Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-tls-utils.h
1 /* packet-tls-utils.h
2  * ssl manipulation functions
3  * By Paolo Abeni <paolo.abeni@email.com>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_TLS_UTILS_H__
13 #define __PACKET_TLS_UTILS_H__
14 
15 #include <stdio.h> /* some APIs we declare take a stdio stream as an argument */
16 
17 #include <glib.h>
18 #include <epan/packet.h>
19 #include <epan/prefs.h>
20 #include <epan/wmem_scopes.h>
21 #include <epan/expert.h>
22 #include <epan/conversation.h>
23 #include <epan/unit_strings.h>
24 #include <wsutil/wsgcrypt.h>
25 
26 #ifdef HAVE_LIBGNUTLS
27 #include <gnutls/x509.h>
28 #include <gnutls/pkcs12.h>
29 #endif /* HAVE_LIBGNUTLS */
30 
31 /* TODO inline this now that Libgcrypt is mandatory? */
32 #define SSL_CIPHER_CTX gcry_cipher_hd_t
33 #define SSL_DECRYPT_DEBUG
34 
35 
36 /* other defines */
37 typedef enum {
38  SSL_ID_CHG_CIPHER_SPEC = 0x14,
39  SSL_ID_ALERT = 0x15,
40  SSL_ID_HANDSHAKE = 0x16,
41  SSL_ID_APP_DATA = 0x17,
42  SSL_ID_HEARTBEAT = 0x18,
43  SSL_ID_TLS12_CID = 0x19,
44  SSL_ID_DTLS13_ACK = 0x1A,
45 } ContentType;
46 
47 typedef enum {
48  SSL_HND_HELLO_REQUEST = 0,
49  SSL_HND_CLIENT_HELLO = 1,
50  SSL_HND_SERVER_HELLO = 2,
51  SSL_HND_HELLO_VERIFY_REQUEST = 3,
52  SSL_HND_NEWSESSION_TICKET = 4,
53  SSL_HND_END_OF_EARLY_DATA = 5,
54  SSL_HND_HELLO_RETRY_REQUEST = 6,
55  SSL_HND_ENCRYPTED_EXTENSIONS = 8,
56  SSL_HND_CERTIFICATE = 11,
57  SSL_HND_SERVER_KEY_EXCHG = 12,
58  SSL_HND_CERT_REQUEST = 13,
59  SSL_HND_SVR_HELLO_DONE = 14,
60  SSL_HND_CERT_VERIFY = 15,
61  SSL_HND_CLIENT_KEY_EXCHG = 16,
62  SSL_HND_FINISHED = 20,
63  SSL_HND_CERT_URL = 21,
64  SSL_HND_CERT_STATUS = 22,
65  SSL_HND_SUPPLEMENTAL_DATA = 23,
66  SSL_HND_KEY_UPDATE = 24,
67  SSL_HND_COMPRESSED_CERTIFICATE = 25,
68  /* Encrypted Extensions was NextProtocol in draft-agl-tls-nextprotoneg-03
69  * and changed in draft 04. Not to be confused with TLS 1.3 EE. */
70  SSL_HND_ENCRYPTED_EXTS = 67
71 } HandshakeType;
72 
73 #define SSL2_HND_ERROR 0x00
74 #define SSL2_HND_CLIENT_HELLO 0x01
75 #define SSL2_HND_CLIENT_MASTER_KEY 0x02
76 #define SSL2_HND_CLIENT_FINISHED 0x03
77 #define SSL2_HND_SERVER_HELLO 0x04
78 #define SSL2_HND_SERVER_VERIFY 0x05
79 #define SSL2_HND_SERVER_FINISHED 0x06
80 #define SSL2_HND_REQUEST_CERTIFICATE 0x07
81 #define SSL2_HND_CLIENT_CERTIFICATE 0x08
82 
83 #define SSL_HND_HELLO_EXT_SERVER_NAME 0
84 #define SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH 1
85 #define SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL 2
86 #define SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS 3
87 #define SSL_HND_HELLO_EXT_TRUNCATED_HMAC 4
88 #define SSL_HND_HELLO_EXT_STATUS_REQUEST 5
89 #define SSL_HND_HELLO_EXT_USER_MAPPING 6
90 #define SSL_HND_HELLO_EXT_CLIENT_AUTHZ 7
91 #define SSL_HND_HELLO_EXT_SERVER_AUTHZ 8
92 #define SSL_HND_HELLO_EXT_CERT_TYPE 9
93 #define SSL_HND_HELLO_EXT_SUPPORTED_GROUPS 10 /* renamed from "elliptic_curves" (RFC 7919 / TLS 1.3) */
94 #define SSL_HND_HELLO_EXT_EC_POINT_FORMATS 11
95 #define SSL_HND_HELLO_EXT_SRP 12
96 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS 13
97 #define SSL_HND_HELLO_EXT_USE_SRTP 14
98 #define SSL_HND_HELLO_EXT_HEARTBEAT 15
99 #define SSL_HND_HELLO_EXT_ALPN 16
100 #define SSL_HND_HELLO_EXT_STATUS_REQUEST_V2 17
101 #define SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP 18
102 #define SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE 19
103 #define SSL_HND_HELLO_EXT_SERVER_CERT_TYPE 20
104 #define SSL_HND_HELLO_EXT_PADDING 21
105 #define SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC 22
106 #define SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET 23
107 #define SSL_HND_HELLO_EXT_TOKEN_BINDING 24
108 #define SSL_HND_HELLO_EXT_CACHED_INFO 25
109 #define SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE 27
110 #define SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT 28
111 /* 26-33 Unassigned*/
112 #define SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS 34 /* draft-ietf-tls-subcerts-10.txt */
113 #define SSL_HND_HELLO_EXT_SESSION_TICKET_TLS 35
114 /* RFC 8446 (TLS 1.3) */
115 #define SSL_HND_HELLO_EXT_KEY_SHARE_OLD 40 /* draft-ietf-tls-tls13-22 (removed in -23) */
116 #define SSL_HND_HELLO_EXT_PRE_SHARED_KEY 41
117 #define SSL_HND_HELLO_EXT_EARLY_DATA 42
118 #define SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS 43
119 #define SSL_HND_HELLO_EXT_COOKIE 44
120 #define SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES 45
121 #define SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO 46 /* draft-ietf-tls-tls13-18 (removed in -19) */
122 #define SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES 47
123 #define SSL_HND_HELLO_EXT_OID_FILTERS 48
124 #define SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH 49
125 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT 50
126 #define SSL_HND_HELLO_EXT_KEY_SHARE 51
127 #define SSL_HND_HELLO_EXT_TRANSPARENCY_INFO 52 /* draft-ietf-trans-rfc6962-bis-41 */
128 #define SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED 53 /* draft-ietf-tls-dtls-connection-id-07 */
129 #define SSL_HND_HELLO_EXT_CONNECTION_ID 54
130 #define SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH 55 /* RFC 8844 */
131 #define SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID 56 /* RFC 8844 */
132 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1 57 /* draft-ietf-quic-tls-33 */
133 #define SSL_HND_HELLO_EXT_TICKET_REQUEST 58 /* draft-ietf-tls-ticketrequests-07 */
134 #define SSL_HND_HELLO_EXT_DNSSEC_CHAIN 59 /* RFC 9102 */
135 #define SSL_HND_HELLO_EXT_GREASE_0A0A 2570
136 #define SSL_HND_HELLO_EXT_GREASE_1A1A 6682
137 #define SSL_HND_HELLO_EXT_GREASE_2A2A 10794
138 #define SSL_HND_HELLO_EXT_NPN 13172 /* 0x3374 */
139 #define SSL_HND_HELLO_EXT_GREASE_3A3A 14906
140 #define SSL_HND_HELLO_EXT_ALPS 17513 /* draft-vvv-tls-alps-01, temporary value used in BoringSSL implementation */
141 #define SSL_HND_HELLO_EXT_GREASE_4A4A 19018
142 #define SSL_HND_HELLO_EXT_GREASE_5A5A 23130
143 #define SSL_HND_HELLO_EXT_GREASE_6A6A 27242
144 #define SSL_HND_HELLO_EXT_CHANNEL_ID_OLD 30031 /* 0x754f */
145 #define SSL_HND_HELLO_EXT_CHANNEL_ID 30032 /* 0x7550 */
146 #define SSL_HND_HELLO_EXT_GREASE_7A7A 31354
147 #define SSL_HND_HELLO_EXT_GREASE_8A8A 35466
148 #define SSL_HND_HELLO_EXT_GREASE_9A9A 39578
149 #define SSL_HND_HELLO_EXT_GREASE_AAAA 43690
150 #define SSL_HND_HELLO_EXT_GREASE_BABA 47802
151 #define SSL_HND_HELLO_EXT_GREASE_CACA 51914
152 #define SSL_HND_HELLO_EXT_GREASE_DADA 56026
153 #define SSL_HND_HELLO_EXT_GREASE_EAEA 60138
154 #define SSL_HND_HELLO_EXT_GREASE_FAFA 64250
155 #define SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO 65037 /* 0xfe0d draft-ietf-tls-esni-16 */
156 #define SSL_HND_HELLO_EXT_RENEGOTIATION_INFO 65281 /* 0xFF01 */
157 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS 65445 /* 0xffa5 draft-ietf-quic-tls-13 */
158 #define SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME 65486 /* 0xffce draft-ietf-tls-esni-01 */
159 
160 #define SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT 1
161 #define SSL_HND_CERT_URL_TYPE_PKIPATH 2
162 #define SSL_HND_CERT_STATUS_TYPE_OCSP 1
163 #define SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI 2
164 #define SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY 2
165 
166 /* https://github.com/quicwg/base-drafts/wiki/Temporary-IANA-Registry#quic-transport-parameters */
167 #define SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID 0x00
168 #define SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT 0x01
169 #define SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN 0x02
170 #define SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE 0x03
171 #define SSL_HND_QUIC_TP_INITIAL_MAX_DATA 0x04
172 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL 0x05
173 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE 0x06
174 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI 0x07
175 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI 0x08
176 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI 0x09
177 #define SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT 0x0a
178 #define SSL_HND_QUIC_TP_MAX_ACK_DELAY 0x0b
179 #define SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION 0x0c
180 #define SSL_HND_QUIC_TP_PREFERRED_ADDRESS 0x0d
181 #define SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT 0x0e
182 #define SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID 0x0f
183 #define SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID 0x10
184 #define SSL_HND_QUIC_TP_VERSION_INFORMATION 0x11 /* https://tools.ietf.org/html/draft-ietf-quic-version-negotiation-14 */
185 #define SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE 0x20 /* https://datatracker.ietf.org/doc/html/draft-ietf-quic-datagram-06 */
186 #define SSL_HND_QUIC_TP_CIBIR_ENCODING 0x1000 /* https://datatracker.ietf.org/doc/html/draft-banks-quic-cibir-01 */
187 #define SSL_HND_QUIC_TP_LOSS_BITS 0x1057 /* https://tools.ietf.org/html/draft-ferrieuxhamchaoui-quic-lossbits-03 */
188 #define SSL_HND_QUIC_TP_GREASE_QUIC_BIT 0x2ab2 /* RFC 9287 */
189 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP 0x7157 /* https://tools.ietf.org/html/draft-huitema-quic-ts-02 */
190 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2 0x7158 /* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
191 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD 0xde1a /* https://tools.ietf.org/html/draft-iyengar-quic-delayed-ack-00 */
192 /* https://quiche.googlesource.com/quiche/+/refs/heads/master/quic/core/crypto/transport_parameters.cc */
193 #define SSL_HND_QUIC_TP_GOOGLE_USER_AGENT 0x3129
194 #define SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED 0x312B
195 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION 0x4752
196 #define SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT 0x3127
197 #define SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE 0x312A
198 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS 0x4751
199 #define SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS 0x3128
200 /* https://github.com/facebookincubator/mvfst/blob/master/quic/QuicConstants.h */
201 #define SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY 0xFF00
202 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1 0xFF03DE1A /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-01 */
203 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05 0xff04de1a /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-04 / draft-05 */
204 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY 0xff04de1b /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-07 */
205 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04 0x0f739bbc1b666d04 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-04 */
206 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05 0x0f739bbc1b666d05 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-05 */
207 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH 0x0f739bbc1b666d06 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-06 */
208 #define SSL_HND_QUIC_TP_INITIAL_MAX_PATHS 0x0f739bbc1b666d07 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-07 */
209 /*
210  * Lookup tables
211  */
212 extern const value_string ssl_version_short_names[];
213 extern const value_string ssl_20_msg_types[];
214 extern value_string_ext ssl_20_cipher_suites_ext;
215 extern const value_string ssl_20_certificate_type[];
216 extern const value_string ssl_31_content_type[];
217 extern const value_string ssl_versions[];
218 extern const value_string ssl_31_change_cipher_spec[];
219 extern const value_string ssl_31_alert_level[];
220 extern const value_string ssl_31_alert_description[];
221 extern const value_string ssl_31_handshake_type[];
222 extern const value_string tls_heartbeat_type[];
223 extern const value_string tls_heartbeat_mode[];
224 extern const value_string ssl_31_compression_method[];
225 extern const value_string ssl_31_key_exchange_algorithm[];
226 extern const value_string ssl_31_signature_algorithm[];
227 extern const value_string ssl_31_client_certificate_type[];
228 extern const value_string ssl_31_public_value_encoding[];
229 extern value_string_ext ssl_31_ciphersuite_ext;
230 extern const value_string tls_hello_extension_types[];
231 extern const value_string tls_hash_algorithm[];
232 extern const value_string tls_signature_algorithm[];
233 extern const value_string tls13_signature_algorithm[];
234 extern const value_string tls_certificate_type[];
235 extern const value_string tls_cert_chain_type[];
236 extern const value_string tls_cert_status_type[];
237 extern const value_string ssl_extension_curves[];
238 extern const value_string ssl_extension_ec_point_formats[];
239 extern const value_string ssl_curve_types[];
240 extern const value_string tls_hello_ext_server_name_type_vs[];
241 extern const value_string tls_hello_ext_max_fragment_length[];
242 extern const value_string tls_hello_ext_psk_ke_mode[];
243 extern const value_string tls13_key_update_request[];
244 extern const value_string compress_certificate_algorithm_vals[];
245 extern const val64_string quic_transport_parameter_id[];
246 extern const range_string quic_version_vals[];
247 extern const val64_string quic_enable_time_stamp_v2_vals[];
248 extern const val64_string quic_enable_multipath_vals[];
249 extern const value_string tls_hello_ext_ech_clienthello_types[];
250 extern const value_string kem_id_type_vals[];
251 extern const value_string kdf_id_type_vals[];
252 extern const value_string aead_id_type_vals[];
253 extern const value_string token_binding_key_parameter_vals[];
254 
255 /* XXX Should we use GByteArray instead? */
256 typedef struct _StringInfo {
257  guchar *data; /* Backing storage which may be larger than data_len */
258  guint data_len; /* Length of the meaningful part of data */
259 } StringInfo;
260 
261 #define SSL_WRITE_KEY 1
262 
263 #define SSL_VER_UNKNOWN 0
264 #define SSLV2_VERSION 0x0002 /* not in record layer, SSL_CLIENT_SERVER from
265  http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html */
266 #define SSLV3_VERSION 0x300
267 #define TLSV1_VERSION 0x301
268 #define TLCPV1_VERSION 0x101
