Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 10964, column 13
Null pointer passed to 2nd parameter expecting 'nonnull'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-18/lib/clang/18 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/epan -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -dwarf-debug-flags /usr/lib/llvm-18/bin/clang -### --analyze -x c -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/epan -fvisibility=hidden -fexcess-precision=fast -fstrict-flex-arrays=3 -fstack-clash-protection -fcf-protection=full -D _GLIBCXX_ASSERTIONS -fstack-protector-strong -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -fexceptions -Wno-format-truncation -Wno-format-nonliteral -fdiagnostics-color=always -Wno-pointer-sign -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -std=gnu11 -fPIC /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c -o /builds/wireshark/wireshark/sbout/2025-05-08-100309-3825-1 -Xclang -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2025-05-08-100309-3825-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "packet-ber.h"
41#include "packet-x509af.h"
42#include "packet-x509if.h"
43#include "packet-tls-utils.h"
44#include "packet-ocsp.h"
45#include "packet-tls.h"
46#include "packet-dtls.h"
47#include "packet-quic.h"
48#if defined(HAVE_LIBGNUTLS1)
49#include <gnutls/abstract.h>
50#endif
51
52/* JA3/JA3S calculations must ignore GREASE values
53 * as described in RFC 8701.
54 */
55#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff)))
((((x) & 0x0f0f) == 0x0a0a) && \
56 (((x) & 0xff) == (((x)>>8) & 0xff)))
57
58/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
59 * form for a similar purpose as GREASE.
60 */
61#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
62
63#define DTLS13_MAX_EPOCH10 10
64
65/* Lookup tables {{{ */
66const value_string ssl_version_short_names[] = {
67 { SSLV2_VERSION0x0002, "SSLv2" },
68 { SSLV3_VERSION0x300, "SSLv3" },
69 { TLSV1_VERSION0x301, "TLSv1" },
70 { TLCPV1_VERSION0x101, "TLCP" },
71 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
72 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
73 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
74 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
75 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
76 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
77 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
78 { 0x00, NULL((void*)0) }
79};
80
81const value_string ssl_versions[] = {
82 { SSLV2_VERSION0x0002, "SSL 2.0" },
83 { SSLV3_VERSION0x300, "SSL 3.0" },
84 { TLSV1_VERSION0x301, "TLS 1.0" },
85 { TLCPV1_VERSION0x101, "TLCP" },
86 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
87 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
88 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
89 { 0x7F0E, "TLS 1.3 (draft 14)" },
90 { 0x7F0F, "TLS 1.3 (draft 15)" },
91 { 0x7F10, "TLS 1.3 (draft 16)" },
92 { 0x7F11, "TLS 1.3 (draft 17)" },
93 { 0x7F12, "TLS 1.3 (draft 18)" },
94 { 0x7F13, "TLS 1.3 (draft 19)" },
95 { 0x7F14, "TLS 1.3 (draft 20)" },
96 { 0x7F15, "TLS 1.3 (draft 21)" },
97 { 0x7F16, "TLS 1.3 (draft 22)" },
98 { 0x7F17, "TLS 1.3 (draft 23)" },
99 { 0x7F18, "TLS 1.3 (draft 24)" },
100 { 0x7F19, "TLS 1.3 (draft 25)" },
101 { 0x7F1A, "TLS 1.3 (draft 26)" },
102 { 0x7F1B, "TLS 1.3 (draft 27)" },
103 { 0x7F1C, "TLS 1.3 (draft 28)" },
104 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
105 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
106 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
107 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
108 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
109 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
110 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
111 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
112 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
113 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0x00, NULL((void*)0) }
127};
128
129static const value_string ssl_version_ja4_names[] = {
130 { 0x0100, "s1" },
131 { SSLV2_VERSION0x0002, "s2" },
132 { SSLV3_VERSION0x300, "s3" },
133 { TLSV1_VERSION0x301, "10" },
134 { TLSV1DOT1_VERSION0x302, "11" },
135 { TLSV1DOT2_VERSION0x303, "12" },
136 { TLSV1DOT3_VERSION0x304, "13" },
137 { DTLSV1DOT0_VERSION0xfeff, "d1" },
138 { DTLSV1DOT2_VERSION0xfefd, "d2" },
139 { DTLSV1DOT3_VERSION0xfefc, "d3" },
140 { 0x00, NULL((void*)0) }
141};
142
143const value_string ssl_20_msg_types[] = {
144 { SSL2_HND_ERROR0x00, "Error" },
145 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
146 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
147 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
148 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
149 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
150 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
151 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
152 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
153 { 0x00, NULL((void*)0) }
154};
155/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
156/* Note: sorted by ascending value so value_string-ext can do a binary search */
157static const value_string ssl_20_cipher_suites[] = {
158 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
159 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
160 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
161 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
162 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
163 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
164 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
165 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
166 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
167 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
168 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
169 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
171 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
174 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
175 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
177 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
180 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
182 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
183 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
184 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
185 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
186 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
187 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
188#if 0
189 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
190#endif
191 /* RFC 2712 */
192 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
193 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
194 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
195 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
196 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
197 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
198 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
199 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
200 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
201 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
202 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
203 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
204 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
205 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
206 /* RFC 4785 */
207 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
208 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
209 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
210 /* RFC 5246 */
211 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
212 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
213 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
214 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
215 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
216 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
217 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
218 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
219 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
220 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
221 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
222 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
223 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
224 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
225 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
226 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
227 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
229 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
230 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
231 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
232 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
236 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
237 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
238 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
239 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
240 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
241 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
242 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
243 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
244 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
245 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
246 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
247 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
248 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
249 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
250 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
251 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
252 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
253 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
254 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
255 /* 0x00,0x6E-83 Unassigned */
256 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
257 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
258 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
259 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
262 /* RFC 4279 */
263 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
264 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
265 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
266 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
267 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
268 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
269 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
270 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
271 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
272 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
273 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
274 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
275 /* RFC 4162 */
276 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
277 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
278 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
279 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
280 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
281 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
282 /* RFC 5288 */
283 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
284 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
285 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
286 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
287 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
288 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
289 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
290 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
291 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
292 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
293 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
294 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
295 /* RFC 5487 */
296 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
298 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
299 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
300 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
301 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
302 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
303 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
304 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
305 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
306 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
307 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
308 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
309 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
310 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
311 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
312 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
313 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
314 /* From RFC 5932 */
315 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
316 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
317 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
318 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
322 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
323 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
324 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
327 /* 0x00,0xC6-FE Unassigned */
328 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
329 /* 0x01-BF,* Unassigned */
330 /* From RFC 4492 */
331 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
332 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
333 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
334 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
335 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
336 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
337 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
338 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
339 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
340 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
341 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
342 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
343 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
344 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
345 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
346 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
347 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
348 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
349 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
350 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
351 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
352 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
353 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
354 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
355 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
356 /* RFC 5054 */
357 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
358 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
359 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
360 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
361 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
362 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
363 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
364 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
365 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
366 /* RFC 5589 */
367 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
368 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
369 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
370 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
371 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
372 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
373 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
374 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
375 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
376 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
377 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
378 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
379 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
380 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
381 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
382 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
383 /* RFC 5489 */
384 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
385 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
386 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
387 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
388 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
389 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
390 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
391 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
392 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
393 /* 0xC0,0x3C-FF Unassigned
394 0xC1-FD,* Unassigned
395 0xFE,0x00-FD Unassigned
396 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
397 0xFF,0x00-FF Reserved for Private Use [RFC5246]
398 */
399
400 /* old numbers used in the beginning
401 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
402 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
403 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
404 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
405
406 /* https://tools.ietf.org/html/rfc7905 */
407 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
409 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
410 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414
415 /* GM/T 0024-2014 */
416 { 0x00e001, "ECDHE_SM1_SM3"},
417 { 0x00e003, "ECC_SM1_SM3"},
418 { 0x00e005, "IBSDH_SM1_SM3"},
419 { 0x00e007, "IBC_SM1_SM3"},
420 { 0x00e009, "RSA_SM1_SM3"},
421 { 0x00e00a, "RSA_SM1_SHA1"},
422 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
423 { 0x00e013, "ECC_SM4_CBC_SM3"},
424 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
425 { 0x00e017, "IBC_SM4_CBC_SM3"},
426 { 0x00e019, "RSA_SM4_CBC_SM3"},
427 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
428 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
429 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
430 { 0x00e053, "ECC_SM4_GCM_SM3"},
431 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
432 { 0x00e057, "IBC_SM4_GCM_SM3"},
433 { 0x00e059, "RSA_SM4_GCM_SM3"},
434 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
435
436 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
437 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
438 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
439 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
440 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
441 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
442 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
443 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
444 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
445 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
446 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
447 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
448 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
449 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
450 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
451 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
452 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
453
454 /* these from http://www.mozilla.org/projects/
455 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
456 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
457 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
458 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
459 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 /* note that ciphersuites of {0x00????} are TLS cipher suites in
461 * a sslv2 client hello message; the ???? above is the two-byte
462 * tls cipher suite id
463 */
464
465 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
466 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
467 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
468 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
469 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
470 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
471 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
472 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
473
474 { 0x00, NULL((void*)0) }
475};
476
477value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites" }
;
478
479
480/*
481 * Supported Groups (formerly named "EC Named Curve").
482 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
483 */
484const value_string ssl_extension_curves[] = {
485 { 1, "sect163k1" },
486 { 2, "sect163r1" },
487 { 3, "sect163r2" },
488 { 4, "sect193r1" },
489 { 5, "sect193r2" },
490 { 6, "sect233k1" },
491 { 7, "sect233r1" },
492 { 8, "sect239k1" },
493 { 9, "sect283k1" },
494 { 10, "sect283r1" },
495 { 11, "sect409k1" },
496 { 12, "sect409r1" },
497 { 13, "sect571k1" },
498 { 14, "sect571r1" },
499 { 15, "secp160k1" },
500 { 16, "secp160r1" },
501 { 17, "secp160r2" },
502 { 18, "secp192k1" },
503 { 19, "secp192r1" },
504 { 20, "secp224k1" },
505 { 21, "secp224r1" },
506 { 22, "secp256k1" },
507 { 23, "secp256r1" },
508 { 24, "secp384r1" },
509 { 25, "secp521r1" },
510 { 26, "brainpoolP256r1" }, /* RFC 7027 */
511 { 27, "brainpoolP384r1" }, /* RFC 7027 */
512 { 28, "brainpoolP512r1" }, /* RFC 7027 */
513 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
514 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
515 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
516 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
517 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
518 { 34, "GC256A" }, /* RFC9189 */
519 { 35, "GC256B" }, /* RFC9189 */
520 { 36, "GC256C" }, /* RFC9189 */
521 { 37, "GC256D" }, /* RFC9189 */
522 { 38, "GC512A" }, /* RFC9189 */
523 { 39, "GC512B" }, /* RFC9189 */
524 { 40, "GC512C" }, /* RFC9189 */
525 { 41, "curveSM2" }, /* RFC 8998 */
526 { 256, "ffdhe2048" }, /* RFC 7919 */
527 { 257, "ffdhe3072" }, /* RFC 7919 */
528 { 258, "ffdhe4096" }, /* RFC 7919 */
529 { 259, "ffdhe6144" }, /* RFC 7919 */
530 { 260, "ffdhe8192" }, /* RFC 7919 */
531 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
532 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
533 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
534 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
535 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
536 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
537 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
538 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
539 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
540 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
541 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
544 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
545 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
547 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
548 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 0xFF01, "arbitrary_explicit_prime_curves" },
556 { 0xFF02, "arbitrary_explicit_char2_curves" },
557 /* Below are various unofficial values that have been used for testing. */
558 /* PQC key exchange algorithms from OQS-OpenSSL,
559 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
560 These use IANA unassigned values and this list may be incomplete.
561 */
562 { 0x2F00, "p256_frodo640aes" },
563 { 0x2F01, "p256_frodo640shake" },
564 { 0x2F02, "p384_frodo976aes" },
565 { 0x0203, "frodo976shake" },
566 { 0x2F03, "p384_frodo976shake" },
567 { 0x0204, "frodo1344aes" },
568 { 0x2F04, "p521_frodo1344aes" },
569 { 0x0205, "frodo1344shake" },
570 { 0x2F05, "p521_frodo1344shake" },
571 { 0x023A, "kyber512" },
572 { 0x2F3A, "p256_kyber512" },
573 { 0x023C, "kyber768" },
574 { 0x2F3C, "p384_kyber768" },
575 { 0x023D, "kyber1024" },
576 { 0x2F3D, "p521_kyber1024" },
577 { 0x0214, "ntru_hps2048509" },
578 { 0x2F14, "p256_ntru_hps2048509" },
579 { 0x0215, "ntru_hps2048677" },
580 { 0x2F15, "p384_ntru_hps2048677" },
581 { 0x0216, "ntru_hps4096821" },
582 { 0x2F16, "p521_ntru_hps4096821" },
583 { 0x0245, "ntru_hps40961229" },
584 { 0x2F45, "p521_ntru_hps40961229" },
585 { 0x0217, "ntru_hrss701" },
586 { 0x2F17, "p384_ntru_hrss701" },
587 { 0x0246, "ntru_hrss1373" },
588 { 0x2F46, "p521_ntru_hrss1373" },
589 { 0x0218, "lightsaber" },
590 { 0x2F18, "p256_lightsaber" },
591 { 0x0219, "saber" },
592 { 0x2F19, "p384_saber" },
593 { 0x021A, "firesaber" },
594 { 0x2F1A, "p521_firesaber" },
595 { 0x021B, "sidhp434" },
596 { 0x2F1B, "p256_sidhp434" },
597 { 0x021C, "sidhp503" },
598 { 0x2F1C, "p256_sidhp503" },
599 { 0x021D, "sidhp610" },
600 { 0x2F1D, "p384_sidhp610" },
601 { 0x021E, "sidhp751" },
602 { 0x2F1E, "p521_sidhp751" },
603 { 0x021F, "sikep434" },
604 { 0x2F1F, "p256_sikep434" },
605 { 0x0220, "sikep503" },
606 { 0x2F20, "p256_sikep503" },
607 { 0x0221, "sikep610" },
608 { 0x2F21, "p384_sikep610" },
609 { 0x0222, "sikep751" },
610 { 0x2F22, "p521_sikep751" },
611 { 0x0238, "bikel1" },
612 { 0x2F38, "p256_bikel1" },
613 { 0x023B, "bikel3" },
614 { 0x2F3B, "p384_bikel3" },
615 { 0x023E, "kyber90s512" },
616 { 0x2F3E, "p256_kyber90s512" },
617 { 0x023F, "kyber90s768" },
618 { 0x2F3F, "p384_kyber90s768" },
619 { 0x0240, "kyber90s1024" },
620 { 0x2F40, "p521_kyber90s1024" },
621 { 0x022C, "hqc128" },
622 { 0x2F2C, "p256_hqc128" },
623 { 0x022D, "hqc192" },
624 { 0x2F2D, "p384_hqc192" },
625 { 0x022E, "hqc256" },
626 { 0x2F2E, "p521_hqc256" },
627 { 0x022F, "ntrulpr653" },
628 { 0x2F2F, "p256_ntrulpr653" },
629 { 0x0230, "ntrulpr761" },
630 { 0x2F43, "p256_ntrulpr761" },
631 { 0x0231, "ntrulpr857" },
632 { 0x2F31, "p384_ntrulpr857" },
633 { 0x0241, "ntrulpr1277" },
634 { 0x2F41, "p521_ntrulpr1277" },
635 { 0x0232, "sntrup653" },
636 { 0x2F32, "p256_sntrup653" },
637 { 0x0233, "sntrup761" },
638 { 0x2F44, "p256_sntrup761" },
639 { 0x0234, "sntrup857" },
640 { 0x2F34, "p384_sntrup857" },
641 { 0x0242, "sntrup1277" },
642 { 0x2F42, "p521_sntrup1277" },
643 /* Other PQ key exchange algorithms, using Reserved for Private Use values
644 https://blog.cloudflare.com/post-quantum-for-all
645 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
646 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
647 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
648 { 0x00, NULL((void*)0) }
649};
650
651const value_string ssl_curve_types[] = {
652 { 1, "explicit_prime" },
653 { 2, "explicit_char2" },
654 { 3, "named_curve" },
655 { 0x00, NULL((void*)0) }
656};
657
658const value_string ssl_extension_ec_point_formats[] = {
659 { 0, "uncompressed" },
660 { 1, "ansiX962_compressed_prime" },
661 { 2, "ansiX962_compressed_char2" },
662 { 0x00, NULL((void*)0) }
663};
664
665const value_string ssl_20_certificate_type[] = {
666 { 0x00, "N/A" },
667 { 0x01, "X.509 Certificate" },
668 { 0x00, NULL((void*)0) }
669};
670
671const value_string ssl_31_content_type[] = {
672 { 20, "Change Cipher Spec" },
673 { 21, "Alert" },
674 { 22, "Handshake" },
675 { 23, "Application Data" },
676 { 24, "Heartbeat" },
677 { 25, "Connection ID" },
678 { 0x00, NULL((void*)0) }
679};
680
681#if 0
682/* XXX - would be used if we dissected the body of a Change Cipher Spec
683 message. */
684const value_string ssl_31_change_cipher_spec[] = {
685 { 1, "Change Cipher Spec" },
686 { 0x00, NULL((void*)0) }
687};
688#endif
689
690const value_string ssl_31_alert_level[] = {
691 { 1, "Warning" },
692 { 2, "Fatal" },
693 { 0x00, NULL((void*)0) }
694};
695
696const value_string ssl_31_alert_description[] = {
697 { 0, "Close Notify" },
698 { 1, "End of Early Data" },
699 { 10, "Unexpected Message" },
700 { 20, "Bad Record MAC" },
701 { 21, "Decryption Failed" },
702 { 22, "Record Overflow" },
703 { 30, "Decompression Failure" },
704 { 40, "Handshake Failure" },
705 { 41, "No Certificate" },
706 { 42, "Bad Certificate" },
707 { 43, "Unsupported Certificate" },
708 { 44, "Certificate Revoked" },
709 { 45, "Certificate Expired" },
710 { 46, "Certificate Unknown" },
711 { 47, "Illegal Parameter" },
712 { 48, "Unknown CA" },
713 { 49, "Access Denied" },
714 { 50, "Decode Error" },
715 { 51, "Decrypt Error" },
716 { 60, "Export Restriction" },
717 { 70, "Protocol Version" },
718 { 71, "Insufficient Security" },
719 { 80, "Internal Error" },
720 { 86, "Inappropriate Fallback" },
721 { 90, "User Canceled" },
722 { 100, "No Renegotiation" },
723 { 109, "Missing Extension" },
724 { 110, "Unsupported Extension" },
725 { 111, "Certificate Unobtainable" },
726 { 112, "Unrecognized Name" },
727 { 113, "Bad Certificate Status Response" },
728 { 114, "Bad Certificate Hash Value" },
729 { 115, "Unknown PSK Identity" },
730 { 116, "Certificate Required" },
731 { 120, "No application Protocol" },
732 { 121, "ECH Required" },
733 { 0x00, NULL((void*)0) }
734};
735
736const value_string ssl_31_handshake_type[] = {
737 { SSL_HND_HELLO_REQUEST, "Hello Request" },
738 { SSL_HND_CLIENT_HELLO, "Client Hello" },
739 { SSL_HND_SERVER_HELLO, "Server Hello" },
740 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
741 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
742 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
743 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
744 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
745 { SSL_HND_CERTIFICATE, "Certificate" },
746 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
747 { SSL_HND_CERT_REQUEST, "Certificate Request" },
748 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
749 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
750 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
751 { SSL_HND_FINISHED, "Finished" },
752 { SSL_HND_CERT_URL, "Client Certificate URL" },
753 { SSL_HND_CERT_STATUS, "Certificate Status" },
754 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
755 { SSL_HND_KEY_UPDATE, "Key Update" },
756 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
757 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
758 { 0x00, NULL((void*)0) }
759};
760
761const value_string tls_heartbeat_type[] = {
762 { 1, "Request" },
763 { 2, "Response" },
764 { 0x00, NULL((void*)0) }
765};
766
767const value_string tls_heartbeat_mode[] = {
768 { 1, "Peer allowed to send requests" },
769 { 2, "Peer not allowed to send requests" },
770 { 0x00, NULL((void*)0) }
771};
772
773const value_string ssl_31_compression_method[] = {
774 { 0, "null" },
775 { 1, "DEFLATE" },
776 { 64, "LZS" },
777 { 0x00, NULL((void*)0) }
778};
779
780#if 0
781/* XXX - would be used if we dissected a Signature, as would be
782 seen in a server key exchange or certificate verify message. */
783const value_string ssl_31_key_exchange_algorithm[] = {
784 { 0, "RSA" },
785 { 1, "Diffie Hellman" },
786 { 0x00, NULL((void*)0) }
787};
788
789const value_string ssl_31_signature_algorithm[] = {
790 { 0, "Anonymous" },
791 { 1, "RSA" },
792 { 2, "DSA" },
793 { 0x00, NULL((void*)0) }
794};
795#endif
796
797const value_string ssl_31_client_certificate_type[] = {
798 { 1, "RSA Sign" },
799 { 2, "DSS Sign" },
800 { 3, "RSA Fixed DH" },
801 { 4, "DSS Fixed DH" },
802 /* GOST certificate types */
803 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
804 { 21, "GOST R 34.10-94" },
805 { 22, "GOST R 34.10-2001" },
806 /* END GOST certificate types */
807 { 64, "ECDSA Sign" },
808 { 65, "RSA Fixed ECDH" },
809 { 66, "ECDSA Fixed ECDH" },
810 { 80, "IBC Params" },
811 { 0x00, NULL((void*)0) }
812};
813
814#if 0
815/* XXX - would be used if we dissected exchange keys, as would be
816 seen in a client key exchange message. */
817const value_string ssl_31_public_value_encoding[] = {
818 { 0, "Implicit" },
819 { 1, "Explicit" },
820 { 0x00, NULL((void*)0) }
821};
822#endif
823
824/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
825/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
826static const value_string ssl_31_ciphersuite[] = {
827 /* RFC 2246, RFC 4346, RFC 5246 */
828 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
829 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
830 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
831 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
832 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
833 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
834 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
835 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
836 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
837 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
838 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
839 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
841 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
844 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
845 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
847 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
850 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
852 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
853 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
854 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
855 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
856
857 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
858 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
859#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
860 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
861 of the ietf-tls list */
862 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
863#endif
864 /* RFC 2712 */
865 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
866 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
867 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
868 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
869 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
870 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
871 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
872 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
873 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
874 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
875 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
876 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
877 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
878 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
879 /* RFC 4785 */
880 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
881 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
882 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
883 /* RFC 5246 */
884 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
885 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
886 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
887 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
888 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
889 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
890 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
891 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
892 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
893 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
894 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
895 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
896 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
897 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
898 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
899 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
900 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
902 /* RFC 4132 */
903 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
904 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
905 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
906 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
909 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
910 /* --- ??? --- */
911 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
912 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
913 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
914 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
915 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
916 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
917 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
918 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
919 /* --- ??? ---*/
920 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
921 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
922 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
923 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
924 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
925 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
926 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
927 /* draft-chudov-cryptopro-cptls-04.txt */
928 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
929 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
930 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
931 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
932 /* RFC 4132 */
933 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
934 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
935 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
936 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
939 /* RFC 4279 */
940 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
941 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
942 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
943 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
944 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
945 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
946 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
947 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
948 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
949 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
950 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
951 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
952 /* RFC 4162 */
953 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
954 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
955 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
956 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
957 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
958 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
959 /* RFC 5288 */
960 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
961 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
962 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
963 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
964 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
965 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
966 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
967 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
968 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
969 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
970 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
971 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
972 /* RFC 5487 */
973 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
974 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
975 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
976 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
977 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
978 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
979 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
980 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
981 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
982 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
983 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
984 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
985 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
986 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
987 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
988 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
989 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
990 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
991 /* From RFC 5932 */
992 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
993 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
994 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
995 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
999 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1000 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1001 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1004 /* RFC 8998 */
1005 { 0x00C6, "TLS_SM4_GCM_SM3" },
1006 { 0x00C7, "TLS_SM4_CCM_SM3" },
1007 /* 0x00,0xC8-FE Unassigned */
1008 /* From RFC 5746 */
1009 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1010 /* RFC 8701 */
1011 { 0x0A0A, "Reserved (GREASE)" },
1012 /* RFC 8446 */
1013 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1014 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1015 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1016 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1017 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1018 /* RFC 8701 */
1019 { 0x1A1A, "Reserved (GREASE)" },
1020 { 0x2A2A, "Reserved (GREASE)" },
1021 { 0x3A3A, "Reserved (GREASE)" },
1022 { 0x4A4A, "Reserved (GREASE)" },
1023 /* From RFC 7507 */
1024 { 0x5600, "TLS_FALLBACK_SCSV" },
1025 /* RFC 8701 */
1026 { 0x5A5A, "Reserved (GREASE)" },
1027 { 0x6A6A, "Reserved (GREASE)" },
1028 { 0x7A7A, "Reserved (GREASE)" },
1029 { 0x8A8A, "Reserved (GREASE)" },
1030 { 0x9A9A, "Reserved (GREASE)" },
1031 { 0xAAAA, "Reserved (GREASE)" },
1032 { 0xBABA, "Reserved (GREASE)" },
1033 /* From RFC 4492 */
1034 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1035 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1036 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1037 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1038 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1039 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1040 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1041 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1042 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1043 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1044 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1045 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1046 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1047 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1048 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1049 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1050 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1051 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1052 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1053 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1054 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1055 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1056 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1057 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1058 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1059 /* RFC 5054 */
1060 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1061 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1062 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1063 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1064 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1065 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1066 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1067 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1068 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1069 /* RFC 5589 */
1070 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1071 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1072 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1073 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1074 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1075 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1076 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1077 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1078 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1079 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1080 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1081 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1082 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1083 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1084 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1085 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1086 /* RFC 5489 */
1087 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1088 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1089 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1090 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1091 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1092 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1093 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1094 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1095 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1096 /* RFC 6209 */
1097 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1098 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1099 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1100 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1101 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1102 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1103 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1104 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1105 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1106 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1107 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1108 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1109 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1110 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1111 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1112 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1113 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1114 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1115 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1116 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1117 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1118 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1119 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1120 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1121 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1122 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1123 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1124 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1125 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1126 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1127 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1128 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1129 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1130 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1131 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1132 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1133 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1134 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1135 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1136 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1137 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1138 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1139 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1140 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1141 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1142 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1143 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1144 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1145 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1146 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1147 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1148 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1149 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1150 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1151 /* RFC 6367 */
1152 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1153 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1154 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1155 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1156 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1157 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1158 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1159 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1160 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1161 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1162 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1163 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1164 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1165 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1166 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1167 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1168 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1169 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1170 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1171 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1172 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1173 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1174 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1175 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1176 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1177 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1178 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1179 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1180 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1181 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1182 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1183 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1184 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1185 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1186 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1187 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1188 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1189 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1190 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1191 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1192 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1193 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1194 /* RFC 6655 */
1195 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1196 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1197 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1198 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1199 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1200 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1201 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1202 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1203 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1204 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1205 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1206 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1207 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1208 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1209 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1210 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1211 /* RFC 7251 */
1212 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1213 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1214 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1215 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1216 /* RFC 8492 */
1217 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1218 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1219 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1220 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1221 /* draft-camwinget-tls-ts13-macciphersuites */
1222 { 0xC0B4, "TLS_SHA256_SHA256" },
1223 { 0xC0B5, "TLS_SHA384_SHA384" },
1224 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1225 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1226 /* draft-smyshlyaev-tls12-gost-suites */
1227 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1228 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1229 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1230 /* draft-smyshlyaev-tls13-gost-suites */
