Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 4073, column 17
Potential leak of memory pointed to by 'handshake_hashed_data.data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-08-22-100317-3660-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 /* PQC digital signature algorithms from OQS-OpenSSL,
1539 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1540 { 0xfea0, "dilithium2" },
1541 { 0xfea1, "p256_dilithium2" },
1542 { 0xfea2, "rsa3072_dilithium2" },
1543 { 0xfea3, "dilithium3" },
1544 { 0xfea4, "p384_dilithium3" },
1545 { 0xfea5, "dilithium5" },
1546 { 0xfea6, "p521_dilithium5" },
1547 { 0xfea7, "dilithium2_aes" },
1548 { 0xfea8, "p256_dilithium2_aes" },
1549 { 0xfea9, "rsa3072_dilithium2_aes" },
1550 { 0xfeaa, "dilithium3_aes" },
1551 { 0xfeab, "p384_dilithium3_aes" },
1552 { 0xfeac, "dilithium5_aes" },
1553 { 0xfead, "p521_dilithium5_aes" },
1554 { 0xfe0b, "falcon512" },
1555 { 0xfe0c, "p256_falcon512" },
1556 { 0xfe0d, "rsa3072_falcon512" },
1557 { 0xfe0e, "falcon1024" },
1558 { 0xfe0f, "p521_falcon1024" },
1559 { 0xfe96, "picnicl1full" },
1560 { 0xfe97, "p256_picnicl1full" },
1561 { 0xfe98, "rsa3072_picnicl1full" },
1562 { 0xfe1b, "picnic3l1" },
1563 { 0xfe1c, "p256_picnic3l1" },
1564 { 0xfe1d, "rsa3072_picnic3l1" },
1565 { 0xfe27, "rainbowIclassic" },
1566 { 0xfe28, "p256_rainbowIclassic" },
1567 { 0xfe29, "rsa3072_rainbowIclassic" },
1568 { 0xfe3c, "rainbowVclassic" },
1569 { 0xfe3d, "p521_rainbowVclassic" },
1570 { 0xfe42, "sphincsharaka128frobust" },
1571 { 0xfe43, "p256_sphincsharaka128frobust" },
1572 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1573 { 0xfe5e, "sphincssha256128frobust" },
1574 { 0xfe5f, "p256_sphincssha256128frobust" },
1575 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1576 { 0xfe7a, "sphincsshake256128frobust" },
1577 { 0xfe7b, "p256_sphincsshake256128frobust" },
1578 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1579 { 0, NULL((void*)0) }
1580};
1581
1582/* RFC 6091 3.1 */
1583const value_string tls_certificate_type[] = {
1584 { 0, "X.509" },
1585 { 1, "OpenPGP" },
1586 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1587 { 0, NULL((void*)0) }
1588};
1589
1590const value_string tls_cert_chain_type[] = {
1591 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1592 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1593 { 0, NULL((void*)0) }
1594};
1595
1596const value_string tls_cert_status_type[] = {
1597 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1598 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1599 { 0, NULL((void*)0) }
1600};
1601
1602/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1603 * Last-Modified Sat, 11 Jul 2026 13:58:00 GMT, 42 entries. */
1604static const bytes_string ct_logids[] = {
1605 { (const uint8_t[]){
1606 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1607 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1608 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1609 },
1610 32, "Google 'Argon2026h1' log" },
1611 { (const uint8_t[]){
1612 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1613 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1614 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1615 },
1616 32, "Google 'Argon2026h2' log" },
1617 { (const uint8_t[]){
1618 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1619 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1620 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1621 },
1622 32, "Google 'Argon2027h1'" },
1623 { (const uint8_t[]){
1624 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1625 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1626 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1627 },
1628 32, "Google 'Xenon2026h1' log" },
1629 { (const uint8_t[]){
1630 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1631 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1632 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1633 },
1634 32, "Google 'Xenon2026h2' log" },
1635 { (const uint8_t[]){
1636 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1637 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1638 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1639 },
1640 32, "Google 'Xenon2027h1'" },
1641 { (const uint8_t[]){
1642 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1643 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1644 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1645 },
1646 32, "Google 'Submariner' log" },
1647 { (const uint8_t[]){
1648 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1649 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1650 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1651 },
1652 32, "Google 'Daedalus' log" },
1653 { (const uint8_t[]){
1654 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1655 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1656 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1657 },
1658 32, "Google 'Testtube' log" },
1659 { (const uint8_t[]){
1660 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1661 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1662 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1663 },
1664 32, "Google 'Crucible' log" },
1665 { (const uint8_t[]){
1666 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1667 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1668 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1669 },
1670 32, "Google 'Solera2026h1' log" },
1671 { (const uint8_t[]){
1672 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1673 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1674 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1675 },
1676 32, "Google 'Solera2026h2' log" },
1677 { (const uint8_t[]){
1678 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1679 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1680 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1681 },
1682 32, "Google 'Solera2027h1' log" },
1683 { (const uint8_t[]){
1684 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1685 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1686 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1687 },
1688 32, "Cloudflare 'Nimbus2026'" },
1689 { (const uint8_t[]){
1690 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1691 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1692 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1693 },
1694 32, "Cloudflare 'Nimbus2027'" },
1695 { (const uint8_t[]){
1696 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1697 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1698 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1699 },
1700 32, "DigiCert 'Wyvern2026h1'" },
1701 { (const uint8_t[]){
1702 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1703 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1704 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1705 },
1706 32, "DigiCert 'Wyvern2026h2'" },
1707 { (const uint8_t[]){
1708 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1709 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1710 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1711 },
1712 32, "DigiCert 'Wyvern2027h1'" },
1713 { (const uint8_t[]){
1714 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1715 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1716 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1717 },
1718 32, "DigiCert 'Wyvern2027h2'" },
1719 { (const uint8_t[]){
1720 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1721 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1722 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1723 },
1724 32, "DigiCert 'Sphinx2026h1'" },
1725 { (const uint8_t[]){
1726 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1727 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1728 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1729 },
1730 32, "DigiCert 'Sphinx2026h2'" },
1731 { (const uint8_t[]){
1732 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1733 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1734 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1735 },
1736 32, "DigiCert 'sphinx2027h1'" },
1737 { (const uint8_t[]){
1738 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1739 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1740 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1741 },
1742 32, "DigiCert 'sphinx2027h2'" },
1743 { (const uint8_t[]){
1744 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1745 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1746 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1747 },
1748 32, "Sectigo 'Mammoth2026h1'" },
1749 { (const uint8_t[]){
1750 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1751 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1752 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1753 },
1754 32, "Sectigo 'Mammoth2026h2'" },
1755 { (const uint8_t[]){
1756 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1757 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1758 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1759 },
1760 32, "Sectigo 'Sabre2026h1'" },
1761 { (const uint8_t[]){
1762 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1763 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1764 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1765 },
1766 32, "Sectigo 'Sabre2026h2'" },
1767 { (const uint8_t[]){
1768 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1769 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1770 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1771 },
1772 32, "Sectigo 'Elephant2026h1'" },
1773 { (const uint8_t[]){
1774 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1775 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1776 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1777 },
1778 32, "Sectigo 'Elephant2026h2'" },
1779 { (const uint8_t[]){
1780 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1781 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1782 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1783 },
1784 32, "Sectigo 'Elephant2027h1'" },
1785 { (const uint8_t[]){
1786 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1787 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1788 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1789 },
1790 32, "Sectigo 'Elephant2027h2'" },
1791 { (const uint8_t[]){
1792 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1793 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1794 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1795 },
1796 32, "Sectigo 'Tiger2026h1'" },
1797 { (const uint8_t[]){
1798 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1799 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1800 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1801 },
1802 32, "Sectigo 'Tiger2026h2'" },
1803 { (const uint8_t[]){
1804 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1805 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1806 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1807 },
1808 32, "Sectigo 'Tiger2027h1'" },
1809 { (const uint8_t[]){
1810 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1811 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1812 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1813 },
1814 32, "Sectigo 'Tiger2027h2'" },
1815 { (const uint8_t[]){
1816 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1817 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1818 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1819 },
1820 32, "Let's Encrypt 'Oak2026h1'" },
1821 { (const uint8_t[]){
1822 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1823 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1824 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1825 },
1826 32, "Let's Encrypt 'Oak2026h2'" },
1827 { (const uint8_t[]){
1828 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1829 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1830 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1831 },
1832 32, "TrustAsia 'log2026a'" },
1833 { (const uint8_t[]){
1834 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1835 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1836 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1837 },
1838 32, "TrustAsia 'log2026b'" },
1839 { (const uint8_t[]){
1840 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1841 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1842 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1843 },
1844 32, "TrustAsia 'HETU2027'" },
1845 { (const uint8_t[]){
1846 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1847 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1848 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1849 },
1850 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1851 { (const uint8_t[]){
1852 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1853 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1854 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1855 },
1856 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1857 { NULL((void*)0), 0, NULL((void*)0) }
1858};
1859
1860/*
1861 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1862 */
1863static dissector_table_t ssl_alpn_dissector_table;
1864static dissector_table_t dtls_alpn_dissector_table;
1865
1866/*
1867 * Special cases for prefix matching of the ALPN, if the ALPN includes
1868 * a version number for a draft or protocol revision.
1869 */
1870typedef struct ssl_alpn_prefix_match_protocol {
1871 const char *proto_prefix;
1872 const char *dissector_name;
1873} ssl_alpn_prefix_match_protocol_t;
1874
1875static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1876 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1877 * already exists 3.1 as of this writing... match the prefix. */
1878 { "spdy/", "spdy" },
1879 /* draft-ietf-httpbis-http2-16 */
1880 { "h2-", "http2" }, /* draft versions */
1881};
1882
1883const value_string compress_certificate_algorithm_vals[] = {
1884 { 1, "zlib" },
1885 { 2, "brotli" },
1886 { 3, "zstd" },
1887 { 0, NULL((void*)0) }
1888};
1889
1890
1891const val64_string quic_transport_parameter_id[] = {
1892 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1893 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1894 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1895 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1896 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1897 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1898 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1899 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1900 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1901 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1902 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1903 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1904 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1905 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1906 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1907 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1908 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1909 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1910 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1911 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1912 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1913 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1914 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1915 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1916 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1917 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1918 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1919 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1920 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1921 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1922 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1923 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1924 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1925 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1926 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1927 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1928 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1929 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1930 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1931 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1932 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1933 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1934 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1935 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1936 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1937 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1938 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1939 { 0, NULL((void*)0) }
1940};
1941
1942/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1943const val64_string quic_address_discovery_vals[] = {
1944 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1945 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1946 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1947 { 0, NULL((void*)0) }
1948};
1949
1950/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1951const val64_string quic_enable_time_stamp_v2_vals[] = {
1952 { 1, "I would like to receive TIME_STAMP frames" },
1953 { 2, "I am able to generate TIME_STAMP frames" },
1954 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1955 { 0, NULL((void*)0) }
1956};
1957
1958/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1959const val64_string quic_enable_multipath_vals[] = {
1960 { 0, "don't support multipath" },
1961 { 1, "support multipath as defined in this document" },
1962 { 0, NULL((void*)0) }
1963};
1964
1965/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
1966const value_string tls_hello_ext_ech_clienthello_types[] = {
1967 { 0, "Outer Client Hello" },
1968 { 1, "Inner Client Hello" },
1969 { 0, NULL((void*)0) }
1970};
1971
1972/* RFC 9180 */
1973const value_string kem_id_type_vals[] = {
1974 { 0x0000, "Reserved" },
1975 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
1976 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
1977 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
1978 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
1979 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
1980 { 0, NULL((void*)0) }
1981};
1982const value_string kdf_id_type_vals[] = {
1983 { 0x0000, "Reserved" },
1984 { 0x0001, "HKDF-SHA256" },
1985 { 0x0002, "HKDF-SHA384" },
1986 { 0x0003, "HKDF-SHA512" },
1987 { 0, NULL((void*)0) }
1988};
1989const value_string aead_id_type_vals[] = {
1990 { 0x0000, "Reserved" },
1991 { 0x0001, "AES-128-GCM" },
1992 { 0x0002, "AES-256-GCM" },
1993 { 0x0003, "ChaCha20Poly1305" },
1994 { 0xFFFF, "Export-only" },
1995 { 0, NULL((void*)0) }
1996};
1997
1998const value_string token_binding_key_parameter_vals[] = {
1999 { 0, "rsa2048_pkcs1.5" },
2000 { 1, "rsa2048_pss" },
2001 { 2, "ecdsap256" },
2002 { 0, NULL((void*)0) }
2003};
2004
2005/* Lookup tables }}} */
2006
2007void
2008quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2009{
2010 const char *label;
2011 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2012 label = "GREASE";
2013 } else {
2014 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2015 }
2016 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2017}
2018
2019/* we keep this internal to packet-tls-utils, as there should be
2020 no need to access it any other way.
2021
2022 This also allows us to hide the dependency on zlib.
2023*/
2024struct _SslDecompress {
2025 int compression;
2026#ifdef USE_ZLIB_OR_ZLIBNG
2027 zlib_stream istream;
2028#endif
2029};
2030
2031/* To assist in parsing client/server key exchange messages
2032 0 indicates unknown */
2033int ssl_get_keyex_alg(int cipher)
2034{
2035 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2036 switch(cipher) {
2037 case 0x0017:
2038 case 0x0018:
2039 case 0x0019:
2040 case 0x001a:
2041 case 0x001b:
2042 case 0x0034:
2043 case 0x003a:
2044 case 0x0046:
2045 case 0x006c:
2046 case 0x006d:
2047 case 0x0089:
2048 case 0x009b:
2049 case 0x00a6:
2050 case 0x00a7:
2051 case 0x00bf:
2052 case 0x00c5:
2053 case 0xc084:
2054 case 0xc085:
2055 return KEX_DH_ANON0x13;
2056 case 0x000b:
2057 case 0x000c:
2058 case 0x000d:
2059 case 0x0030:
2060 case 0x0036:
2061 case 0x003e:
2062 case 0x0042:
2063 case 0x0068:
2064 case 0x0085:
2065 case 0x0097:
2066 case 0x00a4:
2067 case 0x00a5:
2068 case 0x00bb:
2069 case 0x00c1:
2070 case 0xc082:
2071 case 0xc083:
2072 return KEX_DH_DSS0x14;
2073 case 0x000e:
2074 case 0x000f:
2075 case 0x0010:
2076 case 0x0031:
2077 case 0x0037:
2078 case 0x003f:
2079 case 0x0043:
2080 case 0x0069:
2081 case 0x0086:
2082 case 0x0098:
2083 case 0x00a0:
2084 case 0x00a1:
2085 case 0x00bc:
2086 case 0x00c2:
2087 case 0xc07e:
2088 case 0xc07f:
2089 return KEX_DH_RSA0x15;
2090 case 0x0011:
2091 case 0x0012:
2092 case 0x0013:
2093 case 0x0032:
2094 case 0x0038:
2095 case 0x0040:
2096 case 0x0044:
2097 case 0x0063:
2098 case 0x0065:
2099 case 0x0066:
2100 case 0x006a:
2101 case 0x0087:
2102 case 0x0099:
2103 case 0x00a2:
2104 case 0x00a3:
2105 case 0x00bd:
2106 case 0x00c3:
2107 case 0xc080:
2108 case 0xc081:
2109 return KEX_DHE_DSS0x10;
2110 case 0x002d:
2111 case 0x008e:
2112 case 0x008f:
2113 case 0x0090:
2114 case 0x0091:
2115 case 0x00aa:
2116 case 0x00ab:
2117 case 0x00b2:
2118 case 0x00b3:
2119 case 0x00b4:
2120 case 0x00b5:
2121 case 0xc090:
2122 case 0xc091:
2123 case 0xc096:
2124 case 0xc097:
2125 case 0xc0a6:
2126 case 0xc0a7:
2127 case 0xc0aa:
2128 case 0xc0ab:
2129 case 0xccad:
2130 case 0xe41c:
2131 case 0xe41d:
2132 return KEX_DHE_PSK0x11;
2133 case 0x0014:
2134 case 0x0015:
2135 case 0x0016:
2136 case 0x0033:
2137 case 0x0039:
2138 case 0x0045:
2139 case 0x0067:
2140 case 0x006b:
2141 case 0x0088:
2142 case 0x009a:
2143 case 0x009e:
2144 case 0x009f:
2145 case 0x00be:
2146 case 0x00c4:
2147 case 0xc07c:
2148 case 0xc07d:
2149 case 0xc09e:
2150 case 0xc09f:
2151 case 0xc0a2:
2152 case 0xc0a3:
2153 case 0xccaa:
2154 case 0xe41e:
2155 case 0xe41f:
2156 return KEX_DHE_RSA0x12;
2157 case 0xc015:
2158 case 0xc016:
2159 case 0xc017:
2160 case 0xc018:
2161 case 0xc019:
2162 return KEX_ECDH_ANON0x19;
2163 case 0xc001:
2164 case 0xc002:
2165 case 0xc003:
2166 case 0xc004:
2167 case 0xc005:
2168 case 0xc025:
2169 case 0xc026:
2170 case 0xc02d:
2171 case 0xc02e:
2172 case 0xc074:
2173 case 0xc075:
2174 case 0xc088:
2175 case 0xc089:
2176 return KEX_ECDH_ECDSA0x1a;
2177 case 0xc00b:
2178 case 0xc00c:
2179 case 0xc00d:
2180 case 0xc00e:
2181 case 0xc00f:
2182 case 0xc029:
2183 case 0xc02a:
2184 case 0xc031:
2185 case 0xc032:
2186 case 0xc078:
2187 case 0xc079:
2188 case 0xc08c:
2189 case 0xc08d:
2190 return KEX_ECDH_RSA0x1b;
2191 case 0xc006:
2192 case 0xc007:
2193 case 0xc008:
2194 case 0xc009:
2195 case 0xc00a:
2196 case 0xc023:
2197 case 0xc024:
2198 case 0xc02b:
2199 case 0xc02c:
2200 case 0xc072:
2201 case 0xc073:
2202 case 0xc086:
2203 case 0xc087:
2204 case 0xc0ac:
2205 case 0xc0ad:
2206 case 0xc0ae:
2207 case 0xc0af:
2208 case 0xcca9:
2209 case 0xe414:
2210 case 0xe415:
2211 return KEX_ECDHE_ECDSA0x16;
2212 case 0xc033:
2213 case 0xc034:
2214 case 0xc035:
2215 case 0xc036:
2216 case 0xc037:
2217 case 0xc038:
2218 case 0xc039:
2219 case 0xc03a:
2220 case 0xc03b:
2221 case 0xc09a:
2222 case 0xc09b:
2223 case 0xccac:
2224 case 0xe418:
2225 case 0xe419:
2226 case 0xd001:
2227 case 0xd002:
2228 case 0xd003:
2229 case 0xd005:
2230 return KEX_ECDHE_PSK0x17;
2231 case 0xc010:
2232 case 0xc011:
2233 case 0xc012:
2234 case 0xc013:
2235 case 0xc014:
2236 case 0xc027:
2237 case 0xc028:
2238 case 0xc02f:
2239 case 0xc030:
2240 case 0xc076:
2241 case 0xc077:
2242 case 0xc08a:
2243 case 0xc08b:
2244 case 0xcca8:
2245 case 0xe412:
2246 case 0xe413:
2247 return KEX_ECDHE_RSA0x18;
2248 case 0x001e:
2249 case 0x001f:
2250 case 0x0020:
2251 case 0x0021:
2252 case 0x0022:
2253 case 0x0023:
2254 case 0x0024:
2255 case 0x0025:
2256 case 0x0026:
2257 case 0x0027:
2258 case 0x0028:
2259 case 0x0029:
2260 case 0x002a:
2261 case 0x002b:
2262 return KEX_KRB50x1c;
2263 case 0x002c:
2264 case 0x008a:
2265 case 0x008b:
2266 case 0x008c:
2267 case 0x008d:
2268 case 0x00a8:
2269 case 0x00a9:
2270 case 0x00ae:
2271 case 0x00af:
2272 case 0x00b0:
2273 case 0x00b1:
2274 case 0xc064:
2275 case 0xc065:
2276 case 0xc08e:
2277 case 0xc08f:
2278 case 0xc094:
2279 case 0xc095:
2280 case 0xc0a4:
2281 case 0xc0a5:
2282 case 0xc0a8:
2283 case 0xc0a9:
2284 case 0xccab:
2285 case 0xe416:
2286 case 0xe417:
2287 return KEX_PSK0x1d;
2288 case 0x0001:
2289 case 0x0002:
2290 case 0x0003:
2291 case 0x0004:
2292 case 0x0005:
2293 case 0x0006:
2294 case 0x0007:
2295 case 0x0008:
2296 case 0x0009:
2297 case 0x000a:
2298 case 0x002f:
2299 case 0x0035:
2300 case 0x003b:
2301 case 0x003c:
2302 case 0x003d:
2303 case 0x0041:
2304 case 0x0060:
2305 case 0x0061:
2306 case 0x0062:
2307 case 0x0064:
2308 case 0x0084:
2309 case 0x0096:
2310 case 0x009c:
2311 case 0x009d:
2312 case 0x00ba:
2313 case 0x00c0:
2314 case 0xc07a:
2315 case 0xc07b:
2316 case 0xc09c:
2317 case 0xc09d:
2318 case 0xc0a0:
2319 case 0xc0a1:
2320 case 0xe410:
2321 case 0xe411:
2322 case 0xfefe:
2323 case 0xfeff:
2324 case 0xffe0:
2325 case 0xffe1:
2326 return KEX_RSA0x1e;
2327 case 0x002e:
2328 case 0x0092:
2329 case 0x0093:
2330 case 0x0094:
2331 case 0x0095:
2332 case 0x00ac:
2333 case 0x00ad:
2334 case 0x00b6:
2335 case 0x00b7:
2336 case 0x00b8:
2337 case 0x00b9:
2338 case 0xc092:
2339 case 0xc093:
2340 case 0xc098:
2341 case 0xc099:
2342 case 0xccae:
2343 case 0xe41a:
2344 case 0xe41b:
2345 return KEX_RSA_PSK0x1f;
2346 case 0xc01a:
2347 case 0xc01d:
2348 case 0xc020:
2349 return KEX_SRP_SHA0x20;
2350 case 0xc01c:
2351 case 0xc01f:
2352 case 0xc022:
2353 return KEX_SRP_SHA_DSS0x21;
2354 case 0xc01b:
2355 case 0xc01e:
2356 case 0xc021:
2357 return KEX_SRP_SHA_RSA0x22;
2358 case 0xc0ff:
2359 return KEX_ECJPAKE0x24;
2360 case 0xe003:
2361 case 0xe013:
2362 case 0xe053:
2363 return KEX_ECC_SM20x26;
2364 default:
2365 break;
2366 }
2367
2368 return 0;
2369 /* }}} */
2370}
2371
2372static wmem_list_t *connection_id_session_list;
2373
2374void
2375ssl_init_cid_list(void) {
2376 connection_id_session_list = wmem_list_new(wmem_file_scope());
2377}
2378
2379void
2380ssl_cleanup_cid_list(void) {
2381 wmem_destroy_list(connection_id_session_list);
2382}
2383
2384void
2385ssl_add_session_by_cid(SslDecryptSession *session)
2386{
2387 wmem_list_append(connection_id_session_list, session);
2388}
2389
2390SslDecryptSession *
2391ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2392{
2393 SslDecryptSession * ssl_cid = NULL((void*)0);
2394 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2395
2396 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2397 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2398 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2398, "ssl != ((void*)0)"))));
2399 SslSession *session = &ssl->session;
2400
2401 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2402 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2403 ssl_cid = ssl;
2404 }
2405 }
2406
2407 if (session->server_cid_len > 0) {
2408 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2409 ssl_cid = ssl;
2410 }
2411 }
2412
2413 it = wmem_list_frame_next(it);
2414 }
2415
2416 return ssl_cid;
2417}
2418
2419/* StringInfo structure (len + data) functions {{{ */
2420
2421int
2422ssl_data_alloc(StringInfo* str, size_t len)
2423{
2424 str->data = (unsigned char *)g_malloc(len);
16
←
Memory is allocated
→
2425 /* the allocator can return a null pointer for a size equal to 0,
2426 * and that must be allowed */
2427 if (len
16.1
'len' is > 0
 > 0 && !str->data)
17
←
Assuming field 'data' is non-null
→
18
←
Taking false branch
→
2428 return -1;
2429 str->data_len = (unsigned) len;
2430 return 0;
2431}
2432
2433void
2434ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2435{
2436 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2436, "data"))));
2437 memcpy(str->data, data, len);
2438 str->data_len = len;
2439}
2440
2441static int
2442ssl_data_realloc(StringInfo* str, unsigned len)
2443{
2444 str->data = (unsigned char *)g_realloc(str->data, len);
2445 if (!str->data)
2446 return -1;
2447 str->data_len = len;
2448 return 0;
2449}
2450
2451static StringInfo *
2452ssl_data_clone(StringInfo *str)
2453{
2454 StringInfo *cloned_str;
2455 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2456 sizeof(StringInfo) + str->data_len);
2457 cloned_str->data = (unsigned char *) (cloned_str + 1);
2458 ssl_data_set(cloned_str, str->data, str->data_len);
2459 return cloned_str;
2460}
2461
2462static int
2463ssl_data_copy(StringInfo* dst, StringInfo* src)
2464{
2465 if (dst->data_len < src->data_len) {
2466 if (ssl_data_realloc(dst, src->data_len))
2467 return -1;
2468 }
2469 memcpy(dst->data, src->data, src->data_len);
2470 dst->data_len = src->data_len;
2471 return 0;
2472}
2473
2474/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2475 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2476 * success. */
2477static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2478 size_t i;
2479
2480 if (hex_len & 1)
2481 return false0;
2482
2483 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2484 for (i = 0; i < hex_len / 2; i++) {
2485 int a = ws_xton(in[i*2]);
2486 int b = ws_xton(in[i*2 + 1]);
2487 if (a == -1 || b == -1)
2488 return false0;
2489 out->data[i] = a << 4 | b;
2490 }
2491 out->data_len = (unsigned)hex_len / 2;
2492 return true1;
2493}
2494/* StringInfo structure (len + data) functions }}} */
2495
2496
2497/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2498/* hmac abstraction layer */
2499#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2500
2501static inline int
2502ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2503{
2504 gcry_error_t err;
2505 const char *err_str, *err_src;
2506
2507 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2508 if (err != 0) {
2509 err_str = gcry_strerror(err);
2510 err_src = gcry_strsource(err);
2511 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2512 return -1;
2513 }
2514 return 0;
2515}
2516
2517static inline int
2518ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2519{
2520 gcry_error_t err;
2521 const char *err_str, *err_src;
2522
2523 err = gcry_md_setkey (*(md), key, len);
2524 if (err != 0) {
2525 err_str = gcry_strerror(err);
2526 err_src = gcry_strsource(err);
2527 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2528 return -1;
2529 }
2530 return 0;
2531}
2532
2533static inline int
2534ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2535{
2536 gcry_md_reset(*md);
2537 return 0;
2538}
2539
2540static inline void
2541ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2542{
2543 gcry_md_write(*(md), data, len);
2544}
2545static inline void
2546ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2547{
2548 int algo;
2549 unsigned len;
2550
2551 algo = gcry_md_get_algo (*(md));
2552 len = gcry_md_get_algo_dlen(algo);
2553 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2553, "len <= *datalen"))));
2554 memcpy(data, gcry_md_read(*(md), algo), len);
2555 *datalen = len;
2556}
2557static inline void
2558ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2559{
2560 gcry_md_close(*(md));
2561}
2562
2563/* message digest abstraction layer*/
2564#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2565
2566static inline int
2567ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2568{
2569 gcry_error_t err;
2570 const char *err_str, *err_src;
2571 err = gcry_md_open(md,algo, 0);
2572 if (err != 0) {
2573 err_str = gcry_strerror(err);
2574 err_src = gcry_strsource(err);
2575 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2576 return -1;
2577 }
2578 return 0;
2579}
2580static inline void
2581ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2582{
2583 gcry_md_write(*(md), data, len);
2584}
2585static inline void
2586ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2587{
2588 int algo;
2589 int len;
2590 algo = gcry_md_get_algo (*(md));
2591 len = gcry_md_get_algo_dlen (algo);
2592 memcpy(data, gcry_md_read(*(md), algo), len);
2593 *datalen = len;
2594}
2595static inline void
2596ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2597{
2598 gcry_md_close(*(md));
2599}
2600
2601static inline void
2602ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2603{
2604 gcry_md_reset(*md);
2605}
2606
2607/* md5 /sha abstraction layer */