269 #define TLSV1DOT1_VERSION 0x302
270 #define TLSV1DOT2_VERSION 0x303
271 #define TLSV1DOT3_VERSION 0x304
272 #define DTLSV1DOT0_VERSION 0xfeff
273 #define DTLSV1DOT0_OPENSSL_VERSION 0x100
274 #define DTLSV1DOT2_VERSION 0xfefd
275 #define DTLSV1DOT3_VERSION 0xfefc
276 
277 /* Returns the TLS 1.3 draft version or 0 if not applicable. */
278 static inline guint8 extract_tls13_draft_version(guint32 version) {
279  if ((version & 0xff00) == 0x7f00) {
280  return (guint8) version;
281  }
282  return 0;
283 }
284 
285 
286 #define SSL_CLIENT_RANDOM (1<<0)
287 #define SSL_SERVER_RANDOM (1<<1)
288 #define SSL_CIPHER (1<<2)
289 #define SSL_HAVE_SESSION_KEY (1<<3)
290 #define SSL_VERSION (1<<4)
291 #define SSL_MASTER_SECRET (1<<5)
292 #define SSL_PRE_MASTER_SECRET (1<<6)
293 #define SSL_CLIENT_EXTENDED_MASTER_SECRET (1<<7)
294 #define SSL_SERVER_EXTENDED_MASTER_SECRET (1<<8)
295 #define SSL_NEW_SESSION_TICKET (1<<10)
296 #define SSL_ENCRYPT_THEN_MAC (1<<11)
297 #define SSL_SEEN_0RTT_APPDATA (1<<12)
298 #define SSL_QUIC_RECORD_LAYER (1<<13) /* For QUIC (draft >= -13) */
299 
300 #define SSL_EXTENDED_MASTER_SECRET_MASK (SSL_CLIENT_EXTENDED_MASTER_SECRET|SSL_SERVER_EXTENDED_MASTER_SECRET)
301 
302 /* SSL Cipher Suite modes */
303 typedef enum {
304  MODE_STREAM, /* GenericStreamCipher */
305  MODE_CBC, /* GenericBlockCipher */
306  MODE_GCM, /* GenericAEADCipher */
307  MODE_CCM, /* AEAD_AES_{128,256}_CCM with 16 byte auth tag */
308  MODE_CCM_8, /* AEAD_AES_{128,256}_CCM with 8 byte auth tag */
309  MODE_POLY1305, /* AEAD_CHACHA20_POLY1305 with 16 byte auth tag (RFC 7905) */
310 } ssl_cipher_mode_t;
311 
312 /* Explicit and implicit nonce length (RFC 5116 - Section 3.2.1) */
313 #define IMPLICIT_NONCE_LEN 4
314 #define EXPLICIT_NONCE_LEN 8
315 #define TLS13_AEAD_NONCE_LENGTH 12
316 
317 /* TLS 1.3 Record type for selecting the appropriate secret. */
318 typedef enum {
319  TLS_SECRET_0RTT_APP,
320  TLS_SECRET_HANDSHAKE,
321  TLS_SECRET_APP,
322 } TLSRecordType;
323 
324 #define SSL_DEBUG_USE_STDERR "-"
325 
326 #define SSLV2_MAX_SESSION_ID_LENGTH_IN_BYTES 16
327 
328 /* Record fragment lengths MUST NOT exceed 2^14 (= 0x4000) */
329 #define TLS_MAX_RECORD_LENGTH 0x4000
330 
331 typedef struct _SslCipherSuite {
332  gint number;
333  gint kex;
334  gint enc;
335  gint dig;
336  ssl_cipher_mode_t mode;
338 
339 typedef struct _SslFlow {
340  guint32 byte_seq;
341  guint16 flags;
342  wmem_tree_t *multisegment_pdus;
343 } SslFlow;
344 
345 typedef struct _SslDecompress SslDecompress;
346 
347 typedef struct _SslDecoder {
348  const SslCipherSuite *cipher_suite;
349  gint compression;
350  guchar _mac_key_or_write_iv[48];
351  StringInfo mac_key; /* for block and stream ciphers */
352  StringInfo write_iv; /* for AEAD ciphers (at least GCM, CCM) */
353  SSL_CIPHER_CTX evp;
354  SslDecompress *decomp;
355  guint64 seq;
356  guint16 epoch;
357  SslFlow *flow;
359 } SslDecoder;
360 
361 #define KEX_DHE_DSS 0x10
362 #define KEX_DHE_PSK 0x11
363 #define KEX_DHE_RSA 0x12
364 #define KEX_DH_ANON 0x13
365 #define KEX_DH_DSS 0x14
366 #define KEX_DH_RSA 0x15
367 #define KEX_ECDHE_ECDSA 0x16
368 #define KEX_ECDHE_PSK 0x17
369 #define KEX_ECDHE_RSA 0x18
370 #define KEX_ECDH_ANON 0x19
371 #define KEX_ECDH_ECDSA 0x1a
372 #define KEX_ECDH_RSA 0x1b
373 #define KEX_KRB5 0x1c
374 #define KEX_PSK 0x1d
375 #define KEX_RSA 0x1e
376 #define KEX_RSA_PSK 0x1f
377 #define KEX_SRP_SHA 0x20
378 #define KEX_SRP_SHA_DSS 0x21
379 #define KEX_SRP_SHA_RSA 0x22
380 #define KEX_IS_DH(n) ((n) >= KEX_DHE_DSS && (n) <= KEX_ECDH_RSA)
381 #define KEX_TLS13 0x23
382 #define KEX_ECJPAKE 0x24
383 
384 #define KEX_ECDHE_SM2 0x25
385 #define KEX_ECC_SM2 0x26
386 #define KEX_IBSDH_SM9 0x27
387 #define KEX_IBC_SM9 0x28
388 
389 /* Order is significant, must match "ciphers" array in packet-tls-utils.c */
390 
391 #define ENC_START 0x30
392 #define ENC_DES 0x30
393 #define ENC_3DES 0x31
394 #define ENC_RC4 0x32
395 #define ENC_RC2 0x33
396 #define ENC_IDEA 0x34
397 #define ENC_AES 0x35
398 #define ENC_AES256 0x36
399 #define ENC_CAMELLIA128 0x37
400 #define ENC_CAMELLIA256 0x38
401 #define ENC_SEED 0x39
402 #define ENC_CHACHA20 0x3A
403 #define ENC_SM1 0x3B
404 #define ENC_SM4 0x3C
405 #define ENC_NULL 0x3D
406 
407 
408 #define DIG_MD5 0x40
409 #define DIG_SHA 0x41
410 #define DIG_SHA256 0x42
411 #define DIG_SHA384 0x43
412 #define DIG_SM3 0x44
413 #define DIG_NA 0x45 /* Not Applicable */
414 
415 typedef struct {
416  const gchar *name;
417  guint len;
418 } SslDigestAlgo;
419 
420 typedef struct _SslRecordInfo {
421  guchar *plain_data;
422  guint data_len;
423  gint id;
425  ContentType type;
426  SslFlow *flow;
428  guint32 seq;
429  struct _SslRecordInfo* next;
430 } SslRecordInfo;
431 
436 typedef struct _TlsHsFragment {
437  guint record_id;
440  guint32 offset;
441  guint8 type;
442  int is_last : 1;
443  struct _TlsHsFragment *next;
444 } TlsHsFragment;
445 
446 typedef struct {
447  SslRecordInfo *records;
448  TlsHsFragment *hs_fragments;
449  guint32 srcport;
450  guint32 destport;
451  gint cipher;
453 } SslPacketInfo;
454 
455 typedef struct _SslSession {
456  gint cipher;
457  gint compression;
458  guint16 version;
459  guchar tls13_draft_version;
460  gint8 client_cert_type;
461  gint8 server_cert_type;
462  guint32 client_ccs_frame;
463  guint32 server_ccs_frame;
464 
465  /* The address/proto/port of the server as determined from heuristics
466  * (e.g. ClientHello) or set externally (via ssl_set_master_secret()). */
467  address srv_addr;
468  port_type srv_ptype;
469  guint srv_port;
470 
471  /* The Application layer protocol if known (for STARTTLS support) */
472  dissector_handle_t app_handle;
473  const char *alpn_name;
474  /* The ALPN the client requested, not necessarily the one chosen */
475  const char *client_alpn_name;
476  guint32 last_nontls_frame;
477  gboolean is_session_resumed;
478 
479  /* First pass only: track an in-progress handshake reassembly (>0) */
480  guint32 client_hs_reassembly_id;
481  guint32 server_hs_reassembly_id;
482 
483  /* Connection ID extension
484 
485  struct {
486  opaque cid<0..2^8-1>;
487  } ConnectionId;
488  */
489 
490  guint8 *client_cid;
491  guint8 *server_cid;
492  guint8 client_cid_len;
493  gboolean client_cid_len_present;
494  guint8 server_cid_len;
495  gboolean server_cid_len_present;
496  gboolean deprecated_cid; /* Set when handshake is using the deprecated CID extension type */
497 } SslSession;
498 
499 /* RFC 5246, section 8.1 says that the master secret is always 48 bytes */
500 #define SSL_MASTER_SECRET_LENGTH 48
501 
502 struct cert_key_id; /* defined in epan/secrets.h */
503 
504 /* This holds state information for a SSL conversation */
505 typedef struct _SslDecryptSession {
506  guchar _master_secret[SSL_MASTER_SECRET_LENGTH];
507  guchar _session_id[256];
508  guchar _client_random[32];
509  guchar _server_random[32];
510  StringInfo session_id;
511  StringInfo session_ticket;
512  StringInfo server_random;
513  StringInfo client_random;
514  StringInfo master_secret;
515  StringInfo handshake_data;
516  /* the data store for this StringInfo must be allocated explicitly with a capture lifetime scope */
517  StringInfo pre_master_secret;
518  guchar _server_data_for_iv[24];
519  StringInfo server_data_for_iv;
520  guchar _client_data_for_iv[24];
521  StringInfo client_data_for_iv;
522 
523  gint state;
524  const SslCipherSuite *cipher_suite;
525  SslDecoder *server;
526  SslDecoder *client;
527  SslDecoder *server_new;
528  SslDecoder *client_new;
529 #if defined(HAVE_LIBGNUTLS)
530  struct cert_key_id *cert_key_id;
531 #endif
532  StringInfo psk;
533  StringInfo app_data_segment;
534  SslSession session;
535  gboolean has_early_data;
536 
538 
539 /* RecordNumber - RFC 9147 section 4 */
540 typedef struct {
541  guint64 epoch;
542  guint64 sequence_number;
544 
545 /* User Access Table */
546 typedef struct _ssldecrypt_assoc_t {
547  char* ipaddr;
548  char* port;
549  char* protocol;
550  char* keyfile;
551  char* password;
553 
554 typedef struct ssl_common_options {
555  const gchar *psk;
556  const gchar *keylog_filename;
558 
560 typedef struct {
561  GHashTable *session; /* Session ID (1-32 bytes) to master secret. */
562  GHashTable *tickets; /* Session Ticket to master secret. */
563  GHashTable *crandom; /* Client Random to master secret */
564  GHashTable *pre_master; /* First 8 bytes of encrypted pre-master secret to
565  pre-master secret */
566  GHashTable *pms; /* Client Random to unencrypted pre-master secret */
567 
568  /* For TLS 1.3: maps Client Random to derived secret. */
569  GHashTable *tls13_client_early;
570  GHashTable *tls13_client_handshake;
571  GHashTable *tls13_server_handshake;
572  GHashTable *tls13_client_appdata;
573  GHashTable *tls13_server_appdata;
574  GHashTable *tls13_early_exporter;
575  GHashTable *tls13_exporter;
576 
577  /* The hash tables above store the static keylog file contents and secrets
578  * from any DSB, not all of which may be used, in addition to any master
579  * secrets derived at runtime ([D]TLS < 1.3). These store the used
580  * Client Random for exporting master secrets and derived secrets in
581  * TLS Export Sessions or adding a DSB.
582  */
583  GHashTable *used_crandom;
585 
586 gint ssl_get_keyex_alg(gint cipher);
587 
588 void quic_transport_parameter_id_base_custom(gchar *result, guint64 parameter_id);
589 
590 bool ssldecrypt_uat_fld_ip_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
591 bool ssldecrypt_uat_fld_port_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
592 bool ssldecrypt_uat_fld_fileopen_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
593 bool ssldecrypt_uat_fld_password_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
594 gchar* ssl_association_info(const char* dissector_table_name, const char* table_protocol);
595 
597 void ssl_init_cid_list(void);
598 
600 void ssl_cleanup_cid_list(void);
601 
603 void ssl_add_session_by_cid(SslDecryptSession *ssl);
604 
610 SslDecryptSession *ssl_get_session_by_cid(tvbuff_t *tvb, guint32 offset);
611 
616 extern SslDecryptSession *
617 ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle);
618 
620 extern void
621 ssl_reset_session(SslSession *session, SslDecryptSession *ssl, gboolean is_client);
622 
624 extern void
625 ssl_set_server(SslSession *session, address *addr, port_type ptype, guint32 port);
626 
634 WS_DLL_PUBLIC void
635 tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
636  dissector_handle_t app_handle);
637 
647 WS_DLL_PUBLIC guint32
648 ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
649  dissector_handle_t app_handle);
650 
659 WS_DLL_PUBLIC guint32
660 ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
661  dissector_handle_t app_handle);
662 
663 extern dissector_handle_t
664 ssl_find_appdata_dissector(const char *name);
665 
671 extern void
672 ssl_data_set(StringInfo* buf, const guchar* src, guint len);
673 
677 extern gint
678 ssl_data_alloc(StringInfo* str, size_t len);
679 
680 extern gint
681 ssl_cipher_setiv(SSL_CIPHER_CTX *cipher, guchar* iv, gint iv_len);
682 
686 extern const SslCipherSuite *
687 ssl_find_cipher(int num);
688 
689 
691 int
692 ssl_get_cipher_algo(const SslCipherSuite *cipher_suite);
693 
698 guint
699 ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite);
700 
701 gboolean
702 ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
703  guint32 length, tvbuff_t *tvb, guint32 offset,
704  const gchar *ssl_psk, packet_info *pinfo,
705 #ifdef HAVE_LIBGNUTLS
706  GHashTable *key_hash,
707 #endif
708  const ssl_master_key_map_t *mk_map);
709 
714 extern gint
715 ssl_generate_keyring_material(SslDecryptSession*ssl_session);
716 
717 extern void
718 ssl_change_cipher(SslDecryptSession *ssl_session, gboolean server);
719 
734 extern gint
735 ssl_decrypt_record(SslDecryptSession *ssl, SslDecoder *decoder, guint8 ct, guint16 record_version,
736  gboolean ignore_mac_failed,
737  const guchar *in, guint16 inl, const guchar *cid, guint8 cidl,
738  StringInfo *comp_str, StringInfo *out_str, guint *outl);
739 
740 
741 /* Common part between TLS and DTLS dissectors */
742 
743 /* handling of association between tls/dtls ports and clear text protocol */
744 extern void
745 ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
746 
747 extern void
748 ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
749 
750 extern gint
751 ssl_packet_from_server(SslSession *session, dissector_table_t table, packet_info *pinfo);
752 
753 /* Obtain information about the current TLS layer. */
755 tls_add_packet_info(gint proto, packet_info *pinfo, guint8 curr_layer_num_ssl);
756 
757 /* add to packet data a copy of the specified real data */
758 extern void
759 ssl_add_record_info(gint proto, packet_info *pinfo, const guchar *data, gint data_len, gint record_id, SslFlow *flow, ContentType type, guint8 curr_layer_num_ssl);
760 
761 /* search in packet data for the specified id; return a newly created tvb for the associated data */
762 extern tvbuff_t*
763 ssl_get_record_info(tvbuff_t *parent_tvb, gint proto, packet_info *pinfo, gint record_id, guint8 curr_layer_num_ssl, SslRecordInfo **matched_record);
764 
765 /* initialize/reset per capture state data (ssl sessions cache) */
766 extern void
767 ssl_common_init(ssl_master_key_map_t *master_key_map,
768  StringInfo *decrypted_data, StringInfo *compressed_data);
769 extern void
770 ssl_common_cleanup(ssl_master_key_map_t *master_key_map, FILE **ssl_keylog_file,
771  StringInfo *decrypted_data, StringInfo *compressed_data);
772 
778 WS_DLL_PUBLIC ssl_master_key_map_t *
779 tls_get_master_key_map(gboolean load_secrets);
780 
781 /* Process lines from the TLS key log and populate the secrets map. */
782 extern void
783 tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const guint8 *data, guint len);
784 
785 /* tries to update the secrets cache from the given filename */
786 extern void
787 ssl_load_keyfile(const gchar *ssl_keylog_filename, FILE **keylog_file,
788  const ssl_master_key_map_t *mk_map);
789 
790 #ifdef HAVE_LIBGNUTLS
791 /* parse ssl related preferences (private keys and ports association strings) */
792 extern void
793 ssl_parse_key_list(const ssldecrypt_assoc_t * uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, gboolean tcp);