1231 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1232 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1233 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1234 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1235 /* RFC 8701 */
1236 { 0xCACA, "Reserved (GREASE)" },
1237/*
12380xC0,0xAB-FF Unassigned
12390xC1,0x03-FD,* Unassigned
12400xFE,0x00-FD Unassigned
12410xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12420xFF,0x00-FF Reserved for Private Use [RFC5246]
1243*/
1244 /* old numbers used in the beginning
1245 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1246 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1247 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1248 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1249 /* RFC 7905 */
1250 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1253 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 /* RFC 8442 */
1258 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1259 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1260 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1261 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1262 /* RFC 8701 */
1263 { 0xDADA, "Reserved (GREASE)" },
1264 /* GM/T 0024-2014 */
1265 { 0xe001, "ECDHE_SM1_SM3"},
1266 { 0xe003, "ECC_SM1_SM3"},
1267 { 0xe005, "IBSDH_SM1_SM3"},
1268 { 0xe007, "IBC_SM1_SM3"},
1269 { 0xe009, "RSA_SM1_SM3"},
1270 { 0xe00a, "RSA_SM1_SHA1"},
1271 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1272 { 0xe013, "ECC_SM4_CBC_SM3"},
1273 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1274 { 0xe017, "IBC_SM4_CBC_SM3"},
1275 { 0xe019, "RSA_SM4_CBC_SM3"},
1276 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1277 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1278 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1279 { 0xe053, "ECC_SM4_GCM_SM3"},
1280 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1281 { 0xe057, "IBC_SM4_GCM_SM3"},
1282 { 0xe059, "RSA_SM4_GCM_SM3"},
1283 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1284 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1285 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1286 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1287 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1288 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1289 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1290 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1291 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1292 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1293 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1294 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1295 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1296 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1297 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1298 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1299 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1300 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1301 /* RFC 8701 */
1302 { 0xEAEA, "Reserved (GREASE)" },
1303 { 0xFAFA, "Reserved (GREASE)" },
1304 /* these from http://www.mozilla.org/projects/
1305 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1306 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1307 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1308 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1309 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1310 /* note that ciphersuites 0xff00 - 0xffff are private */
1311 { 0x00, NULL((void*)0) }
1312};
1313
1314value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
}
;
1315
1316/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1317const value_string tls_hello_extension_types[] = {
1318 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1319 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1320 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1321 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1322 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1323 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1325 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1326 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1327 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1328 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1329 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1330 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1331 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1332 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1333 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1334 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1335 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1336 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1337 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1338 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1339 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1340 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1341 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1342 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1343 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1344 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1345 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1346 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1347 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1348 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1349 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1350 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1351 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1352 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1353 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1354 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1355 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1360 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1361 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1362 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1363 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1364 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1365 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1366 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1367 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1368 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1369 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1370 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1371 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://tools.ietf.org/id/draft-agl-tls-nextprotoneg-03.html */
1372 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1373 { SSL_HND_HELLO_EXT_ALPS17513, "application_settings" }, /* draft-vvv-tls-alps-01 */
1374 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1377 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1378 https://twitter.com/ericlaw/status/274237352531083264 */
1379 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1380 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1381 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1382 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1384 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1385 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1386 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1387 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1388 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1392 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1393 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1394 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1395 { 0, NULL((void*)0) }
1396};
1397
1398const value_string tls_hello_ext_server_name_type_vs[] = {
1399 { 0, "host_name" },
1400 { 0, NULL((void*)0) }
1401};
1402
1403/* RFC 6066 Section 4 */
1404const value_string tls_hello_ext_max_fragment_length[] = {
1405 { 1, "512" }, // 2^9
1406 { 2, "1024" }, // 2^10
1407 { 3, "2048" }, // 2^11
1408 { 4, "4096" }, // 2^12
1409 { 0, NULL((void*)0) }
1410};
1411
1412/* RFC 8446 Section 4.2.9 */
1413const value_string tls_hello_ext_psk_ke_mode[] = {
1414 { 0, "PSK-only key establishment (psk_ke)" },
1415 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1416 { 0, NULL((void*)0) }
1417};
1418
1419/* RFC 6066 Section 6 */
1420const value_string tls_hello_ext_trusted_ca_key_type[] = {
1421 {0, "pre_agreed"},
1422 {1, "key_sha1_hash"},
1423 {2, "x509_name"},
1424 {3, "cert_sha1_hash"},
1425 {0, NULL((void*)0)}
1426};
1427
1428const value_string tls13_key_update_request[] = {
1429 { 0, "update_not_requested" },
1430 { 1, "update_requested" },
1431 { 0, NULL((void*)0) }
1432};
1433
1434/* RFC 5246 7.4.1.4.1 */
1435/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1436/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1437 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1438 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1439 *
1440 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1441 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1442 * and TLS HashAlgorithm registries, but the new values are not compatible
1443 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1444 * cause confusion if used to interpret one of those schemes in a
1445 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1446 */
1447const value_string tls_hash_algorithm[] = {
1448 { 0, "None" },
1449 { 1, "MD5" },
1450 { 2, "SHA1" },
1451 { 3, "SHA224" },
1452 { 4, "SHA256" },
1453 { 5, "SHA384" },
1454 { 6, "SHA512" },
1455#if 0
1456 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1457 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1458 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1459 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1460 */
1461 { 8, "Intrinsic" },
1462#endif
1463 { 0, NULL((void*)0) }
1464};
1465
1466const value_string tls_signature_algorithm[] = {
1467 { 0, "Anonymous" },
1468 { 1, "RSA" },
1469 { 2, "DSA" },
1470 { 3, "ECDSA" },
1471#if 0
1472 /* As above. */
1473 { 7, "ED25519" },
1474 { 8, "ED448" },
1475 { 64, "GOSTR34102012_256" },
1476 { 65, "GOSTR34102012_512" },
1477#endif
1478 { 0, NULL((void*)0) }
1479};
1480
1481/* RFC 8446 Section 4.2.3 */
1482const value_string tls13_signature_algorithm[] = {
1483 { 0x0201, "rsa_pkcs1_sha1" },
1484 { 0x0203, "ecdsa_sha1" },
1485 { 0x0401, "rsa_pkcs1_sha256" },
1486 { 0x0403, "ecdsa_secp256r1_sha256" },
1487 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1488 { 0x0501, "rsa_pkcs1_sha384" },
1489 { 0x0503, "ecdsa_secp384r1_sha384" },
1490 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1491 { 0x0601, "rsa_pkcs1_sha512" },
1492 { 0x0603, "ecdsa_secp521r1_sha512" },
1493 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0708, "sm2sig_sm3" },
1495 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1496 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1497 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1498 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1499 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1500 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1501 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1502 { 0x0804, "rsa_pss_rsae_sha256" },
1503 { 0x0805, "rsa_pss_rsae_sha384" },
1504 { 0x0806, "rsa_pss_rsae_sha512" },
1505 { 0x0807, "ed25519" },
1506 { 0x0808, "ed448" },
1507 { 0x0809, "rsa_pss_pss_sha256" },
1508 { 0x080a, "rsa_pss_pss_sha384" },
1509 { 0x080b, "rsa_pss_pss_sha512" },
1510 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1511 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1512 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1513 /* PQC digital signature algorithms from OQS-OpenSSL,
1514 see https://github.com/open-quantum-safe/openssl/blob/OQS-OpenSSL_1_1_1-stable/oqs-template/oqs-sig-info.md */
1515 { 0xfea0, "dilithium2" },
1516 { 0xfea1, "p256_dilithium2" },
1517 { 0xfea2, "rsa3072_dilithium2" },
1518 { 0xfea3, "dilithium3" },
1519 { 0xfea4, "p384_dilithium3" },
1520 { 0xfea5, "dilithium5" },
1521 { 0xfea6, "p521_dilithium5" },
1522 { 0xfea7, "dilithium2_aes" },
1523 { 0xfea8, "p256_dilithium2_aes" },
1524 { 0xfea9, "rsa3072_dilithium2_aes" },
1525 { 0xfeaa, "dilithium3_aes" },
1526 { 0xfeab, "p384_dilithium3_aes" },
1527 { 0xfeac, "dilithium5_aes" },
1528 { 0xfead, "p521_dilithium5_aes" },
1529 { 0xfe0b, "falcon512" },
1530 { 0xfe0c, "p256_falcon512" },
1531 { 0xfe0d, "rsa3072_falcon512" },
1532 { 0xfe0e, "falcon1024" },
1533 { 0xfe0f, "p521_falcon1024" },
1534 { 0xfe96, "picnicl1full" },
1535 { 0xfe97, "p256_picnicl1full" },
1536 { 0xfe98, "rsa3072_picnicl1full" },
1537 { 0xfe1b, "picnic3l1" },
1538 { 0xfe1c, "p256_picnic3l1" },
1539 { 0xfe1d, "rsa3072_picnic3l1" },
1540 { 0xfe27, "rainbowIclassic" },
1541 { 0xfe28, "p256_rainbowIclassic" },
1542 { 0xfe29, "rsa3072_rainbowIclassic" },
1543 { 0xfe3c, "rainbowVclassic" },
1544 { 0xfe3d, "p521_rainbowVclassic" },
1545 { 0xfe42, "sphincsharaka128frobust" },
1546 { 0xfe43, "p256_sphincsharaka128frobust" },
1547 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1548 { 0xfe5e, "sphincssha256128frobust" },
1549 { 0xfe5f, "p256_sphincssha256128frobust" },
1550 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1551 { 0xfe7a, "sphincsshake256128frobust" },
1552 { 0xfe7b, "p256_sphincsshake256128frobust" },
1553 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1554 { 0, NULL((void*)0) }
1555};
1556
1557/* RFC 6091 3.1 */
1558const value_string tls_certificate_type[] = {
1559 { 0, "X.509" },
1560 { 1, "OpenPGP" },
1561 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1562 { 0, NULL((void*)0) }
1563};
1564
1565const value_string tls_cert_chain_type[] = {
1566 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1567 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1568 { 0, NULL((void*)0) }
1569};
1570
1571const value_string tls_cert_status_type[] = {
1572 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1573 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1574 { 0, NULL((void*)0) }
1575};
1576
1577/* Generated by tools/make-tls-ct-logids.py
1578 * Last-Modified Sat, 01 Mar 2025 13:28:00 GMT, 175 entries. */
1579static const bytes_string ct_logids[] = {
1580 { (const uint8_t[]){
1581 0xb2, 0x1e, 0x05, 0xcc, 0x8b, 0xa2, 0xcd, 0x8a, 0x20, 0x4e, 0x87,
1582 0x66, 0xf9, 0x2b, 0xb9, 0x8a, 0x25, 0x20, 0x67, 0x6b, 0xda, 0xfa,
1583 0x70, 0xe7, 0xb2, 0x49, 0x53, 0x2d, 0xef, 0x8b, 0x90, 0x5e,
1584 },
1585 32, "Google 'Argon2020' log" },
1586 { (const uint8_t[]){
1587 0xf6, 0x5c, 0x94, 0x2f, 0xd1, 0x77, 0x30, 0x22, 0x14, 0x54, 0x18,
1588 0x08, 0x30, 0x94, 0x56, 0x8e, 0xe3, 0x4d, 0x13, 0x19, 0x33, 0xbf,
1589 0xdf, 0x0c, 0x2f, 0x20, 0x0b, 0xcc, 0x4e, 0xf1, 0x64, 0xe3,
1590 },
1591 32, "Google 'Argon2021' log" },
1592 { (const uint8_t[]){
1593 0x29, 0x79, 0xbe, 0xf0, 0x9e, 0x39, 0x39, 0x21, 0xf0, 0x56, 0x73,
1594 0x9f, 0x63, 0xa5, 0x77, 0xe5, 0xbe, 0x57, 0x7d, 0x9c, 0x60, 0x0a,
1595 0xf8, 0xf9, 0x4d, 0x5d, 0x26, 0x5c, 0x25, 0x5d, 0xc7, 0x84,
1596 },
1597 32, "Google 'Argon2022' log" },
1598 { (const uint8_t[]){
1599 0xe8, 0x3e, 0xd0, 0xda, 0x3e, 0xf5, 0x06, 0x35, 0x32, 0xe7, 0x57,
1600 0x28, 0xbc, 0x89, 0x6b, 0xc9, 0x03, 0xd3, 0xcb, 0xd1, 0x11, 0x6b,
1601 0xec, 0xeb, 0x69, 0xe1, 0x77, 0x7d, 0x6d, 0x06, 0xbd, 0x6e,
1602 },
1603 32, "Google 'Argon2023' log" },
1604 { (const uint8_t[]){
1605 0xee, 0xcd, 0xd0, 0x64, 0xd5, 0xdb, 0x1a, 0xce, 0xc5, 0x5c, 0xb7,
1606 0x9d, 0xb4, 0xcd, 0x13, 0xa2, 0x32, 0x87, 0x46, 0x7c, 0xbc, 0xec,
1607 0xde, 0xc3, 0x51, 0x48, 0x59, 0x46, 0x71, 0x1f, 0xb5, 0x9b,
1608 },
1609 32, "Google 'Argon2024' log" },
1610 { (const uint8_t[]){
1611 0x4e, 0x75, 0xa3, 0x27, 0x5c, 0x9a, 0x10, 0xc3, 0x38, 0x5b, 0x6c,
1612 0xd4, 0xdf, 0x3f, 0x52, 0xeb, 0x1d, 0xf0, 0xe0, 0x8e, 0x1b, 0x8d,
1613 0x69, 0xc0, 0xb1, 0xfa, 0x64, 0xb1, 0x62, 0x9a, 0x39, 0xdf,
1614 },
1615 32, "Google 'Argon2025h1' log" },
1616 { (const uint8_t[]){
1617 0x12, 0xf1, 0x4e, 0x34, 0xbd, 0x53, 0x72, 0x4c, 0x84, 0x06, 0x19,
1618 0xc3, 0x8f, 0x3f, 0x7a, 0x13, 0xf8, 0xe7, 0xb5, 0x62, 0x87, 0x88,
1619 0x9c, 0x6d, 0x30, 0x05, 0x84, 0xeb, 0xe5, 0x86, 0x26, 0x3a,
1620 },
1621 32, "Google 'Argon2025h2' log" },
1622 { (const uint8_t[]){
1623 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1624 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1625 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1626 },
1627 32, "Google 'Argon2026h1' log" },
1628 { (const uint8_t[]){
1629 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1630 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1631 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1632 },
1633 32, "Google 'Argon2026h2' log" },
1634 { (const uint8_t[]){
1635 0x07, 0xb7, 0x5c, 0x1b, 0xe5, 0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6,
1636 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6, 0x57, 0x7c, 0x57, 0x94, 0xb7,
1637 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69, 0xd3, 0xa2, 0x1c,
1638 },
1639 32, "Google 'Xenon2020' log" },
1640 { (const uint8_t[]){
1641 0x7d, 0x3e, 0xf2, 0xf8, 0x8f, 0xff, 0x88, 0x55, 0x68, 0x24, 0xc2,
1642 0xc0, 0xca, 0x9e, 0x52, 0x89, 0x79, 0x2b, 0xc5, 0x0e, 0x78, 0x09,
1643 0x7f, 0x2e, 0x6a, 0x97, 0x68, 0x99, 0x7e, 0x22, 0xf0, 0xd7,
1644 },
1645 32, "Google 'Xenon2021' log" },
1646 { (const uint8_t[]){
1647 0x46, 0xa5, 0x55, 0xeb, 0x75, 0xfa, 0x91, 0x20, 0x30, 0xb5, 0xa2,
1648 0x89, 0x69, 0xf4, 0xf3, 0x7d, 0x11, 0x2c, 0x41, 0x74, 0xbe, 0xfd,
1649 0x49, 0xb8, 0x85, 0xab, 0xf2, 0xfc, 0x70, 0xfe, 0x6d, 0x47,
1650 },
1651 32, "Google 'Xenon2022' log" },
1652 { (const uint8_t[]){
1653 0xad, 0xf7, 0xbe, 0xfa, 0x7c, 0xff, 0x10, 0xc8, 0x8b, 0x9d, 0x3d,
1654 0x9c, 0x1e, 0x3e, 0x18, 0x6a, 0xb4, 0x67, 0x29, 0x5d, 0xcf, 0xb1,
1655 0x0c, 0x24, 0xca, 0x85, 0x86, 0x34, 0xeb, 0xdc, 0x82, 0x8a,
1656 },
1657 32, "Google 'Xenon2023' log" },
1658 { (const uint8_t[]){
1659 0x76, 0xff, 0x88, 0x3f, 0x0a, 0xb6, 0xfb, 0x95, 0x51, 0xc2, 0x61,
1660 0xcc, 0xf5, 0x87, 0xba, 0x34, 0xb4, 0xa4, 0xcd, 0xbb, 0x29, 0xdc,
1661 0x68, 0x42, 0x0a, 0x9f, 0xe6, 0x67, 0x4c, 0x5a, 0x3a, 0x74,
1662 },
1663 32, "Google 'Xenon2024' log" },
1664 { (const uint8_t[]){
1665 0xcf, 0x11, 0x56, 0xee, 0xd5, 0x2e, 0x7c, 0xaf, 0xf3, 0x87, 0x5b,
1666 0xd9, 0x69, 0x2e, 0x9b, 0xe9, 0x1a, 0x71, 0x67, 0x4a, 0xb0, 0x17,
1667 0xec, 0xac, 0x01, 0xd2, 0x5b, 0x77, 0xce, 0xcc, 0x3b, 0x08,
1668 },
1669 32, "Google 'Xenon2025h1' log" },
1670 { (const uint8_t[]){
1671 0xdd, 0xdc, 0xca, 0x34, 0x95, 0xd7, 0xe1, 0x16, 0x05, 0xe7, 0x95,
1672 0x32, 0xfa, 0xc7, 0x9f, 0xf8, 0x3d, 0x1c, 0x50, 0xdf, 0xdb, 0x00,
1673 0x3a, 0x14, 0x12, 0x76, 0x0a, 0x2c, 0xac, 0xbb, 0xc8, 0x2a,
1674 },
1675 32, "Google 'Xenon2025h2' log" },
1676 { (const uint8_t[]){
1677 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1678 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1679 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1680 },
1681 32, "Google 'Xenon2026h1' log" },
1682 { (const uint8_t[]){
1683 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1684 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1685 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1686 },
1687 32, "Google 'Xenon2026h2' log" },
1688 { (const uint8_t[]){
1689 0x68, 0xf6, 0x98, 0xf8, 0x1f, 0x64, 0x82, 0xbe, 0x3a, 0x8c, 0xee,
1690 0xb9, 0x28, 0x1d, 0x4c, 0xfc, 0x71, 0x51, 0x5d, 0x67, 0x93, 0xd4,
1691 0x44, 0xd1, 0x0a, 0x67, 0xac, 0xbb, 0x4f, 0x4f, 0xfb, 0xc4,
1692 },
1693 32, "Google 'Aviator' log" },
1694 { (const uint8_t[]){
1695 0x29, 0x3c, 0x51, 0x96, 0x54, 0xc8, 0x39, 0x65, 0xba, 0xaa, 0x50,
1696 0xfc, 0x58, 0x07, 0xd4, 0xb7, 0x6f, 0xbf, 0x58, 0x7a, 0x29, 0x72,
1697 0xdc, 0xa4, 0xc3, 0x0c, 0xf4, 0xe5, 0x45, 0x47, 0xf4, 0x78,
1698 },
1699 32, "Google 'Icarus' log" },
1700 { (const uint8_t[]){
1701 0xa4, 0xb9, 0x09, 0x90, 0xb4, 0x18, 0x58, 0x14, 0x87, 0xbb, 0x13,
1702 0xa2, 0xcc, 0x67, 0x70, 0x0a, 0x3c, 0x35, 0x98, 0x04, 0xf9, 0x1b,
1703 0xdf, 0xb8, 0xe3, 0x77, 0xcd, 0x0e, 0xc8, 0x0d, 0xdc, 0x10,
1704 },
1705 32, "Google 'Pilot' log" },
1706 { (const uint8_t[]){
1707 0xee, 0x4b, 0xbd, 0xb7, 0x75, 0xce, 0x60, 0xba, 0xe1, 0x42, 0x69,
1708 0x1f, 0xab, 0xe1, 0x9e, 0x66, 0xa3, 0x0f, 0x7e, 0x5f, 0xb0, 0x72,
1709 0xd8, 0x83, 0x00, 0xc4, 0x7b, 0x89, 0x7a, 0xa8, 0xfd, 0xcb,
1710 },
1711 32, "Google 'Rocketeer' log" },
1712 { (const uint8_t[]){
1713 0xbb, 0xd9, 0xdf, 0xbc, 0x1f, 0x8a, 0x71, 0xb5, 0x93, 0x94, 0x23,
1714 0x97, 0xaa, 0x92, 0x7b, 0x47, 0x38, 0x57, 0x95, 0x0a, 0xab, 0x52,
1715 0xe8, 0x1a, 0x90, 0x96, 0x64, 0x36, 0x8e, 0x1e, 0xd1, 0x85,
1716 },
1717 32, "Google 'Skydiver' log" },
1718 { (const uint8_t[]){
1719 0xfa, 0xd4, 0xc9, 0x7c, 0xc4, 0x9e, 0xe2, 0xf8, 0xac, 0x85, 0xc5,
1720 0xea, 0x5c, 0xea, 0x09, 0xd0, 0x22, 0x0d, 0xbb, 0xf4, 0xe4, 0x9c,
1721 0x6b, 0x50, 0x66, 0x2f, 0xf8, 0x68, 0xf8, 0x6b, 0x8c, 0x28,
1722 },
1723 32, "Google 'Argon2017' log" },
1724 { (const uint8_t[]){
1725 0xa4, 0x50, 0x12, 0x69, 0x05, 0x5a, 0x15, 0x54, 0x5e, 0x62, 0x11,
1726 0xab, 0x37, 0xbc, 0x10, 0x3f, 0x62, 0xae, 0x55, 0x76, 0xa4, 0x5e,
1727 0x4b, 0x17, 0x14, 0x45, 0x3e, 0x1b, 0x22, 0x10, 0x6a, 0x25,
1728 },
1729 32, "Google 'Argon2018' log" },
1730 { (const uint8_t[]){
1731 0x63, 0xf2, 0xdb, 0xcd, 0xe8, 0x3b, 0xcc, 0x2c, 0xcf, 0x0b, 0x72,
1732 0x84, 0x27, 0x57, 0x6b, 0x33, 0xa4, 0x8d, 0x61, 0x77, 0x8f, 0xbd,
1733 0x75, 0xa6, 0x38, 0xb1, 0xc7, 0x68, 0x54, 0x4b, 0xd8, 0x8d,
1734 },
1735 32, "Google 'Argon2019' log" },
1736 { (const uint8_t[]){
1737 0xb1, 0x0c, 0xd5, 0x59, 0xa6, 0xd6, 0x78, 0x46, 0x81, 0x1f, 0x7d,
1738 0xf9, 0xa5, 0x15, 0x32, 0x73, 0x9a, 0xc4, 0x8d, 0x70, 0x3b, 0xea,
1739 0x03, 0x23, 0xda, 0x5d, 0x38, 0x75, 0x5b, 0xc0, 0xad, 0x4e,
1740 },
1741 32, "Google 'Xenon2018' log" },
1742 { (const uint8_t[]){
1743 0x08, 0x41, 0x14, 0x98, 0x00, 0x71, 0x53, 0x2c, 0x16, 0x19, 0x04,
1744 0x60, 0xbc, 0xfc, 0x47, 0xfd, 0xc2, 0x65, 0x3a, 0xfa, 0x29, 0x2c,
1745 0x72, 0xb3, 0x7f, 0xf8, 0x63, 0xae, 0x29, 0xcc, 0xc9, 0xf0,
1746 },
1747 32, "Google 'Xenon2019' log" },
1748 { (const uint8_t[]){
1749 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1750 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1751 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1752 },
1753 32, "Google 'Submariner' log" },
1754 { (const uint8_t[]){
1755 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1756 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1757 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1758 },
1759 32, "Google 'Daedalus' log" },
1760 { (const uint8_t[]){
1761 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1762 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1763 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1764 },
1765 32, "Google 'Testtube' log" },
1766 { (const uint8_t[]){
1767 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1768 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1769 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1770 },
1771 32, "Google 'Crucible' log" },
1772 { (const uint8_t[]){
1773 0x52, 0xeb, 0x4b, 0x22, 0x5e, 0xc8, 0x96, 0x97, 0x48, 0x50, 0x67,
1774 0x5f, 0x23, 0xe4, 0x3b, 0xc1, 0xd0, 0x21, 0xe3, 0x21, 0x4c, 0xe5,
1775 0x2e, 0xcd, 0x5f, 0xa8, 0x7c, 0x20, 0x3c, 0xdf, 0xca, 0x03,
1776 },
1777 32, "Google 'Solera2018' log" },
1778 { (const uint8_t[]){
1779 0x0b, 0x76, 0x0e, 0x9a, 0x8b, 0x9a, 0x68, 0x2f, 0x88, 0x98, 0x5b,
1780 0x15, 0xe9, 0x47, 0x50, 0x1a, 0x56, 0x44, 0x6b, 0xba, 0x88, 0x30,
1781 0x78, 0x5c, 0x38, 0x42, 0x99, 0x43, 0x86, 0x45, 0x0c, 0x00,
1782 },
1783 32, "Google 'Solera2019' log" },
1784 { (const uint8_t[]){
1785 0x1f, 0xc7, 0x2c, 0xe5, 0xa1, 0xb7, 0x99, 0xf4, 0x00, 0xc3, 0x59,
1786 0xbf, 0xf9, 0x6c, 0xa3, 0x91, 0x35, 0x48, 0xe8, 0x64, 0x42, 0x20,
1787 0x61, 0x09, 0x52, 0xe9, 0xba, 0x17, 0x74, 0xf7, 0xba, 0xc7,
1788 },
1789 32, "Google 'Solera2020' log" },
1790 { (const uint8_t[]){
1791 0xa3, 0xc9, 0x98, 0x45, 0xe8, 0x0a, 0xb7, 0xce, 0x00, 0x15, 0x7b,
1792 0x37, 0x42, 0xdf, 0x02, 0x07, 0xdd, 0x27, 0x2b, 0x2b, 0x60, 0x2e,
1793 0xcf, 0x98, 0xee, 0x2c, 0x12, 0xdb, 0x9c, 0x5a, 0xe7, 0xe7,
1794 },
1795 32, "Google 'Solera2021' log" },
1796 { (const uint8_t[]){
1797 0x69, 0x7a, 0xaf, 0xca, 0x1a, 0x6b, 0x53, 0x6f, 0xae, 0x21, 0x20,
1798 0x50, 0x46, 0xde, 0xba, 0xd7, 0xe0, 0xea, 0xea, 0x13, 0xd2, 0x43,
1799 0x2e, 0x6e, 0x9d, 0x8f, 0xb3, 0x79, 0xf2, 0xb9, 0xaa, 0xf3,
1800 },
1801 32, "Google 'Solera2022' log" },
1802 { (const uint8_t[]){
1803 0xf9, 0x7e, 0x97, 0xb8, 0xd3, 0x3e, 0xf7, 0xa1, 0x59, 0x02, 0xa5,
1804 0x3a, 0x19, 0xe1, 0x79, 0x90, 0xe5, 0xdc, 0x40, 0x6a, 0x03, 0x18,
1805 0x25, 0xba, 0xad, 0x93, 0xe9, 0x8f, 0x9b, 0x9c, 0x69, 0xcb,
1806 },
1807 32, "Google 'Solera2023' log" },
1808 { (const uint8_t[]){
1809 0x30, 0x24, 0xce, 0x7e, 0xeb, 0x16, 0x88, 0x62, 0x72, 0x4b, 0xea,
1810 0x70, 0x2e, 0xff, 0xf9, 0x92, 0xcf, 0xe4, 0x56, 0x43, 0x41, 0x91,
1811 0xaa, 0x59, 0x5b, 0x25, 0xf8, 0x02, 0x26, 0xc8, 0x00, 0x17,
1812 },
1813 32, "Google 'Solera2024' log" },
1814 { (const uint8_t[]){
1815 0x3f, 0xe1, 0xcb, 0x46, 0xed, 0x47, 0x35, 0x79, 0xaf, 0x01, 0x41,
1816 0xf9, 0x72, 0x4d, 0x9d, 0xc4, 0x43, 0x47, 0x2d, 0x75, 0x6e, 0x85,
1817 0xe7, 0x71, 0x9c, 0x55, 0x82, 0x48, 0x5d, 0xd4, 0xe1, 0xe4,
1818 },
1819 32, "Google 'Solera2025h1' log" },
1820 { (const uint8_t[]){
1821 0x26, 0x02, 0x39, 0x48, 0x87, 0x4c, 0xf7, 0xfc, 0xd0, 0xfb, 0x64,
1822 0x71, 0xa4, 0x3e, 0x84, 0x7e, 0xbb, 0x20, 0x0a, 0xe6, 0xe2, 0xfa,
1823 0x24, 0x23, 0x6d, 0xf6, 0xd1, 0xa6, 0x06, 0x63, 0x0f, 0xb1,
1824 },
1825 32, "Google 'Solera2025h2' log" },
1826 { (const uint8_t[]){
1827 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1828 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1829 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1830 },
1831 32, "Google 'Solera2026h1' log" },
1832 { (const uint8_t[]){
1833 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1834 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1835 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1836 },
1837 32, "Google 'Solera2026h2' log" },
1838 { (const uint8_t[]){
1839 0x5e, 0xa7, 0x73, 0xf9, 0xdf, 0x56, 0xc0, 0xe7, 0xb5, 0x36, 0x48,
1840 0x7d, 0xd0, 0x49, 0xe0, 0x32, 0x7a, 0x91, 0x9a, 0x0c, 0x84, 0xa1,
1841 0x12, 0x12, 0x84, 0x18, 0x75, 0x96, 0x81, 0x71, 0x45, 0x58,
1842 },
1843 32, "Cloudflare 'Nimbus2020' Log" },
1844 { (const uint8_t[]){
1845 0x44, 0x94, 0x65, 0x2e, 0xb0, 0xee, 0xce, 0xaf, 0xc4, 0x40, 0x07,
1846 0xd8, 0xa8, 0xfe, 0x28, 0xc0, 0xda, 0xe6, 0x82, 0xbe, 0xd8, 0xcb,
1847 0x31, 0xb5, 0x3f, 0xd3, 0x33, 0x96, 0xb5, 0xb6, 0x81, 0xa8,
1848 },
1849 32, "Cloudflare 'Nimbus2021' Log" },
1850 { (const uint8_t[]){
1851 0x41, 0xc8, 0xca, 0xb1, 0xdf, 0x22, 0x46, 0x4a, 0x10, 0xc6, 0xa1,
1852 0x3a, 0x09, 0x42, 0x87, 0x5e, 0x4e, 0x31, 0x8b, 0x1b, 0x03, 0xeb,
1853 0xeb, 0x4b, 0xc7, 0x68, 0xf0, 0x90, 0x62, 0x96, 0x06, 0xf6,
1854 },
1855 32, "Cloudflare 'Nimbus2022' Log" },
1856 { (const uint8_t[]){
1857 0x7a, 0x32, 0x8c, 0x54, 0xd8, 0xb7, 0x2d, 0xb6, 0x20, 0xea, 0x38,
1858 0xe0, 0x52, 0x1e, 0xe9, 0x84, 0x16, 0x70, 0x32, 0x13, 0x85, 0x4d,
1859 0x3b, 0xd2, 0x2b, 0xc1, 0x3a, 0x57, 0xa3, 0x52, 0xeb, 0x52,
1860 },
1861 32, "Cloudflare 'Nimbus2023' Log" },
1862 { (const uint8_t[]){
1863 0xda, 0xb6, 0xbf, 0x6b, 0x3f, 0xb5, 0xb6, 0x22, 0x9f, 0x9b, 0xc2,
1864 0xbb, 0x5c, 0x6b, 0xe8, 0x70, 0x91, 0x71, 0x6c, 0xbb, 0x51, 0x84,
1865 0x85, 0x34, 0xbd, 0xa4, 0x3d, 0x30, 0x48, 0xd7, 0xfb, 0xab,
1866 },
1867 32, "Cloudflare 'Nimbus2024' Log" },
1868 { (const uint8_t[]){
1869 0xcc, 0xfb, 0x0f, 0x6a, 0x85, 0x71, 0x09, 0x65, 0xfe, 0x95, 0x9b,
1870 0x53, 0xce, 0xe9, 0xb2, 0x7c, 0x22, 0xe9, 0x85, 0x5c, 0x0d, 0x97,
1871 0x8d, 0xb6, 0xa9, 0x7e, 0x54, 0xc0, 0xfe, 0x4c, 0x0d, 0xb0,
1872 },
1873 32, "Cloudflare 'Nimbus2025'" },
1874 { (const uint8_t[]){
1875 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1876 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1877 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1878 },
1879 32, "Cloudflare 'Nimbus2026'" },
1880 { (const uint8_t[]){
1881 0x1f, 0xbc, 0x36, 0xe0, 0x02, 0xed, 0xe9, 0x7f, 0x40, 0x19, 0x9e,
1882 0x86, 0xb3, 0x57, 0x3b, 0x8a, 0x42, 0x17, 0xd8, 0x01, 0x87, 0x74,
1883 0x6a, 0xd0, 0xda, 0x03, 0xa0, 0x60, 0x54, 0xd2, 0x0d, 0xf4,
1884 },
1885 32, "Cloudflare 'Nimbus2017' Log" },
1886 { (const uint8_t[]){
1887 0xdb, 0x74, 0xaf, 0xee, 0xcb, 0x29, 0xec, 0xb1, 0xfe, 0xca, 0x3e,
1888 0x71, 0x6d, 0x2c, 0xe5, 0xb9, 0xaa, 0xbb, 0x36, 0xf7, 0x84, 0x71,
1889 0x83, 0xc7, 0x5d, 0x9d, 0x4f, 0x37, 0xb6, 0x1f, 0xbf, 0x64,
1890 },
1891 32, "Cloudflare 'Nimbus2018' Log" },
1892 { (const uint8_t[]){
1893 0x74, 0x7e, 0xda, 0x83, 0x31, 0xad, 0x33, 0x10, 0x91, 0x21, 0x9c,
1894 0xce, 0x25, 0x4f, 0x42, 0x70, 0xc2, 0xbf, 0xfd, 0x5e, 0x42, 0x20,
1895 0x08, 0xc6, 0x37, 0x35, 0x79, 0xe6, 0x10, 0x7b, 0xcc, 0x56,
1896 },
1897 32, "Cloudflare 'Nimbus2019' Log" },
1898 { (const uint8_t[]){
1899 0x56, 0x14, 0x06, 0x9a, 0x2f, 0xd7, 0xc2, 0xec, 0xd3, 0xf5, 0xe1,
1900 0xbd, 0x44, 0xb2, 0x3e, 0xc7, 0x46, 0x76, 0xb9, 0xbc, 0x99, 0x11,
1901 0x5c, 0xc0, 0xef, 0x94, 0x98, 0x55, 0xd6, 0x89, 0xd0, 0xdd,
1902 },
1903 32, "DigiCert Log Server" },
1904 { (const uint8_t[]){
1905 0x87, 0x75, 0xbf, 0xe7, 0x59, 0x7c, 0xf8, 0x8c, 0x43, 0x99, 0x5f,
1906 0xbd, 0xf3, 0x6e, 0xff, 0x56, 0x8d, 0x47, 0x56, 0x36, 0xff, 0x4a,
1907 0xb5, 0x60, 0xc1, 0xb4, 0xea, 0xff, 0x5e, 0xa0, 0x83, 0x0f,
1908 },
1909 32, "DigiCert Log Server 2" },
1910 { (const uint8_t[]){
1911 0xf0, 0x95, 0xa4, 0x59, 0xf2, 0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d,
1912 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b, 0xfe, 0x1d, 0x47, 0xe3, 0x99,
1913 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa, 0x8e, 0xb2, 0x73,
1914 },
1915 32, "DigiCert Yeti2020 Log" },
1916 { (const uint8_t[]){
1917 0x5c, 0xdc, 0x43, 0x92, 0xfe, 0xe6, 0xab, 0x45, 0x44, 0xb1, 0x5e,
1918 0x9a, 0xd4, 0x56, 0xe6, 0x10, 0x37, 0xfb, 0xd5, 0xfa, 0x47, 0xdc,
1919 0xa1, 0x73, 0x94, 0xb2, 0x5e, 0xe6, 0xf6, 0xc7, 0x0e, 0xca,
1920 },
1921 32, "DigiCert Yeti2021 Log" },
1922 { (const uint8_t[]){
1923 0x22, 0x45, 0x45, 0x07, 0x59, 0x55, 0x24, 0x56, 0x96, 0x3f, 0xa1,
1924 0x2f, 0xf1, 0xf7, 0x6d, 0x86, 0xe0, 0x23, 0x26, 0x63, 0xad, 0xc0,
1925 0x4b, 0x7f, 0x5d, 0xc6, 0x83, 0x5c, 0x6e, 0xe2, 0x0f, 0x02,
1926 },
1927 32, "DigiCert Yeti2022 Log" },
1928 { (const uint8_t[]){
1929 0x35, 0xcf, 0x19, 0x1b, 0xbf, 0xb1, 0x6c, 0x57, 0xbf, 0x0f, 0xad,
1930 0x4c, 0x6d, 0x42, 0xcb, 0xbb, 0xb6, 0x27, 0x20, 0x26, 0x51, 0xea,
1931 0x3f, 0xe1, 0x2a, 0xef, 0xa8, 0x03, 0xc3, 0x3b, 0xd6, 0x4c,
1932 },
1933 32, "DigiCert Yeti2023 Log" },
1934 { (const uint8_t[]){
1935 0x48, 0xb0, 0xe3, 0x6b, 0xda, 0xa6, 0x47, 0x34, 0x0f, 0xe5, 0x6a,
1936 0x02, 0xfa, 0x9d, 0x30, 0xeb, 0x1c, 0x52, 0x01, 0xcb, 0x56, 0xdd,
1937 0x2c, 0x81, 0xd9, 0xbb, 0xbf, 0xab, 0x39, 0xd8, 0x84, 0x73,
1938 },
1939 32, "DigiCert Yeti2024 Log" },
1940 { (const uint8_t[]){
1941 0x7d, 0x59, 0x1e, 0x12, 0xe1, 0x78, 0x2a, 0x7b, 0x1c, 0x61, 0x67,
1942 0x7c, 0x5e, 0xfd, 0xf8, 0xd0, 0x87, 0x5c, 0x14, 0xa0, 0x4e, 0x95,
1943 0x9e, 0xb9, 0x03, 0x2f, 0xd9, 0x0e, 0x8c, 0x2e, 0x79, 0xb8,
1944 },
1945 32, "DigiCert Yeti2025 Log" },
1946 { (const uint8_t[]){
1947 0xc6, 0x52, 0xa0, 0xec, 0x48, 0xce, 0xb3, 0xfc, 0xab, 0x17, 0x09,
1948 0x92, 0xc4, 0x3a, 0x87, 0x41, 0x33, 0x09, 0xe8, 0x00, 0x65, 0xa2,
1949 0x62, 0x52, 0x40, 0x1b, 0xa3, 0x36, 0x2a, 0x17, 0xc5, 0x65,
1950 },
1951 32, "DigiCert Nessie2020 Log" },
1952 { (const uint8_t[]){
1953 0xee, 0xc0, 0x95, 0xee, 0x8d, 0x72, 0x64, 0x0f, 0x92, 0xe3, 0xc3,
1954 0xb9, 0x1b, 0xc7, 0x12, 0xa3, 0x69, 0x6a, 0x09, 0x7b, 0x4b, 0x6a,
1955 0x1a, 0x14, 0x38, 0xe6, 0x47, 0xb2, 0xcb, 0xed, 0xc5, 0xf9,
1956 },
1957 32, "DigiCert Nessie2021 Log" },
1958 { (const uint8_t[]){
1959 0x51, 0xa3, 0xb0, 0xf5, 0xfd, 0x01, 0x79, 0x9c, 0x56, 0x6d, 0xb8,
1960 0x37, 0x78, 0x8f, 0x0c, 0xa4, 0x7a, 0xcc, 0x1b, 0x27, 0xcb, 0xf7,
1961 0x9e, 0x88, 0x42, 0x9a, 0x0d, 0xfe, 0xd4, 0x8b, 0x05, 0xe5,
1962 },
1963 32, "DigiCert Nessie2022 Log" },
1964 { (const uint8_t[]){
1965 0xb3, 0x73, 0x77, 0x07, 0xe1, 0x84, 0x50, 0xf8, 0x63, 0x86, 0xd6,
1966 0x05, 0xa9, 0xdc, 0x11, 0x09, 0x4a, 0x79, 0x2d, 0xb1, 0x67, 0x0c,
1967 0x0b, 0x87, 0xdc, 0xf0, 0x03, 0x0e, 0x79, 0x36, 0xa5, 0x9a,
1968 },
1969 32, "DigiCert Nessie2023 Log" },
1970 { (const uint8_t[]){
1971 0x73, 0xd9, 0x9e, 0x89, 0x1b, 0x4c, 0x96, 0x78, 0xa0, 0x20, 0x7d,
1972 0x47, 0x9d, 0xe6, 0xb2, 0xc6, 0x1c, 0xd0, 0x51, 0x5e, 0x71, 0x19,
1973 0x2a, 0x8c, 0x6b, 0x80, 0x10, 0x7a, 0xc1, 0x77, 0x72, 0xb5,
1974 },
1975 32, "DigiCert Nessie2024 Log" },
1976 { (const uint8_t[]){
1977 0xe6, 0xd2, 0x31, 0x63, 0x40, 0x77, 0x8c, 0xc1, 0x10, 0x41, 0x06,
1978 0xd7, 0x71, 0xb9, 0xce, 0xc1, 0xd2, 0x40, 0xf6, 0x96, 0x84, 0x86,
1979 0xfb, 0xba, 0x87, 0x32, 0x1d, 0xfd, 0x1e, 0x37, 0x8e, 0x50,
1980 },
1981 32, "DigiCert Nessie2025 Log" },
1982 { (const uint8_t[]){
1983 0xb6, 0x9d, 0xdc, 0xbc, 0x3c, 0x1a, 0xbd, 0xef, 0x6f, 0x9f, 0xd6,
1984 0x0c, 0x88, 0xb1, 0x06, 0x7b, 0x77, 0xf0, 0x82, 0x68, 0x8b, 0x2d,
1985 0x78, 0x65, 0xd0, 0x4b, 0x39, 0xab, 0xe9, 0x27, 0xa5, 0x75,
1986 },
1987 32, "DigiCert 'Wyvern2024h1' Log" },
1988 { (const uint8_t[]){
1989 0x0c, 0x2a, 0xef, 0x2c, 0x4a, 0x5b, 0x98, 0x83, 0xd4, 0xdd, 0xa3,
1990 0x82, 0xfe, 0x50, 0xfb, 0x51, 0x88, 0xb3, 0xe9, 0x73, 0x33, 0xa1,
1991 0xec, 0x53, 0xa0, 0x9d, 0xc9, 0xa7, 0x9d, 0x0d, 0x08, 0x20,
1992 },
1993 32, "DigiCert 'Wyvern2024h2' Log" },
1994 { (const uint8_t[]){
1995 0x73, 0x20, 0x22, 0x0f, 0x08, 0x16, 0x8a, 0xf9, 0xf3, 0xc4, 0xa6,
1996 0x8b, 0x0a, 0xb2, 0x6a, 0x9a, 0x4a, 0x00, 0xee, 0xf5, 0x77, 0x85,
1997 0x8a, 0x08, 0x4d, 0x05, 0x00, 0xd4, 0xa5, 0x42, 0x44, 0x59,
1998 },
1999 32, "DigiCert 'Wyvern2025h1' Log" },
2000 { (const uint8_t[]){
2001 0xed, 0x3c, 0x4b, 0xd6, 0xe8, 0x06, 0xc2, 0xa4, 0xa2, 0x00, 0x57,
2002 0xdb, 0xcb, 0x24, 0xe2, 0x38, 0x01, 0xdf, 0x51, 0x2f, 0xed, 0xc4,
2003 0x86, 0xc5, 0x70, 0x0f, 0x20, 0xdd, 0xb7, 0x3e, 0x3f, 0xe0,
2004 },
2005 32, "DigiCert 'Wyvern2025h2' Log" },
2006 { (const uint8_t[]){
2007 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
2008 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
2009 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
2010 },
2011 32, "DigiCert 'Wyvern2026h1'" },
2012 { (const uint8_t[]){
2013 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
2014 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
2015 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
2016 },
2017 32, "DigiCert 'Wyvern2026h2'" },
2018 { (const uint8_t[]){
2019 0xdb, 0x07, 0x6c, 0xde, 0x6a, 0x8b, 0x78, 0xec, 0x58, 0xd6, 0x05,
2020 0x64, 0x96, 0xeb, 0x6a, 0x26, 0xa8, 0xc5, 0x9e, 0x72, 0x12, 0x93,
2021 0xe8, 0xac, 0x03, 0x27, 0xdd, 0xde, 0x89, 0xdb, 0x5a, 0x2a,
2022 },
2023 32, "DigiCert 'Sphinx2024h1' Log" },
2024 { (const uint8_t[]){
2025 0xdc, 0xc9, 0x5e, 0x6f, 0xa2, 0x99, 0xb9, 0xb0, 0xfd, 0xbd, 0x6c,
2026 0xa6, 0xa3, 0x6e, 0x1d, 0x72, 0xc4, 0x21, 0x2f, 0xdd, 0x1e, 0x0f,
2027 0x47, 0x55, 0x3a, 0x36, 0xd6, 0xcf, 0x1a, 0xd1, 0x1d, 0x8d,
2028 },
2029 32, "DigiCert 'Sphinx2024h2' Log" },
2030 { (const uint8_t[]){
2031 0xde, 0x85, 0x81, 0xd7, 0x50, 0x24, 0x7c, 0x6b, 0xcd, 0xcb, 0xaf,
2032 0x56, 0x37, 0xc5, 0xe7, 0x81, 0xc6, 0x4c, 0xe4, 0x6e, 0xd6, 0x17,
2033 0x63, 0x9f, 0x8f, 0x34, 0xa7, 0x26, 0xc9, 0xe2, 0xbd, 0x37,
2034 },
2035 32, "DigiCert 'Sphinx2025h1' Log" },
2036 { (const uint8_t[]){
2037 0xa4, 0x42, 0xc5, 0x06, 0x49, 0x60, 0x61, 0x54, 0x8f, 0x0f, 0xd4,
2038 0xea, 0x9c, 0xfb, 0x7a, 0x2d, 0x26, 0x45, 0x4d, 0x87, 0xa9, 0x7f,
2039 0x2f, 0xdf, 0x45, 0x59, 0xf6, 0x27, 0x4f, 0x3a, 0x84, 0x54,
2040 },
2041 32, "DigiCert 'Sphinx2025h2' Log" },
2042 { (const uint8_t[]){
2043 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
2044 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
2045 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
2046 },
2047 32, "DigiCert 'Sphinx2026h1'" },
2048 { (const uint8_t[]){
2049 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
2050 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
2051 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
2052 },
2053 32, "DigiCert 'Sphinx2026h2'" },
2054 { (const uint8_t[]){
2055 0xdd, 0xeb, 0x1d, 0x2b, 0x7a, 0x0d, 0x4f, 0xa6, 0x20, 0x8b, 0x81,
2056 0xad, 0x81, 0x68, 0x70, 0x7e, 0x2e, 0x8e, 0x9d, 0x01, 0xd5, 0x5c,
2057 0x88, 0x8d, 0x3d, 0x11, 0xc4, 0xcd, 0xb6, 0xec, 0xbe, 0xcc,
2058 },
2059 32, "Symantec log" },
2060 { (const uint8_t[]){
2061 0xbc, 0x78, 0xe1, 0xdf, 0xc5, 0xf6, 0x3c, 0x68, 0x46, 0x49, 0x33,
2062 0x4d, 0xa1, 0x0f, 0xa1, 0x5f, 0x09, 0x79, 0x69, 0x20, 0x09, 0xc0,
2063 0x81, 0xb4, 0xf3, 0xf6, 0x91, 0x7f, 0x3e, 0xd9, 0xb8, 0xa5,
2064 },
2065 32, "Symantec 'Vega' log" },
2066 { (const uint8_t[]){
2067 0x15, 0x97, 0x04, 0x88, 0xd7, 0xb9, 0x97, 0xa0, 0x5b, 0xeb, 0x52,
2068 0x51, 0x2a, 0xde, 0xe8, 0xd2, 0xe8, 0xb4, 0xa3, 0x16, 0x52, 0x64,
2069 0x12, 0x1a, 0x9f, 0xab, 0xfb, 0xd5, 0xf8, 0x5a, 0xd9, 0x3f,
2070 },
2071 32, "Symantec 'Sirius' log" },
2072 { (const uint8_t[]){
2073 0x05, 0x9c, 0x01, 0xd3, 0x20, 0xe0, 0x07, 0x84, 0x13, 0x95, 0x80,
2074 0x49, 0x8d, 0x11, 0x7c, 0x90, 0x32, 0x66, 0xaf, 0xaf, 0x72, 0x50,
2075 0xb5, 0xaf, 0x3b, 0x46, 0xa4, 0x3e, 0x11, 0x84, 0x0d, 0x4a,
2076 },
2077 32, "DigiCert Yeti2022-2 Log" },
2078 { (const uint8_t[]){
2079 0xc1, 0x16, 0x4a, 0xe0, 0xa7, 0x72, 0xd2, 0xd4, 0x39, 0x2d, 0xc8,
2080 0x0a, 0xc1, 0x07, 0x70, 0xd4, 0xf0, 0xc4, 0x9b, 0xde, 0x99, 0x1a,
2081 0x48, 0x40, 0xc1, 0xfa, 0x07, 0x51, 0x64, 0xf6, 0x33, 0x60,
2082 },
2083 32, "DigiCert Yeti2018 Log" },
2084 { (const uint8_t[]){
2085 0xe2, 0x69, 0x4b, 0xae, 0x26, 0xe8, 0xe9, 0x40, 0x09, 0xe8, 0x86,
2086 0x1b, 0xb6, 0x3b, 0x83, 0xd4, 0x3e, 0xe7, 0xfe, 0x74, 0x88, 0xfb,
2087 0xa4, 0x8f, 0x28, 0x93, 0x01, 0x9d, 0xdd, 0xf1, 0xdb, 0xfe,
2088 },
2089 32, "DigiCert Yeti2019 Log" },
2090 { (const uint8_t[]){
2091 0x6f, 0xf1, 0x41, 0xb5, 0x64, 0x7e, 0x42, 0x22, 0xf7, 0xef, 0x05,
2092 0x2c, 0xef, 0xae, 0x7c, 0x21, 0xfd, 0x60, 0x8e, 0x27, 0xd2, 0xaf,
2093 0x5a, 0x6e, 0x9f, 0x4b, 0x8a, 0x37, 0xd6, 0x63, 0x3e, 0xe5,
2094 },
2095 32, "DigiCert Nessie2018 Log" },
2096 { (const uint8_t[]){
2097 0xfe, 0x44, 0x61, 0x08, 0xb1, 0xd0, 0x1a, 0xb7, 0x8a, 0x62, 0xcc,
2098 0xfe, 0xab, 0x6a, 0xb2, 0xb2, 0xba, 0xbf, 0xf3, 0xab, 0xda, 0xd8,
2099 0x0a, 0x4d, 0x8b, 0x30, 0xdf, 0x2d, 0x00, 0x08, 0x83, 0x0c,
2100 },
2101 32, "DigiCert Nessie2019 Log" },
2102 { (const uint8_t[]){
2103 0xa7, 0xce, 0x4a, 0x4e, 0x62, 0x07, 0xe0, 0xad, 0xde, 0xe5, 0xfd,
2104 0xaa, 0x4b, 0x1f, 0x86, 0x76, 0x87, 0x67, 0xb5, 0xd0, 0x02, 0xa5,
2105 0x5d, 0x47, 0x31, 0x0e, 0x7e, 0x67, 0x0a, 0x95, 0xea, 0xb2,
2106 },
2107 32, "Symantec Deneb" },
2108 { (const uint8_t[]){
2109 0xcd, 0xb5, 0x17, 0x9b, 0x7f, 0xc1, 0xc0, 0x46, 0xfe, 0xea, 0x31,
2110 0x13, 0x6a, 0x3f, 0x8f, 0x00, 0x2e, 0x61, 0x82, 0xfa, 0xf8, 0x89,
2111 0x6f, 0xec, 0xc8, 0xb2, 0xf5, 0xb5, 0xab, 0x60, 0x49, 0x00,
2112 },
2113 32, "Certly.IO log" },
2114 { (const uint8_t[]){
2115 0x74, 0x61, 0xb4, 0xa0, 0x9c, 0xfb, 0x3d, 0x41, 0xd7, 0x51, 0x59,
2116 0x57, 0x5b, 0x2e, 0x76, 0x49, 0xa4, 0x45, 0xa8, 0xd2, 0x77, 0x09,
2117 0xb0, 0xcc, 0x56, 0x4a, 0x64, 0x82, 0xb7, 0xeb, 0x41, 0xa3,
2118 },
2119 32, "Izenpe log" },
2120 { (const uint8_t[]){
2121 0x89, 0x41, 0x44, 0x9c, 0x70, 0x74, 0x2e, 0x06, 0xb9, 0xfc, 0x9c,
2122 0xe7, 0xb1, 0x16, 0xba, 0x00, 0x24, 0xaa, 0x36, 0xd5, 0x9a, 0xf4,
2123 0x4f, 0x02, 0x04, 0x40, 0x4f, 0x00, 0xf7, 0xea, 0x85, 0x66,
2124 },
2125 32, "Izenpe 'Argi' log" },
2126 { (const uint8_t[]){
2127 0x41, 0xb2, 0xdc, 0x2e, 0x89, 0xe6, 0x3c, 0xe4, 0xaf, 0x1b, 0xa7,
2128 0xbb, 0x29, 0xbf, 0x68, 0xc6, 0xde, 0xe6, 0xf9, 0xf1, 0xcc, 0x04,
2129 0x7e, 0x30, 0xdf, 0xfa, 0xe3, 0xb3, 0xba, 0x25, 0x92, 0x63,
2130 },
2131 32, "WoSign log" },
2132 { (const uint8_t[]){
2133 0x9e, 0x4f, 0xf7, 0x3d, 0xc3, 0xce, 0x22, 0x0b, 0x69, 0x21, 0x7c,
2134 0x89, 0x9e, 0x46, 0x80, 0x76, 0xab, 0xf8, 0xd7, 0x86, 0x36, 0xd5,
2135 0xcc, 0xfc, 0x85, 0xa3, 0x1a, 0x75, 0x62, 0x8b, 0xa8, 0x8b,
2136 },
2137 32, "WoSign CT log #1" },
2138 { (const uint8_t[]){
2139 0x63, 0xd0, 0x00, 0x60, 0x26, 0xdd, 0xe1, 0x0b, 0xb0, 0x60, 0x1f,
2140 0x45, 0x24, 0x46, 0x96, 0x5e, 0xe2, 0xb6, 0xea, 0x2c, 0xd4, 0xfb,
2141 0xc9, 0x5a, 0xc8, 0x66, 0xa5, 0x50, 0xaf, 0x90, 0x75, 0xb7,
2142 },
2143 32, "WoSign log 2" },
2144 { (const uint8_t[]){
2145 0xac, 0x3b, 0x9a, 0xed, 0x7f, 0xa9, 0x67, 0x47, 0x57, 0x15, 0x9e,
2146 0x6d, 0x7d, 0x57, 0x56, 0x72, 0xf9, 0xd9, 0x81, 0x00, 0x94, 0x1e,
2147 0x9b, 0xde, 0xff, 0xec, 0xa1, 0x31, 0x3b, 0x75, 0x78, 0x2d,
2148 },
2149 32, "Venafi log" },
2150 { (const uint8_t[]){
2151 0x03, 0x01, 0x9d, 0xf3, 0xfd, 0x85, 0xa6, 0x9a, 0x8e, 0xbd, 0x1f,
2152 0xac, 0xc6, 0xda, 0x9b, 0xa7, 0x3e, 0x46, 0x97, 0x74, 0xfe, 0x77,
2153 0xf5, 0x79, 0xfc, 0x5a, 0x08, 0xb8, 0x32, 0x8c, 0x1d, 0x6b,
2154 },
2155 32, "Venafi Gen2 CT log" },
2156 { (const uint8_t[]){
2157 0xa5, 0x77, 0xac, 0x9c, 0xed, 0x75, 0x48, 0xdd, 0x8f, 0x02, 0x5b,
2158 0x67, 0xa2, 0x41, 0x08, 0x9d, 0xf8, 0x6e, 0x0f, 0x47, 0x6e, 0xc2,
2159 0x03, 0xc2, 0xec, 0xbe, 0xdb, 0x18, 0x5f, 0x28, 0x26, 0x38,
2160 },
2161 32, "CNNIC CT log" },
2162 { (const uint8_t[]){
2163 0x34, 0xbb, 0x6a, 0xd6, 0xc3, 0xdf, 0x9c, 0x03, 0xee, 0xa8, 0xa4,
2164 0x99, 0xff, 0x78, 0x91, 0x48, 0x6c, 0x9d, 0x5e, 0x5c, 0xac, 0x92,
2165 0xd0, 0x1f, 0x7b, 0xfd, 0x1b, 0xce, 0x19, 0xdb, 0x48, 0xef,
2166 },
2167 32, "StartCom log" },
2168 { (const uint8_t[]){
2169 0x55, 0x81, 0xd4, 0xc2, 0x16, 0x90, 0x36, 0x01, 0x4a, 0xea, 0x0b,
2170 0x9b, 0x57, 0x3c, 0x53, 0xf0, 0xc0, 0xe4, 0x38, 0x78, 0x70, 0x25,
2171 0x08, 0x17, 0x2f, 0xa3, 0xaa, 0x1d, 0x07, 0x13, 0xd3, 0x0c,
2172 },
2173 32, "Sectigo 'Sabre' CT log" },
2174 { (const uint8_t[]){
2175 0xa2, 0xe2, 0xbf, 0xd6, 0x1e, 0xde, 0x2f, 0x2f, 0x07, 0xa0, 0xd6,
2176 0x4e, 0x6d, 0x37, 0xa7, 0xdc, 0x65, 0x43, 0xb0, 0xc6, 0xb5, 0x2e,
2177 0xa2, 0xda, 0xb7, 0x8a, 0xf8, 0x9a, 0x6d, 0xf5, 0x17, 0xd8,
2178 },
2179 32, "Sectigo 'Sabre2024h1'" },
2180 { (const uint8_t[]){
2181 0x19, 0x98, 0x10, 0x71, 0x09, 0xf0, 0xd6, 0x52, 0x2e, 0x30, 0x80,
2182 0xd2, 0x9e, 0x3f, 0x64, 0xbb, 0x83, 0x6e, 0x28, 0xcc, 0xf9, 0x0f,
2183 0x52, 0x8e, 0xee, 0xdf, 0xce, 0x4a, 0x3f, 0x16, 0xb4, 0xca,
2184 },
2185 32, "Sectigo 'Sabre2024h2'" },
2186 { (const uint8_t[]){
2187 0xe0, 0x92, 0xb3, 0xfc, 0x0c, 0x1d, 0xc8, 0xe7, 0x68, 0x36, 0x1f,
2188 0xde, 0x61, 0xb9, 0x96, 0x4d, 0x0a, 0x52, 0x78, 0x19, 0x8a, 0x72,
2189 0xd6, 0x72, 0xc4, 0xb0, 0x4d, 0xa5, 0x6d, 0x6f, 0x54, 0x04,
2190 },
2191 32, "Sectigo 'Sabre2025h1'" },
2192 { (const uint8_t[]){
2193 0x1a, 0x04, 0xff, 0x49, 0xd0, 0x54, 0x1d, 0x40, 0xaf, 0xf6, 0xa0,
2194 0xc3, 0xbf, 0xf1, 0xd8, 0xc4, 0x67, 0x2f, 0x4e, 0xec, 0xee, 0x23,
2195 0x40, 0x68, 0x98, 0x6b, 0x17, 0x40, 0x2e, 0xdc, 0x89, 0x7d,
2196 },
2197 32, "Sectigo 'Sabre2025h2'" },
2198 { (const uint8_t[]){
2199 0x6f, 0x53, 0x76, 0xac, 0x31, 0xf0, 0x31, 0x19, 0xd8, 0x99, 0x00,
2200 0xa4, 0x51, 0x15, 0xff, 0x77, 0x15, 0x1c, 0x11, 0xd9, 0x02, 0xc1,
2201 0x00, 0x29, 0x06, 0x8d, 0xb2, 0x08, 0x9a, 0x37, 0xd9, 0x13,
2202 },
2203 32, "Sectigo 'Mammoth' CT log" },
2204 { (const uint8_t[]){
2205 0x29, 0xd0, 0x3a, 0x1b, 0xb6, 0x74, 0xaa, 0x71, 0x1c, 0xd3, 0x03,
2206 0x5b, 0x65, 0x57, 0xc1, 0x4f, 0x8a, 0xa7, 0x8b, 0x4f, 0xe8, 0x38,
2207 0x94, 0x49, 0xec, 0xa4, 0x53, 0xf9, 0x44, 0xbd, 0x24, 0x68,
2208 },
2209 32, "Sectigo 'Mammoth2024h1'" },
2210 { (const uint8_t[]){
2211 0x50, 0x85, 0x01, 0x58, 0xdc, 0xb6, 0x05, 0x95, 0xc0, 0x0e, 0x92,
2212 0xa8, 0x11, 0x02, 0xec, 0xcd, 0xfe, 0x3f, 0x6b, 0x78, 0x58, 0x42,
2213 0x9f, 0x57, 0x98, 0x35, 0x38, 0xc9, 0xda, 0x52, 0x50, 0x63,
2214 },
2215 32, "Sectigo 'Mammoth2024h1b'" },
2216 { (const uint8_t[]){
2217 0xdf, 0xe1, 0x56, 0xeb, 0xaa, 0x05, 0xaf, 0xb5, 0x9c, 0x0f, 0x86,
2218 0x71, 0x8d, 0xa8, 0xc0, 0x32, 0x4e, 0xae, 0x56, 0xd9, 0x6e, 0xa7,
2219 0xf5, 0xa5, 0x6a, 0x01, 0xd1, 0xc1, 0x3b, 0xbe, 0x52, 0x5c,
2220 },
2221 32, "Sectigo 'Mammoth2024h2'" },
2222 { (const uint8_t[]){
2223 0x13, 0x4a, 0xdf, 0x1a, 0xb5, 0x98, 0x42, 0x09, 0x78, 0x0c, 0x6f,
2224 0xef, 0x4c, 0x7a, 0x91, 0xa4, 0x16, 0xb7, 0x23, 0x49, 0xce, 0x58,
2225 0x57, 0x6a, 0xdf, 0xae, 0xda, 0xa7, 0xc2, 0xab, 0xe0, 0x22,
2226 },
2227 32, "Sectigo 'Mammoth2025h1'" },
2228 { (const uint8_t[]){
2229 0xaf, 0x18, 0x1a, 0x28, 0xd6, 0x8c, 0xa3, 0xe0, 0xa9, 0x8a, 0x4c,
2230 0x9c, 0x67, 0xab, 0x09, 0xf8, 0xbb, 0xbc, 0x22, 0xba, 0xae, 0xbc,
2231 0xb1, 0x38, 0xa3, 0xa1, 0x9d, 0xd3, 0xf9, 0xb6, 0x03, 0x0d,
2232 },
2233 32, "Sectigo 'Mammoth2025h2'" },
2234 { (const uint8_t[]){
2235 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
2236 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
2237 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
2238 },
2239 32, "Sectigo 'Mammoth2026h1'" },
2240 { (const uint8_t[]){
2241 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
2242 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
2243 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
2244 },
2245 32, "Sectigo 'Mammoth2026h2'" },
2246 { (const uint8_t[]){
2247 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
2248 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
2249 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
2250 },
2251 32, "Sectigo 'Sabre2026h1'" },
2252 { (const uint8_t[]){
2253 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
2254 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
2255 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
2256 },
2257 32, "Sectigo 'Sabre2026h2'" },
2258 { (const uint8_t[]){
2259 0x0d, 0x1d, 0xbc, 0x89, 0x44, 0xe9, 0xf5, 0x00, 0x55, 0x42, 0xd7,
2260 0x2d, 0x3e, 0x14, 0x4c, 0xcc, 0x43, 0x08, 0x2a, 0xb6, 0xea, 0x1e,
2261 0x94, 0xdf, 0xd7, 0x06, 0x65, 0x7d, 0x2e, 0x86, 0xf3, 0x01,
2262 },
2263 32, "Sectigo 'Elephant2025h2'" },
2264 { (const uint8_t[]){
2265 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
2266 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
2267 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
2268 },
2269 32, "Sectigo 'Elephant2026h1'" },
2270 { (const uint8_t[]){
2271 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
2272 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
2273 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
2274 },
2275 32, "Sectigo 'Elephant2026h2'" },
2276 { (const uint8_t[]){
2277 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
2278 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
2279 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
2280 },
2281 32, "Sectigo 'Elephant2027h1'" },
2282 { (const uint8_t[]){
2283 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
2284 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
2285 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
2286 },
2287 32, "Sectigo 'Elephant2027h2'" },
2288 { (const uint8_t[]){
2289 0x5c, 0xa5, 0x77, 0xd2, 0x9b, 0x7f, 0x8b, 0xaf, 0x41, 0x9e, 0xd8,
2290 0xec, 0xab, 0xfb, 0x6d, 0xcb, 0xae, 0xc3, 0x85, 0x37, 0x02, 0xd5,
2291 0x74, 0x6f, 0x17, 0x4d, 0xad, 0x3c, 0x93, 0x4a, 0xa9, 0x6a,
2292 },
2293 32, "Sectigo 'Tiger2025h2'" },
2294 { (const uint8_t[]){
2295 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
2296 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
2297 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
2298 },
2299 32, "Sectigo 'Tiger2026h1'" },
2300 { (const uint8_t[]){
2301 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
2302 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
2303 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
2304 },
2305 32, "Sectigo 'Tiger2026h2'" },
2306 { (const uint8_t[]){
2307 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
2308 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
2309 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
2310 },
2311 32, "Sectigo 'Tiger2027h1'" },
2312 { (const uint8_t[]){
2313 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
2314 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
2315 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
2316 },
2317 32, "Sectigo 'Tiger2027h2'" },
2318 { (const uint8_t[]){
2319 0xdb, 0x76, 0xfd, 0xad, 0xac, 0x65, 0xe7, 0xd0, 0x95, 0x08, 0x88,
2320 0x6e, 0x21, 0x59, 0xbd, 0x8b, 0x90, 0x35, 0x2f, 0x5f, 0xea, 0xd3,
2321 0xe3, 0xdc, 0x5e, 0x22, 0xeb, 0x35, 0x0a, 0xcc, 0x7b, 0x98,
2322 },
2323 32, "Sectigo 'Dodo' CT log" },
2324 { (const uint8_t[]){
2325 0xe7, 0x12, 0xf2, 0xb0, 0x37, 0x7e, 0x1a, 0x62, 0xfb, 0x8e, 0xc9,
2326 0x0c, 0x61, 0x84, 0xf1, 0xea, 0x7b, 0x37, 0xcb, 0x56, 0x1d, 0x11,
2327 0x26, 0x5b, 0xf3, 0xe0, 0xf3, 0x4b, 0xf2, 0x41, 0x54, 0x6e,
2328 },
2329 32, "Let's Encrypt 'Oak2020' log" },
2330 { (const uint8_t[]){
2331 0x94, 0x20, 0xbc, 0x1e, 0x8e, 0xd5, 0x8d, 0x6c, 0x88, 0x73, 0x1f,
2332 0x82, 0x8b, 0x22, 0x2c, 0x0d, 0xd1, 0xda, 0x4d, 0x5e, 0x6c, 0x4f,
2333 0x94, 0x3d, 0x61, 0xdb, 0x4e, 0x2f, 0x58, 0x4d, 0xa2, 0xc2,
2334 },
2335 32, "Let's Encrypt 'Oak2021' log" },
2336 { (const uint8_t[]){
2337 0xdf, 0xa5, 0x5e, 0xab, 0x68, 0x82, 0x4f, 0x1f, 0x6c, 0xad, 0xee,
2338 0xb8, 0x5f, 0x4e, 0x3e, 0x5a, 0xea, 0xcd, 0xa2, 0x12, 0xa4, 0x6a,
2339 0x5e, 0x8e, 0x3b, 0x12, 0xc0, 0x20, 0x44, 0x5c, 0x2a, 0x73,
2340 },
2341 32, "Let's Encrypt 'Oak2022' log" },
2342 { (const uint8_t[]){
2343 0xb7, 0x3e, 0xfb, 0x24, 0xdf, 0x9c, 0x4d, 0xba, 0x75, 0xf2, 0x39,
2344 0xc5, 0xba, 0x58, 0xf4, 0x6c, 0x5d, 0xfc, 0x42, 0xcf, 0x7a, 0x9f,
2345 0x35, 0xc4, 0x9e, 0x1d, 0x09, 0x81, 0x25, 0xed, 0xb4, 0x99,
2346 },
2347 32, "Let's Encrypt 'Oak2023' log" },
2348 { (const uint8_t[]){
2349 0x3b, 0x53, 0x77, 0x75, 0x3e, 0x2d, 0xb9, 0x80, 0x4e, 0x8b, 0x30,
2350 0x5b, 0x06, 0xfe, 0x40, 0x3b, 0x67, 0xd8, 0x4f, 0xc3, 0xf4, 0xc7,
2351 0xbd, 0x00, 0x0d, 0x2d, 0x72, 0x6f, 0xe1, 0xfa, 0xd4, 0x17,
2352 },
2353 32, "Let's Encrypt 'Oak2024H1' log" },
2354 { (const uint8_t[]){
2355 0x3f, 0x17, 0x4b, 0x4f, 0xd7, 0x22, 0x47, 0x58, 0x94, 0x1d, 0x65,
2356 0x1c, 0x84, 0xbe, 0x0d, 0x12, 0xed, 0x90, 0x37, 0x7f, 0x1f, 0x85,
2357 0x6a, 0xeb, 0xc1, 0xbf, 0x28, 0x85, 0xec, 0xf8, 0x64, 0x6e,
2358 },
2359 32, "Let's Encrypt 'Oak2024H2' log" },
2360 { (const uint8_t[]){
2361 0xa2, 0xe3, 0x0a, 0xe4, 0x45, 0xef, 0xbd, 0xad, 0x9b, 0x7e, 0x38,
2362 0xed, 0x47, 0x67, 0x77, 0x53, 0xd7, 0x82, 0x5b, 0x84, 0x94, 0xd7,
2363 0x2b, 0x5e, 0x1b, 0x2c, 0xc4, 0xb9, 0x50, 0xa4, 0x47, 0xe7,
2364 },
2365 32, "Let's Encrypt 'Oak2025h1'" },
2366 { (const uint8_t[]){
2367 0x0d, 0xe1, 0xf2, 0x30, 0x2b, 0xd3, 0x0d, 0xc1, 0x40, 0x62, 0x12,
2368 0x09, 0xea, 0x55, 0x2e, 0xfc, 0x47, 0x74, 0x7c, 0xb1, 0xd7, 0xe9,
2369 0x30, 0xef, 0x0e, 0x42, 0x1e, 0xb4, 0x7e, 0x4e, 0xaa, 0x34,
2370 },
2371 32, "Let's Encrypt 'Oak2025h2'" },
2372 { (const uint8_t[]){
2373 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
2374 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
2375 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
2376 },
2377 32, "Let's Encrypt 'Oak2026h1'" },
2378 { (const uint8_t[]){
2379 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
2380 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
2381 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
2382 },
2383 32, "Let's Encrypt 'Oak2026h2'" },
2384 { (const uint8_t[]){
2385 0x65, 0x9b, 0x33, 0x50, 0xf4, 0x3b, 0x12, 0xcc, 0x5e, 0xa5, 0xab,
2386 0x4e, 0xc7, 0x65, 0xd3, 0xfd, 0xe6, 0xc8, 0x82, 0x43, 0x77, 0x77,
2387 0x78, 0xe7, 0x20, 0x03, 0xf9, 0xeb, 0x2b, 0x8c, 0x31, 0x29,
2388 },
2389 32, "Let's Encrypt 'Oak2019' log" },
2390 { (const uint8_t[]){
2391 0x84, 0x9f, 0x5f, 0x7f, 0x58, 0xd2, 0xbf, 0x7b, 0x54, 0xec, 0xbd,
2392 0x74, 0x61, 0x1c, 0xea, 0x45, 0xc4, 0x9c, 0x98, 0xf1, 0xd6, 0x48,
2393 0x1b, 0xc6, 0xf6, 0x9e, 0x8c, 0x17, 0x4f, 0x24, 0xf3, 0xcf,
2394 },
2395 32, "Let's Encrypt 'Testflume2019' log" },
2396 { (const uint8_t[]){
2397 0x23, 0x2d, 0x41, 0xa4, 0xcd, 0xac, 0x87, 0xce, 0xd9, 0xf9, 0x43,
2398 0xf4, 0x68, 0xc2, 0x82, 0x09, 0x5a, 0xe0, 0x9d, 0x30, 0xd6, 0x2e,
2399 0x2f, 0xa6, 0x5d, 0xdc, 0x3b, 0x91, 0x9c, 0x2e, 0x46, 0x8f,
2400 },
2401 32, "Let's Encrypt 'Sapling 2022h2' log" },
2402 { (const uint8_t[]){
2403 0xc1, 0x83, 0x24, 0x0b, 0xf1, 0xa4, 0x50, 0xc7, 0x6f, 0xbb, 0x00,
2404 0x72, 0x69, 0xdc, 0xac, 0x3b, 0xe2, 0x2a, 0x48, 0x05, 0xd4, 0xdb,
2405 0xe0, 0x49, 0x66, 0xc3, 0xc8, 0xab, 0xc4, 0x47, 0xb0, 0x0c,
2406 },
2407 32, "Let's Encrypt 'Sapling 2023h1' log" },
2408 { (const uint8_t[]){
2409 0xc6, 0x3f, 0x22, 0x18, 0xc3, 0x7d, 0x56, 0xa6, 0xaa, 0x06, 0xb5,
2410 0x96, 0xda, 0x8e, 0x53, 0xd4, 0xd7, 0x15, 0x6d, 0x1e, 0x9b, 0xac,
2411 0x8e, 0x44, 0xd2, 0x20, 0x2d, 0xe6, 0x4d, 0x69, 0xd9, 0xdc,
2412 },
2413 32, "Let's Encrypt 'Testflume2020' log" },
2414 { (const uint8_t[]){
2415 0x03, 0xed, 0xf1, 0xda, 0x97, 0x76, 0xb6, 0xf3, 0x8c, 0x34, 0x1e,
2416 0x39, 0xed, 0x9d, 0x70, 0x7a, 0x75, 0x70, 0x36, 0x9c, 0xf9, 0x84,
2417 0x4f, 0x32, 0x7f, 0xe9, 0xe1, 0x41, 0x38, 0x36, 0x1b, 0x60,
2418 },
2419 32, "Let's Encrypt 'Testflume2021' log" },
2420 { (const uint8_t[]){
2421 0x23, 0x27, 0xef, 0xda, 0x35, 0x25, 0x10, 0xdb, 0xc0, 0x19, 0xef,
2422 0x49, 0x1a, 0xe3, 0xff, 0x1c, 0xc5, 0xa4, 0x79, 0xbc, 0xe3, 0x78,
2423 0x78, 0x36, 0x0e, 0xe3, 0x18, 0xcf, 0xfb, 0x64, 0xf8, 0xc8,
2424 },
2425 32, "Let's Encrypt 'Testflume2022' log" },
2426 { (const uint8_t[]){
2427 0x55, 0x34, 0xb7, 0xab, 0x5a, 0x6a, 0xc3, 0xa7, 0xcb, 0xeb, 0xa6,
2428 0x54, 0x87, 0xb2, 0xa2, 0xd7, 0x1b, 0x48, 0xf6, 0x50, 0xfa, 0x17,
2429 0xc5, 0x19, 0x7c, 0x97, 0xa0, 0xcb, 0x20, 0x76, 0xf3, 0xc6,
2430 },
2431 32, "Let's Encrypt 'Testflume2023' log" },
2432 { (const uint8_t[]){
2433 0x29, 0x6a, 0xfa, 0x2d, 0x56, 0x8b, 0xca, 0x0d, 0x2e, 0xa8, 0x44,
2434 0x95, 0x6a, 0xe9, 0x72, 0x1f, 0xc3, 0x5f, 0xa3, 0x55, 0xec, 0xda,
2435 0x99, 0x69, 0x3a, 0xaf, 0xd4, 0x58, 0xa7, 0x1a, 0xef, 0xdd,
