10625 return;
10626
10627 /* RFC 9849 7.2 Backend Server */
10628 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10629 if (!hash_algo)
20
←
Assuming 'hash_algo' is 0
→
21
←
Taking true branch
→
10630 return;
10631
10632 /* Check that the entire message is present and find the confirmation
10633 * before using the transcript, so that a truncated or malformed message
10634 * doesn't throw an exception here (preventing the extensions from being
10635 * dissected, or leaving the transcript partially updated.) */
10636 if (length < 34 || !tvb_bytes_exist(tvb, offset, length))
10637 return;
10638 /* The ServerHello confirmation is the last 8 bytes of the random. */
10639 uint32_t confirmation_offset = offset + 26;
10640 bool_Bool zero_confirmation = !is_hrr;
10641 if (is_hrr) {
10642 /* The HelloRetryRequest confirmation is in the extension. */
10643 uint32_t hrr_offset = offset + 34;
10644 uint32_t message_end = offset + length;
10645 uint32_t extensions_end = hrr_offset;
10646 if (message_end - hrr_offset >= 1) {
10647 /* legacy_session_id_echo, cipher_suite, legacy_compression_method */
10648 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1 + 3;
10649 if (hrr_offset <= message_end && message_end - hrr_offset >= 2) {
10650 extensions_end = hrr_offset + 2 + tvb_get_ntohs(tvb, hrr_offset);
10651 hrr_offset += 2;
10652 if (extensions_end > message_end) {
10653 extensions_end = message_end;
10654 }
10655 }
10656 }
10657 while (hrr_offset <= extensions_end && extensions_end - hrr_offset >= 4) {
10658 uint16_t ext_type = tvb_get_ntohs(tvb, hrr_offset);
10659 uint16_t ext_len = tvb_get_ntohs(tvb, hrr_offset + 2);
10660 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 && ext_len == 8 &&
10661 extensions_end - hrr_offset >= 12) {
10662 confirmation_offset = hrr_offset + 4;
10663 zero_confirmation = true1;
10664 break;
10665 }
10666 hrr_offset += 4 + ext_len;
10667 }
10668 }
10669 uint8_t *message = (uint8_t *)wmem_alloc(pinfo->pool, 4 + length);
10670 message[0] = SSL_HND_SERVER_HELLO;
10671 phtonu24(&message[1], length);
10672 tvb_memcpy(tvb, message + 4, offset, length);
10673 uint8_t *zeroed = (uint8_t *)wmem_memdup(pinfo->pool, message, 4 + length);
10674 if (zero_confirmation) {
10675 memset(zeroed + 4 + confirmation_offset - offset, 0, 8);
10676 }
10677
10678 if (is_hrr) {
10679 /* RFC 8446 4.4.1 The Transcript Hash
10680 * Special synthetic handshake following a HelloRetryRequest */
10681 if (!tls_transcript_hello_retry(&ssl->ech_transcript, hash_algo, 0))
10682 return;
10683 }
10684
10685 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10686 unsigned char prk[DIGEST_MAX_SIZE48];
10687 unsigned char *ech_verify_out = NULL((void*)0);
10688 unsigned int len;
10689 gcry_md_hd_t md = tls_transcript_copy(&ssl->ech_transcript, hash_algo, 0);
10690 if (!md)
10691 return;
10692 gcry_md_write(md, zeroed, 4 + length);
10693 len = gcry_md_get_algo_dlen(hash_algo);
10694 memcpy(transcript_hash, gcry_md_read(md, hash_algo), len);
10695 gcry_md_close(md);
10696
10697 /* The transcript continues with the actual message. */
10698 if (tls_transcript_set_hash(&ssl->ech_transcript, hash_algo, 0))
10699 tls_transcript_add(&ssl->ech_transcript, message, 4 + length);
10700
10701 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10702 StringInfo prk_string = {prk, len};
10703 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10704 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10705 transcript_hash, len, 8, &ech_verify_out)) {
10706 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10707 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10708 if (is_hrr) {
10709 ssl->session.hrr_ech_declined = true1;
10710 ssl->session.first_ch_ech_frame = 0;
10711 }
10712 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10713 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10714 }
10715 wmem_free(NULL((void*)0), ech_verify_out);
10716 }
10717 /* XXX - If ECH is accepted, then the ECH transcript should be used
10718 * instead of the handshake_transcript for various purposes, like PSK KE.
10719 * If declined, then we don't need the ECH transcript anymore.
10720 */
10721 ssl->session.ech = true1;
10722}
10723
10724void
10725ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10726 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10727 SslSession *session, SslDecryptSession *ssl,
10728 bool_Bool is_dtls, bool_Bool is_hrr)
10729{
10730 /* struct {
10731 * ProtocolVersion server_version;
10732 * Random random;
10733 * SessionID session_id; // TLS 1.2 and before
10734 * CipherSuite cipher_suite;
10735 * CompressionMethod compression_method; // TLS 1.2 and before
10736 * Extension server_hello_extension_list<0..2^16-1>;
10737 * } ServerHello;
10738 */
10739 uint8_t draft_version = session->tls13_draft_version;
10740 proto_item *ti;
10741 uint32_t server_version;
10742 uint32_t cipher_suite;
10743 uint32_t initial_offset = offset;
10744 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10745 char *ja3_hash;
10746
10747 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10748 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10749
10750 /* Initially assume that the session is resumed. If this is not the case, a
10751 * ServerHelloDone will be observed before the ChangeCipherSpec message
10752 * which will reset this flag. */
10753 session->is_session_resumed = true1;
10754
10755 /* show the server version */
10756 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10757 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10758
10759 uint16_t supported_server_version;
10760 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
1
Taking false branch
→
10761 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10762 }
10763 /*
10764 * Is it version 1.3?
10765 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10766 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10767 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10768 * Hello".
10769 */
10770 if (is_dtls) {
2
←
Assuming 'is_dtls' is false
→
3
←
Taking false branch
→
10771 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10772 /* Don't do that. */
10773 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10774 }
10775 } else {
10776 if (server_version == TLSV1DOT3_VERSION0x304) {
4
←
Assuming 'server_version' is not equal to TLSV1DOT3_VERSION
→
5
←
Taking false branch
→
10777 /* Don't do that. */
10778 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10779 }
10780 }
10781
10782 offset += 2;
10783 wmem_strbuf_append_printf(ja3, "%i", server_version);
10784
10785 /* dissect fields that are present in both ClientHello and ServerHello */
10786 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10787
10788 if (ssl
5.1
'ssl' is non-null
) {
6
←
Taking true branch
→
10789 /* store selected cipher suite for decryption */
10790 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
7
←
Calling 'ssl_set_cipher'
→
15
←
Returning from 'ssl_set_cipher'
→
10791
10792 /* XXX - If we previously had a HRR, we should check to make sure the
10793 * Cipher Suite did not change (similar with the supported_versions ext.
10794 * https://www.rfc-editor.org/rfc/rfc9846.html#name-hello-retry-request
10795 */
10796 }
10797
10798 /* now the server-selected cipher suite */
10799 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10800 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10801 offset += 2;
10802 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10803
10804 /* With the Cipher Suite, we can now calculate the ECH handshake hash.