794 #endif
795 
796 extern void
797 ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
798 
803 extern void
804 tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
805 
806 extern gboolean
807 tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, gboolean is_from_server);
808 
809 extern StringInfo *
810 tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
811  gboolean is_from_server, TLSRecordType type);
812 
813 extern void
814 tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
815  gboolean is_from_server, TLSRecordType type);
816 
817 extern void
818 tls13_key_update(SslDecryptSession *ssl, gboolean is_from_server);
819 
820 extern gboolean
821 ssl_is_valid_content_type(guint8 type);
822 
823 extern gboolean
824 ssl_is_valid_handshake_type(guint8 hs_type, gboolean is_dtls);
825 
826 extern bool
827 tls_scan_server_hello(tvbuff_t *tvb, guint32 offset, guint32 offset_end,
828  guint16 *server_version, bool *is_hrr);
829 
830 extern void
831 ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
832  guint8 content_type, guint8 handshake_type,
833  gboolean is_dtls, guint16 version);
834 
835 extern void
836 ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, guint32 offset, guint32 length);
837 
838 /* common header fields, subtrees and expert info for SSL and DTLS dissectors */
839 typedef struct ssl_common_dissect {
840  struct {
841  gint change_cipher_spec;
842  gint hs_exts_len;
843  gint hs_ext_alpn_len;
844  gint hs_ext_alpn_list;
845  gint hs_ext_alpn_str;
846  gint hs_ext_alpn_str_len;
847  gint hs_ext_cert_url_item;
848  gint hs_ext_cert_url_padding;
849  gint hs_ext_cert_url_sha1;
850  gint hs_ext_cert_url_type;
851  gint hs_ext_cert_url_url;
852  gint hs_ext_cert_url_url_hash_list_len;
853  gint hs_ext_cert_url_url_len;
854  gint hs_ext_cert_status_type;
855  gint hs_ext_cert_status_request_len;
856  gint hs_ext_cert_status_responder_id_list_len;
857  gint hs_ext_cert_status_request_extensions_len;
858  gint hs_ext_cert_status_request_list_len;
859  gint hs_ocsp_response_list_len;
860  gint hs_ocsp_response_len;
861  gint hs_ext_cert_type;
862  gint hs_ext_cert_types;
863  gint hs_ext_cert_types_len;
864  gint hs_ext_data;
865  gint hs_ext_ec_point_format;
866  gint hs_ext_ec_point_formats;
867  gint hs_ext_ec_point_formats_len;
868  gint hs_ext_srp_len;
869  gint hs_ext_srp_username;
870  gint hs_ext_supported_group;
871  gint hs_ext_supported_groups;
872  gint hs_ext_supported_groups_len;
873  gint hs_ext_heartbeat_mode;
874  gint hs_ext_len;
875  gint hs_ext_npn_str;
876  gint hs_ext_npn_str_len;
877  gint hs_ext_reneg_info_len;
878  gint hs_ext_reneg_info;
879  gint hs_ext_key_share_client_length;
880  gint hs_ext_key_share_group;
881  gint hs_ext_key_share_key_exchange_length;
882  gint hs_ext_key_share_key_exchange;
883  gint hs_ext_key_share_selected_group;
884  gint hs_ext_psk_identities_length;
885  gint hs_ext_psk_identity_identity_length;
886  gint hs_ext_psk_identity_identity;
887  gint hs_ext_psk_identity_obfuscated_ticket_age;
888  gint hs_ext_psk_binders_length;
889  gint hs_ext_psk_binders;
890  gint hs_ext_psk_identity_selected;
891  gint hs_ext_session_ticket;
892  gint hs_ext_supported_versions_len;
893  gint hs_ext_supported_version;
894  gint hs_ext_cookie_len;
895  gint hs_ext_cookie;
896  gint hs_ext_server_name;
897  gint hs_ext_server_name_len;
898  gint hs_ext_server_name_list_len;
899  gint hs_ext_server_name_type;
900  gint hs_ext_max_fragment_length;
901  gint hs_ext_padding_data;
902  gint hs_ext_type;
903  gint hs_ext_connection_id_length;
904  gint hs_ext_connection_id;
905  gint hs_sig_hash_alg;
906  gint hs_sig_hash_alg_len;
907  gint hs_sig_hash_algs;
908  gint hs_sig_hash_hash;
909  gint hs_sig_hash_sig;
910  gint hs_client_keyex_epms_len;
911  gint hs_client_keyex_epms;
912  gint hs_server_keyex_modulus_len;
913  gint hs_server_keyex_exponent_len;
914  gint hs_server_keyex_sig_len;
915  gint hs_server_keyex_p_len;
916  gint hs_server_keyex_g_len;
917  gint hs_server_keyex_ys_len;
918  gint hs_client_keyex_yc_len;
919  gint hs_client_keyex_point_len;
920  gint hs_server_keyex_point_len;
921  gint hs_server_keyex_p;
922  gint hs_server_keyex_g;
923  gint hs_server_keyex_curve_type;
924  gint hs_server_keyex_named_curve;
925  gint hs_server_keyex_ys;
926  gint hs_client_keyex_yc;
927  gint hs_server_keyex_point;
928  gint hs_client_keyex_point;
929  gint hs_server_keyex_xs_len;
930  gint hs_client_keyex_xc_len;
931  gint hs_server_keyex_xs;
932  gint hs_client_keyex_xc;
933  gint hs_server_keyex_vs_len;
934  gint hs_client_keyex_vc_len;
935  gint hs_server_keyex_vs;
936  gint hs_client_keyex_vc;
937  gint hs_server_keyex_rs_len;
938  gint hs_client_keyex_rc_len;
939  gint hs_server_keyex_rs;
940  gint hs_client_keyex_rc;
941  gint hs_server_keyex_modulus;
942  gint hs_server_keyex_exponent;
943  gint hs_server_keyex_sig;
944  gint hs_server_keyex_hint_len;
945  gint hs_server_keyex_hint;
946  gint hs_client_keyex_identity_len;
947  gint hs_client_keyex_identity;
948  gint hs_certificates_len;
949  gint hs_certificates;
950  gint hs_certificate_len;
951  gint hs_certificate;
952  gint hs_cert_types_count;
953  gint hs_cert_types;
954  gint hs_cert_type;
955  gint hs_dnames_len;
956  gint hs_dnames;
957  gint hs_dnames_truncated;
958  gint hs_dname_len;
959  gint hs_dname;
960  gint hs_random;
961  gint hs_random_time;
962  gint hs_random_bytes;
963  gint hs_session_id;
964  gint hs_session_id_len;
965  gint hs_client_version;
966  gint hs_server_version;
967  gint hs_cipher_suites_len;
968  gint hs_cipher_suites;
969  gint hs_cipher_suite;
970  gint hs_comp_methods_len;
971  gint hs_comp_methods;
972  gint hs_comp_method;
973  gint hs_session_ticket_lifetime_hint;
974  gint hs_session_ticket_age_add;
975  gint hs_session_ticket_nonce_len;
976  gint hs_session_ticket_nonce;
977  gint hs_session_ticket_len;
978  gint hs_session_ticket;
979  gint hs_finished;
980  gint hs_client_cert_vrfy_sig_len;
981  gint hs_client_cert_vrfy_sig;
982  gint hs_ja3_full;
983  gint hs_ja3_hash;
984  gint hs_ja3s_full;
985  gint hs_ja3s_hash;
986  gint hs_ja4;
987  gint hs_ja4_r;
988 
989  /* TLS 1.3 */
990  gint hs_ext_psk_ke_modes_length;
991  gint hs_ext_psk_ke_mode;
992  gint hs_certificate_request_context_length;
993  gint hs_certificate_request_context;
994  gint hs_key_update_request_update;
995  gint sct_scts_length;
996  gint sct_sct_length;
997  gint sct_sct_version;
998  gint sct_sct_logid;
999  gint sct_sct_timestamp;
1000  gint sct_sct_extensions_length;
1001  gint sct_sct_extensions;
1002  gint sct_sct_signature;
1003  gint sct_sct_signature_length;
1004  gint hs_ext_max_early_data_size;
1005  gint hs_ext_oid_filters_length;
1006  gint hs_ext_oid_filters_oid_length;
1007  gint hs_ext_oid_filters_oid;
1008  gint hs_ext_oid_filters_values_length;
1009  gint hs_cred_valid_time;
1010  gint hs_cred_pubkey;
1011  gint hs_cred_pubkey_len;
1012  gint hs_cred_signature;
1013  gint hs_cred_signature_len;
1014 
1015  /* compress_certificate */
1016  gint hs_ext_compress_certificate_algorithms_length;
1017  gint hs_ext_compress_certificate_algorithm;
1018  gint hs_ext_compress_certificate_uncompressed_length;
1019  gint hs_ext_compress_certificate_compressed_certificate_message_length;
1020  gint hs_ext_compress_certificate_compressed_certificate_message;
1021 
1022  /* Token Binding Negotiation */
1023  gint hs_ext_token_binding_version_major;
1024  gint hs_ext_token_binding_version_minor;
1025  gint hs_ext_token_binding_key_parameters;
1026  gint hs_ext_token_binding_key_parameters_length;
1027  gint hs_ext_token_binding_key_parameter;
1028 
1029  gint hs_ext_record_size_limit;
1030 
1031  /* QUIC Transport Parameters */
1032  gint hs_ext_quictp_len;
1033  gint hs_ext_quictp_parameter;
1034  gint hs_ext_quictp_parameter_type;
1035  gint hs_ext_quictp_parameter_len;
1036  gint hs_ext_quictp_parameter_len_old;
1037  gint hs_ext_quictp_parameter_value;
1038  gint hs_ext_quictp_parameter_original_destination_connection_id;
1039  gint hs_ext_quictp_parameter_max_idle_timeout;
1040  gint hs_ext_quictp_parameter_stateless_reset_token;
1041  gint hs_ext_quictp_parameter_initial_max_data;
1042  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_local;
1043  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote;
1044  gint hs_ext_quictp_parameter_initial_max_stream_data_uni;
1045  gint hs_ext_quictp_parameter_initial_max_streams_bidi;
1046  gint hs_ext_quictp_parameter_initial_max_streams_uni;
1047  gint hs_ext_quictp_parameter_ack_delay_exponent;
1048  gint hs_ext_quictp_parameter_max_ack_delay;
1049  gint hs_ext_quictp_parameter_max_udp_payload_size;
1050  gint hs_ext_quictp_parameter_pa_ipv4address;
1051  gint hs_ext_quictp_parameter_pa_ipv6address;
1052  gint hs_ext_quictp_parameter_pa_ipv4port;
1053  gint hs_ext_quictp_parameter_pa_ipv6port;
1054  gint hs_ext_quictp_parameter_pa_connectionid_length;
1055  gint hs_ext_quictp_parameter_pa_connectionid;
1056  gint hs_ext_quictp_parameter_pa_statelessresettoken;
1057  gint hs_ext_quictp_parameter_active_connection_id_limit;
1058  gint hs_ext_quictp_parameter_initial_source_connection_id;
1059  gint hs_ext_quictp_parameter_retry_source_connection_id;
1060  gint hs_ext_quictp_parameter_max_datagram_frame_size;
1061  gint hs_ext_quictp_parameter_cibir_encoding_length;
1062  gint hs_ext_quictp_parameter_cibir_encoding_offset;
1063  gint hs_ext_quictp_parameter_loss_bits;
1064  gint hs_ext_quictp_parameter_enable_time_stamp_v2;
1065  gint hs_ext_quictp_parameter_min_ack_delay;
1066  gint hs_ext_quictp_parameter_google_user_agent_id;
1067  gint hs_ext_quictp_parameter_google_key_update_not_yet_supported;
1068  gint hs_ext_quictp_parameter_google_quic_version;
1069  gint hs_ext_quictp_parameter_google_initial_rtt;
1070  gint hs_ext_quictp_parameter_google_support_handshake_done;
1071  gint hs_ext_quictp_parameter_google_quic_params;
1072  gint hs_ext_quictp_parameter_google_quic_params_unknown_field;
1073  gint hs_ext_quictp_parameter_google_connection_options;
1074  gint hs_ext_quictp_parameter_google_supported_versions_length;
1075  gint hs_ext_quictp_parameter_google_supported_version;
1076  gint hs_ext_quictp_parameter_facebook_partial_reliability;
1077  gint hs_ext_quictp_parameter_chosen_version;
1078  gint hs_ext_quictp_parameter_other_version;
1079  gint hs_ext_quictp_parameter_enable_multipath;
1080  gint hs_ext_quictp_parameter_initial_max_paths;
1081 
1082  gint esni_suite;
1083  gint esni_record_digest_length;
1084  gint esni_record_digest;
1085  gint esni_encrypted_sni_length;
1086  gint esni_encrypted_sni;
1087  gint esni_nonce;
1088 
1089  gint ech_echconfiglist_length;
1090  gint ech_echconfiglist;
1091  gint ech_echconfig;
1092  gint ech_echconfig_version;
1093  gint ech_echconfig_length;
1094  gint ech_echconfigcontents_maximum_name_length;
1095  gint ech_echconfigcontents_public_name_length;
1096  gint ech_echconfigcontents_public_name;
1097  gint ech_echconfigcontents_extensions_length;
1098  gint ech_echconfigcontents_extensions;
1099  gint ech_hpke_keyconfig;
1100  gint ech_hpke_keyconfig_config_id;
1101  gint ech_hpke_keyconfig_kem_id;
1102  gint ech_hpke_keyconfig_public_key_length;
1103  gint ech_hpke_keyconfig_public_key;
1104  gint ech_hpke_keyconfig_cipher_suites;
1105  gint ech_hpke_keyconfig_cipher_suites_length;
1106  gint ech_hpke_keyconfig_cipher_suite;
1107  gint ech_hpke_keyconfig_cipher_suite_kdf_id;
1108  gint ech_hpke_keyconfig_cipher_suite_aead_id;
1109  gint ech_clienthello_type;
1110  gint ech_cipher_suite;
1111  gint ech_config_id;
1112  gint ech_enc_length;
1113  gint ech_enc;
1114  gint ech_payload_length;
1115  gint ech_payload;
1116  gint ech_confirmation;
1117  gint ech_retry_configs;
1118 
1119  gint hs_ext_alps_len;
1120  gint hs_ext_alps_alpn_list;
1121  gint hs_ext_alps_alpn_str;
1122  gint hs_ext_alps_alpn_str_len;
1123  gint hs_ext_alps_settings;
1124 
1125  /* do not forget to update SSL_COMMON_HF_LIST! */
1126  } hf;
1127  struct {
1128  gint hs_ext;
1129  gint hs_ext_alpn;
1130  gint hs_ext_cert_types;
1131  gint hs_ext_groups;
1132  gint hs_ext_curves_point_formats;
1133  gint hs_ext_npn;
1134  gint hs_ext_reneg_info;
1135  gint hs_ext_key_share;
1136  gint hs_ext_key_share_ks;
1137  gint hs_ext_pre_shared_key;
1138  gint hs_ext_psk_identity;
1139  gint hs_ext_server_name;
1140  gint hs_ext_oid_filter;
1141  gint hs_ext_quictp_parameter;
1142  gint hs_sig_hash_alg;
1143  gint hs_sig_hash_algs;
1144  gint urlhash;
1145  gint keyex_params;
1146  gint certificates;
1147  gint cert_types;
1148  gint dnames;
1149  gint hs_random;
1150  gint cipher_suites;
1151  gint comp_methods;
1152  gint session_ticket;
1153  gint sct;
1154  gint cert_status;
1155  gint ocsp_response;
1156  gint uncompressed_certificates;
1157  gint hs_ext_alps;
1158  gint ech_echconfiglist;
1159  gint ech_echconfig;
1160  gint ech_retry_configs;
1161  gint ech_hpke_keyconfig;
1162  gint ech_hpke_cipher_suites;
1163  gint ech_hpke_cipher_suite;
1164  gint hs_ext_token_binding_key_parameters;
1165 
1166  /* do not forget to update SSL_COMMON_ETT_LIST! */
1167  } ett;
1168  struct {
1169  /* Generic expert info for malformed packets. */
1170  expert_field client_version_error;
1171  expert_field server_version_error;
1172  expert_field legacy_version;
1173  expert_field malformed_vector_length;
1174  expert_field malformed_buffer_too_small;
1175  expert_field malformed_trailing_data;
1176 
1177  expert_field hs_ext_cert_status_undecoded;
1178  expert_field resumed;
1179  expert_field record_length_invalid;
1180  expert_field decompression_error;
1181 
1182  expert_field ech_echconfig_invalid_version;
1183 
1184  /* do not forget to update SSL_COMMON_EI_LIST! */
1185  } ei;
1187 
1188 /* Header fields specific to DTLS. See packet-dtls.c */
1189 typedef struct {
1190  gint hf_dtls_handshake_cookie_len;
1191  gint hf_dtls_handshake_cookie;
1192 
1193  /* Do not forget to initialize dtls_hfs to -1 in packet-dtls.c! */
1194 } dtls_hfs_t;
1195 
1196 /* Header fields specific to SSL. See packet-tls.c */
1197 typedef struct {
1198  gint hs_md5_hash;
1199  gint hs_sha_hash;
1200 
1201  /* Do not forget to initialize ssl_hfs to -1 in packet-tls.c! */