2436 },
2437 32, "Let's Encrypt 'Clicky' log" },
2438 { (const uint8_t[]){
2439 0xa5, 0x95, 0x94, 0x3b, 0x53, 0x70, 0xbe, 0xe9, 0x06, 0xe0, 0x05,
2440 0x0d, 0x1f, 0xb5, 0xbb, 0xc6, 0xa4, 0x0e, 0x65, 0xf2, 0x65, 0xae,
2441 0x85, 0x2c, 0x76, 0x36, 0x3f, 0xad, 0xb2, 0x33, 0x36, 0xed,
2442 },
2443 32, "Trust Asia Log2020" },
2444 { (const uint8_t[]){
2445 0xa8, 0xdc, 0x52, 0xf6, 0x3d, 0x6b, 0x24, 0x25, 0xe5, 0x31, 0xe3,
2446 0x7c, 0xf4, 0xe4, 0x4a, 0x71, 0x4f, 0x14, 0x2a, 0x20, 0x80, 0x3b,
2447 0x0d, 0x04, 0xd2, 0xe2, 0xee, 0x06, 0x64, 0x79, 0x4a, 0x23,
2448 },
2449 32, "Trust Asia CT2021" },
2450 { (const uint8_t[]){
2451 0x67, 0x8d, 0xb6, 0x5b, 0x3e, 0x74, 0x43, 0xb6, 0xf3, 0xa3, 0x70,
2452 0xd5, 0xe1, 0x3a, 0xb1, 0xb4, 0x3b, 0xe0, 0xa0, 0xd3, 0x51, 0xf7,
2453 0xca, 0x74, 0x22, 0x50, 0xc7, 0xc6, 0xfa, 0x51, 0xa8, 0x8a,
2454 },
2455 32, "Trust Asia Log2021" },
2456 { (const uint8_t[]){
2457 0xc3, 0x65, 0xf9, 0xb3, 0x65, 0x4f, 0x32, 0x83, 0xc7, 0x9d, 0xa9,
2458 0x8e, 0x93, 0xd7, 0x41, 0x8f, 0x5b, 0xab, 0x7b, 0xe3, 0x25, 0x2c,
2459 0x98, 0xe1, 0xd2, 0xf0, 0x4b, 0xb9, 0xeb, 0x42, 0x7d, 0x23,
2460 },
2461 32, "Trust Asia Log2022" },
2462 { (const uint8_t[]){
2463 0xe8, 0x7e, 0xa7, 0x66, 0x0b, 0xc2, 0x6c, 0xf6, 0x00, 0x2e, 0xf5,
2464 0x72, 0x5d, 0x3f, 0xe0, 0xe3, 0x31, 0xb9, 0x39, 0x3b, 0xb9, 0x2f,
2465 0xbf, 0x58, 0xeb, 0x3b, 0x90, 0x49, 0xda, 0xf5, 0x43, 0x5a,
2466 },
2467 32, "Trust Asia Log2023" },
2468 { (const uint8_t[]){
2469 0x30, 0x6d, 0x29, 0x57, 0x6a, 0xd2, 0x1a, 0x9d, 0x4a, 0xe1, 0x2a,
2470 0xca, 0xd8, 0xaa, 0x8a, 0x78, 0x3a, 0xa6, 0x5a, 0x32, 0x11, 0x60,
2471 0xac, 0xff, 0x5b, 0x0e, 0xee, 0x4c, 0xa3, 0x20, 0x1d, 0x05,
2472 },
2473 32, "Trust Asia Log2024" },
2474 { (const uint8_t[]){
2475 0x87, 0x4f, 0xb5, 0x0d, 0xc0, 0x29, 0xd9, 0x93, 0x1d, 0xe5, 0x73,
2476 0xe9, 0xf2, 0x89, 0x9e, 0x8e, 0x45, 0x33, 0xb3, 0x92, 0xd3, 0x8b,
2477 0x0a, 0x46, 0x25, 0x74, 0xbf, 0x0f, 0xee, 0xb2, 0xfc, 0x1e,
2478 },
2479 32, "Trust Asia Log2024-2" },
2480 { (const uint8_t[]){
2481 0x28, 0xe2, 0x81, 0x38, 0xfd, 0x83, 0x21, 0x45, 0xe9, 0xa9, 0xd6,
2482 0xaa, 0x75, 0x37, 0x6d, 0x83, 0x77, 0xa8, 0x85, 0x12, 0xb3, 0xc0,
2483 0x7f, 0x72, 0x41, 0x48, 0x21, 0xdc, 0xbd, 0xe9, 0x8c, 0x66,
2484 },
2485 32, "TrustAsia Log2025a" },
2486 { (const uint8_t[]){
2487 0x28, 0x2c, 0x8b, 0xdd, 0x81, 0x0f, 0xf9, 0x09, 0x12, 0x0a, 0xce,
2488 0x16, 0xd6, 0xe0, 0xec, 0x20, 0x1b, 0xea, 0x82, 0xa3, 0xa4, 0xaf,
2489 0x19, 0xd9, 0xef, 0xfb, 0x59, 0xe8, 0x3f, 0xdc, 0x42, 0x68,
2490 },
2491 32, "TrustAsia Log2025b" },
2492 { (const uint8_t[]){
2493 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
2494 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
2495 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
2496 },
2497 32, "TrustAsia 'log2026a'" },
2498 { (const uint8_t[]){
2499 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
2500 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
2501 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
2502 },
2503 32, "TrustAsia 'log2026b'" },
2504 { (const uint8_t[]){
2505 0x45, 0x35, 0x94, 0x98, 0xd9, 0x3a, 0x89, 0xe0, 0x28, 0x03, 0x08,
2506 0xd3, 0x7d, 0x62, 0x6d, 0xc4, 0x23, 0x75, 0x47, 0x58, 0xdc, 0xe0,
2507 0x37, 0x00, 0x36, 0xfb, 0xab, 0x0e, 0xdf, 0x8a, 0x6b, 0xcf,
2508 },
2509 32, "Trust Asia Log1" },
2510 { (const uint8_t[]){
2511 0xc9, 0xcf, 0x89, 0x0a, 0x21, 0x10, 0x9c, 0x66, 0x6c, 0xc1, 0x7a,
2512 0x3e, 0xd0, 0x65, 0xc9, 0x30, 0xd0, 0xe0, 0x13, 0x5a, 0x9f, 0xeb,
2513 0xa8, 0x5a, 0xf1, 0x42, 0x10, 0xb8, 0x07, 0x24, 0x21, 0xaa,
2514 },
2515 32, "GDCA CT log #1" },
2516 { (const uint8_t[]){
2517 0x92, 0x4a, 0x30, 0xf9, 0x09, 0x33, 0x6f, 0xf4, 0x35, 0xd6, 0x99,
2518 0x3a, 0x10, 0xac, 0x75, 0xa2, 0xc6, 0x41, 0x72, 0x8e, 0x7f, 0xc2,
2519 0xd6, 0x59, 0xae, 0x61, 0x88, 0xff, 0xad, 0x40, 0xce, 0x01,
2520 },
2521 32, "GDCA CT log #2" },
2522 { (const uint8_t[]){
2523 0x71, 0x7e, 0xa7, 0x42, 0x09, 0x75, 0xbe, 0x84, 0xa2, 0x72, 0x35,
2524 0x53, 0xf1, 0x77, 0x7c, 0x26, 0xdd, 0x51, 0xaf, 0x4e, 0x10, 0x21,
2525 0x44, 0x09, 0x4d, 0x90, 0x19, 0xb4, 0x62, 0xfb, 0x66, 0x68,
2526 },
2527 32, "GDCA Log 1" },
2528 { (const uint8_t[]){
2529 0x14, 0x30, 0x8d, 0x90, 0xcc, 0xd0, 0x30, 0x13, 0x50, 0x05, 0xc0,
2530 0x1c, 0xa5, 0x26, 0xd8, 0x1e, 0x84, 0xe8, 0x76, 0x24, 0xe3, 0x9b,
2531 0x62, 0x48, 0xe0, 0x8f, 0x72, 0x4a, 0xea, 0x3b, 0xb4, 0x2a,
2532 },
2533 32, "GDCA Log 2" },
2534 { (const uint8_t[]){
2535 0xe0, 0x12, 0x76, 0x29, 0xe9, 0x04, 0x96, 0x56, 0x4e, 0x3d, 0x01,
2536 0x47, 0x98, 0x44, 0x98, 0xaa, 0x48, 0xf8, 0xad, 0xb1, 0x66, 0x00,
2537 0xeb, 0x79, 0x02, 0xa1, 0xef, 0x99, 0x09, 0x90, 0x62, 0x73,
2538 },
2539 32, "PuChuangSiDa CT log" },
2540 { (const uint8_t[]){
2541 0x53, 0x7b, 0x69, 0xa3, 0x56, 0x43, 0x35, 0xa9, 0xc0, 0x49, 0x04,
2542 0xe3, 0x95, 0x93, 0xb2, 0xc2, 0x98, 0xeb, 0x8d, 0x7a, 0x6e, 0x83,
2543 0x02, 0x36, 0x35, 0xc6, 0x27, 0x24, 0x8c, 0xd6, 0xb4, 0x40,
2544 },
2545 32, "Nordu 'flimsy' log" },
2546 { (const uint8_t[]){
2547 0xaa, 0xe7, 0x0b, 0x7f, 0x3c, 0xb8, 0xd5, 0x66, 0xc8, 0x6c, 0x2f,
2548 0x16, 0x97, 0x9c, 0x9f, 0x44, 0x5f, 0x69, 0xab, 0x0e, 0xb4, 0x53,
2549 0x55, 0x89, 0xb2, 0xf7, 0x7a, 0x03, 0x01, 0x04, 0xf3, 0xcd,
2550 },
2551 32, "Nordu 'plausible' log" },
2552 { (const uint8_t[]){
2553 0xcf, 0x55, 0xe2, 0x89, 0x23, 0x49, 0x7c, 0x34, 0x0d, 0x52, 0x06,
2554 0xd0, 0x53, 0x53, 0xae, 0xb2, 0x58, 0x34, 0xb5, 0x2f, 0x1f, 0x8d,
2555 0xc9, 0x52, 0x68, 0x09, 0xf2, 0x12, 0xef, 0xdd, 0x7c, 0xa6,
2556 },
2557 32, "SHECA CT log 1" },
2558 { (const uint8_t[]){
2559 0x32, 0xdc, 0x59, 0xc2, 0xd4, 0xc4, 0x19, 0x68, 0xd5, 0x6e, 0x14,
2560 0xbc, 0x61, 0xac, 0x8f, 0x0e, 0x45, 0xdb, 0x39, 0xfa, 0xf3, 0xc1,
2561 0x55, 0xaa, 0x42, 0x52, 0xf5, 0x00, 0x1f, 0xa0, 0xc6, 0x23,
2562 },
2563 32, "SHECA CT log 2" },
2564 { (const uint8_t[]){
2565 0x96, 0x06, 0xc0, 0x2c, 0x69, 0x00, 0x33, 0xaa, 0x1d, 0x14, 0x5f,
2566 0x59, 0xc6, 0xe2, 0x64, 0x8d, 0x05, 0x49, 0xf0, 0xdf, 0x96, 0xaa,
2567 0xb8, 0xdb, 0x91, 0x5a, 0x70, 0xd8, 0xec, 0xf3, 0x90, 0xa5,
2568 },
2569 32, "Akamai CT Log" },
2570 { (const uint8_t[]){
2571 0x39, 0x37, 0x6f, 0x54, 0x5f, 0x7b, 0x46, 0x07, 0xf5, 0x97, 0x42,
2572 0xd7, 0x68, 0xcd, 0x5d, 0x24, 0x37, 0xbf, 0x34, 0x73, 0xb6, 0x53,
2573 0x4a, 0x48, 0x34, 0xbc, 0xf7, 0x2e, 0x68, 0x1c, 0x83, 0xc9,
2574 },
2575 32, "Alpha CT Log" },
2576 { (const uint8_t[]){
2577 0xb0, 0xb7, 0x84, 0xbc, 0x81, 0xc0, 0xdd, 0xc4, 0x75, 0x44, 0xe8,
2578 0x83, 0xf0, 0x59, 0x85, 0xbb, 0x90, 0x77, 0xd1, 0x34, 0xd8, 0xab,
2579 0x88, 0xb2, 0xb2, 0xe5, 0x33, 0x98, 0x0b, 0x8e, 0x50, 0x8b,
2580 },
2581 32, "Up In The Air 'Behind the Sofa' log" },
2582 { (const uint8_t[]){
2583 0x47, 0x44, 0x47, 0x7c, 0x75, 0xde, 0x42, 0x6d, 0x5c, 0x44, 0xef,
2584 0xd4, 0xa9, 0x2c, 0x96, 0x77, 0x59, 0x7f, 0x65, 0x7a, 0x8f, 0xe0,
2585 0xca, 0xdb, 0xc6, 0xd6, 0x16, 0xed, 0xa4, 0x97, 0xc4, 0x25,
2586 },
2587 32, "Qihoo 360 2020" },
2588 { (const uint8_t[]){
2589 0xc6, 0xd7, 0xed, 0x9e, 0xdb, 0x8e, 0x74, 0xf0, 0xa7, 0x1b, 0x4d,
2590 0x4a, 0x98, 0x4b, 0xcb, 0xeb, 0xab, 0xbd, 0x28, 0xcc, 0x1f, 0xd7,
2591 0x63, 0x29, 0xe8, 0x87, 0x26, 0xcd, 0x4c, 0x25, 0x46, 0x63,
2592 },
2593 32, "Qihoo 360 2021" },
2594 { (const uint8_t[]){
2595 0x66, 0x3c, 0xb0, 0x9c, 0x1f, 0xcd, 0x9b, 0xaa, 0x62, 0x76, 0x3c,
2596 0xcb, 0x53, 0x4e, 0xec, 0x80, 0x58, 0x12, 0x28, 0x05, 0x07, 0xac,
2597 0x69, 0xa4, 0x5f, 0xcd, 0x38, 0xcf, 0x4c, 0xc7, 0x4c, 0xf1,
2598 },
2599 32, "Qihoo 360 2022" },
2600 { (const uint8_t[]){
2601 0xe2, 0x64, 0x7f, 0x6e, 0xda, 0x34, 0x05, 0x03, 0xc6, 0x4d, 0x4e,
2602 0x10, 0xa8, 0x69, 0x68, 0x1f, 0xde, 0x9c, 0x5a, 0x2c, 0xf3, 0xb3,
2603 0x2d, 0x5f, 0x20, 0x0b, 0x96, 0x36, 0x05, 0x90, 0x88, 0x23,
2604 },
2605 32, "Qihoo 360 2023" },
2606 { (const uint8_t[]){
2607 0xc5, 0xcf, 0xe5, 0x4b, 0x61, 0x51, 0xb4, 0x9b, 0x14, 0x2e, 0xd2,
2608 0x63, 0xbd, 0xe7, 0x32, 0x93, 0x36, 0x37, 0x99, 0x79, 0x95, 0x50,
2609 0xae, 0x44, 0x35, 0xcd, 0x1a, 0x69, 0x97, 0xc9, 0xc3, 0xc3,
2610 },
2611 32, "Qihoo 360 v1 2020" },
2612 { (const uint8_t[]){
2613 0x48, 0x14, 0x58, 0x7c, 0xf2, 0x8b, 0x08, 0xfe, 0x68, 0x3f, 0xd2,
2614 0xbc, 0xd9, 0x45, 0x99, 0x4c, 0x2e, 0xb7, 0x4c, 0x8a, 0xe8, 0xc8,
2615 0x7f, 0xce, 0x42, 0x9b, 0x7c, 0xd3, 0x1d, 0x51, 0xbd, 0xc4,
2616 },
2617 32, "Qihoo 360 v1 2021" },
2618 { (const uint8_t[]){
2619 0x49, 0x11, 0xb8, 0xd6, 0x14, 0xcf, 0xd3, 0xd9, 0x9f, 0x16, 0xd3,
2620 0x76, 0x54, 0x5e, 0xe1, 0xb8, 0xcc, 0xfc, 0x51, 0x1f, 0x50, 0x9f,
2621 0x08, 0x0b, 0xa0, 0xa0, 0x87, 0xd9, 0x1d, 0xfa, 0xee, 0xa9,
2622 },
2623 32, "Qihoo 360 v1 2022" },
2624 { (const uint8_t[]){
2625 0xb6, 0x74, 0x0b, 0x12, 0x00, 0x2e, 0x03, 0x3f, 0xd0, 0xe7, 0xe9,
2626 0x41, 0xf4, 0xba, 0x3e, 0xe1, 0xbf, 0xc1, 0x49, 0xb5, 0x24, 0xb4,
2627 0xcf, 0x62, 0x8d, 0x53, 0xef, 0xea, 0x1f, 0x40, 0x3a, 0x8d,
2628 },
2629 32, "Qihoo 360 v1 2023" },
2630 { NULL((void*)0), 0, NULL((void*)0) }
2631};
2632
2633/*
2634 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
2635 */
2636static dissector_table_t ssl_alpn_dissector_table;
2637static dissector_table_t dtls_alpn_dissector_table;
2638
2639/*
2640 * Special cases for prefix matching of the ALPN, if the ALPN includes
2641 * a version number for a draft or protocol revision.
2642 */
2643typedef struct ssl_alpn_prefix_match_protocol {
2644 const char *proto_prefix;
2645 const char *dissector_name;
2646} ssl_alpn_prefix_match_protocol_t;
2647
2648static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
2649 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
2650 * already exists 3.1 as of this writing... match the prefix. */
2651 { "spdy/", "spdy" },
2652 /* draft-ietf-httpbis-http2-16 */
2653 { "h2-", "http2" }, /* draft versions */
2654};
2655
2656const value_string compress_certificate_algorithm_vals[] = {
2657 { 1, "zlib" },
2658 { 2, "brotli" },
2659 { 3, "zstd" },
2660 { 0, NULL((void*)0) }
2661};
2662
2663
2664const val64_string quic_transport_parameter_id[] = {
2665 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
2666 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
2667 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
2668 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
2669 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
2670 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
2671 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
2672 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
2673 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
2674 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
2675 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
2676 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
2677 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
2678 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
2679 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
2680 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
2681 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
2682 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
2683 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
2684 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
2685 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
2686 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
2687 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
2688 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
2689 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
2690 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
2691 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
2692 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
2693 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
2694 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
2695 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
2696 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
2697 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
2698 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
2699 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
2700 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
2701 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
2702 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
2703 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
2704 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
2705 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
2706 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
2707 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
2708 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d, "initial_max_path_id" },
2709 { 0, NULL((void*)0) }
2710};
2711
2712/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
2713const val64_string quic_enable_time_stamp_v2_vals[] = {
2714 { 1, "I would like to receive TIME_STAMP frames" },
2715 { 2, "I am able to generate TIME_STAMP frames" },
2716 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
2717 { 0, NULL((void*)0) }
2718};
2719
2720/* https://tools.ietf.org/html/draft-multipath-04 */
2721const val64_string quic_enable_multipath_vals[] = {
2722 { 0, "don't support multipath" },
2723 { 1, "support multipath as defined in this document" },
2724 { 0, NULL((void*)0) }
2725};
2726
2727/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2728const value_string tls_hello_ext_ech_clienthello_types[] = {
2729 { 0, "Outer Client Hello" },
2730 { 1, "Inner Client Hello" },
2731 { 0, NULL((void*)0) }
2732};
2733
2734/* RFC 9180 */
2735const value_string kem_id_type_vals[] = {
2736 { 0x0000, "Reserved" },
2737 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2738 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2739 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2740 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2741 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2742 { 0, NULL((void*)0) }
2743};
2744const value_string kdf_id_type_vals[] = {
2745 { 0x0000, "Reserved" },
2746 { 0x0001, "HKDF-SHA256" },
2747 { 0x0002, "HKDF-SHA384" },
2748 { 0x0003, "HKDF-SHA512" },
2749 { 0, NULL((void*)0) }
2750};
2751const value_string aead_id_type_vals[] = {
2752 { 0x0000, "Reserved" },
2753 { 0x0001, "AES-128-GCM" },
2754 { 0x0002, "AES-256-GCM" },
2755 { 0x0003, "ChaCha20Poly1305" },
2756 { 0xFFFF, "Export-only" },
2757 { 0, NULL((void*)0) }
2758};
2759
2760const value_string token_binding_key_parameter_vals[] = {
2761 { 0, "rsa2048_pkcs1.5" },
2762 { 1, "rsa2048_pss" },
2763 { 2, "ecdsap256" },
2764 { 0, NULL((void*)0) }
2765};
2766
2767/* Lookup tables }}} */
2768
2769void
2770quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2771{
2772 const char *label;
2773 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)
) {
2774 label = "GREASE";
2775 } else {
2776 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2777 }
2778 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2779}
2780
2781/* we keep this internal to packet-tls-utils, as there should be
2782 no need to access it any other way.
2783
2784 This also allows us to hide the dependency on zlib.
2785*/
2786struct _SslDecompress {
2787 int compression;
2788#ifdef USE_ZLIB_OR_ZLIBNG
2789 zlib_stream istream;
2790#endif
2791};
2792
2793/* To assist in parsing client/server key exchange messages
2794 0 indicates unknown */
2795int ssl_get_keyex_alg(int cipher)
2796{
2797 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2798 switch(cipher) {
2799 case 0x0017:
2800 case 0x0018:
2801 case 0x0019:
2802 case 0x001a:
2803 case 0x001b:
2804 case 0x0034:
2805 case 0x003a:
2806 case 0x0046:
2807 case 0x006c:
2808 case 0x006d:
2809 case 0x0089:
2810 case 0x009b:
2811 case 0x00a6:
2812 case 0x00a7:
2813 case 0x00bf:
2814 case 0x00c5:
2815 case 0xc084:
2816 case 0xc085:
2817 return KEX_DH_ANON0x13;
2818 case 0x000b:
2819 case 0x000c:
2820 case 0x000d:
2821 case 0x0030:
2822 case 0x0036:
2823 case 0x003e:
2824 case 0x0042:
2825 case 0x0068:
2826 case 0x0085:
2827 case 0x0097:
2828 case 0x00a4:
2829 case 0x00a5:
2830 case 0x00bb:
2831 case 0x00c1:
2832 case 0xc082:
2833 case 0xc083:
2834 return KEX_DH_DSS0x14;
2835 case 0x000e:
2836 case 0x000f:
2837 case 0x0010:
2838 case 0x0031:
2839 case 0x0037:
2840 case 0x003f:
2841 case 0x0043:
2842 case 0x0069:
2843 case 0x0086:
2844 case 0x0098:
2845 case 0x00a0:
2846 case 0x00a1:
2847 case 0x00bc:
2848 case 0x00c2:
2849 case 0xc07e:
2850 case 0xc07f:
2851 return KEX_DH_RSA0x15;
2852 case 0x0011:
2853 case 0x0012:
2854 case 0x0013:
2855 case 0x0032:
2856 case 0x0038:
2857 case 0x0040:
2858 case 0x0044:
2859 case 0x0063:
2860 case 0x0065:
2861 case 0x0066:
2862 case 0x006a:
2863 case 0x0087:
2864 case 0x0099:
2865 case 0x00a2:
2866 case 0x00a3:
2867 case 0x00bd:
2868 case 0x00c3:
2869 case 0xc080:
2870 case 0xc081:
2871 return KEX_DHE_DSS0x10;
2872 case 0x002d:
2873 case 0x008e:
2874 case 0x008f:
2875 case 0x0090:
2876 case 0x0091:
2877 case 0x00aa:
2878 case 0x00ab:
2879 case 0x00b2:
2880 case 0x00b3:
2881 case 0x00b4:
2882 case 0x00b5:
2883 case 0xc090:
2884 case 0xc091:
2885 case 0xc096:
2886 case 0xc097:
2887 case 0xc0a6:
2888 case 0xc0a7:
2889 case 0xc0aa:
2890 case 0xc0ab:
2891 case 0xccad:
2892 case 0xe41c:
2893 case 0xe41d:
2894 return KEX_DHE_PSK0x11;
2895 case 0x0014:
2896 case 0x0015:
2897 case 0x0016:
2898 case 0x0033:
2899 case 0x0039:
2900 case 0x0045:
2901 case 0x0067:
2902 case 0x006b:
2903 case 0x0088:
2904 case 0x009a:
2905 case 0x009e:
2906 case 0x009f:
2907 case 0x00be:
2908 case 0x00c4:
2909 case 0xc07c:
2910 case 0xc07d:
2911 case 0xc09e:
2912 case 0xc09f:
2913 case 0xc0a2:
2914 case 0xc0a3:
2915 case 0xccaa:
2916 case 0xe41e:
2917 case 0xe41f:
2918 return KEX_DHE_RSA0x12;
2919 case 0xc015:
2920 case 0xc016:
2921 case 0xc017:
2922 case 0xc018:
2923 case 0xc019:
2924 return KEX_ECDH_ANON0x19;
2925 case 0xc001:
2926 case 0xc002:
2927 case 0xc003:
2928 case 0xc004:
2929 case 0xc005:
2930 case 0xc025:
2931 case 0xc026:
2932 case 0xc02d:
2933 case 0xc02e:
2934 case 0xc074:
2935 case 0xc075:
2936 case 0xc088:
2937 case 0xc089:
2938 return KEX_ECDH_ECDSA0x1a;
2939 case 0xc00b:
2940 case 0xc00c:
2941 case 0xc00d:
2942 case 0xc00e:
2943 case 0xc00f:
2944 case 0xc029:
2945 case 0xc02a:
2946 case 0xc031:
2947 case 0xc032:
2948 case 0xc078:
2949 case 0xc079:
2950 case 0xc08c:
2951 case 0xc08d:
2952 return KEX_ECDH_RSA0x1b;
2953 case 0xc006:
2954 case 0xc007:
2955 case 0xc008:
2956 case 0xc009:
2957 case 0xc00a:
2958 case 0xc023:
2959 case 0xc024:
2960 case 0xc02b:
2961 case 0xc02c:
2962 case 0xc072:
2963 case 0xc073:
2964 case 0xc086:
2965 case 0xc087:
2966 case 0xc0ac:
2967 case 0xc0ad:
2968 case 0xc0ae:
2969 case 0xc0af:
2970 case 0xcca9:
2971 case 0xe414:
2972 case 0xe415:
2973 return KEX_ECDHE_ECDSA0x16;
2974 case 0xc033:
2975 case 0xc034:
2976 case 0xc035:
2977 case 0xc036:
2978 case 0xc037:
2979 case 0xc038:
2980 case 0xc039:
2981 case 0xc03a:
2982 case 0xc03b:
2983 case 0xc09a:
2984 case 0xc09b:
2985 case 0xccac:
2986 case 0xe418:
2987 case 0xe419:
2988 case 0xd001:
2989 case 0xd002:
2990 case 0xd003:
2991 case 0xd005:
2992 return KEX_ECDHE_PSK0x17;
2993 case 0xc010:
2994 case 0xc011:
2995 case 0xc012:
2996 case 0xc013:
2997 case 0xc014:
2998 case 0xc027:
2999 case 0xc028:
3000 case 0xc02f:
3001 case 0xc030:
3002 case 0xc076:
3003 case 0xc077:
3004 case 0xc08a:
3005 case 0xc08b:
3006 case 0xcca8:
3007 case 0xe412:
3008 case 0xe413:
3009 return KEX_ECDHE_RSA0x18;
3010 case 0x001e:
3011 case 0x001f:
3012 case 0x0020:
3013 case 0x0021:
3014 case 0x0022:
3015 case 0x0023:
3016 case 0x0024:
3017 case 0x0025:
3018 case 0x0026:
3019 case 0x0027:
3020 case 0x0028:
3021 case 0x0029:
3022 case 0x002a:
3023 case 0x002b:
3024 return KEX_KRB50x1c;
3025 case 0x002c:
3026 case 0x008a:
3027 case 0x008b:
3028 case 0x008c:
3029 case 0x008d:
3030 case 0x00a8:
3031 case 0x00a9:
3032 case 0x00ae:
3033 case 0x00af:
3034 case 0x00b0:
3035 case 0x00b1:
3036 case 0xc064:
3037 case 0xc065:
3038 case 0xc08e:
3039 case 0xc08f:
3040 case 0xc094:
3041 case 0xc095:
3042 case 0xc0a4:
3043 case 0xc0a5:
3044 case 0xc0a8:
3045 case 0xc0a9:
3046 case 0xccab:
3047 case 0xe416:
3048 case 0xe417:
3049 return KEX_PSK0x1d;
3050 case 0x0001:
3051 case 0x0002:
3052 case 0x0003:
3053 case 0x0004:
3054 case 0x0005:
3055 case 0x0006:
3056 case 0x0007:
3057 case 0x0008:
3058 case 0x0009:
3059 case 0x000a:
3060 case 0x002f:
3061 case 0x0035:
3062 case 0x003b:
3063 case 0x003c:
3064 case 0x003d:
3065 case 0x0041:
3066 case 0x0060:
3067 case 0x0061:
3068 case 0x0062:
3069 case 0x0064:
3070 case 0x0084:
3071 case 0x0096:
3072 case 0x009c:
3073 case 0x009d:
3074 case 0x00ba:
3075 case 0x00c0:
3076 case 0xc07a:
3077 case 0xc07b:
3078 case 0xc09c:
3079 case 0xc09d:
3080 case 0xc0a0:
3081 case 0xc0a1:
3082 case 0xe410:
3083 case 0xe411:
3084 case 0xfefe:
3085 case 0xfeff:
3086 case 0xffe0:
3087 case 0xffe1:
3088 return KEX_RSA0x1e;
3089 case 0x002e:
3090 case 0x0092:
3091 case 0x0093:
3092 case 0x0094:
3093 case 0x0095:
3094 case 0x00ac:
3095 case 0x00ad:
3096 case 0x00b6:
3097 case 0x00b7:
3098 case 0x00b8:
3099 case 0x00b9:
3100 case 0xc092:
3101 case 0xc093:
3102 case 0xc098:
3103 case 0xc099:
3104 case 0xccae:
3105 case 0xe41a:
3106 case 0xe41b:
3107 return KEX_RSA_PSK0x1f;
3108 case 0xc01a:
3109 case 0xc01d:
3110 case 0xc020:
3111 return KEX_SRP_SHA0x20;
3112 case 0xc01c:
3113 case 0xc01f:
3114 case 0xc022:
3115 return KEX_SRP_SHA_DSS0x21;
3116 case 0xc01b:
3117 case 0xc01e:
3118 case 0xc021:
3119 return KEX_SRP_SHA_RSA0x22;
3120 case 0xc0ff:
3121 return KEX_ECJPAKE0x24;
3122 case 0xe003:
3123 case 0xe013:
3124 case 0xe053:
3125 return KEX_ECC_SM20x26;
3126 default:
3127 break;
3128 }
3129
3130 return 0;
3131 /* }}} */
3132}
3133
3134static wmem_list_t *connection_id_session_list;
3135
3136void
3137ssl_init_cid_list(void) {
3138 connection_id_session_list = wmem_list_new(wmem_file_scope());
3139}
3140
3141void
3142ssl_cleanup_cid_list(void) {
3143 wmem_destroy_list(connection_id_session_list);
3144}
3145
3146void
3147ssl_add_session_by_cid(SslDecryptSession *session)
3148{
3149 wmem_list_append(connection_id_session_list, session);
3150}
3151
3152SslDecryptSession *
3153ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
3154{
3155 SslDecryptSession * ssl_cid = NULL((void*)0);
3156 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
3157
3158 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
3159 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
3160 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3160, "ssl != ((void*)0)"))))
;
3161 SslSession *session = &ssl->session;
3162
3163 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
3164 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
3165 ssl_cid = ssl;
3166 }
3167 }
3168
3169 if (session->server_cid_len > 0) {
3170 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
3171 ssl_cid = ssl;
3172 }
3173 }
3174
3175 it = wmem_list_frame_next(it);
3176 }
3177
3178 return ssl_cid;
3179}
3180
3181/* StringInfo structure (len + data) functions {{{ */
3182
3183int
3184ssl_data_alloc(StringInfo* str, size_t len)
3185{
3186 str->data = (unsigned char *)g_malloc(len);
3187 /* the allocator can return a null pointer for a size equal to 0,
3188 * and that must be allowed */
3189 if (len > 0 && !str->data)
3190 return -1;
3191 str->data_len = (unsigned) len;
3192 return 0;
3193}
3194
3195void
3196ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
3197{
3198 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3198, "data"))))
;
3199 memcpy(str->data, data, len);
3200 str->data_len = len;
3201}
3202
3203static int
3204ssl_data_realloc(StringInfo* str, unsigned len)
3205{
3206 str->data = (unsigned char *)g_realloc(str->data, len);
3207 if (!str->data)
3208 return -1;
3209 str->data_len = len;
3210 return 0;
3211}
3212
3213static StringInfo *
3214ssl_data_clone(StringInfo *str)
3215{
3216 StringInfo *cloned_str;
3217 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
3218 sizeof(StringInfo) + str->data_len);
3219 cloned_str->data = (unsigned char *) (cloned_str + 1);
3220 ssl_data_set(cloned_str, str->data, str->data_len);
3221 return cloned_str;
3222}
3223
3224static int
3225ssl_data_copy(StringInfo* dst, StringInfo* src)
3226{
3227 if (dst->data_len < src->data_len) {
3228 if (ssl_data_realloc(dst, src->data_len))
3229 return -1;
3230 }
3231 memcpy(dst->data, src->data, src->data_len);
3232 dst->data_len = src->data_len;
3233 return 0;
3234}
3235
3236/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
3237 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
3238 * success. */
3239static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
3240 size_t i;
3241
3242 if (hex_len & 1)
3243 return false0;
3244
3245 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
3246 for (i = 0; i < hex_len / 2; i++) {
3247 int a = ws_xton(in[i*2]);
3248 int b = ws_xton(in[i*2 + 1]);
3249 if (a == -1 || b == -1)
3250 return false0;
3251 out->data[i] = a << 4 | b;
3252 }
3253 out->data_len = (unsigned)hex_len / 2;
3254 return true1;
3255}
3256/* StringInfo structure (len + data) functions }}} */
3257
3258
3259/* libgcrypt wrappers for HMAC/message digest operations {{{ */
3260/* hmac abstraction layer */
3261#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
3262
3263static inline int
3264ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
3265{
3266 gcry_error_t err;
3267 const char *err_str, *err_src;
3268
3269 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
3270 if (err != 0) {
3271 err_str = gcry_strerror(err);
3272 err_src = gcry_strsource(err);
3273 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
3274 return -1;
3275 }
3276 return 0;
3277}
3278
3279static inline int
3280ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
3281{
3282 gcry_error_t err;
3283 const char *err_str, *err_src;
3284
3285 err = gcry_md_setkey (*(md), key, len);
3286 if (err != 0) {
3287 err_str = gcry_strerror(err);
3288 err_src = gcry_strsource(err);
3289 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
3290 return -1;
3291 }
3292 return 0;
3293}
3294
3295static inline int
3296ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
3297{
3298 gcry_md_reset(*md);
3299 return 0;
3300}
3301
3302static inline void
3303ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
3304{
3305 gcry_md_write(*(md), data, len);
3306}
3307static inline void
3308ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3309{
3310 int algo;
3311 unsigned len;
3312
3313 algo = gcry_md_get_algo (*(md));
3314 len = gcry_md_get_algo_dlen(algo);
3315 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3315, "len <= *datalen"))))
;
3316 memcpy(data, gcry_md_read(*(md), algo), len);
3317 *datalen = len;
3318}
3319static inline void
3320ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
3321{
3322 gcry_md_close(*(md));
3323}
3324
3325/* message digest abstraction layer*/
3326#define SSL_MDgcry_md_hd_t gcry_md_hd_t
3327
3328static inline int
3329ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
3330{
3331 gcry_error_t err;
3332 const char *err_str, *err_src;
3333 err = gcry_md_open(md,algo, 0);
3334 if (err != 0) {
3335 err_str = gcry_strerror(err);
3336 err_src = gcry_strsource(err);
3337 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
3338 return -1;
3339 }
3340 return 0;
3341}
3342static inline void
3343ssl_md_update(SSL_MDgcry_md_hd_t* md, unsigned char* data, int len)
3344{
3345 gcry_md_write(*(md), data, len);
3346}
3347static inline void
3348ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3349{
3350 int algo;
3351 int len;
3352 algo = gcry_md_get_algo (*(md));
3353 len = gcry_md_get_algo_dlen (algo);
3354 memcpy(data, gcry_md_read(*(md), algo), len);
3355 *datalen = len;
3356}
3357static inline void
3358ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
3359{
3360 gcry_md_close(*(md));
3361}
3362
3363static inline void
3364ssl_md_reset(SSL_MDgcry_md_hd_t* md)
3365{
3366 gcry_md_reset(*md);
3367}
3368
3369/* md5 /sha abstraction layer */
3370#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
3371#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
3372
3373static inline int
3374ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
3375{
3376 gcry_error_t err;
3377 const char *err_str, *err_src;
3378 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
3379 if (err != 0) {
3380 err_str = gcry_strerror(err);
3381 err_src = gcry_strsource(err);
3382 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
3383 return -1;
3384 }
3385 return 0;
3386}
3387static inline void
3388ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3389{
3390 gcry_md_write(*(md), data, len);
3391}
3392static inline void
3393ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
3394{
3395 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
3396 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
3397}
3398
3399static inline void
3400ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
3401{
3402 gcry_md_reset(*md);
3403}
3404
3405static inline void
3406ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
3407{
3408 gcry_md_close(*(md));
3409}
3410
3411static inline int
3412ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
3413{
3414 gcry_error_t err;
3415 const char *err_str, *err_src;
3416 err = gcry_md_open(md,GCRY_MD_MD5, 0);
3417 if (err != 0) {
3418 err_str = gcry_strerror(err);
3419 err_src = gcry_strsource(err);
3420 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
3421 return -1;
3422 }
3423 return 0;
3424}
3425static inline void
3426ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3427{
3428 gcry_md_write(*(md), data, len);
3429}
3430static inline void
3431ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
3432{
3433 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
3434 gcry_md_get_algo_dlen(GCRY_MD_MD5));
3435}
3436
3437static inline void
3438ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
3439{
3440 gcry_md_reset(*md);
3441}
3442
3443static inline void
3444ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
3445{
3446 gcry_md_close(*(md));
3447}
3448/* libgcrypt wrappers for HMAC/message digest operations }}} */
3449
3450/* libgcrypt wrappers for Cipher state manipulation {{{ */
3451int
3452ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
3453{
3454 int ret;
3455#if 0
3456 unsigned char *ivp;
3457 int i;
3458 gcry_cipher_hd_t c;
3459 c=(gcry_cipher_hd_t)*cipher;
3460#endif
3461 ssl_debug_printf("--------------------------------------------------------------------");
3462#if 0
3463 for(ivp=c->iv,i=0; i < iv_len; i++ )
3464 {
3465 ssl_debug_printf("%d ",ivp[i]);
3466 i++;
3467 }
3468#endif
3469 ssl_debug_printf("--------------------------------------------------------------------");
3470 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
3471#if 0
3472 for(ivp=c->iv,i=0; i < iv_len; i++ )
3473 {
3474 ssl_debug_printf("%d ",ivp[i]);
3475 i++;
3476 }
3477#endif
3478 ssl_debug_printf("--------------------------------------------------------------------");
3479 return ret;
3480}
3481/* stream cipher abstraction layer*/
3482static int
3483ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
3484 unsigned char* iv, int mode)
3485{
3486 int gcry_modes[] = {
3487 GCRY_CIPHER_MODE_STREAM,
3488 GCRY_CIPHER_MODE_CBC,
3489 GCRY_CIPHER_MODE_GCM,
3490 GCRY_CIPHER_MODE_CCM,
3491 GCRY_CIPHER_MODE_CCM,
3492 GCRY_CIPHER_MODE_POLY1305,
3493 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
3494 };
3495 int err;
3496 if (algo == -1) {
3497 /* NULL mode */
3498 *(cipher) = (gcry_cipher_hd_t)-1;
3499 return 0;
3500 }
3501 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
3502 if (err !=0)
3503 return -1;
3504 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
3505 if (err != 0)
3506 return -1;
3507 /* AEAD cipher suites will set the nonce later. */
3508 if (mode == MODE_CBC) {
3509 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
3510 if (err != 0)
3511 return -1;
3512 }
3513 return 0;
3514}
3515static inline int
3516ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
3517 const unsigned char * in, int inl)
3518{
3519 if ((*cipher) == (gcry_cipher_hd_t)-1)
3520 {
3521 if (in && inl)
3522 memcpy(out, in, outl < inl ? outl : inl);
3523 return 0;
3524 }
3525 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
3526}
3527static inline int
3528ssl_get_digest_by_name(const char*name)
3529{
3530 return gcry_md_map_name(name);
3531}
3532static inline int
3533ssl_get_cipher_by_name(const char* name)
3534{
3535 return gcry_cipher_map_name(name);
3536}
3537
3538static inline void
3539ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
3540{
3541 if ((*cipher) != (gcry_cipher_hd_t)-1)
3542 gcry_cipher_close(*cipher);
3543 *cipher = NULL((void*)0);
3544}
3545/* }}} */
3546
3547/* Digests, Ciphers and Cipher Suites registry {{{ */
3548static const SslDigestAlgo digests[]={
3549 {"MD5", 16},
3550 {"SHA1", 20},
3551 {"SHA256", 32},
3552 {"SHA384", 48},
3553 {"SM3", 32},
3554 {"Not Applicable", 0},
3555};
3556
3557#define DIGEST_MAX_SIZE48 48
3558
3559/* get index digest index */
3560static const SslDigestAlgo *
3561ssl_cipher_suite_dig(const SslCipherSuite *cs) {
3562 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
3563 return &digests[DIG_NA0x45 - DIG_MD50x40];
3564 }
3565 return &digests[cs->dig - DIG_MD50x40];
3566}
3567
3568static const char *ciphers[]={
3569 "DES",
3570 "3DES",
3571 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
3572 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
3573 "IDEA",
3574 "AES",
3575 "AES256",
3576 "CAMELLIA128",
3577 "CAMELLIA256",
3578 "SEED",
3579 "CHACHA20", /* since Libgcrypt 1.7.0 */
3580 "SM1",
3581 "SM4",
3582 "*UNKNOWN*"
3583};
3584
3585static const SslCipherSuite cipher_suites[]={
3586 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
3587 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
3588 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3589 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
3590 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
3591 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3592 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
3593 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3594 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
3595 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
3596 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3597 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
3598 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
3599 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3600 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
3601 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
3602 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3603 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
3604 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
3605 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3606 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
3607 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
3608 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3609 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
3610 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3611 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
3612 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
3613 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
3614 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
3615 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
3616 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
3617 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
3618 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
3619 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
3620 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
3621 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
3622 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
3623 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
3624 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
3625 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
3626 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
3627 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
3628 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
3629 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
3630 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
3631 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
3632 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
3633 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
3634 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
3635 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
3636 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
3637 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
3638 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
3639 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
3640 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3641 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3642 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3643 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3644 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3645 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3646 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
3647 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
3648 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
3649 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
3650 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
3651 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
3652 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
3653 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
3654 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
3655 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
3656 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
3657 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
3658 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
3659 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
3660 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
3661 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
3662 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
3663 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
3664 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
3665 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
3666 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
3667 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
3668 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
3669 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
3670 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
3671 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
3672 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
3673 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
3674 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
3675 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
3676 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
3677 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
3678 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
3679 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
3680 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
3681 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
3682 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
3683 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
3684 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
3685 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
3686 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
3687 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
3688 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
3689 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
3690 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
3691 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
3692 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
3693 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
3694 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
3695 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
3696 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
3697 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
3698 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
3699 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
3700 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
3701 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
3702 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
3703 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
3704 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
3705 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
3706 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
3707 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
3708 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3709 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3710 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3711 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3712 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3713 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
3714 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3715 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3716 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3717 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3718 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3719 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
3720
3721 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
3722 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
3723 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
3724 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
3725 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
3726 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
3727 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3728
3729 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3730 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3731 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3732 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3733 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3734 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3735 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3736 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3737 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3738 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3739 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3740 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3741 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3742 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3743 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3744 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3745 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3746 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3747 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3748 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3749 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3750 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3751 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3752 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3753 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3754 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3755 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3756 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3757 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3758 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3759 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3760 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3761 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3762 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3763 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3764 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3765 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3766 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3767 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3768 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3769 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3770 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3771 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3772 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3773 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3774 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3775 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3776 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3777 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3778 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3779 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3780 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3781 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3782 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3783 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3784 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3785 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3786 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3787 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3788 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3789 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3790 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3791 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3792 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3793 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3794 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3795 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3796 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3797 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3798 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3799 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3800 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3801 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3802 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3803 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3804 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3805 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3806 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3807 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3808 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3809 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3810 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3811 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3812 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3813 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3814 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3815 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3816 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3817 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3818 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3819 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3820 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3821 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3822 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3823 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3824 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3825 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3826 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3827 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3828 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3829 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3830 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3831 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3832 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3833 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3834 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3835 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3836 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3837 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3838 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3839 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3840 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3841 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3842 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3843 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3844 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3845 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3846 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3847 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3848 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3849 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3850 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3851 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3852 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3853 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3854 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3855 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3856 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3857 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3858 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3859 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3860 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3861 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3862 /* GM */
3863 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3864 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3865 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3866 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3867 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3868 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3869 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3870 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3871 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3872 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3873 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3874 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3875 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3876 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3877 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3878 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3879 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3880 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3881 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3882 {-1, 0, 0, 0, MODE_STREAM}
3883};
3884
3885#define MAX_BLOCK_SIZE16 16
3886#define MAX_KEY_SIZE32 32
3887
3888const SslCipherSuite *
3889ssl_find_cipher(int num)
3890{
3891 const SslCipherSuite *c;
3892 for(c=cipher_suites;c->number!=-1;c++){
3893 if(c->number==num){
3894 return c;
3895 }
3896 }
3897
3898 return NULL((void*)0);
3899}
3900
3901int
3902ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3903{
3904 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3905}
3906
3907unsigned
3908ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3909{
3910 int cipher_algo;
3911 if (cipher_suite->mode != MODE_CBC) return 0;
3912 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3913 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3914}
3915
3916static unsigned
3917ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3918{
3919 switch (cipher_suite_num) {
3920 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3921 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3922 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3923 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3924 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3925 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3926 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3927 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3928 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3929 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3930 return 5;
3931
3932 /* not defined in below draft, but "implemented by several vendors",
3933 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3934 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3935 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3936 return 7;
3937
3938 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3939 * used 7. Until a pcap proves 8, let's use the old value. Link:
3940 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3941 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3942 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3943 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3944 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3945 return 7;
3946
3947 default:
3948 return 0;
3949 }
3950}
3951
3952/* Digests, Ciphers and Cipher Suites registry }}} */
3953
3954
3955/* HMAC and the Pseudorandom function {{{ */
3956static int
3957tls_hash(StringInfo *secret, StringInfo *seed, int md,
3958 StringInfo *out, unsigned out_len)
3959{
3960 /* RFC 2246 5. HMAC and the pseudorandom function
3961 * '+' denotes concatenation.