10805 * Do it now so we have it before the encrypted_client_hello extension
10806 * in a HRR. */
10807 tls_calculate_ech_handshake_hash(pinfo, ssl, tvb, initial_offset, offset_end - initial_offset, is_hrr);
16
←
Calling 'tls_calculate_ech_handshake_hash'
→
22
←
Returning from 'tls_calculate_ech_handshake_hash'
→
10808
10809 if (session->ech) {
23
←
Assuming field 'ech' is false
→
10810 tls_ech_confirm_t *ech_confirm = p_get_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm);
10811 if (ech_confirm) {
10812 proto_tree *ech_confirm_tree = proto_item_add_subtree(ech_confirm->parent_item, hf->ett.hs_random);
10813 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, ech_confirm->confirm_tvb, 0, 8, ENC_NA0x00000000);
10814 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute,
10815 ech_confirm->confirm_tvb, 0, 0,
10816 session->ech_confirmation, 8);
10817 proto_item_set_generated(ti);
10818 if (tvb_memeql(ech_confirm->confirm_tvb, 0, session->ech_confirmation, 8)) {
10819 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10820 } else {
10821 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10822 }
10823 }
10824 }
10825
10826 /* No compression with TLS 1.3 before draft -22 */
10827 if (!(session->version
23.1
Field 'version' is not equal to TLSV1DOT3_VERSION
 == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
24
←
Taking true branch
→
10828 if (ssl
24.1
'ssl' is non-null
) {
25
←
Taking true branch
→
10829 /* store selected compression method for decryption */
10830 ssl->session.compression = tvb_get_uint8(tvb, offset);
10831 }
10832 /* and the server-selected compression method */
10833 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10834 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10835 offset++;
10836 }
10837
10838 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10839 if (offset < offset_end) {
26
←
Assuming 'offset' is >= 'offset_end'
→
27
←
Taking false branch
→
10840 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10841 offset_end,
10842 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10843 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10844 }
10845
10846 if (ssl
27.1
'ssl' is non-null
) {
28
←
Taking true branch
→
10847 /* The version and cipher suite are known now, so we know the hash
10848 * function and can keep only the digest state of the transcript. */
10849 int algo, algo2;
10850 if (!tls_transcript_hash_algos(ssl, &algo, &algo2)) {
29
←
Calling 'tls_transcript_hash_algos'
→
10851 ssl_debug_printf("%s can't determine the transcript hash\n", G_STRFUNC((const char*) (__func__)));
10852 tls_transcript_fail(&ssl->handshake_transcript);
10853 } else if (is_hrr) {
10854 /* The HelloRetryRequest itself is already in the transcript. */
10855 tls_transcript_hello_retry(&ssl->handshake_transcript, algo,
10856 (is_dtls ? 12 : 4) + offset_end - initial_offset);
10857 } else {
10858 tls_transcript_set_hash(&ssl->handshake_transcript, algo, algo2);
10859 }
10860 if (!is_hrr) {
10861 ssl->state &= ~SSL_HELLO_RETRY_REQUEST(1<<14);
10862 }
10863 }
10864
10865 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10866 wmem_strbuf_get_len(ja3));
10867 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10868 proto_item_set_generated(ti);
10869 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10870 proto_item_set_generated(ti);
10871 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10872}
10873/* Client Hello and Server Hello dissections. }}} */
10874
10875/* New Session Ticket dissection. {{{ */
10876void
10877ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10878 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10879 SslSession *session, SslDecryptSession *ssl,
10880 bool_Bool is_dtls, GHashTable *session_hash)
10881{
10882 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10883 * struct {
10884 * uint32 ticket_lifetime_hint;
10885 * opaque ticket<0..2^16-1>;
10886 * } NewSessionTicket;
10887 *
10888 * RFC 8446 Section 4.6.1 (TLS 1.3):
10889 * struct {
10890 * uint32 ticket_lifetime;
10891 * uint32 ticket_age_add;
10892 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10893 * opaque ticket<1..2^16-1>;
10894 * Extension extensions<0..2^16-2>;
10895 * } NewSessionTicket;
10896 */
10897 proto_tree *subtree;
10898 proto_item *subitem;
10899 uint32_t ticket_len;
10900 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10901 unsigned char draft_version = session->tls13_draft_version;
10902 uint32_t lifetime_hint;
10903
10904 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10905 hf->ett.session_ticket, NULL((void*)0),
10906 "TLS Session Ticket");
10907
10908 /* ticket lifetime hint */
10909 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10910 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10911 offset += 4;
10912
10913 if (lifetime_hint >= 60) {
10914 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10915 proto_item_append_text(subitem, " (%s)", time_str);
10916 }
10917
10918 if (is_tls13) {
10919
10920 /* for TLS 1.3: ticket_age_add */
10921 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10922 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10923 offset += 4;
10924
10925 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10926 if (draft_version == 0 || draft_version >= 21) {
10927 uint32_t ticket_nonce_len;
10928
10929 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10930 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10931 return;
10932 }
10933 offset++;
10934
10935 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10936 offset += ticket_nonce_len;
10937 }
10938
10939 }
10940
10941 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10942 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10943 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10944 return;
10945 }
10946 offset += 2;
10947
10948 /* Content depends on implementation, so just show data! */
10949 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10950 tvb, offset, ticket_len, ENC_NA0x00000000);
10951 /* save the session ticket to cache for ssl_finalize_decryption */
10952 if (ssl && !is_tls13) {
10953 if (ssl->session.is_session_resumed) {
10954 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10955 * (Abbreviated Handshake Using New Session Ticket).
10956 * Restore the master key for this session ticket before saving
10957 * it to the new session ticket. */
10958 ssl_restore_master_key(ssl, "Session Ticket", false0,
10959 session_hash, &ssl->session_ticket);
10960 }
10961 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10962 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10963 ssl->session_ticket.data, ticket_len);
10964 ssl->session_ticket.data_len = ticket_len;
10965 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10966 /* NewSessionTicket is received after the first (client)
10967 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10968 * Since the second CCS has already the session key available it will
10969 * just return. To ensure that the session ticket is mapped to a
10970 * master key (from the first CCS), save the ticket here too. */
10971 ssl_save_master_key("Session Ticket", session_hash,
10972 &ssl->session_ticket, &ssl->master_secret);
10973 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10974 }
10975 offset += ticket_len;
10976
10977 if (is_tls13) {
10978 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10979 offset_end, SSL_HND_NEWSESSION_TICKET,
10980 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10981 }
10982} /* }}} */
10983
10984void
10985ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10986 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10987 SslSession *session, SslDecryptSession *ssl,
10988 bool_Bool is_dtls)
10989{
10990 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10991 * struct {
10992 * ProtocolVersion server_version;
10993 * CipherSuite cipher_suite; // not before draft -19
10994 * Extension extensions<2..2^16-1>;
10995 * } HelloRetryRequest;
10996 * Note: no longer used since draft -22
10997 */
10998 uint32_t version;
10999 uint8_t draft_version;
11000
11001 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11002 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
11003 draft_version = extract_tls13_draft_version(version);
11004 offset += 2;
11005
11006 if (draft_version == 0 || draft_version >= 19) {
11007 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
11008 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11009 offset += 2;
11010 }
11011
11012 /* We assume that there's nothing out there that supports only TLS 1.3
11013 * draft-22 but also Encrypted Client Hello, or else we should set the
11014 * cipher suite and call tls_calculate_ech_handshake_hash here. */
11015 if (ssl) {
11016 ssl->state |= SSL_HELLO_RETRY_REQUEST(1<<14);
11017 }
11018
11019 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11020 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11021 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11022}
11023
11024void
11025ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11026 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11027 SslSession *session, SslDecryptSession *ssl,
11028 bool_Bool is_dtls)
11029{
11030 /* RFC 8446 Section 4.3.1
11031 * struct {
11032 * Extension extensions<0..2^16-1>;
11033 * } EncryptedExtensions;