1202 } ssl_hfs_t;
1204 typedef struct {
1205  guint32 max_version;
1206  gboolean server_name_present;
1207  gint num_cipher_suites;
1208  gint num_extensions;
1209  wmem_strbuf_t *alpn;
1210  wmem_list_t *cipher_list;
1211  wmem_list_t *extension_list;
1212  wmem_list_t *sighash_list;
1213 } ja4_data_t;
1214 
1215 
1216 /* Helpers for dissecting Variable-Length Vectors. {{{ */
1217 /* Largest value that fits in a 24-bit number (2^24-1). */
1218 #define G_MAXUINT24 ((1U << 24) - 1)
1219 
1232 extern gboolean
1233 ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1234  guint offset, guint offset_end, guint32 *ret_length,
1235  int hf_length, guint32 min_value, guint32 max_value);
1236 
1245 extern gboolean
1246 ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1247  guint offset, guint offset_end);
1248 /* }}} */
1249 
1250 
1251 extern void
1252 ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
1253  ContentType content_type,
1254  guint record_length, proto_item *length_pi,
1255  guint16 version, tvbuff_t *decrypted_tvb);
1256 
1257 void
1258 ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1259  packet_info *pinfo, proto_tree *tree,
1260  guint32 offset, SslSession *session,
1261  gboolean is_from_server,
1262  const SslDecryptSession *ssl);
1263 
1264 extern void
1265 ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1266  packet_info *pinfo, proto_tree *tree, guint32 offset,
1267  guint32 offset_end, SslSession *session,
1268  SslDecryptSession *ssl,
1269  dtls_hfs_t *dtls_hfs);
1270 
1271 extern void
1272 ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1273  proto_tree *tree, guint32 offset, guint32 offset_end,
1274  SslSession *session, SslDecryptSession *ssl,
1275  gboolean is_dtls, gboolean is_hrr);
1276 
1277 extern void
1278 ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1279  proto_tree *tree, guint32 offset, guint32 offset_end,
1280  SslSession *session, SslDecryptSession *ssl,
1281  gboolean is_dtls);
1282 
1283 extern void
1284 ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1285  proto_tree *tree, guint32 offset, guint32 offset_end,
1286  SslSession *session, SslDecryptSession *ssl,
1287  gboolean is_dtls);
1288 
1289 extern void
1290 ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1291  proto_tree *tree, guint32 offset, guint32 offset_end,
1292  SslSession *session, SslDecryptSession *ssl,
1293  gboolean is_dtls, GHashTable *session_hash);
1294 
1295 extern void
1296 ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1297  guint32 offset, guint32 offset_end, packet_info *pinfo,
1298  SslSession *session, SslDecryptSession *ssl,
1299  gboolean is_from_server, gboolean is_dtls);
1300 
1301 extern void
1302 ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1303  proto_tree *tree, guint32 offset, guint32 offset_end,
1304  SslSession *session, gboolean is_dtls);
1305 
1306 extern void
1307 ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1308  proto_tree *tree, guint32 offset, guint32 offset_end, guint16 version);
1309 
1310 extern void
1311 ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1312  proto_tree *tree, guint32 offset, guint32 offset_end,
1313  const SslSession *session, ssl_hfs_t *ssl_hfs);
1314 
1315 extern void
1316 ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, guint32 offset);
1317 
1318 extern guint32
1319 tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1320  proto_tree *tree, guint32 offset, guint32 offset_end);
1321 
1322 extern void
1323 ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1324  proto_tree *tree, guint32 offset, guint32 length,
1325  const SslSession *session);
1326 
1327 extern void
1328 ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1329  proto_tree *tree, guint32 offset, guint32 offset_end,
1330  const SslSession *session);
1331 
1332 extern void
1333 tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1334  proto_tree *tree, guint32 offset);
1335 
1336 extern guint32
1337 tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1338  guint32 offset, guint32 offset_end, guint16 version);
1339 
1340 extern gboolean
1341 tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
1342  const char *label_prefix, const char *label,
1343  const guint8 *context, guint8 context_length,
1344  guint16 out_len, guchar **out);
1345 
1346 extern gboolean
1347 tls13_hkdf_expand_label(int md, const StringInfo *secret,
1348  const char *label_prefix, const char *label,
1349  guint16 out_len, guchar **out);
1350 
1351 extern void
1352 ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1353  guint32 offset, guint32 offset_end, packet_info *pinfo,
1354  SslSession *session _U_, SslDecryptSession *ssl _U_,
1355  gboolean is_from_server _U_, gboolean is_dtls _U_);
1356 /* {{{ */
1357 #define SSL_COMMON_LIST_T(name) \
1358 ssl_common_dissect_t name;
1359 /* }}} */
1360 
1361 /* {{{ */
1362 #define SSL_COMMON_HF_LIST(name, prefix) \
1363  { & name .hf.change_cipher_spec, \
1364  { "Change Cipher Spec Message", prefix ".change_cipher_spec", \
1365  FT_NONE, BASE_NONE, NULL, 0x0, \
1366  "Signals a change in cipher specifications", HFILL } \
1367  }, \
1368  { & name .hf.hs_exts_len, \
1369  { "Extensions Length", prefix ".handshake.extensions_length", \
1370  FT_UINT16, BASE_DEC, NULL, 0x0, \
1371  "Length of hello extensions", HFILL } \
1372  }, \
1373  { & name .hf.hs_ext_type, \
1374  { "Type", prefix ".handshake.extension.type", \
1375  FT_UINT16, BASE_DEC, VALS(tls_hello_extension_types), 0x0, \
1376  "Hello extension type", HFILL } \
1377  }, \
1378  { & name .hf.hs_ext_len, \
1379  { "Length", prefix ".handshake.extension.len", \
1380  FT_UINT16, BASE_DEC, NULL, 0x0, \
1381  "Length of a hello extension", HFILL } \
1382  }, \
1383  { & name .hf.hs_ext_data, \
1384  { "Data", prefix ".handshake.extension.data", \
1385  FT_BYTES, BASE_NONE, NULL, 0x0, \
1386  "Hello Extension data", HFILL } \
1387  }, \
1388  { & name .hf.hs_ext_supported_groups_len, \
1389  { "Supported Groups List Length", prefix ".handshake.extensions_supported_groups_length", \
1390  FT_UINT16, BASE_DEC, NULL, 0x0, \
1391  NULL, HFILL } \
1392  }, \
1393  { & name .hf.hs_ext_supported_groups, \
1394  { "Supported Groups List", prefix ".handshake.extensions_supported_groups", \
1395  FT_NONE, BASE_NONE, NULL, 0x0, \
1396  "List of supported groups (formerly Supported Elliptic Curves)", HFILL } \
1397  }, \
1398  { & name .hf.hs_ext_supported_group, \
1399  { "Supported Group", prefix ".handshake.extensions_supported_group", \
1400  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1401  NULL, HFILL } \
1402  }, \
1403  { & name .hf.hs_ext_ec_point_formats_len, \
1404  { "EC point formats Length", prefix ".handshake.extensions_ec_point_formats_length", \
1405  FT_UINT8, BASE_DEC, NULL, 0x0, \
1406  "Length of elliptic curves point formats field", HFILL } \
1407  }, \
1408  { & name .hf.hs_ext_ec_point_formats, \
1409  { "EC point formats", prefix ".handshake.extensions_ec_point_formats", \
1410  FT_NONE, BASE_NONE, NULL, 0x0, \
1411  "List of elliptic curves point format", HFILL } \
1412  }, \
1413  { & name .hf.hs_ext_ec_point_format, \
1414  { "EC point format", prefix ".handshake.extensions_ec_point_format", \
1415  FT_UINT8, BASE_DEC, VALS(ssl_extension_ec_point_formats), 0x0, \
1416  "Elliptic curves point format", HFILL } \
1417  }, \
1418  { & name .hf.hs_ext_srp_len, \
1419  { "SRP username length", prefix ".handshake.extensions_srp_len", \
1420  FT_UINT8, BASE_DEC, NULL, 0x0, \
1421  "Length of Secure Remote Password username field", HFILL } \
1422  }, \
1423  { & name .hf.hs_ext_srp_username, \
1424  { "SRP username", prefix ".handshake.extensions_srp_username", \
1425  FT_STRING, BASE_NONE, NULL, 0x0, \
1426  "Secure Remote Password username", HFILL } \
1427  }, \
1428  { & name .hf.hs_ext_alpn_len, \
1429  { "ALPN Extension Length", prefix ".handshake.extensions_alpn_len", \
1430  FT_UINT16, BASE_DEC, NULL, 0x0, \
1431  "Length of the ALPN Extension", HFILL } \
1432  }, \
1433  { & name .hf.hs_ext_alpn_list, \
1434  { "ALPN Protocol", prefix ".handshake.extensions_alpn_list", \
1435  FT_NONE, BASE_NONE, NULL, 0x0, \
1436  NULL, HFILL } \
1437  }, \
1438  { & name .hf.hs_ext_alpn_str_len, \
1439  { "ALPN string length", prefix ".handshake.extensions_alpn_str_len", \
1440  FT_UINT8, BASE_DEC, NULL, 0x0, \
1441  "Length of ALPN string", HFILL } \
1442  }, \
1443  { & name .hf.hs_ext_alpn_str, \
1444  { "ALPN Next Protocol", prefix ".handshake.extensions_alpn_str", \
1445  FT_STRING, BASE_NONE, NULL, 0x00, \
1446  NULL, HFILL } \
1447  }, \
1448  { & name .hf.hs_ext_npn_str_len, \
1449  { "Protocol string length", prefix ".handshake.extensions_npn_str_len", \
1450  FT_UINT8, BASE_DEC, NULL, 0x0, \
1451  "Length of next protocol string", HFILL } \
1452  }, \
1453  { & name .hf.hs_ext_npn_str, \
1454  { "Next Protocol", prefix ".handshake.extensions_npn", \
1455  FT_STRING, BASE_NONE, NULL, 0x0, \
1456  NULL, HFILL } \
1457  }, \
1458  { & name .hf.hs_ext_reneg_info_len, \
1459  { "Renegotiation info extension length", prefix ".handshake.extensions_reneg_info_len", \
1460  FT_UINT8, BASE_DEC, NULL, 0x0, \
1461  NULL, HFILL } \
1462  }, \
1463  { & name .hf.hs_ext_reneg_info, \
1464  { "Renegotiation info", prefix ".handshake.extensions_reneg_info",\
1465  FT_BYTES, BASE_NONE, NULL, 0x0, \
1466  NULL, HFILL } \
1467  }, \
1468  { & name .hf.hs_ext_key_share_client_length, \
1469  { "Client Key Share Length", prefix ".handshake.extensions_key_share_client_length", \
1470  FT_UINT16, BASE_DEC, NULL, 0x00, \
1471  NULL, HFILL } \
1472  }, \
1473  { & name .hf.hs_ext_key_share_group, \
1474  { "Group", prefix ".handshake.extensions_key_share_group", \
1475  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1476  NULL, HFILL } \
1477  }, \
1478  { & name .hf.hs_ext_key_share_key_exchange_length, \
1479  { "Key Exchange Length", prefix ".handshake.extensions_key_share_key_exchange_length", \
1480  FT_UINT16, BASE_DEC, NULL, 0x00, \
1481  NULL, HFILL } \
1482  }, \
1483  { & name .hf.hs_ext_key_share_key_exchange, \
1484  { "Key Exchange", prefix ".handshake.extensions_key_share_key_exchange", \
1485  FT_BYTES, BASE_NONE, NULL, 0x0, \
1486  NULL, HFILL } \
1487  }, \
1488  { & name .hf.hs_ext_key_share_selected_group, \
1489  { "Selected Group", prefix ".handshake.extensions_key_share_selected_group", \
1490  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1491  NULL, HFILL } \
1492  }, \
1493  { & name .hf.hs_ext_psk_identities_length, \
1494  { "Identities Length", prefix ".handshake.extensions.psk.identities.length", \
1495  FT_UINT16, BASE_DEC, NULL, 0x0, \
1496  NULL, HFILL } \
1497  }, \
1498  { & name .hf.hs_ext_psk_identity_identity_length, \
1499  { "Identity Length", prefix ".handshake.extensions.psk.identity.identity_length", \
1500  FT_UINT16, BASE_DEC, NULL, 0x0, \
1501  NULL, HFILL } \
1502  }, \
1503  { & name .hf.hs_ext_psk_identity_identity, \
1504  { "Identity", prefix ".handshake.extensions.psk.identity.identity", \
1505  FT_BYTES, BASE_NONE, NULL, 0x0, \
1506  NULL, HFILL } \
1507  }, \
1508  { & name .hf.hs_ext_psk_identity_obfuscated_ticket_age, \
1509  { "Obfuscated Ticket Age", prefix ".handshake.extensions.psk.identity.obfuscated_ticket_age", \
1510  FT_UINT32, BASE_DEC, NULL, 0x0, \
1511  NULL, HFILL } \
1512  }, \
1513  { & name .hf.hs_ext_psk_binders_length, \
1514  { "PSK Binders length", prefix ".handshake.extensions.psk.binders_len", \
1515  FT_UINT16, BASE_DEC, NULL, 0x0, \
1516  NULL, HFILL } \
1517  }, \
1518  { & name .hf.hs_ext_psk_binders, \
1519  { "PSK Binders", prefix ".handshake.extensions.psk.binders", \
1520  FT_NONE, BASE_NONE, NULL, 0x0, \
1521  NULL, HFILL } \
1522  }, \
1523  { & name .hf.hs_ext_psk_identity_selected, \
1524  { "Selected Identity", prefix ".handshake.extensions.psk.identity.selected", \
1525  FT_UINT16, BASE_DEC, NULL, 0x0, \
1526  NULL, HFILL } \
1527  }, \
1528  { & name .hf.hs_ext_session_ticket, \
1529  { "Session Ticket", prefix ".handshake.extensions.session_ticket", \
1530  FT_BYTES, BASE_NONE, NULL, 0x0, \
1531  NULL, HFILL } \
1532  }, \
1533  { & name .hf.hs_ext_supported_versions_len, \
1534  { "Supported Versions length", prefix ".handshake.extensions.supported_versions_len", \
1535  FT_UINT8, BASE_DEC, NULL, 0x0, \
1536  NULL, HFILL } \
1537  }, \
1538  { & name .hf.hs_ext_supported_version, \
1539  { "Supported Version", prefix ".handshake.extensions.supported_version", \
1540  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1541  NULL, HFILL } \
1542  }, \
1543  { & name .hf.hs_ext_cookie_len, \
1544  { "Cookie length", prefix ".handshake.extensions.cookie_len", \
1545  FT_UINT16, BASE_DEC, NULL, 0x0, \
1546  NULL, HFILL } \
1547  }, \
1548  { & name .hf.hs_ext_cookie, \
1549  { "Cookie", prefix ".handshake.extensions.cookie", \
1550  FT_BYTES, BASE_NONE, NULL, 0x0, \
1551  NULL, HFILL } \
1552  }, \
1553  { & name .hf.hs_ext_server_name_list_len, \
1554  { "Server Name list length", prefix ".handshake.extensions_server_name_list_len", \
1555  FT_UINT16, BASE_DEC, NULL, 0x0, \
1556  "Length of server name list", HFILL } \
1557  }, \
1558  { & name .hf.hs_ext_server_name_len, \
1559  { "Server Name length", prefix ".handshake.extensions_server_name_len", \
1560  FT_UINT16, BASE_DEC, NULL, 0x0, \
1561  "Length of server name string", HFILL } \
1562  }, \
1563  { & name .hf.hs_ext_server_name_type, \
1564  { "Server Name Type", prefix ".handshake.extensions_server_name_type", \
1565  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_server_name_type_vs), 0x0, \
1566  NULL, HFILL } \
1567  }, \
1568  { & name .hf.hs_ext_server_name, \
1569  { "Server Name", prefix ".handshake.extensions_server_name", \
1570  FT_STRING, BASE_NONE, NULL, 0x0, \
1571  NULL, HFILL } \
1572  }, \
1573  { & name .hf.hs_ext_max_fragment_length, \
1574  { "Maximum Fragment Length", prefix ".handshake.max_fragment_length", \
1575  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_max_fragment_length), 0x00, \
1576  "Maximum fragment length that an endpoint is willing to receive", HFILL } \
1577  }, \
1578  { & name .hf.hs_ext_padding_data, \
1579  { "Padding Data", prefix ".handshake.extensions_padding_data", \