3962 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3963 * HMAC_hash(secret, A(2) + seed) + ...
3964 * A(0) = seed
3965 * A(i) = HMAC_hash(secret, A(i - 1))
3966 */
3967 uint8_t *ptr;
3968 unsigned left, tocpy;
3969 uint8_t *A;
3970 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3971 unsigned A_l, tmp_l;
3972 SSL_HMACgcry_md_hd_t hm;
3973
3974 ptr = out->data;
3975 left = out_len;
3976
3977 ssl_print_string("tls_hash: hash secret", secret);
3978 ssl_print_string("tls_hash: hash seed", seed);
3979 /* A(0) = seed */
3980 A = seed->data;
3981 A_l = seed->data_len;
3982
3983 if (ssl_hmac_init(&hm, md) != 0) {
3984 return -1;
3985 }
3986 while (left) {
3987 /* A(i) = HMAC_hash(secret, A(i-1)) */
3988 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3989 ssl_hmac_update(&hm, A, A_l);
3990 A_l = sizeof(_A); /* upper bound len for hash output */
3991 ssl_hmac_final(&hm, _A, &A_l);
3992 A = _A;
3993
3994 /* HMAC_hash(secret, A(i) + seed) */
3995 ssl_hmac_reset(&hm);
3996 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3997 ssl_hmac_update(&hm, A, A_l);
3998 ssl_hmac_update(&hm, seed->data, seed->data_len);
3999 tmp_l = sizeof(tmp); /* upper bound len for hash output */
4000 ssl_hmac_final(&hm, tmp, &tmp_l);
4001 ssl_hmac_reset(&hm);
4002
4003 /* ssl_hmac_final puts the actual digest output size in tmp_l */
4004 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
4005 memcpy(ptr, tmp, tocpy);
4006 ptr += tocpy;
4007 left -= tocpy;
4008 }
4009 ssl_hmac_cleanup(&hm);
4010 out->data_len = out_len;
4011
4012 ssl_print_string("hash out", out);
4013 return 0;
4014}
4015
4016static bool_Bool
4017tls_prf(StringInfo* secret, const char *usage,
4018 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4019{
4020 StringInfo seed, sha_out, md5_out;
4021 uint8_t *ptr;
4022 StringInfo s1, s2;
4023 unsigned i,s_l;
4024 size_t usage_len, rnd2_len;
4025 bool_Bool success = false0;
4026 usage_len = strlen(usage);
4027 rnd2_len = rnd2 ? rnd2->data_len : 0;
4028
4029 /* initialize buffer for sha, md5 random seed*/
4030 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
4031 ssl_debug_printf("tls_prf: can't allocate sha out\n");
4032 return false0;
4033 }
4034 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
4035 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
4036 goto free_sha;
4037 }
4038 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4039 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
4040 (int) (usage_len+rnd1->data_len+rnd2_len));
4041 goto free_md5;
4042 }
4043
4044 ptr=seed.data;
4045 memcpy(ptr,usage,usage_len);
4046 ptr+=usage_len;
4047 memcpy(ptr,rnd1->data,rnd1->data_len);
4048 if (rnd2_len > 0) {
4049 ptr+=rnd1->data_len;
4050 memcpy(ptr,rnd2->data,rnd2->data_len);
4051 /*ptr+=rnd2->data_len;*/
4052 }
4053
4054 /* initialize buffer for client/server seeds*/
4055 s_l=secret->data_len/2 + secret->data_len%2;
4056 if (ssl_data_alloc(&s1, s_l) < 0) {
4057 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
4058 goto free_seed;
4059 }
4060 if (ssl_data_alloc(&s2, s_l) < 0) {
4061 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
4062 goto free_s1;
4063 }
4064
4065 memcpy(s1.data,secret->data,s_l);
4066 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
4067
4068 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
4069 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
4070 goto free_s2;
4071 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
4072 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
4073 goto free_s2;
4074
4075 for (i = 0; i < out_len; i++)
4076 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
4077 /* success, now store the new meaningful data length */
4078 out->data_len = out_len;
4079 success = true1;
4080
4081 ssl_print_string("PRF out",out);
4082free_s2:
4083 g_free(s2.data);
4084free_s1:
4085 g_free(s1.data);
4086free_seed:
4087 g_free(seed.data);
4088free_md5:
4089 g_free(md5_out.data);
4090free_sha:
4091 g_free(sha_out.data);
4092 return success;
4093}
4094
4095static bool_Bool
4096tls12_prf(int md, StringInfo* secret, const char* usage,
4097 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4098{
4099 StringInfo label_seed;
4100 int success;
4101 size_t usage_len, rnd2_len;
4102 rnd2_len = rnd2 ? rnd2->data_len : 0;
4103
4104 usage_len = strlen(usage);
4105 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4106 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
4107 return false0;
4108 }
4109 memcpy(label_seed.data, usage, usage_len);
4110 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
4111 if (rnd2_len > 0)
4112 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
4113
4114 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
4115 success = tls_hash(secret, &label_seed, md, out, out_len);
4116 g_free(label_seed.data);
4117 if(success != -1){
4118 ssl_print_string("PRF out", out);
4119 return true1;
4120 }
4121 return false0;
4122}
4123
4124static bool_Bool
4125ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
4126 StringInfo *out, unsigned out_len)
4127{
4128 SSL_MD5_CTXgcry_md_hd_t md5;
4129 uint8_t tmp[16];
4130
4131 if (ssl_md5_init(&md5) != 0) {
4132 return false0;
4133 }
4134 ssl_md5_update(&md5,r1->data,r1->data_len);
4135 ssl_md5_update(&md5,r2->data,r2->data_len);
4136 ssl_md5_final(tmp,&md5);
4137 ssl_md5_cleanup(&md5);
4138
4139 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4139, "out_len <= sizeof(tmp)"))))
;
4140 ssl_data_set(out, tmp, out_len);
4141 ssl_print_string("export iv", out);
4142 return true1;
4143}
4144
4145static bool_Bool
4146ssl3_prf(StringInfo* secret, const char* usage,
4147 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4148{
4149 SSL_MD5_CTXgcry_md_hd_t md5;
4150 SSL_SHA_CTXgcry_md_hd_t sha;
4151 unsigned off;
4152 int i = 0,j;
4153 uint8_t buf[20];
4154
4155 if (ssl_sha_init(&sha) != 0) {
4156 return false0;
4157 }
4158 if (ssl_md5_init(&md5) != 0) {
4159 ssl_sha_cleanup(&sha);
4160 return false0;
4161 }
4162 for (off = 0; off < out_len; off += 16) {
4163 unsigned char outbuf[16];
4164 i++;
4165
4166 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
4167 /* A, BB, CCC, ... */
4168 for(j=0;j<i;j++){
4169 buf[j]=64+i;
4170 }
4171
4172 ssl_sha_update(&sha,buf,i);
4173 ssl_sha_update(&sha,secret->data,secret->data_len);
4174
4175 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
4176 if (rnd2)
4177 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4178 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4179 }
4180 else{
4181 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4182 if (rnd2)
4183 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4184 }
4185
4186 ssl_sha_final(buf,&sha);
4187 ssl_sha_reset(&sha);
4188
4189 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
4190 secret->data_len);
4191 ssl_md5_update(&md5,secret->data,secret->data_len);
4192 ssl_md5_update(&md5,buf,20);
4193 ssl_md5_final(outbuf,&md5);
4194 ssl_md5_reset(&md5);
4195
4196 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
4197 }
4198 ssl_sha_cleanup(&sha);
4199 ssl_md5_cleanup(&md5);
4200 out->data_len = out_len;
4201
4202 return true1;
4203}
4204
4205/* out_len is the wanted output length for the pseudorandom function.
4206 * Ensure that ssl->cipher_suite is set. */
4207static bool_Bool
4208prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
4209 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
4210{
4211 switch (ssl->session.version) {
4212 case SSLV3_VERSION0x300:
4213 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
4214
4215 case TLSV1_VERSION0x301:
4216 case TLSV1DOT1_VERSION0x302:
4217 case DTLSV1DOT0_VERSION0xfeff:
4218 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4219 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
4220
4221 default: /* TLSv1.2 */
4222 switch (ssl->cipher_suite->dig) {
4223 case DIG_SM30x44:
4224#if GCRYPT_VERSION_NUMBER0x010a03 >= 0x010900
4225 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
4226 out, out_len);
4227#else
4228 return false0;
4229#endif
4230 case DIG_SHA3840x43:
4231 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
4232 out, out_len);
4233 default:
4234 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
4235 out, out_len);
4236 }
4237 }
4238}
4239
4240static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
4241{
4242 SSL_MD5_CTXgcry_md_hd_t md5;
4243 SSL_SHA_CTXgcry_md_hd_t sha;
4244
4245 if (ssl_data_alloc(out, 36) < 0)
4246 return -1;
4247
4248 if (ssl_md5_init(&md5) != 0)
4249 return -1;
4250 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
4251 ssl_md5_final(out->data,&md5);
4252 ssl_md5_cleanup(&md5);
4253
4254 if (ssl_sha_init(&sha) != 0)
4255 return -1;
4256 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
4257 ssl_sha_final(out->data+16,&sha);
4258 ssl_sha_cleanup(&sha);
4259 return 0;
4260}
4261
4262static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
4263{
4264 SSL_MDgcry_md_hd_t mc;
4265 uint8_t tmp[48];
4266 unsigned len;
4267
4268 if (ssl_md_init(&mc, md) != 0)
4269 return -1;
4270 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
4271 ssl_md_final(&mc, tmp, &len);
4272 ssl_md_cleanup(&mc);
4273
4274 if (ssl_data_alloc(out, len) < 0)
4275 return -1;
4276 memcpy(out->data, tmp, len);
4277 return 0;
4278}
4279
4280/**
4281 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
4282 * inlined and removed once support for draft 19 and before is dropped.
4283 */
4284static inline const char *
4285tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
4286{
4287 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
4288 return "TLS 1.3, ";
4289 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4290 return "dtls13";
4291 } else {
4292 return "tls13 ";
4293 }
4294}
4295
4296/*
4297 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
4298 * custom label prefix. If "context_hash" is NULL, then an empty context is
4299 * used. Otherwise it must have the same length as the hash algorithm output.
4300 */
4301bool_Bool
4302tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
4303 const char *label_prefix, const char *label,
4304 const uint8_t *context_hash, uint8_t context_length,
4305 uint16_t out_len, unsigned char **out)
4306{
4307 /* RFC 8446 Section 7.1:
4308 * HKDF-Expand-Label(Secret, Label, Context, Length) =
4309 * HKDF-Expand(Secret, HkdfLabel, Length)
4310 * struct {
4311 * uint16 length = Length;
4312 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
4313 * opaque context<0..255> = Context;
4314 * } HkdfLabel;
4315 *
4316 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
4317 * HKDF-Expand(PRK, info, L) -> OKM
4318 */
4319 gcry_error_t err;
4320 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
4321 const unsigned label_length = (unsigned) strlen(label);
4322
4323 /* Some sanity checks */
4324 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4324, "label_length > 0 && label_prefix_length + label_length <= 255"
))))
;
38
'?' condition is true
4325
4326 /* info = HkdfLabel { length, label, context } */
4327 GByteArray *info = g_byte_array_new();
4328 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))))
;
4329 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
4330
4331 const uint8_t label_vector_length = label_prefix_length + label_length;
4332 g_byte_array_append(info, &label_vector_length, 1);
4333 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
4334 g_byte_array_append(info, (const uint8_t*)label, label_length);
4335
4336 g_byte_array_append(info, &context_length, 1);
4337 if (context_length
38.1
'context_length' is not equal to 0
) {
39
Taking true branch
4338 g_byte_array_append(info, context_hash, context_length);
4339 }
4340
4341 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
4342 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
4343 g_byte_array_free(info, true1);
4344
4345 if (err) {
40
Assuming 'err' is not equal to 0
41
Taking true branch
4346 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
4347 wmem_free(NULL((void*)0), *out);
4348 *out = NULL((void*)0);
42
Null pointer value stored to 'ech_verify_out'
4349 return false0;
4350 }
4351
4352 return true1;
4353}
4354
4355bool_Bool
4356tls13_hkdf_expand_label(int md, const StringInfo *secret,
4357 const char *label_prefix, const char *label,
4358 uint16_t out_len, unsigned char **out)
4359{
4360 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
4361}
4362/* HMAC and the Pseudorandom function }}} */
4363
4364/* Record Decompression (after decryption) {{{ */
4365#ifdef USE_ZLIB_OR_ZLIBNG
4366/* memory allocation functions for zlib initialization */
4367static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
4368{
4369 return g_malloc0(no*size);
4370}
4371static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
4372{
4373 g_free(addr);
4374}
4375#endif /* USE_ZLIB_OR_ZLIBNG */
4376
4377static SslDecompress*
4378ssl_create_decompressor(int compression)
4379{
4380 SslDecompress *decomp;
4381#ifdef USE_ZLIB_OR_ZLIBNG
4382 int err;
4383#endif
4384
4385 if (compression == 0) return NULL((void*)0);
4386 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
4387 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)))
;
4388 decomp->compression = compression;
4389 switch (decomp->compression) {
4390#ifdef USE_ZLIB_OR_ZLIBNG
4391 case 1: /* DEFLATE */
4392 decomp->istream.zalloc = ssl_zalloc;
4393 decomp->istream.zfree = ssl_zfree;
4394 decomp->istream.opaque = Z_NULL0;
4395 decomp->istream.next_in = Z_NULL0;
4396 decomp->istream.next_out = Z_NULL0;
4397 decomp->istream.avail_in = 0;
4398 decomp->istream.avail_out = 0;
4399 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3", (int)sizeof(z_stream
))
;
4400 if (err != Z_OK0) {
4401 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
4402 return NULL((void*)0);
4403 }
4404 break;
4405#endif /* USE_ZLIB_OR_ZLIBNG */
4406 default:
4407 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
4408 return NULL((void*)0);
4409 }
4410 return decomp;
4411}
4412
4413#ifdef USE_ZLIB_OR_ZLIBNG
4414static int
4415ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
4416{
4417 int err;
4418
4419 switch (decomp->compression) {
4420 case 1: /* DEFLATE */
4421 err = Z_OK0;
4422 if (out_str->data_len < 16384) { /* maximal plain length */
4423 ssl_data_realloc(out_str, 16384);
4424 }
4425#ifdef z_constconst
4426 decomp->istream.next_in = in;
4427#else
4428DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
4429 decomp->istream.next_in = (Bytef *)in;
4430DIAG_ON(cast-qual)clang diagnostic pop
4431#endif
4432 decomp->istream.avail_in = inl;
4433 decomp->istream.next_out = out_str->data;
4434 decomp->istream.avail_out = out_str->data_len;
4435 if (inl > 0)
4436 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
4437 if (err != Z_OK0) {
4438 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
4439 return -1;
4440 }
4441 *outl = out_str->data_len - decomp->istream.avail_out;
4442 break;
4443 default:
4444 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4445 return -1;
4446 }
4447 return 0;
4448}
4449#else /* USE_ZLIB_OR_ZLIBNG */
4450int
4451ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
4452{
4453 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4454 return -1;
4455}
4456#endif /* USE_ZLIB_OR_ZLIBNG */
4457/* Record Decompression (after decryption) }}} */
4458
4459/* Create a new structure to store decrypted chunks. {{{ */
4460static SslFlow*
4461ssl_create_flow(void)
4462{
4463 SslFlow *flow;
4464
4465 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
4466 flow->byte_seq = 0;
4467 flow->flags = 0;
4468 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
4469 return flow;
4470}
4471/* }}} */
4472
4473/* Use the negotiated security parameters for decryption. {{{ */
4474void
4475ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
4476{
4477 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
4478 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
4479 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
4480 *new_decoder ? "" : " (No decoder found - retransmission?)");
4481 if (*new_decoder) {
4482 *dest = *new_decoder;
4483 *new_decoder = NULL((void*)0);
4484 }
4485}
4486/* }}} */
4487
4488/* Init cipher state given some security parameters. {{{ */
4489static bool_Bool
4490ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
4491
4492static SslDecoder*
4493ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
4494 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
4495{
4496 SslDecoder *dec;
4497 ssl_cipher_mode_t mode = cipher_suite->mode;
4498
4499 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)))
;
4500 /* init mac buffer: mac storage is embedded into decoder struct to save a
4501 memory allocation and waste samo more memory*/
4502 dec->cipher_suite=cipher_suite;
4503 dec->compression = compression;
4504 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4505 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4506 // the special case for NULL ciphers, even if there is insufficiency
4507 // keying material (including MAC key), we will can still create
4508 // decoders since "decryption" is easy for such ciphers.
4509 dec->mac_key.data = dec->_mac_key_or_write_iv;
4510 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4511 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4512 // Input for the nonce, to be used with AEAD ciphers.
4513 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4513, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))))
;
4514 dec->write_iv.data = dec->_mac_key_or_write_iv;
4515 ssl_data_set(&dec->write_iv, iv, iv_length);
4516 }
4517 dec->seq = 0;
4518 dec->decomp = ssl_create_decompressor(compression);
4519 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4520
4521 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4522 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4523 cipher_algo, cipher_suite->mode);
4524 return NULL((void*)0);
4525 }
4526
4527 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4528 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4529 mode = MODE_ECB;
4530 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4531 mode = MODE_STREAM;
4532 } else {
4533 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4534 return NULL((void*)0);
4535 }
4536
4537 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4538 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4539 cipher_algo, MODE_ECB);
4540 ssl_cipher_cleanup(&dec->evp);
4541 dec->evp = NULL((void*)0);
4542 return NULL((void*)0);
4543 }
4544 } else {
4545 dec->sn_evp = NULL((void*)0);
4546 }
4547
4548 dec->dtls13_aad.data = NULL((void*)0);
4549 dec->dtls13_aad.data_len = 0;
4550 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4551 return dec;
4552}
4553
4554static bool_Bool
4555ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4556{
4557 SslDecoder *dec = (SslDecoder *) user_data;
4558
4559 if (dec->evp)
4560 ssl_cipher_cleanup(&dec->evp);
4561 if (dec->sn_evp)
4562 ssl_cipher_cleanup(&dec->sn_evp);
4563
4564#ifdef USE_ZLIB_OR_ZLIBNG
4565 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4566 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4567#endif
4568
4569 return false0;
4570}
4571/* }}} */
4572
4573/* (Pre-)master secrets calculations {{{ */
4574#ifdef HAVE_LIBGNUTLS1
4575static bool_Bool
4576ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4577 StringInfo *encrypted_pre_master,
4578 GHashTable *key_hash);
4579#endif /* HAVE_LIBGNUTLS */
4580
4581static bool_Bool
4582ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4583 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4584
4585bool_Bool
4586ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4587 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4588 const char *ssl_psk, packet_info *pinfo,
4589#ifdef HAVE_LIBGNUTLS1
4590 GHashTable *key_hash,
4591#endif
4592 const ssl_master_key_map_t *mk_map)
4593{
4594 /* check for required session data */
4595 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4596 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4597 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4598 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4599 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4600 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4601 return false0;
4602 }
4603
4604 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4605 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4606 return false0;
4607 }
4608
4609 /* check to see if the PMS was provided to us*/
4610 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4611 mk_map->pms, &ssl_session->client_random)) {
4612 return true1;
4613 }
4614
4615 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4616 {
4617 /* calculate pre master secret*/
4618 StringInfo pre_master_secret;
4619 unsigned psk_len, pre_master_len;
4620
4621 if (!ssl_psk || (ssl_psk[0] == 0)) {
4622 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
4623 return false0;
4624 }
4625
4626 /* convert hex string into char*/
4627 if (!from_hex(&ssl_session->psk, ssl_psk, strlen(ssl_psk))) {
4628 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
4629 G_STRFUNC((const char*) (__func__)));
4630 return false0;
4631 }
4632
4633 psk_len = ssl_session->psk.data_len;
4634 if (psk_len >= (2 << 15)) {
4635 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
4636 G_STRFUNC((const char*) (__func__)));
4637 return false0;
4638 }
4639
4640
4641 pre_master_len = psk_len * 2 + 4;
4642
4643 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4644 pre_master_secret.data_len = pre_master_len;
4645 /* 2 bytes psk_len*/
4646 pre_master_secret.data[0] = psk_len >> 8;
4647 pre_master_secret.data[1] = psk_len & 0xFF;
4648 /* psk_len bytes times 0*/
4649 memset(&pre_master_secret.data[2], 0, psk_len);
4650 /* 2 bytes psk_len*/
4651 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4652 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4653 /* psk*/
4654 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4655
4656 ssl_session->pre_master_secret.data = pre_master_secret.data;
4657 ssl_session->pre_master_secret.data_len = pre_master_len;
4658 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4659
4660 /* Remove the master secret if it was there.
4661 This forces keying material regeneration in
4662 case we're renegotiating */
4663 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4664 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4665 return true1;
4666 }
4667 else
4668 {
4669 unsigned encrlen, skip;
4670 encrlen = length;
4671 skip = 0;
4672
4673 /* get encrypted data, on tls1 we have to skip two bytes
4674 * (it's the encrypted len and should be equal to record len - 2)
4675 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4676 */
4677 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4678 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4679 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4680 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4681 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4682 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4683 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4684 {
4685 encrlen = tvb_get_ntohs(tvb, offset);
4686 skip = 2;
4687 if (encrlen > length - 2)
4688 {
4689 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4690 G_STRFUNC((const char*) (__func__)), encrlen, length);
4691 return false0;
4692 }
4693 }
4694 /* the valid lower bound is higher than 8, but it is sufficient for the
4695 * ssl keylog file below */
4696 if (encrlen < 8) {
4697 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4698 G_STRFUNC((const char*) (__func__)), encrlen);
4699 return false0;
4700 }
4701
4702 StringInfo encrypted_pre_master = {
4703 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4704 .data_len = encrlen,
4705 };
4706
4707#ifdef HAVE_LIBGNUTLS1
4708 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4709 if (ssl_session->cert_key_id) {
4710 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4711 return true1;
4712
4713 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4714 G_STRFUNC((const char*) (__func__)));
4715 }
4716#endif /* HAVE_LIBGNUTLS */
4717
4718 /* try to find the pre-master secret from the encrypted one. The
4719 * ssl key logfile stores only the first 8 bytes, so truncate it */
4720 encrypted_pre_master.data_len = 8;
4721 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4722 true1, mk_map->pre_master, &encrypted_pre_master))
4723 return true1;
4724 }
4725 return false0;
4726}
4727
4728/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4729int
4730ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4731{
4732 StringInfo key_block = { NULL((void*)0), 0 };
4733 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4734 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4735 int needed;
4736 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4737 unsigned encr_key_len, write_iv_len = 0;
4738 bool_Bool is_export_cipher;
4739 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4740 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4741 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4742
4743 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4744 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4745 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4746 return -1;
4747 }
4748
4749 /* check for enough info to proceed */
4750 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4751 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4752 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4753 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4754 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4755 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4756 /* Special case: for NULL encryption, allow dissection of data even if
4757 * the Client Hello is missing (MAC keys are now skipped though). */
4758 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4759 if ((ssl_session->state & need_all) == need_all &&
4760 cipher_suite->enc == ENC_NULL0x3D) {
4761 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4762 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4763 goto create_decoders;
4764 }
4765
4766 return -1;
4767 }
4768
4769 /* if master key is not available, generate is from the pre-master secret */
4770 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
4771 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
4772 StringInfo handshake_hashed_data;
4773 int ret;
4774
4775 handshake_hashed_data.data = NULL((void*)0);
4776 handshake_hashed_data.data_len = 0;
4777
4778 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4779 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4780 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4780, "ssl_session->handshake_data.data_len > 0"
))))
;
4781
4782 switch(ssl_session->session.version) {
4783 case TLSV1_VERSION0x301:
4784 case TLSV1DOT1_VERSION0x302:
4785 case DTLSV1DOT0_VERSION0xfeff:
4786 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4787 case TLCPV1_VERSION0x101:
4788 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
4789 break;
4790 default:
4791 switch (cipher_suite->dig) {
4792 case DIG_SHA3840x43:
4793 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4794 break;
4795 default:
4796 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4797 break;
4798 }
4799 break;
4800 }
4801 if (ret) {
4802 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
4803 return -1;
4804 }
4805
4806 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4807 ssl_session->handshake_data.data = NULL((void*)0);
4808 ssl_session->handshake_data.data_len = 0;
4809
4810 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4811 &handshake_hashed_data,
4812 NULL((void*)0), &ssl_session->master_secret,
4813 SSL_MASTER_SECRET_LENGTH48)) {
4814 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4815 g_free(handshake_hashed_data.data);
4816 return -1;
4817 }
4818 g_free(handshake_hashed_data.data);
4819 } else {
4820 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4821 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4822 ssl_print_string("client random",&ssl_session->client_random);
4823 ssl_print_string("server random",&ssl_session->server_random);
4824 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4825 &ssl_session->client_random,
4826 &ssl_session->server_random, &ssl_session->master_secret,
4827 SSL_MASTER_SECRET_LENGTH48)) {
4828 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4829 return -1;
4830 }
4831 }
4832 ssl_print_string("master secret",&ssl_session->master_secret);
4833
4834 /* the pre-master secret has been 'consumed' so we must clear it now */
4835 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4836 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4837 }
4838
4839 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4840 if (cipher_suite->enc != ENC_NULL0x3D) {
4841 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4842 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4843 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4844 if (cipher_algo == 0) {
4845 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4846 return -1;
4847 }
4848 }
4849
4850 /* Export ciphers consume less material from the key block. */
4851 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4852 is_export_cipher = encr_key_len > 0;
4853 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4854 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4855 }
4856
4857 if (cipher_suite->mode == MODE_CBC) {
4858 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4859 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4860 /* account for a four-byte salt for client and server side (from
4861 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4862 write_iv_len = 4;
4863 } else if (cipher_suite->mode == MODE_POLY1305) {
4864 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4865 write_iv_len = 12;
4866 }
4867
4868 /* Compute the key block. First figure out how much data we need */
4869 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4870 needed += 2 * encr_key_len; /* encryption key */
4871 needed += 2 * write_iv_len; /* write IV */
4872
4873 key_block.data = (unsigned char *)g_malloc(needed);
4874 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4875 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4876 &ssl_session->server_random,&ssl_session->client_random,
4877 &key_block, needed)) {
4878 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4879 goto fail;
4880 }
4881 ssl_print_string("key expansion", &key_block);
4882
4883 ptr=key_block.data;
4884 /* client/server write MAC key (for non-AEAD ciphers) */
4885 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4886 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4887 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4888 }
4889 /* client/server write encryption key */
4890 c_wk=ptr; ptr += encr_key_len;
4891 s_wk=ptr; ptr += encr_key_len;
4892 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4893 if (write_iv_len > 0) {
4894 c_iv=ptr; ptr += write_iv_len;
4895 s_iv=ptr; /* ptr += write_iv_len; */
4896 }
4897
4898 /* export ciphers work with a smaller key length */
4899 if (is_export_cipher) {
4900 if (cipher_suite->mode == MODE_CBC) {
4901
4902 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4903 all we should need. This is a sanity check */
4904 if (write_iv_len > MAX_BLOCK_SIZE16) {
4905 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4906 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4907 goto fail;
4908 }
4909
4910 if(ssl_session->session.version==SSLV3_VERSION0x300){
4911 /* The length of these fields are ignored by this caller */
4912 StringInfo iv_c, iv_s;
4913 iv_c.data = _iv_c;
4914 iv_s.data = _iv_s;
4915
4916 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4917 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4918 &ssl_session->server_random, &iv_c, write_iv_len)) {
4919 goto fail;
4920 }
4921 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4922 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4923 &ssl_session->client_random, &iv_s, write_iv_len)) {
4924 goto fail;
4925 }
4926 }
4927 else{
4928 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4929 StringInfo iv_block;
4930 StringInfo key_null;
4931 uint8_t _key_null;
4932
4933 key_null.data = &_key_null;
4934 key_null.data_len = 0;
4935
4936 iv_block.data = _iv_block;
4937
4938 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4939 if (!prf(ssl_session, &key_null, "IV block",
4940 &ssl_session->client_random,
4941 &ssl_session->server_random, &iv_block,
4942 write_iv_len * 2)) {
4943 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4944 goto fail;
4945 }
4946
4947 memcpy(_iv_c, iv_block.data, write_iv_len);
4948 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4949 }
4950
4951 c_iv=_iv_c;
4952 s_iv=_iv_s;
4953 }
4954
4955 if (ssl_session->session.version==SSLV3_VERSION0x300){
4956
4957 SSL_MD5_CTXgcry_md_hd_t md5;
4958 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4959
4960 if (ssl_md5_init(&md5) != 0)
4961 goto fail;
4962 ssl_md5_update(&md5,c_wk,encr_key_len);
4963 ssl_md5_update(&md5,ssl_session->client_random.data,
4964 ssl_session->client_random.data_len);
4965 ssl_md5_update(&md5,ssl_session->server_random.data,
4966 ssl_session->server_random.data_len);
4967 ssl_md5_final(_key_c,&md5);
4968 ssl_md5_cleanup(&md5);
4969 c_wk=_key_c;
4970
4971 if (ssl_md5_init(&md5) != 0)
4972 goto fail;
4973 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4974 ssl_md5_update(&md5,s_wk,encr_key_len);
4975 ssl_md5_update(&md5,ssl_session->server_random.data,
4976 ssl_session->server_random.data_len);
4977 ssl_md5_update(&md5,ssl_session->client_random.data,
4978 ssl_session->client_random.data_len);
4979 ssl_md5_final(_key_s,&md5);
4980 ssl_md5_cleanup(&md5);
4981 s_wk=_key_s;
4982 }
4983 else{
4984 StringInfo key_c, key_s, k;
4985 key_c.data = _key_c;
4986 key_s.data = _key_s;
4987
4988 k.data = c_wk;
4989 k.data_len = encr_key_len;
4990 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4991 if (!prf(ssl_session, &k, "client write key",
4992 &ssl_session->client_random,
4993 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4994 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4995 goto fail;
4996 }
4997 c_wk=_key_c;
4998
4999 k.data = s_wk;
5000 k.data_len = encr_key_len;
5001 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
5002 if (!prf(ssl_session, &k, "server write key",
5003 &ssl_session->client_random,
5004 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
5005 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
5006 goto fail;
5007 }
5008 s_wk=_key_s;
5009 }
5010 }
5011
5012 /* show key material info */
5013 if (c_mk != NULL((void*)0)) {
5014 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5015 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5016 }
5017 ssl_print_data("Client Write key", c_wk, encr_key_len);
5018 ssl_print_data("Server Write key", s_wk, encr_key_len);
5019 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
5020 if (write_iv_len > 0) {
5021 ssl_print_data("Client Write IV", c_iv, write_iv_len);
5022 ssl_print_data("Server Write IV", s_iv, write_iv_len);
5023 }
5024
5025create_decoders:
5026 /* create both client and server ciphers*/
5027 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
5028 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
5029 if (!ssl_session->client_new) {
5030 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
5031 goto fail;
5032 }
5033 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
5034 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
5035 if (!ssl_session->server_new) {
5036 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
5037 goto fail;
5038 }
5039
5040 /* Continue the SSL stream after renegotiation with new keys. */
5041 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5042 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5043
5044 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
5045 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
5046 g_free(key_block.data);
5047 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
5048 return 0;
5049
5050fail:
5051 g_free(key_block.data);
5052 return -1;
5053}
5054
5055/* Generated the key material based on the given secret. */
5056bool_Bool
5057tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
5058{
5059 bool_Bool success = false0;
5060 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
5061 unsigned char *sn_key = NULL((void*)0);
5062 SslDecoder *decoder;
5063 unsigned key_length, iv_length;
5064 int hash_algo;
5065 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
5066 int cipher_algo;
5067
5068 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
5069 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
5070 ssl_session->session.version);
5071 return false0;
5072 }
5073
5074 if (cipher_suite == NULL((void*)0)) {
5075 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
5076 return false0;
5077 }
5078
5079 if (cipher_suite->kex != KEX_TLS130x23) {
5080 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
5081 return false0;
5082 }
5083
5084 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
5085 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
5086 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5087 cipher_algo = ssl_get_cipher_by_name(cipher_name);
5088 if (cipher_algo == 0) {
5089 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5090 return false0;
5091 }
5092
5093 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
5094 hash_algo = ssl_get_digest_by_name(hash_name);
5095 if (!hash_algo) {
5096 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
5097 return false0;
5098 }
5099
5100 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
5101 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
5102 iv_length = 12;
5103 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
5104
5105 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
5106 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
5107 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5108 return false0;
5109 }
5110 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
5111 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
5112 goto end;
5113 }
5114
5115 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5116 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
5117 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5118 goto end;
5119 }
5120 }
5121
5122 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
5123 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
5124 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5125 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
5126 }
5127
5128 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5129 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
5130 if (!decoder) {
5131 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5132 goto end;
5133 }
5134
5135 /* Continue the TLS session with new keys, but reuse old flow to keep things
5136 * like "Follow TLS" working (by linking application data records). */
5137 if (is_from_server) {
5138 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5139 ssl_session->server = decoder;
5140 } else {
5141 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5142 ssl_session->client = decoder;
5143 }
5144 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
5145 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
5146 success = true1;
5147
5148end:
5149 wmem_free(NULL((void*)0), write_key);
5150 wmem_free(NULL((void*)0), write_iv);
5151 if (sn_key)
5152 wmem_free(NULL((void*)0), sn_key);
5153 return success;
5154}
5155/* (Pre-)master secrets calculations }}} */
5156
5157#ifdef HAVE_LIBGNUTLS1
5158/* Decrypt RSA pre-master secret using RSA private key. {{{ */
5159static bool_Bool
5160ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
5161 StringInfo *encrypted_pre_master, GHashTable *key_hash)
5162{
5163 int ret;
5164
5165 if (!encrypted_pre_master)
5166 return false0;
5167
5168 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)
) {
5169 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
5170 "(cipher suite 0x%04X %s) and cannot be decrypted "
5171 "using a RSA private key file.\n",
5172 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
5173 val_to_str_ext_const(ssl_session->session.cipher,
5174 &ssl_31_ciphersuite_ext, "unknown"));
5175 return false0;
5176 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
5177 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
5178 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
5179 return false0;
5180 }
5181
5182 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
5183
5184 ssl_print_string("pre master encrypted", encrypted_pre_master);
5185 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
5186 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
5187 gnutls_datum_t pms = { 0 };
5188 if (pk) {
5189 // Try to decrypt using the RSA keys table from (D)TLS preferences.
5190 ret = gnutls_privkey_decrypt_data(pk, 0, &epms, &pms);
5191 } else {
5192 // Try to decrypt using a hardware token.
5193 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
5194 }
5195 if (ret < 0) {
5196 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
5197 return false0;
5198 }
5199
5200 if (pms.size != 48) {
5201 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
5202 G_STRFUNC((const char*) (__func__)), pms.size, 48);
5203 if (pk) {
5204 gnutls_free(pms.data);
5205 } else {
5206 g_free(pms.data);
5207 }
5208 return false0;
5209 }
5210
5211 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
5212 ssl_session->pre_master_secret.data_len = 48;
5213 if (pk) {
5214 gnutls_free(pms.data);
5215 } else {
5216 g_free(pms.data);
5217 }
5218 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
5219
5220 /* Remove the master secret if it was there.
5221 This forces keying material regeneration in
5222 case we're renegotiating */
5223 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
5224 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
5225 return true1;
5226} /* }}} */
5227#endif /* HAVE_LIBGNUTLS */
5228
5229/* Decryption integrity check {{{ */
5230
5231static int
5232tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
5233 uint32_t datalen, uint8_t* mac)
5234{
5235 SSL_HMACgcry_md_hd_t hm;
5236 int md;
5237 uint32_t len;
5238 uint8_t buf[DIGEST_MAX_SIZE48];
5239 int16_t temp;
5240
5241 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5242 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
5243 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5244
5245 if (ssl_hmac_init(&hm,md) != 0)
5246 return -1;
5247 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5248 return -1;
5249
5250 /* hash sequence number */
5251 phton64(buf, decoder->seq);
5252
5253 decoder->seq++;
5254
5255 ssl_hmac_update(&hm,buf,8);
5256
5257 /* hash content type */
5258 buf[0]=ct;
5259 ssl_hmac_update(&hm,buf,1);
5260
5261 /* hash version,data length and data*/
5262 /* *((int16_t*)buf) = g_htons(ver); */
5263 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5264 memcpy(buf, &temp, 2);
5265 ssl_hmac_update(&hm,buf,2);
5266
5267 /* *((int16_t*)buf) = g_htons(datalen); */
5268 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5269 memcpy(buf, &temp, 2);
5270 ssl_hmac_update(&hm,buf,2);
5271 ssl_hmac_update(&hm,data,datalen);
5272
5273 /* get digest and digest len*/
5274 len = sizeof(buf);
5275 ssl_hmac_final(&hm,buf,&len);
5276 ssl_hmac_cleanup(&hm);
5277 ssl_print_data("Mac", buf, len);
5278 if(memcmp(mac,buf,len))
5279 return -1;
5280
5281 return 0;
5282}
5283
5284static int
5285ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
5286 uint32_t datalen, uint8_t* mac)
5287{
5288 SSL_MDgcry_md_hd_t mc;
5289 int md;
5290 uint32_t len;
5291 uint8_t buf[64],dgst[20];
5292 int pad_ct;
5293 int16_t temp;
5294
5295 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
5296
5297 /* get cipher used for digest computation */
5298 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5299 if (ssl_md_init(&mc,md) !=0)
5300 return -1;
5301
5302 /* do hash computation on data && padding */
5303 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5304
5305 /* hash padding*/
5306 memset(buf,0x36,pad_ct);
5307 ssl_md_update(&mc,buf,pad_ct);
5308
5309 /* hash sequence number */
5310 phton64(buf, decoder->seq);
5311 decoder->seq++;
5312 ssl_md_update(&mc,buf,8);
5313
5314 /* hash content type */
5315 buf[0]=ct;
5316 ssl_md_update(&mc,buf,1);
5317
5318 /* hash data length in network byte order and data*/
5319 /* *((int16_t* )buf) = g_htons(datalen); */
5320 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5321 memcpy(buf, &temp, 2);
5322 ssl_md_update(&mc,buf,2);
5323 ssl_md_update(&mc,data,datalen);
5324
5325 /* get partial digest */
5326 ssl_md_final(&mc,dgst,&len);
5327 ssl_md_reset(&mc);
5328
5329 /* hash mac key */
5330 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5331
5332 /* hash padding and partial digest*/
5333 memset(buf,0x5c,pad_ct);
5334 ssl_md_update(&mc,buf,pad_ct);
5335 ssl_md_update(&mc,dgst,len);
5336
5337 ssl_md_final(&mc,dgst,&len);
5338 ssl_md_cleanup(&mc);
5339
5340 if(memcmp(mac,dgst,len))
5341 return -1;
5342
5343 return 0;
5344}
5345
5346static int
5347dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
5348 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
5349{
5350 SSL_HMACgcry_md_hd_t hm;
5351 int md;
5352 uint32_t len;
5353 uint8_t buf[DIGEST_MAX_SIZE48];
5354 int16_t temp;
5355
5356 int ver = ssl->session.version;
5357 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
5358
5359 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5360 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
5361 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5362
5363 if (ssl_hmac_init(&hm,md) != 0)
5364 return -1;
5365 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5366 return -1;
5367
5368 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
5369
5370 if (is_cid && !ssl->session.deprecated_cid) {
5371 /* hash seq num placeholder */
5372 memset(buf,0xFF,8);
5373 ssl_hmac_update(&hm,buf,8);
5374
5375 /* hash content type + cid length + content type */
5376 buf[0]=ct;
5377 buf[1]=cidl;
5378 buf[2]=ct;
5379 ssl_hmac_update(&hm,buf,3);
5380
5381 /* hash version */
5382 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5383 memcpy(buf, &temp, 2);
5384 ssl_hmac_update(&hm,buf,2);
5385
5386 /* hash sequence number */
5387 phton64(buf, decoder->seq);
5388 buf[0]=decoder->epoch>>8;
5389 buf[1]=(uint8_t)decoder->epoch;
5390 ssl_hmac_update(&hm,buf,8);
5391
5392 /* hash cid */
5393 ssl_hmac_update(&hm,cid,cidl);
5394 } else {
5395 /* hash sequence number */
5396 phton64(buf, decoder->seq);
5397 buf[0]=decoder->epoch>>8;
5398 buf[1]=(uint8_t)decoder->epoch;
5399 ssl_hmac_update(&hm,buf,8);
5400
5401 /* hash content type */
5402 buf[0]=ct;
5403 ssl_hmac_update(&hm,buf,1);
5404
5405 /* hash version */
5406 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5407 memcpy(buf, &temp, 2);
5408 ssl_hmac_update(&hm,buf,2);
5409
5410 if (is_cid && ssl->session.deprecated_cid) {
5411 /* hash cid */
5412 ssl_hmac_update(&hm,cid,cidl);
5413
5414 /* hash cid length */
5415 buf[0] = cidl;
5416 ssl_hmac_update(&hm,buf,1);
5417 }
5418 }
5419
5420 /* data length and data */
5421 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5422 memcpy(buf, &temp, 2);
5423 ssl_hmac_update(&hm,buf,2);
5424 ssl_hmac_update(&hm,data,datalen);
5425
5426 /* get digest and digest len */
5427 len = sizeof(buf);
5428 ssl_hmac_final(&hm,buf,&len);
5429 ssl_hmac_cleanup(&hm);
5430 ssl_print_data("Mac", buf, len);
5431 if(memcmp(mac,buf,len))
5432 return -1;
5433
5434 return 0;
5435}
5436/* Decryption integrity check }}} */
5437
5438
5439static bool_Bool
5440tls_decrypt_aead_record(SslDecryptSession *ssl, SslDecoder *decoder,
5441 uint8_t ct, uint16_t record_version,
5442 bool_Bool ignore_mac_failed,
5443 const unsigned char *in, uint16_t inl,
5444 const unsigned char *cid, uint8_t cidl,
5445 StringInfo *out_str, unsigned *outl)
5446{
5447 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
5448 * GenericAEADCipher: { nonce_explicit, [content] }
5449 * In TLS 1.3 this explicit nonce is gone.
5450 * With AES GCM/CCM, "[content]" is actually the concatenation of the
5451 * ciphertext and authentication tag.