11034 */
11035 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11036 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11037 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11038}
11039
11040/* Certificate and Certificate Request dissections. {{{ */
11041void
11042ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11043 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11044 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11045 bool_Bool is_from_server, bool_Bool is_dtls)
11046{
11047 /* opaque ASN.1Cert<1..2^24-1>;
11048 *
11049 * Before RFC 8446 (TLS <= 1.2):
11050 * struct {
11051 * select(certificate_type) {
11052 *
11053 * // certificate type defined in RFC 7250
11054 * case RawPublicKey:
11055 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11056 *
11057 * // X.509 certificate defined in RFC 5246
11058 * case X.509:
11059 * ASN.1Cert certificate_list<0..2^24-1>;
11060 * };
11061 * } Certificate;
11062 *
11063 * RFC 8446 (since draft -20):
11064 * struct {
11065 * select(certificate_type){
11066 * case RawPublicKey:
11067 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11068 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11069 *
11070 * case X.509:
11071 * opaque cert_data<1..2^24-1>;
11072 * }
11073 * Extension extensions<0..2^16-1>;
11074 * } CertificateEntry;
11075 * struct {
11076 * opaque certificate_request_context<0..2^8-1>;
11077 * CertificateEntry certificate_list<0..2^24-1>;
11078 * } Certificate;
11079 */
11080 enum { CERT_X509, CERT_RPK } cert_type;
11081 asn1_ctx_t asn1_ctx;
11082#if defined(HAVE_LIBGNUTLS1)
11083 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11084 unsigned certificate_index = 0;
11085#endif
11086 uint32_t next_offset, certificate_list_length, cert_length;
11087 proto_tree *subtree = tree;
11088
11089 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11090
11091 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11092 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11093 cert_type = CERT_RPK;
11094 } else {
11095 cert_type = CERT_X509;
11096 }
11097
11098#if defined(HAVE_LIBGNUTLS1)
11099 /* Ask the pkcs1 dissector to return the public key details */
11100 if (ssl)
11101 asn1_ctx.private_data = &subjectPublicKeyInfo;
11102#endif
11103
11104 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11105 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11106 uint32_t context_length;
11107 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11108 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11109 return;
11110 }
11111 offset++;
11112 if (context_length > 0) {
11113 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11114 tvb, offset, context_length, ENC_NA0x00000000);
11115 offset += context_length;
11116 }
11117 }
11118
11119 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11120 /* For RPK before TLS 1.3, the single RPK is stored directly without
11121 * another "certificate_list" field. */
11122 certificate_list_length = offset_end - offset;
11123 next_offset = offset_end;
11124 } else {
11125 /* CertificateEntry certificate_list<0..2^24-1> */
11126 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11127 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11128 return;
11129 }
11130 offset += 3; /* 24-bit length value */
11131 next_offset = offset + certificate_list_length;
11132 }
11133
11134 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11135 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11136 proto_item *ti;
11137
11138 ti = proto_tree_add_none_format(tree,
11139 hf->hf.hs_certificates,
11140 tvb, offset, certificate_list_length,
11141 "Certificates (%u bytes)",
11142 certificate_list_length);
11143
11144 /* make it a subtree */
11145 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11146 }
11147
11148 while (offset < next_offset) {
11149 switch (cert_type) {
11150 case CERT_RPK:
11151 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11152 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11153 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11154 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11155 return;
11156 }
11157 offset += 3;
11158
11159 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11160 offset += cert_length;
11161 break;
11162 case CERT_X509:
11163 /* opaque ASN1Cert<1..2^24-1> */
11164 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11165 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11166 return;
11167 }
11168 offset += 3;
11169
11170 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11171#if defined(HAVE_LIBGNUTLS1)
11172 if (is_from_server && ssl && certificate_index == 0) {
11173 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11174 /* Only attempt to get the RSA modulus for the first cert. */
11175 asn1_ctx.private_data = NULL((void*)0);
11176 }
11177#endif
11178 offset += cert_length;
11179 break;
11180 }
11181
11182 /* TLS 1.3: Extension extensions<0..2^16-1> */
11183 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11184 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11185 next_offset, SSL_HND_CERTIFICATE,
11186 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11187 }
11188
11189#if defined(HAVE_LIBGNUTLS1)
11190 certificate_index++;
11191#endif
11192 }
11193}
11194
11195void
11196ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11197 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11198 SslSession *session, bool_Bool is_dtls)
11199{
11200 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11201 * enum {
11202 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11203 * (255)
11204 * } ClientCertificateType;
11205 *
11206 * opaque DistinguishedName<1..2^16-1>;
11207 *
11208 * struct {
11209 * ClientCertificateType certificate_types<1..2^8-1>;
11210 * DistinguishedName certificate_authorities<3..2^16-1>;
11211 * } CertificateRequest;
11212 *
11213 *
11214 * As per TLSv1.2 (RFC 5246) the format has changed to:
11215 *
11216 * enum {
11217 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11218 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11219 * fortezza_dms_RESERVED(20), (255)
11220 * } ClientCertificateType;
11221 *
11222 * enum {
11223 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11224 * sha512(6), (255)
11225 * } HashAlgorithm;
11226 *
11227 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11228 * SignatureAlgorithm;
11229 *
11230 * struct {
11231 * HashAlgorithm hash;
11232 * SignatureAlgorithm signature;
11233 * } SignatureAndHashAlgorithm;
11234 *
11235 * SignatureAndHashAlgorithm
11236 * supported_signature_algorithms<2..2^16-2>;
11237 *
11238 * opaque DistinguishedName<1..2^16-1>;
11239 *
11240 * struct {
11241 * ClientCertificateType certificate_types<1..2^8-1>;
11242 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11243 * DistinguishedName certificate_authorities<0..2^16-1>;
11244 * } CertificateRequest;
11245 *
11246 * draft-ietf-tls-tls13-18:
11247 * struct {
11248 * opaque certificate_request_context<0..2^8-1>;
11249 * SignatureScheme
11250 * supported_signature_algorithms<2..2^16-2>;
11251 * DistinguishedName certificate_authorities<0..2^16-1>;
11252 * CertificateExtension certificate_extensions<0..2^16-1>;
11253 * } CertificateRequest;
11254 *
11255 * RFC 8446 (since draft-ietf-tls-tls13-19):
11256 *
11257 * struct {
11258 * opaque certificate_request_context<0..2^8-1>;
11259 * Extension extensions<2..2^16-1>;
11260 * } CertificateRequest;
11261 */
11262 proto_item *ti;
11263 proto_tree *subtree;
11264 uint32_t next_offset;
11265 asn1_ctx_t asn1_ctx;
11266 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11267 unsigned char draft_version = session->tls13_draft_version;
11268
11269 if (!tree)
11270 return;
11271
11272 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11273
11274 if (is_tls13) {
11275 uint32_t context_length;
11276 /* opaque certificate_request_context<0..2^8-1> */
11277 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11278 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11279 return;
11280 }
11281 offset++;
11282 if (context_length > 0) {
11283 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11284 tvb, offset, context_length, ENC_NA0x00000000);
11285 offset += context_length;
11286 }
11287 } else {
11288 uint32_t cert_types_count;
11289 /* ClientCertificateType certificate_types<1..2^8-1> */
11290 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11291 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11292 return;
11293 }
11294 offset++;
11295 next_offset = offset + cert_types_count;
11296
11297 ti = proto_tree_add_none_format(tree,
11298 hf->hf.hs_cert_types,
11299 tvb, offset, cert_types_count,
11300 "Certificate types (%u type%s)",
11301 cert_types_count,
11302 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11303 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11304
11305 while (offset < next_offset) {
11306 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11307 offset++;
11308 }
11309 }
11310
11311 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11312 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11313 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11314 }
11315
11316 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11317 /*
11318 * TLS 1.3 draft 19 and newer: Extensions.