1580  FT_BYTES, BASE_NONE, NULL, 0x0, \
1581  "Must be zero", HFILL } \
1582  }, \
1583  { & name .hf.hs_ext_cert_url_type, \
1584  { "Certificate Chain Type", prefix ".handshake.cert_url_type", \
1585  FT_UINT8, BASE_DEC, VALS(tls_cert_chain_type), 0x0, \
1586  "Certificate Chain Type for Client Certificate URL", HFILL } \
1587  }, \
1588  { & name .hf.hs_ext_cert_url_url_hash_list_len, \
1589  { "URL and Hash list Length", prefix ".handshake.cert_url.url_hash_len", \
1590  FT_UINT16, BASE_DEC, NULL, 0x0, \
1591  NULL, HFILL } \
1592  }, \
1593  { & name .hf.hs_ext_cert_url_item, \
1594  { "URL and Hash", prefix ".handshake.cert_url.url_hash", \
1595  FT_NONE, BASE_NONE, NULL, 0x0, \
1596  NULL, HFILL } \
1597  }, \
1598  { & name .hf.hs_ext_cert_url_url_len, \
1599  { "URL Length", prefix ".handshake.cert_url.url_len", \
1600  FT_UINT16, BASE_DEC, NULL, 0x0, \
1601  NULL, HFILL } \
1602  }, \
1603  { & name .hf.hs_ext_cert_type, \
1604  { "Certificate Type", prefix ".handshake.cert_type.type", \
1605  FT_UINT8, BASE_HEX, VALS(tls_certificate_type), 0x0, \
1606  NULL, HFILL } \
1607  }, \
1608  { & name .hf.hs_ext_cert_types, \
1609  { "Certificate Type List", prefix ".handshake.cert_type.types", \
1610  FT_NONE, BASE_NONE, NULL, 0x0, \
1611  NULL, HFILL } \
1612  }, \
1613  { & name .hf.hs_ext_cert_types_len, \
1614  { "Certificate Type List Length", prefix ".handshake.cert_type.types_len", \
1615  FT_UINT8, BASE_DEC, NULL, 0x0, \
1616  NULL, HFILL } \
1617  }, \
1618  { & name .hf.hs_ext_cert_url_url, \
1619  { "URL", prefix ".handshake.cert_url.url", \
1620  FT_STRING, BASE_NONE, NULL, 0x0, \
1621  "URL used to fetch the certificate(s)", HFILL } \
1622  }, \
1623  { & name .hf.hs_ext_cert_url_padding, \
1624  { "Padding", prefix ".handshake.cert_url.padding", \
1625  FT_NONE, BASE_NONE, NULL, 0x0, \
1626  "Padding that MUST be 0x01 for backwards compatibility", HFILL } \
1627  }, \
1628  { & name .hf.hs_ext_cert_url_sha1, \
1629  { "SHA1 Hash", prefix ".handshake.cert_url.sha1", \
1630  FT_BYTES, BASE_NONE, NULL, 0x0, \
1631  "SHA1 Hash of the certificate", HFILL } \
1632  }, \
1633  { & name .hf.hs_ext_cert_status_type, \
1634  { "Certificate Status Type", prefix ".handshake.extensions_status_request_type", \
1635  FT_UINT8, BASE_DEC, VALS(tls_cert_status_type), 0x0, \
1636  NULL, HFILL } \
1637  }, \
1638  { & name .hf.hs_ext_cert_status_request_len, \
1639  { "Certificate Status Length", prefix ".handshake.extensions_status_request_len", \
1640  FT_UINT16, BASE_DEC, NULL, 0x0, \
1641  NULL, HFILL } \
1642  }, \
1643  { & name .hf.hs_ext_cert_status_responder_id_list_len, \
1644  { "Responder ID list Length", prefix ".handshake.extensions_status_request_responder_ids_len", \
1645  FT_UINT16, BASE_DEC, NULL, 0x0, \
1646  NULL, HFILL } \
1647  }, \
1648  { & name .hf.hs_ext_cert_status_request_extensions_len, \
1649  { "Request Extensions Length", prefix ".handshake.extensions_status_request_exts_len", \
1650  FT_UINT16, BASE_DEC, NULL, 0x0, \
1651  NULL, HFILL } \
1652  }, \
1653  { & name .hf.hs_ext_cert_status_request_list_len, \
1654  { "Certificate Status List Length", prefix ".handshake.extensions_status_request_list_len", \
1655  FT_UINT16, BASE_DEC, NULL, 0x0, \
1656  "CertificateStatusRequestItemV2 list length", HFILL } \
1657  }, \
1658  { & name .hf.hs_ocsp_response_list_len, \
1659  { "OCSP Response List Length", prefix ".handshake.ocsp_response_list_len", \
1660  FT_UINT24, BASE_DEC, NULL, 0x0, \
1661  "OCSPResponseList length", HFILL } \
1662  }, \
1663  { & name .hf.hs_ocsp_response_len, \
1664  { "OCSP Response Length", prefix ".handshake.ocsp_response_len", \
1665  FT_UINT24, BASE_DEC, NULL, 0x0, \
1666  NULL, HFILL } \
1667  }, \
1668  { & name .hf.hs_sig_hash_alg_len, \
1669  { "Signature Hash Algorithms Length", prefix ".handshake.sig_hash_alg_len", \
1670  FT_UINT16, BASE_DEC, NULL, 0x0, \
1671  "Length of Signature Hash Algorithms", HFILL } \
1672  }, \
1673  { & name .hf.hs_sig_hash_algs, \
1674  { "Signature Algorithms", prefix ".handshake.sig_hash_algs", \
1675  FT_NONE, BASE_NONE, NULL, 0x0, \
1676  "List of supported Signature Algorithms", HFILL } \
1677  }, \
1678  { & name .hf.hs_sig_hash_alg, \
1679  { "Signature Algorithm", prefix ".handshake.sig_hash_alg", \
1680  FT_UINT16, BASE_HEX, VALS(tls13_signature_algorithm), 0x0, \
1681  NULL, HFILL } \
1682  }, \
1683  { & name .hf.hs_sig_hash_hash, \
1684  { "Signature Hash Algorithm Hash", prefix ".handshake.sig_hash_hash", \
1685  FT_UINT8, BASE_DEC, VALS(tls_hash_algorithm), 0x0, \
1686  "Hash algorithm (TLS 1.2)", HFILL } \
1687  }, \
1688  { & name .hf.hs_sig_hash_sig, \
1689  { "Signature Hash Algorithm Signature", prefix ".handshake.sig_hash_sig", \
1690  FT_UINT8, BASE_DEC, VALS(tls_signature_algorithm), 0x0, \
1691  "Signature algorithm (TLS 1.2)", HFILL } \
1692  }, \
1693  { & name .hf.hs_client_keyex_epms_len, \
1694  { "Encrypted PreMaster length", prefix ".handshake.epms_len", \
1695  FT_UINT16, BASE_DEC, NULL, 0x0, \
1696  "Length of encrypted PreMaster secret", HFILL } \
1697  }, \
1698  { & name .hf.hs_client_keyex_epms, \
1699  { "Encrypted PreMaster", prefix ".handshake.epms", \
1700  FT_BYTES, BASE_NONE, NULL, 0x0, \
1701  "Encrypted PreMaster secret", HFILL } \
1702  }, \
1703  { & name .hf.hs_server_keyex_modulus_len, \
1704  { "Modulus Length", prefix ".handshake.modulus_len", \
1705  FT_UINT16, BASE_DEC, NULL, 0x0, \
1706  "Length of RSA-EXPORT modulus", HFILL } \
1707  }, \
1708  { & name .hf.hs_server_keyex_exponent_len, \
1709  { "Exponent Length", prefix ".handshake.exponent_len", \
1710  FT_UINT16, BASE_DEC, NULL, 0x0, \
1711  "Length of RSA-EXPORT exponent", HFILL } \
1712  }, \
1713  { & name .hf.hs_server_keyex_sig_len, \
1714  { "Signature Length", prefix ".handshake.sig_len", \
1715  FT_UINT16, BASE_DEC, NULL, 0x0, \
1716  "Length of Signature", HFILL } \
1717  }, \
1718  { & name .hf.hs_server_keyex_p_len, \
1719  { "p Length", prefix ".handshake.p_len", \
1720  FT_UINT16, BASE_DEC, NULL, 0x0, \
1721  "Length of p", HFILL } \
1722  }, \
1723  { & name .hf.hs_server_keyex_g_len, \
1724  { "g Length", prefix ".handshake.g_len", \
1725  FT_UINT16, BASE_DEC, NULL, 0x0, \
1726  "Length of g", HFILL } \
1727  }, \
1728  { & name .hf.hs_server_keyex_ys_len, \
1729  { "Pubkey Length", prefix ".handshake.ys_len", \
1730  FT_UINT16, BASE_DEC, NULL, 0x0, \
1731  "Length of server's Diffie-Hellman public key", HFILL } \
1732  }, \
1733  { & name .hf.hs_client_keyex_yc_len, \
1734  { "Pubkey Length", prefix ".handshake.yc_len", \
1735  FT_UINT16, BASE_DEC, NULL, 0x0, \
1736  "Length of client's Diffie-Hellman public key", HFILL } \
1737  }, \
1738  { & name .hf.hs_client_keyex_point_len, \
1739  { "Pubkey Length", prefix ".handshake.client_point_len", \
1740  FT_UINT8, BASE_DEC, NULL, 0x0, \
1741  "Length of client's EC Diffie-Hellman public key", HFILL } \
1742  }, \
1743  { & name .hf.hs_server_keyex_point_len, \
1744  { "Pubkey Length", prefix ".handshake.server_point_len", \
1745  FT_UINT8, BASE_DEC, NULL, 0x0, \
1746  "Length of server's EC Diffie-Hellman public key", HFILL } \
1747  }, \
1748  { & name .hf.hs_server_keyex_p, \
1749  { "p", prefix ".handshake.p", \
1750  FT_BYTES, BASE_NONE, NULL, 0x0, \
1751  "Diffie-Hellman p", HFILL } \
1752  }, \
1753  { & name .hf.hs_server_keyex_g, \
1754  { "g", prefix ".handshake.g", \
1755  FT_BYTES, BASE_NONE, NULL, 0x0, \
1756  "Diffie-Hellman g", HFILL } \
1757  }, \
1758  { & name .hf.hs_server_keyex_curve_type, \
1759  { "Curve Type", prefix ".handshake.server_curve_type", \
1760  FT_UINT8, BASE_HEX, VALS(ssl_curve_types), 0x0, \
1761  "Server curve_type", HFILL } \
1762  }, \
1763  { & name .hf.hs_server_keyex_named_curve, \
1764  { "Named Curve", prefix ".handshake.server_named_curve", \
1765  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1766  "Server named_curve", HFILL } \
1767  }, \
1768  { & name .hf.hs_server_keyex_ys, \
1769  { "Pubkey", prefix ".handshake.ys", \
1770  FT_BYTES, BASE_NONE, NULL, 0x0, \
1771  "Diffie-Hellman server pubkey", HFILL } \
1772  }, \
1773  { & name .hf.hs_client_keyex_yc, \
1774  { "Pubkey", prefix ".handshake.yc", \
1775  FT_BYTES, BASE_NONE, NULL, 0x0, \
1776  "Diffie-Hellman client pubkey", HFILL } \
1777  }, \
1778  { & name .hf.hs_server_keyex_point, \
1779  { "Pubkey", prefix ".handshake.server_point", \
1780  FT_BYTES, BASE_NONE, NULL, 0x0, \
1781  "EC Diffie-Hellman server pubkey", HFILL } \
1782  }, \
1783  { & name .hf.hs_client_keyex_point, \
1784  { "Pubkey", prefix ".handshake.client_point", \
1785  FT_BYTES, BASE_NONE, NULL, 0x0, \
1786  "EC Diffie-Hellman client pubkey", HFILL } \
1787  }, \
1788  { & name .hf.hs_server_keyex_xs_len, \
1789  { "Pubkey Length", prefix ".handshake.xs_len", \
1790  FT_UINT8, BASE_DEC, NULL, 0x0, \
1791  "Length of EC J-PAKE server public key", HFILL } \
1792  }, \
1793  { & name .hf.hs_client_keyex_xc_len, \
1794  { "Pubkey Length", prefix ".handshake.xc_len", \
1795  FT_UINT8, BASE_DEC, NULL, 0x0, \
1796  "Length of EC J-PAKE client public key", HFILL } \
1797  }, \
1798  { & name .hf.hs_server_keyex_xs, \
1799  { "Pubkey", prefix ".handshake.xs", \
1800  FT_BYTES, BASE_NONE, NULL, 0x0, \
1801  "EC J-PAKE server public key", HFILL } \
1802  }, \
1803  { & name .hf.hs_client_keyex_xc, \
1804  { "Pubkey", prefix ".handshake.xc", \
1805  FT_BYTES, BASE_NONE, NULL, 0x0, \
1806  "EC J-PAKE client public key", HFILL } \
1807  }, \
1808  { & name .hf.hs_server_keyex_vs_len, \
1809  { "Ephemeral Pubkey Length", prefix ".handshake.vs_len", \
1810  FT_UINT8, BASE_DEC, NULL, 0x0, \
1811  "Length of EC J-PAKE server ephemeral public key", HFILL } \
1812  }, \
1813  { & name .hf.hs_client_keyex_vc_len, \
1814  { "Ephemeral Pubkey Length", prefix ".handshake.vc_len", \
1815  FT_UINT8, BASE_DEC, NULL, 0x0, \
1816  "Length of EC J-PAKE client ephemeral public key", HFILL } \
1817  }, \
1818  { & name .hf.hs_server_keyex_vs, \
1819  { "Ephemeral Pubkey", prefix ".handshake.vs", \
1820  FT_BYTES, BASE_NONE, NULL, 0x0, \
1821  "EC J-PAKE server ephemeral public key", HFILL } \
1822  }, \
1823  { & name .hf.hs_client_keyex_vc, \
1824  { "Ephemeral Pubkey", prefix ".handshake.vc", \
1825  FT_BYTES, BASE_NONE, NULL, 0x0, \
1826  "EC J-PAKE client ephemeral public key", HFILL } \
1827  }, \
1828  { & name .hf.hs_server_keyex_rs_len, \
1829  { "Schnorr signature Length", prefix ".handshake.rs_len", \
1830  FT_UINT8, BASE_DEC, NULL, 0x0, \
1831  "Length of EC J-PAKE server Schnorr signature", HFILL } \
1832  }, \
1833  { & name .hf.hs_client_keyex_rc_len, \
1834  { "Schnorr signature Length", prefix ".handshake.rc_len", \
1835  FT_UINT8, BASE_DEC, NULL, 0x0, \
1836  "Length of EC J-PAKE client Schnorr signature", HFILL } \
1837  }, \
1838  { & name .hf.hs_server_keyex_rs, \
1839  { "Schnorr signature", prefix ".handshake.rs", \
1840  FT_BYTES, BASE_NONE, NULL, 0x0, \
1841  "EC J-PAKE server Schnorr signature", HFILL } \
1842  }, \
1843  { & name .hf.hs_client_keyex_rc, \
1844  { "Schnorr signature", prefix ".handshake.rc", \
1845  FT_BYTES, BASE_NONE, NULL, 0x0, \
1846  "EC J-PAKE client Schnorr signature", HFILL } \
1847  }, \
1848  { & name .hf.hs_server_keyex_modulus, \
1849  { "Modulus", prefix ".handshake.modulus", \
1850  FT_BYTES, BASE_NONE, NULL, 0x0, \
1851  "RSA-EXPORT modulus", HFILL } \
1852  }, \
1853  { & name .hf.hs_server_keyex_exponent, \
1854  { "Exponent", prefix ".handshake.exponent", \
1855  FT_BYTES, BASE_NONE, NULL, 0x0, \
1856  "RSA-EXPORT exponent", HFILL } \
1857  }, \
1858  { & name .hf.hs_server_keyex_sig, \
1859  { "Signature", prefix ".handshake.sig", \
1860  FT_BYTES, BASE_NONE, NULL, 0x0, \
1861  "Diffie-Hellman server signature", HFILL } \
1862  }, \
1863  { & name .hf.hs_server_keyex_hint_len, \
1864  { "Hint Length", prefix ".handshake.hint_len", \
1865  FT_UINT16, BASE_DEC, NULL, 0x0, \
1866  "Length of PSK Hint", HFILL } \
1867  }, \
1868  { & name .hf.hs_server_keyex_hint, \
1869  { "Hint", prefix ".handshake.hint", \
1870  FT_BYTES, BASE_NONE, NULL, 0x0, \
1871  "PSK Hint", HFILL } \
1872  }, \
1873  { & name .hf.hs_client_keyex_identity_len, \
1874  { "Identity Length", prefix ".handshake.identity_len", \
1875  FT_UINT16, BASE_DEC, NULL, 0x0, \
1876  "Length of PSK Identity", HFILL } \
1877  }, \
1878  { & name .hf.hs_client_keyex_identity, \
1879  { "Identity", prefix ".handshake.identity", \
1880  FT_BYTES, BASE_NONE, NULL, 0x0, \
1881  "PSK Identity", HFILL } \
1882  }, \
1883  { & name .hf.hs_ext_heartbeat_mode, \
1884  { "Mode", prefix ".handshake.extension.heartbeat.mode", \
1885  FT_UINT8, BASE_DEC, VALS(tls_heartbeat_mode), 0x0, \
1886  "Heartbeat extension mode", HFILL } \
1887  }, \
1888  { & name .hf.hs_certificates_len, \
1889  { "Certificates Length", prefix ".handshake.certificates_length", \
1890  FT_UINT24, BASE_DEC, NULL, 0x0, \
1891  "Length of certificates field", HFILL } \
1892  }, \
1893  { & name .hf.hs_certificates, \
1894  { "Certificates", prefix ".handshake.certificates", \
1895  FT_NONE, BASE_NONE, NULL, 0x0, \
1896  "List of certificates", HFILL } \
1897  }, \
1898  { & name .hf.hs_certificate, \
1899  { "Certificate", prefix ".handshake.certificate", \
1900  FT_BYTES, BASE_NONE, NULL, 0x0, \
1901  NULL, HFILL } \
1902  }, \
1903  { & name .hf.hs_certificate_len, \
1904  { "Certificate Length", prefix ".handshake.certificate_length", \
1905  FT_UINT24, BASE_DEC, NULL, 0x0, \
1906  "Length of certificate", HFILL } \
1907  }, \
1908  { & name .hf.hs_cert_types_count, \
1909  { "Certificate types count", prefix ".handshake.cert_types_count",\
1910  FT_UINT8, BASE_DEC, NULL, 0x0, \
1911  "Count of certificate types", HFILL } \
1912  }, \
1913  { & name .hf.hs_cert_types, \
1914  { "Certificate types", prefix ".handshake.cert_types", \
1915  FT_NONE, BASE_NONE, NULL, 0x0, \
1916  "List of certificate types", HFILL } \
1917  }, \
1918  { & name .hf.hs_cert_type, \
1919  { "Certificate type", prefix ".handshake.cert_type", \
1920  FT_UINT8, BASE_DEC, VALS(ssl_31_client_certificate_type), 0x0, \
1921  NULL, HFILL } \
1922  }, \
1923  { & name .hf.hs_dnames_len, \
1924  { "Distinguished Names Length", prefix ".handshake.dnames_len", \
1925  FT_UINT16, BASE_DEC, NULL, 0x0, \