5452 */
5453 const uint16_t version = ssl->session.version;
5454 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
5455 gcry_error_t err;
5456 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
5457 unsigned ciphertext_len, auth_tag_len;
5458 unsigned char nonce[12];
5459 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
5460 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
5461 const uint8_t draft_version = ssl->session.tls13_draft_version;
5462 const unsigned char *auth_tag_wire;
5463 unsigned char auth_tag_calc[16];
5464 unsigned char *aad = NULL((void*)0);
5465 unsigned aad_len = 0;
5466
5467 switch (cipher_mode) {
5468 case MODE_GCM:
5469 case MODE_CCM:
5470 case MODE_POLY1305:
5471 auth_tag_len = 16;
5472 break;
5473 case MODE_CCM_8:
5474 auth_tag_len = 8;
5475 break;
5476 default:
5477 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
5478 return false0;
5479 }
5480
5481 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
5482 if (is_v12 && cipher_mode != MODE_POLY1305) {
5483 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
5484 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
5485 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
5486 return false0;
5487 }
5488 explicit_nonce = in;
5489 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
5490 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
5491 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5492 if (inl < auth_tag_len) {
5493 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
5494 return false0;
5495 }
5496 ciphertext = in;
5497 ciphertext_len = inl - auth_tag_len;
5498 } else {
5499 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
5500 return false0;
5501 }
5502 auth_tag_wire = ciphertext + ciphertext_len;
5503
5504 /*
5505 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
5506 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
5507 */
5508 if (is_v12 && cipher_mode != MODE_POLY1305) {
5509 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5509, "decoder->write_iv.data_len == 4"))))
;
5510 /* Implicit (4) and explicit (8) part of nonce. */
5511 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
5512 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
5513
5514 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5515 /*
5516 * Technically the nonce length must be at least 8 bytes, but for
5517 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5518 */
5519 const unsigned nonce_len = 12;
5520 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5520, "decoder->write_iv.data_len == nonce_len"
))))
;
5521 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5522 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5523 phton64(nonce + nonce_len - 8, pntoh64(nonce + nonce_len - 8) ^ decoder->seq);
5524 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5525 }
5526
5527 /* Set nonce and additional authentication data */
5528 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0)
;
5529 ssl_print_data("nonce", nonce, 12);
5530 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5531 if (err) {
5532 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5533 return false0;
5534 }
5535
5536 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5537 if (is_cid) { /* if connection ID */
5538 if (ssl->session.deprecated_cid) {
5539 aad_len = 14 + cidl;
5540 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5541 phton64(aad, decoder->seq); /* record sequence number */
5542 phton16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5543 aad[8] = ct; /* TLSCompressed.type */
5544 phton16(aad + 9, record_version); /* TLSCompressed.version */
5545 memcpy(aad + 11, cid, cidl); /* cid */
5546 aad[11 + cidl] = cidl; /* cid_length */
5547 phton16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5548 } else {
5549 aad_len = 23 + cidl;
5550 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5551 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5552 aad[8] = ct; /* TLSCompressed.type */
5553 aad[9] = cidl; /* cid_length */
5554 aad[10] = ct; /* TLSCompressed.type */
5555 phton16(aad + 11, record_version); /* TLSCompressed.version */
5556 phton64(aad + 13, decoder->seq); /* record sequence number */
5557 phton16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5558 memcpy(aad + 21, cid, cidl); /* cid */
5559 phton16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5560 }
5561 } else if (is_v12) {
5562 aad_len = 13;
5563 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5564 phton64(aad, decoder->seq); /* record sequence number */
5565 if (version == DTLSV1DOT2_VERSION0xfefd) {
5566 phton16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5567 }
5568 aad[8] = ct; /* TLSCompressed.type */
5569 phton16(aad + 9, record_version); /* TLSCompressed.version */
5570 phton16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5571 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5572 aad_len = decoder->dtls13_aad.data_len;
5573 aad = decoder->dtls13_aad.data;
5574 } else if (draft_version >= 25 || draft_version == 0) {
5575 aad_len = 5;
5576 aad = wmem_alloc(wmem_packet_scope(), aad_len);
5577 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5578 phton16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5579 phton16(aad + 3, inl); /* TLSCiphertext.length */
5580 }
5581
5582 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5583 /* size of plaintext, additional authenticated data and auth tag. */
5584 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5585
5586 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5587 }
5588
5589 if (aad && aad_len > 0) {
5590 ssl_print_data("AAD", aad, aad_len);
5591 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5592 if (err) {
5593 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5594 return false0;
5595 }
5596 }
5597
5598 /* Decrypt now that nonce and AAD are set. */
5599 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5600 if (err) {
5601 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5602 return false0;
5603 }
5604
5605 /* Check authentication tag for authenticity (replaces MAC) */
5606 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5607 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5608 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5609 } else {
5610 if (err) {
5611 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5612 } else {
5613 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5614 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5615 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5616 }
5617 if (ignore_mac_failed) {
5618 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5619 } else {
5620 return false0;
5621 }
5622 }
5623
5624 /*
5625 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5626 * after successful authentication to ensure that early data is skipped when
5627 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5628 */
5629 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5630 decoder->seq++;
5631 }
5632
5633 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5634 *outl = ciphertext_len;
5635 return true1;
5636}
5637
5638/* Record decryption glue based on security parameters {{{ */
5639/* Assume that we are called only for a non-NULL decoder which also means that
5640 * we have a non-NULL decoder->cipher_suite. */
5641int
5642ssl_decrypt_record(SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5643 bool_Bool ignore_mac_failed,
5644 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5645 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5646{
5647 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5648 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5649
5650 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5651 ssl_print_data("Ciphertext",in, inl);
5652
5653 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5654 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5655 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5656 return -1;
5657 }
5658
5659 /* ensure we have enough storage space for decrypted data */
5660 if (inl > out_str->data_len)
5661 {
5662 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5663 inl + 32, out_str->data_len);
5664 ssl_data_realloc(out_str, inl + 32);
5665 }
5666
5667 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5668 * a separate MAC, so use a different routine for simplicity. */
5669 if (decoder->cipher_suite->mode == MODE_GCM ||
5670 decoder->cipher_suite->mode == MODE_CCM ||
5671 decoder->cipher_suite->mode == MODE_CCM_8 ||
5672 decoder->cipher_suite->mode == MODE_POLY1305 ||
5673 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5674 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5675
5676 if (!tls_decrypt_aead_record(ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5677 /* decryption failed */
5678 return -1;
5679 }
5680
5681 goto skip_mac;
5682 }
5683
5684 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5685 * (notation: { unencrypted, [ encrypted ] })
5686 * GenericStreamCipher: { [content, mac] }
5687 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5688 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5689 * GenericAEADCipher: { nonce_explicit, [content] }
5690 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5691 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5692 */
5693
5694 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5695
5696 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5697 if (decoder->cipher_suite->mode == MODE_CBC) {
5698 unsigned blocksize = 0;
5699
5700 switch (ssl->session.version) {
5701 case TLSV1DOT1_VERSION0x302:
5702 case TLSV1DOT2_VERSION0x303:
5703 case DTLSV1DOT0_VERSION0xfeff:
5704 case DTLSV1DOT2_VERSION0xfefd:
5705 case DTLSV1DOT3_VERSION0xfefc:
5706 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5707 case TLCPV1_VERSION0x101:
5708 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5709 if (inl < blocksize) {
5710 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5711 inl, blocksize);
5712 return -1;
5713 }
5714 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5715 if (pad != 0) {
5716 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5717 gcry_strsource (pad), gcry_strerror (pad));
5718 }
5719
5720 inl -= blocksize;
5721 in += blocksize;
5722 break;
5723 }
5724
5725 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5726 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5727 /*
5728 * MAC is calculated over (IV + ) ENCRYPTED contents:
5729 *
5730 * MAC(MAC_write_key, ... +
5731 * IV + // for TLS 1.1 or greater
5732 * TLSCiphertext.enc_content);
5733 */
5734 if (inl < maclen) {
5735 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5736 G_STRFUNC((const char*) (__func__)), inl, maclen);
5737 return -1;
5738 }
5739 inl -= maclen;
5740 mac = (uint8_t *)in + inl;
5741 mac_frag = (uint8_t *)in - blocksize;
5742 mac_fraglen = blocksize + inl;
5743 }
5744 }
5745
5746 /* First decrypt*/
5747 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5748 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5749 gcry_strerror (pad));
5750 return -1;
5751 }
5752
5753 ssl_print_data("Plaintext", out_str->data, inl);
5754 worklen=inl;
5755
5756
5757 /* strip padding for GenericBlockCipher */
5758 if (decoder->cipher_suite->mode == MODE_CBC) {
5759 if (inl < 1) { /* Should this check happen earlier? */
5760 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5761 return -1;
5762 }
5763 pad=out_str->data[inl-1];
5764 if (worklen <= pad) {
5765 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5766 pad, worklen);
5767 return -1;
5768 }
5769 worklen-=(pad+1);
5770 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5771 pad, worklen);
5772 }
5773
5774 /* MAC for GenericStreamCipher and GenericBlockCipher.
5775 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5776 if (!mac) {
5777 /*
5778 * MAC is calculated over the DECRYPTED contents:
5779 *
5780 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5781 */
5782 if (worklen < maclen) {
5783 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5784 return -1;
5785 }
5786 worklen -= maclen;
5787 mac = out_str->data + worklen;
5788 mac_frag = out_str->data;
5789 mac_fraglen = worklen;
5790 }
5791
5792 /* If NULL encryption active and no keys are available, do not bother
5793 * checking the MAC. We do not have keys for that. */
5794 if (decoder->cipher_suite->mode == MODE_STREAM &&
5795 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5796 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5797 ssl_debug_printf("MAC check skipped due to missing keys\n");
5798 decoder->seq++; // Increment this for display
5799 goto skip_mac;
5800 }
5801
5802 /* Now check the MAC */
5803 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5804 worklen, ssl->session.version, ct, decoder->seq);
5805 if(ssl->session.version==SSLV3_VERSION0x300){
5806 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5807 if(ignore_mac_failed) {
5808 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5809 }
5810 else{
5811 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5812 return -1;
5813 }
5814 }
5815 else{
5816 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5817 }
5818 }
5819 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5820 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5821 if(ignore_mac_failed) {
5822 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5823 }
5824 else{
5825 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5826 return -1;
5827 }
5828 }
5829 else{
5830 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5831 }
5832 }
5833 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5834 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5835 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5836 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5837 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5838 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5839 }
5840 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5841 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5842 }
5843 else if(ignore_mac_failed) {
5844 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5845 }
5846 else{
5847 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5848 return -1;
5849 }
5850 }
5851skip_mac:
5852
5853 *outl = worklen;
5854
5855 if (decoder->compression > 0) {
5856 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5857 ssl_data_copy(comp_str, out_str);
5858 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5859 if (!decoder->decomp) {
5860 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5861 return -1;
5862 }
5863 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5864 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5865 *outl = uncomplen;
5866 }
5867
5868 return 0;
5869}
5870/* Record decryption glue based on security parameters }}} */
5871
5872
5873
5874#ifdef HAVE_LIBGNUTLS1
5875
5876/* RSA private key file processing {{{ */
5877static void
5878ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5879 gnutls_datum_t *subjectPublicKeyInfo)
5880{
5881 gnutls_pubkey_t pubkey = NULL((void*)0);
5882 cert_key_id_t key_id;
5883 size_t key_id_len = sizeof(key_id);
5884 int r;
5885
5886 if (!subjectPublicKeyInfo->size) {
5887 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5888 return;
5889 }
5890
5891 r = gnutls_pubkey_init(&pubkey);
5892 if (r < 0) {
5893 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5894 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5895 return;
5896 }
5897
5898 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5899 if (r < 0) {
5900 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5901 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5902 goto end;
5903 }
5904
5905 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5906 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5907 goto end;
5908 }
5909
5910 /* Generate a 20-byte SHA-1 hash. */
5911 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5912 if (r < 0) {
5913 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5914 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5915 goto end;
5916 }
5917
5918 if (key_id_len != sizeof(key_id)) {
5919 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5920 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5921 goto end;
5922 }
5923
5924 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5925 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)))
;
5926 *ssl->cert_key_id = key_id;
5927
5928end:
5929 gnutls_pubkey_deinit(pubkey);
5930}
5931
5932/* RSA private key file processing }}} */
5933#endif /* HAVE_LIBGNUTLS */
5934
5935/*--- Start of dissector-related code below ---*/
5936
5937/* get ssl data for this session. if no ssl data is found allocate a new one*/
5938SslDecryptSession *
5939ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle)
5940{
5941 void *conv_data;
5942 SslDecryptSession *ssl_session;
5943 int proto_ssl;
5944
5945 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5946 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5947 if (conv_data != NULL((void*)0))
5948 return (SslDecryptSession *)conv_data;
5949
5950 /* no previous SSL conversation info, initialize it. */
5951 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)))
;
5952
5953 /* data_len is the part that is meaningful, not the allocated length */
5954 ssl_session->master_secret.data_len = 0;
5955 ssl_session->master_secret.data = ssl_session->_master_secret;
5956 ssl_session->session_id.data_len = 0;
5957 ssl_session->session_id.data = ssl_session->_session_id;
5958 ssl_session->client_random.data_len = 0;
5959 ssl_session->client_random.data = ssl_session->_client_random;
5960 ssl_session->server_random.data_len = 0;
5961 ssl_session->server_random.data = ssl_session->_server_random;
5962 ssl_session->session_ticket.data_len = 0;
5963 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5964 ssl_session->server_data_for_iv.data_len = 0;
5965 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5966 ssl_session->client_data_for_iv.data_len = 0;
5967 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5968 ssl_session->app_data_segment.data = NULL((void*)0);
5969 ssl_session->app_data_segment.data_len = 0;
5970 ssl_session->handshake_data.data=NULL((void*)0);
5971 ssl_session->handshake_data.data_len=0;
5972 ssl_session->ech_transcript.data=NULL((void*)0);
5973 ssl_session->ech_transcript.data_len=0;
5974
5975 /* Initialize parameters which are not necessary specific to decryption. */
5976 ssl_session->session.version = SSL_VER_UNKNOWN0;
5977 clear_address(&ssl_session->session.srv_addr);
5978 ssl_session->session.srv_ptype = PT_NONE;
5979 ssl_session->session.srv_port = 0;
5980 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5981 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5982 ssl_session->session.client_random.data_len = 0;
5983 ssl_session->session.client_random.data = ssl_session->session._client_random;
5984 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5985 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5986 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5987 ssl_session->session.ech = FALSE(0);
5988 ssl_session->session.hrr_ech_declined = FALSE(0);
5989 ssl_session->session.first_ch_ech_frame = 0;
5990
5991 conversation_add_proto_data(conversation, proto_ssl, ssl_session);
5992 return ssl_session;
5993}
5994
5995void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5996{
5997 if (ssl) {
5998 /* Ensure that secrets are not restored using stale identifiers. Split
5999 * between client and server in case the packets somehow got out of order. */
6000 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
6001
6002 if (is_client) {
6003 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
6004 ssl->session_id.data_len = 0;
6005 ssl->session_ticket.data_len = 0;
6006 ssl->master_secret.data_len = 0;
6007 ssl->client_random.data_len = 0;
6008 ssl->has_early_data = false0;
6009 if (ssl->handshake_data.data_len > 0) {
6010 // The EMS handshake hash starts with at the Client Hello,
6011 // ensure that any messages before it are forgotten.
6012 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
6013 ssl->handshake_data.data = NULL((void*)0);
6014 ssl->handshake_data.data_len = 0;
6015 }
6016 } else {
6017 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
6018 ssl->server_random.data_len = 0;
6019 ssl->pre_master_secret.data_len = 0;
6020#ifdef HAVE_LIBGNUTLS1
6021 ssl->cert_key_id = NULL((void*)0);
6022#endif
6023 ssl->psk.data_len = 0;
6024 }
6025
6026 if (ssl->state & clear_flags) {
6027 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
6028 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
6029 ssl->state &= ~clear_flags;
6030 }
6031 }
6032
6033 /* These flags might be used for non-decryption purposes and may affect the
6034 * dissection, so reset them as well. */
6035 if (is_client) {
6036 session->client_cert_type = 0;
6037 } else {
6038 session->compression = 0;
6039 session->server_cert_type = 0;
6040 /* session->is_session_resumed is already handled in the ServerHello dissection. */
6041 }
6042 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
6043 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
6044}
6045
6046void
6047tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
6048 dissector_handle_t app_handle)
6049{
6050 conversation_t *conversation;
6051 SslSession *session;
6052
6053 /* Ignore if the TLS or other dissector is disabled. */
6054 if (!tls_handle || !app_handle)
6055 return;
6056
6057 conversation = find_or_create_conversation(pinfo);
6058 session = &ssl_get_session(conversation, tls_handle)->session;
6059 session->app_handle = app_handle;
6060}
6061
6062static uint32_t
6063ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
6064 dissector_handle_t app_handle, uint32_t last_nontls_frame)
6065{
6066 conversation_t *conversation;
6067 SslSession *session;
6068
6069 /* Ignore if the TLS dissector is disabled. */
6070 if (!tls_handle)
6071 return 0;
6072 /* The caller should always pass a valid handle to its own dissector. */
6073 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6073, "app_handle"))))
;
6074
6075 conversation = find_or_create_conversation(pinfo);
6076 session = &ssl_get_session(conversation, tls_handle)->session;
6077
6078 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6079 session->last_nontls_frame,
6080 (void *)session->app_handle,
6081 dissector_handle_get_dissector_name(session->app_handle));
6082 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6083 pinfo->num, (void *)app_handle,
6084 dissector_handle_get_dissector_name(app_handle));
6085
6086 /* Do not switch again if a dissector did it before. */
6087 if (session->last_nontls_frame) {
6088 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
6089 return session->last_nontls_frame;
6090 }
6091
6092 session->app_handle = app_handle;
6093 /* The TLS dissector should be called first for this conversation. */
6094 conversation_set_dissector(conversation, tls_handle);
6095 /* TLS starts after this frame. */
6096 session->last_nontls_frame = last_nontls_frame;
6097 return 0;
6098}
6099
6100/* ssl_starttls_ack: mark future frames as encrypted. */
6101uint32_t
6102ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6103 dissector_handle_t app_handle)
6104{
6105 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
6106}
6107
6108uint32_t
6109ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6110 dissector_handle_t app_handle)
6111{
6112 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
6113}
6114
6115dissector_handle_t
6116ssl_find_appdata_dissector(const char *name)
6117{
6118 /* Accept 'http' for backwards compatibility and sanity. */
6119 if (!strcmp(name, "http"))
6120 name = "http-over-tls";
6121 /* XXX - Should this check to see if the dissector is actually added for
6122 * Decode As in the appropriate table?
6123 */
6124 return find_dissector(name);
6125}
6126
6127/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
6128static int
6129ssl_equal (const void *v, const void *v2)
6130{
6131 const StringInfo *val1;
6132 const StringInfo *val2;
6133 val1 = (const StringInfo *)v;
6134 val2 = (const StringInfo *)v2;
6135
6136 if (val1->data_len == val2->data_len &&
6137 !memcmp(val1->data, val2->data, val2->data_len)) {
6138 return 1;
6139 }
6140 return 0;
6141}
6142
6143static unsigned
6144ssl_hash (const void *v)
6145{
6146 unsigned l,hash;
6147 const StringInfo* id;
6148 const unsigned* cur;
6149 hash = 0;
6150 id = (const StringInfo*) v;
6151
6152 /* id and id->data are mallocated in ssl_save_master_key(). As such 'data'
6153 * should be aligned for any kind of access (for example as a unsigned as
6154 * is done below). The intermediate void* cast is to prevent "cast
6155 * increases required alignment of target type" warnings on CPUs (such
6156 * as SPARCs) that do not allow misaligned memory accesses.
6157 */
6158 cur = (const unsigned*)(void*) id->data;
6159
6160 for (l=4; (l < id->data_len); l+=4, cur++)
6161 hash = hash ^ (*cur);
6162
6163 return hash;
6164}
6165/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
6166
6167/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
6168void
6169ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6170{
6171 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6171, "main_handle"))))
;
6172 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6172, "subdissector_handle"))))
;
6173 /* Registration is required for Export PDU feature to work properly. */
6174 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6175, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
6175 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6175, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
;
6176 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
6177
6178 if (port) {
6179 dissector_add_uint(dissector_table_name, port, subdissector_handle);
6180 if (tcp)
6181 dissector_add_uint("tcp.port", port, main_handle);
6182 else
6183 dissector_add_uint("udp.port", port, main_handle);
6184 dissector_add_uint("sctp.port", port, main_handle);
6185 } else {
6186 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
6187 }
6188}
6189
6190void
6191ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6192{
6193 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
6194 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
6195 if (main_handle) {
6196 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
6197 dissector_delete_uint("sctp.port", port, main_handle);
6198 }
6199
6200 if (port) {
6201 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
6202 }
6203}
6204
6205void
6206ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
6207{
6208 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
6209 session->srv_ptype = ptype;
6210 session->srv_port = port;
6211}
6212
6213int
6214ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
6215{
6216 int ret;
6217 if (session && session->srv_addr.type != AT_NONE) {
6218 ret = (session->srv_ptype == pinfo->ptype) &&
6219 (session->srv_port == pinfo->srcport) &&
6220 addresses_equal(&session->srv_addr, &pinfo->src);
6221 } else {
6222 ret = (dissector_get_uint_handle(table, pinfo->srcport) != 0);
6223 }
6224
6225 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
6226 return ret;
6227}
6228/* Handling of association between tls/dtls ports and clear text protocol. }}} */
6229
6230
6231/* Links SSL records with the real packet data. {{{ */
6232SslPacketInfo *
6233tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
6234{
6235 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6236 if (!pi) {
6237 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)))
;
6238 pi->srcport = pinfo->srcport;
6239 pi->destport = pinfo->destport;
6240 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
6241 }
6242
6243 return pi;
6244}
6245
6246/**
6247 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
6248 * avoid the need for a decoder in the second pass. Additionally, it remembers
6249 * sequence numbers (for reassembly and Follow TLS Stream).
6250 *
6251 * @param proto The protocol identifier (proto_ssl or proto_dtls).
6252 * @param pinfo The packet where the record originates from.
6253 * @param data Decrypted data to store in the record.
6254 * @param data_len Length of decrypted record data.
6255 * @param record_id The identifier for this record within the current packet.
6256 * @param flow Information about sequence numbers, etc.
6257 * @param type TLS Content Type (such as handshake or application_data).
6258 * @param curr_layer_num_ssl The layer identifier for this TLS session.
6259 */
6260void
6261ssl_add_record_info(int proto, packet_info *pinfo, const unsigned char *data, int data_len, int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl, uint64_t record_seq)
6262{
6263 SslRecordInfo* rec, **prec;
6264 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
6265
6266 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)))
;
6267 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), data, data_len);
6268 rec->data_len = data_len;
6269 rec->id = record_id;
6270 rec->type = type;
6271 rec->next = NULL((void*)0);
6272 rec->record_seq = record_seq;
6273
6274 if (flow && type == SSL_ID_APP_DATA) {
6275 rec->seq = flow->byte_seq;
6276 rec->flow = flow;
6277 flow->byte_seq += data_len;
6278 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
6279 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + data_len, (void*)flow);
6280 }
6281
6282 /* Remember decrypted records. */
6283 prec = &pi->records;
6284 while (*prec) prec = &(*prec)->next;
6285 *prec = rec;
6286}
6287
6288/* search in packet data for the specified id; return a newly created tvb for the associated data */
6289tvbuff_t*
6290ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
6291{
6292 SslRecordInfo* rec;
6293 SslPacketInfo* pi;
6294 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6295
6296 if (!pi)
6297 return NULL((void*)0);
6298
6299 for (rec = pi->records; rec; rec = rec->next)
6300 if (rec->id == record_id) {
6301 *matched_record = rec;
6302 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
6303 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->data_len, rec->data_len);
6304 }
6305
6306 return NULL((void*)0);
6307}
6308/* Links SSL records with the real packet data. }}} */
6309
6310/* initialize/reset per capture state data (ssl sessions cache). {{{ */
6311void
6312ssl_common_init(ssl_master_key_map_t *mk_map,
6313 StringInfo *decrypted_data, StringInfo *compressed_data)
6314{
6315 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
6316 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
6317 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
6318 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
6319 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
6320 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
6321 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6322 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6323 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6324 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6325 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6326 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6327
6328 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
6329 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
6330
6331 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
6332
6333 ssl_data_alloc(decrypted_data, 32);
6334 ssl_data_alloc(compressed_data, 32);
6335}
6336
6337void
6338ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
6339 StringInfo *decrypted_data, StringInfo *compressed_data)
6340{
6341 g_hash_table_destroy(mk_map->session);
6342 g_hash_table_destroy(mk_map->tickets);
6343 g_hash_table_destroy(mk_map->crandom);
6344 g_hash_table_destroy(mk_map->pre_master);
6345 g_hash_table_destroy(mk_map->pms);
6346 g_hash_table_destroy(mk_map->tls13_client_early);
6347 g_hash_table_destroy(mk_map->tls13_client_handshake);
6348 g_hash_table_destroy(mk_map->tls13_server_handshake);
6349 g_hash_table_destroy(mk_map->tls13_client_appdata);
6350 g_hash_table_destroy(mk_map->tls13_server_appdata);
6351 g_hash_table_destroy(mk_map->tls13_early_exporter);
6352 g_hash_table_destroy(mk_map->tls13_exporter);
6353
6354 g_hash_table_destroy(mk_map->ech_secret);
6355 g_hash_table_destroy(mk_map->ech_config);
6356
6357 g_hash_table_destroy(mk_map->used_crandom);
6358
6359 g_free(decrypted_data->data);
6360 g_free(compressed_data->data);
6361
6362 /* close the previous keylog file now that the cache are cleared, this
6363 * allows the cache to be filled with the full keylog file contents. */
6364 if (*ssl_keylog_file) {
6365 fclose(*ssl_keylog_file);
6366 *ssl_keylog_file = NULL((void*)0);
6367 }
6368}
6369/* }}} */
6370
6371/* parse ssl related preferences (private keys and ports association strings) */
6372#if defined(HAVE_LIBGNUTLS1)
6373/* Load a single RSA key file item from preferences. {{{ */
6374void
6375ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
6376{
6377 gnutls_x509_privkey_t x509_priv_key;
6378 gnutls_privkey_t priv_key = NULL((void*)0);
6379 FILE* fp = NULL((void*)0);
6380 int ret;
6381 size_t key_id_len = 20;
6382 unsigned char *key_id = NULL((void*)0);
6383 char *err = NULL((void*)0);
6384 dissector_handle_t handle;
6385 /* try to load keys file first */
6386 fp = ws_fopenfopen(uats->keyfile, "rb");
6387 if (!fp) {
6388 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
6389 return;
6390 }
6391
6392 if ((int)strlen(uats->password) == 0) {
6393 x509_priv_key = rsa_load_pem_key(fp, &err);
6394 } else {
6395 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
6396 }
6397 fclose(fp);
6398
6399 if (!x509_priv_key) {
6400 if (err) {
6401 report_failure("Can't load private key from %s: %s",
6402 uats->keyfile, err);
6403 g_free(err);
6404 } else
6405 report_failure("Can't load private key from %s: unknown error",
6406 uats->keyfile);
6407 return;
6408 }
6409 if (err) {
6410 report_failure("Load of private key from %s \"succeeded\" with error %s",
6411 uats->keyfile, err);
6412 g_free(err);
6413 }
6414
6415 gnutls_privkey_init(&priv_key);
6416 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6417 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6418 if (ret < 0) {
6419 report_failure("Can't convert private key %s: %s",
6420 uats->keyfile, gnutls_strerror(ret));
6421 goto end;
6422 }
6423
6424 key_id = (unsigned char *) g_malloc0(key_id_len);
6425 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6426 if (ret < 0) {
6427 report_failure("Can't calculate public key ID for %s: %s",
6428 uats->keyfile, gnutls_strerror(ret));
6429 goto end;
6430 }
6431 ssl_print_data("KeyID", key_id, key_id_len);
6432 if (key_id_len != 20) {
6433 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6434 uats->keyfile, key_id_len);
6435 goto end;
6436 }
6437
6438 g_hash_table_replace(key_hash, key_id, priv_key);
6439 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6440 priv_key = NULL((void*)0);
6441 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6442
6443 handle = ssl_find_appdata_dissector(uats->protocol);
6444 if (handle) {
6445 /* Port to subprotocol mapping */
6446 uint16_t port = 0;
6447 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6448 if (port > 0) {
6449 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6450 port, uats->keyfile, uats->password);
6451
6452 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6453 }
6454 } else {
6455 if (strcmp(uats->port, "start_tls"))
6456 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6457 }
6458 }
6459
6460end:
6461 gnutls_x509_privkey_deinit(x509_priv_key);
6462 gnutls_privkey_deinit(priv_key);
6463 g_free(key_id);
6464}
6465/* }}} */
6466#endif
6467
6468
6469/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6470/** store a known (pre-)master secret into cache */
6471static void
6472ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6473 StringInfo *mk)
6474{
6475 StringInfo *ht_key, *master_secret;
6476
6477 if (key->data_len == 0) {
6478 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6479 return;
6480 }
6481
6482 if (mk->data_len == 0) {
6483 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6484 G_STRFUNC((const char*) (__func__)), label);
6485 return;
6486 }
6487
6488 /* ssl_hash() depends on session_ticket->data being aligned for unsigned access
6489 * so be careful in changing how it is allocated. */
6490 ht_key = ssl_data_clone(key);
6491 master_secret = ssl_data_clone(mk);
6492 g_hash_table_insert(ht, ht_key, master_secret);
6493
6494 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6495 ssl_print_string("stored key", ht_key);
6496 ssl_print_string("stored (pre-)master secret", master_secret);
6497}
6498
6499/** restore a (pre-)master secret given some key in the cache */
6500static bool_Bool
6501ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6502 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6503{
6504 StringInfo *ms;
6505
6506 if (key->data_len == 0) {
6507 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6508 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6509 return false0;
6510 }
6511
6512 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6513 if (!ms) {
6514 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6515 is_pre_master ? "pre-" : "", label);
6516 return false0;
6517 }
6518
6519 /* (pre)master secret found, clear knowledge of other keys and set it in the
6520 * current conversation */
6521 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6522 SSL_HAVE_SESSION_KEY(1<<3));
6523 if (is_pre_master) {
6524 /* unlike master secret, pre-master secret has a variable size (48 for
6525 * RSA, varying for PSK) and is therefore not statically allocated */
6526 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6527 ms->data_len);
6528 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6529 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6530 } else {
6531 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6532 ssl->state |= SSL_MASTER_SECRET(1<<5);
6533 }
6534 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6535 is_pre_master ? "pre-" : "", label);
6536 ssl_print_string(label, key);
6537 ssl_print_string("(pre-)master secret", ms);
6538 return true1;
6539}
6540/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6541
6542/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6543 * the decoder should be attempted to be initialized. {{{*/
6544void
6545ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6546{
6547 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
6548 /* TLS 1.3 implementations only provide secrets derived from the master
6549 * secret which are loaded in tls13_change_key. No master secrets can be
6550 * loaded here, so just return. */
6551 return;
6552 }
6553 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6554 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
6555 ssl_debug_printf(" session key already available, nothing to do.\n");
6556 return;
6557 }
6558 if (!(ssl->state & SSL_CIPHER(1<<2))) {
6559 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6560 return;
6561 }
6562
6563 /* for decryption, there needs to be a master secret (which can be derived
6564 * from pre-master secret). If missing, try to pick a master key from cache
6565 * (an earlier packet in the capture or key logfile). */
6566 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6567 !ssl_restore_master_key(ssl, "Session ID", false0,
6568 mk_map->session, &ssl->session_id) &&
6569 (!ssl->session.is_session_resumed ||
6570 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6571 mk_map->tickets, &ssl->session_ticket)) &&
6572 !ssl_restore_master_key(ssl, "Client Random", false0,
6573 mk_map->crandom, &ssl->client_random)) {
6574 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6575 /* how unfortunate, the master secret could not be found */
6576 ssl_debug_printf(" Cannot find master secret\n");
6577 return;
6578 } else {
6579 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6580 "because of a NULL cipher\n");
6581 }
6582 }
6583
6584 if (ssl_generate_keyring_material(ssl) < 0) {
6585 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6586 return;
6587 }
6588 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6589 ssl_save_master_key("Client Random", mk_map->crandom,
6590 &ssl->client_random, &ssl->master_secret);
6591 ssl_save_master_key("Session ID", mk_map->session,
6592 &ssl->session_id, &ssl->master_secret);
6593 /* Only save the new secrets if the server sent the ticket. The client
6594 * ticket might have become stale. */
6595 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6596 ssl_save_master_key("Session Ticket", mk_map->tickets,
6597 &ssl->session_ticket, &ssl->master_secret);
6598 }
6599} /* }}} */
6600
6601/* Load the traffic key secret from the keylog file. */
6602StringInfo *
6603tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6604 bool_Bool is_from_server, TLSRecordType type)
6605{
6606 GHashTable *key_map;
6607 const char *label;
6608
6609 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6610 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6611 return NULL((void*)0);
6612 }
6613
6614 if (ssl->client_random.data_len == 0) {
6615 /* May happen if Hello message is missing and Finished is found. */
6616 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6617 return NULL((void*)0);
6618 }
6619
6620 switch (type) {
6621 case TLS_SECRET_0RTT_APP:
6622 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6622, "!is_from_server"))))
;
6623 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6624 key_map = mk_map->tls13_client_early;
6625 break;
6626 case TLS_SECRET_HANDSHAKE:
6627 if (is_from_server) {
6628 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6629 key_map = mk_map->tls13_server_handshake;
6630 } else {
6631 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6632 key_map = mk_map->tls13_client_handshake;
6633 }
6634 break;
6635 case TLS_SECRET_APP:
6636 if (is_from_server) {
6637 label = "SERVER_TRAFFIC_SECRET_0";
6638 key_map = mk_map->tls13_server_appdata;
6639 } else {
6640 label = "CLIENT_TRAFFIC_SECRET_0";
6641 key_map = mk_map->tls13_client_appdata;
6642 }
6643 break;
6644 default:
6645 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6645, __func__, "assertion \"not reached\" failed")
;
6646 }
6647
6648 /* Transitioning to new keys, mark old ones as unusable. */
6649 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6650 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6651
6652 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6653 if (!secret) {
6654 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6655 /* Disable decryption, the keys are invalid. */
6656 if (is_from_server) {
6657 ssl->server = NULL((void*)0);
6658 } else {
6659 ssl->client = NULL((void*)0);
6660 }
6661 return NULL((void*)0);
6662 }
6663
6664 /* TLS 1.3 secret found, set new keys. */
6665 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6666 ssl_print_string("Client Random", &ssl->client_random);
6667 ssl_print_string(label, secret);
6668 return secret;
6669}
6670
6671/* Load the new key. */
6672void
6673tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6674 bool_Bool is_from_server, TLSRecordType type)
6675{
6676 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6677 /*
6678 * QUIC does not use the TLS record layer for message protection.
6679 * The required keys will be extracted later by QUIC.
6680 */
6681 return;
6682 }
6683
6684 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6685 if (!secret) {
6686 if (type != TLS_SECRET_HANDSHAKE) {
6687 return;
6688 }
6689 /*
6690 * Workaround for when for some reason we don't have the handshake
6691 * secret but do have the application traffic secret. (#20240)
6692 * If we can't find the handshake secret, we'll never decrypt the
6693 * Finished message, so we won't know when to change to the app
6694 * traffic key, so we do so now.
6695 */
6696 type = TLS_SECRET_APP;
6697 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6698 if (!secret) {
6699 return;
6700 }
6701 }
6702
6703 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6704 /*
6705 * Remember the application traffic secret to support Key Update. The
6706 * other secrets cannot be used for this purpose, so free them.
6707 */
6708 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6709 StringInfo *app_secret = &decoder->app_traffic_secret;
6710 if (type == TLS_SECRET_APP) {
6711 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6712 app_secret->data,
6713 secret->data_len);
6714 ssl_data_set(app_secret, secret->data, secret->data_len);
6715 } else {
6716 wmem_free(wmem_file_scope(), app_secret->data);
6717 app_secret->data = NULL((void*)0);
6718 app_secret->data_len = 0;
6719 }
6720 }
6721}
6722
6723/**
6724 * Update to next application data traffic secret for TLS 1.3. The previous
6725 * secret should have been set by tls13_change_key.
6726 */
6727void
6728tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6729{
6730 /* RFC 8446 Section 7.2:
6731 * application_traffic_secret_N+1 =
6732 * HKDF-Expand-Label(application_traffic_secret_N,
6733 * "traffic upd", "", Hash.length)
6734 *
6735 * Both application_traffic_secret_N are of the same length (Hash.length).
6736 */
6737 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6738 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6739 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6740 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6741
6742 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6743 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6744 return;
6745 }
6746
6747 /*
6748 * Previous traffic secret is available, so find the hash function,
6749 * expand the new traffic secret and generate new keys.
6750 */
6751 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6752 int hash_algo = ssl_get_digest_by_name(hash_name);
6753 const unsigned hash_len = app_secret->data_len;
6754 unsigned char *new_secret;
6755 const char *label = "traffic upd";
6756 if (tls13_draft_version && tls13_draft_version < 20) {
6757 label = "application traffic secret";
6758 }
6759 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6760 tls13_hkdf_label_prefix(ssl),
6761 label, hash_len, &new_secret)) {
6762 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6763 return;
6764 }
6765 ssl_data_set(app_secret, new_secret, hash_len);
6766 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6767 /*
6768 * Remember the application traffic secret on the new decoder to
6769 * support another Key Update.
6770 */
6771 decoder = is_from_server ? ssl->server : ssl->client;
6772 app_secret = &decoder->app_traffic_secret;
6773 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6774 app_secret->data,
6775 hash_len);
6776 ssl_data_set(app_secret, new_secret, hash_len);
6777 }
6778 wmem_free(NULL((void*)0), new_secret);
6779}
6780
6781void
6782tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6783{
6784 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6785 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6786 }
6787}
6788
6789/** SSL keylog file handling. {{{ */
6790
6791static GRegex *
6792ssl_compile_keyfile_regex(void)
6793{
6794#define OCTET "(?:[[:xdigit:]]{2})"
6795 const char *pattern =
6796 "(?:"
6797 /* Matches Client Hellos having this Client Random */
6798 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6799 /* Matches first part of encrypted RSA pre-master secret */
6800 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6801 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6802 but it can be of any length for DHE */
6803 ")(?<pms>" OCTET "+)"
6804 "|(?:"
6805 /* Matches Server Hellos having a Session ID */
6806 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6807 /* Matches Client Hellos having this Client Random */
6808 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6809 /* Master-Secret is given, its length is fixed */
6810 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6811 "|(?"
6812 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6813 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6814 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6815 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6816 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6817 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6818 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6819 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6820 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6821 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6822 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6823 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6824 ") (?<derived_secret>" OCTET "+)";
6825#undef OCTET
6826 static GRegex *regex = NULL((void*)0);
6827 GError *gerr = NULL((void*)0);
6828
6829 if (!regex) {
6830 regex = g_regex_new(pattern,
6831 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6832 G_REGEX_MATCH_ANCHORED, &gerr);
6833 if (gerr) {
6834 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6835 gerr->message);
6836 g_error_free(gerr);
6837 regex = NULL((void*)0);
6838 }
6839 }
6840
6841 return regex;
6842}
6843
6844typedef struct ssl_master_key_match_group {
6845 const char *re_group_name;
6846 GHashTable *master_key_ht;
6847} ssl_master_key_match_group_t;
6848
6849void
6850tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6851{
6852 ssl_master_key_match_group_t mk_groups[] = {
6853 { "encrypted_pmk", mk_map->pre_master },
6854 { "session_id", mk_map->session },
6855 { "client_random", mk_map->crandom },
6856 { "client_random_pms", mk_map->pms },
6857 /* TLS 1.3 map from Client Random to derived secret. */
6858 { "client_early", mk_map->tls13_client_early },
6859 { "client_handshake", mk_map->tls13_client_handshake },
6860 { "server_handshake", mk_map->tls13_server_handshake },
6861 { "client_appdata", mk_map->tls13_client_appdata },
6862 { "server_appdata", mk_map->tls13_server_appdata },
6863 { "early_exporter", mk_map->tls13_early_exporter },
6864 { "exporter", mk_map->tls13_exporter },
6865 { "ech_secret", mk_map->ech_secret },
6866 { "ech_config", mk_map->ech_config },
6867 };
6868
6869 /* The format of the file is a series of records with one of the following formats:
6870 * - "RSA xxxx yyyy"
6871 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6872 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6873 * (this is the original format introduced with bug 4349)
6874 *
6875 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6876 * Where xxxx is the SSL session ID (hex-encoded)
6877 * Where yyyy is the cleartext master secret (hex-encoded)
6878 * (added to support openssl s_client Master-Key output)
6879 * This is somewhat is a misnomer because there's nothing RSA specific
6880 * about this.
6881 *
6882 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6883 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6884 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6885 * (This format allows SSL connections to be decrypted, if a user can
6886 * capture the PMS but could not recover the MS for a specific session
6887 * with a SSL Server.)
6888 *
6889 * - "CLIENT_RANDOM xxxx yyyy"
6890 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6891 * Where yyyy is the cleartext master secret (hex-encoded)
6892 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6893 * ECDHE-RSA.)
6894 *
6895 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6896 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6897 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6898 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6899 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6900 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6901 * - "EXPORTER_SECRET xxxx yyyy"
6902 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6903 * Where yyyy is the secret (hex-encoded) derived from the early,
6904 * handshake or master secrets. (This format is introduced with TLS 1.3
6905 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6906 */
6907 GRegex *regex = ssl_compile_keyfile_regex();
6908 if (!regex)
6909 return;
6910
6911 const char *next_line = (const char *)data;
6912 const char *line_end = next_line + datalen;
6913 while (next_line && next_line < line_end) {
6914 const char *line = next_line;
6915 next_line = (const char *)memchr(line, '\n', line_end - line);
6916 ssize_t linelen;
6917
6918 if (next_line) {
6919 linelen = next_line - line;
6920 next_line++; /* drop LF */
6921 } else {
6922 linelen = (ssize_t)(line_end - line);
6923 }
6924 if (linelen > 0 && line[linelen - 1] == '\r') {
6925 linelen--; /* drop CR */
6926 }
6927
6928 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6929 GMatchInfo *mi;
6930 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6931 char *hex_key, *hex_pre_ms_or_ms;
6932 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
6933 StringInfo *pre_ms_or_ms = NULL((void*)0);
6934 GHashTable *ht = NULL((void*)0);
6935
6936 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6937 * otherwise we will use the Master Secret
6938 */
6939 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6940 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6941 g_free(hex_pre_ms_or_ms);
6942 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6943 }
6944 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6945 g_free(hex_pre_ms_or_ms);
6946 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6947 }
6948 /* There is always a match, otherwise the regex is wrong. */
6949 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6949, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))))
;
6950
6951 /* convert from hex to bytes and save to hashtable */
6952 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
6953 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6954 g_free(hex_pre_ms_or_ms);
6955
6956 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6957 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6958 ssl_master_key_match_group_t *g = &mk_groups[i];
6959 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6960 if (hex_key && *hex_key) {
6961 ssl_debug_printf(" matched %s\n", g->re_group_name);
6962 ht = g->master_key_ht;
6963 from_hex(key, hex_key, strlen(hex_key));
6964 g_free(hex_key);
6965 break;
6966 }
6967 g_free(hex_key);
6968 }
6969 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6969, "ht"))))
; /* Cannot be reached, or regex is wrong. */
6970
6971 g_hash_table_insert(ht, key, pre_ms_or_ms);
6972
6973 } else if (linelen > 0 && line[0] != '#') {
6974 ssl_debug_printf(" unrecognized line\n");
6975 }
6976 /* always free match info even if there is no match. */
6977 g_match_info_free(mi);
6978 }
6979}
6980
6981void
6982ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6983 const ssl_master_key_map_t *mk_map)
6984{
6985 /* no need to try if no key log file is configured. */
6986 if (!tls_keylog_filename || !*tls_keylog_filename) {
6987 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6988 G_STRFUNC((const char*) (__func__)));
6989 return;
6990 }
6991
6992 /* Validate regexes before even trying to use it. */
6993 if (!ssl_compile_keyfile_regex()) {
6994 return;
6995 }
6996
6997 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6998
6999 /* if the keylog file was deleted/overwritten, re-open it */
7000 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
7001 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
7002 fclose(*keylog_file);
7003 *keylog_file = NULL((void*)0);
7004 }
7005
7006 if (*keylog_file == NULL((void*)0)) {
7007 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
7008 if (!*keylog_file) {
7009 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
7010 return;
7011 }
7012 }
7013
7014 for (;;) {
7015 char buf[1110], *line;
7016 line = fgets(buf, sizeof(buf), *keylog_file);
7017 if (!line) {
7018 if (feof(*keylog_file)) {
7019 /* Ensure that newly appended keys can be read in the future. */
7020 clearerr(*keylog_file);
7021 } else if (ferror(*keylog_file)) {
7022 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
7023 fclose(*keylog_file);
7024 *keylog_file = NULL((void*)0);
7025 }
7026 break;
7027 }
7028 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
7029 }
7030}
7031/** SSL keylog file handling. }}} */
7032
7033#ifdef SSL_DECRYPT_DEBUG /* {{{ */
7034
7035static FILE* ssl_debug_file;
7036
7037void
7038ssl_set_debug(const char* name)
7039{
7040 static int debug_file_must_be_closed;
7041 int use_stderr;
7042
7043 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
7044
7045 if (debug_file_must_be_closed)
7046 fclose(ssl_debug_file);
7047
7048 if (use_stderr)
7049 ssl_debug_file = stderrstderr;
7050 else if (!name || (strcmp(name, "") ==0))
7051 ssl_debug_file = NULL((void*)0);
7052 else
7053 ssl_debug_file = ws_fopenfopen(name, "w");
7054
7055 if (!use_stderr && ssl_debug_file)
7056 debug_file_must_be_closed = 1;
7057 else
7058 debug_file_must_be_closed = 0;
7059
7060 ssl_debug_printf("Wireshark SSL debug log \n\n");
7061#ifdef HAVE_LIBGNUTLS1
7062 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
7063#endif
7064 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
7065 ssl_debug_printf("\n");
7066}
7067
7068void
7069ssl_debug_flush(void)
7070{
7071 if (ssl_debug_file)
7072 fflush(ssl_debug_file);
7073}
7074
7075void
7076ssl_debug_printf(const char* fmt, ...)
7077{
7078 va_list ap;
7079
7080 if (!ssl_debug_file)
7081 return;
7082
7083 va_start(ap, fmt)__builtin_va_start(ap, fmt);
7084 vfprintf(ssl_debug_file, fmt, ap);
7085 va_end(ap)__builtin_va_end(ap);
7086}
7087
7088void
7089ssl_print_data(const char* name, const unsigned char* data, size_t len)
7090{
7091 size_t i, j, k;
7092 if (!ssl_debug_file)
7093 return;
7094 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
7095 for (i=0; i<len; i+=16) {
7096 fprintf(ssl_debug_file,"| ");
7097 for (j=i, k=0; k<16 && j<len; ++j, ++k)
7098 fprintf(ssl_debug_file,"%.2x ",data[j]);
7099 for (; k<16; ++k)
7100 fprintf(ssl_debug_file," ");
7101 fputc('|', ssl_debug_file);
7102 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
7103 unsigned char c = data[j];
7104 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
7105 fputc(c, ssl_debug_file);
7106 }
7107 for (; k<16; ++k)
7108 fputc(' ', ssl_debug_file);
7109 fprintf(ssl_debug_file,"|\n");
7110 }
7111}
7112
7113void
7114ssl_print_string(const char* name, const StringInfo* data)
7115{
7116 ssl_print_data(name, data->data, data->data_len);
7117}
7118#endif /* SSL_DECRYPT_DEBUG }}} */
7119
7120/* UAT preferences callbacks. {{{ */
7121/* checks for SSL and DTLS UAT key list fields */
7122
7123bool_Bool
7124ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7125{
7126 // This should be removed in favor of Decode As. Make it optional.
7127 *err = NULL((void*)0);
7128 return true1;
7129}
7130
7131bool_Bool
7132ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7133{
7134 if (!p || strlen(p) == 0u) {
7135 // This should be removed in favor of Decode As. Make it optional.