11319 * SslDecryptSession pointer is NULL because Certificate Extensions
11320 * should not influence decryption state.
11321 */
11322 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11323 offset_end, SSL_HND_CERT_REQUEST,
11324 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11325 } else if (is_tls13 && draft_version <= 18) {
11326 /*
11327 * TLS 1.3 draft 18 and older: certificate_authorities and
11328 * certificate_extensions (a vector of OID mappings).
11329 */
11330 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11331 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11332 } else {
11333 /* for TLS 1.2 and older, the certificate_authorities field. */
11334 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11335 }
11336}
11337/* Certificate and Certificate Request dissections. }}} */
11338
11339void
11340ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11341 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11342{
11343 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11344 hf->hf.hs_client_cert_vrfy_sig_len,
11345 hf->hf.hs_client_cert_vrfy_sig);
11346}
11347
11348/* Finished dissection. {{{ */
11349void
11350ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11351 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11352 const SslSession *session, ssl_hfs_t *ssl_hfs)
11353{
11354 /* For SSLv3:
11355 * struct {
11356 * opaque md5_hash[16];
11357 * opaque sha_hash[20];
11358 * } Finished;
11359 *
11360 * For (D)TLS:
11361 * struct {
11362 * opaque verify_data[12];
11363 * } Finished;
11364 *
11365 * For TLS 1.3:
11366 * struct {
11367 * opaque verify_data[Hash.length];
11368 * }
11369 */
11370 if (!tree)
11371 return;
11372
11373 if (session->version == SSLV3_VERSION0x300) {
11374 if (ssl_hfs != NULL((void*)0)) {
11375 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11376 tvb, offset, 16, ENC_NA0x00000000);
11377 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11378 tvb, offset + 16, 20, ENC_NA0x00000000);
11379 }
11380 } else {
11381 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11382 proto_tree_add_item(tree, hf->hf.hs_finished,
11383 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11384 }
11385} /* }}} */
11386
11387/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11388void
11389ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11390{
11391 uint32_t url_hash_len;
11392
11393 /* enum {
11394 * individual_certs(0), pkipath(1), (255)
11395 * } CertChainType;
11396 *
11397 * struct {
11398 * CertChainType type;
11399 * URLAndHash url_and_hash_list<1..2^16-1>;
11400 * } CertificateURL;
11401 *
11402 * struct {
11403 * opaque url<1..2^16-1>;
11404 * uint8 padding;
11405 * opaque SHA1Hash[20];
11406 * } URLAndHash;
11407 */
11408
11409 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11410 tvb, offset, 1, ENC_NA0x00000000);
11411 offset++;
11412
11413 url_hash_len = tvb_get_ntohs(tvb, offset);
11414 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11415 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11416 offset += 2;
11417 url_hash_len += offset;
11418 while (offset < url_hash_len) {
11419 proto_item *urlhash_item;
11420 proto_tree *urlhash_tree;
11421 uint16_t url_len;
11422
11423 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11424 tvb, offset, -1, ENC_NA0x00000000);
11425 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11426
11427 url_len = tvb_get_ntohs(tvb, offset);
11428 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11429 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11430 offset += 2;
11431
11432 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11433 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11434 offset += url_len;
11435
11436 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11437 tvb, offset, 1, ENC_NA0x00000000);
11438 offset++;
11439 /* Note: RFC 6066 says that padding must be 0x01 */
11440
11441 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11442 tvb, offset, 20, ENC_NA0x00000000);
11443 offset += 20;
11444 }
11445} /* }}} */
11446
11447void
11448ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11449 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11450 SslSession *session, SslDecryptSession *ssl,
11451 bool_Bool is_from_server, bool_Bool is_dtls)
11452{
11453 uint32_t algorithm, uncompressed_length;
11454 uint32_t compressed_certificate_message_length;
11455 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11456 proto_item *ti;
11457 /*
11458 * enum {
11459 * zlib(1),
11460 * brotli(2),
11461 * zstd(3),
11462 * (65535)
11463 * } CertificateCompressionAlgorithm;
11464 *
11465 * struct {
11466 * CertificateCompressionAlgorithm algorithm;
11467 * uint24 uncompressed_length;
11468 * opaque compressed_certificate_message<1..2^24-1>;
11469 * } CompressedCertificate;
11470 */
11471
11472 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11473 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11474 offset += 2;
11475
11476 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11477 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11478 offset += 3;
11479
11480 /* opaque compressed_certificate_message<1..2^24-1>; */
11481 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11482 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11483 return;
11484 }
11485 offset += 3;
11486
11487 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11488 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11489
11490 /* Certificate decompression following algorithm */
11491 switch (algorithm) {
11492 case 1: /* zlib */
11493 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11494 break;
11495 case 2: /* brotli */
11496 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11497 break;
11498 case 3: /* zstd */
11499 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11500 break;
11501 }
11502
11503 if (uncompressed_tvb) {
11504 proto_tree *uncompressed_tree;
11505
11506 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11507 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11508 tvb, offset, offset_end - offset,
11509 "Invalid uncompressed length %u (expected %u)",
11510 tvb_captured_length(uncompressed_tvb),
11511 uncompressed_length);
11512 } else {
11513 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11514 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11515 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11516 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11517 }
11518 }
11519}
11520
11521/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11522static int
11523// NOLINTNEXTLINE(misc-no-recursion)
11524ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11525 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11526 SslSession *session, SslDecryptSession *ssl,
11527 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11528 ssl_master_key_map_t *mk_map)
11529{
11530 uint32_t exts_len;
11531 uint16_t ext_type;
11532 uint32_t ext_len;
11533 uint32_t next_offset;
11534 proto_item *ext_item;
11535 proto_tree *ext_tree;
11536 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11537 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11538 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11539 char *ja3_dash = "";
11540 unsigned supported_version;
11541
11542 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11543 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11544 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11545 return offset_end;
11546 }
11547 offset += 2;
11548 offset_end = offset + exts_len;
11549
11550 if (ja4_data) {
11551 ja4_data->num_extensions = 0;
11552 }
11553 while (offset_end - offset >= 4)
11554 {
11555 ext_type = tvb_get_ntohs(tvb, offset);
11556 ext_len = tvb_get_ntohs(tvb, offset + 2);
11557
11558 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11559 ja4_data->num_extensions += 1;
11560 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11561 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11562 uint16_t et16 = (uint16_t)ext_type;
11563 wmem_array_append_one(ja4_data->extension_array, et16)wmem_array_append((ja4_data->extension_array), &(et16)
, 1);
11564 }
11565 }
11566
11567 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11568 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11569 tls_hello_extension_types,
11570 "Unknown type %u"), ext_len);
11571 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11572
11573 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11574 tvb, offset, 2, ext_type);
11575 offset += 2;
11576 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11577 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11578 ja3_dash = "-";
11579 }
11580
11581 /* opaque extension_data<0..2^16-1> */
11582 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11583 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11584 return offset_end;
11585 }
11586 offset += 2;
11587 next_offset = offset + ext_len;
11588
11589 switch (ext_type) {
11590 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11591 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11592 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11593 if (ja4_data) {
11594 ja4_data->server_name_present = true1;
11595 }
11596 }
11597 break;
11598 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11599 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11600 offset += 1;
11601 break;
11602 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11603 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11604 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11605 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11606 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11607 }
11608 break;
11609 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11610 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11611 offset, next_offset,
11612 hnd_type, ext_type,
11613 session);
11614 break;