1926  "Length of list of CAs that server trusts", HFILL } \
1927  }, \
1928  { & name .hf.hs_dnames, \
1929  { "Distinguished Names", prefix ".handshake.dnames", \
1930  FT_NONE, BASE_NONE, NULL, 0x0, \
1931  "List of CAs that server trusts", HFILL } \
1932  }, \
1933  { & name .hf.hs_dname_len, \
1934  { "Distinguished Name Length", prefix ".handshake.dname_len", \
1935  FT_UINT16, BASE_DEC, NULL, 0x0, \
1936  "Length of distinguished name", HFILL } \
1937  }, \
1938  { & name .hf.hs_dnames_truncated, \
1939  { "Tree view truncated", prefix ".handshake.dnames_truncated", \
1940  FT_NONE, BASE_NONE, NULL, 0x00, \
1941  "Some Distinguished Names are not added to tree pane to limit resources", HFILL } \
1942  }, \
1943  { & name .hf.hs_dname, \
1944  { "Distinguished Name", prefix ".handshake.dname", \
1945  FT_NONE, BASE_NONE, NULL, 0x0, \
1946  "Distinguished name of a CA that server trusts", HFILL } \
1947  }, \
1948  { & name .hf.hs_random, \
1949  { "Random", prefix ".handshake.random", \
1950  FT_BYTES, BASE_NONE, NULL, 0x0, \
1951  "Random values used for deriving keys", HFILL } \
1952  }, \
1953  { & name .hf.hs_random_time, \
1954  { "GMT Unix Time", prefix ".handshake.random_time", \
1955  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0, \
1956  "Unix time field of random structure", HFILL } \
1957  }, \
1958  { & name .hf.hs_random_bytes, \
1959  { "Random Bytes", prefix ".handshake.random_bytes", \
1960  FT_BYTES, BASE_NONE, NULL, 0x0, \
1961  "Random values used for deriving keys", HFILL } \
1962  }, \
1963  { & name .hf.hs_session_id, \
1964  { "Session ID", prefix ".handshake.session_id", \
1965  FT_BYTES, BASE_NONE, NULL, 0x0, \
1966  "Identifies the SSL session, allowing later resumption", HFILL }\
1967  }, \
1968  { & name .hf.hs_session_id_len, \
1969  { "Session ID Length", prefix ".handshake.session_id_length", \
1970  FT_UINT8, BASE_DEC, NULL, 0x0, \
1971  "Length of Session ID field", HFILL } \
1972  }, \
1973  { & name .hf.hs_client_version, \
1974  { "Version", prefix ".handshake.version", \
1975  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1976  "Maximum version supported by client [legacy_version if supported_versions ext is present]", HFILL } \
1977  }, \
1978  { & name .hf.hs_server_version, \
1979  { "Version", prefix ".handshake.version", \
1980  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1981  "Version selected by server [legacy_version if supported_versions ext is present]", HFILL } \
1982  }, \
1983  { & name .hf.hs_cipher_suites_len, \
1984  { "Cipher Suites Length", prefix ".handshake.cipher_suites_length", \
1985  FT_UINT16, BASE_DEC, NULL, 0x0, \
1986  "Length of cipher suites field", HFILL } \
1987  }, \
1988  { & name .hf.hs_cipher_suites, \
1989  { "Cipher Suites", prefix ".handshake.ciphersuites", \
1990  FT_NONE, BASE_NONE, NULL, 0x0, \
1991  "List of cipher suites supported by client", HFILL } \
1992  }, \
1993  { & name .hf.hs_cipher_suite, \
1994  { "Cipher Suite", prefix ".handshake.ciphersuite", \
1995  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
1996  NULL, HFILL } \
1997  }, \
1998  { & name .hf.hs_comp_methods_len, \
1999  { "Compression Methods Length", prefix ".handshake.comp_methods_length", \
2000  FT_UINT8, BASE_DEC, NULL, 0x0, \
2001  "Length of compression methods field", HFILL } \
2002  }, \
2003  { & name .hf.hs_comp_methods, \
2004  { "Compression Methods", prefix ".handshake.comp_methods", \
2005  FT_NONE, BASE_NONE, NULL, 0x0, \
2006  "List of compression methods supported by client", HFILL } \
2007  }, \
2008  { & name .hf.hs_comp_method, \
2009  { "Compression Method", prefix ".handshake.comp_method", \
2010  FT_UINT8, BASE_DEC, VALS(ssl_31_compression_method), 0x0, \
2011  NULL, HFILL } \
2012  }, \
2013  { & name .hf.hs_session_ticket_lifetime_hint, \
2014  { "Session Ticket Lifetime Hint", \
2015  prefix ".handshake.session_ticket_lifetime_hint", \
2016  FT_UINT32, BASE_DEC|BASE_UNIT_STRING, &units_second_seconds, 0x0, \
2017  "New Session Ticket Lifetime Hint", HFILL } \
2018  }, \
2019  { & name .hf.hs_session_ticket_age_add, \
2020  { "Session Ticket Age Add", \
2021  prefix ".handshake.session_ticket_age_add", \
2022  FT_UINT32, BASE_DEC, NULL, 0x0, \
2023  "Random 32-bit value to obscure age of ticket", HFILL } \
2024  }, \
2025  { & name .hf.hs_session_ticket_nonce_len, \
2026  { "Session Ticket Nonce Length", prefix ".handshake.session_ticket_nonce_length", \
2027  FT_UINT8, BASE_DEC, NULL, 0x0, \
2028  NULL, HFILL } \
2029  }, \
2030  { & name .hf.hs_session_ticket_nonce, \
2031  { "Session Ticket Nonce", prefix ".handshake.session_ticket_nonce", \
2032  FT_BYTES, BASE_NONE, NULL, 0x0, \
2033  "A unique per-ticket value", HFILL } \
2034  }, \
2035  { & name .hf.hs_session_ticket_len, \
2036  { "Session Ticket Length", prefix ".handshake.session_ticket_length", \
2037  FT_UINT16, BASE_DEC, NULL, 0x0, \
2038  "New Session Ticket Length", HFILL } \
2039  }, \
2040  { & name .hf.hs_session_ticket, \
2041  { "Session Ticket", prefix ".handshake.session_ticket", \
2042  FT_BYTES, BASE_NONE, NULL, 0x0, \
2043  "New Session Ticket", HFILL } \
2044  }, \
2045  { & name .hf.hs_finished, \
2046  { "Verify Data", prefix ".handshake.verify_data", \
2047  FT_NONE, BASE_NONE, NULL, 0x0, \
2048  "Opaque verification data", HFILL } \
2049  }, \
2050  { & name .hf.hs_client_cert_vrfy_sig_len, \
2051  { "Signature length", prefix ".handshake.client_cert_vrfy.sig_len", \
2052  FT_UINT16, BASE_DEC, NULL, 0x0, \
2053  "Length of CertificateVerify's signature", HFILL } \
2054  }, \
2055  { & name .hf.hs_client_cert_vrfy_sig, \
2056  { "Signature", prefix ".handshake.client_cert_vrfy.sig", \
2057  FT_BYTES, BASE_NONE, NULL, 0x0, \
2058  "CertificateVerify's signature", HFILL } \
2059  }, \
2060  { & name .hf.hs_ja3_full, \
2061  { "JA3 Fullstring", prefix ".handshake.ja3_full", \
2062  FT_STRING, BASE_NONE, NULL, 0x0, \
2063  NULL, HFILL } \
2064  }, \
2065  { & name .hf.hs_ja3_hash, \
2066  { "JA3", prefix ".handshake.ja3", \
2067  FT_STRING, BASE_NONE, NULL, 0x0, \
2068  NULL, HFILL } \
2069  }, \
2070  { & name .hf.hs_ja3s_full, \
2071  { "JA3S Fullstring", prefix ".handshake.ja3s_full", \
2072  FT_STRING, BASE_NONE, NULL, 0x0, \
2073  NULL, HFILL } \
2074  }, \
2075  { & name .hf.hs_ja3s_hash, \
2076  { "JA3S", prefix ".handshake.ja3s", \
2077  FT_STRING, BASE_NONE, NULL, 0x0, \
2078  NULL, HFILL } \
2079  }, \
2080  { & name .hf.hs_ja4, \
2081  { "JA4", prefix ".handshake.ja4", \
2082  FT_STRING, BASE_NONE, NULL, 0x0, \
2083  NULL, HFILL } \
2084  }, \
2085  { & name .hf.hs_ja4_r, \
2086  { "JA4_r", prefix ".handshake.ja4_r", \
2087  FT_STRING, BASE_NONE, NULL, 0x0, \
2088  NULL, HFILL } \
2089  }, \
2090  { & name .hf.hs_ext_psk_ke_modes_length, \
2091  { "PSK Key Exchange Modes Length", prefix ".extension.psk_ke_modes_length", \
2092  FT_UINT8, BASE_DEC, NULL, 0x0, \
2093  NULL, HFILL } \
2094  }, \
2095  { & name .hf.hs_ext_psk_ke_mode, \
2096  { "PSK Key Exchange Mode", prefix ".extension.psk_ke_mode", \
2097  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_psk_ke_mode), 0x0, \
2098  "Key exchange modes where the client supports use of PSKs", HFILL } \
2099  }, \
2100  { & name .hf.hs_certificate_request_context_length, \
2101  { "Certificate Request Context Length", prefix ".handshake.certificate_request_context_length", \
2102  FT_UINT8, BASE_DEC, NULL, 0x0, \
2103  NULL, HFILL } \
2104  }, \
2105  { & name .hf.hs_certificate_request_context, \
2106  { "Certificate Request Context", prefix ".handshake.certificate_request_context", \
2107  FT_BYTES, BASE_NONE, NULL, 0x0, \
2108  "Value from CertificateRequest or empty for server auth", HFILL } \
2109  }, \
2110  { & name .hf.hs_key_update_request_update, \
2111  { "Key Update Request", prefix ".handshake.key_update.request_update", \
2112  FT_UINT8, BASE_DEC, VALS(tls13_key_update_request), 0x00, \
2113  "Whether the receiver should also update its keys", HFILL } \
2114  }, \
2115  { & name .hf.sct_scts_length, \
2116  { "Serialized SCT List Length", prefix ".sct.scts_length", \
2117  FT_UINT16, BASE_DEC, NULL, 0x00, \
2118  NULL, HFILL } \
2119  }, \
2120  { & name .hf.sct_sct_length, \
2121  { "Serialized SCT Length", prefix ".sct.sct_length", \
2122  FT_UINT16, BASE_DEC, NULL, 0x00, \
2123  NULL, HFILL } \
2124  }, \
2125  { & name .hf.sct_sct_version, \
2126  { "SCT Version", prefix ".sct.sct_version", \
2127  FT_UINT8, BASE_DEC, NULL, 0x00, \
2128  "SCT Protocol version (v1 (0) is defined in RFC 6962)", HFILL } \
2129  }, \
2130  { & name .hf.sct_sct_logid, \
2131  { "Log ID", prefix ".sct.sct_logid", \
2132  FT_BYTES, BASE_NONE, NULL, 0x00, \
2133  "SHA-256 hash of log's public key", HFILL } \
2134  }, \
2135  { & name .hf.sct_sct_timestamp, \
2136  { "Timestamp", prefix ".sct.sct_timestamp", \
2137  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x00, \
2138  "Timestamp of issuance", HFILL } \
2139  }, \
2140  { & name .hf.sct_sct_extensions_length, \
2141  { "Extensions length", prefix ".sct.sct_extensions_length", \
2142  FT_UINT16, BASE_DEC, NULL, 0x00, \
2143  "Length of future extensions to this protocol (currently none)", HFILL } \
2144  }, \
2145  { & name .hf.sct_sct_extensions, \
2146  { "Extensions", prefix ".sct.sct_extensions", \
2147  FT_NONE, BASE_NONE, NULL, 0x00, \
2148  "Future extensions to this protocol (currently none)", HFILL } \
2149  }, \
2150  { & name .hf.sct_sct_signature_length, \
2151  { "Signature Length", prefix ".sct.sct_signature_length", \
2152  FT_UINT16, BASE_DEC, NULL, 0x00, \
2153  NULL, HFILL } \
2154  }, \
2155  { & name .hf.sct_sct_signature, \
2156  { "Signature", prefix ".sct.sct_signature", \
2157  FT_BYTES, BASE_NONE, NULL, 0x00, \
2158  NULL, HFILL } \
2159  }, \
2160  { & name .hf.hs_ext_max_early_data_size, \
2161  { "Maximum Early Data Size", prefix ".early_data.max_early_data_size", \
2162  FT_UINT32, BASE_DEC, NULL, 0x00, \
2163  "Maximum amount of 0-RTT data that the client may send", HFILL } \
2164  }, \
2165  { & name .hf.hs_ext_oid_filters_length, \
2166  { "OID Filters Length", prefix ".extension.oid_filters_length", \
2167  FT_UINT16, BASE_DEC, NULL, 0x00, \
2168  NULL, HFILL } \
2169  }, \
2170  { & name .hf.hs_ext_oid_filters_oid_length, \
2171  { "Certificate Extension OID Length", prefix ".extension.oid_filters.oid_length", \
2172  FT_UINT8, BASE_DEC, NULL, 0x00, \
2173  NULL, HFILL } \
2174  }, \
2175  { & name .hf.hs_ext_oid_filters_oid, \
2176  { "Certificate Extension OID", prefix ".extension.oid_filters.oid", \
2177  FT_OID, BASE_NONE, NULL, 0x00, \
2178  NULL, HFILL } \
2179  }, \
2180  { & name .hf.hs_ext_oid_filters_values_length, \
2181  { "Certificate Extension Values Length", prefix ".extension.oid_filters.values_length", \
2182  FT_UINT16, BASE_DEC, NULL, 0x00, \
2183  NULL, HFILL } \
2184  }, \
2185  { & name .hf.hs_cred_valid_time, \
2186  { "Valid Time", prefix ".handshake.cred.valid_time", \
2187  FT_UINT16, BASE_DEC, NULL, 0x0, \
2188  "Delegated Credentials Valid Time", HFILL } \
2189  }, \
2190  { & name .hf.hs_cred_pubkey, \
2191  { "Subject Public Key Info", prefix ".handshake.cred.pubkey", \
2192  FT_BYTES, BASE_NONE, NULL, 0x0, \
2193  "Delegated Credentials Subject Public Key Info", HFILL } \
2194  }, \
2195  { & name .hf.hs_cred_pubkey_len, \
2196  { "Subject Public Key Info Length", prefix ".handshake.cred.pubkey_len", \
2197  FT_UINT24, BASE_DEC, NULL, 0x0, \
2198  "Delegated Credentials Subject Public Key Info Length", HFILL } \
2199  }, \
2200  { & name .hf.hs_cred_signature, \
2201  { "Signature", prefix ".handshake.cred.signature", \
2202  FT_BYTES, BASE_NONE, NULL, 0x0, \
2203  "Delegated Credentials Signature", HFILL } \
2204  }, \
2205  { & name .hf.hs_cred_signature_len, \
2206  { "Signature Length", prefix ".handshake.cred.signature_len", \
2207  FT_UINT16, BASE_DEC, NULL, 0x0, \
2208  "Delegated Credentials Signature Length", HFILL } \
2209  }, \
2210  { & name .hf.hs_ext_compress_certificate_algorithms_length, \
2211  { "Algorithms Length", prefix ".compress_certificate.algorithms_length", \
2212  FT_UINT8, BASE_DEC, NULL, 0x00, \
2213  NULL, HFILL } \
2214  }, \
2215  { & name .hf.hs_ext_compress_certificate_algorithm, \
2216  { "Algorithm", prefix ".compress_certificate.algorithm", \
2217  FT_UINT16, BASE_DEC, VALS(compress_certificate_algorithm_vals), 0x00, \
2218  NULL, HFILL } \
2219  }, \
2220  { & name .hf.hs_ext_compress_certificate_uncompressed_length, \
2221  { "Uncompressed Length", prefix ".compress_certificate.uncompressed_length", \
2222  FT_UINT24, BASE_DEC, NULL, 0x00, \
2223  NULL, HFILL } \
2224  }, \
2225  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message_length, \
2226  { "Length", prefix ".compress_certificate.compressed_certificate_message.length", \
2227  FT_UINT24, BASE_DEC, NULL, 0x00, \
2228  NULL, HFILL } \
2229  }, \
2230  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message, \
2231  { "Compressed Certificate Message", prefix ".compress_certificate.compressed_certificate_message", \
2232  FT_BYTES, BASE_NONE, NULL, 0x00, \
2233  NULL, HFILL } \
2234  }, \
2235  { & name .hf.hs_ext_token_binding_version_major, \
2236  { "Protocol Major Version", prefix ".token_binding.version_major", \
2237  FT_UINT8, BASE_HEX, NULL, 0x00, \
2238  "Major version of the Token Binding protocol", HFILL } \
2239  }, \
2240  { & name .hf.hs_ext_token_binding_version_minor, \
2241  { "Protocol Minor Version", prefix ".token_binding.version_minor", \
2242  FT_UINT8, BASE_HEX, NULL, 0x00, \
2243  "Minor version of the Token Binding protocol", HFILL } \
2244  }, \
2245  { & name .hf.hs_ext_token_binding_key_parameters, \
2246  { "Key Parameters", prefix ".token_binding.key_parameters", \
2247  FT_NONE, BASE_NONE, NULL, 0x0, \
2248  NULL, HFILL } \
2249  }, \
2250  { & name .hf.hs_ext_token_binding_key_parameters_length, \
2251  { "Key Parameters Length", prefix ".token_binding.key_parameters_length", \
2252  FT_UINT8, BASE_DEC, NULL, 0x00, \
2253  "Length of the key parameters list", HFILL } \
2254  }, \
2255  { & name .hf.hs_ext_token_binding_key_parameter, \
2256  { "Key Parameter", prefix ".token_binding.key_parameter", \
2257  FT_UINT8, BASE_DEC, VALS(token_binding_key_parameter_vals), 0x00, \