7136 *err = NULL((void*)0);
7137 return true1;
7138 }
7139
7140 if (strcmp(p, "start_tls") != 0){
7141 uint16_t port;
7142 if (!ws_strtou16(p, NULL((void*)0), &port)) {
7143 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
7144 return false0;
7145 }
7146 }
7147
7148 *err = NULL((void*)0);
7149 return true1;
7150}
7151
7152bool_Bool
7153ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7154{
7155 ws_statb64struct stat st;
7156
7157 if (!p || strlen(p) == 0u) {
7158 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
7159 return false0;
7160 } else {
7161 if (ws_stat64stat(p, &st) != 0) {
7162 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p)
;
7163 return false0;
7164 }
7165 }
7166
7167 *err = NULL((void*)0);
7168 return true1;
7169}
7170
7171bool_Bool
7172ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
7173{
7174#if defined(HAVE_LIBGNUTLS1)
7175 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
7176 FILE *fp = NULL((void*)0);
7177
7178 if (p && (strlen(p) > 0u)) {
7179 fp = ws_fopenfopen(f->keyfile, "rb");
7180 if (fp) {
7181 char *msg = NULL((void*)0);
7182 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
7183 if (!priv_key) {
7184 fclose(fp);
7185 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg)
;
7186 g_free(msg);
7187 return false0;
7188 }
7189 g_free(msg);
7190 gnutls_x509_privkey_deinit(priv_key);
7191 fclose(fp);
7192 } else {
7193 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
)
;
7194 return false0;
7195 }
7196 }
7197
7198 *err = NULL((void*)0);
7199 return true1;
7200#else
7201 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
)
;
7202 return false0;
7203#endif
7204}
7205/* UAT preferences callbacks. }}} */
7206
7207/** maximum size of ssl_association_info() string */
7208#define SSL_ASSOC_MAX_LEN8192 8192
7209
7210typedef struct ssl_association_info_callback_data
7211{
7212 char *str;
7213 const char *table_protocol;
7214} ssl_association_info_callback_data_t;
7215
7216/**
7217 * callback function used by ssl_association_info() to traverse the SSL associations.
7218 */
7219static void
7220ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
7221{
7222 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
7223 const int l = (const int)strlen(data->str);
7224 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
7225}
7226
7227/**
7228 * @return an information string on the SSL protocol associations. The string must be freed.
7229 */
7230char*
7231ssl_association_info(const char* dissector_table_name, const char* table_protocol)
7232{
7233 ssl_association_info_callback_data_t data;
7234
7235 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
7236 data.table_protocol = table_protocol;
7237 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
7238 return data.str;
7239}
7240
7241
7242/** Begin of code related to dissection of wire data. */
7243
7244/* Helpers for dissecting Variable-Length Vectors. {{{ */
7245bool_Bool
7246ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7247 unsigned offset, unsigned offset_end, uint32_t *ret_length,
7248 int hf_length, uint32_t min_value, uint32_t max_value)
7249{
7250 unsigned veclen_size;
7251 uint32_t veclen_value;
7252 proto_item *pi;
7253
7254 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 7254, (uint64_t)min_value, (uint64_t)max_value))))
;
7255 if (offset > offset_end) {
7256 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
7257 "Vector offset is past buffer end offset (%u > %u)",
7258 offset, offset_end);
7259 *ret_length = 0;
7260 return false0; /* Cannot read length. */
7261 }
7262
7263 if (max_value > 0xffffff) {
7264 veclen_size = 4;
7265 } else if (max_value > 0xffff) {
7266 veclen_size = 3;
7267 } else if (max_value > 0xff) {
7268 veclen_size = 2;
7269 } else {
7270 veclen_size = 1;
7271 }
7272
7273 if (offset_end - offset < veclen_size) {
7274 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7275 tvb, offset, offset_end - offset,
7276 "No more room for vector of length %u",
7277 veclen_size);
7278 *ret_length = 0;
7279 return false0; /* Cannot read length. */
7280 }
7281
7282 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
7283 offset += veclen_size;
7284
7285 if (veclen_value < min_value) {
7286 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7287 "Vector length %u is smaller than minimum %u",
7288 veclen_value, min_value);
7289 } else if (veclen_value > max_value) {
7290 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7291 "Vector length %u is larger than maximum %u",
7292 veclen_value, max_value);
7293 }
7294
7295 if (offset_end - offset < veclen_value) {
7296 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
7297 "Vector length %u is too large, truncating it to %u",
7298 veclen_value, offset_end - offset);
7299 *ret_length = offset_end - offset;
7300 return false0; /* Length is truncated to avoid overflow. */
7301 }
7302
7303 *ret_length = veclen_value;
7304 return true1; /* Length is OK. */
7305}
7306
7307bool_Bool
7308ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7309 unsigned offset, unsigned offset_end)
7310{
7311 if (offset < offset_end) {
7312 unsigned trailing = offset_end - offset;
7313 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7314 tvb, offset, trailing,
7315 "%u trailing byte%s unprocessed",
7316 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7317 return false0; /* unprocessed data warning */
7318 } else if (offset > offset_end) {
7319 /*
7320 * Returned offset runs past the end. This should not happen and is
7321 * possibly a dissector bug.
7322 */
7323 unsigned excess = offset - offset_end;
7324 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7325 tvb, offset_end, excess,
7326 "Dissector processed too much data (%u byte%s)",
7327 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7328 return false0; /* overflow error */
7329 }
7330
7331 return true1; /* OK, offset matches. */
7332}
7333/** }}} */
7334
7335
7336static uint32_t
7337ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7338 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7339 uint16_t version, int hf_sig_len, int hf_sig);
7340
7341/* change_cipher_spec(20) dissection */
7342void
7343ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7344 packet_info *pinfo, proto_tree *tree,
7345 uint32_t offset, SslSession *session,
7346 bool_Bool is_from_server,
7347 const SslDecryptSession *ssl)
7348{
7349 /*
7350 * struct {
7351 * enum { change_cipher_spec(1), (255) } type;
7352 * } ChangeCipherSpec;
7353 */
7354 proto_item *ti;
7355 proto_item_set_text(tree,
7356 "%s Record Layer: %s Protocol: Change Cipher Spec",
7357 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7358 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7359 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7360
7361 if (session->version == TLSV1DOT3_VERSION0x304) {
7362 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7363 return;
7364 }
7365
7366 /* Remember frame number of first CCS */
7367 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7368 if (*ccs_frame == 0)
7369 *ccs_frame = pinfo->num;
7370
7371 /* Use heuristics to detect an abbreviated handshake, assume that missing
7372 * ServerHelloDone implies reusing previously negotiating keys. Then when
7373 * a Session ID or ticket is present, it must be a resumed session.
7374 * Normally this should be done at the Finished message, but that may be
7375 * encrypted so we do it here, at the last cleartext message. */
7376 if (is_from_server && ssl) {
7377 if (session->is_session_resumed) {
7378 const char *resumed = NULL((void*)0);
7379 if (ssl->session_ticket.data_len) {
7380 resumed = "Session Ticket";
7381 } else if (ssl->session_id.data_len) {
7382 resumed = "Session ID";
7383 }
7384 if (resumed) {
7385 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7386 } else {
7387 /* Can happen if the capture somehow starts in the middle */
7388 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7389 }
7390 } else {
7391 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7392 }
7393 }
7394 if (is_from_server && session->is_session_resumed)
7395 expert_add_info(pinfo, ti, &hf->ei.resumed);
7396}
7397
7398/** Begin of handshake(22) record dissections */
7399
7400/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7401 * {{{ */
7402static void
7403tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7404{
7405 uint32_t sighash, hashalg, sigalg;
7406 proto_item *ti_sigalg;
7407 proto_tree *sigalg_tree;
7408
7409 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7410 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7411 if (ja4_data) {
7412 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7413 }
7414
7415 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7416
7417 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7418 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7419 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7420 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7421 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7422
7423 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7424 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7425 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7426 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7427 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7428 sighash);
7429 }
7430} /* }}} */
7431
7432/* dissect a list of hash algorithms, return the number of bytes dissected
7433 this is used for the signature algorithms extension and for the
7434 TLS1.2 certificate request. {{{ */
7435static int
7436ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7437 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7438{
7439 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7440 * struct {
7441 * HashAlgorithm hash;
7442 * SignatureAlgorithm signature;
7443 * } SignatureAndHashAlgorithm;
7444 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7445 */
7446 proto_tree *subtree;
7447 proto_item *ti;
7448 unsigned sh_alg_length;
7449 uint32_t next_offset;
7450
7451 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7452 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7453 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7454 return offset_end;
7455 }
7456 offset += 2;
7457 next_offset = offset + sh_alg_length;
7458
7459 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7460 "Signature Hash Algorithms (%u algorithm%s)",
7461 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7462 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7463
7464 while (offset + 2 <= next_offset) {
7465 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7466 offset += 2;
7467 }
7468
7469 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7470 offset = next_offset;
7471 }
7472
7473 return offset;
7474} /* }}} */
7475
7476/* Dissection of DistinguishedName (for CertificateRequest and
7477 * certificate_authorities extension). {{{ */
7478static uint32_t
7479tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7480 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7481{
7482 proto_item *ti;
7483 proto_tree *subtree;
7484 uint32_t dnames_length, next_offset;
7485 asn1_ctx_t asn1_ctx;
7486 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7487
7488 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7489 /* DistinguishedName certificate_authorities<0..2^16-1> */
7490 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7491 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7492 return offset_end;
7493 }
7494 offset += 2;
7495 next_offset = offset + dnames_length;
7496
7497 if (dnames_length > 0) {
7498 ti = proto_tree_add_none_format(tree,
7499 hf->hf.hs_dnames,
7500 tvb, offset, dnames_length,
7501 "Distinguished Names (%d byte%s)",
7502 dnames_length,
7503 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7504 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7505
7506 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7507
7508 while (offset < next_offset) {
7509 /* get the length of the current certificate */
7510 uint32_t name_length;
7511
7512 if (dnames_count-- == 0) {
7513 /* stop adding to tree when the list is considered too large
7514 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7515 Note: dnames_count must be set low enough not to hit the
7516 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7517 */
7518 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7519 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7520 proto_item_set_generated(ti);
7521 return next_offset;
7522 }
7523
7524 /* opaque DistinguishedName<1..2^16-1> */
7525 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7526 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7527 return next_offset;
7528 }
7529 offset += 2;
7530
7531 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7532 subtree, hf->hf.hs_dname);
7533 offset += name_length;
7534 }
7535 }
7536 return offset;
7537} /* }}} */
7538
7539
7540/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7541static int
7542ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7543 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7544{
7545 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7546}
7547
7548static int
7549ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7550 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7551{
7552 if (hnd_type == SSL_HND_CLIENT_HELLO) {
7553 /*
7554 * struct {
7555 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7556 * } SignatureSchemeList;
7557 */
7558
7559 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7560 } else {
7561 asn1_ctx_t asn1_ctx;
7562 unsigned pubkey_length, sign_length;
7563
7564 /*
7565 * struct {
7566 * uint32 valid_time;
7567 * SignatureScheme expected_cert_verify_algorithm;
7568 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7569 * } Credential;
7570 *
7571 * struct {
7572 * Credential cred;
7573 * SignatureScheme algorithm;
7574 * opaque signature<0..2^16-1>;
7575 * } DelegatedCredential;
7576 */
7577
7578 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7579
7580 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7581 offset += 4;
7582
7583 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7584 offset += 2;
7585
7586 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7587 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7588 return offset_end;
7589 }
7590 offset += 3;
7591 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7592 offset += pubkey_length;
7593
7594 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7595 offset += 2;
7596
7597 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7598 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7599 return offset_end;
7600 }
7601 offset += 2;
7602 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7603 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7604 offset += sign_length;
7605
7606 return offset;
7607 }
7608}
7609
7610static int
7611ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7612 packet_info *pinfo, proto_tree *tree,
7613 uint32_t offset, uint32_t offset_end,
7614 uint8_t hnd_type)
7615{
7616
7617 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7618
7619 switch (hnd_type) {
7620 case SSL_HND_CLIENT_HELLO: {
7621 proto_tree *alps_tree;
7622 proto_item *ti;
7623 uint32_t next_offset, alps_length, name_length;
7624
7625 /*
7626 * opaque ProtocolName<1..2^8-1>;
7627 * struct {
7628 * ProtocolName supported_protocols<2..2^16-1>
7629 * } ApplicationSettingsSupport;
7630 */
7631
7632 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7633 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7634 return offset_end;
7635 }
7636 offset += 2;
7637 next_offset = offset + alps_length;
7638
7639 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7640 tvb, offset, alps_length, ENC_NA0x00000000);
7641 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7642
7643 /* Parse list (note missing check for end of vector, ssl_add_vector below
7644 * ensures that data is always available.) */
7645 while (offset < next_offset) {
7646 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7647 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7648 return next_offset;
7649 }
7650 offset++;
7651
7652 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7653 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7654 offset += name_length;
7655 }
7656
7657 return offset;
7658 }
7659 case SSL_HND_ENCRYPTED_EXTS:
7660 /* Opaque blob */
7661 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7662 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7663 break;
7664 }
7665
7666 return offset_end;
7667}
7668
7669static int
7670ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7671 packet_info *pinfo, proto_tree *tree,
7672 uint32_t offset, uint32_t offset_end,
7673 uint8_t hnd_type, SslSession *session,
7674 bool_Bool is_dtls, ja4_data_t *ja4_data)
7675{
7676
7677 /* https://tools.ietf.org/html/rfc7301#section-3.1
7678 * opaque ProtocolName<1..2^8-1>;
7679 * struct {
7680 * ProtocolName protocol_name_list<2..2^16-1>
7681 * } ProtocolNameList;
7682 */
7683 proto_tree *alpn_tree;
7684 proto_item *ti;
7685 uint32_t next_offset, alpn_length, name_length;
7686 uint8_t *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7687
7688 /* ProtocolName protocol_name_list<2..2^16-1> */
7689 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7690 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7691 return offset_end;
7692 }
7693 offset += 2;
7694 next_offset = offset + alpn_length;
7695
7696 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7697 tvb, offset, alpn_length, ENC_NA0x00000000);
7698 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7699
7700 /* Parse list (note missing check for end of vector, ssl_add_vector below
7701 * ensures that data is always available.) */
7702 while (offset < next_offset) {
7703 /* opaque ProtocolName<1..2^8-1> */
7704 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7705 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7706 return next_offset;
7707 }
7708 offset++;
7709
7710 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7711 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7712 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7713 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7714 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7715 if ((g_ascii_isprint(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_PRINT
) != 0)
) && g_ascii_isprint(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_PRINT
) != 0)
) {
7716 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7717 }
7718 else {
7719 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7720 alpn_last_char & 0x0F);
7721 }
7722 }
7723 /* Remember first ALPN ProtocolName entry for server. */
7724 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7725 /* '\0'-terminated string for dissector table match and prefix
7726 * comparison purposes. */
7727 proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7728 name_length, ENC_ASCII0x00000000);
7729 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7730 client_proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7731 name_length, ENC_ASCII0x00000000);
7732 }
7733 offset += name_length;
7734 }
7735
7736 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7737 * exactly one "ProtocolName". */
7738 if (proto_name) {
7739 dissector_handle_t handle;
7740
7741 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7742
7743 if (is_dtls) {
7744 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7745 proto_name);
7746 } else {
7747 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7748 proto_name);
7749 if (handle == NULL((void*)0)) {
7750 /* Try prefix matching */
7751 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0]))
; i++) {
7752 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7753
7754 /* string_string is inappropriate as it compares strings
7755 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7756 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )
) {
7757 handle = find_dissector(alpn_proto->dissector_name);
7758 break;
7759 }
7760 }
7761 }
7762 }
7763 if (handle != NULL((void*)0)) {
7764 /* ProtocolName match, so set the App data dissector handle.
7765 * This may override protocols given via the UAT dialog, but
7766 * since the ALPN hint is precise, do it anyway. */
7767 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7768 (void *)session->app_handle,
7769 (void *)handle,
7770 dissector_handle_get_dissector_name(handle));
7771 session->app_handle = handle;
7772 }
7773 } else if (client_proto_name) {
7774 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7775 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7776 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7777 }
7778
7779 return offset;
7780}
7781
7782static int
7783ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7784 packet_info *pinfo, proto_tree *tree,
7785 uint32_t offset, uint32_t offset_end)
7786{
7787 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7788 * The "extension_data" field of a "next_protocol_negotiation" extension
7789 * in a "ServerHello" contains an optional list of protocols advertised
7790 * by the server. Protocols are named by opaque, non-empty byte strings
7791 * and the list of protocols is serialized as a concatenation of 8-bit,
7792 * length prefixed byte strings. Implementations MUST ensure that the
7793 * empty string is not included and that no byte strings are truncated.
7794 */
7795 uint32_t npn_length;
7796 proto_tree *npn_tree;
7797
7798 /* List is optional, do not add tree if there are no entries. */
7799 if (offset == offset_end) {
7800 return offset;
7801 }
7802
7803 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7804
7805 while (offset < offset_end) {
7806 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7807 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7808 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7809 return offset_end;
7810 }
7811 offset++;
7812
7813 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7814 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7815 offset += npn_length;
7816 }
7817
7818 return offset;
7819}
7820
7821static int
7822ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7823 packet_info *pinfo, proto_tree *tree,
7824 uint32_t offset, uint32_t offset_end)
7825{
7826 /* https://tools.ietf.org/html/rfc5746#section-3.2
7827 * struct {
7828 * opaque renegotiated_connection<0..255>;
7829 * } RenegotiationInfo;
7830 *
7831 */
7832 proto_tree *reneg_info_tree;
7833 uint32_t reneg_info_length;
7834
7835 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7836
7837 /* opaque renegotiated_connection<0..255> */
7838 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7839 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7840 return offset_end;
7841 }
7842 offset++;
7843
7844 if (reneg_info_length > 0) {
7845 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7846 offset += reneg_info_length;
7847 }
7848
7849 return offset;
7850}
7851
7852static int
7853ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7854 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7855 const char **group_name_out)
7856{
7857 /* RFC 8446 Section 4.2.8
7858 * struct {
7859 * NamedGroup group;
7860 * opaque key_exchange<1..2^16-1>;
7861 * } KeyShareEntry;
7862 */
7863 uint32_t key_exchange_length, group;
7864 proto_tree *ks_tree;
7865
7866 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7867
7868 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7869 offset += 2;
7870 const char *group_name = val_to_str(group, ssl_extension_curves, "Unknown (%u)");
7871 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7872 if (group_name_out) {
7873 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff)))
? group_name : NULL((void*)0);
7874 }
7875
7876 /* opaque key_exchange<1..2^16-1> */
7877 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7878 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7879 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7880 }
7881 offset += 2;
7882 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7883 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7884
7885 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7886 offset += key_exchange_length;
7887
7888 return offset;
7889}
7890
7891static int
7892ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7893 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7894 uint8_t hnd_type)
7895{
7896 proto_tree *key_share_tree;
7897 uint32_t next_offset;
7898 uint32_t client_shares_length;
7899 uint32_t group;
7900 const char *group_name = NULL((void*)0);
7901
7902 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7903 return offset;
7904 }
7905
7906 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7907
7908 switch(hnd_type){
7909 case SSL_HND_CLIENT_HELLO:
7910 /* KeyShareEntry client_shares<0..2^16-1> */
7911 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7912 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7913 return offset_end;
7914 }
7915 offset += 2;
7916 next_offset = offset + client_shares_length;
7917 const char *sep = " ";
7918 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7919 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7920 if (group_name) {
7921 proto_item_append_text(tree, "%s%s", sep, group_name);
7922 sep = ", ";
7923 }
7924 }
7925 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7926 return next_offset;
7927 }
7928 break;
7929 case SSL_HND_SERVER_HELLO:
7930 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7931 if (group_name) {
7932 proto_item_append_text(tree, " %s", group_name);
7933 }
7934 break;
7935 case SSL_HND_HELLO_RETRY_REQUEST:
7936 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7937 offset += 2;
7938 group_name = val_to_str(group, ssl_extension_curves, "Unknown (%u)");
7939 proto_item_append_text(tree, " %s", group_name);
7940 break;
7941 default: /* no default */
7942 break;
7943 }
7944
7945 return offset;
7946}
7947
7948static int
7949ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7950 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7951 uint8_t hnd_type)
7952{
7953 /* RFC 8446 Section 4.2.11
7954 * struct {
7955 * opaque identity<1..2^16-1>;
7956 * uint32 obfuscated_ticket_age;
7957 * } PskIdentity;
7958 * opaque PskBinderEntry<32..255>;
7959 * struct {
7960 * select (Handshake.msg_type) {
7961 * case client_hello:
7962 * PskIdentity identities<7..2^16-1>;
7963 * PskBinderEntry binders<33..2^16-1>;
7964 * case server_hello:
7965 * uint16 selected_identity;
7966 * };
7967 * } PreSharedKeyExtension;
7968 */
7969
7970 proto_tree *psk_tree;
7971
7972 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7973
7974 switch (hnd_type){
7975 case SSL_HND_CLIENT_HELLO: {
7976 uint32_t identities_length, identities_end, binders_length;
7977
7978 /* PskIdentity identities<7..2^16-1> */
7979 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7980 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7981 return offset_end;
7982 }
7983 offset += 2;
7984 identities_end = offset + identities_length;
7985
7986 while (offset < identities_end) {
7987 uint32_t identity_length;
7988 proto_tree *identity_tree;
7989
7990 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7991
7992 /* opaque identity<1..2^16-1> */
7993 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7994 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7995 return identities_end;
7996 }
7997 offset += 2;
7998 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7999
8000 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
8001 offset += identity_length;
8002
8003 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8004 offset += 4;
8005
8006 proto_item_set_len(identity_tree, 2 + identity_length + 4);
8007 }
8008 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
8009 offset = identities_end;
8010 }
8011
8012 /* PskBinderEntry binders<33..2^16-1> */
8013 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
8014 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
8015 return offset_end;
8016 }
8017 offset += 2;
8018
8019 proto_item *binders_item;
8020 proto_tree *binders_tree;
8021 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
8022 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
8023 uint32_t binders_end = offset + binders_length;
8024 while (offset < binders_end) {
8025 uint32_t binder_length;
8026 proto_item *binder_item;
8027 proto_tree *binder_tree;
8028
8029 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
8030 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
8031
8032 /* opaque PskBinderEntry<32..255>; */
8033 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
8034 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
8035 return binders_end;
8036 }
8037 offset += 1;
8038 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
8039
8040 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
8041 offset += binder_length;
8042
8043 proto_item_set_end(binder_item, tvb, offset);
8044 }
8045 }
8046 break;
8047 case SSL_HND_SERVER_HELLO: {
8048 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8049 offset += 2;
8050 }
8051 break;
8052 default:
8053 break;
8054 }
8055
8056 return offset;
8057}
8058
8059static uint32_t
8060ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
8061 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
8062 uint8_t hnd_type, SslDecryptSession *ssl)
8063{
8064 /* RFC 8446 Section 4.2.10
8065 * struct {} Empty;
8066 * struct {
8067 * select (Handshake.msg_type) {
8068 * case new_session_ticket: uint32 max_early_data_size;
8069 * case client_hello: Empty;
8070 * case encrypted_extensions: Empty;
8071 * };
8072 * } EarlyDataIndication;
8073 */
8074 switch (hnd_type) {
8075 case SSL_HND_CLIENT_HELLO:
8076 /* Remember that early_data will follow the handshake. */
8077 if (ssl) {
8078 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
8079 ssl->has_early_data = true1;
8080 }
8081 break;
8082 case SSL_HND_NEWSESSION_TICKET:
8083 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8084 offset += 4;
8085 break;
8086 default:
8087 break;
8088 }
8089 return offset;
8090}
8091
8092static uint16_t
8093tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
8094{
8095 if (draft_version) {
8096 *draft_version = 0;
8097 }
8098 if (!is_dtls) {
8099 uint8_t tls13_draft = extract_tls13_draft_version(version);
8100 if (tls13_draft != 0) {
8101 /* This is TLS 1.3 (a draft version). */
8102 if (draft_version) {
8103 *draft_version = tls13_draft;
8104 }
8105 version = TLSV1DOT3_VERSION0x304;
8106 }
8107 if (version == 0xfb17 || version == 0xfb1a) {
8108 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
8109 tls13_draft = (uint8_t)version;
8110 if (draft_version) {
8111 *draft_version = tls13_draft;
8112 }
8113 version = TLSV1DOT3_VERSION0x304;
8114 }
8115 }
8116
8117 switch (version) {
8118 case SSLV3_VERSION0x300:
8119 case TLSV1_VERSION0x301:
8120 case TLSV1DOT1_VERSION0x302:
8121 case TLSV1DOT2_VERSION0x303:
8122 case TLSV1DOT3_VERSION0x304:
8123 case TLCPV1_VERSION0x101:
8124 if (is_dtls)
8125 return SSL_VER_UNKNOWN0;
8126 break;
8127
8128 case DTLSV1DOT0_VERSION0xfeff:
8129 case DTLSV1DOT0_OPENSSL_VERSION0x100:
8130 case DTLSV1DOT2_VERSION0xfefd:
8131 case DTLSV1DOT3_VERSION0xfefc:
8132 if (!is_dtls)
8133 return SSL_VER_UNKNOWN0;
8134 break;
8135
8136 default: /* invalid version number */
8137 return SSL_VER_UNKNOWN0;
8138 }
8139
8140 return version;
8141}
8142
8143static int
8144ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8145 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8146 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
8147{
8148
8149 /* RFC 8446 Section 4.2.1
8150 * struct {
8151 * ProtocolVersion versions<2..254>; // ClientHello
8152 * } SupportedVersions;
8153 * Note that ServerHello and HelloRetryRequest are handled by the caller.
8154 */
8155 uint32_t versions_length, next_offset;
8156 /* ProtocolVersion versions<2..254> */
8157 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
8158 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
8159 return offset_end;
8160 }
8161 offset++;
8162 next_offset = offset + versions_length;
8163
8164 unsigned version;
8165 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
8166 uint8_t draft_version, max_draft_version = 0;
8167 const char *sep = " ";
8168 while (offset + 2 <= next_offset) {
8169 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
8170 offset += 2;
8171
8172 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8173 proto_item_append_text(tree, "%s%s", sep, val_to_str(version, ssl_versions, "Unknown (0x%04x)"));
8174 sep = ", ";
8175 }
8176
8177 current_version = tls_try_get_version(is_dtls, version, &draft_version);
8178 if (session->version == SSL_VER_UNKNOWN0) {
8179 if (lowest_version == SSL_VER_UNKNOWN0) {
8180 lowest_version = current_version;
8181 } else if (current_version != SSL_VER_UNKNOWN0) {
8182 if (!is_dtls) {
8183 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version))
;
8184 } else {
8185 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version))
;
8186 }
8187 }
8188 }
8189 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version))
;
8190 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8191 /* The DTLS version numbers get mapped to "00" for unknown per
8192 * JA4 spec, but if JA4 ever does support DTLS we'll probably
8193 * need to take the MIN instead of MAX here for DTLS.
8194 */
8195 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version))
;
8196 }
8197 }
8198 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
8199 col_set_str(pinfo->cinfo, COL_PROTOCOL,
8200 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
8201 }
8202 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
8203 offset = next_offset;
8204 }
8205
8206 /* XXX remove this when draft 19 support is dropped,
8207 * this is only required for early data decryption. */
8208 if (max_draft_version) {
8209 session->tls13_draft_version = max_draft_version;
8210 }
8211
8212 return offset;
8213}
8214
8215static int
8216ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8217 packet_info *pinfo, proto_tree *tree,
8218 uint32_t offset, uint32_t offset_end)
8219{
8220 /* RFC 8446 Section 4.2.2
8221 * struct {
8222 * opaque cookie<1..2^16-1>;
8223 * } Cookie;
8224 */
8225 uint32_t cookie_length;
8226 /* opaque cookie<1..2^16-1> */
8227 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
8228 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
8229 return offset_end;
8230 }
8231 offset += 2;
8232
8233 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
8234 offset += cookie_length;
8235
8236 return offset;
8237}
8238
8239static int
8240ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8241 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8242{
8243 /* RFC 8446 Section 4.2.9
8244 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
8245 *
8246 * struct {
8247 * PskKeyExchangeMode ke_modes<1..255>;
8248 * } PskKeyExchangeModes;
8249 */
8250 uint32_t ke_modes_length, next_offset;
8251
8252 /* PskKeyExchangeMode ke_modes<1..255> */
8253 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
8254 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
8255 return offset_end;
8256 }
8257 offset++;
8258 next_offset = offset + ke_modes_length;
8259
8260 while (offset < next_offset) {
8261 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
8262 offset++;
8263 }
8264
8265 return offset;
8266}
8267
8268static uint32_t
8269ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8270 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8271{
8272 /* RFC 8446 Section 4.2.4
8273 * opaque DistinguishedName<1..2^16-1>;
8274 * struct {
8275 * DistinguishedName authorities<3..2^16-1>;
8276 * } CertificateAuthoritiesExtension;
8277 */
8278 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
8279}
8280
8281static int
8282ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8283 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8284{
8285 /* RFC 8446 Section 4.2.5
8286 * struct {
8287 * opaque certificate_extension_oid<1..2^8-1>;
8288 * opaque certificate_extension_values<0..2^16-1>;
8289 * } OIDFilter;
8290 * struct {
8291 * OIDFilter filters<0..2^16-1>;
8292 * } OIDFilterExtension;
8293 */
8294 proto_tree *subtree;
8295 uint32_t filters_length, oid_length, values_length, value_offset;
8296 asn1_ctx_t asn1_ctx;
8297 const char *oid, *name;
8298
8299 /* OIDFilter filters<0..2^16-1> */
8300 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8301 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8302 return offset_end;
8303 }
8304 offset += 2;
8305 offset_end = offset + filters_length;
8306
8307 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8308
8309 while (offset < offset_end) {
8310 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8311 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8312
8313 /* opaque certificate_extension_oid<1..2^8-1> */
8314 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8315 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8316 return offset_end;
8317 }
8318 offset++;
8319 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8320 hf->hf.hs_ext_oid_filters_oid, &oid);
8321 offset += oid_length;
8322
8323 /* Append OID to tree label */
8324 name = oid_resolved_from_string(pinfo->pool, oid);
8325 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8326
8327 /* opaque certificate_extension_values<0..2^16-1> */
8328 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8329 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8330 return offset_end;
8331 }
8332 offset += 2;
8333 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8334 if (values_length > 0) {
8335 value_offset = offset;
8336 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8337 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8338 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8339 }
8340 offset += values_length;
8341 }
8342
8343 return offset;
8344}
8345
8346static int
8347ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8348 packet_info *pinfo, proto_tree *tree,
8349 uint32_t offset, uint32_t offset_end)
8350{
8351 /* https://tools.ietf.org/html/rfc6066#section-3
8352 *
8353 * struct {
8354 * NameType name_type;
8355 * select (name_type) {
8356 * case host_name: HostName;
8357 * } name;
8358 * } ServerName;
8359 *
8360 * enum {
8361 * host_name(0), (255)
8362 * } NameType;
8363 *
8364 * opaque HostName<1..2^16-1>;
8365 *
8366 * struct {
8367 * ServerName server_name_list<1..2^16-1>
8368 * } ServerNameList;
8369 */
8370 proto_tree *server_name_tree;
8371 uint32_t list_length, server_name_length, next_offset;
8372
8373 /* The server SHALL include "server_name" extension with empty data. */
8374 if (offset == offset_end) {
8375 return offset;
8376 }
8377
8378 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8379
8380 /* ServerName server_name_list<1..2^16-1> */
8381 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8382 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8383 return offset_end;
8384 }
8385 offset += 2;
8386 next_offset = offset + list_length;
8387
8388 while (offset < next_offset) {
8389 uint32_t name_type;
8390 const uint8_t *server_name = NULL((void*)0);
8391 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8392 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8393 offset++;
8394
8395 /* opaque HostName<1..2^16-1> */
8396 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8397 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8398 return next_offset;
8399 }
8400 offset += 2;
8401
8402 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8403 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8404 pinfo->pool, &server_name);
8405 offset += server_name_length;
8406 // Each type must only occur once, so we don't check for duplicates.
8407 if (name_type == 0) {
8408 proto_item_append_text(tree, " name=%s", server_name);
8409 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8410
8411 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8412 // Client Hello: Client (Src) -> Server (Dst)
8413 switch (pinfo->dst.type) {
8414 case AT_IPv4:
8415 if (pinfo->dst.len == sizeof(uint32_t)) {
8416 add_ipv4_name(*(uint32_t *)pinfo->dst.data, server_name, false0);
8417 }
8418 break;
8419 case AT_IPv6:
8420 if (pinfo->dst.len == sizeof(ws_in6_addr)) {
8421 add_ipv6_name(pinfo->dst.data, server_name, false0);
8422 }
8423 break;
8424 }
8425 }
8426 }
8427 }
8428 return offset;
8429}
8430
8431static int
8432ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8433 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8434{
8435 unsigned ext_len = offset_end - offset;
8436 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8437 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8438 /* Save the Session Ticket such that it can be used as identifier for
8439 * restoring a previous Master Secret (in ChangeCipherSpec) */
8440 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8441 ssl->session_ticket.data, ext_len);
8442 ssl->session_ticket.data_len = ext_len;
8443 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8444 }
8445 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8446 tvb, offset, ext_len, ENC_NA0x00000000);
8447 return offset + ext_len;
8448}
8449
8450static int
8451ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8452 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8453 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8454{
8455 uint8_t cert_list_length;
8456 uint8_t cert_type;
8457 proto_tree *cert_list_tree;
8458 proto_item *ti;
8459
8460 switch(hnd_type){
8461 case SSL_HND_CLIENT_HELLO:
8462 cert_list_length = tvb_get_uint8(tvb, offset);
8463 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8464 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8465 offset += 1;
8466 if (offset_end - offset != (uint32_t)cert_list_length)
8467 return offset;
8468
8469 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8470 cert_list_length, cert_list_length);
8471 proto_item_append_text(ti, " (%d)", cert_list_length);
8472
8473 /* make this a subtree */
8474 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8475
8476 /* loop over all point formats */
8477 while (cert_list_length > 0)
8478 {
8479 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8480 offset++;
8481 cert_list_length--;
8482 }
8483 break;
8484 case SSL_HND_SERVER_HELLO:
8485 case SSL_HND_ENCRYPTED_EXTENSIONS:
8486 case SSL_HND_CERTIFICATE:
8487 cert_type = tvb_get_uint8(tvb, offset);
8488 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8489 offset += 1;
8490 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8491 session->client_cert_type = cert_type;
8492 }
8493 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8494 session->server_cert_type = cert_type;
8495 }
8496 break;
8497 default: /* no default */
8498 break;
8499 }
8500
8501 return offset;
8502}
8503
8504static uint32_t
8505ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8506 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8507 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8508{
8509 uint32_t compress_certificate_algorithms_length, next_offset;
8510
8511 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8512 * enum {
8513 * zlib(1),
8514 * brotli(2),
8515 * (65535)
8516 * } CertificateCompressionAlgorithm;
8517 *
8518 * struct {
8519 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8520 * } CertificateCompressionAlgorithms;
8521 */
8522 switch (hnd_type) {
8523 case SSL_HND_CLIENT_HELLO:
8524 case SSL_HND_CERT_REQUEST:
8525 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8526 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8527 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8528 return offset_end;
8529 }
8530 offset += 1;
8531 next_offset = offset + compress_certificate_algorithms_length;
8532
8533 while (offset < next_offset) {
8534 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8535 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8536 offset += 2;
8537 }
8538 break;
8539 default:
8540 break;
8541 }
8542
8543 return offset;
8544}
8545
8546static uint32_t
8547ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8548 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8549 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8550{
8551 uint32_t key_parameters_length, next_offset;
8552 proto_item *p_ti;
8553 proto_tree *p_tree;
8554
8555 /* RFC 8472
8556 *
8557 * struct {
8558 * uint8 major;
8559 * uint8 minor;
8560 * } TB_ProtocolVersion;
8561 *
8562 * enum {
8563 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8564 * } TokenBindingKeyParameters;
8565 *
8566 * struct {
8567 * TB_ProtocolVersion token_binding_version;
8568 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8569 * } TokenBindingParameters;
8570 */
8571
8572 switch (hnd_type) {
8573 case SSL_HND_CLIENT_HELLO:
8574 case SSL_HND_SERVER_HELLO:
8575 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8576 offset += 1;
8577 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8578 offset += 1;
8579
8580 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8581 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8582 return offset_end;
8583 }
8584 offset += 1;
8585 next_offset = offset + key_parameters_length;
8586
8587 p_ti = proto_tree_add_none_format(tree,
8588 hf->hf.hs_ext_token_binding_key_parameters,
8589 tvb, offset, key_parameters_length,
8590 "Key parameters identifiers (%d identifier%s)",
8591 key_parameters_length,
8592 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8593 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8594
8595 while (offset < next_offset) {
8596 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8597 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8598 offset += 1;
8599 }
8600
8601 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8602 offset = next_offset;
8603 }
8604
8605 break;
8606 default:
8607 break;
8608 }
8609
8610 return offset;
8611}
8612
8613static uint32_t
8614ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8615 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8616 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8617{
8618 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8619 uint32_t next_offset;
8620
8621 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8622 *
8623 * Note: the following structures are not literally defined in the spec,
8624 * they instead use an ASCII diagram.
8625 *
8626 * struct {
8627 * uint16 id;
8628 * opaque value<0..2^16-1>;
8629 * } TransportParameter; // before draft -27
8630 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8631 *
8632 * struct {
8633 * opaque ipv4Address[4];
8634 * uint16 ipv4Port;
8635 * opaque ipv6Address[16];
8636 * uint16 ipv6Port;
8637 * opaque connectionId<0..18>;
8638 * opaque statelessResetToken[16];
8639 * } PreferredAddress;
8640 */
8641
8642 if (offset_end - offset >= 6 &&
8643 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8644 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8645 // Assume encoding of Transport Parameters draft -26 or older with at
8646 // least one transport parameter that has a valid length.
8647 use_varint_encoding = false0;
8648 }
8649
8650 if (use_varint_encoding) {
8651 next_offset = offset_end;
8652 } else {
8653 uint32_t quic_length;
8654 // Assume draft -26 or earlier.
8655 /* TransportParameter TransportParameters<0..2^16-1>; */
8656 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8657 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8658 return offset_end;
8659 }
8660 offset += 2;
8661 next_offset = offset + quic_length;
8662 }
8663
8664 while (offset < next_offset) {
8665 uint64_t parameter_type; /* 62-bit space */
8666 uint32_t parameter_length;
8667 proto_tree *parameter_tree;
8668 uint32_t parameter_end_offset;
8669 uint64_t value;
8670 uint32_t len = 0, i;
8671
8672 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8673 NULL((void*)0), "Parameter");
8674 /* TransportParameter ID and Length. */
8675 if (use_varint_encoding) {
8676 uint64_t parameter_length64;
8677 uint32_t type_len = 0;
8678
8679 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8680 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8681 offset += type_len;
8682
8683 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8684 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8685 parameter_length = (uint32_t)parameter_length64;
8686 offset += len;
8687
8688 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8689 } else {
8690 parameter_type = tvb_get_ntohs(tvb, offset);
8691 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8692 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8693 offset += 2;
8694
8695 /* opaque value<0..2^16-1> */
8696 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8697 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8698 return next_offset;
8699 }
8700 offset += 2;
8701
8702 proto_item_set_len(parameter_tree, 4 + parameter_length);
8703 }
8704
8705 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)
) {
8706 proto_item_append_text(parameter_tree, ": GREASE");
8707 } else {
8708 proto_item_append_text(parameter_tree, ": %s", val64_to_str(parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8709 }
8710
8711 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8712 parameter_end_offset = offset + parameter_length;
8713
8714 /* Omit the value field if the parameter's length is 0. */
8715 if (parameter_length != 0) {
8716 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8717 tvb, offset, parameter_length, ENC_NA0x00000000);
8718 }
8719
8720 switch (parameter_type) {
8721 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8722 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8723 tvb, offset, parameter_length, ENC_NA0x00000000);
8724 offset += parameter_length;
8725 break;
8726 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8727 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8728 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8729 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8730 offset += len;
8731 break;
8732 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8733 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8734 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8735 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8736 offset += 16;
8737 break;
8738 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8739 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8740 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8741 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8742 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8743 offset += len;
8744 break;
8745 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8746 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8747 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8748 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8749 offset += len;
8750 break;
8751 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8752 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8753 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8754 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8755 offset += len;
8756 break;
8757 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8758 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8759 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8760 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8761 offset += len;
8762 break;
8763 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8764 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8765 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8766 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8767 offset += len;
8768 break;
8769 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8770 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8771 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8772 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8773 offset += len;
8774 break;
8775 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8776 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8777 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8778 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8779 offset += len;
8780 break;
8781 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8782 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8783 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8784 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8785 offset += len;
8786 break;
8787 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8788 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8789 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8790 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8791 offset += len;
8792 break;
8793 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8794 /* No Payload */
8795 break;
8796 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8797 uint32_t connectionid_length;
8798 quic_cid_t cid;
8799
8800 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8801 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8802 offset += 4;
8803 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8804 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8805 offset += 2;
8806 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8807 tvb, offset, 16, ENC_NA0x00000000);
8808 offset += 16;
8809 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8810 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8811 offset += 2;
8812 /* XXX - Should we add these addresses and ports as addresses that the client
8813 * is allowed / expected to migrate the server address to? Right now we don't
8814 * enforce that (see RFC 9000 Section 9, which implies that while the client
8815 * can migrate to whatever address it wants, it can only migrate the server
8816 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8817 */
8818
8819 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8820 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8821 break;
8822 }
8823 offset += 1;
8824
8825 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8826 tvb, offset, connectionid_length, ENC_NA0x00000000);
8827 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8828 cid.len = connectionid_length;
8829 // RFC 9000 5.1.1 "If the preferred_address transport
8830 // parameter is sent, the sequence number of the supplied
8831 // connection ID is 1."
8832 cid.seq_num = 1;
8833 // Multipath draft-07 "Also, the Path Identifier for the
8834 // connection ID specified in the "preferred address"
8835 // transport parameter is 0."
8836 cid.path_id = 0;
8837 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8838 quic_add_connection(pinfo, &cid);
8839 }
8840 offset += connectionid_length;
8841
8842 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8843 tvb, offset, 16, ENC_NA0x00000000);
8844 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8845 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8846 }
8847 offset += 16;
8848 }
8849 break;
8850 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8851 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8852 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8853 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8854 offset += len;
8855 break;
8856 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8857 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8858 tvb, offset, parameter_length, ENC_NA0x00000000);
8859 offset += parameter_length;
8860 break;
8861 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8862 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8863 tvb, offset, parameter_length, ENC_NA0x00000000);
8864 offset += parameter_length;
8865 break;
8866 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8867 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8868 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8869 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8870 offset += len;
8871 break;
8872 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8873 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8874 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8875 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8876 offset += len;
8877 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8878 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8879 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8880 offset += len;
8881 break;
8882 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8883 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8884 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8885 if (len > 0) {
8886 quic_add_loss_bits(pinfo, value);
8887 }
8888 offset += 1;
8889 break;
8890 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8891 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8892 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8893 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8894 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8895 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8896 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8897 offset += len;
8898 break;
8899 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8900 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8901 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8902 offset += parameter_length;
8903 break;
8904 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8905 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8906 tvb, offset, parameter_length, ENC_NA0x00000000);
8907 offset += parameter_length;
8908 break;
8909 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8910 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8911 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8912 offset += 4;
8913 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8914 uint32_t versions_length;
8915
8916 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8917 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8918 offset += 1;
8919 for (i = 0; i < versions_length / 4; i++) {
8920 quic_proto_tree_add_version(tvb, parameter_tree,
8921 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8922 offset += 4;
8923 }
8924 }
8925 break;
8926 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8927 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8928 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8929 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8930 offset += len;
8931 break;
8932 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8933 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8934 tvb, offset, parameter_length, ENC_NA0x00000000);
8935 offset += parameter_length;
8936 break;
8937 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8938 /* This field was used for non-standard Google-specific parameters encoded as a
8939 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8940 * parameters. Report it as a bytes blob... */
8941 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8942 tvb, offset, parameter_length, ENC_NA0x00000000);
8943 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8944 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8945 tvb, offset, 4, ENC_NA0x00000000);
8946 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8947 offset += parameter_length;
8948 break;
8949 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8950 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8951 tvb, offset, parameter_length, ENC_NA0x00000000);
8952 offset += parameter_length;
8953 break;
8954 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8955 /* No Payload */
8956 break;
8957 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8958 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8959 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8960 offset += parameter_length;
8961 break;
8962 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8963 quic_proto_tree_add_version(tvb, parameter_tree,
8964 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8965 offset += 4;
8966 for (i = 4; i < parameter_length; i += 4) {
8967 quic_proto_tree_add_version(tvb, parameter_tree,
8968 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8969 offset += 4;
8970 }
8971 break;
8972 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8973 /* No Payload */
8974 quic_add_grease_quic_bit(pinfo);
8975 break;
8976 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8977 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8978 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8979 offset += parameter_length;
8980 break;
8981 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8982 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8983 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8984 if (value == 1) {
8985 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8986 }
8987 offset += parameter_length;
8988 break;
8989 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8990 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8991 /* No Payload */
8992 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8993 break;
8994 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8995 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8996 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8997 if (value > 1) {
8998 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8999 }
9000 /* multipath draft-07: "The value of the initial_max_paths
9001 * parameter MUST be at least 2." TODO: Expert Info? */
9002 offset += parameter_length;
9003 break;
9004 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
9005 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
9006 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
9007 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d:
9008 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
9009 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9010 /* multipath draft-09 and later: "If an endpoint receives an
9011 * initial_max_path_id transport parameter with value 0, the
9012 * peer aims to enable the multipath extension without allowing
9013 * extra paths immediately."
9014 */
9015 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9016 offset += parameter_length;
9017 break;
9018 default:
9019 offset += parameter_length;
9020 /*TODO display expert info about unknown ? */
9021 break;
9022 }
9023
9024 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
9025 /* Dissection did not end at expected location, fix it. */
9026 offset = parameter_end_offset;
9027 }
9028 }
9029
9030 return offset;
9031}
9032
9033static int
9034ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9035 proto_tree *tree, uint32_t offset,
9036 SslSession *session, SslDecryptSession *ssl,
9037 bool_Bool from_server, bool_Bool is_hrr)
9038{
9039 uint8_t sessid_length;
9040 proto_item *ti;
9041 proto_tree *rnd_tree;
9042 proto_tree *ti_rnd;
9043 proto_tree *ech_confirm_tree;
9044 uint8_t draft_version = session->tls13_draft_version;
9045
9046 if (ssl) {
7
Assuming 'ssl' is non-null, which participates in a condition later
8
Taking true branch
9047 StringInfo *rnd;
9048 if (from_server
8.1
'from_server' is true
)
9
Taking true branch
9049 rnd = &ssl->server_random;
9050 else
9051 rnd = &ssl->client_random;
9052
9053 /* save provided random for later keyring generation */
9054 tvb_memcpy(tvb, rnd->data, offset, 32);
9055 rnd->data_len = 32;
9056 if (from_server
9.1
'from_server' is true
)
10
Taking true branch
9057 ssl->state |= SSL_SERVER_RANDOM(1<<1);
9058 else
9059 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
9060 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
9061 from_server
10.1
'from_server' is true
? "SERVER" : "CLIENT", ssl->state);
11
'?' condition is true
9062 }
9063
9064 if (!from_server
11.1
'from_server' is true
&& session->client_random.data_len == 0) {
9065 session->client_random.data_len = 32;
9066 tvb_memcpy(tvb, session->client_random.data, offset, 32);
9067 }
9068
9069 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
9070
9071 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
12
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
13
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
14
Taking true branch
9072
9073 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9074 /* show the time */
9075 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
9076 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
9077 offset += 4;
9078
9079 /* show the random bytes */
9080 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
9081 tvb, offset, 28, ENC_NA0x00000000);
9082 offset += 28;
9083 } else {
9084 if (is_hrr) {
9085 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
9086 } else if (from_server && session->ech) {
9087 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9088 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
9089 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
9090 session->ech_confirmation, 8);
9091 proto_item_set_generated(ti);
9092 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
9093 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9094 } else {
9095 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9096 }
9097 }
9098
9099 offset += 32;
9100 }
9101
9102 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
9103 if (from_server
14.1
'from_server' is not equal to 0
== 0 || !(session->version
14.2
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
15
Taking true branch
9104 /* show the session id (length followed by actual Session ID) */
9105 sessid_length = tvb_get_uint8(tvb, offset);
9106 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
9107 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9108 offset++;
9109
9110 if (ssl
15.1
'ssl' is non-null, which participates in a condition later
) {
9111 /* save the authoritative SID for later use in ChangeCipherSpec.