2608#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2609#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2610
2611static inline int
2612ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2613{
2614 gcry_error_t err;
2615 const char *err_str, *err_src;
2616 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2617 if (err != 0) {
2618 err_str = gcry_strerror(err);
2619 err_src = gcry_strsource(err);
2620 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2621 return -1;
2622 }
2623 return 0;
2624}
2625static inline void
2626ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2627{
2628 gcry_md_write(*(md), data, len);
2629}
2630static inline void
2631ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2632{
2633 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2634 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2635}
2636
2637static inline void
2638ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2639{
2640 gcry_md_reset(*md);
2641}
2642
2643static inline void
2644ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2645{
2646 gcry_md_close(*(md));
2647}
2648
2649static inline int
2650ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2651{
2652 gcry_error_t err;
2653 const char *err_str, *err_src;
2654 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2655 if (err != 0) {
2656 err_str = gcry_strerror(err);
2657 err_src = gcry_strsource(err);
2658 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2659 return -1;
2660 }
2661 return 0;
2662}
2663static inline void
2664ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2665{
2666 gcry_md_write(*(md), data, len);
2667}
2668static inline void
2669ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2670{
2671 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2672 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2673}
2674
2675static inline void
2676ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2677{
2678 gcry_md_reset(*md);
2679}
2680
2681static inline void
2682ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2683{
2684 gcry_md_close(*(md));
2685}
2686/* libgcrypt wrappers for HMAC/message digest operations }}} */
2687
2688/* libgcrypt wrappers for Cipher state manipulation {{{ */
2689int
2690ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2691{
2692 int ret;
2693#if 0
2694 unsigned char *ivp;
2695 int i;
2696 gcry_cipher_hd_t c;
2697 c=(gcry_cipher_hd_t)*cipher;
2698#endif
2699 ssl_debug_printf("--------------------------------------------------------------------");
2700#if 0
2701 for(ivp=c->iv,i=0; i < iv_len; i++ )
2702 {
2703 ssl_debug_printf("%d ",ivp[i]);
2704 i++;
2705 }
2706#endif
2707 ssl_debug_printf("--------------------------------------------------------------------");
2708 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2709#if 0
2710 for(ivp=c->iv,i=0; i < iv_len; i++ )
2711 {
2712 ssl_debug_printf("%d ",ivp[i]);
2713 i++;
2714 }
2715#endif
2716 ssl_debug_printf("--------------------------------------------------------------------");
2717 return ret;
2718}
2719/* stream cipher abstraction layer*/
2720static int
2721ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2722 unsigned char* iv, int mode)
2723{
2724 int gcry_modes[] = {
2725 GCRY_CIPHER_MODE_STREAM,
2726 GCRY_CIPHER_MODE_CBC,
2727 GCRY_CIPHER_MODE_GCM,
2728 GCRY_CIPHER_MODE_CCM,
2729 GCRY_CIPHER_MODE_CCM,
2730 GCRY_CIPHER_MODE_POLY1305,
2731 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2732 };
2733 int err;
2734 if (algo == -1) {
2735 /* NULL mode */
2736 *(cipher) = (gcry_cipher_hd_t)-1;
2737 return 0;
2738 }
2739 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2740 if (err !=0)
2741 return -1;
2742 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2743 if (err != 0)
2744 return -1;
2745 /* AEAD cipher suites will set the nonce later. */
2746 if (mode == MODE_CBC) {
2747 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2748 if (err != 0)
2749 return -1;
2750 }
2751 return 0;
2752}
2753static inline int
2754ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2755 const unsigned char * in, int inl)
2756{
2757 if ((*cipher) == (gcry_cipher_hd_t)-1)
2758 {
2759 if (in && inl)
2760 memcpy(out, in, outl < inl ? outl : inl);
2761 return 0;
2762 }
2763 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2764}
2765static inline int
2766ssl_get_digest_by_name(const char*name)
2767{
2768 return gcry_md_map_name(name);
2769}
2770static inline int
2771ssl_get_cipher_by_name(const char* name)
2772{
2773 return gcry_cipher_map_name(name);
2774}
2775
2776static inline void
2777ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2778{
2779 if ((*cipher) != (gcry_cipher_hd_t)-1)
2780 gcry_cipher_close(*cipher);
2781 *cipher = NULL((void*)0);
2782}
2783/* }}} */
2784
2785/* Digests, Ciphers and Cipher Suites registry {{{ */
2786static const SslDigestAlgo digests[]={
2787 {"MD5", 16},
2788 {"SHA1", 20},
2789 {"SHA256", 32},
2790 {"SHA384", 48},
2791 {"SM3", 32},
2792 {"Not Applicable", 0},
2793};
2794
2795#define DIGEST_MAX_SIZE48 48
2796
2797/* get index digest index */
2798static const SslDigestAlgo *
2799ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2800 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2801 return &digests[DIG_NA0x45 - DIG_MD50x40];
2802 }
2803 return &digests[cs->dig - DIG_MD50x40];
2804}
2805
2806static const char *ciphers[]={
2807 "DES",
2808 "3DES",
2809 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2810 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2811 "IDEA",
2812 "AES",
2813 "AES256",
2814 "CAMELLIA128",
2815 "CAMELLIA256",
2816 "SEED",
2817 "CHACHA20", /* since Libgcrypt 1.7.0 */
2818 "SM1",
2819 "SM4",
2820 "*UNKNOWN*"
2821};
2822
2823static const SslCipherSuite cipher_suites[]={
2824 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2825 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2826 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2827 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2828 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2829 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2830 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2831 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2832 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2833 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2834 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2835 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2836 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2837 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2838 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2839 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2840 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2841 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2842 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2843 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2844 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2845 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2846 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2847 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2848 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2849 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2850 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2851 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2852 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2853 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2854 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2855 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2856 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2857 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2858 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2859 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2860 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2861 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2862 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2863 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2864 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2865 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2866 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2867 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2868 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2869 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2870 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2871 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2872 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2873 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2874 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2875 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2876 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2877 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2878 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2879 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2880 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2881 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2882 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2883 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2884 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2885 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2886 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2887 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2888 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2889 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2890 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2891 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2892 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2893 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2894 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2895 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2896 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2897 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2898 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2899 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2900 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2901 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2902 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2903 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2904 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2905 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2906 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2907 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2908 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2909 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2910 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2911 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2912 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2913 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2914 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2915 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2916 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2917 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2918 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2919 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2920 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2921 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2922 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2923 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2924 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2925 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2926 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2927 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2928 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2929 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2930 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2931 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2932 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2933 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2934 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2935 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2936 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2937 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2938 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2939 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2940 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2941 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2942 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2943 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2944 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2945 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2946 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2947 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2948 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2949 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2950 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2951 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2952 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2953 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2954 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2955 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2956 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2957 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2958
2959 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2960 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2961 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
2962 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
2963 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
2964 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
2965 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
2966
2967 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
2968 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
2969 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
2970 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
2971 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
2972 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
2973 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
2974 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
2975 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
2976 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
2977 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
2978 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
2979 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
2980 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
2981 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
2982 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
2983 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
2984 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
2985 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
2986 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
2987 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
2988 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
2989 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
2990 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
2991 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
2992 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
2993 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
2994 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
2995 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
2996 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
2997 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
2998 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
2999 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3000 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3001 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3002 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3003 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3004 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3005 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3006 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3007 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3008 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3009 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3010 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3011 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3012 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3013 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3014 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3015 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3016 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3017 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3018 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3019 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3020 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3021 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3022 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3023 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3024 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3025 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3026 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3027 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3028 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3029 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3030 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3031 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3032 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3033 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3034 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3035 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3036 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3037 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3038 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3039 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3040 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3041 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3042 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3043 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3044 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3045 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3046 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3047 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3048 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3049 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3050 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3051 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3052 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3053 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3054 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3055 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3056 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3057 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3058 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3059 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3060 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3061 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3062 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3063 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3064 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3065 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3066 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3067 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3068 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3069 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3070 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3071 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3072 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3073 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3074 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3075 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3076 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3077 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3078 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3079 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3080 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3081 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3082 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3083 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3084 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3085 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3086 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3087 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3088 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3089 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3090 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3091 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3092 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3093 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3094 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3095 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3096 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3097 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3098 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3099 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3100 /* GM */
3101 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3102 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3103 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3104 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3105 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3106 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3107 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3108 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3109 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3110 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3111 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3112 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3113 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3114 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3115 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3116 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3117 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3118 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3119 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3120 {-1, 0, 0, 0, MODE_STREAM}
3121};
3122
3123#define MAX_BLOCK_SIZE16 16
3124#define MAX_KEY_SIZE32 32
3125
3126const SslCipherSuite *
3127ssl_find_cipher(int num)
3128{
3129 const SslCipherSuite *c;
3130 for(c=cipher_suites;c->number!=-1;c++){
3131 if(c->number==num){
3132 return c;
3133 }
3134 }
3135
3136 return NULL((void*)0);
3137}
3138
3139int
3140ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3141{
3142 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3143}
3144
3145unsigned
3146ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3147{
3148 int cipher_algo;
3149 if (cipher_suite->mode != MODE_CBC) return 0;
3150 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3151 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3152}
3153
3154static unsigned
3155ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3156{
3157 switch (cipher_suite_num) {
3158 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3159 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3160 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3161 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3162 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3163 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3164 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3165 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3166 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3167 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3168 return 5;
3169
3170 /* not defined in below draft, but "implemented by several vendors",
3171 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3172 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3173 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3174 return 7;
3175
3176 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3177 * used 7. Until a pcap proves 8, let's use the old value. Link:
3178 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3179 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3180 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3181 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3182 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3183 return 7;
3184
3185 default:
3186 return 0;
3187 }
3188}
3189
3190/* Digests, Ciphers and Cipher Suites registry }}} */
3191
3192
3193/* HMAC and the Pseudorandom function {{{ */
3194static int
3195tls_hash(StringInfo *secret, StringInfo *seed, int md,
3196 StringInfo *out, unsigned out_len)
3197{
3198 /* RFC 2246 5. HMAC and the pseudorandom function
3199 * '+' denotes concatenation.
3200 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3201 * HMAC_hash(secret, A(2) + seed) + ...
3202 * A(0) = seed
3203 * A(i) = HMAC_hash(secret, A(i - 1))
3204 */
3205 uint8_t *ptr;
3206 unsigned left, tocpy;
3207 uint8_t *A;
3208 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3209 unsigned A_l, tmp_l;
3210 SSL_HMACgcry_md_hd_t hm;
3211
3212 ptr = out->data;
3213 left = out_len;
3214
3215 ssl_print_string("tls_hash: hash secret", secret);
3216 ssl_print_string("tls_hash: hash seed", seed);
3217 /* A(0) = seed */
3218 A = seed->data;
3219 A_l = seed->data_len;
3220
3221 if (ssl_hmac_init(&hm, md) != 0) {
3222 return -1;
3223 }
3224 while (left) {
3225 /* A(i) = HMAC_hash(secret, A(i-1)) */
3226 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3227 ssl_hmac_update(&hm, A, A_l);
3228 A_l = sizeof(_A); /* upper bound len for hash output */
3229 ssl_hmac_final(&hm, _A, &A_l);
3230 A = _A;
3231
3232 /* HMAC_hash(secret, A(i) + seed) */
3233 ssl_hmac_reset(&hm);
3234 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3235 ssl_hmac_update(&hm, A, A_l);
3236 ssl_hmac_update(&hm, seed->data, seed->data_len);
3237 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3238 ssl_hmac_final(&hm, tmp, &tmp_l);
3239 ssl_hmac_reset(&hm);
3240
3241 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3242 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3243 memcpy(ptr, tmp, tocpy);
3244 ptr += tocpy;
3245 left -= tocpy;
3246 }
3247 ssl_hmac_cleanup(&hm);
3248 out->data_len = out_len;
3249
3250 ssl_print_string("hash out", out);
3251 return 0;
3252}
3253
3254static bool_Bool
3255tls_prf(StringInfo* secret, const char *usage,
3256 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3257{
3258 StringInfo seed, sha_out, md5_out;
3259 uint8_t *ptr;
3260 StringInfo s1, s2;
3261 unsigned i,s_l;
3262 size_t usage_len, rnd2_len;
3263 bool_Bool success = false0;
3264 usage_len = strlen(usage);
3265 rnd2_len = rnd2 ? rnd2->data_len : 0;
3266
3267 /* initialize buffer for sha, md5 random seed*/
3268 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3269 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3270 return false0;
3271 }
3272 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3273 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3274 goto free_sha;
3275 }
3276 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3277 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3278 (int) (usage_len+rnd1->data_len+rnd2_len));
3279 goto free_md5;
3280 }
3281
3282 ptr=seed.data;
3283 memcpy(ptr,usage,usage_len);
3284 ptr+=usage_len;
3285 memcpy(ptr,rnd1->data,rnd1->data_len);
3286 if (rnd2_len > 0) {
3287 ptr+=rnd1->data_len;
3288 memcpy(ptr,rnd2->data,rnd2->data_len);
3289 /*ptr+=rnd2->data_len;*/
3290 }
3291
3292 /* initialize buffer for client/server seeds*/
3293 s_l=secret->data_len/2 + secret->data_len%2;
3294 if (ssl_data_alloc(&s1, s_l) < 0) {
3295 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3296 goto free_seed;
3297 }
3298 if (ssl_data_alloc(&s2, s_l) < 0) {
3299 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3300 goto free_s1;
3301 }
3302
3303 memcpy(s1.data,secret->data,s_l);
3304 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3305
3306 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3307 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3308 goto free_s2;
3309 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3310 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3311 goto free_s2;
3312
3313 for (i = 0; i < out_len; i++)
3314 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3315 /* success, now store the new meaningful data length */
3316 out->data_len = out_len;
3317 success = true1;
3318
3319 ssl_print_string("PRF out",out);
3320free_s2:
3321 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3322free_s1:
3323 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3324free_seed:
3325 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3326free_md5:
3327 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3328free_sha:
3329 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3330 return success;
3331}
3332
3333static bool_Bool
3334tls12_prf(int md, StringInfo* secret, const char* usage,
3335 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3336{
3337 StringInfo label_seed;
3338 int success;
3339 size_t usage_len, rnd2_len;
3340 rnd2_len = rnd2 ? rnd2->data_len : 0;
3341
3342 usage_len = strlen(usage);
3343 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3344 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3345 return false0;
3346 }
3347 memcpy(label_seed.data, usage, usage_len);
3348 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3349 if (rnd2_len > 0)
3350 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3351
3352 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3353 success = tls_hash(secret, &label_seed, md, out, out_len);
3354 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3355 if(success != -1){
3356 ssl_print_string("PRF out", out);
3357 return true1;
3358 }
3359 return false0;
3360}
3361
3362static bool_Bool
3363ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3364 StringInfo *out, unsigned out_len)
3365{
3366 SSL_MD5_CTXgcry_md_hd_t md5;
3367 uint8_t tmp[16];
3368
3369 if (ssl_md5_init(&md5) != 0) {
3370 return false0;
3371 }
3372 ssl_md5_update(&md5,r1->data,r1->data_len);
3373 ssl_md5_update(&md5,r2->data,r2->data_len);
3374 ssl_md5_final(tmp,&md5);
3375 ssl_md5_cleanup(&md5);
3376
3377 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3377, "out_len <= sizeof(tmp)"))));
3378 ssl_data_set(out, tmp, out_len);
3379 ssl_print_string("export iv", out);
3380 return true1;
3381}
3382
3383static bool_Bool
3384ssl3_prf(StringInfo* secret, const char* usage,
3385 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3386{
3387 SSL_MD5_CTXgcry_md_hd_t md5;
3388 SSL_SHA_CTXgcry_md_hd_t sha;
3389 unsigned off;
3390 int i = 0,j;
3391 uint8_t buf[20];
3392
3393 if (ssl_sha_init(&sha) != 0) {
3394 return false0;
3395 }
3396 if (ssl_md5_init(&md5) != 0) {
3397 ssl_sha_cleanup(&sha);
3398 return false0;
3399 }
3400 for (off = 0; off < out_len; off += 16) {
3401 unsigned char outbuf[16];
3402 i++;
3403
3404 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3405 /* A, BB, CCC, ... */
3406 for(j=0;j<i;j++){
3407 buf[j]=64+i;
3408 }
3409
3410 ssl_sha_update(&sha,buf,i);
3411 ssl_sha_update(&sha,secret->data,secret->data_len);
3412
3413 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3414 if (rnd2)
3415 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3416 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3417 }
3418 else{
3419 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3420 if (rnd2)
3421 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3422 }
3423
3424 ssl_sha_final(buf,&sha);
3425 ssl_sha_reset(&sha);
3426
3427 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3428 secret->data_len);
3429 ssl_md5_update(&md5,secret->data,secret->data_len);
3430 ssl_md5_update(&md5,buf,20);
3431 ssl_md5_final(outbuf,&md5);
3432 ssl_md5_reset(&md5);
3433
3434 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3435 }
3436 ssl_sha_cleanup(&sha);
3437 ssl_md5_cleanup(&md5);
3438 out->data_len = out_len;
3439
3440 return true1;
3441}
3442
3443/* out_len is the wanted output length for the pseudorandom function.