2258  "Identifier of the Token Binding key parameter", HFILL } \
2259  }, \
2260  { & name .hf.hs_ext_record_size_limit, \
2261  { "Record Size Limit", prefix ".record_size_limit", \
2262  FT_UINT16, BASE_DEC, NULL, 0x00, \
2263  "Maximum record size that an endpoint is willing to receive", HFILL } \
2264  }, \
2265  { & name .hf.hs_ext_quictp_len, \
2266  { "Parameters Length", prefix ".quic.len", \
2267  FT_UINT16, BASE_DEC, NULL, 0x00, \
2268  NULL, HFILL } \
2269  }, \
2270  { & name .hf.hs_ext_quictp_parameter, \
2271  { "Parameter", prefix ".quic.parameter", \
2272  FT_NONE, BASE_NONE, NULL, 0x00, \
2273  NULL, HFILL } \
2274  }, \
2275  { & name .hf.hs_ext_quictp_parameter_type, \
2276  { "Type", prefix ".quic.parameter.type", \
2277  FT_UINT64, BASE_CUSTOM, CF_FUNC(quic_transport_parameter_id_base_custom), 0x00, \
2278  NULL, HFILL } \
2279  }, \
2280  { & name .hf.hs_ext_quictp_parameter_len, \
2281  { "Length", prefix ".quic.parameter.length", \
2282  FT_UINT64, BASE_DEC, NULL, 0x00, \
2283  NULL, HFILL } \
2284  }, \
2285  { & name .hf.hs_ext_quictp_parameter_len_old, \
2286  { "Length", prefix ".quic.parameter.lengt.old", \
2287  FT_UINT16, BASE_DEC, NULL, 0x00, \
2288  NULL, HFILL } \
2289  }, \
2290  { & name .hf.hs_ext_quictp_parameter_value, \
2291  { "Value", prefix ".quic.parameter.value", \
2292  FT_BYTES, BASE_NONE, NULL, 0x00, \
2293  NULL, HFILL } \
2294  }, \
2295  { & name .hf.hs_ext_quictp_parameter_original_destination_connection_id, \
2296  { "original_destination_connection_id", prefix ".quic.parameter.original_destination_connection_id", \
2297  FT_BYTES, BASE_NONE, NULL, 0x00, \
2298  "Destination Connection ID from the first Initial packet sent by the client", HFILL } \
2299  }, \
2300  { & name .hf.hs_ext_quictp_parameter_max_idle_timeout, \
2301  { "max_idle_timeout", prefix ".quic.parameter.max_idle_timeout", \
2302  FT_UINT64, BASE_DEC, NULL, 0x00, \
2303  "In milliseconds", HFILL } \
2304  }, \
2305  { & name .hf.hs_ext_quictp_parameter_stateless_reset_token, \
2306  { "stateless_reset_token", prefix ".quic.parameter.stateless_reset_token", \
2307  FT_BYTES, BASE_NONE, NULL, 0x00, \
2308  "Used in verifying a stateless reset", HFILL } \
2309  }, \
2310  { & name .hf.hs_ext_quictp_parameter_max_udp_payload_size, \
2311  { "max_udp_payload_size", prefix ".quic.parameter.max_udp_payload_size", \
2312  FT_UINT64, BASE_DEC, NULL, 0x00, \
2313  "Maximum UDP payload size that the endpoint is willing to receive", HFILL } \
2314  }, \
2315  { & name .hf.hs_ext_quictp_parameter_initial_max_data, \
2316  { "initial_max_data", prefix ".quic.parameter.initial_max_data", \
2317  FT_UINT64, BASE_DEC, NULL, 0x00, \
2318  "Contains the initial value for the maximum amount of data that can be sent on the connection", HFILL } \
2319  }, \
2320  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local, \
2321  { "initial_max_stream_data_bidi_local", prefix ".quic.parameter.initial_max_stream_data_bidi_local", \
2322  FT_UINT64, BASE_DEC, NULL, 0x00, \
2323  "Initial stream maximum data for bidirectional, locally-initiated streams", HFILL } \
2324  }, \
2325  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote, \
2326  { "initial_max_stream_data_bidi_remote", prefix ".quic.parameter.initial_max_stream_data_bidi_remote", \
2327  FT_UINT64, BASE_DEC, NULL, 0x00, \
2328  "Initial stream maximum data for bidirectional, peer-initiated streams", HFILL } \
2329  }, \
2330  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_uni, \
2331  { "initial_max_stream_data_uni", prefix ".quic.parameter.initial_max_stream_data_uni", \
2332  FT_UINT64, BASE_DEC, NULL, 0x00, \
2333  "Initial stream maximum data for unidirectional streams parameter", HFILL } \
2334  }, \
2335  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_bidi, \
2336  { "initial_max_streams_bidi", prefix ".quic.parameter.initial_max_streams_bidi", \
2337  FT_UINT64, BASE_DEC, NULL, 0x00, \
2338  "Initial maximum number of application-owned bidirectional streams", HFILL } \
2339  }, \
2340  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_uni, \
2341  { "initial_max_streams_uni", prefix ".quic.parameter.initial_max_streams_uni", \
2342  FT_UINT64, BASE_DEC, NULL, 0x00, \
2343  "Initial maximum number of application-owned unidirectional streams", HFILL } \
2344  }, \
2345  { & name .hf.hs_ext_quictp_parameter_ack_delay_exponent, \
2346  { "ack_delay_exponent", prefix ".quic.parameter.ack_delay_exponent", \
2347  FT_UINT64, BASE_DEC, NULL, 0x00, \
2348  "Indicating an exponent used to decode the ACK Delay field in the ACK frame,", HFILL } \
2349  }, \
2350  { & name .hf.hs_ext_quictp_parameter_max_ack_delay, \
2351  { "max_ack_delay", prefix ".quic.parameter.max_ack_delay", \
2352  FT_UINT64, BASE_DEC, NULL, 0x00, \
2353  "Indicating the maximum amount of time in milliseconds by which it will delay sending of acknowledgments", HFILL } \
2354  }, \
2355  { & name .hf.hs_ext_quictp_parameter_pa_ipv4address, \
2356  { "ipv4Address", prefix ".quic.parameter.preferred_address.ipv4address", \
2357  FT_IPv4, BASE_NONE, NULL, 0x00, \
2358  NULL, HFILL } \
2359  }, \
2360  { & name .hf.hs_ext_quictp_parameter_pa_ipv6address, \
2361  { "ipv6Address", prefix ".quic.parameter.preferred_address.ipv6address", \
2362  FT_IPv6, BASE_NONE, NULL, 0x00, \
2363  NULL, HFILL } \
2364  }, \
2365  { & name .hf.hs_ext_quictp_parameter_pa_ipv4port, \
2366  { "ipv4Port", prefix ".quic.parameter.preferred_address.ipv4port", \
2367  FT_UINT16, BASE_DEC, NULL, 0x00, \
2368  NULL, HFILL } \
2369  }, \
2370  { & name .hf.hs_ext_quictp_parameter_pa_ipv6port, \
2371  { "ipv6Port", prefix ".quic.parameter.preferred_address.ipv6port", \
2372  FT_UINT16, BASE_DEC, NULL, 0x00, \
2373  NULL, HFILL } \
2374  }, \
2375  { & name .hf.hs_ext_quictp_parameter_pa_connectionid_length, \
2376  { "Length", prefix ".quic.parameter.preferred_address.connectionid.length", \
2377  FT_UINT8, BASE_DEC, NULL, 0x00, \
2378  "Length of connectionId Field", HFILL } \
2379  }, \
2380  { & name .hf.hs_ext_quictp_parameter_pa_connectionid, \
2381  { "connectionId", prefix ".quic.parameter.preferred_address.connectionid", \
2382  FT_BYTES, BASE_NONE, NULL, 0x00, \
2383  NULL, HFILL } \
2384  }, \
2385  { & name .hf.hs_ext_quictp_parameter_pa_statelessresettoken, \
2386  { "statelessResetToken", prefix ".quic.parameter.preferred_address.statelessresettoken", \
2387  FT_BYTES, BASE_NONE, NULL, 0x00, \
2388  NULL, HFILL } \
2389  }, \
2390  { & name .hf.hs_ext_quictp_parameter_active_connection_id_limit, \
2391  { "Active Connection ID Limit", prefix ".quic.parameter.active_connection_id_limit", \
2392  FT_UINT64, BASE_DEC, NULL, 0x00, \
2393  NULL, HFILL } \
2394  }, \
2395  { & name .hf.hs_ext_quictp_parameter_initial_source_connection_id, \
2396  { "Initial Source Connection ID", prefix ".quic.parameter.initial_source_connection_id", \
2397  FT_BYTES, BASE_NONE, NULL, 0x00, \
2398  NULL, HFILL } \
2399  }, \
2400  { & name .hf.hs_ext_quictp_parameter_retry_source_connection_id, \
2401  { "Retry Source Connection ID", prefix ".quic.parameter.retry_source_connection_id", \
2402  FT_BYTES, BASE_NONE, NULL, 0x00, \
2403  NULL, HFILL } \
2404  }, \
2405  { & name .hf.hs_ext_quictp_parameter_max_datagram_frame_size, \
2406  { "max_datagram_frame_size", prefix ".quic.parameter.max_datagram_frame_size", \
2407  FT_UINT64, BASE_DEC, NULL, 0x00, \
2408  NULL, HFILL } \
2409  }, \
2410  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_length, \
2411  { "length", prefix ".quic.parameter.cibir_encoding.length", \
2412  FT_UINT64, BASE_DEC, NULL, 0x00, \
2413  NULL, HFILL } \
2414  }, \
2415  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_offset, \
2416  { "offset", prefix ".quic.parameter.cibir_encoding.offset", \
2417  FT_UINT64, BASE_DEC, NULL, 0x00, \
2418  NULL, HFILL } \
2419  }, \
2420  { & name .hf.hs_ext_quictp_parameter_loss_bits, \
2421  { "loss_bits", prefix ".quic.parameter.loss_bits", \
2422  FT_UINT64, BASE_DEC, NULL, 0x00, \
2423  NULL, HFILL } \
2424  }, \
2425  { & name .hf.hs_ext_quictp_parameter_enable_time_stamp_v2, \
2426  { "Enable TimestampV2", prefix ".quic.parameter.enable_time_stamp_v2", \
2427  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_time_stamp_v2_vals), 0x00, \
2428  NULL, HFILL } \
2429  }, \
2430  { & name .hf.hs_ext_quictp_parameter_min_ack_delay, \
2431  { "min_ack_delay", prefix ".quic.parameter.min_ack_delay", \
2432  FT_UINT64, BASE_DEC, NULL, 0x00, \
2433  NULL, HFILL } \
2434  }, \
2435  { & name .hf.hs_ext_quictp_parameter_google_user_agent_id, \
2436  { "Google UserAgent", prefix ".quic.parameter.google.user_agent", \
2437  FT_STRING, BASE_NONE, NULL, 0x00, \
2438  NULL, HFILL } \
2439  }, \
2440  { & name .hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported, \
2441  { "Google Key Update not yet supported", prefix ".quic.parameter.google.key_update_not_yet_supported", \
2442  FT_NONE, BASE_NONE, NULL, 0x00, \
2443  NULL, HFILL } \
2444  }, \
2445  { & name .hf.hs_ext_quictp_parameter_google_quic_version, \
2446  { "Google QUIC version", prefix ".quic.parameter.google.quic_version", \
2447  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2448  NULL, HFILL } \
2449  }, \
2450  { & name .hf.hs_ext_quictp_parameter_google_initial_rtt, \
2451  { "Google Initial RTT", prefix ".quic.parameter.google.initial_rtt", \
2452  FT_UINT64, BASE_DEC, NULL, 0x00, \
2453  NULL, HFILL } \
2454  }, \
2455  { & name .hf.hs_ext_quictp_parameter_google_support_handshake_done, \
2456  { "Google Support Handshake Done", prefix ".quic.parameter.google.support_handshake_done", \
2457  FT_NONE, BASE_NONE, NULL, 0x00, \
2458  NULL, HFILL } \
2459  }, \
2460  { & name .hf.hs_ext_quictp_parameter_google_quic_params, \
2461  { "Google QUIC parameters", prefix ".quic.parameter.google.quic_params", \
2462  FT_BYTES, BASE_NONE, NULL, 0x00, \
2463  NULL, HFILL } \
2464  }, \
2465  { & name .hf.hs_ext_quictp_parameter_google_quic_params_unknown_field, \
2466  { "Google Unknown Field", prefix ".quic.parameter.google.quic_params_unknown_field", \
2467  FT_BYTES, BASE_NONE, NULL, 0x00, \
2468  NULL, HFILL } \
2469  }, \
2470  { & name .hf.hs_ext_quictp_parameter_google_connection_options, \
2471  { "Google Connection options", prefix ".quic.parameter.google.connection_options", \
2472  FT_BYTES, BASE_NONE, NULL, 0x00, \
2473  NULL, HFILL } \
2474  }, \
2475  { & name .hf.hs_ext_quictp_parameter_google_supported_versions_length, \
2476  { "Google Supported Versions Length", prefix ".quic.parameter.google.supported_versions_length", \
2477  FT_UINT8, BASE_DEC, NULL, 0x00, \
2478  NULL, HFILL } \
2479  }, \
2480  { & name .hf.hs_ext_quictp_parameter_google_supported_version, \
2481  { "Google Supported Version", prefix ".quic.parameter.google.supported_version", \
2482  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2483  NULL, HFILL } \
2484  }, \
2485  { & name .hf.hs_ext_quictp_parameter_facebook_partial_reliability, \
2486  { "Facebook Partial Reliability", prefix ".quic.parameter.facebook.partial_reliability", \
2487  FT_UINT64, BASE_DEC, NULL, 0x00, \
2488  NULL, HFILL } \
2489  }, \
2490  { & name .hf.hs_ext_quictp_parameter_chosen_version, \
2491  { "Chosen Version", prefix ".quic.parameter.vi.chosen_version", \
2492  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2493  NULL, HFILL } \
2494  }, \
2495  { & name .hf.hs_ext_quictp_parameter_other_version, \
2496  { "Other Version", prefix ".quic.parameter.vi.other_version", \
2497  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2498  NULL, HFILL } \
2499  }, \
2500  { & name .hf.hs_ext_quictp_parameter_enable_multipath, \
2501  { "Enable Multipath", prefix ".quic.parameter.enable_multipath", \
2502  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_multipath_vals), 0x00, \
2503  NULL, HFILL } \
2504  }, \
2505  { & name .hf.hs_ext_quictp_parameter_initial_max_paths, \
2506  { "Initial Max Paths", prefix ".quic.parameter.initial_max_paths", \
2507  FT_UINT64, BASE_DEC, NULL, 0x00, \
2508  NULL, HFILL } \
2509  }, \
2510  { & name .hf.hs_ext_connection_id_length, \
2511  { "Connection ID length", prefix ".connection_id_length", \
2512  FT_UINT8, BASE_DEC, NULL, 0x00, \
2513  NULL, HFILL } \
2514  }, \
2515  { & name .hf.hs_ext_connection_id, \
2516  { "Connection ID", prefix ".connection_id", \
2517  FT_BYTES, BASE_NONE, NULL, 0x00, \
2518  NULL, HFILL } \
2519  }, \
2520  { & name .hf.esni_suite, \
2521  { "Cipher Suite", prefix ".esni.suite", \
2522  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2523  "Cipher suite used to encrypt the SNI", HFILL } \
2524  }, \
2525  { & name .hf.esni_record_digest_length, \
2526  { "Record Digest Length", prefix ".esni.record_digest_length", \
2527  FT_UINT16, BASE_DEC, NULL, 0x00, \
2528  NULL, HFILL } \
2529  }, \
2530  { & name .hf.esni_record_digest, \
2531  { "Record Digest", prefix ".esni.record_digest", \
2532  FT_BYTES, BASE_NONE, NULL, 0x00, \
2533  "Cryptographic hash of the ESNIKeys from which the ESNI key was obtained", HFILL } \
2534  }, \
2535  { & name .hf.esni_encrypted_sni_length, \
2536  { "Encrypted SNI Length", prefix ".esni.encrypted_sni_length", \
2537  FT_UINT16, BASE_DEC, NULL, 0x00, \
2538  NULL, HFILL } \
2539  }, \
2540  { & name .hf.esni_encrypted_sni, \
2541  { "Encrypted SNI", prefix ".esni.encrypted_sni", \
2542  FT_BYTES, BASE_NONE, NULL, 0x00, \
2543  "The encrypted ClientESNIInner structure", HFILL } \
2544  }, \
2545  { & name .hf.esni_nonce, \
2546  { "Nonce", prefix ".esni.nonce", \
2547  FT_BYTES, BASE_NONE, NULL, 0x00, \
2548  "Contents of ClientESNIInner.nonce", HFILL } \
2549  }, \
2550  { & name .hf.ech_echconfiglist_length, \
2551  { "ECHConfigList length", prefix ".ech.echconfiglist_length", \
2552  FT_UINT16, BASE_DEC, NULL, 0x0, \
2553  "Encrypted ClientHello (ECH) Configurations length", HFILL } \
2554  }, \
2555  { & name .hf.ech_echconfiglist, \
2556  { "ECHConfigList", prefix ".ech.echconfiglist", \
2557  FT_NONE, BASE_NONE, NULL, 0x0, \
2558  "Encrypted ClientHello (ECH) Configurations", HFILL } \
2559  }, \
2560  { & name .hf.ech_echconfig, \
2561  { "ECHConfig", prefix ".ech.echconfig", \
2562  FT_NONE, BASE_NONE, NULL, 0x0, \