9112 * (D)TLS restricts the SID to 32 chars, it does not make sense to
9113 * save more, so ignore larger ones. */
9114 if (from_server
15.2
'from_server' is true
&& sessid_length <= 32) {
16
Assuming 'sessid_length' is > 32
17
Taking false branch
9115 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
9116 ssl->session_id.data_len = sessid_length;
9117 }
9118 }
9119 if (sessid_length
17.1
'sessid_length' is > 0
> 0) {
18
Taking true branch
9120 proto_tree_add_item(tree, hf->hf.hs_session_id,
9121 tvb, offset, sessid_length, ENC_NA0x00000000);
9122 offset += sessid_length;
9123 }
9124 }
9125
9126 return offset;
9127}
9128
9129static int
9130ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9131 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9132 bool_Bool has_length)
9133{
9134 /* TLS 1.2/1.3 status_request Client Hello Extension.
9135 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
9136 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
9137 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
9138 * struct {
9139 * CertificateStatusType status_type;
9140 * uint16 request_length; // for status_request_v2
9141 * select (status_type) {
9142 * case ocsp: OCSPStatusRequest;
9143 * case ocsp_multi: OCSPStatusRequest;
9144 * } request;
9145 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
9146 *
9147 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
9148 * struct {
9149 * ResponderID responder_id_list<0..2^16-1>;
9150 * Extensions request_extensions;
9151 * } OCSPStatusRequest;
9152 * opaque ResponderID<1..2^16-1>;
9153 * opaque Extensions<0..2^16-1>;
9154 */
9155 unsigned cert_status_type;
9156
9157 cert_status_type = tvb_get_uint8(tvb, offset);
9158 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
9159 tvb, offset, 1, ENC_NA0x00000000);
9160 offset++;
9161
9162 if (has_length) {
9163 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
9164 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9165 offset += 2;
9166 }
9167
9168 switch (cert_status_type) {
9169 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9170 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9171 {
9172 uint32_t responder_id_list_len;
9173 uint32_t request_extensions_len;
9174
9175 /* ResponderID responder_id_list<0..2^16-1> */
9176 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
9177 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
9178 return offset_end;
9179 }
9180 offset += 2;
9181 if (responder_id_list_len != 0) {
9182 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9183 tvb, offset, responder_id_list_len,
9184 "Responder ID list is not implemented, contact Wireshark"
9185 " developers if you want this to be supported");
9186 }
9187 offset += responder_id_list_len;
9188
9189 /* opaque Extensions<0..2^16-1> */
9190 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
9191 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
9192 return offset_end;
9193 }
9194 offset += 2;
9195 if (request_extensions_len != 0) {
9196 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9197 tvb, offset, request_extensions_len,
9198 "Request Extensions are not implemented, contact"
9199 " Wireshark developers if you want this to be supported");
9200 }
9201 offset += request_extensions_len;
9202 break;
9203 }
9204 }
9205
9206 return offset;
9207}
9208
9209static unsigned
9210ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9211 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9212{
9213 /* https://tools.ietf.org/html/rfc6961#section-2.2
9214 * struct {
9215 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
9216 * } CertificateStatusRequestListV2;
9217 */
9218 uint32_t req_list_length, next_offset;
9219
9220 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
9221 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
9222 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
9223 return offset_end;
9224 }
9225 offset += 2;
9226 next_offset = offset + req_list_length;
9227
9228 while (offset < next_offset) {
9229 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
9230 }
9231
9232 return offset;
9233}
9234
9235static uint32_t
9236tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9237 uint32_t offset, uint32_t offset_end)
9238{
9239 uint32_t response_length;
9240 proto_item *ocsp_resp;
9241 proto_tree *ocsp_resp_tree;
9242 asn1_ctx_t asn1_ctx;
9243
9244 /* opaque OCSPResponse<1..2^24-1>; */
9245 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
9246 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9247 return offset_end;
9248 }
9249 offset += 3;
9250
9251 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
9252 response_length, ENC_BIG_ENDIAN0x00000000);
9253 proto_item_set_text(ocsp_resp, "OCSP Response");
9254 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
9255 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
9256 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9257 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
9258 }
9259 offset += response_length;
9260
9261 return offset;
9262}
9263
9264uint32_t
9265tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9266 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9267{
9268 /* TLS 1.2 "CertificateStatus" handshake message.
9269 * TLS 1.3 "status_request" Certificate extension.
9270 * struct {
9271 * CertificateStatusType status_type;
9272 * select (status_type) {
9273 * case ocsp: OCSPResponse;
9274 * case ocsp_multi: OCSPResponseList; // status_request_v2
9275 * } response;
9276 * } CertificateStatus;
9277 * opaque OCSPResponse<1..2^24-1>;
9278 * struct {
9279 * OCSPResponse ocsp_response_list<1..2^24-1>;
9280 * } OCSPResponseList; // status_request_v2
9281 */
9282 uint32_t status_type, resp_list_length, next_offset;
9283
9284 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9285 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9286 offset += 1;
9287
9288 switch (status_type) {
9289 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9290 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9291 break;
9292
9293 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9294 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9295 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9296 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9297 return offset_end;
9298 }
9299 offset += 3;
9300 next_offset = offset + resp_list_length;
9301
9302 while (offset < next_offset) {
9303 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9304 }
9305 break;
9306 }
9307
9308 return offset;
9309}
9310
9311static unsigned
9312ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9313 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9314 wmem_strbuf_t *ja3)
9315{
9316 /* RFC 8446 Section 4.2.7
9317 * enum { ..., (0xFFFF) } NamedGroup;
9318 * struct {
9319 * NamedGroup named_group_list<2..2^16-1>
9320 * } NamedGroupList;
9321 *
9322 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9323 * the extension itself from "elliptic_curves" to "supported_groups".
9324 */
9325 uint32_t groups_length, next_offset;
9326 proto_tree *groups_tree;
9327 proto_item *ti;
9328 char *ja3_dash = "";
9329
9330 /* NamedGroup named_group_list<2..2^16-1> */
9331 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9332 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9333 return offset_end;
9334 }
9335 offset += 2;
9336 next_offset = offset + groups_length;
9337
9338 ti = proto_tree_add_none_format(tree,
9339 hf->hf.hs_ext_supported_groups,
9340 tvb, offset, groups_length,
9341 "Supported Groups (%d group%s)",
9342 groups_length / 2,
9343 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9344
9345 /* make this a subtree */
9346 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9347
9348 if (ja3) {
9349 wmem_strbuf_append_c(ja3, ',');
9350 }
9351 /* loop over all groups */
9352 while (offset + 2 <= offset_end) {
9353 uint32_t ext_supported_group;
9354
9355 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9356 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9357 offset += 2;
9358 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))
) {
9359 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9360 ja3_dash = "-";
9361 }
9362 }
9363 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9364 offset = next_offset;
9365 }
9366
9367 return offset;
9368}
9369
9370static int
9371ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9372 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9373{
9374 uint8_t ecpf_length;
9375 proto_tree *ecpf_tree;
9376 proto_item *ti;
9377
9378 ecpf_length = tvb_get_uint8(tvb, offset);
9379 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9380 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9381
9382 offset += 1;
9383 ti = proto_tree_add_none_format(tree,
9384 hf->hf.hs_ext_ec_point_formats,
9385 tvb, offset, ecpf_length,
9386 "Elliptic curves point formats (%d)",
9387 ecpf_length);
9388
9389 /* make this a subtree */
9390 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9391
9392 if (ja3) {
9393 wmem_strbuf_append_c(ja3, ',');
9394 }
9395
9396 /* loop over all point formats */
9397 while (ecpf_length > 0)
9398 {
9399 uint32_t ext_ec_point_format;
9400
9401 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9402 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9403 offset++;
9404 ecpf_length--;
9405 if (ja3) {
9406 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9407 if (ecpf_length > 0) {
9408 wmem_strbuf_append_c(ja3, '-');
9409 }
9410 }
9411 }
9412
9413 return offset;
9414}
9415
9416static int
9417ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9418 packet_info *pinfo, proto_tree *tree,
9419 uint32_t offset, uint32_t next_offset)
9420{
9421 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9422 * opaque srp_I<1..2^8-1>;
9423 */
9424 uint32_t username_len;
9425
9426 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9427 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9428 return next_offset;
9429 }
9430 offset++;
9431
9432 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9433 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9434 offset += username_len;
9435
9436 return offset;
9437}
9438
9439static uint32_t
9440tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9441 uint32_t offset, uint32_t offset_end, uint16_t version)
9442{
9443 /* https://tools.ietf.org/html/rfc6962#section-3.2
9444 * enum { v1(0), (255) } Version;
9445 * struct {
9446 * opaque key_id[32];
9447 * } LogID;
9448 * opaque CtExtensions<0..2^16-1>;
9449 * struct {
9450 * Version sct_version;
9451 * LogID id;
9452 * uint64 timestamp;
9453 * CtExtensions extensions;
9454 * digitally-signed struct { ... };
9455 * } SignedCertificateTimestamp;
9456 */
9457 uint32_t sct_version;
9458 uint64_t sct_timestamp_ms;
9459 nstime_t sct_timestamp;
9460 uint32_t exts_len;
9461 const char *log_name;
9462
9463 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9464 offset++;
9465 if (sct_version != 0) {
9466 // TODO expert info about unknown SCT version?
9467 return offset;
9468 }
9469 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9470 log_name = bytesval_to_str(tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9471 proto_item_append_text(tree, " (%s)", log_name);
9472 offset += 32;
9473 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9474 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9475 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9476 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9477 offset += 8;
9478 /* opaque CtExtensions<0..2^16-1> */
9479 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9480 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9481 return offset_end;
9482 }
9483 offset += 2;
9484 if (exts_len > 0) {
9485 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9486 offset += exts_len;
9487 }
9488 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9489 hf->hf.sct_sct_signature_length,
9490 hf->hf.sct_sct_signature);
9491 return offset;
9492}
9493
9494uint32_t
9495tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9496 uint32_t offset, uint32_t offset_end, uint16_t version)
9497{
9498 /* https://tools.ietf.org/html/rfc6962#section-3.3
9499 * opaque SerializedSCT<1..2^16-1>;
9500 * struct {
9501 * SerializedSCT sct_list <1..2^16-1>;
9502 * } SignedCertificateTimestampList;
9503 */
9504 uint32_t list_length, sct_length, next_offset;
9505 proto_tree *subtree;
9506
9507 /* SerializedSCT sct_list <1..2^16-1> */
9508 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9509 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9510 return offset_end;
9511 }
9512 offset += 2;
9513
9514 while (offset < offset_end) {
9515 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9516
9517 /* opaque SerializedSCT<1..2^16-1> */
9518 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9519 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9520 return offset_end;
9521 }
9522 offset += 2;
9523 next_offset = offset + sct_length;
9524 proto_item_set_len(subtree, 2 + sct_length);
9525 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9526 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9527 offset = next_offset;
9528 }
9529 }
9530
9531 return offset;
9532}
9533
9534static int
9535dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9536 proto_tree *tree, uint32_t offset)
9537{
9538 uint32_t kdf_id, aead_id;
9539 proto_item *cs_ti;
9540 proto_tree *cs_tree;
9541
9542 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9543 tvb, offset, 4, ENC_NA0x00000000);
9544 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9545
9546 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9547 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9548 offset += 2;
9549 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9550 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9551 offset += 2;
9552
9553 proto_item_append_text(cs_ti, ": %s/%s",
9554 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9555 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9556 return offset;
9557}
9558
9559static int
9560dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9561 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9562 uint32_t *config_id)
9563{
9564 uint32_t length, cipher_suite_length;
9565 proto_item *kc_ti, *css_ti;
9566 proto_tree *kc_tree, *css_tree;
9567 uint32_t original_offset = offset, next_offset;
9568
9569 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9570 tvb, offset, -1, ENC_NA0x00000000);
9571 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9572
9573 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9574 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9575 offset += 1;
9576 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9577 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9578 offset += 2;
9579 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9580 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9581 offset += 2;
9582 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9583 tvb, offset, length, ENC_NA0x00000000);
9584 offset += length;
9585
9586 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9587 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9588 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9589 return offset_end;
9590 }
9591 offset += 2;
9592 next_offset = offset + cipher_suite_length;
9593
9594 css_ti = proto_tree_add_none_format(kc_tree,
9595 hf->hf.ech_hpke_keyconfig_cipher_suites,
9596 tvb, offset, cipher_suite_length,
9597 "Cipher Suites (%d suite%s)",
9598 cipher_suite_length / 4,
9599 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9600 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9601
9602
9603 while (offset + 4 <= next_offset) {
9604 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9605 }
9606
9607 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9608 offset = next_offset;
9609 }
9610
9611 proto_item_set_len(kc_ti, offset - original_offset);
9612
9613 return offset;
9614}
9615
9616static int
9617dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9618 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9619 const uint8_t **public_name, uint32_t *config_id)
9620{
9621 uint32_t public_name_length, extensions_length, next_offset;
9622
9623 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9624 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9625 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9626 offset += 1;
9627 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9628 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9629 offset += 1;
9630 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9631 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9632 offset += public_name_length;
9633
9634 /* Extension extensions<0..2^16-1>; */
9635 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9636 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9637 return offset_end;
9638 }
9639 offset += 2;
9640 next_offset = offset + extensions_length;
9641
9642 if (extensions_length > 0) {
9643 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9644 tvb, offset, extensions_length, ENC_NA0x00000000);
9645 }
9646 offset += extensions_length;
9647
9648 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9649 offset = next_offset;
9650 }
9651
9652 return offset;
9653}
9654
9655static int
9656dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9657 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9658{
9659 uint32_t version, length;
9660 proto_item *ech_ti;
9661 proto_tree *ech_tree;
9662 const uint8_t *public_name = NULL((void*)0);
9663 uint32_t config_id = 0;
9664
9665 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9666 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9667
9668 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9669 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9670 offset += 2;
9671 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9672 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9673 offset += 2;
9674
9675 proto_item_set_len(ech_ti, 4 + length);
9676
9677 switch(version) {
9678 case 0xfe0d:
9679 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9680 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9681 break;
9682
9683 default:
9684 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9685 }
9686
9687 return 4 + length;
9688}
9689
9690uint32_t
9691ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9692 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9693{
9694 uint32_t echconfiglist_length, next_offset;
9695
9696 /* ECHConfig ECHConfigList<1..2^16-1>; */
9697 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9698 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9699 return offset_end;
9700 }
9701 offset += 2;
9702 next_offset = offset + echconfiglist_length;
9703
9704 while (offset < next_offset) {
9705 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9706 }
9707
9708 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9709 offset = next_offset;
9710 }
9711
9712 return offset;
9713}
9714
9715static uint32_t
9716ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9717 uint32_t offset, uint32_t offset_end)
9718{
9719 uint32_t ext_length, next_offset;
9720 proto_tree *ext_tree;
9721 proto_item *ti;
9722
9723 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9724 hf->hf.hs_ext_ech_outer_ext_len, 2, G_MAXUINT8((guint8) 0xff))) {
9725 return offset_end;
9726 }
9727 offset += 1;
9728 next_offset = offset + ext_length;
9729
9730 ti = proto_tree_add_none_format(tree,
9731 hf->hf.hs_ext_ech_outer_ext,
9732 tvb, offset, ext_length,
9733 "Outer Extensions (%d extension%s)",
9734 ext_length / 2,
9735 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9736
9737 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9738
9739 while (offset + 2 <= offset_end) {
9740 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9741 offset += 2;
9742 }
9743
9744 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9745 offset = next_offset;
9746 }
9747
9748 return offset;
9749}
9750
9751static uint32_t
9752// NOLINTNEXTLINE(misc-no-recursion)
9753ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9754 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9755 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
9756 uint32_t initial_offset, uint32_t hello_length)
9757{
9758 uint32_t ch_type, length;
9759 proto_item *ti, *payload_ti;
9760 proto_tree *retry_tree, *payload_tree;
9761
9762 switch (hnd_type) {
9763 case SSL_HND_CLIENT_HELLO:
9764 /*
9765 * enum { outer(0), inner(1) } ECHClientHelloType;
9766 *
9767 * struct {
9768 * ECHClientHelloType type;
9769 * select (ECHClientHello.type) {
9770 * case outer:
9771 * HpkeSymmetricCipherSuite cipher_suite;
9772 * uint8 config_id;
9773 * opaque enc<0..2^16-1>;
9774 * opaque payload<1..2^16-1>;
9775 * case inner:
9776 * Empty;
9777 * };
9778 * } ECHClientHello;
9779 */
9780
9781 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9782 offset += 1;
9783 switch (ch_type) {
9784 case 0: /* outer */
9785 if (ssl && session->first_ch_ech_frame == 0) {
9786 session->first_ch_ech_frame = pinfo->num;
9787 }
9788 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9789 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9790 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9791
9792 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9793 uint8_t config_id = tvb_get_uint8(tvb, offset);
9794 offset += 1;
9795 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9796 offset += 2;
9797 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9798 offset += length;
9799 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9800 offset += 2;
9801 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9802 offset += length;
9803
9804 if (!mk_map) {
9805 break;
9806 }
9807 if (session->client_random.data_len == 0) {
9808 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9809 break;
9810 }
9811 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9812 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9813 if (!ech_secret || !ech_config) {
9814 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9815 G_STRFUNC((const char*) (__func__)));
9816 break;
9817 }
9818
9819 if (hpke_hkdf_len(kdf_id) == 0) {
9820 ssl_debug_printf("Unsupported KDF\n");
9821 break;
9822 }
9823
9824 if (hpke_aead_key_len(aead_id) == 0) {
9825 ssl_debug_printf("Unsupported AEAD\n");
9826 break;
9827 }
9828
9829 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9830
9831 uint16_t version = GUINT16_FROM_BE(*(uint16_t *)ech_config->data)(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)ech_config
->data) >> 8) | (guint16) ((guint16) (*(uint16_t *)ech_config
->data) << 8))))))
;
9832 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9833 ssl_debug_printf("Unexpected version in ECH Config\n");
9834 break;
9835 }
9836 uint32_t ech_config_offset = 2;
9837 if (GUINT16_FROM_BE(*(uint16_t *)(ech_config->data + ech_config_offset))(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)(ech_config
->data + ech_config_offset)) >> 8) | (guint16) ((guint16
) (*(uint16_t *)(ech_config->data + ech_config_offset)) <<
8))))))
!= ech_config->data_len - 4) {
9838 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9839 break;
9840 }
9841 ech_config_offset += 2;
9842 if (*(ech_config->data + ech_config_offset) != config_id) {
9843 ssl_debug_printf("ECH Config version mismatch\n");
9844 break;
9845 }
9846 ech_config_offset += 1;
9847 uint16_t kem_id_be = *(uint16_t *)(ech_config->data + ech_config_offset);
9848 uint16_t kem_id = GUINT16_FROM_BE(kem_id_be)(((((guint16) ( (guint16) ((guint16) (kem_id_be) >> 8) |
(guint16) ((guint16) (kem_id_be) << 8))))))
;
9849 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9850 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9851 GByteArray *info = g_byte_array_new();
9852 g_byte_array_append(info, "tls ech", 8);
9853 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9854 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9855 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9856 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9857 key, base_nonce)) {
9858 g_byte_array_free(info, TRUE(!(0)));
9859 break;
9860 }
9861 g_byte_array_free(info, TRUE(!(0)));
9862 gcry_cipher_hd_t cipher;
9863 if (hpke_setup_aead(&cipher, aead_id, key) ||
9864 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9865 gcry_cipher_close(cipher);
9866 break;
9867 }
9868 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9869 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9870 tvb_memcpy(tvb, ech_aad, initial_offset, hello_length);
9871 memset(ech_aad + offset - length - initial_offset, 0, length);
9872 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9873 gcry_cipher_close(cipher);
9874 wmem_free(NULL((void*)0), ech_aad);
9875 break;
9876 }
9877 wmem_free(NULL((void*)0), ech_aad);
9878 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, length - 16);
9879 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, length - 16, payload, length - 16)) {
9880 gcry_cipher_close(cipher);
9881 break;
9882 }
9883 guchar ech_auth_tag_calc[16];
9884 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, 16)) {
9885 gcry_cipher_close(cipher);
9886 break;
9887 }
9888 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9889 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, 16);
9890 gcry_cipher_close(cipher);
9891 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9892 payload + length - 16, 16)) {
9893 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9894 } else {
9895 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9896 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, length - 16, length - 16);
9897 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9898 if (ssl) {
9899 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9900 uint32_t len_offset = ssl->ech_transcript.data_len;
9901 if (ssl->ech_transcript.data_len > 0)
9902 ssl->ech_transcript.data = (guchar*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9903 ssl->ech_transcript.data_len + hello_length + 4);
9904 else
9905 ssl->ech_transcript.data = (guchar*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9906 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9907 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9908 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9909 ssl->ech_transcript.data_len += 38;
9910 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset + 34,
9911 tvb_get_uint8(tvb, initial_offset + 34) + 1);
9912 ssl->ech_transcript.data_len += tvb_get_uint8(tvb, initial_offset + 34) + 1;
9913 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9914 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9915 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9916 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9917 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9918 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9919 1 + tvb_get_uint8(ech_tvb, ech_offset));
9920 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9921 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9922 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9923 ssl->ech_transcript.data_len += 2;
9924 uint16_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9925 ech_offset += 2;
9926 while (extensions_end - ech_offset >= 4) {
9927 if (tvb_get_ntohs(ech_tvb, ech_offset) != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9928 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9929 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2));
9930 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
9931 ech_offset += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
9932 } else if (tvb_get_ntohs(ech_tvb, ech_offset + 2) > 0) {
9933 uint8_t outer_extensions_end = tvb_get_uint8(ech_tvb, ech_offset + 4) + ech_offset + 5;
9934 ech_offset += 5;
9935 uint16_t outer_offset = initial_offset + 35 + tvb_get_uint8(tvb, initial_offset + 34);
9936 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9937 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9938 while (outer_extensions_end - ech_offset >= 2) {
9939 while (hello_length - outer_offset >= 4) {
9940 if (tvb_get_ntohs(tvb, outer_offset) == tvb_get_ntohs(ech_tvb, ech_offset)) {
9941 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9942 4 + tvb_get_ntohs(tvb, outer_offset + 2));
9943 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9944 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9945 break;
9946 } else {
9947 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
9948 }
9949 }
9950 ech_offset += 2;
9951 }
9952 }
9953 }
9954 uint16_t ech_extensions_len_be = GUINT16_TO_BE(ssl->ech_transcript.data_len - ech_extensions_len_offset - 2)((((guint16) ( (guint16) ((guint16) (ssl->ech_transcript.data_len
- ech_extensions_len_offset - 2) >> 8) | (guint16) ((guint16
) (ssl->ech_transcript.data_len - ech_extensions_len_offset
- 2) << 8)))))
;
9955 *(ssl->ech_transcript.data + ech_extensions_len_offset) = ech_extensions_len_be & 0xff;
9956 *(ssl->ech_transcript.data + ech_extensions_len_offset + 1) = (ech_extensions_len_be >> 8);
9957 *(ssl->ech_transcript.data + len_offset + 2) = ((ssl->ech_transcript.data_len - len_offset - 4) >> 8);
9958 *(ssl->ech_transcript.data + len_offset + 3) = (ssl->ech_transcript.data_len - len_offset - 4) & 0xff;
9959 }
9960 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, length - 16, session,
9961 ssl, NULL((void*)0), mk_map);
9962 if (ech_padding_begin < length - 16) {
9963 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, length - 16 - ech_padding_begin,
9964 ENC_NA0x00000000);
9965 }
9966 }
9967
9968 break;
9969 case 1: /* inner */
9970 break;
9971 }
9972 break;
9973
9974 case SSL_HND_ENCRYPTED_EXTENSIONS:
9975 /*
9976 * struct {
9977 * ECHConfigList retry_configs;
9978 * } ECHEncryptedExtensions;
9979 */
9980
9981 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9982 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9983 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9984 break;
9985
9986 case SSL_HND_HELLO_RETRY_REQUEST:
9987 /*
9988 * struct {
9989 * opaque confirmation[8];
9990 * } ECHHelloRetryRequest;
9991 */
9992
9993 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9994 if (session->ech) {
9995 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9996 proto_item_set_generated(ti);
9997 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
9998 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9999 } else {
10000 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10001 }
10002 }
10003 offset += 8;
10004 break;
10005 }
10006
10007 return offset;
10008}
10009
10010static uint32_t
10011ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10012 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10013 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
10014{
10015 uint32_t record_digest_length, encrypted_sni_length;
10016
10017 switch (hnd_type) {
10018 case SSL_HND_CLIENT_HELLO:
10019 /*
10020 * struct {
10021 * CipherSuite suite;
10022 * KeyShareEntry key_share;
10023 * opaque record_digest<0..2^16-1>;
10024 * opaque encrypted_sni<0..2^16-1>;
10025 * } ClientEncryptedSNI;
10026 */
10027 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10028 offset += 2;
10029 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
10030
10031 /* opaque record_digest<0..2^16-1> */
10032 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
10033 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
10034 return offset_end;
10035 }
10036 offset += 2;
10037 if (record_digest_length > 0) {
10038 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
10039 offset += record_digest_length;
10040 }
10041
10042 /* opaque encrypted_sni<0..2^16-1> */
10043 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
10044 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
10045 return offset_end;
10046 }
10047 offset += 2;
10048 if (encrypted_sni_length > 0) {
10049 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
10050 offset += encrypted_sni_length;
10051 }
10052 break;
10053
10054 case SSL_HND_ENCRYPTED_EXTENSIONS:
10055 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
10056 offset += 16;
10057 break;
10058 }
10059
10060 return offset;
10061}
10062/** TLS Extensions (in Client Hello and Server Hello). }}} */
10063
10064/* Connection ID dissection. {{{ */
10065static uint32_t
10066ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10067 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
10068 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
10069{
10070 /* keep track of the decrypt session only for the first pass */
10071 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
10072 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
10073 *session_cidl = cidl;
10074 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
10075 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
10076 if (ssl) {
10077 ssl_add_session_by_cid(ssl);
10078 }
10079 }
10080
10081 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
10082 tvb, offset, 1, ENC_NA0x00000000);
10083 offset++;
10084
10085 if (cidl > 0) {
10086 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
10087 tvb, offset, cidl, ENC_NA0x00000000);
10088 offset += cidl;
10089 }
10090
10091 return offset;
10092}
10093
10094static uint32_t
10095ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10096 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
10097 SslSession *session, SslDecryptSession *ssl)
10098{
10099 uint8_t cidl = tvb_get_uint8(tvb, offset);
10100
10101 switch (hnd_type) {
10102 case SSL_HND_CLIENT_HELLO:
10103 session->client_cid_len_present = true1;
10104 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10105 cidl, &session->client_cid, &session->client_cid_len);
10106 case SSL_HND_SERVER_HELLO:
10107 session->server_cid_len_present = true1;
10108 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10109 cidl, &session->server_cid, &session->server_cid_len);
10110 default:
10111 return offset;
10112 }
10113} /* }}} */
10114
10115/* Trusted CA dissection. {{{ */
10116static uint32_t
10117ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
10118 uint32_t offset, uint32_t offset_end)
10119{
10120 proto_item *ti;
10121 proto_tree *subtree;
10122 uint32_t keys_length, next_offset;
10123
10124 /*
10125 * struct {
10126 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
10127 * } TrustedAuthorities;
10128 *
10129 * struct {
10130 * IdentifierType identifier_type;
10131 * select (identifier_type) {
10132 * case pre_agreed: struct {};
10133 * case key_sha1_hash: SHA1Hash;
10134 * case x509_name: DistinguishedName;
10135 * case cert_sha1_hash: SHA1Hash;
10136 * } identifier;
10137 * } TrustedAuthority;
10138 *
10139 * enum {
10140 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10141 * cert_sha1_hash(3), (255)
10142 * } IdentifierType;
10143 *
10144 * opaque DistinguishedName<1..2^16-1>;
10145 *
10146 */
10147
10148
10149 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
10150 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
10151 0, UINT16_MAX(65535)))
10152 {
10153 return offset_end;
10154 }
10155 offset += 2;
10156 next_offset = offset + keys_length;
10157
10158 if (keys_length > 0)
10159 {
10160 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
10161 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
10162 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
10163
10164 while (offset < next_offset)
10165 {
10166 uint32_t identifier_type;
10167 proto_tree *trusted_key_tree;
10168 proto_item *trusted_key_item;
10169 asn1_ctx_t asn1_ctx;
10170 uint32_t key_len = 0;
10171
10172 identifier_type = tvb_get_uint8(tvb, offset);
10173
10174 // Use 0 as length for now as we'll only know the size when we decode the identifier
10175 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
10176 offset, 0, "Trusted CA Key");
10177 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
10178
10179 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
10180 offset, 1, identifier_type);
10181 offset++;
10182
10183 /*
10184 * enum {
10185 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10186 * cert_sha1_hash(3), (255)
10187 * } IdentifierType;
10188 */
10189 switch (identifier_type)
10190 {
10191 case 0:
10192 key_len = 0;
10193 break;
10194 case 2:
10195 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10196
10197 uint32_t name_length;
10198 /* opaque DistinguishedName<1..2^16-1> */
10199 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
10200 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
10201 return next_offset;
10202 }
10203 offset += 2;
10204
10205 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
10206 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
10207 offset += name_length;
10208 break;
10209 case 1:
10210 case 3:
10211 key_len = 20;
10212 /* opaque SHA1Hash[20]; */
10213 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
10214 offset, 20, ENC_NA0x00000000);
10215 break;
10216
10217 default:
10218 key_len = 0;
10219 /*TODO display expert info about unknown ? */
10220 break;
10221 }
10222 proto_item_set_len(trusted_key_item, 1 + key_len);
10223 offset += key_len;
10224 }
10225 }
10226
10227 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10228 {
10229 offset = next_offset;
10230 }
10231
10232 return offset;
10233} /* }}} */
10234
10235
10236/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10237bool_Bool
10238ssl_is_valid_content_type(uint8_t type)
10239{
10240 switch ((ContentType) type) {
10241 case SSL_ID_CHG_CIPHER_SPEC:
10242 case SSL_ID_ALERT:
10243 case SSL_ID_HANDSHAKE:
10244 case SSL_ID_APP_DATA:
10245 case SSL_ID_HEARTBEAT:
10246 case SSL_ID_TLS12_CID:
10247 case SSL_ID_DTLS13_ACK:
10248 return true1;
10249 }
10250 return false0;
10251}
10252
10253bool_Bool
10254ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10255{
10256 switch ((HandshakeType) hs_type) {
10257 case SSL_HND_HELLO_VERIFY_REQUEST:
10258 /* hello_verify_request is DTLS-only */
10259 return is_dtls;
10260
10261 case SSL_HND_HELLO_REQUEST:
10262 case SSL_HND_CLIENT_HELLO:
10263 case SSL_HND_SERVER_HELLO:
10264 case SSL_HND_NEWSESSION_TICKET:
10265 case SSL_HND_END_OF_EARLY_DATA:
10266 case SSL_HND_HELLO_RETRY_REQUEST:
10267 case SSL_HND_ENCRYPTED_EXTENSIONS:
10268 case SSL_HND_CERTIFICATE:
10269 case SSL_HND_SERVER_KEY_EXCHG:
10270 case SSL_HND_CERT_REQUEST:
10271 case SSL_HND_SVR_HELLO_DONE:
10272 case SSL_HND_CERT_VERIFY:
10273 case SSL_HND_CLIENT_KEY_EXCHG:
10274 case SSL_HND_FINISHED:
10275 case SSL_HND_CERT_URL:
10276 case SSL_HND_CERT_STATUS:
10277 case SSL_HND_SUPPLEMENTAL_DATA:
10278 case SSL_HND_KEY_UPDATE:
10279 case SSL_HND_COMPRESSED_CERTIFICATE:
10280 case SSL_HND_ENCRYPTED_EXTS:
10281 return true1;
10282 case SSL_HND_MESSAGE_HASH:
10283 return false0;
10284 }
10285 return false0;
10286}
10287
10288static bool_Bool
10289ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10290 bool_Bool is_dtls)
10291{
10292 /* Consider all valid Handshake messages (except for Client Hello) and
10293 * all other valid record types (other than Handshake) */
10294 return (content_type == SSL_ID_HANDSHAKE &&
10295 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10296 handshake_type != SSL_HND_CLIENT_HELLO) ||
10297 (content_type != SSL_ID_HANDSHAKE &&
10298 ssl_is_valid_content_type(content_type));
10299}
10300
10301/**
10302 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10303 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10304 * Returns true if the supported_versions extension was found, false if not.
10305 */
10306bool_Bool
10307tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10308 uint16_t *server_version, bool_Bool *is_hrr)
10309{
10310 /* SHA256("HelloRetryRequest") */
10311 static const uint8_t tls13_hrr_random_magic[] = {
10312 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10313 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10314 };
10315 uint8_t session_id_length;
10316
10317 *server_version = tvb_get_ntohs(tvb, offset);
10318
10319 /*
10320 * Try to look for supported_versions extension. Minimum length:
10321 * 2 + 32 + 1 = 35 (version, random, session id length)
10322 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10323 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10324 *
10325 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10326 * there's a separate expert info warning for that.
10327 */
10328 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10329 offset += 2;
10330 if (is_hrr) {
10331 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10332 }
10333 offset += 32;
10334 session_id_length = tvb_get_uint8(tvb, offset);
10335 offset++;
10336 if (offset_end - offset < session_id_length + 5u) {
10337 return false0;
10338 }
10339 offset += session_id_length + 5;
10340
10341 while (offset_end - offset >= 6) {
10342 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10343 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10344 if (offset_end - offset < 4u + ext_len) {
10345 break; /* not enough data for type, length and data */
10346 }
10347 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10348 if (ext_len == 2) {
10349 *server_version = tvb_get_ntohs(tvb, offset + 4);
10350 }
10351 return true1;
10352 }
10353 offset += 4 + ext_len;
10354 }
10355 } else {
10356 if (is_hrr) {
10357 *is_hrr = false0;
10358 }
10359 }
10360 return false0;
10361}
10362
10363/**
10364 * Scan a Client Hello handshake message to see if the supported_versions
10365 * extension is found, in which case the version field is legacy_version.
10366 */
10367static bool_Bool
10368tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10369{
10370 uint8_t session_id_length;
10371
10372 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10373
10374 /*
10375 * Try to look for supported_versions extension. Minimum length:
10376 * 2 + 32 + 1 = 35 (version, random, session id length)
10377 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10378 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10379 *
10380 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10381 * there's a separate expert info warning for that.
10382 */
10383 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10384 offset += 2;
10385 offset += 32;
10386 session_id_length = tvb_get_uint8(tvb, offset);
10387 offset++;
10388 if (offset_end - offset < session_id_length + 2u) {
10389 return false0;
10390 }
10391 offset += session_id_length;
10392 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10393 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10394 offset++;
10395 if (offset_end - offset < cookie_length + 2u) {
10396 return false0;
10397 }
10398 }
10399 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10400 offset += 2;
10401 if (offset_end - offset < cipher_suites_length + 1u) {
10402 return false0;
10403 }
10404 offset += cipher_suites_length;
10405 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10406 offset++;
10407 if (offset_end - offset < compression_methods_length + 2u) {
10408 return false0;
10409 }
10410 offset += compression_methods_length + 2;
10411
10412 while (offset_end - offset >= 6) {
10413 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10414 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10415 if (offset_end - offset < 4u + ext_len) {
10416 break; /* not enough data for type, length and data */
10417 }
10418 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10419 return true1;
10420 }
10421 offset += 4 + ext_len;
10422 }
10423 }
10424 return false0;
10425}
10426void
10427ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10428 uint8_t content_type, uint8_t handshake_type,
10429 bool_Bool is_dtls, uint16_t version)
10430{
10431 uint8_t tls13_draft = 0;
10432
10433 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10434 is_dtls))
10435 return;
10436
10437 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10438 if (version == SSL_VER_UNKNOWN0) {
10439 return;
10440 }
10441
10442 session->tls13_draft_version = tls13_draft;
10443 session->version = version;
10444 if (ssl) {
10445 ssl->state |= SSL_VERSION(1<<4);
10446 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10447 }
10448}
10449
10450void
10451ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10452 ContentType content_type,
10453 unsigned record_length, proto_item *length_pi,
10454 uint16_t version, tvbuff_t *decrypted_tvb)
10455{
10456 unsigned max_expansion;
10457 if (version == TLSV1DOT3_VERSION0x304) {
10458 /* TLS 1.3: Max length is 2^14 + 256 */
10459 max_expansion = 256;
10460 } else {
10461 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10462 max_expansion = 2048;
10463 }
10464 /*
10465 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10466 * and ChangeCipherSpec.
10467 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10468 * so assume it is permitted.
10469 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10470 * assume TLS 1.2 requirements.
10471 */
10472 if (record_length == 0 &&
10473 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10474 content_type == SSL_ID_ALERT ||
10475 content_type == SSL_ID_HANDSHAKE)) {
10476 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10477 "Zero-length %s fragments are not allowed",
10478 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10479 }
10480 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10481 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10482 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10483 }
10484 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10485 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10486 "TLSPlaintext length MUST NOT exceed 2^14");
10487 }
10488}
10489
10490static void
10491ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10492{
10493 /* store selected cipher suite for decryption */
10494 ssl->session.cipher = cipher;
10495
10496 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10497 if (!cs) {
10498 ssl->cipher_suite = NULL((void*)0);
10499 ssl->state &= ~SSL_CIPHER(1<<2);
10500 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10501 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10502 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10503 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10504 * to avoid a potential buffer overflow in ssl3_check_mac. */
10505 ssl->cipher_suite = NULL((void*)0);
10506 ssl->state &= ~SSL_CIPHER(1<<2);
10507 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10508 } else {
10509 /* Cipher found, save this for the delayed decoder init */
10510 ssl->cipher_suite = cs;
10511 ssl->state |= SSL_CIPHER(1<<2);
10512 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10513 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10514 ssl->state);
10515 }
10516}
10517/* }}} */
10518
10519
10520/* Client Hello and Server Hello dissections. {{{ */
10521static int
10522ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10523 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10524 SslSession *session, SslDecryptSession *ssl,
10525 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10526 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length);
10527int
10528// NOLINTNEXTLINE(misc-no-recursion)
10529ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10530 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10531 uint32_t offset_end, SslSession *session,
10532 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10533{
10534 /* struct {
10535 * ProtocolVersion client_version;
10536 * Random random;
10537 * SessionID session_id;
10538 * opaque cookie<0..32>; //new field for DTLS
10539 * CipherSuite cipher_suites<2..2^16-1>;
10540 * CompressionMethod compression_methods<1..2^8-1>;
10541 * Extension client_hello_extension_list<0..2^16-1>;
10542 * } ClientHello;
10543 */
10544 proto_item *ti;
10545 proto_tree *cs_tree;
10546 uint32_t client_version;
10547 uint32_t cipher_suite_length;
10548 uint32_t compression_methods_length;
10549 uint8_t compression_method;
10550 uint32_t next_offset;
10551 uint32_t initial_offset = offset;
10552 uint32_t hello_length = offset_end - initial_offset;
10553 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10554 char *ja3_hash;
10555 char *ja3_dash = "";
10556 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10557 ja4_data_t ja4_data;
10558 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10559 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10560 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10561 wmem_list_frame_t *curr_entry;
10562
10563 ja4_data.max_version = 0;
10564 ja4_data.server_name_present = false0;
10565 ja4_data.num_cipher_suites = 0;
10566 ja4_data.num_extensions = 0;
10567 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10568 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10569 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10570 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10571
10572 /* show the client version */
10573 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, tvb,
10574 offset, 2, ENC_BIG_ENDIAN0x00000000,
10575 &client_version);
10576 if (tls_scan_client_hello(tvb, offset, offset_end)) {
10577 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10578 }
10579 offset += 2;
10580 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10581
10582 /*
10583 * Is it version 1.3?
10584 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10585 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10586 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10587 * Hello".
10588 */
10589 if (dtls_hfs != NULL((void*)0)) {
10590 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10591 /* Don't do that. */
10592 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10593 }
10594 } else {
10595 if (client_version == TLSV1DOT3_VERSION0x304) {
10596 /* Don't do that. */
10597 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10598 }
10599 }
10600
10601 /* dissect fields that are present in both ClientHello and ServerHello */
10602 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, false0, false0);
10603
10604 /* fields specific for DTLS (cookie_len, cookie) */
10605 if (dtls_hfs != NULL((void*)0)) {
10606 uint32_t cookie_length;
10607 /* opaque cookie<0..32> (for DTLS only) */
10608 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
10609 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10610 return offset;
10611 }
10612 offset++;
10613 if (cookie_length > 0) {
10614 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10615 tvb, offset, cookie_length, ENC_NA0x00000000);
10616 offset += cookie_length;
10617 }
10618 }
10619
10620 /* CipherSuite cipher_suites<2..2^16-1> */
10621 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10622 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10623 return offset;
10624 }
10625 offset += 2;
10626 next_offset = offset + cipher_suite_length;
10627 ti = proto_tree_add_none_format(tree,
10628 hf->hf.hs_cipher_suites,
10629 tvb, offset, cipher_suite_length,
10630 "Cipher Suites (%d suite%s)",
10631 cipher_suite_length / 2,
10632 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10633 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10634 while (offset + 2 <= next_offset) {
10635 uint32_t cipher_suite;
10636
10637 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, tvb, offset, 2,
10638 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10639 offset += 2;
10640 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))
) {
10641 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10642 ja3_dash = "-";
10643 ja4_data.num_cipher_suites += 1;
10644 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10645 }
10646 }
10647 wmem_strbuf_append_c(ja3, ',');
10648 if (!ssl_end_vector(hf, tvb, pinfo, cs_tree, offset, next_offset)) {
10649 offset = next_offset;
10650 }
10651
10652 /* CompressionMethod compression_methods<1..2^8-1> */
10653 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10654 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10655 return offset;
10656 }
10657 offset++;
10658 next_offset = offset + compression_methods_length;
10659 ti = proto_tree_add_none_format(tree,
10660 hf->hf.hs_comp_methods,
10661 tvb, offset, compression_methods_length,
10662 "Compression Methods (%u method%s)",
10663 compression_methods_length,
10664 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10665 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10666 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10667 while (offset < next_offset) {
10668 compression_method = tvb_get_uint8(tvb, offset);
10669 /* TODO: make reserved/private comp meth. fields selectable */
10670 if (compression_method < 64)
10671 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10672 tvb, offset, 1, compression_method);
10673 else if (compression_method > 63 && compression_method < 193)
10674 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10675 compression_method, "Reserved - to be assigned by IANA (%u)",
10676 compression_method);
10677 else
10678 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10679 compression_method, "Private use range (%u)",
10680 compression_method);
10681 offset++;
10682 }
10683
10684 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10685 if (offset < offset_end) {
10686 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10687 offset_end, SSL_HND_CLIENT_HELLO,
10688 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map, initial_offset, hello_length);
10689 if (ja4_data.max_version > 0) {
10690 client_version = ja4_data.max_version;
10691 }
10692 } else {
10693 wmem_strbuf_append_printf(ja3, ",,");
10694 }
10695
10696 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10697 wmem_strbuf_append(ja4_a, "t");
10698 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10699 wmem_strbuf_append(ja4_a, "q");
10700 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10701 wmem_strbuf_append(ja4_a, "d");
10702 }
10703 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10704 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10705 if (ja4_data.num_cipher_suites > 99) {
10706 wmem_strbuf_append(ja4_a, "99");
10707 } else {
10708 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10709 }
10710 if (ja4_data.num_extensions > 99) {
10711 wmem_strbuf_append(ja4_a, "99");
10712 } else {
10713 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10714 }
10715 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10716 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10717 } else {
10718 wmem_strbuf_append(ja4_a, "00");
10719 }
10720
10721 curr_entry = wmem_list_head(ja4_data.cipher_list);
10722 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10723 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10724 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10725 wmem_strbuf_append(ja4_br, ",");
10726 }
10727 curr_entry = wmem_list_frame_next(curr_entry);
10728 }
10729
10730 curr_entry = wmem_list_head(ja4_data.extension_list);
10731 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10732 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10733 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10734 wmem_strbuf_append(ja4_cr, ",");
10735 }
10736 curr_entry = wmem_list_frame_next(curr_entry);
10737 }
10738
10739 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10740 wmem_strbuf_append(ja4_cr, "_");
10741 curr_entry = wmem_list_head(ja4_data.sighash_list);
10742 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10743 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10744 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10745 wmem_strbuf_append(ja4_cr, ",");
10746 }
10747 curr_entry = wmem_list_frame_next(curr_entry);
10748 }
10749 }
10750 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10751 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10752 } else {
10753 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10754 }
10755 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10756
10757 g_free(ja4_hash);
10758 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10759 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10760 } else {
10761 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10762 }
10763 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10764 g_free(ja4_hash);
10765
10766 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10767 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10768
10769 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, tvb, offset, 0, ja4);
10770 proto_item_set_generated(ti);
10771 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, tvb, offset, 0, ja4_r);
10772 proto_item_set_generated(ti);
10773
10774 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10775 wmem_strbuf_get_len(ja3));
10776 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10777 proto_item_set_generated(ti);
10778 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, tvb, offset, 0, ja3_hash);
10779 proto_item_set_generated(ti);
10780 g_free(ja3_hash);
10781 return offset;
10782}
10783
10784void
10785ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10786 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10787 SslSession *session, SslDecryptSession *ssl,
10788 bool_Bool is_dtls, bool_Bool is_hrr)
10789{
10790 /* struct {
10791 * ProtocolVersion server_version;
10792 * Random random;
10793 * SessionID session_id; // TLS 1.2 and before
10794 * CipherSuite cipher_suite;
10795 * CompressionMethod compression_method; // TLS 1.2 and before
10796 * Extension server_hello_extension_list<0..2^16-1>;
10797 * } ServerHello;
10798 */
10799 uint8_t draft_version = session->tls13_draft_version;
10800 proto_item *ti;
10801 uint32_t server_version;
10802 uint32_t cipher_suite;
10803 uint32_t initial_offset = offset;
10804 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10805 char *ja3_hash;
10806
10807 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10808 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10809
10810 /* Initially assume that the session is resumed. If this is not the case, a
10811 * ServerHelloDone will be observed before the ChangeCipherSpec message
10812 * which will reset this flag. */
10813 session->is_session_resumed = true1;
10814
10815 /* show the server version */
10816 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10817 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10818
10819 uint16_t supported_server_version;
10820 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
1
Taking false branch
10821 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10822 }
10823 /*
10824 * Is it version 1.3?
10825 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10826 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10827 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10828 * Hello".