3444 * Ensure that ssl->cipher_suite is set. */
3445static bool_Bool
3446prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3447 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3448{
3449 switch (ssl->session.version) {
3450 case SSLV3_VERSION0x300:
3451 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3452
3453 case TLSV1_VERSION0x301:
3454 case TLSV1DOT1_VERSION0x302:
3455 case DTLSV1DOT0_VERSION0xfeff:
3456 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3457 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3458
3459 default: /* TLSv1.2 */
3460 switch (ssl->cipher_suite->dig) {
3461 case DIG_SM30x44:
3462#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3463 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3464 out, out_len);
3465#else
3466 return false0;
3467#endif
3468 case DIG_SHA3840x43:
3469 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3470 out, out_len);
3471 default:
3472 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3473 out, out_len);
3474 }
3475 }
3476}
3477
3478static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3479{
3480 SSL_MD5_CTXgcry_md_hd_t md5;
3481 SSL_SHA_CTXgcry_md_hd_t sha;
3482
3483 if (ssl_data_alloc(out, 36) < 0)
15
←
Calling 'ssl_data_alloc'
→
19
←
Returned allocated memory
→
20
←
Taking false branch
→
3484 return -1;
3485
3486 if (ssl_md5_init(&md5) != 0)
21
←
Taking true branch
→
3487 return -1;
3488 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
3489 ssl_md5_final(out->data,&md5);
3490 ssl_md5_cleanup(&md5);
3491
3492 if (ssl_sha_init(&sha) != 0)
3493 return -1;
3494 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
3495 ssl_sha_final(out->data+16,&sha);
3496 ssl_sha_cleanup(&sha);
3497 return 0;
3498}
3499
3500static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3501{
3502 SSL_MDgcry_md_hd_t mc;
3503 uint8_t tmp[48];
3504 unsigned len;
3505
3506 if (ssl_md_init(&mc, md) != 0)
3507 return -1;
3508 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
3509 ssl_md_final(&mc, tmp, &len);
3510 ssl_md_cleanup(&mc);
3511
3512 if (ssl_data_alloc(out, len) < 0)
3513 return -1;
3514 memcpy(out->data, tmp, len);
3515 return 0;
3516}
3517
3518bool_Bool
3519tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3520{
3521 if (!tls_psk || (tls_psk[0] == 0)) {
3522 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3523 return false0;
3524 }
3525
3526 wmem_free(wmem_file_scope(), tls_session->psk.data);
3527 /* convert hex string into char*/
3528 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3529 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3530 G_STRFUNC((const char*) (__func__)));
3531 return false0;
3532 }
3533
3534 if (tls_session->psk.data_len >= (2 << 15)) {
3535 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3536 G_STRFUNC((const char*) (__func__)));
3537 wmem_free(wmem_file_scope(), tls_session->psk.data);
3538 tls_session->psk.data = NULL((void*)0);
3539 tls_session->psk.data_len = 0;
3540 return false0;
3541 }
3542
3543 return true1;
3544}
3545
3546/**
3547 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3548 * inlined and removed once support for draft 19 and before is dropped.
3549 */
3550static inline const char *
3551tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3552{
3553 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3554 return "TLS 1.3, ";
3555 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3556 return "dtls13";
3557 } else {
3558 return "tls13 ";
3559 }
3560}
3561
3562/*
3563 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3564 * custom label prefix. If "context_hash" is NULL, then an empty context is
3565 * used. Otherwise it must have the same length as the hash algorithm output.
3566 */
3567bool_Bool
3568tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3569 const char *label_prefix, const char *label,
3570 const uint8_t *context_hash, uint8_t context_length,
3571 uint16_t out_len, unsigned char **out)
3572{
3573 /* RFC 8446 Section 7.1:
3574 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3575 * HKDF-Expand(Secret, HkdfLabel, Length)
3576 * struct {
3577 * uint16 length = Length;
3578 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3579 * opaque context<0..255> = Context;
3580 * } HkdfLabel;
3581 *
3582 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3583 * HKDF-Expand(PRK, info, L) -> OKM
3584 */
3585 gcry_error_t err;
3586 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3587 const unsigned label_length = (unsigned) strlen(label);
3588
3589 /* Some sanity checks */
3590 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3590, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3591
3592 /* info = HkdfLabel { length, label, context } */
3593 GByteArray *info = g_byte_array_new();
3594 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3595 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3596
3597 const uint8_t label_vector_length = label_prefix_length + label_length;
3598 g_byte_array_append(info, &label_vector_length, 1);
3599 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3600 g_byte_array_append(info, (const uint8_t*)label, label_length);
3601
3602 g_byte_array_append(info, &context_length, 1);
3603 if (context_length) {
3604 g_byte_array_append(info, context_hash, context_length);
3605 }
3606
3607 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3608 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3609 g_byte_array_free(info, true1);
3610
3611 if (err) {
3612 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3613 wmem_free(NULL((void*)0), *out);
3614 *out = NULL((void*)0);
3615 return false0;
3616 }
3617
3618 return true1;
3619}
3620
3621bool_Bool
3622tls13_hkdf_expand_label(int md, const StringInfo *secret,
3623 const char *label_prefix, const char *label,
3624 uint16_t out_len, unsigned char **out)
3625{
3626 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3627}
3628
3629static bool_Bool
3630tls13_derive_secret(int md, const StringInfo *secret,
3631 const char *label_prefix, const char *label,
3632 const uint8_t *context, unsigned context_length,
3633 uint16_t out_len, unsigned char **out)
3634{
3635 SSL_MDgcry_md_hd_t mc;
3636 uint8_t context_hash[DIGEST_MAX_SIZE48];
3637 unsigned hash_len;
3638
3639 if (ssl_md_init(&mc, md) != 0)
3640 return false0;
3641 ssl_md_update(&mc, context, context_length);
3642 ssl_md_final(&mc, context_hash, &hash_len);
3643 ssl_md_cleanup(&mc);
3644
3645 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3646}
3647
3648/* HMAC and the Pseudorandom function }}} */
3649
3650/* Record Decompression (after decryption) {{{ */
3651#ifdef USE_ZLIB_OR_ZLIBNG
3652/* memory allocation functions for zlib initialization */
3653static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3654{
3655 return g_malloc0(no*size);
3656}
3657static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3658{
3659 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3660}
3661#endif /* USE_ZLIB_OR_ZLIBNG */
3662
3663static SslDecompress*
3664ssl_create_decompressor(int compression)
3665{
3666 SslDecompress *decomp;
3667#ifdef USE_ZLIB_OR_ZLIBNG
3668 int err;
3669#endif
3670
3671 if (compression == 0) return NULL((void*)0);
3672 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3673 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3674 decomp->compression = compression;
3675 switch (decomp->compression) {
3676#ifdef USE_ZLIB_OR_ZLIBNG
3677 case 1: /* DEFLATE */
3678 decomp->istream.zalloc = ssl_zalloc;
3679 decomp->istream.zfree = ssl_zfree;
3680 decomp->istream.opaque = Z_NULL0;
3681 decomp->istream.next_in = Z_NULL0;
3682 decomp->istream.next_out = Z_NULL0;
3683 decomp->istream.avail_in = 0;
3684 decomp->istream.avail_out = 0;
3685 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3686 if (err != Z_OK0) {
3687 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3688 return NULL((void*)0);
3689 }
3690 break;
3691#endif /* USE_ZLIB_OR_ZLIBNG */
3692 default:
3693 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3694 return NULL((void*)0);
3695 }
3696 return decomp;
3697}
3698
3699#ifdef USE_ZLIB_OR_ZLIBNG
3700static int
3701ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3702{
3703 int err;
3704
3705 switch (decomp->compression) {
3706 case 1: /* DEFLATE */
3707 err = Z_OK0;
3708 if (out_str->data_len < 16384) { /* maximal plain length */
3709 ssl_data_realloc(out_str, 16384);
3710 }
3711#ifdef z_constconst
3712 decomp->istream.next_in = in;
3713#else
3714DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3715 decomp->istream.next_in = (Bytef *)in;
3716DIAG_ON(cast-qual)clang diagnostic pop
3717#endif
3718 decomp->istream.avail_in = inl;
3719 decomp->istream.next_out = out_str->data;
3720 decomp->istream.avail_out = out_str->data_len;
3721 if (inl > 0)
3722 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3723 if (err != Z_OK0) {
3724 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3725 return -1;
3726 }
3727 *outl = out_str->data_len - decomp->istream.avail_out;
3728 break;
3729 default:
3730 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3731 return -1;
3732 }
3733 return 0;
3734}
3735#else /* USE_ZLIB_OR_ZLIBNG */
3736int
3737ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3738{
3739 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3740 return -1;
3741}
3742#endif /* USE_ZLIB_OR_ZLIBNG */
3743/* Record Decompression (after decryption) }}} */
3744
3745/* Create a new structure to store decrypted chunks. {{{ */
3746static SslFlow*
3747ssl_create_flow(void)
3748{
3749 SslFlow *flow;
3750
3751 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3752 flow->byte_seq = 0;
3753 flow->flags = 0;
3754 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3755 return flow;
3756}
3757/* }}} */
3758
3759/* Use the negotiated security parameters for decryption. {{{ */
3760void
3761ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3762{
3763 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3764 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3765 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3766 *new_decoder ? "" : " (No decoder found - retransmission?)");
3767 if (*new_decoder) {
3768 *dest = *new_decoder;
3769 *new_decoder = NULL((void*)0);
3770 }
3771}
3772/* }}} */
3773
3774/* Init cipher state given some security parameters. {{{ */
3775static bool_Bool
3776ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3777
3778static SslDecoder*
3779ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3780 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3781{
3782 SslDecoder *dec;
3783 ssl_cipher_mode_t mode = cipher_suite->mode;
3784
3785 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3786 /* init mac buffer: mac storage is embedded into decoder struct to save a
3787 memory allocation and waste samo more memory*/
3788 dec->cipher_suite=cipher_suite;
3789 dec->compression = compression;
3790 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
3791 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
3792 // the special case for NULL ciphers, even if there is insufficiency
3793 // keying material (including MAC key), we will can still create
3794 // decoders since "decryption" is easy for such ciphers.
3795 dec->mac_key.data = dec->_mac_key_or_write_iv;
3796 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
3797 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
3798 // Input for the nonce, to be used with AEAD ciphers.
3799 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3799, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
3800 dec->write_iv.data = dec->_mac_key_or_write_iv;
3801 ssl_data_set(&dec->write_iv, iv, iv_length);
3802 }
3803 dec->seq = 0;
3804 dec->decomp = ssl_create_decompressor(compression);
3805 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
3806
3807 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
3808 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
3809 cipher_algo, cipher_suite->mode);
3810 return NULL((void*)0);
3811 }
3812
3813 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
3814 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
3815 mode = MODE_ECB;
3816 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
3817 mode = MODE_STREAM;
3818 } else {
3819 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
3820 return NULL((void*)0);
3821 }
3822
3823 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
3824 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
3825 cipher_algo, MODE_ECB);
3826 ssl_cipher_cleanup(&dec->evp);
3827 dec->evp = NULL((void*)0);
3828 return NULL((void*)0);
3829 }
3830 } else {
3831 dec->sn_evp = NULL((void*)0);
3832 }
3833
3834 dec->dtls13_aad.data = NULL((void*)0);
3835 dec->dtls13_aad.data_len = 0;
3836 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
3837 return dec;
3838}
3839
3840static bool_Bool
3841ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
3842{
3843 SslDecoder *dec = (SslDecoder *) user_data;
3844
3845 if (dec->evp)
3846 ssl_cipher_cleanup(&dec->evp);
3847 if (dec->sn_evp)
3848 ssl_cipher_cleanup(&dec->sn_evp);
3849
3850#ifdef USE_ZLIB_OR_ZLIBNG
3851 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
3852 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
3853#endif
3854
3855 return false0;
3856}
3857/* }}} */
3858
3859/* (Pre-)master secrets calculations {{{ */
3860#ifdef HAVE_LIBGNUTLS1
3861static bool_Bool
3862ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
3863 StringInfo *encrypted_pre_master,
3864 GHashTable *key_hash);
3865#endif /* HAVE_LIBGNUTLS */
3866
3867static bool_Bool
3868ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
3869 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
3870
3871bool_Bool
3872ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
3873 uint32_t length, tvbuff_t *tvb, uint32_t offset,
3874 const char *ssl_psk, packet_info *pinfo,
3875#ifdef HAVE_LIBGNUTLS1
3876 GHashTable *key_hash,
3877#endif
3878 const ssl_master_key_map_t *mk_map)
3879{
3880 /* check for required session data */
3881 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
3882 G_STRFUNC((const char*) (__func__)), ssl_session->state);
3883 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
3884 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
3885 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
3886 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
3887 return false0;
3888 }
3889
3890 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
3891 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
3892 return false0;
3893 }
3894
3895 /* check to see if the PMS was provided to us*/
3896 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
3897 mk_map->pms, &ssl_session->client_random)) {
3898 return true1;
3899 }
3900
3901 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
3902 {
3903 /* calculate pre master secret*/
3904 StringInfo pre_master_secret;
3905 unsigned psk_len, pre_master_len;
3906
3907 if (!tls_load_psk(ssl_session, ssl_psk)) {
3908 return false0;
3909 }
3910 psk_len = ssl_session->psk.data_len;
3911
3912 pre_master_len = psk_len * 2 + 4;
3913
3914 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
3915 pre_master_secret.data_len = pre_master_len;
3916 /* 2 bytes psk_len*/
3917 pre_master_secret.data[0] = psk_len >> 8;
3918 pre_master_secret.data[1] = psk_len & 0xFF;
3919 /* psk_len bytes times 0*/
3920 memset(&pre_master_secret.data[2], 0, psk_len);
3921 /* 2 bytes psk_len*/
3922 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
3923 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
3924 /* psk*/
3925 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
3926
3927 ssl_session->pre_master_secret.data = pre_master_secret.data;
3928 ssl_session->pre_master_secret.data_len = pre_master_len;
3929 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
3930
3931 /* Remove the master secret if it was there.