11615 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11616 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11617 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11618 next_offset, ja3_sg);
11619 } else {
11620 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11621 next_offset, NULL((void*)0));
11622 }
11623 break;
11624 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11625 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11626 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11627 } else {
11628 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11629 }
11630 break;
11631 case SSL_HND_HELLO_EXT_SRP12:
11632 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11633 break;
11634 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11635 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11636 break;
11637 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11638 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11639 break;
11640 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11641 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11642 break;
11643 case SSL_HND_HELLO_EXT_USE_SRTP14:
11644 if (is_dtls) {
11645 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11646 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11647 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11648 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11649 }
11650 } else {
11651 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11652 }
11653 break;
11654 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11655 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11656 break;
11657 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11658 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11659 break;
11660 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11661 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11662 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11663 offset++;
11664 break;
11665 case SSL_HND_HELLO_EXT_ALPN16:
11666 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11667 break;
11668 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11669 if (hnd_type == SSL_HND_CLIENT_HELLO)
11670 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11671 break;
11672 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11673 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11674 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11675 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11676 break;
11677 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11678 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11679 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11680 offset, next_offset,
11681 hnd_type, ext_type,
11682 session);
11683 break;
11684 case SSL_HND_HELLO_EXT_PADDING21:
11685 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11686 offset += ext_len;
11687 break;
11688 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11689 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11690 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11691 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11692 }
11693 break;
11694 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11695 if (ssl) {
11696 switch (hnd_type) {
11697 case SSL_HND_CLIENT_HELLO:
11698 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11699 break;
11700 case SSL_HND_SERVER_HELLO:
11701 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11702 break;
11703 default: /* no default */
11704 break;
11705 }
11706 }
11707 break;
11708 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11709 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11710 break;
11711 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11712 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11713 break;
11714 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11715 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11716 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11717 offset += 2;
11718 break;
11719 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11720 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11721 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11722 break;
11723 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11724 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11725 break;
11726 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11727 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11728 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11729 break;
11730 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11731 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11732 break;
11733 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11734 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11735 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11736 break;
11737 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11738 switch (hnd_type) {
11739 case SSL_HND_CLIENT_HELLO:
11740 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11741 break;
11742 case SSL_HND_SERVER_HELLO:
11743 case SSL_HND_HELLO_RETRY_REQUEST:
11744 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11745 offset += 2;
11746 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11747 break;
11748 }
11749 break;
11750 case SSL_HND_HELLO_EXT_COOKIE44:
11751 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11752 break;
11753 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11754 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11755 break;
11756 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11757 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11758 break;
11759 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11760 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11761 break;
11762 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11763 break;
11764 case SSL_HND_HELLO_EXT_NPN13172:
11765 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11766 break;
11767 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11768 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11769 break;
11770 case SSL_HND_HELLO_EXT_ALPS17613:
11771 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11772 break;
11773 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11774 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11775 break;
11776 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11777 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11778 break;
11779 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11780 session->deprecated_cid = true1;
11781 /* FALLTHRU */
11782 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11783 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11784 break;
11785 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11786 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11787 break;
11788 default:
11789 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11790 tvb, offset, ext_len, ENC_NA0x00000000);
11791 offset += ext_len;
11792 break;
11793 }
11794
11795 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11796 /* Dissection did not end at expected location, fix it. */
11797 offset = next_offset;
11798 }
11799 }
11800
11801 if (ja3) {
11802 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11803 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11804 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11805 } else {
11806 wmem_strbuf_append_c(ja3, ',');
11807 }
11808 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11809 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11810 } else {
11811 wmem_strbuf_append_c(ja3, ',');
11812 }
11813 }
11814 }
11815
11816 /* Check if Extensions vector is correctly terminated. */
11817 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11818 offset = offset_end;
11819 }
11820
11821 return offset;
11822} /* }}} */
11823
11824
11825/* ClientKeyExchange algo-specific dissectors. {{{ */
11826
11827static void
11828dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11829 proto_tree *tree, uint32_t offset,
11830 uint32_t length)
11831{
11832 int point_len;
11833 proto_tree *ssl_ecdh_tree;
11834
11835 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11836 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11837
11838 /* point */
11839 point_len = tvb_get_uint8(tvb, offset);
11840 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11841 offset, 1, ENC_BIG_ENDIAN0x00000000);
11842 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11843 offset + 1, point_len, ENC_NA0x00000000);
11844}
11845
11846static void
11847dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11848 proto_tree *tree, uint32_t offset, uint32_t length)
11849{
11850 int yc_len;
11851 proto_tree *ssl_dh_tree;
11852
11853 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11854 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11855
11856 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11857 yc_len = tvb_get_ntohs(tvb, offset);
11858 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11859 offset, 2, ENC_BIG_ENDIAN0x00000000);
11860 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11861 offset + 2, yc_len, ENC_NA0x00000000);
11862}
11863
11864static void
11865dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11866 proto_tree *tree, uint32_t offset,
11867 uint32_t length, const SslSession *session)
11868{
11869 int epms_len;
11870 proto_tree *ssl_rsa_tree;
11871
11872 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11873 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11874
11875 /* EncryptedPreMasterSecret.pre_master_secret */
11876 switch (session->version) {
11877 case SSLV2_VERSION0x0002:
11878 case SSLV3_VERSION0x300:
11879 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11880 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11881 * not present. The handshake contents represents the EPMS, see:
11882 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11883 epms_len = length;
11884 break;
11885
11886 default:
11887 /* TLS and DTLS include vector length before EPMS */
11888 epms_len = tvb_get_ntohs(tvb, offset);
11889 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11890 offset, 2, ENC_BIG_ENDIAN0x00000000);
11891 offset += 2;
11892 break;
11893 }
11894 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11895 offset, epms_len, ENC_NA0x00000000);
11896}
11897
11898/* Used in PSK cipher suites */
11899static uint32_t
11900dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11901 proto_tree *tree, uint32_t offset)
11902{
11903 unsigned identity_len;
11904 proto_tree *ssl_psk_tree;
11905
11906 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11907 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11908 /* identity */
11909 identity_len = tvb_get_ntohs(tvb, offset);
11910 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11911 offset, 2, ENC_BIG_ENDIAN0x00000000);
11912 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11913 offset + 2, identity_len, ENC_NA0x00000000);
11914
11915 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11916 return 2 + identity_len;
11917}
11918
11919/* Used in RSA PSK cipher suites */
11920static void
11921dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11922 proto_tree *tree, uint32_t offset,
11923 uint32_t length)
11924{
11925 int identity_len, epms_len;
11926 proto_tree *ssl_psk_tree;
11927
11928 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11929 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11930
11931 /* identity */
11932 identity_len = tvb_get_ntohs(tvb, offset);
11933 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11934 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11935 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11936 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11937 offset += 2 + identity_len;
11938
11939 /* Yc */
11940 epms_len = tvb_get_ntohs(tvb, offset);
11941 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11942 offset, 2, ENC_BIG_ENDIAN0x00000000);
11943 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11944 offset + 2, epms_len, ENC_NA0x00000000);
11945}
11946
11947/* Used in Diffie-Hellman PSK cipher suites */
11948static void
11949dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11950 proto_tree *tree, uint32_t offset, uint32_t length)
11951{
11952 /*
11953 * struct {
11954 * select (KeyExchangeAlgorithm) {
11955 * case diffie_hellman_psk:
11956 * opaque psk_identity<0..2^16-1>;
11957 * ClientDiffieHellmanPublic public;
11958 * } exchange_keys;
11959 * } ClientKeyExchange;
11960 */
11961
11962 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11963 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11964}
11965
11966/* Used in EC Diffie-Hellman PSK cipher suites */
11967static void
11968dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11969 proto_tree *tree, uint32_t offset, uint32_t length)
11970{
11971 /*
11972 * struct {
11973 * select (KeyExchangeAlgorithm) {
11974 * case ec_diffie_hellman_psk:
11975 * opaque psk_identity<0..2^16-1>;
11976 * ClientECDiffieHellmanPublic public;
11977 * } exchange_keys;
11978 * } ClientKeyExchange;
11979 */
11980
11981 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11982 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11983}
11984
11985/* Used in EC J-PAKE cipher suites */
11986static void
11987dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11988 proto_tree *tree, uint32_t offset,
11989 uint32_t length)
11990{
11991 /*
11992 * struct {
11993 * ECPoint V;
11994 * opaque r<1..2^8-1>;
11995 * } ECSchnorrZKP;
11996 *
11997 * struct {
11998 * ECPoint X;
11999 * ECSchnorrZKP zkp;
12000 * } ECJPAKEKeyKP;
12001 *
12002 * struct {
12003 * ECJPAKEKeyKP ecjpake_key_kp;
12004 * } ClientECJPAKEParams;
12005 *
12006 * select (KeyExchangeAlgorithm) {
12007 * case ecjpake:
12008 * ClientECJPAKEParams params;
12009 * } ClientKeyExchange;
12010 */
12011
12012 int point_len;
12013 proto_tree *ssl_ecjpake_tree;
12014
12015 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12016 hf->ett.keyex_params, NULL((void*)0),
12017 "EC J-PAKE Client Params");
12018
12019 /* ECJPAKEKeyKP.X */
12020 point_len = tvb_get_uint8(tvb, offset);
12021 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12022 offset, 1, ENC_BIG_ENDIAN0x00000000);
12023 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12024 offset + 1, point_len, ENC_NA0x00000000);
12025 offset += 1 + point_len;
12026
12027 /* ECJPAKEKeyKP.zkp.V */
12028 point_len = tvb_get_uint8(tvb, offset);
12029 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12030 offset, 1, ENC_BIG_ENDIAN0x00000000);
12031 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12032 offset + 1, point_len, ENC_NA0x00000000);
12033 offset += 1 + point_len;
12034
12035 /* ECJPAKEKeyKP.zkp.r */
12036 point_len = tvb_get_uint8(tvb, offset);
12037 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12038 offset, 1, ENC_BIG_ENDIAN0x00000000);
12039 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12040 offset + 1, point_len, ENC_NA0x00000000);
12041}
12042
12043static void
12044dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12045 proto_tree *tree, uint32_t offset,
12046 uint32_t length)
12047{
12048 int epms_len;
12049 proto_tree *ssl_ecc_sm2_tree;
12050
12051 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12052 hf->ett.keyex_params, NULL((void*)0),
12053 "ECC-SM2 Encrypted PreMaster Secret");
12054
12055 epms_len = tvb_get_ntohs(tvb, offset);
12056 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12057 offset, 2, ENC_BIG_ENDIAN0x00000000);
12058 offset += 2;
12059 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12060 offset, epms_len, ENC_NA0x00000000);
12061}
12062/* ClientKeyExchange algo-specific dissectors. }}} */
12063
12064
12065/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12066static uint32_t
12067ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12068 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12069 uint16_t version, int hf_sig_len, int hf_sig)
12070{
12071 uint32_t sig_len;
12072
12073 switch (version) {
12074 case TLSV1DOT2_VERSION0x303:
12075 case DTLSV1DOT2_VERSION0xfefd:
12076 case TLSV1DOT3_VERSION0x304:
12077 case DTLSV1DOT3_VERSION0xfefc:
12078 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12079 offset += 2;
12080 break;
12081
12082 default:
12083 break;
12084 }
12085
12086 /* Sig */
12087 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12088 hf_sig_len, 0, UINT16_MAX(65535))) {
12089 return offset_end;
12090 }
12091 offset += 2;
12092 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12093 offset += sig_len;
12094 return offset;
12095} /* }}} */
12096
12097/* ServerKeyExchange algo-specific dissectors. {{{ */
12098
12099/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12100static void
12101dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12102 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12103 uint16_t version)
12104{
12105 /*
12106 * TLSv1.2 (RFC 5246 sec 7.4.8)
12107 * struct {
12108 * digitally-signed struct {
12109 * opaque handshake_messages[handshake_messages_length];
12110 * }
12111 * } CertificateVerify;
12112 *
12113 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12114 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12115 *
12116 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12117 * does more hashing including the master secret and padding.
12118 */
12119 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12120 hf->hf.hs_server_keyex_sig_len,
12121 hf->hf.hs_server_keyex_sig);
12122}
12123
12124static uint32_t
12125dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12126{
12127 /*
12128 * RFC 4492 ECC cipher suites for TLS
12129 *
12130 * struct {
12131 * ECCurveType curve_type;
12132 * select (curve_type) {
12133 * case explicit_prime:
12134 * ...
12135 * case explicit_char2:
12136 * ...
12137 * case named_curve:
12138 * NamedCurve namedcurve;
12139 * };
12140 * } ECParameters;
12141 */
12142
12143 int curve_type;
12144
12145 /* ECParameters.curve_type */
12146 curve_type = tvb_get_uint8(tvb, offset);
12147 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12148 offset, 1, ENC_BIG_ENDIAN0x00000000);
12149 offset++;
12150
12151 if (curve_type != 3)
12152 return offset_end; /* only named_curves are supported */
12153
12154 /* case curve_type == named_curve; ECParameters.namedcurve */
12155 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12156 offset, 2, ENC_BIG_ENDIAN0x00000000);
12157 offset += 2;
12158
12159 return offset;
12160}
12161
12162static void
12163dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12164 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12165 uint16_t version, bool_Bool anon)
12166{
12167 /*
12168 * RFC 4492 ECC cipher suites for TLS
12169 *
12170 * struct {
12171 * opaque point <1..2^8-1>;
12172 * } ECPoint;
12173 *
12174 * struct {
12175 * ECParameters curve_params;
12176 * ECPoint public;
12177 * } ServerECDHParams;
12178 *
12179 * select (KeyExchangeAlgorithm) {
12180 * case ec_diffie_hellman:
12181 * ServerECDHParams params;
12182 * Signature signed_params;
12183 * } ServerKeyExchange;
12184 */
12185
12186 int point_len;
12187 proto_tree *ssl_ecdh_tree;
12188
12189 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12190 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12191
12192 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12193 if (offset >= offset_end)
12194 return; /* only named_curves are supported */
12195
12196 /* ECPoint.point */
12197 point_len = tvb_get_uint8(tvb, offset);
12198 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12199 offset, 1, ENC_BIG_ENDIAN0x00000000);
12200 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12201 offset + 1, point_len, ENC_NA0x00000000);
12202 offset += 1 + point_len;
12203
12204 /* Signature (if non-anonymous KEX) */
12205 if (!anon) {
12206 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12207 }
12208}
12209
12210static void