2563  "Encrypted ClientHello (ECH) Configuration", HFILL } \
2564  }, \
2565  { & name .hf.ech_echconfig_version, \
2566  { "Version", prefix ".ech.echconfig.version", \
2567  FT_UINT16, BASE_HEX, NULL, 0x0, \
2568  "Encrypted ClientHello: ECHConfig version", HFILL } \
2569  }, \
2570  { & name .hf.ech_echconfig_length, \
2571  { "Length", prefix ".ech.echconfig.length", \
2572  FT_UINT16, BASE_DEC, NULL, 0x0, \
2573  "Encrypted ClientHello: ECHConfig length", HFILL } \
2574  }, \
2575  { & name .hf.ech_echconfigcontents_maximum_name_length, \
2576  { "Maximum Name Length", prefix ".ech.echconfigcontents.maximum_name_length", \
2577  FT_UINT8, BASE_DEC, NULL, 0x0, \
2578  "The longest name of a backend server, if known", HFILL } \
2579  }, \
2580  { & name .hf.ech_echconfigcontents_public_name_length, \
2581  { "Public Name length", prefix ".ech.echconfigcontents.public_name_length", \
2582  FT_UINT8, BASE_DEC, NULL, 0x0, \
2583  "Length of the Public Name field", HFILL } \
2584  }, \
2585  { & name .hf.ech_echconfigcontents_public_name, \
2586  { "Public Name", prefix ".ech.echconfigcontents.public_name", \
2587  FT_STRING, BASE_NONE, NULL, 0x0, \
2588  "The DNS name of the client-facing server, i.e., the entity trusted to update the ECH configuration", HFILL } \
2589  }, \
2590  { & name .hf.ech_echconfigcontents_extensions_length, \
2591  { "Extensions length", prefix ".ech.echconfigcontents.extensions_length", \
2592  FT_UINT16, BASE_DEC, NULL, 0x0, \
2593  "Length of the Extensions field", HFILL } \
2594  }, \
2595  { & name .hf.ech_echconfigcontents_extensions, \
2596  { "Extensions", prefix ".ech.echconfigcontents.extensions", \
2597  FT_BYTES, BASE_NONE, NULL, 0x0, \
2598  "A list of extensions that the client must take into consideration when generating a ClientHello message", HFILL } \
2599  }, \
2600  { & name .hf.ech_hpke_keyconfig, \
2601  { "HKPE Key Config", prefix ".ech.hpke.keyconfig", \
2602  FT_NONE, BASE_NONE, NULL, 0x0, \
2603  "HPKE Key Config", HFILL } \
2604  }, \
2605  { & name .hf.ech_hpke_keyconfig_config_id, \
2606  { "Config Id", prefix ".ech.hpke.keyconfig.config_id", \
2607  FT_UINT8, BASE_DEC, NULL, 0x0, \
2608  "HPKE Config Id", HFILL } \
2609  }, \
2610  { & name .hf.ech_hpke_keyconfig_kem_id, \
2611  { "KEM Id", prefix ".ech.hpke.keyconfig.kem_id", \
2612  FT_UINT16, BASE_DEC, VALS(kem_id_type_vals), 0x0, \
2613  "HPKE KEM Id", HFILL } \
2614  }, \
2615  { & name .hf.ech_hpke_keyconfig_public_key_length, \
2616  { "Public Key length", prefix ".ech.hpke.keyconfig.public_key_length", \
2617  FT_UINT16, BASE_DEC, NULL, 0x0, \
2618  "HPKE Public Key length", HFILL } \
2619  }, \
2620  { & name .hf.ech_hpke_keyconfig_public_key, \
2621  { "Public Key", prefix ".ech.hpke.keyconfig.public_key", \
2622  FT_BYTES, BASE_NONE, NULL, 0x0, \
2623  "HPKE Public Key", HFILL } \
2624  }, \
2625  { & name .hf.ech_hpke_keyconfig_cipher_suites, \
2626  { "Cipher Suites", prefix ".ech.hpke.keyconfig.cipher_suites", \
2627  FT_NONE, BASE_NONE, NULL, 0x0, \
2628  "HPKE Cipher Suites", HFILL } \
2629  }, \
2630  { & name .hf.ech_hpke_keyconfig_cipher_suites_length, \
2631  { "Cipher Suites length", prefix ".ech.hpke.keyconfig.cipher_suites_length", \
2632  FT_UINT16, BASE_DEC, NULL, 0x0, \
2633  "HPKE Cipher Suites length", HFILL } \
2634  }, \
2635  { & name .hf.ech_hpke_keyconfig_cipher_suite, \
2636  { "Cipher Suite", prefix ".ech.hpke.keyconfig.cipher_suite", \
2637  FT_NONE, BASE_NONE, NULL, 0x0, \
2638  "HPKE Cipher Suite", HFILL } \
2639  }, \
2640  { & name .hf.ech_hpke_keyconfig_cipher_suite_kdf_id, \
2641  { "KDF Id", prefix ".ech.hpke.keyconfig.cipher_suite.kdf_id", \
2642  FT_UINT16, BASE_DEC, VALS(kdf_id_type_vals), 0x0, \
2643  "HKPE KDF Id", HFILL } \
2644  }, \
2645  { & name .hf.ech_hpke_keyconfig_cipher_suite_aead_id, \
2646  { "AEAD Id", prefix ".ech.hpke.keyconfig.cipher_suite.aead_id", \
2647  FT_UINT16, BASE_DEC, VALS(aead_id_type_vals), 0x0, \
2648  "HKPE AEAD Id", HFILL } \
2649  }, \
2650  { & name .hf.ech_clienthello_type, \
2651  { "Client Hello type", prefix ".ech.client_hello_type", \
2652  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_ech_clienthello_types), 0x0, \
2653  "Client Hello type", HFILL } \
2654  }, \
2655  { & name .hf.ech_cipher_suite, \
2656  { "Cipher Suite", prefix ".ech.cipher_suite", \
2657  FT_NONE, BASE_NONE, NULL, 0x0, \
2658  "The cipher suite used to encrypt ClientHelloInner", HFILL } \
2659  }, \
2660  { & name .hf.ech_config_id, \
2661  { "Config Id", prefix ".ech.config_id", \
2662  FT_UINT8, BASE_DEC, NULL, 0x0, \
2663  "The ECHConfigContents.key_config.config_id for the chosen ECHConfig", HFILL } \
2664  }, \
2665  { & name .hf.ech_enc_length, \
2666  { "Enc length", prefix ".ech.enc_length", \
2667  FT_UINT16, BASE_DEC, NULL, 0x0, \
2668  NULL, HFILL } \
2669  }, \
2670  { & name .hf.ech_enc, \
2671  { "Enc", prefix ".ech.enc", \
2672  FT_BYTES, BASE_NONE, NULL, 0x0, \
2673  "The HPKE encapsulated key, used by servers to decrypt the corresponding payload field", HFILL } \
2674  }, \
2675  { & name .hf.ech_payload_length, \
2676  { "Payload length", prefix ".ech.payload_length", \
2677  FT_UINT16, BASE_DEC, NULL, 0x0, \
2678  "Payload Length", HFILL } \
2679  }, \
2680  { & name .hf.ech_payload, \
2681  { "Payload", prefix ".ech.payload", \
2682  FT_BYTES, BASE_NONE, NULL, 0x0, \
2683  "The serialized and encrypted ClientHelloInner structure", HFILL } \
2684  }, \
2685  { & name .hf.ech_confirmation, \
2686  { "Confirmation", prefix ".ech.confirmation", \
2687  FT_BYTES, BASE_NONE, NULL, 0x0, \
2688  "Confirmation of ECH acceptance in a HelloRetryRequest", HFILL } \
2689  }, \
2690  { & name .hf.ech_retry_configs, \
2691  { "Retry Configs", prefix ".ech.retry_configs", \
2692  FT_NONE, BASE_NONE, NULL, 0x0, \
2693  "ECHConfig structures for one-time use by the client in a retry connection", HFILL } \
2694  }, \
2695  { & name .hf.hs_ext_alps_len, \
2696  { "ALPS Extension Length", prefix ".handshake.extensions_alps_len", \
2697  FT_UINT16, BASE_DEC, NULL, 0x0, \
2698  "Length of the ALPS Extension", HFILL } \
2699  }, \
2700  { & name .hf.hs_ext_alps_alpn_list, \
2701  { "Supported ALPN List", prefix ".handshake.extensions_alps_alpn_list", \
2702  FT_NONE, BASE_NONE, NULL, 0x0, \
2703  "List of supported ALPN by ALPS", HFILL } \
2704  }, \
2705  { & name .hf.hs_ext_alps_alpn_str_len, \
2706  { "Supported ALPN Length", prefix ".handshake.extensions_alps_alpn_str_len", \
2707  FT_UINT8, BASE_DEC, NULL, 0x0, \
2708  "Length of ALPN string", HFILL } \
2709  }, \
2710  { & name .hf.hs_ext_alps_alpn_str, \
2711  { "Supported ALPN", prefix ".handshake.extensions_alps_alpn_str", \
2712  FT_STRING, BASE_NONE, NULL, 0x00, \
2713  "ALPN supported by ALPS", HFILL } \
2714  }, \
2715  { & name .hf.hs_ext_alps_settings, \
2716  { "ALPN Opaque Settings", prefix ".handshake.extensions_alps.settings", \
2717  FT_BYTES, BASE_NONE, NULL, 0x00, \
2718  "ALPN Opaque Settings", HFILL } \
2719  }
2720 /* }}} */
2721 
2722 /* {{{ */
2723 #define SSL_COMMON_ETT_LIST(name) \
2724  & name .ett.hs_ext, \
2725  & name .ett.hs_ext_alpn, \
2726  & name .ett.hs_ext_cert_types, \
2727  & name .ett.hs_ext_groups, \
2728  & name .ett.hs_ext_curves_point_formats, \
2729  & name .ett.hs_ext_npn, \
2730  & name .ett.hs_ext_reneg_info, \
2731  & name .ett.hs_ext_key_share, \
2732  & name .ett.hs_ext_key_share_ks, \
2733  & name .ett.hs_ext_pre_shared_key, \
2734  & name .ett.hs_ext_psk_identity, \
2735  & name .ett.hs_ext_server_name, \
2736  & name .ett.hs_ext_oid_filter, \
2737  & name .ett.hs_ext_quictp_parameter, \
2738  & name .ett.hs_sig_hash_alg, \
2739  & name .ett.hs_sig_hash_algs, \
2740  & name .ett.urlhash, \
2741  & name .ett.keyex_params, \
2742  & name .ett.certificates, \
2743  & name .ett.cert_types, \
2744  & name .ett.dnames, \
2745  & name .ett.hs_random, \
2746  & name .ett.cipher_suites, \
2747  & name .ett.comp_methods, \
2748  & name .ett.session_ticket, \
2749  & name .ett.sct, \
2750  & name .ett.cert_status, \
2751  & name .ett.ocsp_response, \
2752  & name .ett.uncompressed_certificates, \
2753  & name .ett.hs_ext_alps, \
2754  & name .ett.ech_echconfiglist, \
2755  & name .ett.ech_echconfig, \
2756  & name .ett.ech_retry_configs, \
2757  & name .ett.ech_hpke_keyconfig, \
2758  & name .ett.ech_hpke_cipher_suites, \
2759  & name .ett.ech_hpke_cipher_suite, \
2760  & name .ett.hs_ext_token_binding_key_parameters, \
2761 
2762 /* }}} */
2763 
2764 /* {{{ */
2765 #define SSL_COMMON_EI_LIST(name, prefix) \
2766  { & name .ei.client_version_error, \
2767  { prefix ".handshake.client_version_error", PI_PROTOCOL, PI_WARN, \
2768  "Client Hello legacy version field specifies version 1.3, not version 1.2; some servers may not be able to handle that.", EXPFILL } \
2769  }, \
2770  { & name .ei.server_version_error, \
2771  { prefix ".handshake.server_version_error", PI_PROTOCOL, PI_WARN, \
2772  "Server Hello legacy version field specifies version 1.3, not version 1.2; some middleboxes may not be able to handle that.", EXPFILL } \
2773  }, \
2774  { & name .ei.legacy_version, \
2775  { prefix ".handshake.legacy_version", PI_DEPRECATED, PI_CHAT, \
2776  "This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.", EXPFILL } \
2777  }, \
2778  { & name .ei.malformed_vector_length, \
2779  { prefix ".malformed.vector_length", PI_PROTOCOL, PI_WARN, \
2780  "Variable vector length is outside the permitted range", EXPFILL } \
2781  }, \
2782  { & name .ei.malformed_buffer_too_small, \
2783  { prefix ".malformed.buffer_too_small", PI_MALFORMED, PI_ERROR, \
2784  "Malformed message, not enough data is available", EXPFILL } \
2785  }, \
2786  { & name .ei.malformed_trailing_data, \
2787  { prefix ".malformed.trailing_data", PI_PROTOCOL, PI_WARN, \
2788  "Undecoded trailing data is present", EXPFILL } \
2789  }, \
2790  { & name .ei.hs_ext_cert_status_undecoded, \
2791  { prefix ".handshake.status_request.undecoded", PI_UNDECODED, PI_NOTE, \
2792  "Responder ID list or Request Extensions are not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2793  }, \
2794  { & name .ei.resumed, \
2795  { prefix ".resumed", PI_SEQUENCE, PI_NOTE, \
2796  "This session reuses previously negotiated keys (Session resumption)", EXPFILL } \
2797  }, \
2798  { & name .ei.record_length_invalid, \
2799  { prefix ".record.length.invalid", PI_PROTOCOL, PI_ERROR, \
2800  "Record fragment length is too small or too large", EXPFILL } \
2801  }, \
2802  { & name .ei.decompression_error, \
2803  { prefix ".decompression_error", PI_PROTOCOL, PI_ERROR, \
2804  "Decompression error", EXPFILL } \
2805  }, \
2806  { & name .ei.ech_echconfig_invalid_version, \
2807  { prefix ".ech_echconfig_invalid_version", PI_PROTOCOL, PI_ERROR, \
2808  "Invalid/unknown ECHConfig version", EXPFILL } \
2809  }
2810 /* }}} */
2811 
2812 extern void
2813 ssl_common_register_ssl_alpn_dissector_table(const char *name,
2814  const char *ui_name, const int proto);
2815 
2816 extern void
2817 ssl_common_register_dtls_alpn_dissector_table(const char *name,
2818  const char *ui_name, const int proto);
2819 
2820 extern void
2821 ssl_common_register_options(module_t *module, ssl_common_options_t *options, gboolean is_dtls);
2822 
2823 #ifdef SSL_DECRYPT_DEBUG
2824 extern void
2825 ssl_debug_printf(const gchar* fmt,...) G_GNUC_PRINTF(1,2);
2826 extern void
2827 ssl_print_data(const gchar* name, const guchar* data, size_t len);
2828 extern void
2829 ssl_print_string(const gchar* name, const StringInfo* data);
2830 extern void
2831 ssl_set_debug(const gchar* name);
2832 extern void
2833 ssl_debug_flush(void);
2834 #else
2835 
2836 /* No debug: nullify debug operation*/
2837 static inline void G_GNUC_PRINTF(1,2)
2838 ssl_debug_printf(const gchar* fmt _U_,...)
2839 {
2840 }
2841 #define ssl_print_data(a, b, c)
2842 #define ssl_print_string(a, b)
2843 #define ssl_set_debug(name)
2844 #define ssl_debug_flush()
2845 
2846 #endif /* SSL_DECRYPT_DEBUG */
2847 
2848 
2849 guint32
2850 ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
2851  proto_tree *tree, guint32 offset, guint32 offset_end);
2852 
2853 #endif /* __PACKET_TLS_UTILS_H__ */
2854 
2855 /*
2856  * Editor modelines - https://www.wireshark.org/tools/modelines.html
2857  *
2858  * Local variables:
2859  * c-basic-offset: 4
2860  * tab-width: 8
2861  * indent-tabs-mode: nil
2862  * End:
2863  *
2864  * vi: set shiftwidth=4 tabstop=8 expandtab:
2865  * :indentSize=4:tabSize=8:noTabs=true:
2866  */
Definition: packet-tls-utils.h:330
Definition: packet-tls-utils.h:346
StringInfo app_traffic_secret
Definition: packet-tls-utils.h:357
guint64 seq
Definition: packet-tls-utils.h:354
Definition: packet-tls-utils.c:2517
Definition: packet-tls-utils.h:504
Definition: packet-tls-utils.h:338
Definition: packet-tls-utils.h:419
SslFlow * flow
Definition: packet-tls-utils.h:425
guint32 seq
Definition: packet-tls-utils.h:427
gint id
Definition: packet-tls-utils.h:422
guint data_len
Definition: packet-tls-utils.h:421
guchar * plain_data
Definition: packet-tls-utils.h:420
ContentType type
Definition: packet-tls-utils.h:424
Definition: packet-tls-utils.h:454
Definition: packet-tls-utils.h:256
Definition: packet-tls-utils.h:435
guint record_id
Definition: packet-tls-utils.h:436
int is_last
Definition: packet-tls-utils.h:441
guint32 offset
Definition: packet-tls-utils.h:439
guint8 type
Definition: packet-tls-utils.h:440
guint reassembly_id
Definition: packet-tls-utils.h:438
Definition: address.h:56
Definition: packet_info.h:44
Definition: proto.h:898
Definition: value_string.h:293
Definition: packet-tls-utils.h:545
Definition: value_string.h:133
Definition: value_string.h:170
Definition: value_string.h:26
Definition: wmem_list.c:23
Definition: wmem_strbuf.h:42
Definition: wmem_tree-int.h:48
Definition: packet-tls-utils.h:414
Definition: packet-tls-utils.h:445
Definition: packet-tls-utils.h:539
Definition: conversation.h:220
Definition: packet.c:763
Definition: packet.c:86
Definition: packet-tls-utils.h:1188
Definition: expert.h:39
Definition: packet-tls-utils.h:1203
Definition: prefs-int.h:27
Definition: packet-tls-utils.h:838
Definition: packet-tls-utils.h:553
Definition: packet-tls-utils.h:1196
Definition: packet-tls-utils.h:559
Definition: tvbuff-int.h:35