3932 This forces keying material regeneration in
3933 case we're renegotiating */
3934 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
3935 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
3936 return true1;
3937 }
3938 else
3939 {
3940 unsigned encrlen, skip;
3941 encrlen = length;
3942 skip = 0;
3943
3944 /* get encrypted data, on tls1 we have to skip two bytes
3945 * (it's the encrypted len and should be equal to record len - 2)
3946 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
3947 */
3948 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
3949 (ssl_session->session.version == TLSV1_VERSION0x301 ||
3950 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
3951 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
3952 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
3953 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
3954 ssl_session->session.version == TLCPV1_VERSION0x101 ))
3955 {
3956 encrlen = tvb_get_ntohs(tvb, offset);
3957 skip = 2;
3958 if (encrlen > length - 2)
3959 {
3960 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
3961 G_STRFUNC((const char*) (__func__)), encrlen, length);
3962 return false0;
3963 }
3964 }
3965 /* the valid lower bound is higher than 8, but it is sufficient for the
3966 * ssl keylog file below */
3967 if (encrlen < 8) {
3968 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
3969 G_STRFUNC((const char*) (__func__)), encrlen);
3970 return false0;
3971 }
3972
3973 StringInfo encrypted_pre_master = {
3974 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
3975 .data_len = encrlen,
3976 };
3977
3978#ifdef HAVE_LIBGNUTLS1
3979 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
3980 if (ssl_session->cert_key_id) {
3981 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
3982 return true1;
3983
3984 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
3985 G_STRFUNC((const char*) (__func__)));
3986 }
3987#endif /* HAVE_LIBGNUTLS */
3988
3989 /* try to find the pre-master secret from the encrypted one. The
3990 * ssl key logfile stores only the first 8 bytes, so truncate it */
3991 encrypted_pre_master.data_len = 8;
3992 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
3993 true1, mk_map->pre_master, &encrypted_pre_master))
3994 return true1;
3995 }
3996 return false0;
3997}
3998
3999/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4000int
4001ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4002{
4003 StringInfo key_block = { NULL((void*)0), 0 };
4004 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4005 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4006 int needed;
4007 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4008 unsigned encr_key_len, write_iv_len = 0;
4009 bool_Bool is_export_cipher;
4010 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4011 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4012 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4013
4014 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4015 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
1
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
→
2
←
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
→
3
←
Taking false branch
→
4016 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4017 return -1;
4018 }
4019
4020 /* check for enough info to proceed */
4021 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4022 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4023 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4
←
Assuming the condition is false
→
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
4024 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4025 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4026 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4027 /* Special case: for NULL encryption, allow dissection of data even if
4028 * the Client Hello is missing (MAC keys are now skipped though). */
4029 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4030 if ((ssl_session->state & need_all) == need_all &&
4031 cipher_suite->enc == ENC_NULL0x3D) {
4032 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4033 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4034 goto create_decoders;
4035 }
4036
4037 return -1;
4038 }
4039
4040 /* if master key is not available, generate is from the pre-master secret */
4041 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
7
←
Assuming the condition is true
→
8
←
Taking true branch
→
4042 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
9
←
Assuming the condition is true
→
10
←
Taking true branch
→
4043 StringInfo handshake_hashed_data;
4044 int ret;
4045
4046 handshake_hashed_data.data = NULL((void*)0);
4047 handshake_hashed_data.data_len = 0;
4048
4049 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4050 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4051 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4051, "ssl_session->handshake_data.data_len > 0"
))));
11
←
Assuming field 'data_len' is > 0
→
12
←
'?' condition is true
→
4052
4053 switch(ssl_session->session.version) {
13
←
Control jumps to 'case 257:' at line 4058
→
4054 case TLSV1_VERSION0x301:
4055 case TLSV1DOT1_VERSION0x302:
4056 case DTLSV1DOT0_VERSION0xfeff:
4057 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4058 case TLCPV1_VERSION0x101:
4059 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
14
←
Calling 'tls_handshake_hash'
→
22
←
Returned allocated memory
→
4060 break;
4061 default:
4062 switch (cipher_suite->dig) {
4063 case DIG_SHA3840x43:
4064 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4065 break;
4066 default:
4067 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4068 break;
4069 }
4070 break;
4071 }
4072 if (ret
23.1
'ret' is -1
) {
23
←
 Execution continues on line 4072
→
24
←
Taking true branch
→
4073 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
25
←
Potential leak of memory pointed to by 'handshake_hashed_data.data'
4074 return -1;
4075 }
4076
4077 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4078 ssl_session->handshake_data.data = NULL((void*)0);
4079 ssl_session->handshake_data.data_len = 0;
4080
4081 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4082 &handshake_hashed_data,
4083 NULL((void*)0), &ssl_session->master_secret,
4084 SSL_MASTER_SECRET_LENGTH48)) {
4085 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4086 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4087 return -1;
4088 }
4089 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4090 } else {
4091 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4092 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4093 ssl_print_string("client random",&ssl_session->client_random);
4094 ssl_print_string("server random",&ssl_session->server_random);
4095 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4096 &ssl_session->client_random,
4097 &ssl_session->server_random, &ssl_session->master_secret,
4098 SSL_MASTER_SECRET_LENGTH48)) {
4099 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4100 return -1;
4101 }
4102 }
4103 ssl_print_string("master secret",&ssl_session->master_secret);
4104
4105 /* the pre-master secret has been 'consumed' so we must clear it now */
4106 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4107 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4108 }
4109
4110 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4111 if (cipher_suite->enc != ENC_NULL0x3D) {
4112 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4113 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4114 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4115 if (cipher_algo == 0) {
4116 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4117 return -1;
4118 }
4119 }
4120
4121 /* Export ciphers consume less material from the key block. */
4122 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4123 is_export_cipher = encr_key_len > 0;
4124 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4125 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4126 }
4127
4128 if (cipher_suite->mode == MODE_CBC) {
4129 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4130 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4131 /* account for a four-byte salt for client and server side (from
4132 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4133 write_iv_len = 4;
4134 } else if (cipher_suite->mode == MODE_POLY1305) {
4135 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4136 write_iv_len = 12;
4137 }
4138
4139 /* Compute the key block. First figure out how much data we need */
4140 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4141 needed += 2 * encr_key_len; /* encryption key */
4142 needed += 2 * write_iv_len; /* write IV */
4143
4144 key_block.data = (unsigned char *)g_malloc(needed);
4145 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4146 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4147 &ssl_session->server_random,&ssl_session->client_random,
4148 &key_block, needed)) {
4149 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4150 goto fail;
4151 }
4152 ssl_print_string("key expansion", &key_block);
4153
4154 ptr=key_block.data;
4155 /* client/server write MAC key (for non-AEAD ciphers) */
4156 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4157 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4158 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4159 }
4160 /* client/server write encryption key */
4161 c_wk=ptr; ptr += encr_key_len;
4162 s_wk=ptr; ptr += encr_key_len;
4163 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4164 if (write_iv_len > 0) {
4165 c_iv=ptr; ptr += write_iv_len;
4166 s_iv=ptr; /* ptr += write_iv_len; */
4167 }
4168
4169 /* export ciphers work with a smaller key length */
4170 if (is_export_cipher) {
4171 if (cipher_suite->mode == MODE_CBC) {
4172
4173 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4174 all we should need. This is a sanity check */
4175 if (write_iv_len > MAX_BLOCK_SIZE16) {
4176 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4177 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4178 goto fail;
4179 }
4180
4181 if(ssl_session->session.version==SSLV3_VERSION0x300){
4182 /* The length of these fields are ignored by this caller */
4183 StringInfo iv_c, iv_s;
4184 iv_c.data = _iv_c;
4185 iv_s.data = _iv_s;
4186
4187 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4188 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4189 &ssl_session->server_random, &iv_c, write_iv_len)) {
4190 goto fail;
4191 }
4192 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4193 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4194 &ssl_session->client_random, &iv_s, write_iv_len)) {
4195 goto fail;
4196 }
4197 }
4198 else{
4199 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4200 StringInfo iv_block;
4201 StringInfo key_null;
4202 uint8_t _key_null;
4203
4204 key_null.data = &_key_null;
4205 key_null.data_len = 0;
4206
4207 iv_block.data = _iv_block;
4208
4209 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4210 if (!prf(ssl_session, &key_null, "IV block",
4211 &ssl_session->client_random,
4212 &ssl_session->server_random, &iv_block,
4213 write_iv_len * 2)) {
4214 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4215 goto fail;
4216 }
4217
4218 memcpy(_iv_c, iv_block.data, write_iv_len);
4219 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4220 }
4221
4222 c_iv=_iv_c;
4223 s_iv=_iv_s;
4224 }
4225
4226 if (ssl_session->session.version==SSLV3_VERSION0x300){
4227
4228 SSL_MD5_CTXgcry_md_hd_t md5;
4229 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4230
4231 if (ssl_md5_init(&md5) != 0)
4232 goto fail;
4233 ssl_md5_update(&md5,c_wk,encr_key_len);
4234 ssl_md5_update(&md5,ssl_session->client_random.data,
4235 ssl_session->client_random.data_len);
4236 ssl_md5_update(&md5,ssl_session->server_random.data,
4237 ssl_session->server_random.data_len);
4238 ssl_md5_final(_key_c,&md5);
4239 ssl_md5_cleanup(&md5);
4240 c_wk=_key_c;
4241
4242 if (ssl_md5_init(&md5) != 0)
4243 goto fail;
4244 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4245 ssl_md5_update(&md5,s_wk,encr_key_len);
4246 ssl_md5_update(&md5,ssl_session->server_random.data,
4247 ssl_session->server_random.data_len);
4248 ssl_md5_update(&md5,ssl_session->client_random.data,
4249 ssl_session->client_random.data_len);
4250 ssl_md5_final(_key_s,&md5);
4251 ssl_md5_cleanup(&md5);
4252 s_wk=_key_s;
4253 }
4254 else{
4255 StringInfo key_c, key_s, k;
4256 key_c.data = _key_c;
4257 key_s.data = _key_s;
4258
4259 k.data = c_wk;
4260 k.data_len = encr_key_len;
4261 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4262 if (!prf(ssl_session, &k, "client write key",
4263 &ssl_session->client_random,
4264 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4265 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4266 goto fail;
4267 }
4268 c_wk=_key_c;
4269
4270 k.data = s_wk;
4271 k.data_len = encr_key_len;
4272 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4273 if (!prf(ssl_session, &k, "server write key",
4274 &ssl_session->client_random,
4275 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4276 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4277 goto fail;
4278 }
4279 s_wk=_key_s;
4280 }
4281 }
4282
4283 /* show key material info */
4284 if (c_mk != NULL((void*)0)) {
4285 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4286 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4287 }
4288 ssl_print_data("Client Write key", c_wk, encr_key_len);
4289 ssl_print_data("Server Write key", s_wk, encr_key_len);
4290 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4291 if (write_iv_len > 0) {
4292 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4293 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4294 }
4295
4296create_decoders:
4297 /* create both client and server ciphers*/
4298 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4299 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4300 if (!ssl_session->client_new) {
4301 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4302 goto fail;
4303 }
4304 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4305 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4306 if (!ssl_session->server_new) {
4307 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4308 goto fail;
4309 }
4310
4311 /* Continue the SSL stream after renegotiation with new keys. */
4312 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4313 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4314
4315 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4316 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4317 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4318 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4319 return 0;
4320
4321fail:
4322 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4323 return -1;
4324}
4325
4326/* Generated the key material based on the given secret. */
4327bool_Bool
4328tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4329{
4330 bool_Bool success = false0;
4331 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4332 unsigned char *sn_key = NULL((void*)0);
4333 SslDecoder *decoder;
4334 unsigned key_length, iv_length;
4335 int hash_algo;
4336 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4337 int cipher_algo;
4338
4339 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4340 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4341 ssl_session->session.version);
4342 return false0;
4343 }
4344
4345 if (cipher_suite == NULL((void*)0)) {
4346 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4347 return false0;
4348 }
4349
4350 if (cipher_suite->kex != KEX_TLS130x23) {
4351 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4352 return false0;
4353 }
4354
4355 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4356 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4357 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4358 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4359 if (cipher_algo == 0) {
4360 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4361 return false0;
4362 }
4363
4364 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4365 hash_algo = ssl_get_digest_by_name(hash_name);
4366 if (!hash_algo) {
4367 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4368 return false0;
4369 }
4370
4371 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4372 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4373 iv_length = 12;
4374 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4375
4376 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4377 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4378 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4379 return false0;
4380 }
4381 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4382 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4383 goto end;
4384 }
4385
4386 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4387 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4388 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4389 goto end;
4390 }
4391 }
4392
4393 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4394 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4395 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4396 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4397 }
4398
4399 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4400 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4401 if (!decoder) {
4402 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4403 goto end;
4404 }
4405
4406 /* Continue the TLS session with new keys, but reuse old flow to keep things
4407 * like "Follow TLS" working (by linking application data records). */
4408 if (is_from_server) {
4409 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4410 ssl_session->server = decoder;
4411 } else {
4412 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4413 ssl_session->client = decoder;
4414 }
4415 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4416 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4417 success = true1;
4418
4419end:
4420 wmem_free(NULL((void*)0), write_key);
4421 wmem_free(NULL((void*)0), write_iv);
4422 if (sn_key)
4423 wmem_free(NULL((void*)0), sn_key);
4424 return success;
4425}
4426/* (Pre-)master secrets calculations }}} */
4427
4428#ifdef HAVE_LIBGNUTLS1
4429/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4430static bool_Bool
4431ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4432 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4433{
4434 int ret;
4435
4436 if (!encrypted_pre_master)
4437 return false0;
4438
4439 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4440 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4441 "(cipher suite 0x%04X %s) and cannot be decrypted "
4442 "using a RSA private key file.\n",
4443 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4444 val_to_str_ext_const(ssl_session->session.cipher,
4445 &ssl_31_ciphersuite_ext, "unknown"));
4446 return false0;
4447 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4448 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4449 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4450 return false0;
4451 }
4452
4453 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4454
4455 ssl_print_string("pre master encrypted", encrypted_pre_master);
4456 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4457 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4458 gnutls_datum_t pms = { 0 };
4459 if (pk) {
4460 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4461 char *err = NULL((void*)0);
4462 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4463 if (!private_key) {
4464 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4465 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4466 return false0;
4467 }
4468
4469 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4470 rsa_private_key_free(private_key);
4471 if (pms.size == 0) {
4472 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4473 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4474 return false0;
4475 }
4476 } else {
4477 // Try to decrypt using a hardware token.
4478 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4479 if (ret < 0) {
4480 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4481 return false0;
4482 }
4483 }
4484
4485 if (pms.size != 48) {
4486 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4487 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4488 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4489 return false0;
4490 }
4491
4492 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4493 ssl_session->pre_master_secret.data_len = 48;
4494 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4495 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4496
4497 /* Remove the master secret if it was there.
4498 This forces keying material regeneration in
4499 case we're renegotiating */
4500 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4501 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4502 return true1;
4503} /* }}} */
4504#endif /* HAVE_LIBGNUTLS */
4505
4506/* Decryption integrity check {{{ */
4507
4508static int
4509tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4510 uint32_t datalen, uint8_t* mac)
4511{
4512 SSL_HMACgcry_md_hd_t hm;
4513 int md;
4514 uint32_t len;
4515 uint8_t buf[DIGEST_MAX_SIZE48];
4516 int16_t temp;
4517
4518 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4519 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4520 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4521
4522 if (ssl_hmac_init(&hm,md) != 0)
4523 return -1;
4524 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4525 return -1;
4526
4527 /* hash sequence number */
4528 phtonu64(buf, decoder->seq);
4529
4530 decoder->seq++;
4531
4532 ssl_hmac_update(&hm,buf,8);
4533
4534 /* hash content type */
4535 buf[0]=ct;
4536 ssl_hmac_update(&hm,buf,1);
4537
4538 /* hash version,data length and data*/
4539 /* *((int16_t*)buf) = g_htons(ver); */
4540 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4541 memcpy(buf, &temp, 2);
4542 ssl_hmac_update(&hm,buf,2);
4543
4544 /* *((int16_t*)buf) = g_htons(datalen); */
4545 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4546 memcpy(buf, &temp, 2);
4547 ssl_hmac_update(&hm,buf,2);
4548 ssl_hmac_update(&hm,data,datalen);
4549
4550 /* get digest and digest len*/
4551 len = sizeof(buf);
4552 ssl_hmac_final(&hm,buf,&len);
4553 ssl_hmac_cleanup(&hm);
4554 ssl_print_data("Mac", buf, len);
4555 if(memcmp(mac,buf,len))
4556 return -1;
4557
4558 return 0;
4559}
4560
4561static int
4562ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4563 uint32_t datalen, uint8_t* mac)
4564{
4565 SSL_MDgcry_md_hd_t mc;
4566 int md;
4567 uint32_t len;
4568 uint8_t buf[64],dgst[20];
4569 int pad_ct;
4570 int16_t temp;
4571
4572 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4573
4574 /* get cipher used for digest computation */
4575 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4576 if (ssl_md_init(&mc,md) !=0)
4577 return -1;
4578
4579 /* do hash computation on data && padding */
4580 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4581
4582 /* hash padding*/
4583 memset(buf,0x36,pad_ct);
4584 ssl_md_update(&mc,buf,pad_ct);
4585
4586 /* hash sequence number */
4587 phtonu64(buf, decoder->seq);
4588 decoder->seq++;
4589 ssl_md_update(&mc,buf,8);
4590
4591 /* hash content type */
4592 buf[0]=ct;
4593 ssl_md_update(&mc,buf,1);
4594
4595 /* hash data length in network byte order and data*/
4596 /* *((int16_t* )buf) = g_htons(datalen); */
4597 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4598 memcpy(buf, &temp, 2);
4599 ssl_md_update(&mc,buf,2);
4600 ssl_md_update(&mc,data,datalen);
4601
4602 /* get partial digest */
4603 ssl_md_final(&mc,dgst,&len);
4604 ssl_md_reset(&mc);
4605
4606 /* hash mac key */
4607 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4608
4609 /* hash padding and partial digest*/
4610 memset(buf,0x5c,pad_ct);
4611 ssl_md_update(&mc,buf,pad_ct);
4612 ssl_md_update(&mc,dgst,len);
4613
4614 ssl_md_final(&mc,dgst,&len);
4615 ssl_md_cleanup(&mc);
4616
4617 if(memcmp(mac,dgst,len))
4618 return -1;
4619
4620 return 0;
4621}
4622
4623static int
4624dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4625 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4626{
4627 SSL_HMACgcry_md_hd_t hm;
4628 int md;
4629 uint32_t len;
4630 uint8_t buf[DIGEST_MAX_SIZE48];
4631 int16_t temp;
4632
4633 int ver = ssl->session.version;
4634 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4635
4636 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4637 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4638 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4639
4640 if (ssl_hmac_init(&hm,md) != 0)
4641 return -1;
4642 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4643 return -1;
4644
4645 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4646
4647 if (is_cid && !ssl->session.deprecated_cid) {
4648 /* hash seq num placeholder */
4649 memset(buf,0xFF,8);
4650 ssl_hmac_update(&hm,buf,8);
4651
4652 /* hash content type + cid length + content type */
4653 buf[0]=ct;
4654 buf[1]=cidl;
4655 buf[2]=ct;
4656 ssl_hmac_update(&hm,buf,3);
4657
4658 /* hash version */
4659 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4660 memcpy(buf, &temp, 2);
4661 ssl_hmac_update(&hm,buf,2);
4662
4663 /* hash sequence number */
4664 phtonu64(buf, decoder->seq);
4665 buf[0]=decoder->epoch>>8;
4666 buf[1]=(uint8_t)decoder->epoch;
4667 ssl_hmac_update(&hm,buf,8);
4668
4669 /* hash cid */
4670 ssl_hmac_update(&hm,cid,cidl);
4671 } else {
4672 /* hash sequence number */
4673 phtonu64(buf, decoder->seq);
4674 buf[0]=decoder->epoch>>8;
4675 buf[1]=(uint8_t)decoder->epoch;
4676 ssl_hmac_update(&hm,buf,8);
4677
4678 /* hash content type */
4679 buf[0]=ct;
4680 ssl_hmac_update(&hm,buf,1);
4681
4682 /* hash version */
4683 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4684 memcpy(buf, &temp, 2);
4685 ssl_hmac_update(&hm,buf,2);
4686
4687 if (is_cid && ssl->session.deprecated_cid) {
4688 /* hash cid */
4689 ssl_hmac_update(&hm,cid,cidl);
4690
4691 /* hash cid length */
4692 buf[0] = cidl;
4693 ssl_hmac_update(&hm,buf,1);
4694 }
4695 }
4696
4697 /* data length and data */
4698 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4699 memcpy(buf, &temp, 2);
4700 ssl_hmac_update(&hm,buf,2);
4701 ssl_hmac_update(&hm,data,datalen);
4702
4703 /* get digest and digest len */
4704 len = sizeof(buf);
4705 ssl_hmac_final(&hm,buf,&len);
4706 ssl_hmac_cleanup(&hm);
4707 ssl_print_data("Mac", buf, len);
4708 if(memcmp(mac,buf,len))
4709 return -1;
4710
4711 return 0;
4712}
4713/* Decryption integrity check }}} */
4714
4715
4716static bool_Bool
4717tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4718 uint8_t ct, uint16_t record_version,
4719 bool_Bool ignore_mac_failed,
4720 const unsigned char *in, uint16_t inl,
4721 const unsigned char *cid, uint8_t cidl,
4722 StringInfo *out_str, unsigned *outl)
4723{
4724 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4725 * GenericAEADCipher: { nonce_explicit, [content] }
4726 * In TLS 1.3 this explicit nonce is gone.
4727 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4728 * ciphertext and authentication tag.