10829 */
10830 if (is_dtls) {
2
Assuming 'is_dtls' is false
3
Taking false branch
10831 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10832 /* Don't do that. */
10833 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10834 }
10835 } else {
10836 if (server_version == TLSV1DOT3_VERSION0x304) {
4
Assuming 'server_version' is not equal to TLSV1DOT3_VERSION
5
Taking false branch
10837 /* Don't do that. */
10838 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10839 }
10840 }
10841
10842 offset += 2;
10843 wmem_strbuf_append_printf(ja3, "%i", server_version);
10844
10845 /* dissect fields that are present in both ClientHello and ServerHello */
10846 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
6
Calling 'ssl_dissect_hnd_hello_common'
19
Returning from 'ssl_dissect_hnd_hello_common'
10847
10848 if (ssl
19.1
'ssl' is non-null
) {
20
Taking true branch
10849 /* store selected cipher suite for decryption */
10850 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10851 }
10852
10853 /* now the server-selected cipher suite */
10854 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10855 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10856 offset += 2;
10857 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10858
10859 /* No compression with TLS 1.3 before draft -22 */
10860 if (!(session->version
20.1
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
21
Taking true branch
10861 if (ssl
21.1
'ssl' is non-null
) {
22
Taking true branch
10862 /* store selected compression method for decryption */
10863 ssl->session.compression = tvb_get_uint8(tvb, offset);
10864 }
10865 /* and the server-selected compression method */
10866 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10867 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10868 offset++;
10869 }
10870
10871 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10872 if (offset < offset_end) {
23
Assuming 'offset' is >= 'offset_end'
10873 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10874 offset_end,
10875 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10876 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0), 0, 0);
10877 }
10878
10879 if (ssl
23.1
'ssl' is non-null
&& ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
24
Assuming field 'data_len' is > 0
25
Assuming the condition is true
26
Assuming field 'data_len' is > 0
27
Taking true branch
10880 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10881 if (hash_algo) {
28
Assuming 'hash_algo' is not equal to 0
29
Taking true branch
10882 SSL_MDgcry_md_hd_t mc;
10883 guchar transcript_hash[DIGEST_MAX_SIZE48];
10884 guchar prk[DIGEST_MAX_SIZE48];
10885 guchar *ech_verify_out = NULL((void*)0);
10886 unsigned int len;
10887 ssl_md_init(&mc, hash_algo);
10888 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10889 if (is_hrr) {
30
Assuming 'is_hrr' is false
31
Taking false branch
10890 ssl_md_final(&mc, transcript_hash, &len);
10891 ssl_md_cleanup(&mc);
10892 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10893 ssl->ech_transcript.data_len = 4 + len;
10894 ssl->ech_transcript.data = (guchar*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10895 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10896 ssl->ech_transcript.data[1] = 0;
10897 ssl->ech_transcript.data[2] = 0;
10898 ssl->ech_transcript.data[3] = len;
10899 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10900 ssl_md_init(&mc, hash_algo);
10901 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10902 } else {
10903 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10904 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10905 }
10906 if (initial_offset > 4) {
32
Assuming 'initial_offset' is > 4
33
Taking true branch
10907 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10908 4 + offset_end - initial_offset);
10909 if (is_hrr
33.1
'is_hrr' is false
)
34
Taking false branch
10910 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10911 else
10912 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10913 } else {
10914 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10915 prefix[2] = ((offset - initial_offset) >> 8);
10916 prefix[3] = (offset - initial_offset) & 0xff;
10917 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10918 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
10919 offset_end - initial_offset);
10920 ssl_md_update(&mc, prefix, 4);
10921 if (is_hrr)
10922 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, initial_offset, 34), 34);
10923 else
10924 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, initial_offset, 26), 26);
10925 }
10926 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
10927 uint8_t zeros[8] = { 0 };
10928 uint32_t confirmation_offset = initial_offset + 26;
10929 if (is_hrr
34.1
'is_hrr' is false
) {
35
Taking false branch
10930 uint32_t hrr_offset = initial_offset + 34;
10931 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, hrr_offset,
10932 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
10933 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
10934 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, hrr_offset, 3), 3);
10935 hrr_offset += 3;
10936 uint16_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
10937 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, hrr_offset, 2), 2);
10938 hrr_offset += 2;
10939 while (extensions_end - hrr_offset >= 4) {
10940 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
10941 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
10942 confirmation_offset = hrr_offset + 4;
10943 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, hrr_offset, 4), 4);
10944 ssl_md_update(&mc, zeros, 8);
10945 hrr_offset += 12;
10946 } else {
10947 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
10948 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
10949 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
10950 }
10951 }
10952 } else {
10953 ssl_md_update(&mc, zeros, 8);
10954 ssl_md_update(&mc, (guchar *)tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
10955 offset - initial_offset - 34);
10956 }
10957 ssl_md_final(&mc, transcript_hash, &len);
10958 ssl_md_cleanup(&mc);
10959 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10960 StringInfo prk_string = {prk, len};
10961 tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
37
Calling 'tls13_hkdf_expand_label_context'
43
Returning from 'tls13_hkdf_expand_label_context'
10962 is_hrr
35.1
'is_hrr' is false
? "hrr ech accept confirmation" : "ech accept confirmation",
36
'?' condition is false
10963 transcript_hash, len, 8, &ech_verify_out);
10964 memcpy(is_hrr
43.1
'is_hrr' is false
? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
44
'?' condition is false
45
Null pointer passed to 2nd parameter expecting 'nonnull'
10965 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10966 if (is_hrr) {
10967 ssl->session.hrr_ech_declined = TRUE(!(0));
10968 ssl->session.first_ch_ech_frame = 0;
10969 }
10970 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10971 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10972 }
10973 wmem_free(NULL((void*)0), ech_verify_out);
10974 ssl->session.ech = TRUE(!(0));
10975 }
10976 }
10977
10978 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10979 wmem_strbuf_get_len(ja3));
10980 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10981 proto_item_set_generated(ti);
10982 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10983 proto_item_set_generated(ti);
10984 g_free(ja3_hash);
10985}
10986/* Client Hello and Server Hello dissections. }}} */
10987
10988/* New Session Ticket dissection. {{{ */
10989void
10990ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10991 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10992 SslSession *session, SslDecryptSession *ssl,
10993 bool_Bool is_dtls, GHashTable *session_hash)
10994{
10995 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10996 * struct {
10997 * uint32 ticket_lifetime_hint;
10998 * opaque ticket<0..2^16-1>;
10999 * } NewSessionTicket;
11000 *
11001 * RFC 8446 Section 4.6.1 (TLS 1.3):
11002 * struct {
11003 * uint32 ticket_lifetime;
11004 * uint32 ticket_age_add;
11005 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
11006 * opaque ticket<1..2^16-1>;
11007 * Extension extensions<0..2^16-2>;
11008 * } NewSessionTicket;
11009 */
11010 proto_tree *subtree;
11011 proto_item *subitem;
11012 uint32_t ticket_len;
11013 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
11014 unsigned char draft_version = session->tls13_draft_version;
11015 uint32_t lifetime_hint;
11016
11017 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11018 hf->ett.session_ticket, NULL((void*)0),
11019 "TLS Session Ticket");
11020
11021 /* ticket lifetime hint */
11022 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
11023 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
11024 offset += 4;
11025
11026 if (lifetime_hint >= 60) {
11027 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
11028 proto_item_append_text(subitem, " (%s)", time_str);
11029 }
11030
11031 if (is_tls13) {
11032
11033 /* for TLS 1.3: ticket_age_add */
11034 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
11035 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
11036 offset += 4;
11037
11038 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
11039 if (draft_version == 0 || draft_version >= 21) {
11040 uint32_t ticket_nonce_len;
11041
11042 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
11043 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
11044 return;
11045 }
11046 offset++;
11047
11048 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
11049 offset += ticket_nonce_len;
11050 }
11051
11052 }
11053
11054 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
11055 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
11056 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
11057 return;
11058 }
11059 offset += 2;
11060
11061 /* Content depends on implementation, so just show data! */
11062 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
11063 tvb, offset, ticket_len, ENC_NA0x00000000);
11064 /* save the session ticket to cache for ssl_finalize_decryption */
11065 if (ssl && !is_tls13) {
11066 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
11067 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
11068 ssl->session_ticket.data, ticket_len);
11069 ssl->session_ticket.data_len = ticket_len;
11070 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
11071 /* NewSessionTicket is received after the first (client)
11072 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
11073 * Since the second CCS has already the session key available it will
11074 * just return. To ensure that the session ticket is mapped to a
11075 * master key (from the first CCS), save the ticket here too. */
11076 ssl_save_master_key("Session Ticket", session_hash,
11077 &ssl->session_ticket, &ssl->master_secret);
11078 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
11079 }
11080 offset += ticket_len;
11081
11082 if (is_tls13) {
11083 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11084 offset_end, SSL_HND_NEWSESSION_TICKET,
11085 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11086 }
11087} /* }}} */
11088
11089void
11090ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11091 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11092 SslSession *session, SslDecryptSession *ssl,
11093 bool_Bool is_dtls)
11094{
11095 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
11096 * struct {
11097 * ProtocolVersion server_version;
11098 * CipherSuite cipher_suite; // not before draft -19
11099 * Extension extensions<2..2^16-1>;
11100 * } HelloRetryRequest;
11101 * Note: no longer used since draft -22
11102 */
11103 uint32_t version;
11104 uint8_t draft_version;
11105
11106 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11107 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
11108 draft_version = extract_tls13_draft_version(version);
11109 offset += 2;
11110
11111 if (draft_version == 0 || draft_version >= 19) {
11112 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
11113 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11114 offset += 2;
11115 }
11116
11117 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11118 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11119 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11120}
11121
11122void
11123ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11124 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11125 SslSession *session, SslDecryptSession *ssl,
11126 bool_Bool is_dtls)
11127{
11128 /* RFC 8446 Section 4.3.1
11129 * struct {
11130 * Extension extensions<0..2^16-1>;
11131 * } EncryptedExtensions;
11132 */
11133 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11134 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11135 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11136}
11137
11138/* Certificate and Certificate Request dissections. {{{ */
11139void
11140ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11141 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11142 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11143 bool_Bool is_from_server, bool_Bool is_dtls)
11144{
11145 /* opaque ASN.1Cert<1..2^24-1>;
11146 *
11147 * Before RFC 8446 (TLS <= 1.2):
11148 * struct {
11149 * select(certificate_type) {
11150 *
11151 * // certificate type defined in RFC 7250
11152 * case RawPublicKey:
11153 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11154 *
11155 * // X.509 certificate defined in RFC 5246
11156 * case X.509:
11157 * ASN.1Cert certificate_list<0..2^24-1>;
11158 * };
11159 * } Certificate;
11160 *
11161 * RFC 8446 (since draft -20):
11162 * struct {
11163 * select(certificate_type){
11164 * case RawPublicKey:
11165 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11166 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11167 *
11168 * case X.509:
11169 * opaque cert_data<1..2^24-1>;
11170 * }
11171 * Extension extensions<0..2^16-1>;
11172 * } CertificateEntry;
11173 * struct {
11174 * opaque certificate_request_context<0..2^8-1>;
11175 * CertificateEntry certificate_list<0..2^24-1>;
11176 * } Certificate;
11177 */
11178 enum { CERT_X509, CERT_RPK } cert_type;
11179 asn1_ctx_t asn1_ctx;
11180#if defined(HAVE_LIBGNUTLS1)
11181 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11182 unsigned certificate_index = 0;
11183#endif
11184 uint32_t next_offset, certificate_list_length, cert_length;
11185 proto_tree *subtree = tree;
11186
11187 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11188
11189 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11190 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11191 cert_type = CERT_RPK;
11192 } else {
11193 cert_type = CERT_X509;
11194 }
11195
11196#if defined(HAVE_LIBGNUTLS1)
11197 /* Ask the pkcs1 dissector to return the public key details */
11198 if (ssl)
11199 asn1_ctx.private_data = &subjectPublicKeyInfo;
11200#endif
11201
11202 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11203 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11204 uint32_t context_length;
11205 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11206 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11207 return;
11208 }
11209 offset++;
11210 if (context_length > 0) {
11211 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11212 tvb, offset, context_length, ENC_NA0x00000000);
11213 offset += context_length;
11214 }
11215 }
11216
11217 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11218 /* For RPK before TLS 1.3, the single RPK is stored directly without
11219 * another "certificate_list" field. */
11220 certificate_list_length = offset_end - offset;
11221 next_offset = offset_end;
11222 } else {
11223 /* CertificateEntry certificate_list<0..2^24-1> */
11224 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11225 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11226 return;
11227 }
11228 offset += 3; /* 24-bit length value */
11229 next_offset = offset + certificate_list_length;
11230 }
11231
11232 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11233 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11234 proto_item *ti;
11235
11236 ti = proto_tree_add_none_format(tree,
11237 hf->hf.hs_certificates,
11238 tvb, offset, certificate_list_length,
11239 "Certificates (%u bytes)",
11240 certificate_list_length);
11241
11242 /* make it a subtree */
11243 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11244 }
11245
11246 while (offset < next_offset) {
11247 switch (cert_type) {
11248 case CERT_RPK:
11249 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11250 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11251 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11252 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11253 return;
11254 }
11255 offset += 3;
11256
11257 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11258 offset += cert_length;
11259 break;
11260 case CERT_X509:
11261 /* opaque ASN1Cert<1..2^24-1> */
11262 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11263 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11264 return;
11265 }
11266 offset += 3;
11267
11268 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11269#if defined(HAVE_LIBGNUTLS1)
11270 if (is_from_server && ssl && certificate_index == 0) {
11271 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11272 /* Only attempt to get the RSA modulus for the first cert. */
11273 asn1_ctx.private_data = NULL((void*)0);
11274 }
11275#endif
11276 offset += cert_length;
11277 break;
11278 }
11279
11280 /* TLS 1.3: Extension extensions<0..2^16-1> */
11281 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11282 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11283 next_offset, SSL_HND_CERTIFICATE,
11284 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11285 }
11286
11287#if defined(HAVE_LIBGNUTLS1)
11288 certificate_index++;
11289#endif
11290 }
11291}
11292
11293void
11294ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11295 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11296 SslSession *session, bool_Bool is_dtls)
11297{
11298 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11299 * enum {
11300 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11301 * (255)
11302 * } ClientCertificateType;
11303 *
11304 * opaque DistinguishedName<1..2^16-1>;
11305 *
11306 * struct {
11307 * ClientCertificateType certificate_types<1..2^8-1>;
11308 * DistinguishedName certificate_authorities<3..2^16-1>;
11309 * } CertificateRequest;
11310 *
11311 *
11312 * As per TLSv1.2 (RFC 5246) the format has changed to:
11313 *
11314 * enum {
11315 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11316 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11317 * fortezza_dms_RESERVED(20), (255)
11318 * } ClientCertificateType;
11319 *
11320 * enum {
11321 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11322 * sha512(6), (255)
11323 * } HashAlgorithm;
11324 *
11325 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11326 * SignatureAlgorithm;
11327 *
11328 * struct {
11329 * HashAlgorithm hash;
11330 * SignatureAlgorithm signature;
11331 * } SignatureAndHashAlgorithm;
11332 *
11333 * SignatureAndHashAlgorithm
11334 * supported_signature_algorithms<2..2^16-2>;
11335 *
11336 * opaque DistinguishedName<1..2^16-1>;
11337 *
11338 * struct {
11339 * ClientCertificateType certificate_types<1..2^8-1>;
11340 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11341 * DistinguishedName certificate_authorities<0..2^16-1>;
11342 * } CertificateRequest;
11343 *
11344 * draft-ietf-tls-tls13-18:
11345 * struct {
11346 * opaque certificate_request_context<0..2^8-1>;
11347 * SignatureScheme
11348 * supported_signature_algorithms<2..2^16-2>;
11349 * DistinguishedName certificate_authorities<0..2^16-1>;
11350 * CertificateExtension certificate_extensions<0..2^16-1>;
11351 * } CertificateRequest;
11352 *
11353 * RFC 8446 (since draft-ietf-tls-tls13-19):
11354 *
11355 * struct {
11356 * opaque certificate_request_context<0..2^8-1>;
11357 * Extension extensions<2..2^16-1>;
11358 * } CertificateRequest;
11359 */
11360 proto_item *ti;
11361 proto_tree *subtree;
11362 uint32_t next_offset;
11363 asn1_ctx_t asn1_ctx;
11364 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11365 unsigned char draft_version = session->tls13_draft_version;
11366
11367 if (!tree)
11368 return;
11369
11370 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11371
11372 if (is_tls13) {
11373 uint32_t context_length;
11374 /* opaque certificate_request_context<0..2^8-1> */
11375 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11376 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11377 return;
11378 }
11379 offset++;
11380 if (context_length > 0) {
11381 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11382 tvb, offset, context_length, ENC_NA0x00000000);
11383 offset += context_length;
11384 }
11385 } else {
11386 uint32_t cert_types_count;
11387 /* ClientCertificateType certificate_types<1..2^8-1> */
11388 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11389 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11390 return;
11391 }
11392 offset++;
11393 next_offset = offset + cert_types_count;
11394
11395 ti = proto_tree_add_none_format(tree,
11396 hf->hf.hs_cert_types,
11397 tvb, offset, cert_types_count,
11398 "Certificate types (%u type%s)",
11399 cert_types_count,
11400 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11401 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11402
11403 while (offset < next_offset) {
11404 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11405 offset++;
11406 }
11407 }
11408
11409 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11410 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11411 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11412 }
11413
11414 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11415 /*
11416 * TLS 1.3 draft 19 and newer: Extensions.
11417 * SslDecryptSession pointer is NULL because Certificate Extensions
11418 * should not influence decryption state.
11419 */
11420 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11421 offset_end, SSL_HND_CERT_REQUEST,
11422 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11423 } else if (is_tls13 && draft_version <= 18) {
11424 /*
11425 * TLS 1.3 draft 18 and older: certificate_authorities and
11426 * certificate_extensions (a vector of OID mappings).
11427 */
11428 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11429 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11430 } else {
11431 /* for TLS 1.2 and older, the certificate_authorities field. */
11432 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11433 }
11434}
11435/* Certificate and Certificate Request dissections. }}} */
11436
11437void
11438ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11439 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11440{
11441 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11442 hf->hf.hs_client_cert_vrfy_sig_len,
11443 hf->hf.hs_client_cert_vrfy_sig);
11444}
11445
11446/* Finished dissection. {{{ */
11447void
11448ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11449 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11450 const SslSession *session, ssl_hfs_t *ssl_hfs)
11451{
11452 /* For SSLv3:
11453 * struct {
11454 * opaque md5_hash[16];
11455 * opaque sha_hash[20];
11456 * } Finished;
11457 *
11458 * For (D)TLS:
11459 * struct {
11460 * opaque verify_data[12];
11461 * } Finished;
11462 *
11463 * For TLS 1.3:
11464 * struct {
11465 * opaque verify_data[Hash.length];
11466 * }
11467 */
11468 if (!tree)
11469 return;
11470
11471 if (session->version == SSLV3_VERSION0x300) {
11472 if (ssl_hfs != NULL((void*)0)) {
11473 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11474 tvb, offset, 16, ENC_NA0x00000000);
11475 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11476 tvb, offset + 16, 20, ENC_NA0x00000000);
11477 }
11478 } else {
11479 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11480 proto_tree_add_item(tree, hf->hf.hs_finished,
11481 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11482 }
11483} /* }}} */
11484
11485/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11486void
11487ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11488{
11489 uint16_t url_hash_len;
11490
11491 /* enum {
11492 * individual_certs(0), pkipath(1), (255)
11493 * } CertChainType;
11494 *
11495 * struct {
11496 * CertChainType type;
11497 * URLAndHash url_and_hash_list<1..2^16-1>;
11498 * } CertificateURL;
11499 *
11500 * struct {
11501 * opaque url<1..2^16-1>;
11502 * unint8 padding;
11503 * opaque SHA1Hash[20];
11504 * } URLAndHash;
11505 */
11506
11507 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11508 tvb, offset, 1, ENC_NA0x00000000);
11509 offset++;
11510
11511 url_hash_len = tvb_get_ntohs(tvb, offset);
11512 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11513 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11514 offset += 2;
11515 while (url_hash_len-- > 0) {
11516 proto_item *urlhash_item;
11517 proto_tree *urlhash_tree;
11518 uint16_t url_len;
11519
11520 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11521 tvb, offset, -1, ENC_NA0x00000000);
11522 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11523
11524 url_len = tvb_get_ntohs(tvb, offset);
11525 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11526 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11527 offset += 2;
11528
11529 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11530 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11531 offset += url_len;
11532
11533 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11534 tvb, offset, 1, ENC_NA0x00000000);
11535 offset++;
11536 /* Note: RFC 6066 says that padding must be 0x01 */
11537
11538 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11539 tvb, offset, 20, ENC_NA0x00000000);
11540 offset += 20;
11541 }
11542} /* }}} */
11543
11544void
11545ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11546 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11547 SslSession *session, SslDecryptSession *ssl,
11548 bool_Bool is_from_server, bool_Bool is_dtls)
11549{
11550 uint32_t algorithm, uncompressed_length;
11551 uint32_t compressed_certificate_message_length;
11552 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11553 proto_item *ti;
11554 /*
11555 * enum {
11556 * zlib(1),
11557 * brotli(2),
11558 * zstd(3),
11559 * (65535)
11560 * } CertificateCompressionAlgorithm;
11561 *
11562 * struct {
11563 * CertificateCompressionAlgorithm algorithm;
11564 * uint24 uncompressed_length;
11565 * opaque compressed_certificate_message<1..2^24-1>;
11566 * } CompressedCertificate;
11567 */
11568
11569 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11570 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11571 offset += 2;
11572
11573 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11574 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11575 offset += 3;
11576
11577 /* opaque compressed_certificate_message<1..2^24-1>; */
11578 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11579 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11580 return;
11581 }
11582 offset += 3;
11583
11584 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11585 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11586
11587 /* Certificate decompression following algorithm */
11588 switch (algorithm) {
11589 case 1: /* zlib */
11590 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11591 break;
11592 case 2: /* brotli */
11593 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11594 break;
11595 case 3: /* zstd */
11596 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11597 break;
11598 }
11599
11600 if (uncompressed_tvb) {
11601 proto_tree *uncompressed_tree;
11602
11603 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11604 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11605 tvb, offset, offset_end - offset,
11606 "Invalid uncompressed length %u (expected %u)",
11607 tvb_captured_length(uncompressed_tvb),
11608 uncompressed_length);
11609 } else {
11610 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11611 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11612 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11613 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11614 }
11615 }
11616}
11617
11618/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11619static int
11620// NOLINTNEXTLINE(misc-no-recursion)
11621ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11622 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11623 SslSession *session, SslDecryptSession *ssl,
11624 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11625 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length)
11626{
11627 uint32_t exts_len;
11628 uint16_t ext_type;
11629 uint32_t ext_len;
11630 uint32_t next_offset;
11631 proto_item *ext_item;
11632 proto_tree *ext_tree;
11633 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11634 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11635 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11636 char *ja3_dash = "";
11637 unsigned supported_version;
11638
11639 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11640 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11641 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11642 return offset_end;
11643 }
11644 offset += 2;
11645 offset_end = offset + exts_len;
11646
11647 if (ja4_data) {
11648 ja4_data->num_extensions = 0;
11649 }
11650 while (offset_end - offset >= 4)
11651 {
11652 ext_type = tvb_get_ntohs(tvb, offset);
11653 ext_len = tvb_get_ntohs(tvb, offset + 2);
11654
11655 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11656 ja4_data->num_extensions += 1;
11657 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11658 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11659 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11660 }
11661 }
11662
11663 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11664 "Extension: %s (len=%u)", val_to_str(ext_type,
11665 tls_hello_extension_types,
11666 "Unknown type %u"), ext_len);
11667 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11668
11669 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11670 tvb, offset, 2, ext_type);
11671 offset += 2;
11672 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11673 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11674 ja3_dash = "-";
11675 }
11676
11677 /* opaque extension_data<0..2^16-1> */
11678 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11679 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11680 return offset_end;
11681 }
11682 offset += 2;
11683 next_offset = offset + ext_len;
11684
11685 switch (ext_type) {
11686 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11687 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11688 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11689 if (ja4_data) {
11690 ja4_data->server_name_present = true1;
11691 }
11692 }
11693 break;
11694 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11695 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11696 offset += 1;
11697 break;
11698 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11699 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11700 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11701 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11702 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11703 }
11704 break;
11705 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11706 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11707 offset, next_offset,
11708 hnd_type, ext_type,
11709 session);
11710 break;
11711 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11712 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11713 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11714 next_offset, ja3_sg);
11715 } else {
11716 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11717 next_offset, NULL((void*)0));
11718 }
11719 break;
11720 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11721 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11722 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11723 } else {
11724 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11725 }
11726 break;
11727 break;
11728 case SSL_HND_HELLO_EXT_SRP12:
11729 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11730 break;
11731 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11732 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11733 break;
11734 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11735 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11736 break;
11737 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11738 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11739 break;
11740 case SSL_HND_HELLO_EXT_USE_SRTP14:
11741 if (is_dtls) {
11742 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11743 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11744 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11745 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11746 }
11747 } else {
11748 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11749 }
11750 break;
11751 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11752 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11753 break;
11754 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11755 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map, initial_offset, hello_length);
11756 break;
11757 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11758 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11759 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11760 offset++;
11761 break;
11762 case SSL_HND_HELLO_EXT_ALPN16:
11763 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11764 break;
11765 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11766 if (hnd_type == SSL_HND_CLIENT_HELLO)
11767 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11768 break;
11769 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11770 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11771 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11772 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11773 break;
11774 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11775 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11776 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11777 offset, next_offset,
11778 hnd_type, ext_type,
11779 session);
11780 break;
11781 case SSL_HND_HELLO_EXT_PADDING21:
11782 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11783 offset += ext_len;
11784 break;
11785 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11786 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11787 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11788 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11789 }
11790 break;
11791 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11792 if (ssl) {
11793 switch (hnd_type) {
11794 case SSL_HND_CLIENT_HELLO:
11795 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11796 break;
11797 case SSL_HND_SERVER_HELLO:
11798 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11799 break;
11800 default: /* no default */
11801 break;
11802 }
11803 }
11804 break;
11805 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11806 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11807 break;
11808 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11809 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11810 break;
11811 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11812 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11813 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11814 offset += 2;
11815 break;
11816 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11817 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11818 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11819 break;
11820 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11821 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11822 break;
11823 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11824 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11825 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11826 break;
11827 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11828 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11829 break;
11830 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11831 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11832 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11833 break;
11834 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11835 switch (hnd_type) {
11836 case SSL_HND_CLIENT_HELLO:
11837 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11838 break;
11839 case SSL_HND_SERVER_HELLO:
11840 case SSL_HND_HELLO_RETRY_REQUEST:
11841 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11842 offset += 2;
11843 proto_item_append_text(ext_tree, " %s", val_to_str(supported_version, ssl_versions, "Unknown (0x%04x)"));
11844 break;
11845 }
11846 break;
11847 case SSL_HND_HELLO_EXT_COOKIE44:
11848 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11849 break;
11850 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11851 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11852 break;
11853 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11854 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11855 break;
11856 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11857 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11858 break;
11859 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11860 break;
11861 case SSL_HND_HELLO_EXT_NPN13172:
11862 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11863 break;
11864 case SSL_HND_HELLO_EXT_ALPS17513:
11865 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11866 break;
11867 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11868 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11869 break;
11870 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11871 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11872 break;
11873 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11874 session->deprecated_cid = true1;
11875 /* FALLTHRU */
11876 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11877 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11878 break;
11879 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11880 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11881 break;
11882 default:
11883 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11884 tvb, offset, ext_len, ENC_NA0x00000000);
11885 offset += ext_len;
11886 break;
11887 }
11888
11889 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11890 /* Dissection did not end at expected location, fix it. */
11891 offset = next_offset;
11892 }
11893 }
11894
11895 if (ja3) {
11896 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11897 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11898 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11899 } else {
11900 wmem_strbuf_append_c(ja3, ',');
11901 }
11902 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11903 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11904 } else {
11905 wmem_strbuf_append_c(ja3, ',');
11906 }
11907 }
11908 }
11909
11910 /* Check if Extensions vector is correctly terminated. */
11911 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11912 offset = offset_end;
11913 }
11914
11915 return offset;
11916} /* }}} */
11917
11918
11919/* ClientKeyExchange algo-specific dissectors. {{{ */
11920
11921static void
11922dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11923 proto_tree *tree, uint32_t offset,
11924 uint32_t length)
11925{
11926 int point_len;
11927 proto_tree *ssl_ecdh_tree;
11928
11929 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11930 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11931
11932 /* point */
11933 point_len = tvb_get_uint8(tvb, offset);
11934 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11935 offset, 1, ENC_BIG_ENDIAN0x00000000);
11936 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11937 offset + 1, point_len, ENC_NA0x00000000);
11938}
11939
11940static void
11941dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11942 proto_tree *tree, uint32_t offset, uint32_t length)
11943{
11944 int yc_len;
11945 proto_tree *ssl_dh_tree;
11946
11947 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11948 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11949
11950 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11951 yc_len = tvb_get_ntohs(tvb, offset);
11952 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11953 offset, 2, ENC_BIG_ENDIAN0x00000000);
11954 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11955 offset + 2, yc_len, ENC_NA0x00000000);
11956}
11957
11958static void
11959dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11960 proto_tree *tree, uint32_t offset,
11961 uint32_t length, const SslSession *session)
11962{
11963 int epms_len;
11964 proto_tree *ssl_rsa_tree;
11965
11966 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11967 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11968
11969 /* EncryptedPreMasterSecret.pre_master_secret */
11970 switch (session->version) {
11971 case SSLV2_VERSION0x0002:
11972 case SSLV3_VERSION0x300:
11973 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11974 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11975 * not present. The handshake contents represents the EPMS, see:
11976 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11977 epms_len = length;
11978 break;
11979
11980 default:
11981 /* TLS and DTLS include vector length before EPMS */
11982 epms_len = tvb_get_ntohs(tvb, offset);
11983 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11984 offset, 2, ENC_BIG_ENDIAN0x00000000);
11985 offset += 2;
11986 break;
11987 }
11988 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11989 offset, epms_len, ENC_NA0x00000000);
11990}
11991
11992/* Used in PSK cipher suites */
11993static uint32_t
11994dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11995 proto_tree *tree, uint32_t offset)
11996{
11997 unsigned identity_len;
11998 proto_tree *ssl_psk_tree;
11999
12000 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12001 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
12002 /* identity */
12003 identity_len = tvb_get_ntohs(tvb, offset);
12004 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
12005 offset, 2, ENC_BIG_ENDIAN0x00000000);
12006 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
12007 offset + 2, identity_len, ENC_NA0x00000000);
12008
12009 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
12010 return 2 + identity_len;
12011}
12012
12013/* Used in RSA PSK cipher suites */
12014static void
12015dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12016 proto_tree *tree, uint32_t offset,
12017 uint32_t length)
12018{
12019 int identity_len, epms_len;
12020 proto_tree *ssl_psk_tree;
12021
12022 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12023 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
12024
12025 /* identity */
12026 identity_len = tvb_get_ntohs(tvb, offset);
12027 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
12028 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12029 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
12030 tvb, offset + 2, identity_len, ENC_NA0x00000000);
12031 offset += 2 + identity_len;
12032
12033 /* Yc */
12034 epms_len = tvb_get_ntohs(tvb, offset);
12035 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12036 offset, 2, ENC_BIG_ENDIAN0x00000000);
12037 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
12038 offset + 2, epms_len, ENC_NA0x00000000);
12039}
12040
12041/* Used in Diffie-Hellman PSK cipher suites */
12042static void
12043dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12044 proto_tree *tree, uint32_t offset, uint32_t length)
12045{
12046 /*
12047 * struct {
12048 * select (KeyExchangeAlgorithm) {
12049 * case diffie_hellman_psk:
12050 * opaque psk_identity<0..2^16-1>;
12051 * ClientDiffieHellmanPublic public;
12052 * } exchange_keys;
12053 * } ClientKeyExchange;
12054 */
12055
12056 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12057 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
12058}
12059
12060/* Used in EC Diffie-Hellman PSK cipher suites */
12061static void
12062dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12063 proto_tree *tree, uint32_t offset, uint32_t length)
12064{
12065 /*
12066 * struct {
12067 * select (KeyExchangeAlgorithm) {
12068 * case ec_diffie_hellman_psk:
12069 * opaque psk_identity<0..2^16-1>;
12070 * ClientECDiffieHellmanPublic public;
12071 * } exchange_keys;
12072 * } ClientKeyExchange;
12073 */
12074
12075 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12076 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
12077}
12078
12079/* Used in EC J-PAKE cipher suites */
12080static void
12081dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12082 proto_tree *tree, uint32_t offset,
12083 uint32_t length)
12084{
12085 /*
12086 * struct {
12087 * ECPoint V;
12088 * opaque r<1..2^8-1>;
12089 * } ECSchnorrZKP;
12090 *
12091 * struct {
12092 * ECPoint X;
12093 * ECSchnorrZKP zkp;
12094 * } ECJPAKEKeyKP;
12095 *
12096 * struct {
12097 * ECJPAKEKeyKP ecjpake_key_kp;
12098 * } ClientECJPAKEParams;
12099 *
12100 * select (KeyExchangeAlgorithm) {
12101 * case ecjpake:
12102 * ClientECJPAKEParams params;
12103 * } ClientKeyExchange;
12104 */
12105
12106 int point_len;
12107 proto_tree *ssl_ecjpake_tree;
12108
12109 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12110 hf->ett.keyex_params, NULL((void*)0),
12111 "EC J-PAKE Client Params");
12112
12113 /* ECJPAKEKeyKP.X */
12114 point_len = tvb_get_uint8(tvb, offset);
12115 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12116 offset, 1, ENC_BIG_ENDIAN0x00000000);
12117 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12118 offset + 1, point_len, ENC_NA0x00000000);
12119 offset += 1 + point_len;
12120
12121 /* ECJPAKEKeyKP.zkp.V */
12122 point_len = tvb_get_uint8(tvb, offset);
12123 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12124 offset, 1, ENC_BIG_ENDIAN0x00000000);
12125 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12126 offset + 1, point_len, ENC_NA0x00000000);
12127 offset += 1 + point_len;
12128
12129 /* ECJPAKEKeyKP.zkp.r */
12130 point_len = tvb_get_uint8(tvb, offset);
12131 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12132 offset, 1, ENC_BIG_ENDIAN0x00000000);
12133 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12134 offset + 1, point_len, ENC_NA0x00000000);
12135}
12136
12137static void
12138dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12139 proto_tree *tree, uint32_t offset,
12140 uint32_t length)
12141{
12142 int epms_len;
12143 proto_tree *ssl_ecc_sm2_tree;
12144
12145 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12146 hf->ett.keyex_params, NULL((void*)0),
12147 "ECC-SM2 Encrypted PreMaster Secret");
12148
12149 epms_len = tvb_get_ntohs(tvb, offset);
12150 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12151 offset, 2, ENC_BIG_ENDIAN0x00000000);
12152 offset += 2;
12153 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12154 offset, epms_len, ENC_NA0x00000000);
12155}
12156/* ClientKeyExchange algo-specific dissectors. }}} */
12157
12158
12159/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12160static uint32_t
12161ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12162 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12163 uint16_t version, int hf_sig_len, int hf_sig)
12164{
12165 uint32_t sig_len;
12166
12167 switch (version) {
12168 case TLSV1DOT2_VERSION0x303:
12169 case DTLSV1DOT2_VERSION0xfefd:
12170 case TLSV1DOT3_VERSION0x304:
12171 case DTLSV1DOT3_VERSION0xfefc:
12172 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12173 offset += 2;
12174 break;
12175
12176 default:
12177 break;
12178 }
12179
12180 /* Sig */
12181 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12182 hf_sig_len, 0, UINT16_MAX(65535))) {
12183 return offset_end;
12184 }
12185 offset += 2;
12186 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12187 offset += sig_len;
12188 return offset;
12189} /* }}} */
12190
12191/* ServerKeyExchange algo-specific dissectors. {{{ */
12192
12193/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12194static void
12195dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12196 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12197 uint16_t version)
12198{
12199 /*
12200 * TLSv1.2 (RFC 5246 sec 7.4.8)
12201 * struct {
12202 * digitally-signed struct {
12203 * opaque handshake_messages[handshake_messages_length];
12204 * }
12205 * } CertificateVerify;
12206 *
12207 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12208 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12209 *
12210 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12211 * does more hashing including the master secret and padding.
12212 */
12213 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12214 hf->hf.hs_server_keyex_sig_len,
12215 hf->hf.hs_server_keyex_sig);
12216}
12217
12218static uint32_t
12219dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12220{
12221 /*
12222 * RFC 4492 ECC cipher suites for TLS
12223 *
12224 * struct {
12225 * ECCurveType curve_type;
12226 * select (curve_type) {
12227 * case explicit_prime:
12228 * ...
12229 * case explicit_char2:
12230 * ...
12231 * case named_curve:
12232 * NamedCurve namedcurve;
12233 * };
12234 * } ECParameters;
12235 */
12236
12237 int curve_type;
12238
12239 /* ECParameters.curve_type */
12240 curve_type = tvb_get_uint8(tvb, offset);
12241 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12242 offset, 1, ENC_BIG_ENDIAN0x00000000);
12243 offset++;
12244
12245 if (curve_type != 3)
12246 return offset_end; /* only named_curves are supported */
12247
12248 /* case curve_type == named_curve; ECParameters.namedcurve */
12249 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12250 offset, 2, ENC_BIG_ENDIAN0x00000000);
12251 offset += 2;
12252
12253 return offset;
12254}
12255
12256static void
12257dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12258 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12259 uint16_t version, bool_Bool anon)
12260{
12261 /*
12262 * RFC 4492 ECC cipher suites for TLS
12263 *
12264 * struct {
12265 * opaque point <1..2^8-1>;
12266 * } ECPoint;
12267 *
12268 * struct {
12269 * ECParameters curve_params;
12270 * ECPoint public;
12271 * } ServerECDHParams;
12272 *
12273 * select (KeyExchangeAlgorithm) {
12274 * case ec_diffie_hellman:
12275 * ServerECDHParams params;
12276 * Signature signed_params;
12277 * } ServerKeyExchange;
12278 */
12279
12280 int point_len;
12281 proto_tree *ssl_ecdh_tree;
12282
12283 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12284 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12285
12286 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12287 if (offset >= offset_end)
12288 return; /* only named_curves are supported */
12289
12290 /* ECPoint.point */
12291 point_len = tvb_get_uint8(tvb, offset);
12292 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12293 offset, 1, ENC_BIG_ENDIAN0x00000000);
12294 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12295 offset + 1, point_len, ENC_NA0x00000000);
12296 offset += 1 + point_len;
12297
12298 /* Signature (if non-anonymous KEX) */
12299 if (!anon) {
12300 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12301 }
12302}
12303
12304static void
12305dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12306 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12307 uint16_t version, bool_Bool anon)
12308{
12309 int p_len, g_len, ys_len;
12310 proto_tree *ssl_dh_tree;
12311
12312 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12313 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12314
12315 /* p */
12316 p_len = tvb_get_ntohs(tvb, offset);
12317 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12318 offset, 2, ENC_BIG_ENDIAN0x00000000);
12319 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12320 offset + 2, p_len, ENC_NA0x00000000);
12321 offset += 2 + p_len;
12322
12323 /* g */
12324 g_len = tvb_get_ntohs(tvb, offset);
12325 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12326 offset, 2, ENC_BIG_ENDIAN0x00000000);
12327 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12328 offset + 2, g_len, ENC_NA0x00000000);
12329 offset += 2 + g_len;
12330
12331 /* Ys */
12332 ys_len = tvb_get_ntohs(tvb, offset);
12333 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12334 offset, 2, ys_len);
12335 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12336 offset + 2, ys_len, ENC_NA0x00000000);
12337 offset += 2 + ys_len;
12338
12339 /* Signature (if non-anonymous KEX) */
12340 if (!anon) {
12341 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12342 }
12343}
12344
12345/* Only used in RSA-EXPORT cipher suites */
12346static void
12347dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12348 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12349 uint16_t version)
12350{
12351 int modulus_len, exponent_len;
12352 proto_tree *ssl_rsa_tree;
12353
12354 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12355 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12356
12357 /* modulus */
12358 modulus_len = tvb_get_ntohs(tvb, offset);
12359 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12360 offset, 2, ENC_BIG_ENDIAN0x00000000);
12361 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12362 offset + 2, modulus_len, ENC_NA0x00000000);
12363 offset += 2 + modulus_len;
12364
12365 /* exponent */
12366 exponent_len = tvb_get_ntohs(tvb, offset);
12367 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12368 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12369 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12370 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12371 offset += 2 + exponent_len;
12372
12373 /* Signature */
12374 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12375}
12376
12377/* Used in RSA PSK and PSK cipher suites */
12378static uint32_t
12379dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12380 proto_tree *tree, uint32_t offset)
12381{
12382 unsigned hint_len;
12383 proto_tree *ssl_psk_tree;
12384
12385 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12386 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12387
12388 /* hint */
12389 hint_len = tvb_get_ntohs(tvb, offset);
12390 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12391 offset, 2, ENC_BIG_ENDIAN0x00000000);
12392 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12393 offset + 2, hint_len, ENC_NA0x00000000);
12394
12395 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12396 return 2 + hint_len;
12397}
12398
12399/* Used in Diffie-Hellman PSK cipher suites */
12400static void
12401dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12402 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12403{
12404 /*
12405 * struct {
12406 * select (KeyExchangeAlgorithm) {
12407 * case diffie_hellman_psk:
12408 * opaque psk_identity_hint<0..2^16-1>;
12409 * ServerDHParams params;
12410 * };
12411 * } ServerKeyExchange;
12412 */
12413
12414 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12415 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12416}
12417
12418/* Used in EC Diffie-Hellman PSK cipher suites */
12419static void
12420dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12421 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12422{
12423 /*
12424 * struct {
12425 * select (KeyExchangeAlgorithm) {
12426 * case ec_diffie_hellman_psk:
12427 * opaque psk_identity_hint<0..2^16-1>;
12428 * ServerECDHParams params;
12429 * };
12430 * } ServerKeyExchange;
12431 */
12432
12433 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12434 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12435}
12436
12437/* Used in EC J-PAKE cipher suites */
12438static void
12439dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12440 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12441{
12442 /*
12443 * struct {
12444 * ECPoint V;
12445 * opaque r<1..2^8-1>;
12446 * } ECSchnorrZKP;
12447 *
12448 * struct {
12449 * ECPoint X;
12450 * ECSchnorrZKP zkp;
12451 * } ECJPAKEKeyKP;
12452 *
12453 * struct {
12454 * ECParameters curve_params;
12455 * ECJPAKEKeyKP ecjpake_key_kp;
12456 * } ServerECJPAKEParams;
12457 *
12458 * select (KeyExchangeAlgorithm) {
12459 * case ecjpake:
12460 * ServerECJPAKEParams params;
12461 * } ServerKeyExchange;
12462 */
12463
12464 int point_len;
12465 proto_tree *ssl_ecjpake_tree;
12466
12467 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12468 hf->ett.keyex_params, NULL((void*)0),
12469 "EC J-PAKE Server Params");
12470
12471 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12472 if (offset >= offset_end)
12473 return; /* only named_curves are supported */
12474
12475 /* ECJPAKEKeyKP.X */
12476 point_len = tvb_get_uint8(tvb, offset);
12477 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12478 offset, 1, ENC_BIG_ENDIAN0x00000000);
12479 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12480 offset + 1, point_len, ENC_NA0x00000000);
12481 offset += 1 + point_len;
12482
12483 /* ECJPAKEKeyKP.zkp.V */
12484 point_len = tvb_get_uint8(tvb, offset);
12485 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12486 offset, 1, ENC_BIG_ENDIAN0x00000000);
12487 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12488 offset + 1, point_len, ENC_NA0x00000000);
12489 offset += 1 + point_len;
12490
12491 /* ECJPAKEKeyKP.zkp.r */
12492 point_len = tvb_get_uint8(tvb, offset);
12493 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12494 offset, 1, ENC_BIG_ENDIAN0x00000000);
12495 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12496 offset + 1, point_len, ENC_NA0x00000000);
12497}
12498
12499/* Only used in ECC-SM2-EXPORT cipher suites */
12500static void
12501dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12502 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12503 uint16_t version)
12504{
12505 proto_tree *ssl_ecc_sm2_tree;
12506
12507 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12508 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12509
12510 /* Signature */
12511 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12512}
12513/* ServerKeyExchange algo-specific dissectors. }}} */
12514
12515/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12516void
12517ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12518 proto_tree *tree, uint32_t offset, uint32_t length,
12519 const SslSession *session)
12520{
12521 switch (ssl_get_keyex_alg(session->cipher)) {
12522 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12523 case KEX_DH_DSS0x14:
12524 case KEX_DH_RSA0x15:
12525 case KEX_DHE_DSS0x10:
12526 case KEX_DHE_RSA0x12:
12527 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12528 break;
12529 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12530 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12531 break;
12532 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12533 case KEX_ECDH_ECDSA0x1a:
12534 case KEX_ECDH_RSA0x1b:
12535 case KEX_ECDHE_ECDSA0x16:
12536 case KEX_ECDHE_RSA0x18:
12537 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12538 break;
12539 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12540 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12541 break;
12542 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12543 /* XXX: implement support for KRB5 */
12544 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12545 tvb, offset, length,
12546 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12547 " developers if you want them to be supported");
12548 break;
12549 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12550 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12551 break;
12552 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12553 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12554 break;
12555 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12556 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12557 break;
12558 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12559 case KEX_SRP_SHA_DSS0x21:
12560 case KEX_SRP_SHA_RSA0x22:
12561 /* XXX: implement support for SRP_SHA* */
12562 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12563 tvb, offset, length,
12564 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12565 " developers if you want them to be supported");
12566 break;
12567 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12568 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12569 break;
12570 case KEX_ECC_SM20x26: /* GB/T 38636 */
12571 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12572 break;
12573 default:
12574 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12575 tvb, offset, length);
12576 break;
12577 }
12578}
12579
12580void
12581ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12582 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12583 const SslSession *session)
12584{
12585 switch (ssl_get_keyex_alg(session->cipher)) {
12586 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12587 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12588 break;
12589 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12590 case KEX_DH_RSA0x15:
12591 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12592 tvb, offset, offset_end - offset);
12593 break;
12594 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12595 case KEX_DHE_RSA0x12:
12596 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12597 break;
12598 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12599 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12600 break;
12601 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12602 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12603 break;
12604 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12605 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12606 break;
12607 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12608 case KEX_ECDH_RSA0x1b:
12609 case KEX_ECDHE_ECDSA0x16:
12610 case KEX_ECDHE_RSA0x18:
12611 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12612 break;
12613 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12614 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12615 tvb, offset, offset_end - offset);
12616 break;
12617 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12618 case KEX_RSA_PSK0x1f:
12619 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12620 break;
12621 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12622 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12623 break;
12624 case KEX_ECC_SM20x26: /* GB/T 38636 */
12625 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12626 break;
12627 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12628 case KEX_SRP_SHA_DSS0x21:
12629 case KEX_SRP_SHA_RSA0x22:
12630 /* XXX: implement support for SRP_SHA* */
12631 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12632 tvb, offset, offset_end - offset,
12633 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12634 " developers if you want them to be supported");
12635 break;
12636 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12637 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12638 break;
12639 default:
12640 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12641 tvb, offset, offset_end - offset);
12642 break;
12643 }
12644}
12645/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12646
12647void
12648tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12649 proto_tree *tree, uint32_t offset)
12650{
12651 /* RFC 8446 Section 4.6.3
12652 * enum {
12653 * update_not_requested(0), update_requested(1), (255)
12654 * } KeyUpdateRequest;
12655 *
12656 * struct {
12657 * KeyUpdateRequest request_update;
12658 * } KeyUpdate;
12659 */
12660 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12661}
12662
12663void
12664ssl_common_register_ssl_alpn_dissector_table(const char *name,
12665 const char *ui_name, const int proto)
12666{
12667 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12668 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12669 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12670}
12671
12672void
12673ssl_common_register_dtls_alpn_dissector_table(const char *name,
12674 const char *ui_name, const int proto)
12675{
12676 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12677 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12678 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12679}
12680
12681void
12682ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12683{
12684 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12685 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12686 &(options->psk));
12687
12688 if (is_dtls) {
12689 prefs_register_obsolete_preference(module, "keylog_file");
12690 prefs_register_static_text_preference(module, "keylog_file_removed",
12691 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12692 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12693 return;
12694 }
12695
12696 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12697 "The name of a file which contains a list of \n"
12698 "(pre-)master secrets in one of the following formats:\n"
12699 "\n"
12700 "RSA <EPMS> <PMS>\n"
12701 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12702 "CLIENT_RANDOM <CRAND> <MS>\n"
12703 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12704 "\n"
12705 "Where:\n"
12706 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12707 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12708 "<SSLID> = The SSL Session ID\n"
12709 "<MS> = The Master-Secret (MS)\n"
12710 "<CRAND> = The Client's random number from the ClientHello message\n"
12711 "\n"
12712 "(All fields are in hex notation)",
12713 &(options->keylog_filename), false0);
12714}
12715
12716void
12717ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length)
12718{
12719 if (ssl_session && ssl_session->session.version != TLSV1DOT3_VERSION0x304 && !(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
12720 uint32_t old_length = ssl_session->handshake_data.data_len;
12721 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12722 if (tvb) {
12723 if (tvb_bytes_exist(tvb, offset, length)) {
12724 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12725 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12726 ssl_session->handshake_data.data_len += length;
12727 }
12728 } else {
12729 /* DTLS calculates the hash as if each handshake message had been
12730 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12731 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12732 */
12733 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12733, (int64_t)length, (int64_t)4))))
;
12734 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12735 memset(ssl_session->handshake_data.data + old_length, 0, length);
12736 ssl_session->handshake_data.data_len += length;
12737 }
12738 }
12739}
12740
12741
12742/*
12743 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12744 *
12745 * Local variables:
12746 * c-basic-offset: 4
12747 * tab-width: 8
12748 * indent-tabs-mode: nil
12749 * End:
12750 *
12751 * vi: set shiftwidth=4 tabstop=8 expandtab:
12752 * :indentSize=4:tabSize=8:noTabs=true:
12753 */