12211dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12212 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12213 uint16_t version, bool_Bool anon)
12214{
12215 int p_len, g_len, ys_len;
12216 proto_tree *ssl_dh_tree;
12217
12218 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12219 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12220
12221 /* p */
12222 p_len = tvb_get_ntohs(tvb, offset);
12223 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12224 offset, 2, ENC_BIG_ENDIAN0x00000000);
12225 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12226 offset + 2, p_len, ENC_NA0x00000000);
12227 offset += 2 + p_len;
12228
12229 /* g */
12230 g_len = tvb_get_ntohs(tvb, offset);
12231 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12232 offset, 2, ENC_BIG_ENDIAN0x00000000);
12233 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12234 offset + 2, g_len, ENC_NA0x00000000);
12235 offset += 2 + g_len;
12236
12237 /* Ys */
12238 ys_len = tvb_get_ntohs(tvb, offset);
12239 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12240 offset, 2, ys_len);
12241 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12242 offset + 2, ys_len, ENC_NA0x00000000);
12243 offset += 2 + ys_len;
12244
12245 /* Signature (if non-anonymous KEX) */
12246 if (!anon) {
12247 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12248 }
12249}
12250
12251/* Only used in RSA-EXPORT cipher suites */
12252static void
12253dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12254 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12255 uint16_t version)
12256{
12257 int modulus_len, exponent_len;
12258 proto_tree *ssl_rsa_tree;
12259
12260 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12261 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12262
12263 /* modulus */
12264 modulus_len = tvb_get_ntohs(tvb, offset);
12265 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12266 offset, 2, ENC_BIG_ENDIAN0x00000000);
12267 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12268 offset + 2, modulus_len, ENC_NA0x00000000);
12269 offset += 2 + modulus_len;
12270
12271 /* exponent */
12272 exponent_len = tvb_get_ntohs(tvb, offset);
12273 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12274 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12275 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12276 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12277 offset += 2 + exponent_len;
12278
12279 /* Signature */
12280 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12281}
12282
12283/* Used in RSA PSK and PSK cipher suites */
12284static uint32_t
12285dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12286 proto_tree *tree, uint32_t offset)
12287{
12288 unsigned hint_len;
12289 proto_tree *ssl_psk_tree;
12290
12291 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12292 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12293
12294 /* hint */
12295 hint_len = tvb_get_ntohs(tvb, offset);
12296 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12297 offset, 2, ENC_BIG_ENDIAN0x00000000);
12298 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12299 offset + 2, hint_len, ENC_NA0x00000000);
12300
12301 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12302 return 2 + hint_len;
12303}
12304
12305/* Used in Diffie-Hellman PSK cipher suites */
12306static void
12307dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12308 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12309{
12310 /*
12311 * struct {
12312 * select (KeyExchangeAlgorithm) {
12313 * case diffie_hellman_psk:
12314 * opaque psk_identity_hint<0..2^16-1>;
12315 * ServerDHParams params;
12316 * };
12317 * } ServerKeyExchange;
12318 */
12319
12320 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12321 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12322}
12323
12324/* Used in EC Diffie-Hellman PSK cipher suites */
12325static void
12326dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12327 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12328{
12329 /*
12330 * struct {
12331 * select (KeyExchangeAlgorithm) {
12332 * case ec_diffie_hellman_psk:
12333 * opaque psk_identity_hint<0..2^16-1>;
12334 * ServerECDHParams params;
12335 * };
12336 * } ServerKeyExchange;
12337 */
12338
12339 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12340 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12341}
12342
12343/* Used in EC J-PAKE cipher suites */
12344static void
12345dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12346 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12347{
12348 /*
12349 * struct {
12350 * ECPoint V;
12351 * opaque r<1..2^8-1>;
12352 * } ECSchnorrZKP;
12353 *
12354 * struct {
12355 * ECPoint X;
12356 * ECSchnorrZKP zkp;
12357 * } ECJPAKEKeyKP;
12358 *
12359 * struct {
12360 * ECParameters curve_params;
12361 * ECJPAKEKeyKP ecjpake_key_kp;
12362 * } ServerECJPAKEParams;
12363 *
12364 * select (KeyExchangeAlgorithm) {
12365 * case ecjpake:
12366 * ServerECJPAKEParams params;
12367 * } ServerKeyExchange;
12368 */
12369
12370 int point_len;
12371 proto_tree *ssl_ecjpake_tree;
12372
12373 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12374 hf->ett.keyex_params, NULL((void*)0),
12375 "EC J-PAKE Server Params");
12376
12377 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12378 if (offset >= offset_end)
12379 return; /* only named_curves are supported */
12380
12381 /* ECJPAKEKeyKP.X */
12382 point_len = tvb_get_uint8(tvb, offset);
12383 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12384 offset, 1, ENC_BIG_ENDIAN0x00000000);
12385 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12386 offset + 1, point_len, ENC_NA0x00000000);
12387 offset += 1 + point_len;
12388
12389 /* ECJPAKEKeyKP.zkp.V */
12390 point_len = tvb_get_uint8(tvb, offset);
12391 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12392 offset, 1, ENC_BIG_ENDIAN0x00000000);
12393 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12394 offset + 1, point_len, ENC_NA0x00000000);
12395 offset += 1 + point_len;
12396
12397 /* ECJPAKEKeyKP.zkp.r */
12398 point_len = tvb_get_uint8(tvb, offset);
12399 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12400 offset, 1, ENC_BIG_ENDIAN0x00000000);
12401 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12402 offset + 1, point_len, ENC_NA0x00000000);
12403}
12404
12405/* Only used in ECC-SM2-EXPORT cipher suites */
12406static void
12407dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12408 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12409 uint16_t version)
12410{
12411 proto_tree *ssl_ecc_sm2_tree;
12412
12413 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12414 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12415
12416 /* Signature */
12417 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12418}
12419/* ServerKeyExchange algo-specific dissectors. }}} */
12420
12421/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12422void
12423ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12424 proto_tree *tree, uint32_t offset, uint32_t length,
12425 const SslSession *session)
12426{
12427 switch (ssl_get_keyex_alg(session->cipher)) {
12428 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12429 case KEX_DH_DSS0x14:
12430 case KEX_DH_RSA0x15:
12431 case KEX_DHE_DSS0x10:
12432 case KEX_DHE_RSA0x12:
12433 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12434 break;
12435 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12436 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12437 break;
12438 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12439 case KEX_ECDH_ECDSA0x1a:
12440 case KEX_ECDH_RSA0x1b:
12441 case KEX_ECDHE_ECDSA0x16:
12442 case KEX_ECDHE_RSA0x18:
12443 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12444 break;
12445 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12446 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12447 break;
12448 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12449 /* XXX: implement support for KRB5 */
12450 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12451 tvb, offset, length,
12452 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12453 " developers if you want them to be supported");
12454 break;
12455 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12456 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12457 break;
12458 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12459 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12460 break;
12461 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12462 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12463 break;
12464 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12465 case KEX_SRP_SHA_DSS0x21:
12466 case KEX_SRP_SHA_RSA0x22:
12467 /* XXX: implement support for SRP_SHA* */
12468 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12469 tvb, offset, length,
12470 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12471 " developers if you want them to be supported");
12472 break;
12473 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12474 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12475 break;
12476 case KEX_ECC_SM20x26: /* GB/T 38636 */
12477 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12478 break;
12479 default:
12480 if (session->cipher == 0) {
12481 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12482 tvb, offset, length,
12483 "Cipher Suite not found");
12484 } else {
12485 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12486 tvb, offset, length,
12487 "Cipher Suite 0x%04x is not implemented, "
12488 "contact Wireshark developers if you want this to be supported",
12489 session->cipher);
12490 }
12491 break;
12492 }
12493}
12494
12495void
12496ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12497 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12498 const SslSession *session)
12499{
12500 switch (ssl_get_keyex_alg(session->cipher)) {