4729 */
4730 const uint16_t version = ssl->session.version;
4731 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4732 gcry_error_t err;
4733 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4734 unsigned ciphertext_len, auth_tag_len;
4735 unsigned char nonce[12];
4736 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4737 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4738 const uint8_t draft_version = ssl->session.tls13_draft_version;
4739 const unsigned char *auth_tag_wire;
4740 unsigned char auth_tag_calc[16];
4741 unsigned char *aad = NULL((void*)0);
4742 unsigned aad_len = 0;
4743
4744 switch (cipher_mode) {
4745 case MODE_GCM:
4746 case MODE_CCM:
4747 case MODE_POLY1305:
4748 auth_tag_len = 16;
4749 break;
4750 case MODE_CCM_8:
4751 auth_tag_len = 8;
4752 break;
4753 default:
4754 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4755 return false0;
4756 }
4757
4758 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4759 if (is_v12 && cipher_mode != MODE_POLY1305) {
4760 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4761 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4762 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4763 return false0;
4764 }
4765 explicit_nonce = in;
4766 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4767 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4768 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4769 if (inl < auth_tag_len) {
4770 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4771 return false0;
4772 }
4773 ciphertext = in;
4774 ciphertext_len = inl - auth_tag_len;
4775 } else {
4776 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4777 return false0;
4778 }
4779 auth_tag_wire = ciphertext + ciphertext_len;
4780
4781 /*
4782 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4783 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4784 */
4785 if (is_v12 && cipher_mode != MODE_POLY1305) {
4786 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4786, "decoder->write_iv.data_len == 4"))));
4787 /* Implicit (4) and explicit (8) part of nonce. */
4788 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4789 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
4790
4791 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4792 /*
4793 * Technically the nonce length must be at least 8 bytes, but for
4794 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
4795 */
4796 const unsigned nonce_len = 12;
4797 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4797, "decoder->write_iv.data_len == nonce_len"
))));
4798 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
4799 /* Sequence number is left-padded with zeroes and XORed with write_iv */
4800 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
4801 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
4802 }
4803
4804 /* Set nonce and additional authentication data */
4805 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
4806 ssl_print_data("nonce", nonce, 12);
4807 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
4808 if (err) {
4809 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4810 return false0;
4811 }
4812
4813 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
4814 if (is_cid) { /* if connection ID */
4815 if (ssl->session.deprecated_cid) {
4816 aad_len = 14 + cidl;
4817 aad = wmem_alloc(allocator, aad_len);
4818 phtonu64(aad, decoder->seq); /* record sequence number */
4819 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4820 aad[8] = ct; /* TLSCompressed.type */
4821 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4822 memcpy(aad + 11, cid, cidl); /* cid */
4823 aad[11 + cidl] = cidl; /* cid_length */
4824 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
4825 } else {
4826 aad_len = 23 + cidl;
4827 aad = wmem_alloc(allocator, aad_len);
4828 memset(aad, 0xFF, 8); /* seq_num_placeholder */
4829 aad[8] = ct; /* TLSCompressed.type */
4830 aad[9] = cidl; /* cid_length */
4831 aad[10] = ct; /* TLSCompressed.type */
4832 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
4833 phtonu64(aad + 13, decoder->seq); /* record sequence number */
4834 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
4835 memcpy(aad + 21, cid, cidl); /* cid */
4836 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
4837 }
4838 } else if (is_v12) {
4839 aad_len = 13;
4840 aad = wmem_alloc(allocator, aad_len);
4841 phtonu64(aad, decoder->seq); /* record sequence number */
4842 if (version == DTLSV1DOT2_VERSION0xfefd) {
4843 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4844 }
4845 aad[8] = ct; /* TLSCompressed.type */
4846 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4847 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
4848 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
4849 aad_len = decoder->dtls13_aad.data_len;
4850 aad = decoder->dtls13_aad.data;
4851 } else if (draft_version >= 25 || draft_version == 0) {
4852 aad_len = 5;
4853 aad = wmem_alloc(allocator, aad_len);
4854 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
4855 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
4856 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
4857 }
4858
4859 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
4860 /* size of plaintext, additional authenticated data and auth tag. */
4861 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
4862
4863 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
4864 }
4865
4866 if (aad && aad_len > 0) {
4867 ssl_print_data("AAD", aad, aad_len);
4868 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
4869 if (err) {
4870 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4871 return false0;
4872 }
4873 }
4874
4875 /* Decrypt now that nonce and AAD are set. */
4876 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
4877 if (err) {
4878 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4879 return false0;
4880 }
4881
4882 /* Check authentication tag for authenticity (replaces MAC) */
4883 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
4884 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
4885 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
4886 } else {
4887 if (err) {
4888 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4889 } else {
4890 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
4891 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
4892 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
4893 }
4894 if (ignore_mac_failed) {
4895 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
4896 } else {
4897 return false0;
4898 }
4899 }
4900
4901 /*
4902 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
4903 * after successful authentication to ensure that early data is skipped when
4904 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
4905 */
4906 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
4907 decoder->seq++;
4908 }
4909
4910 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
4911 *outl = ciphertext_len;
4912 return true1;
4913}
4914
4915/* Record decryption glue based on security parameters {{{ */
4916/* Assume that we are called only for a non-NULL decoder which also means that
4917 * we have a non-NULL decoder->cipher_suite. */
4918int
4919ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
4920 bool_Bool ignore_mac_failed,
4921 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
4922 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
4923{
4924 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
4925 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
4926
4927 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
4928 ssl_print_data("Ciphertext",in, inl);
4929
4930 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
4931 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
4932 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
4933 return -1;
4934 }
4935
4936 /* ensure we have enough storage space for decrypted data */
4937 if (inl > out_str->data_len)
4938 {
4939 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
4940 inl + 32, out_str->data_len);
4941 ssl_data_realloc(out_str, inl + 32);
4942 }
4943
4944 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
4945 * a separate MAC, so use a different routine for simplicity. */
4946 if (decoder->cipher_suite->mode == MODE_GCM ||
4947 decoder->cipher_suite->mode == MODE_CCM ||
4948 decoder->cipher_suite->mode == MODE_CCM_8 ||
4949 decoder->cipher_suite->mode == MODE_POLY1305 ||
4950 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
4951 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
4952
4953 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
4954 /* decryption failed */
4955 return -1;
4956 }
4957
4958 goto skip_mac;
4959 }
4960
4961 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
4962 * (notation: { unencrypted, [ encrypted ] })
4963 * GenericStreamCipher: { [content, mac] }
4964 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
4965 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
4966 * GenericAEADCipher: { nonce_explicit, [content] }
4967 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
4968 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
4969 */
4970
4971 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
4972
4973 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
4974 if (decoder->cipher_suite->mode == MODE_CBC) {
4975 unsigned blocksize = 0;
4976
4977 switch (ssl->session.version) {
4978 case TLSV1DOT1_VERSION0x302:
4979 case TLSV1DOT2_VERSION0x303:
4980 case DTLSV1DOT0_VERSION0xfeff:
4981 case DTLSV1DOT2_VERSION0xfefd:
4982 case DTLSV1DOT3_VERSION0xfefc:
4983 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4984 case TLCPV1_VERSION0x101:
4985 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
4986 if (inl < blocksize) {
4987 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
4988 inl, blocksize);
4989 return -1;
4990 }
4991 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
4992 if (pad != 0) {
4993 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
4994 gcry_strsource (pad), gcry_strerror (pad));
4995 }
4996
4997 inl -= blocksize;
4998 in += blocksize;
4999 break;
5000 }
5001
5002 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5003 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5004 /*
5005 * MAC is calculated over (IV + ) ENCRYPTED contents:
5006 *
5007 * MAC(MAC_write_key, ... +
5008 * IV + // for TLS 1.1 or greater
5009 * TLSCiphertext.enc_content);
5010 */
5011 if (inl < maclen) {
5012 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5013 G_STRFUNC((const char*) (__func__)), inl, maclen);
5014 return -1;
5015 }
5016 inl -= maclen;
5017 mac = (uint8_t *)in + inl;
5018 mac_frag = (uint8_t *)in - blocksize;
5019 mac_fraglen = blocksize + inl;
5020 }
5021 }
5022
5023 /* First decrypt*/
5024 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5025 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5026 gcry_strerror (pad));
5027 return -1;
5028 }
5029
5030 ssl_print_data("Plaintext", out_str->data, inl);
5031 worklen=inl;
5032
5033
5034 /* strip padding for GenericBlockCipher */
5035 if (decoder->cipher_suite->mode == MODE_CBC) {
5036 if (inl < 1) { /* Should this check happen earlier? */
5037 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5038 return -1;
5039 }
5040 pad=out_str->data[inl-1];
5041 if (worklen <= pad) {
5042 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5043 pad, worklen);
5044 return -1;
5045 }
5046 worklen-=(pad+1);
5047 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5048 pad, worklen);
5049 }
5050
5051 /* MAC for GenericStreamCipher and GenericBlockCipher.
5052 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5053 if (!mac) {
5054 /*
5055 * MAC is calculated over the DECRYPTED contents:
5056 *
5057 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5058 */
5059 if (worklen < maclen) {
5060 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5061 return -1;
5062 }
5063 worklen -= maclen;
5064 mac = out_str->data + worklen;
5065 mac_frag = out_str->data;
5066 mac_fraglen = worklen;
5067 }
5068
5069 /* If NULL encryption active and no keys are available, do not bother
5070 * checking the MAC. We do not have keys for that. */
5071 if (decoder->cipher_suite->mode == MODE_STREAM &&
5072 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5073 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5074 ssl_debug_printf("MAC check skipped due to missing keys\n");
5075 decoder->seq++; // Increment this for display
5076 goto skip_mac;
5077 }
5078
5079 /* Now check the MAC */
5080 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5081 worklen, ssl->session.version, ct, decoder->seq);
5082 if(ssl->session.version==SSLV3_VERSION0x300){
5083 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5084 if(ignore_mac_failed) {
5085 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5086 }
5087 else{
5088 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5089 return -1;
5090 }
5091 }
5092 else{
5093 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5094 }
5095 }
5096 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5097 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5098 if(ignore_mac_failed) {
5099 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5100 }
5101 else{
5102 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5103 return -1;
5104 }
5105 }
5106 else{
5107 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5108 }
5109 }
5110 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5111 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5112 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5113 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5114 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5115 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5116 }
5117 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5118 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5119 }
5120 else if(ignore_mac_failed) {
5121 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5122 }
5123 else{
5124 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5125 return -1;
5126 }
5127 }
5128skip_mac:
5129
5130 *outl = worklen;
5131
5132 if (decoder->compression > 0) {
5133 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5134 ssl_data_copy(comp_str, out_str);
5135 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5136 if (!decoder->decomp) {
5137 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5138 return -1;
5139 }
5140 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5141 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5142 *outl = uncomplen;
5143 }
5144
5145 return 0;
5146}
5147/* Record decryption glue based on security parameters }}} */
5148
5149
5150
5151#ifdef HAVE_LIBGNUTLS1
5152
5153/* RSA private key file processing {{{ */
5154static void
5155ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5156 const gnutls_datum_t *subjectPublicKeyInfo)
5157{
5158 gnutls_pubkey_t pubkey = NULL((void*)0);
5159 cert_key_id_t key_id;
5160 size_t key_id_len = sizeof(key_id);
5161 int r;
5162
5163 if (!subjectPublicKeyInfo->size) {
5164 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5165 return;
5166 }
5167
5168 r = gnutls_pubkey_init(&pubkey);
5169 if (r < 0) {
5170 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5171 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5172 return;
5173 }
5174
5175 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5176 if (r < 0) {
5177 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5178 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5179 goto end;
5180 }
5181
5182 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5183 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5184 goto end;
5185 }
5186
5187 /* Generate a 20-byte SHA-1 hash. */
5188 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5189 if (r < 0) {
5190 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5191 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5192 goto end;
5193 }
5194
5195 if (key_id_len != sizeof(key_id)) {
5196 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5197 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5198 goto end;
5199 }
5200
5201 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5202 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5203 *ssl->cert_key_id = key_id;
5204
5205end:
5206 gnutls_pubkey_deinit(pubkey);
5207}
5208
5209/* RSA private key file processing }}} */
5210#endif /* HAVE_LIBGNUTLS */
5211
5212/*--- Start of dissector-related code below ---*/
5213
5214/* This is not a "protocol" but ensures that this gets called during
5215 * the handoff stage. */
5216void proto_reg_handoff_tls_utils(void);
5217
5218static dissector_handle_t base_tls_handle;
5219static dissector_handle_t dtls_handle;
5220
5221void
5222proto_reg_handoff_tls_utils(void)
5223{
5224 base_tls_handle = find_dissector("tls");
5225 dtls_handle = find_dissector("dtls");
5226}
5227
5228/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5229 * no session exists. */
5230SslDecryptSession *
5231tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5232{
5233 void *conv_data;
5234 wmem_map_t *session_map;
5235
5236 if (!conversation)
5237 return NULL((void*)0);
5238
5239 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5240 if (conv_data == NULL((void*)0))
5241 return NULL((void*)0);
5242
5243 session_map = (wmem_map_t *)conv_data;
5244
5245 return (SslDecryptSession *)wmem_map_lookup(session_map,
5246 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5247
5248}
5249
5250/* get ssl data for this session. if no ssl data is found allocate a new one*/
5251SslDecryptSession *
5252ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5253{
5254 void *conv_data;
5255 SslDecryptSession *ssl_session;
5256 int proto_ssl;
5257 wmem_map_t *session_map;
5258
5259 /* Note proto_ssl is tls for either the main tls_handle or the
5260 * tls13_handshake handle used by QUIC. */
5261 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5262 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5263
5264 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5265 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5266 * preventing memory leaks on capture reload. */
5267 if (conv_data != NULL((void*)0)) {
5268 session_map = (wmem_map_t *)conv_data;
5269 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5270 if (ssl_session != NULL((void*)0)) {
5271 return ssl_session;
5272 }
5273 } else {
5274 /* Create a new wmem map to store sessions by layer number */
5275 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5276 conversation_add_proto_data(conversation, proto_ssl, session_map);
5277 }
5278
5279 /* no previous SSL conversation info for this layer, initialize it. */
5280 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5281
5282 /* data_len is the part that is meaningful, not the allocated length */
5283 ssl_session->master_secret.data_len = 0;
5284 ssl_session->master_secret.data = ssl_session->_master_secret;
5285 ssl_session->session_id.data_len = 0;
5286 ssl_session->session_id.data = ssl_session->_session_id;
5287 ssl_session->client_random.data_len = 0;
5288 ssl_session->client_random.data = ssl_session->_client_random;
5289 ssl_session->server_random.data_len = 0;
5290 ssl_session->server_random.data = ssl_session->_server_random;
5291 ssl_session->session_ticket.data_len = 0;
5292 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5293 ssl_session->server_data_for_iv.data_len = 0;
5294 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5295 ssl_session->client_data_for_iv.data_len = 0;
5296 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5297 ssl_session->app_data_segment.data = NULL((void*)0);
5298 ssl_session->app_data_segment.data_len = 0;
5299 ssl_session->handshake_data.data=NULL((void*)0);
5300 ssl_session->handshake_data.data_len=0;
5301 ssl_session->ech_transcript.data=NULL((void*)0);
5302 ssl_session->ech_transcript.data_len=0;
5303
5304 /* Initialize parameters which are not necessary specific to decryption. */
5305 ssl_session->session.version = SSL_VER_UNKNOWN0;
5306 clear_address(&ssl_session->session.srv_addr);
5307 ssl_session->session.srv_ptype = PT_NONE;
5308 ssl_session->session.srv_port = 0;
5309 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5310 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5311 ssl_session->session.client_random.data_len = 0;
5312 ssl_session->session.client_random.data = ssl_session->session._client_random;
5313 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5314 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5315 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5316 ssl_session->session.ech = false0;
5317 ssl_session->session.hrr_ech_declined = false0;
5318 ssl_session->session.first_ch_ech_frame = 0;
5319
5320 /* We want to increment the stream count for the normal tls handle and
5321 * dtls handle, but presumably not for the tls13_handshake handle used
5322 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5323 * doesn't get sent to the TLS follow tap.)
5324 */
5325 if (tls_handle == base_tls_handle) {
5326 ssl_session->session.stream = tls_increment_stream_count();
5327 } else if (tls_handle == dtls_handle) {
5328 ssl_session->session.stream = dtls_increment_stream_count();
5329 }
5330
5331 /* Store the session in the wmem map indexed by layer number */
5332 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5333
5334 return ssl_session;
5335}
5336
5337void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5338{
5339 if (ssl) {
5340 /* Ensure that secrets are not restored using stale identifiers. Split
5341 * between client and server in case the packets somehow got out of order. */
5342 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5343
5344 if (is_client) {
5345 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5346 ssl->session_id.data_len = 0;
5347 ssl->session_ticket.data_len = 0;
5348 ssl->master_secret.data_len = 0;
5349 ssl->client_random.data_len = 0;
5350 ssl->has_early_data = false0;
5351 if (ssl->handshake_data.data_len > 0) {
5352 // The EMS handshake hash starts with at the Client Hello,
5353 // ensure that any messages before it are forgotten.
5354 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
5355 ssl->handshake_data.data = NULL((void*)0);
5356 ssl->handshake_data.data_len = 0;
5357 }
5358 } else {
5359 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5360 ssl->server_random.data_len = 0;
5361 ssl->pre_master_secret.data_len = 0;
5362#ifdef HAVE_LIBGNUTLS1
5363 ssl->cert_key_id = NULL((void*)0);
5364#endif
5365 ssl->has_psk = false0;
5366 ssl->has_key_share = false0;
5367 // There is no point in clearing the PSK when resetting the session,
5368 // we only store one global PSK in the prefs.
5369 //ssl->psk.data_len = 0;
5370 }
5371
5372 if (ssl->state & clear_flags) {
5373 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5374 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5375 ssl->state &= ~clear_flags;
5376 }
5377 }
5378
5379 /* These flags might be used for non-decryption purposes and may affect the
5380 * dissection, so reset them as well. */
5381 if (is_client) {
5382 session->client_cert_type = 0;
5383 } else {
5384 session->compression = 0;
5385 session->server_cert_type = 0;
5386 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5387 }
5388 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5389 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5390}
5391
5392void
5393tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5394 dissector_handle_t app_handle)
5395{
5396 conversation_t *conversation;
5397 SslSession *session;
5398
5399 /* Ignore if the TLS or other dissector is disabled. */
5400 /* XXX - find_dissector still works if a dissector is disabled,
5401 * this would be if the dissector isn't registered at all or the
5402 * caller is calling this with explicit NULL. */
5403 if (!tls_handle || !app_handle)
5404 return;
5405
5406 int proto = dissector_handle_get_protocol_index(tls_handle);
5407 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5408
5409 conversation = find_or_create_conversation(pinfo);
5410 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5411 session->app_handle = app_handle;
5412}
5413
5414static uint32_t
5415ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5416 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5417{
5418
5419 conversation_t *conversation;
5420 SslSession *session;
5421
5422 /* Ignore if the TLS dissector is disabled. */
5423 /* XXX - find_dissector still works if a dissector is disabled,
5424 * this would be if the dissector isn't registered at all (or the
5425 * caller has an error.) */
5426 if (!tls_handle)
5427 return 0;
5428
5429 int proto = dissector_handle_get_protocol_index(tls_handle);
5430 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5431
5432 /* The caller should always pass a valid handle to its own dissector. */
5433 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5433, "app_handle"))));
5434
5435 conversation = find_or_create_conversation(pinfo);
5436 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5437
5438 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5439 session->last_nontls_frame,
5440 (void *)session->app_handle,
5441 dissector_handle_get_dissector_name(session->app_handle));
5442 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5443 pinfo->num, (void *)app_handle,
5444 dissector_handle_get_dissector_name(app_handle));
5445
5446 /* Do not switch again if a dissector did it before. */
5447 if (session->last_nontls_frame) {
5448 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5449 return session->last_nontls_frame;
5450 }
5451
5452 session->app_handle = app_handle;
5453 /* The TLS dissector should be called first for this conversation. */
5454 conversation_set_dissector(conversation, tls_handle);
5455 /* TLS starts after this frame. */
5456 session->last_nontls_frame = last_nontls_frame;
5457 return 0;
5458}
5459
5460/* ssl_starttls_ack: mark future frames as encrypted. */
5461uint32_t
5462ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5463 dissector_handle_t app_handle)
5464{
5465 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5466}
5467
5468uint32_t
5469ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5470 dissector_handle_t app_handle)
5471{
5472 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5473}
5474
5475dissector_handle_t
5476ssl_find_appdata_dissector(const char *name)
5477{
5478 /* Accept 'http' for backwards compatibility and sanity. */
5479 if (!strcmp(name, "http"))
5480 name = "http-over-tls";
5481 /* XXX - Should this check to see if the dissector is actually added for
5482 * Decode As in the appropriate table?
5483 */
5484 return find_dissector(name);
5485}
5486
5487/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5488static int
5489ssl_equal (const void *v, const void *v2)
5490{
5491 const StringInfo *val1;
5492 const StringInfo *val2;
5493 val1 = (const StringInfo *)v;
5494 val2 = (const StringInfo *)v2;
5495
5496 if (val1->data_len == val2->data_len &&
5497 !memcmp(val1->data, val2->data, val2->data_len)) {
5498 return 1;
5499 }
5500 return 0;
5501}
5502
5503static unsigned
5504ssl_hash(const void *v)
5505{
5506 const StringInfo* id;
5507 id = (const StringInfo*) v;
5508
5509 return wmem_strong_hash(id->data, id->data_len);
5510}
5511/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5512
5513/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5514void
5515ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5516{
5517 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5517, "main_handle"))));
5518 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5518, "subdissector_handle"))));
5519 /* Registration is required for Export PDU feature to work properly. */
5520 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5521, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5521 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5521, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5522 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5523
5524 if (port) {
5525 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5526 if (tcp)
5527 dissector_add_uint("tcp.port", port, main_handle);
5528 else
5529 dissector_add_uint("udp.port", port, main_handle);
5530 dissector_add_uint("sctp.port", port, main_handle);
5531 } else {
5532 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5533 }
5534}
5535
5536void
5537ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5538{
5539 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5540 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5541 if (main_handle) {
5542 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5543 dissector_delete_uint("sctp.port", port, main_handle);
5544 }
5545
5546 if (port) {
5547 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5548 }
5549}
5550
5551void
5552ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5553{
5554 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5555 session->srv_ptype = ptype;
5556 session->srv_port = port;
5557}
5558
5559int
5560ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5561{
5562 int ret;
5563 if (session && session->srv_addr.type != AT_NONE) {
5564 ret = (session->srv_ptype == pinfo->ptype) &&
5565 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5566 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5567 } else {
5568 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5569 }
5570
5571 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5572 return ret;
5573}
5574/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5575
5576
5577/* Links SSL records with the real packet data. {{{ */
5578SslPacketInfo *
5579tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5580{
5581 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5582 if (!pi) {
5583 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5584 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5585 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5586 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5587 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5588 if (ssl_session) {
5589 /* This can also be called by the QUIC TLS1.3 handshake only
5590 * dissector. That is not associated with a session, or a stream,
5591 * and doesn't need the information for Follow or Decode As. */
5592 pi->stream = ssl_session->session.stream;
5593 }
5594 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5595 }
5596
5597 return pi;
5598}
5599
5600/**
5601 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5602 * avoid the need for a decoder in the second pass. Additionally, it remembers
5603 * sequence numbers (for reassembly and Follow TLS Stream).
5604 *
5605 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5606 * @param pinfo The packet where the record originates from.
5607 * @param plain_data Decrypted plaintext to store in the record.
5608 * @param plain_data_len Total length of the plaintext.
5609 * @param content_len Length of the plaintext section corresponding to the record content.
5610 * @param record_id The identifier for this record within the current packet.
5611 * @param flow Information about sequence numbers, etc.
5612 * @param type TLS Content Type (such as handshake or application_data).
5613 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5614 */
5615void
5616ssl_add_record_info(int proto, packet_info *pinfo,
5617 const unsigned char *plain_data, int plain_data_len, int content_len,
5618 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5619 uint64_t record_seq)
5620{
5621 SslRecordInfo* rec, **prec;
5622 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5623
5624 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5624
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5625
5626 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5627 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5628 rec->plain_data_len = plain_data_len;
5629 rec->content_len = content_len;
5630 rec->id = record_id;
5631 rec->type = type;
5632 rec->next = NULL((void*)0);
5633 rec->record_seq = record_seq;
5634
5635 if (flow && type == SSL_ID_APP_DATA) {
5636 rec->seq = flow->byte_seq;
5637 rec->flow = flow;
5638 flow->byte_seq += content_len;
5639 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5640 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5641 }
5642
5643 /* Remember decrypted records. */
5644 prec = &pi->records;
5645 while (*prec) prec = &(*prec)->next;
5646 *prec = rec;
5647}
5648
5649/* search in packet data for the specified id; return a newly created tvb for the associated data */
5650tvbuff_t*
5651ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5652{
5653 SslRecordInfo* rec;
5654 SslPacketInfo* pi;
5655 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5656
5657 if (!pi)
5658 return NULL((void*)0);
5659
5660 for (rec = pi->records; rec; rec = rec->next)
5661 if (rec->id == record_id) {
5662 *matched_record = rec;
5663 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5664 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5665 }
5666
5667 return NULL((void*)0);
5668}
5669/* Links SSL records with the real packet data. }}} */
5670
5671/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5672void
5673ssl_common_init(ssl_master_key_map_t *mk_map,
5674 StringInfo *decrypted_data, StringInfo *compressed_data)
5675{
5676 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5677 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5678 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5679 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5680 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5681 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5682 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5683 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5684 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5685 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5686 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5687 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5688
5689 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5690 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5691
5692 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5693
5694 ssl_data_alloc(decrypted_data, 32);
5695 ssl_data_alloc(compressed_data, 32);
5696}
5697
5698void
5699ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5700 StringInfo *decrypted_data, StringInfo *compressed_data)
5701{
5702 g_hash_table_destroy(mk_map->session);
5703 g_hash_table_destroy(mk_map->tickets);
5704 g_hash_table_destroy(mk_map->crandom);
5705 g_hash_table_destroy(mk_map->pre_master);
5706 g_hash_table_destroy(mk_map->pms);
5707 g_hash_table_destroy(mk_map->tls13_client_early);
5708 g_hash_table_destroy(mk_map->tls13_client_handshake);
5709 g_hash_table_destroy(mk_map->tls13_server_handshake);
5710 g_hash_table_destroy(mk_map->tls13_client_appdata);
5711 g_hash_table_destroy(mk_map->tls13_server_appdata);
5712 g_hash_table_destroy(mk_map->tls13_early_exporter);
5713 g_hash_table_destroy(mk_map->tls13_exporter);
5714
5715 g_hash_table_destroy(mk_map->ech_secret);
5716 g_hash_table_destroy(mk_map->ech_config);
5717
5718 g_hash_table_destroy(mk_map->used_crandom);
5719
5720 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5721 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5722
5723 /* close the previous keylog file now that the cache are cleared, this
5724 * allows the cache to be filled with the full keylog file contents. */
5725 if (*ssl_keylog_file) {
5726 fclose(*ssl_keylog_file);
5727 *ssl_keylog_file = NULL((void*)0);
5728 }
5729}
5730/* }}} */
5731
5732/* parse ssl related preferences (private keys and ports association strings) */
5733#if defined(HAVE_LIBGNUTLS1)
5734/* Load a single RSA key file item from preferences. {{{ */
5735void
5736ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5737{
5738 gnutls_x509_privkey_t x509_priv_key;
5739 gnutls_privkey_t priv_key = NULL((void*)0);
5740 FILE* fp = NULL((void*)0);
5741 int ret;
5742 size_t key_id_len = 20;
5743 unsigned char *key_id = NULL((void*)0);
5744 char *err = NULL((void*)0);
5745 dissector_handle_t handle;
5746 /* try to load keys file first */
5747 fp = ws_fopenfopen(uats->keyfile, "rb");
5748 if (!fp) {
5749 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5750 return;
5751 }
5752
5753 if ((int)strlen(uats->password) == 0) {
5754 x509_priv_key = rsa_load_pem_key(fp, &err);
5755 } else {
5756 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
5757 }
5758 fclose(fp);
5759
5760 if (!x509_priv_key) {
5761 if (err) {
5762 report_failure("Can't load private key from %s: %s",
5763 uats->keyfile, err);
5764 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5765 } else
5766 report_failure("Can't load private key from %s: unknown error",
5767 uats->keyfile);
5768 return;
5769 }
5770 if (err) {
5771 report_failure("Load of private key from %s \"succeeded\" with error %s",
5772 uats->keyfile, err);
5773 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5774 }
5775
5776 gnutls_privkey_init(&priv_key);
5777 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
5778 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
5779 if (ret < 0) {
5780 report_failure("Can't convert private key %s: %s",
5781 uats->keyfile, gnutls_strerror(ret));
5782 goto end;
5783 }
5784
5785 key_id = (unsigned char *) g_malloc0(key_id_len);
5786 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
5787 if (ret < 0) {
5788 report_failure("Can't calculate public key ID for %s: %s",
5789 uats->keyfile, gnutls_strerror(ret));
5790 goto end;
5791 }
5792 ssl_print_data("KeyID", key_id, key_id_len);
5793 if (key_id_len != 20) {
5794 report_failure("Expected Key ID size %u for %s, got %zu", 20,
5795 uats->keyfile, key_id_len);
5796 goto end;
5797 }
5798
5799 g_hash_table_replace(key_hash, key_id, priv_key);
5800 key_id = NULL((void*)0); /* used in key_hash, do not free. */
5801 priv_key = NULL((void*)0);
5802 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
5803
5804 handle = ssl_find_appdata_dissector(uats->protocol);
5805 if (handle) {
5806 /* Port to subprotocol mapping */
5807 uint16_t port = 0;
5808 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
5809 if (port > 0) {
5810 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
5811 port, uats->keyfile, uats->password);
5812
5813 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
5814 }
5815 } else {
5816 if (strcmp(uats->port, "start_tls"))
5817 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
5818 }
5819 }
5820
5821end:
5822 gnutls_x509_privkey_deinit(x509_priv_key);
5823 gnutls_privkey_deinit(priv_key);
5824 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
5825}
5826/* }}} */
5827#endif
5828
5829
5830/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
5831/** store a known (pre-)master secret into cache */
5832static void
5833ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
5834 StringInfo *mk)
5835{
5836 StringInfo *ht_key, *master_secret;
5837
5838 if (key->data_len == 0) {
5839 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
5840 return;
5841 }
5842
5843 if (mk->data_len == 0) {
5844 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
5845 G_STRFUNC((const char*) (__func__)), label);
5846 return;
5847 }
5848
5849 ht_key = ssl_data_clone(key);
5850 master_secret = ssl_data_clone(mk);
5851 g_hash_table_insert(ht, ht_key, master_secret);
5852
5853 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
5854 ssl_print_string("stored key", ht_key);
5855 ssl_print_string("stored (pre-)master secret", master_secret);
5856}
5857
5858/** restore a (pre-)master secret given some key in the cache */
5859static bool_Bool
5860ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
5861 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
5862{
5863 StringInfo *ms;
5864
5865 if (key->data_len == 0) {
5866 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
5867 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
5868 return false0;
5869 }
5870
5871 ms = (StringInfo *)g_hash_table_lookup(ht, key);
5872 if (!ms) {
5873 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
5874 is_pre_master ? "pre-" : "", label);
5875 return false0;
5876 }
5877
5878 /* (pre)master secret found, clear knowledge of other keys and set it in the
5879 * current conversation */
5880 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
5881 SSL_HAVE_SESSION_KEY(1<<3));
5882 if (is_pre_master) {
5883 /* unlike master secret, pre-master secret has a variable size (48 for
5884 * RSA, varying for PSK) and is therefore not statically allocated */
5885 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
5886 ms->data_len);
5887 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
5888 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
5889 } else {
5890 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
5891 ssl->state |= SSL_MASTER_SECRET(1<<5);
5892 }
5893 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
5894 is_pre_master ? "pre-" : "", label);
5895 ssl_print_string(label, key);
5896 ssl_print_string("(pre-)master secret", ms);
5897 return true1;
5898}
5899/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
5900
5901/* Should be called when all parameters are ready (after ChangeCipherSpec), and
5902 * the decoder should be attempted to be initialized. {{{*/
5903void
5904ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
5905{
5906 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
5907 /* TLS 1.3 implementations only provide secrets derived from the master
5908 * secret which are loaded in tls13_change_key. No master secrets can be
5909 * loaded here, so just return. */
5910 return;
5911 }
5912 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
5913 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
5914 ssl_debug_printf(" session key already available, nothing to do.\n");
5915 return;
5916 }
5917 if (!(ssl->state & SSL_CIPHER(1<<2))) {
5918 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
5919 return;
5920 }
5921
5922 /* for decryption, there needs to be a master secret (which can be derived
5923 * from pre-master secret). If missing, try to pick a master key from cache
5924 * (an earlier packet in the capture or key logfile). */
5925 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
5926 !ssl_restore_master_key(ssl, "Session ID", false0,
5927 mk_map->session, &ssl->session_id) &&
5928 (!ssl->session.is_session_resumed ||
5929 !ssl_restore_master_key(ssl, "Session Ticket", false0,
5930 mk_map->tickets, &ssl->session_ticket)) &&
5931 !ssl_restore_master_key(ssl, "Client Random", false0,
5932 mk_map->crandom, &ssl->client_random)) {
5933 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
5934 /* how unfortunate, the master secret could not be found */
5935 ssl_debug_printf(" Cannot find master secret\n");
5936 return;
5937 } else {
5938 ssl_debug_printf(" Cannot find master secret, continuing anyway "
5939 "because of a NULL cipher\n");
5940 }
5941 }
5942
5943 if (ssl_generate_keyring_material(ssl) < 0) {
5944 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
5945 return;
5946 }
5947 /* Save Client Random/ Session ID for "SSL Export Session keys" */
5948 ssl_save_master_key("Client Random", mk_map->crandom,
5949 &ssl->client_random, &ssl->master_secret);
5950 ssl_save_master_key("Session ID", mk_map->session,
5951 &ssl->session_id, &ssl->master_secret);
5952 /* Only save the new secrets if the server sent the ticket. The client
5953 * ticket might have become stale. */
5954 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
5955 ssl_save_master_key("Session Ticket", mk_map->tickets,
5956 &ssl->session_ticket, &ssl->master_secret);
5957 }
5958} /* }}} */
5959
5960static StringInfo*
5961tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
5962 TLSRecordType type)
5963{
5964 /* XXX - In addition to an out-of-bound PSK, we could also save the
5965 * PSK from a NewSessionTicket; we would also need to compute the
5966 * resumption_master_secret. */
5967 if (tls->psk.data_len == 0)
5968 return NULL((void*)0);
5969
5970 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
5971 * a UAT instead of a single global PSK string preference, preferably
5972 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
5973 * SHOULD be used. We will try the negotiated hash algorithm regardless
5974 * with the PSK, but fall back to SHA-256 for the Early Secret, since
5975 * that's before the Server Hello completes negotiation.
5976 */
5977 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
5978 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
5979 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
5980 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
5981 }
5982
5983 int hash_algo = ssl_get_digest_by_name(dig->name);
5984 if (!hash_algo) {
5985 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
5986 return NULL((void*)0);
5987 }
5988
5989 /* We can re-use this to store the Pseudo Random Key for each epoch. */
5990 uint8_t prk[DIGEST_MAX_SIZE48];
5991 StringInfo prk_string = { prk, dig->len };
5992 uint8_t *derived_secret;
5993
5994 uint8_t zeroes[DIGEST_MAX_SIZE48];
5995 memset(zeroes, 0, dig->len);
5996
5997 StringInfo *secret = NULL((void*)0);
5998 const char *label;
5999
6000 /* PRK = Early Secret */
6001 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6002
6003 if (type == TLS_SECRET_0RTT_APP) {
6004 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6004, "!is_from_server"))));
6005 label = "c e traffic";
6006 } else {
6007 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6008 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6009 return NULL((void*)0);
6010
6011 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6012 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6013 wmem_free(NULL((void*)0), derived_secret);
6014
6015 if (type == TLS_SECRET_HANDSHAKE) {
6016 label = is_from_server ? "s hs traffic" : "c hs traffic";
6017 } else {
6018 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6019 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6020 return NULL((void*)0);
6021
6022 /* PRK = Master Secret */
6023 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6024 wmem_free(NULL((void*)0), derived_secret);
6025
6026 label = is_from_server ? "s ap traffic" : "c ap traffic";
6027 }
6028 }
6029
6030 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6031 * support ECHO with psk_ke?) then we should use ech_transcript instead
6032 * of handshake_data. Perhaps we should consolidate some of that handling,
6033 * though note that we would have to keep both transcripts around after
6034 * the ClientHello until the ServerHello indicated whether ECHO was
6035 * accepted or not. */
6036 if (!tls13_derive_secret(hash_algo, &prk_string,
6037 tls13_hkdf_label_prefix(tls), label,
6038 tls->handshake_data.data, tls->handshake_data.data_len,
6039 dig->len, &derived_secret))
6040 return NULL((void*)0);
6041
6042 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6043 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6044 secret->data_len = dig->len;
6045 wmem_free(NULL((void*)0), derived_secret);
6046 return secret;
6047}
6048
6049/* Load the traffic key secret from the keylog file. */
6050StringInfo *
6051tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6052 bool_Bool is_from_server, TLSRecordType type)
6053{
6054 GHashTable *key_map;
6055 const char *label;
6056
6057 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6058 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6059 return NULL((void*)0);
6060 }
6061
6062 if (ssl->client_random.data_len == 0) {
6063 /* May happen if Hello message is missing and Finished is found. */
6064 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6065 return NULL((void*)0);
6066 }
6067
6068 switch (type) {
6069 case TLS_SECRET_0RTT_APP:
6070 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6070, "!is_from_server"))));
6071 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6072 key_map = mk_map->tls13_client_early;
6073 break;
6074 case TLS_SECRET_HANDSHAKE:
6075 if (is_from_server) {
6076 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6077 key_map = mk_map->tls13_server_handshake;
6078 } else {
6079 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6080 key_map = mk_map->tls13_client_handshake;
6081 }
6082 break;
6083 case TLS_SECRET_APP:
6084 if (is_from_server) {
6085 label = "SERVER_TRAFFIC_SECRET_0";
6086 key_map = mk_map->tls13_server_appdata;
6087 } else {
6088 label = "CLIENT_TRAFFIC_SECRET_0";
6089 key_map = mk_map->tls13_client_appdata;
6090 }
6091 break;
6092 default:
6093 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6093, __func__, "assertion \"not reached\" failed");
6094 }
6095
6096 /* Transitioning to new keys, mark old ones as unusable. */
6097 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6098 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6099
6100 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6101 if (!secret) {
6102 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6103 if (secret) {
6104 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6105 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6106 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6107 }
6108 }
6109 if (!secret) {
6110 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6111 /* Disable decryption, the keys are invalid. */
6112 if (is_from_server) {
6113 ssl->server = NULL((void*)0);
6114 } else {
6115 ssl->client = NULL((void*)0);
6116 }
6117 return NULL((void*)0);
6118 }
6119
6120 /* TLS 1.3 secret found, set new keys. */
6121 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6122 ssl_print_string("Client Random", &ssl->client_random);
6123 ssl_print_string(label, secret);
6124 return secret;
6125}
6126
6127/* Load the new key. */
6128void
6129tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6130 bool_Bool is_from_server, TLSRecordType type)
6131{
6132 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6133 /*
6134 * QUIC does not use the TLS record layer for message protection.
6135 * The required keys will be extracted later by QUIC.
6136 */
6137 return;
6138 }
6139
6140 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6141 if (!secret) {
6142 if (type != TLS_SECRET_HANDSHAKE) {
6143 return;
6144 }
6145 /*
6146 * Workaround for when for some reason we don't have the handshake
6147 * secret but do have the application traffic secret. (#20240)
6148 * If we can't find the handshake secret, we'll never decrypt the
6149 * Finished message, so we won't know when to change to the app
6150 * traffic key, so we do so now.
6151 */
6152 type = TLS_SECRET_APP;
6153 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6154 if (!secret) {
6155 return;
6156 }
6157 }
6158
6159 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6160 /*
6161 * Remember the application traffic secret to support Key Update. The
6162 * other secrets cannot be used for this purpose, so free them.
6163 */
6164 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6165 StringInfo *app_secret = &decoder->app_traffic_secret;
6166 if (type == TLS_SECRET_APP) {
6167 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6168 app_secret->data,
6169 secret->data_len);
6170 ssl_data_set(app_secret, secret->data, secret->data_len);
6171 } else {
6172 wmem_free(wmem_file_scope(), app_secret->data);
6173 app_secret->data = NULL((void*)0);
6174 app_secret->data_len = 0;
6175 }
6176 }
6177}
6178
6179/**
6180 * Update to next application data traffic secret for TLS 1.3. The previous
6181 * secret should have been set by tls13_change_key.
6182 */
6183void
6184tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6185{
6186 /* RFC 8446 Section 7.2:
6187 * application_traffic_secret_N+1 =
6188 * HKDF-Expand-Label(application_traffic_secret_N,
6189 * "traffic upd", "", Hash.length)
6190 *
6191 * Both application_traffic_secret_N are of the same length (Hash.length).
6192 */
6193 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6194 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6195 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6196 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6197
6198 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6199 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6200 return;
6201 }
6202
6203 /*
6204 * Previous traffic secret is available, so find the hash function,
6205 * expand the new traffic secret and generate new keys.
6206 */
6207 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6208 int hash_algo = ssl_get_digest_by_name(hash_name);
6209 const unsigned hash_len = app_secret->data_len;
6210 unsigned char *new_secret;
6211 const char *label = "traffic upd";
6212 if (tls13_draft_version && tls13_draft_version < 20) {
6213 label = "application traffic secret";
6214 }
6215 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6216 tls13_hkdf_label_prefix(ssl),
6217 label, hash_len, &new_secret)) {
6218 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6219 return;
6220 }
6221 ssl_data_set(app_secret, new_secret, hash_len);
6222 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6223 /*
6224 * Remember the application traffic secret on the new decoder to
6225 * support another Key Update.
6226 */
6227 decoder = is_from_server ? ssl->server : ssl->client;
6228 app_secret = &decoder->app_traffic_secret;
6229 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6230 app_secret->data,
6231 hash_len);
6232 ssl_data_set(app_secret, new_secret, hash_len);
6233 }
6234 wmem_free(NULL((void*)0), new_secret);
6235}
6236
6237void
6238tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6239{
6240 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6241 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6242 }
6243}
6244
6245/** SSL keylog file handling. {{{ */
6246
6247static GRegex *
6248ssl_compile_keyfile_regex(void)
6249{
6250#define OCTET "(?:[[:xdigit:]]{2})"
6251 const char *pattern =
6252 "(?:"
6253 /* Matches Client Hellos having this Client Random */
6254 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6255 /* Matches first part of encrypted RSA pre-master secret */
6256 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6257 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6258 but it can be of any length for DHE */
6259 ")(?<pms>" OCTET "+)"
6260 "|(?:"
6261 /* Matches Server Hellos having a Session ID */
6262 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6263 /* Matches Client Hellos having this Client Random */
6264 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6265 /* Master-Secret is given, its length is fixed */
6266 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6267 "|(?"
6268 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6269 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6270 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6271 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6272 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6273 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6274 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6275 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6276 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6277 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6278 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6279 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6280 ") (?<derived_secret>" OCTET "+)";
6281#undef OCTET
6282 static GRegex *regex = NULL((void*)0);
6283 GError *gerr = NULL((void*)0);
6284
6285 if (!regex) {
6286 regex = g_regex_new(pattern,
6287 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6288 G_REGEX_MATCH_ANCHORED, &gerr);
6289 if (gerr) {
6290 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6291 gerr->message);
6292 g_error_free(gerr);
6293 regex = NULL((void*)0);
6294 }
6295 }
6296
6297 return regex;
6298}
6299
6300typedef struct ssl_master_key_match_group {
6301 const char *re_group_name;
6302 GHashTable *master_key_ht;
6303} ssl_master_key_match_group_t;
6304
6305void
6306tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6307{
6308 ssl_master_key_match_group_t mk_groups[] = {
6309 { "encrypted_pmk", mk_map->pre_master },
6310 { "session_id", mk_map->session },
6311 { "client_random", mk_map->crandom },
6312 { "client_random_pms", mk_map->pms },
6313 /* TLS 1.3 map from Client Random to derived secret. */
6314 { "client_early", mk_map->tls13_client_early },
6315 { "client_handshake", mk_map->tls13_client_handshake },
6316 { "server_handshake", mk_map->tls13_server_handshake },
6317 { "client_appdata", mk_map->tls13_client_appdata },
6318 { "server_appdata", mk_map->tls13_server_appdata },
6319 { "early_exporter", mk_map->tls13_early_exporter },
6320 { "exporter", mk_map->tls13_exporter },
6321 { "ech_secret", mk_map->ech_secret },
6322 { "ech_config", mk_map->ech_config },
6323 };
6324
6325 /* The format of the file is a series of records with one of the following formats:
6326 * - "RSA xxxx yyyy"
6327 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6328 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6329 * (this is the original format introduced with bug 4349)
6330 *
6331 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6332 * Where xxxx is the SSL session ID (hex-encoded)
6333 * Where yyyy is the cleartext master secret (hex-encoded)
6334 * (added to support openssl s_client Master-Key output)
6335 * This is somewhat is a misnomer because there's nothing RSA specific
6336 * about this.
6337 *
6338 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6339 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6340 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6341 * (This format allows SSL connections to be decrypted, if a user can
6342 * capture the PMS but could not recover the MS for a specific session
6343 * with a SSL Server.)
6344 *
6345 * - "CLIENT_RANDOM xxxx yyyy"
6346 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6347 * Where yyyy is the cleartext master secret (hex-encoded)
6348 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6349 * ECDHE-RSA.)