12501 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12502 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12503 break;
12504 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12505 case KEX_DH_RSA0x15:
12506 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12507 tvb, offset, offset_end - offset);
12508 break;
12509 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12510 case KEX_DHE_RSA0x12:
12511 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12512 break;
12513 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12514 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12515 break;
12516 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12517 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12518 break;
12519 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12520 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12521 break;
12522 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12523 case KEX_ECDH_RSA0x1b:
12524 case KEX_ECDHE_ECDSA0x16:
12525 case KEX_ECDHE_RSA0x18:
12526 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12527 break;
12528 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12529 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12530 tvb, offset, offset_end - offset);
12531 break;
12532 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12533 case KEX_RSA_PSK0x1f:
12534 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12535 break;
12536 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12537 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12538 break;
12539 case KEX_ECC_SM20x26: /* GB/T 38636 */
12540 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12541 break;
12542 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12543 case KEX_SRP_SHA_DSS0x21:
12544 case KEX_SRP_SHA_RSA0x22:
12545 /* XXX: implement support for SRP_SHA* */
12546 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12547 tvb, offset, offset_end - offset,
12548 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12549 " developers if you want them to be supported");
12550 break;
12551 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12552 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12553 break;
12554 default:
12555 if (session->cipher == 0) {
12556 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12557 tvb, offset, offset_end - offset,
12558 "Cipher Suite not found");
12559 } else {
12560 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12561 tvb, offset, offset_end - offset,
12562 "Cipher Suite 0x%04x is not implemented, "
12563 "contact Wireshark developers if you want this to be supported",
12564 session->cipher);
12565 }
12566 break;
12567 }
12568}
12569/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12570
12571void
12572tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12573 proto_tree *tree, uint32_t offset)
12574{
12575 /* RFC 8446 Section 4.6.3
12576 * enum {
12577 * update_not_requested(0), update_requested(1), (255)
12578 * } KeyUpdateRequest;
12579 *
12580 * struct {
12581 * KeyUpdateRequest request_update;
12582 * } KeyUpdate;
12583 */
12584 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12585}
12586
12587void
12588ssl_common_register_ssl_alpn_dissector_table(const char *name,
12589 const char *ui_name, const int proto)
12590{
12591 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12592 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12593 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12594}
12595
12596void
12597ssl_common_register_dtls_alpn_dissector_table(const char *name,
12598 const char *ui_name, const int proto)
12599{
12600 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12601 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12602 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12603}
12604
12605void
12606ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12607{
12608 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12609 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12610 &(options->psk));
12611
12612 if (is_dtls) {
12613 prefs_register_obsolete_preference(module, "keylog_file");
12614 prefs_register_static_text_preference(module, "keylog_file_removed",
12615 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12616 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12617 return;
12618 }
12619
12620 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12621 "The name of a file which contains a list of \n"
12622 "(pre-)master secrets in one of the following formats:\n"
12623 "\n"
12624 "RSA <EPMS> <PMS>\n"
12625 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12626 "CLIENT_RANDOM <CRAND> <MS>\n"
12627 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12628 "\n"
12629 "Where:\n"
12630 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12631 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12632 "<SSLID> = The SSL Session ID\n"
12633 "<MS> = The Master-Secret (MS)\n"
12634 "<CRAND> = The Client's random number from the ClientHello message\n"
12635 "\n"
12636 "(All fields are in hex notation)",
12637 &(options->keylog_filename), false0);
12638}
12639
12640void
12641ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12642{
12643 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12644 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12645 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12646 * negotiated. */
12647 if (!ssl_session)
12648 return;
12649
12650 switch (ssl_session->session.version) {
12651 /* The handshake message types used in the handshake hash are different
12652 * in different versions. [D]TLS 1.3 tracks the messages up to the
12653 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12654 * at the ClientHello and include the messages up to the ServerHello, at
12655 * which point we know the version.
12656 *
12657 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12658 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12659 * format as TLS 1.3). We don't know at the point of the ClientHello which
12660 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12661 *
12662 * When the server responds with a HelloRetryRequest, for subsequent
12663 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12664 * replaced with a synthetic handshake message of type "message_hash",
12665 * per RFC 8446 4.4.1. That is done in ssl_dissect_hnd_srv_hello, once
12666 * the cipher suite (and thus the hash function) is known; after that,
12667 * only the digest state of the transcript is kept.
12668 */
12669 case TLSV1DOT3_VERSION0x304:
12670 case DTLSV1DOT3_VERSION0xfefc:
12671 /* In [D]TLS 1.3 only the following handshake messages are used in the
12672 * handshake transcript. EndOfEarlyData and the Client Certificate,
12673 * Certificate Verify, and Finished are used in deriving the
12674 * resumption_master_secret but not the other secrets derived from
12675 * the master secret (client or server app traffic secret, exporter
12676 * secret). We don't yet support calculating a PSK to resume via
12677 * the resumption_master_secret, so we simply stop the transcript
12678 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12679 switch (msg_type) {
12680 case SSL_HND_CLIENT_HELLO:
12681 case SSL_HND_SERVER_HELLO:
12682 case SSL_HND_HELLO_RETRY_REQUEST:
12683 case SSL_HND_ENCRYPTED_EXTENSIONS:
12684 case SSL_HND_CERT_REQUEST:
12685 break;
12686 case SSL_HND_CERTIFICATE:
12687 case SSL_HND_CERT_VERIFY:
12688 case SSL_HND_FINISHED:
12689 if (!is_from_server)
12690 return;
12691 break;
12692 case SSL_HND_END_OF_EARLY_DATA:
12693 default:
12694 return;
12695 }
12696 break;
12697 default:
12698 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12699 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12700 * but the keys are not retrieved until ChangeCipherSpec later. If
12701 * mutual authentication is requested by the server, an intervening
12702 * CertificateVerify message can be sent but is not to be included
12703 * in the hash. */
12704 if (msg_type == SSL_HND_CERT_VERIFY)
12705 return;
12706 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12707 return;
12708 break;
12709 }
12710
12711 /* Until the ServerHello gives the hash function, the transcript should
12712 * only have the ClientHello (in DTLS, possibly a HelloVerifyRequest,
12713 * which resets the transcript) and the ServerHello or HelloRetryRequest
12714 * itself; there's no point in buffering anything else. */
12715 if (ssl_session->handshake_transcript.md == NULL((void*)0)) {
12716 switch (msg_type) {
12717 case SSL_HND_CLIENT_HELLO:
12718 case SSL_HND_SERVER_HELLO:
12719 case SSL_HND_HELLO_RETRY_REQUEST:
12720 case SSL_HND_HELLO_VERIFY_REQUEST:
12721 break;
12722 default:
12723 if (!ssl_session->handshake_transcript.failed) {
12724 ssl_debug_printf("%s handshake message %u before the ServerHello\n", G_STRFUNC((const char*) (__func__)), msg_type);
12725 tls_transcript_fail(&ssl_session->handshake_transcript);
12726 }
12727 return;
12728 }
12729 }
12730
12731 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12732 if (tvb) {
12733 if (tvb_bytes_exist(tvb, offset, length)) {
12734 tls_transcript_add(&ssl_session->handshake_transcript, tvb_get_ptr(tvb, offset, length), length);
12735 }
12736 } else {
12737 /* DTLS calculates the hash as if each handshake message had been
12738 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12739 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12740 */
12741 static const uint8_t zeros[3];
12742 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12742, (int64_t)length, (int64_t)4))));
12743 tls_transcript_add(&ssl_session->handshake_transcript, zeros, length);
12744 }
12745}
12746
12747
12748/*
12749 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12750 *
12751 * Local variables:
12752 * c-basic-offset: 4
12753 * tab-width: 8
12754 * indent-tabs-mode: nil
12755 * End:
12756 *
12757 * vi: set shiftwidth=4 tabstop=8 expandtab:
12758 * :indentSize=4:tabSize=8:noTabs=true:
12759 */