6350 *
6351 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6352 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6353 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6354 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6355 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6356 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6357 * - "EXPORTER_SECRET xxxx yyyy"
6358 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6359 * Where yyyy is the secret (hex-encoded) derived from the early,
6360 * handshake or master secrets. (This format is introduced with TLS 1.3
6361 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6362 */
6363 GRegex *regex = ssl_compile_keyfile_regex();
6364 if (!regex)
6365 return;
6366
6367 const char *next_line = (const char *)data;
6368 const char *line_end = next_line + datalen;
6369 while (next_line && next_line < line_end) {
6370 const char *line = next_line;
6371 next_line = (const char *)memchr(line, '\n', line_end - line);
6372 ssize_t linelen;
6373
6374 if (next_line) {
6375 linelen = next_line - line;
6376 next_line++; /* drop LF */
6377 } else {
6378 linelen = (ssize_t)(line_end - line);
6379 }
6380 if (linelen > 0 && line[linelen - 1] == '\r') {
6381 linelen--; /* drop CR */
6382 }
6383
6384 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6385 GMatchInfo *mi;
6386 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6387 char *hex_key, *hex_pre_ms_or_ms;
6388 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6389 StringInfo *pre_ms_or_ms = NULL((void*)0);
6390 GHashTable *ht = NULL((void*)0);
6391
6392 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6393 * otherwise we will use the Master Secret
6394 */
6395 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6396 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6397 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6398 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6399 }
6400 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6401 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6402 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6403 }
6404 /* There is always a match, otherwise the regex is wrong. */
6405 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6405, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6406
6407 /* convert from hex to bytes and save to hashtable */
6408 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6409 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6410 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6411
6412 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6413 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6414 ssl_master_key_match_group_t *g = &mk_groups[i];
6415 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6416 if (hex_key && *hex_key) {
6417 ssl_debug_printf(" matched %s\n", g->re_group_name);
6418 ht = g->master_key_ht;
6419 from_hex(key, hex_key, strlen(hex_key));
6420 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6421 break;
6422 }
6423 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6424 }
6425 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6425, "ht")))); /* Cannot be reached, or regex is wrong. */
6426
6427 g_hash_table_insert(ht, key, pre_ms_or_ms);
6428
6429 } else if (linelen > 0 && line[0] != '#') {
6430 ssl_debug_printf(" unrecognized line\n");
6431 }
6432 /* always free match info even if there is no match. */
6433 g_match_info_free(mi);
6434 }
6435}
6436
6437void
6438ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6439 const ssl_master_key_map_t *mk_map)
6440{
6441 /* no need to try if no key log file is configured. */
6442 if (!tls_keylog_filename || !*tls_keylog_filename) {
6443 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6444 G_STRFUNC((const char*) (__func__)));
6445 return;
6446 }
6447
6448 /* Validate regexes before even trying to use it. */
6449 if (!ssl_compile_keyfile_regex()) {
6450 return;
6451 }
6452
6453 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6454
6455 /* if the keylog file was deleted/overwritten, re-open it */
6456 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6457 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6458 fclose(*keylog_file);
6459 *keylog_file = NULL((void*)0);
6460 }
6461
6462 if (*keylog_file == NULL((void*)0)) {
6463 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6464 if (!*keylog_file) {
6465 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6466 return;
6467 }
6468 }
6469
6470 for (;;) {
6471 char buf[1110], *line;
6472 line = fgets(buf, sizeof(buf), *keylog_file);
6473 if (!line) {
6474 if (feof(*keylog_file)) {
6475 /* Ensure that newly appended keys can be read in the future. */
6476 clearerr(*keylog_file);
6477 } else if (ferror(*keylog_file)) {
6478 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6479 fclose(*keylog_file);
6480 *keylog_file = NULL((void*)0);
6481 }
6482 break;
6483 }
6484 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6485 }
6486}
6487/** SSL keylog file handling. }}} */
6488
6489#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6490
6491static FILE* ssl_debug_file;
6492
6493void
6494ssl_set_debug(const char* name)
6495{
6496 static int debug_file_must_be_closed;
6497 int use_stderr;
6498
6499 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6500
6501 if (debug_file_must_be_closed)
6502 fclose(ssl_debug_file);
6503
6504 if (use_stderr)
6505 ssl_debug_file = stderrstderr;
6506 else if (!name || (strcmp(name, "") ==0))
6507 ssl_debug_file = NULL((void*)0);
6508 else
6509 ssl_debug_file = ws_fopenfopen(name, "w");
6510
6511 if (!use_stderr && ssl_debug_file)
6512 debug_file_must_be_closed = 1;
6513 else
6514 debug_file_must_be_closed = 0;
6515
6516 ssl_debug_printf("Wireshark SSL debug log \n\n");
6517#ifdef HAVE_LIBGNUTLS1
6518 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6519#endif
6520 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6521 ssl_debug_printf("\n");
6522}
6523
6524void
6525ssl_debug_flush(void)
6526{
6527 if (ssl_debug_file)
6528 fflush(ssl_debug_file);
6529}
6530
6531void
6532ssl_debug_printf(const char* fmt, ...)
6533{
6534 va_list ap;
6535
6536 if (!ssl_debug_file)
6537 return;
6538
6539 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6540 vfprintf(ssl_debug_file, fmt, ap);
6541 va_end(ap)__builtin_va_end(ap);
6542}
6543
6544void
6545ssl_print_data(const char* name, const unsigned char* data, size_t len)
6546{
6547 size_t i, j, k;
6548 if (!ssl_debug_file)
6549 return;
6550 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6551 for (i=0; i<len; i+=16) {
6552 fprintf(ssl_debug_file,"| ");
6553 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6554 fprintf(ssl_debug_file,"%.2x ",data[j]);
6555 for (; k<16; ++k)
6556 fprintf(ssl_debug_file," ");
6557 fputc('|', ssl_debug_file);
6558 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6559 unsigned char c = data[j];
6560 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6561 fputc(c, ssl_debug_file);
6562 }
6563 for (; k<16; ++k)
6564 fputc(' ', ssl_debug_file);
6565 fprintf(ssl_debug_file,"|\n");
6566 }
6567}
6568
6569void
6570ssl_print_string(const char* name, const StringInfo* data)
6571{
6572 ssl_print_data(name, data->data, data->data_len);
6573}
6574#endif /* SSL_DECRYPT_DEBUG }}} */
6575
6576/* UAT preferences callbacks. {{{ */
6577/* checks for SSL and DTLS UAT key list fields */
6578
6579bool_Bool
6580ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6581{
6582 // This should be removed in favor of Decode As. Make it optional.
6583 *err = NULL((void*)0);
6584 return true1;
6585}
6586
6587bool_Bool
6588ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6589{
6590 if (!p || strlen(p) == 0u) {
6591 // This should be removed in favor of Decode As. Make it optional.
6592 *err = NULL((void*)0);
6593 return true1;
6594 }
6595
6596 if (strcmp(p, "start_tls") != 0){
6597 uint16_t port;
6598 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6599 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6600 return false0;
6601 }
6602 }
6603
6604 *err = NULL((void*)0);
6605 return true1;
6606}
6607
6608bool_Bool
6609ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6610{
6611 ws_statb64struct stat st;
6612
6613 if (!p || strlen(p) == 0u) {
6614 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6615 return false0;
6616 } else {
6617 if (ws_stat64stat(p, &st) != 0) {
6618 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6619 return false0;
6620 }
6621 }
6622
6623 *err = NULL((void*)0);
6624 return true1;
6625}
6626
6627bool_Bool
6628ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6629{
6630#if defined(HAVE_LIBGNUTLS1)
6631 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6632 FILE *fp = NULL((void*)0);
6633
6634 if (p && (strlen(p) > 0u)) {
6635 fp = ws_fopenfopen(f->keyfile, "rb");
6636 if (fp) {
6637 char *msg = NULL((void*)0);
6638 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6639 if (!priv_key) {
6640 fclose(fp);
6641 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6642 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6643 return false0;
6644 }
6645 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6646 gnutls_x509_privkey_deinit(priv_key);
6647 fclose(fp);
6648 } else {
6649 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6650 return false0;
6651 }
6652 }
6653
6654 *err = NULL((void*)0);
6655 return true1;
6656#else
6657 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6658 return false0;
6659#endif
6660}
6661/* UAT preferences callbacks. }}} */
6662
6663/** maximum size of ssl_association_info() string */
6664#define SSL_ASSOC_MAX_LEN8192 8192
6665
6666typedef struct ssl_association_info_callback_data
6667{
6668 char *str;
6669 const char *table_protocol;
6670} ssl_association_info_callback_data_t;
6671
6672/**
6673 * callback function used by ssl_association_info() to traverse the SSL associations.
6674 */
6675static void
6676ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6677{
6678 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6679 const int l = (const int)strlen(data->str);
6680 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6681}
6682
6683/**
6684 * @return an information string on the SSL protocol associations. The string must be freed.
6685 */
6686char*
6687ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6688{
6689 ssl_association_info_callback_data_t data;
6690
6691 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6692 data.table_protocol = table_protocol;
6693 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6694 return data.str;
6695}
6696
6697
6698/** Begin of code related to dissection of wire data. */
6699
6700/* Helpers for dissecting Variable-Length Vectors. {{{ */
6701bool_Bool
6702ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6703 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6704 int hf_length, uint32_t min_value, uint32_t max_value)
6705{
6706 unsigned veclen_size;
6707 uint32_t veclen_value;
6708 proto_item *pi;
6709
6710 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6710, (uint64_t)min_value, (uint64_t)max_value))));
6711 if (offset > offset_end) {
6712 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6713 "Vector offset is past buffer end offset (%u > %u)",
6714 offset, offset_end);
6715 *ret_length = 0;
6716 return false0; /* Cannot read length. */
6717 }
6718
6719 if (max_value > 0xffffff) {
6720 veclen_size = 4;
6721 } else if (max_value > 0xffff) {
6722 veclen_size = 3;
6723 } else if (max_value > 0xff) {
6724 veclen_size = 2;
6725 } else {
6726 veclen_size = 1;
6727 }
6728
6729 if (offset_end - offset < veclen_size) {
6730 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6731 tvb, offset, offset_end - offset,
6732 "No more room for vector of length %u",
6733 veclen_size);
6734 *ret_length = 0;
6735 return false0; /* Cannot read length. */
6736 }
6737
6738 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6739 offset += veclen_size;
6740
6741 if (veclen_value < min_value) {
6742 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6743 "Vector length %u is smaller than minimum %u",
6744 veclen_value, min_value);
6745 } else if (veclen_value > max_value) {
6746 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6747 "Vector length %u is larger than maximum %u",
6748 veclen_value, max_value);
6749 }
6750
6751 if (offset_end - offset < veclen_value) {
6752 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
6753 "Vector length %u is too large, truncating it to %u",
6754 veclen_value, offset_end - offset);
6755 *ret_length = offset_end - offset;
6756 return false0; /* Length is truncated to avoid overflow. */
6757 }
6758
6759 *ret_length = veclen_value;
6760 return true1; /* Length is OK. */
6761}
6762
6763bool_Bool
6764ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6765 unsigned offset, unsigned offset_end)
6766{
6767 if (offset < offset_end) {
6768 unsigned trailing = offset_end - offset;
6769 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
6770 tvb, offset, trailing,
6771 "%u trailing byte%s unprocessed",
6772 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
6773 return false0; /* unprocessed data warning */
6774 } else if (offset > offset_end) {
6775 /*
6776 * Returned offset runs past the end. This should not happen and is
6777 * possibly a dissector bug.
6778 */
6779 unsigned excess = offset - offset_end;
6780 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6781 tvb, offset_end, excess,
6782 "Dissector processed too much data (%u byte%s)",
6783 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
6784 return false0; /* overflow error */
6785 }
6786
6787 return true1; /* OK, offset matches. */
6788}
6789/** }}} */
6790
6791
6792static uint32_t
6793ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6794 proto_tree *tree, uint32_t offset, uint32_t offset_end,
6795 uint16_t version, int hf_sig_len, int hf_sig);
6796
6797/* change_cipher_spec(20) dissection */
6798void
6799ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
6800 packet_info *pinfo, proto_tree *tree,
6801 uint32_t offset, SslSession *session,
6802 bool_Bool is_from_server,
6803 const SslDecryptSession *ssl)
6804{
6805 /*
6806 * struct {
6807 * enum { change_cipher_spec(1), (255) } type;
6808 * } ChangeCipherSpec;
6809 */
6810 proto_item *ti;
6811 proto_item_set_text(tree,
6812 "%s Record Layer: %s Protocol: Change Cipher Spec",
6813 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
6814 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
6815 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
6816
6817 if (session->version == TLSV1DOT3_VERSION0x304) {
6818 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
6819 return;
6820 }
6821
6822 /* Remember frame number of first CCS */
6823 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
6824 if (*ccs_frame == 0)
6825 *ccs_frame = pinfo->num;
6826
6827 /* Use heuristics to detect an abbreviated handshake, assume that missing
6828 * ServerHelloDone implies reusing previously negotiating keys. Then when
6829 * a Session ID or ticket is present, it must be a resumed session.
6830 * Normally this should be done at the Finished message, but that may be
6831 * encrypted so we do it here, at the last cleartext message. */
6832 if (is_from_server && ssl) {
6833 if (session->is_session_resumed) {
6834 const char *resumed = NULL((void*)0);
6835 if (ssl->session_ticket.data_len) {
6836 resumed = "Session Ticket";
6837 } else if (ssl->session_id.data_len) {
6838 resumed = "Session ID";
6839 }
6840 if (resumed) {
6841 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
6842 } else {
6843 /* Can happen if the capture somehow starts in the middle */
6844 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
6845 }
6846 } else {
6847 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
6848 }
6849 }
6850 if (is_from_server && session->is_session_resumed)
6851 expert_add_info(pinfo, ti, &hf->ei.resumed);
6852}
6853
6854/** Begin of handshake(22) record dissections */
6855
6856/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
6857 * {{{ */
6858static void
6859tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
6860{
6861 uint32_t sighash, hashalg, sigalg;
6862 proto_item *ti_sigalg;
6863 proto_tree *sigalg_tree;
6864
6865 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
6866 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
6867 if (ja4_data) {
6868 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
6869 }
6870
6871 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
6872
6873 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
6874 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
6875 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
6876 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
6877 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
6878
6879 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
6880 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
6881 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
6882 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
6883 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
6884 sighash);
6885 }
6886} /* }}} */
6887
6888/* dissect a list of hash algorithms, return the number of bytes dissected
6889 this is used for the signature algorithms extension and for the
6890 TLS1.2 certificate request. {{{ */
6891static int
6892ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
6893 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
6894{
6895 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
6896 * struct {
6897 * HashAlgorithm hash;
6898 * SignatureAlgorithm signature;
6899 * } SignatureAndHashAlgorithm;
6900 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
6901 */
6902 proto_tree *subtree;
6903 proto_item *ti;
6904 unsigned sh_alg_length;
6905 uint32_t next_offset;
6906
6907 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
6908 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
6909 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
6910 return offset_end;
6911 }
6912 offset += 2;
6913 next_offset = offset + sh_alg_length;
6914
6915 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
6916 "Signature Hash Algorithms (%u algorithm%s)",
6917 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
6918 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
6919
6920 while (offset + 2 <= next_offset) {
6921 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
6922 offset += 2;
6923 }
6924
6925 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
6926 offset = next_offset;
6927 }
6928
6929 return offset;
6930} /* }}} */
6931
6932/* Dissection of DistinguishedName (for CertificateRequest and
6933 * certificate_authorities extension). {{{ */
6934static uint32_t
6935tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6936 proto_tree *tree, uint32_t offset, uint32_t offset_end)
6937{
6938 proto_item *ti;
6939 proto_tree *subtree;
6940 uint32_t dnames_length, next_offset;
6941 asn1_ctx_t asn1_ctx;
6942 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
6943
6944 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
6945 /* DistinguishedName certificate_authorities<0..2^16-1> */
6946 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
6947 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
6948 return offset_end;
6949 }
6950 offset += 2;
6951 next_offset = offset + dnames_length;
6952
6953 if (dnames_length > 0) {
6954 ti = proto_tree_add_none_format(tree,
6955 hf->hf.hs_dnames,
6956 tvb, offset, dnames_length,
6957 "Distinguished Names (%d byte%s)",
6958 dnames_length,
6959 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
6960 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
6961
6962 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
6963
6964 while (offset < next_offset) {
6965 /* get the length of the current certificate */
6966 uint32_t name_length;
6967
6968 if (dnames_count-- == 0) {
6969 /* stop adding to tree when the list is considered too large
6970 * https://gitlab.com/wireshark/wireshark/-/issues/16202
6971 Note: dnames_count must be set low enough not to hit the
6972 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
6973 */
6974 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
6975 tvb, offset, next_offset - offset, ENC_NA0x00000000);
6976 proto_item_set_generated(ti);
6977 return next_offset;
6978 }
6979
6980 /* opaque DistinguishedName<1..2^16-1> */
6981 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
6982 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
6983 return next_offset;
6984 }
6985 offset += 2;
6986
6987 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
6988 subtree, hf->hf.hs_dname);
6989 offset += name_length;
6990 }
6991 }
6992 return offset;
6993} /* }}} */
6994
6995
6996/** TLS Extensions (in Client Hello and Server Hello). {{{ */
6997static int
6998ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
6999 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7000{
7001 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7002}
7003
7004static int
7005ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7006 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7007{
7008 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7009 hnd_type == SSL_HND_CERT_REQUEST) {
7010 /*
7011 * struct {
7012 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7013 * } SignatureSchemeList;
7014 */
7015
7016 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7017 } else {
7018 asn1_ctx_t asn1_ctx;
7019 unsigned pubkey_length, sign_length;
7020
7021 /*
7022 * struct {
7023 * uint32 valid_time;
7024 * SignatureScheme expected_cert_verify_algorithm;
7025 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7026 * } Credential;
7027 *
7028 * struct {
7029 * Credential cred;
7030 * SignatureScheme algorithm;
7031 * opaque signature<0..2^16-1>;
7032 * } DelegatedCredential;
7033 */
7034
7035 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7036
7037 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7038 offset += 4;
7039
7040 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7041 offset += 2;
7042
7043 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7044 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7045 return offset_end;
7046 }
7047 offset += 3;
7048 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7049 offset += pubkey_length;
7050
7051 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7052 offset += 2;
7053
7054 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7055 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7056 return offset_end;
7057 }
7058 offset += 2;
7059 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7060 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7061 offset += sign_length;
7062
7063 return offset;
7064 }
7065}
7066
7067static int
7068ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7069 packet_info *pinfo, proto_tree *tree,
7070 uint32_t offset, uint32_t offset_end,
7071 uint8_t hnd_type)
7072{
7073
7074 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7075
7076 switch (hnd_type) {
7077 case SSL_HND_CLIENT_HELLO: {
7078 proto_tree *alps_tree;
7079 proto_item *ti;
7080 uint32_t next_offset, alps_length, name_length;
7081
7082 /*
7083 * opaque ProtocolName<1..2^8-1>;
7084 * struct {
7085 * ProtocolName supported_protocols<2..2^16-1>
7086 * } ApplicationSettingsSupport;
7087 */
7088
7089 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7090 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7091 return offset_end;
7092 }
7093 offset += 2;
7094 next_offset = offset + alps_length;
7095
7096 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7097 tvb, offset, alps_length, ENC_NA0x00000000);
7098 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7099
7100 /* Parse list (note missing check for end of vector, ssl_add_vector below
7101 * ensures that data is always available.) */
7102 while (offset < next_offset) {
7103 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7104 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7105 return next_offset;
7106 }
7107 offset++;
7108
7109 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7110 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7111 offset += name_length;
7112 }
7113
7114 return offset;
7115 }
7116 case SSL_HND_ENCRYPTED_EXTS:
7117 /* Opaque blob */
7118 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7119 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7120 break;
7121 }
7122
7123 return offset_end;
7124}
7125
7126static int
7127ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7128 packet_info *pinfo, proto_tree *tree,
7129 uint32_t offset, uint32_t offset_end,
7130 uint8_t hnd_type, SslSession *session,
7131 bool_Bool is_dtls, ja4_data_t *ja4_data)
7132{
7133
7134 /* https://tools.ietf.org/html/rfc7301#section-3.1
7135 * opaque ProtocolName<1..2^8-1>;
7136 * struct {
7137 * ProtocolName protocol_name_list<2..2^16-1>
7138 * } ProtocolNameList;
7139 */
7140 proto_tree *alpn_tree;
7141 proto_item *ti;
7142 uint32_t next_offset, alpn_length, name_length;
7143 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7144
7145 /* ProtocolName protocol_name_list<2..2^16-1> */
7146 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7147 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7148 return offset_end;
7149 }
7150 offset += 2;
7151 next_offset = offset + alpn_length;
7152
7153 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7154 tvb, offset, alpn_length, ENC_NA0x00000000);
7155 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7156
7157 /* Parse list (note missing check for end of vector, ssl_add_vector below
7158 * ensures that data is always available.) */
7159 while (offset < next_offset) {
7160 /* opaque ProtocolName<1..2^8-1> */
7161 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7162 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7163 return next_offset;
7164 }
7165 offset++;
7166
7167 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7168 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7169 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7170 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7171 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7172 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7173 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7174 }
7175 else {
7176 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7177 alpn_last_char & 0x0F);
7178 }
7179 }
7180 /* Remember first ALPN ProtocolName entry for server. */
7181 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7182 /* '\0'-terminated string for dissector table match and prefix
7183 * comparison purposes. */
7184 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7185 name_length, ENC_ASCII0x00000000);
7186 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7187 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7188 name_length, ENC_ASCII0x00000000);
7189 }
7190 offset += name_length;
7191 }
7192
7193 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7194 * exactly one "ProtocolName". */
7195 if (proto_name) {
7196 dissector_handle_t handle;
7197
7198 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7199
7200 if (is_dtls) {
7201 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7202 proto_name);
7203 } else {
7204 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7205 proto_name);
7206 if (handle == NULL((void*)0)) {
7207 /* Try prefix matching */
7208 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7209 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7210
7211 /* string_string is inappropriate as it compares strings
7212 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7213 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7214 handle = find_dissector(alpn_proto->dissector_name);
7215 break;
7216 }
7217 }
7218 }
7219 }
7220 if (handle != NULL((void*)0)) {
7221 /* ProtocolName match, so set the App data dissector handle.
7222 * This may override protocols given via the UAT dialog, but
7223 * since the ALPN hint is precise, do it anyway. */
7224 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7225 (void *)session->app_handle,
7226 (void *)handle,
7227 dissector_handle_get_dissector_name(handle));
7228 session->app_handle = handle;
7229 }
7230 } else if (client_proto_name) {
7231 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7232 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7233 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7234 }
7235
7236 return offset;
7237}
7238
7239static int
7240ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7241 packet_info *pinfo, proto_tree *tree,
7242 uint32_t offset, uint32_t offset_end)
7243{
7244 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7245 * The "extension_data" field of a "next_protocol_negotiation" extension
7246 * in a "ServerHello" contains an optional list of protocols advertised
7247 * by the server. Protocols are named by opaque, non-empty byte strings
7248 * and the list of protocols is serialized as a concatenation of 8-bit,
7249 * length prefixed byte strings. Implementations MUST ensure that the
7250 * empty string is not included and that no byte strings are truncated.
7251 */
7252 uint32_t npn_length;
7253 proto_tree *npn_tree;
7254
7255 /* List is optional, do not add tree if there are no entries. */
7256 if (offset == offset_end) {
7257 return offset;
7258 }
7259
7260 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7261
7262 while (offset < offset_end) {
7263 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7264 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7265 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7266 return offset_end;
7267 }
7268 offset++;
7269
7270 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7271 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7272 offset += npn_length;
7273 }
7274
7275 return offset;
7276}
7277
7278static int
7279ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7280 packet_info *pinfo, proto_tree *tree,
7281 uint32_t offset, uint32_t offset_end)
7282{
7283 /* https://tools.ietf.org/html/rfc5746#section-3.2
7284 * struct {
7285 * opaque renegotiated_connection<0..255>;
7286 * } RenegotiationInfo;
7287 *
7288 */
7289 proto_tree *reneg_info_tree;
7290 uint32_t reneg_info_length;
7291
7292 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7293
7294 /* opaque renegotiated_connection<0..255> */
7295 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7296 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7297 return offset_end;
7298 }
7299 offset++;
7300
7301 if (reneg_info_length > 0) {
7302 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7303 offset += reneg_info_length;
7304 }
7305
7306 return offset;
7307}
7308
7309static int
7310ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7311 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7312 const char **group_name_out)
7313{
7314 /* RFC 8446 Section 4.2.8
7315 * struct {
7316 * NamedGroup group;
7317 * opaque key_exchange<1..2^16-1>;
7318 * } KeyShareEntry;
7319 */
7320 uint32_t key_exchange_length, group;
7321 proto_tree *ks_tree;
7322
7323 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7324
7325 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7326 offset += 2;
7327 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7328 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7329 if (group_name_out) {
7330 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7331 }
7332
7333 /* opaque key_exchange<1..2^16-1> */
7334 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7335 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7336 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7337 }
7338 offset += 2;
7339 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7340 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7341
7342 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7343 offset += key_exchange_length;
7344
7345 return offset;
7346}
7347
7348static int
7349ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7350 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7351 uint8_t hnd_type, SslDecryptSession *ssl)
7352{
7353 proto_tree *key_share_tree;
7354 uint32_t next_offset;
7355 uint32_t client_shares_length;
7356 uint32_t group;
7357 const char *group_name = NULL((void*)0);
7358
7359 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7360 return offset;
7361 }
7362
7363 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7364
7365 switch(hnd_type){
7366 case SSL_HND_CLIENT_HELLO:
7367 /* KeyShareEntry client_shares<0..2^16-1> */
7368 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7369 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7370 return offset_end;
7371 }
7372 offset += 2;
7373 next_offset = offset + client_shares_length;
7374 const char *sep = " ";
7375 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7376 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7377 if (group_name) {
7378 proto_item_append_text(tree, "%s%s", sep, group_name);
7379 sep = ", ";
7380 }
7381 }
7382 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7383 return next_offset;
7384 }
7385 break;
7386 case SSL_HND_SERVER_HELLO:
7387 if (ssl) {
7388 ssl->has_key_share = true1;
7389 }
7390 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7391 if (group_name) {
7392 proto_item_append_text(tree, " %s", group_name);
7393 }
7394 break;
7395 case SSL_HND_HELLO_RETRY_REQUEST:
7396 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7397 offset += 2;
7398 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7399 proto_item_append_text(tree, " %s", group_name);
7400 break;
7401 default: /* no default */
7402 break;
7403 }
7404
7405 return offset;
7406}
7407
7408static int
7409ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7410 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7411 uint8_t hnd_type, SslDecryptSession *ssl)
7412{
7413 /* RFC 8446 Section 4.2.11
7414 * struct {
7415 * opaque identity<1..2^16-1>;
7416 * uint32 obfuscated_ticket_age;
7417 * } PskIdentity;
7418 * opaque PskBinderEntry<32..255>;
7419 * struct {
7420 * select (Handshake.msg_type) {
7421 * case client_hello:
7422 * PskIdentity identities<7..2^16-1>;
7423 * PskBinderEntry binders<33..2^16-1>;
7424 * case server_hello:
7425 * uint16 selected_identity;
7426 * };
7427 * } PreSharedKeyExtension;
7428 */
7429
7430 proto_tree *psk_tree;
7431
7432 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7433
7434 switch (hnd_type){
7435 case SSL_HND_CLIENT_HELLO: {
7436 uint32_t identities_length, identities_end, binders_length;
7437
7438 /* PskIdentity identities<7..2^16-1> */
7439 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7440 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7441 return offset_end;
7442 }
7443 offset += 2;
7444 identities_end = offset + identities_length;
7445
7446 while (offset < identities_end) {
7447 uint32_t identity_length;
7448 proto_tree *identity_tree;
7449
7450 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7451
7452 /* opaque identity<1..2^16-1> */
7453 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7454 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7455 return identities_end;
7456 }
7457 offset += 2;
7458 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7459
7460 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7461 offset += identity_length;
7462
7463 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7464 offset += 4;
7465
7466 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7467 }
7468 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7469 offset = identities_end;
7470 }
7471
7472 /* PskBinderEntry binders<33..2^16-1> */
7473 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7474 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7475 return offset_end;
7476 }
7477 offset += 2;
7478
7479 proto_item *binders_item;
7480 proto_tree *binders_tree;
7481 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7482 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7483 uint32_t binders_end = offset + binders_length;
7484 while (offset < binders_end) {
7485 uint32_t binder_length;
7486 proto_item *binder_item;
7487 proto_tree *binder_tree;
7488
7489 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7490 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7491
7492 /* opaque PskBinderEntry<32..255>; */
7493 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7494 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7495 return binders_end;
7496 }
7497 offset += 1;
7498 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7499
7500 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7501 offset += binder_length;
7502
7503 proto_item_set_end(binder_item, tvb, offset);
7504 }
7505 }
7506 break;
7507 case SSL_HND_SERVER_HELLO: {
7508 if (ssl) {
7509 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7510 ssl->has_psk = true1;
7511 }
7512 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7513 offset += 2;
7514 }
7515 break;
7516 default:
7517 break;
7518 }
7519
7520 return offset;
7521}
7522
7523static uint32_t
7524ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7525 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7526 uint8_t hnd_type, SslDecryptSession *ssl)
7527{
7528 /* RFC 8446 Section 4.2.10
7529 * struct {} Empty;
7530 * struct {
7531 * select (Handshake.msg_type) {
7532 * case new_session_ticket: uint32 max_early_data_size;
7533 * case client_hello: Empty;
7534 * case encrypted_extensions: Empty;
7535 * };
7536 * } EarlyDataIndication;
7537 */
7538 switch (hnd_type) {
7539 case SSL_HND_CLIENT_HELLO:
7540 /* Remember that early_data will follow the handshake. */
7541 if (ssl) {
7542 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7543 ssl->has_early_data = true1;
7544 }
7545 break;
7546 case SSL_HND_NEWSESSION_TICKET:
7547 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7548 offset += 4;
7549 break;
7550 default:
7551 break;
7552 }
7553 return offset;
7554}
7555
7556static uint16_t
7557tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7558{
7559 if (draft_version) {
7560 *draft_version = 0;
7561 }
7562 if (!is_dtls) {
7563 uint8_t tls13_draft = extract_tls13_draft_version(version);
7564 if (tls13_draft != 0) {
7565 /* This is TLS 1.3 (a draft version). */
7566 if (draft_version) {
7567 *draft_version = tls13_draft;
7568 }
7569 version = TLSV1DOT3_VERSION0x304;
7570 }
7571 if (version == 0xfb17 || version == 0xfb1a) {
7572 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7573 tls13_draft = (uint8_t)version;
7574 if (draft_version) {
7575 *draft_version = tls13_draft;
7576 }
7577 version = TLSV1DOT3_VERSION0x304;
7578 }
7579 }
7580
7581 switch (version) {
7582 case SSLV3_VERSION0x300:
7583 case TLSV1_VERSION0x301:
7584 case TLSV1DOT1_VERSION0x302:
7585 case TLSV1DOT2_VERSION0x303:
7586 case TLSV1DOT3_VERSION0x304:
7587 case TLCPV1_VERSION0x101:
7588 if (is_dtls)
7589 return SSL_VER_UNKNOWN0;
7590 break;
7591
7592 case DTLSV1DOT0_VERSION0xfeff:
7593 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7594 case DTLSV1DOT2_VERSION0xfefd:
7595 case DTLSV1DOT3_VERSION0xfefc:
7596 if (!is_dtls)
7597 return SSL_VER_UNKNOWN0;
7598 break;
7599
7600 default: /* invalid version number */
7601 return SSL_VER_UNKNOWN0;
7602 }
7603
7604 return version;
7605}
7606
7607static int
7608ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7609 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7610 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7611{
7612
7613 /* RFC 8446 Section 4.2.1
7614 * struct {
7615 * ProtocolVersion versions<2..254>; // ClientHello
7616 * } SupportedVersions;
7617 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7618 */
7619 uint32_t versions_length, next_offset;
7620 /* ProtocolVersion versions<2..254> */
7621 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7622 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7623 return offset_end;
7624 }
7625 offset++;
7626 next_offset = offset + versions_length;
7627
7628 unsigned version;
7629 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7630 uint8_t draft_version, max_draft_version = 0;
7631 const char *sep = " ";
7632 while (offset + 2 <= next_offset) {
7633 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7634 offset += 2;
7635
7636 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7637 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7638 sep = ", ";
7639 }
7640
7641 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7642 if (session->version == SSL_VER_UNKNOWN0) {
7643 if (lowest_version == SSL_VER_UNKNOWN0) {
7644 lowest_version = current_version;
7645 } else if (current_version != SSL_VER_UNKNOWN0) {
7646 if (!is_dtls) {
7647 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7648 } else {
7649 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7650 }
7651 }
7652 }
7653 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7654 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7655 /* The DTLS version numbers get mapped to "00" for unknown per
7656 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7657 * need to take the MIN instead of MAX here for DTLS.
7658 */
7659 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7660 }
7661 }
7662 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7663 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7664 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7665 }
7666 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7667 offset = next_offset;
7668 }
7669
7670 /* XXX remove this when draft 19 support is dropped,
7671 * this is only required for early data decryption. */
7672 if (max_draft_version) {
7673 session->tls13_draft_version = max_draft_version;
7674 }
7675
7676 return offset;
7677}
7678
7679static int
7680ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7681 packet_info *pinfo, proto_tree *tree,
7682 uint32_t offset, uint32_t offset_end)
7683{
7684 /* RFC 8446 Section 4.2.2
7685 * struct {
7686 * opaque cookie<1..2^16-1>;
7687 * } Cookie;
7688 */
7689 uint32_t cookie_length;
7690 /* opaque cookie<1..2^16-1> */
7691 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7692 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7693 return offset_end;
7694 }
7695 offset += 2;
7696
7697 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7698 offset += cookie_length;
7699
7700 return offset;
7701}
7702
7703static int
7704ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7705 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7706{
7707 /* RFC 8446 Section 4.2.9
7708 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7709 *
7710 * struct {
7711 * PskKeyExchangeMode ke_modes<1..255>;
7712 * } PskKeyExchangeModes;
7713 */
7714 uint32_t ke_modes_length, next_offset;
7715
7716 /* PskKeyExchangeMode ke_modes<1..255> */
7717 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7718 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7719 return offset_end;
7720 }
7721 offset++;
7722 next_offset = offset + ke_modes_length;
7723
7724 while (offset < next_offset) {
7725 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7726 offset++;
7727 }
7728
7729 return offset;
7730}
7731
7732static uint32_t
7733ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7734 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7735{
7736 /* RFC 8446 Section 4.2.4
7737 * opaque DistinguishedName<1..2^16-1>;
7738 * struct {
7739 * DistinguishedName authorities<3..2^16-1>;
7740 * } CertificateAuthoritiesExtension;
7741 */
7742 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7743}
7744
7745static int
7746ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7747 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7748{
7749 /* RFC 8446 Section 4.2.5
7750 * struct {
7751 * opaque certificate_extension_oid<1..2^8-1>;
7752 * opaque certificate_extension_values<0..2^16-1>;
7753 * } OIDFilter;
7754 * struct {
7755 * OIDFilter filters<0..2^16-1>;
7756 * } OIDFilterExtension;
7757 */
7758 proto_tree *subtree;
7759 uint32_t filters_length, oid_length, values_length, value_offset;
7760 asn1_ctx_t asn1_ctx;
7761 const char *oid, *name;
7762
7763 /* OIDFilter filters<0..2^16-1> */
7764 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
7765 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
7766 return offset_end;
7767 }
7768 offset += 2;
7769 offset_end = offset + filters_length;
7770
7771 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7772
7773 while (offset < offset_end) {
7774 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
7775 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
7776
7777 /* opaque certificate_extension_oid<1..2^8-1> */
7778 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
7779 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
7780 return offset_end;
7781 }
7782 offset++;
7783 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
7784 hf->hf.hs_ext_oid_filters_oid, &oid);
7785 offset += oid_length;
7786
7787 /* Append OID to tree label */
7788 name = oid_resolved_from_string(pinfo->pool, oid);
7789 proto_item_append_text(subtree, " (%s)", name ? name : oid);
7790
7791 /* opaque certificate_extension_values<0..2^16-1> */
7792 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
7793 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
7794 return offset_end;
7795 }
7796 offset += 2;
7797 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
7798 if (values_length > 0) {
7799 value_offset = offset;
7800 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
7801 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
7802 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
7803 }
7804 offset += values_length;
7805 }
7806
7807 return offset;
7808}
7809
7810static int
7811ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7812 packet_info *pinfo, proto_tree *tree,
7813 uint32_t offset, uint32_t offset_end)
7814{
7815 /* https://tools.ietf.org/html/rfc6066#section-3
7816 *
7817 * struct {
7818 * NameType name_type;
7819 * select (name_type) {
7820 * case host_name: HostName;
7821 * } name;
7822 * } ServerName;
7823 *
7824 * enum {
7825 * host_name(0), (255)
7826 * } NameType;
7827 *
7828 * opaque HostName<1..2^16-1>;
7829 *
7830 * struct {
7831 * ServerName server_name_list<1..2^16-1>
7832 * } ServerNameList;
7833 */
7834 proto_tree *server_name_tree;
7835 uint32_t list_length, server_name_length, next_offset;
7836
7837 /* The server SHALL include "server_name" extension with empty data. */
7838 if (offset == offset_end) {
7839 return offset;
7840 }
7841
7842 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
7843
7844 /* ServerName server_name_list<1..2^16-1> */
7845 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
7846 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
7847 return offset_end;
7848 }
7849 offset += 2;
7850 next_offset = offset + list_length;
7851
7852 while (offset < next_offset) {
7853 uint32_t name_type;
7854 const char *server_name = NULL((void*)0);
7855 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
7856 tvb, offset, 1, ENC_NA0x00000000, &name_type);
7857 offset++;
7858
7859 /* opaque HostName<1..2^16-1> */
7860 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
7861 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
7862 return next_offset;
7863 }
7864 offset += 2;
7865
7866 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
7867 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
7868 pinfo->pool, (const uint8_t**)&server_name);
7869 offset += server_name_length;
7870 // Each type must only occur once, so we don't check for duplicates.
7871 if (name_type == 0) {
7872 proto_item_append_text(tree, " name=%s", server_name);
7873 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
7874
7875 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
7876 // Client Hello: Client (Src) -> Server (Dst)
7877 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
7878 case AT_IPv4:
7879 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
7880 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7881 }
7882 break;
7883 case AT_IPv6:
7884 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
7885 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7886 }
7887 break;
7888 }
7889 }
7890 }
7891 }
7892 return offset;
7893}
7894
7895static int
7896ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7897 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
7898{
7899 unsigned ext_len = offset_end - offset;
7900 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
7901 tvb_ensure_bytes_exist(tvb, offset, ext_len);
7902 /* Save the Session Ticket such that it can be used as identifier for
7903 * restoring a previous Master Secret (in ChangeCipherSpec) */
7904 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
7905 ssl->session_ticket.data, ext_len);
7906 ssl->session_ticket.data_len = ext_len;
7907 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
7908 }
7909 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
7910 tvb, offset, ext_len, ENC_NA0x00000000);
7911 return offset + ext_len;
7912}
7913
7914static int
7915ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7916 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7917 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
7918{
7919 uint8_t cert_list_length;
7920 uint8_t cert_type;
7921 proto_tree *cert_list_tree;
7922 proto_item *ti;
7923
7924 switch(hnd_type){
7925 case SSL_HND_CLIENT_HELLO:
7926 cert_list_length = tvb_get_uint8(tvb, offset);
7927 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
7928 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7929 offset += 1;
7930 if (offset_end - offset != (uint32_t)cert_list_length)
7931 return offset;
7932
7933 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
7934 cert_list_length, cert_list_length);
7935 proto_item_append_text(ti, " (%d)", cert_list_length);
7936
7937 /* make this a subtree */
7938 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
7939
7940 /* loop over all point formats */
7941 while (cert_list_length > 0)
7942 {
7943 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7944 offset++;
7945 cert_list_length--;
7946 }
7947 break;
7948 case SSL_HND_SERVER_HELLO:
7949 case SSL_HND_ENCRYPTED_EXTENSIONS:
7950 case SSL_HND_CERTIFICATE:
7951 cert_type = tvb_get_uint8(tvb, offset);
7952 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7953 offset += 1;
7954 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
7955 session->client_cert_type = cert_type;
7956 }
7957 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
7958 session->server_cert_type = cert_type;
7959 }
7960 break;
7961 default: /* no default */
7962 break;
7963 }
7964
7965 return offset;
7966}
7967
7968static uint32_t
7969ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7970 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7971 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
7972{
7973 uint32_t compress_certificate_algorithms_length, next_offset;
7974
7975 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
7976 * enum {
7977 * zlib(1),
7978 * brotli(2),
7979 * (65535)
7980 * } CertificateCompressionAlgorithm;
7981 *
7982 * struct {
7983 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
7984 * } CertificateCompressionAlgorithms;
7985 */
7986 switch (hnd_type) {
7987 case SSL_HND_CLIENT_HELLO:
7988 case SSL_HND_CERT_REQUEST:
7989 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
7990 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
7991 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
7992 return offset_end;
7993 }
7994 offset += 1;
7995 next_offset = offset + compress_certificate_algorithms_length;
7996
7997 while (offset < next_offset) {
7998 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
7999 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8000 offset += 2;
8001 }
8002 break;
8003 default:
8004 break;
8005 }
8006
8007 return offset;
8008}
8009
8010static uint32_t
8011ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8012 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8013 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8014{
8015 uint32_t key_parameters_length, next_offset;
8016 proto_item *p_ti;
8017 proto_tree *p_tree;
8018
8019 /* RFC 8472
8020 *
8021 * struct {
8022 * uint8 major;
8023 * uint8 minor;
8024 * } TB_ProtocolVersion;
8025 *
8026 * enum {
8027 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8028 * } TokenBindingKeyParameters;
8029 *
8030 * struct {
8031 * TB_ProtocolVersion token_binding_version;
8032 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8033 * } TokenBindingParameters;
8034 */
8035
8036 switch (hnd_type) {
8037 case SSL_HND_CLIENT_HELLO:
8038 case SSL_HND_SERVER_HELLO:
8039 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8040 offset += 1;
8041 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8042 offset += 1;
8043
8044 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8045 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8046 return offset_end;
8047 }
8048 offset += 1;
8049 next_offset = offset + key_parameters_length;
8050
8051 p_ti = proto_tree_add_none_format(tree,
8052 hf->hf.hs_ext_token_binding_key_parameters,
8053 tvb, offset, key_parameters_length,
8054 "Key parameters identifiers (%d identifier%s)",
8055 key_parameters_length,
8056 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8057 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8058
8059 while (offset < next_offset) {
8060 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8061 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8062 offset += 1;
8063 }
8064
8065 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8066 offset = next_offset;
8067 }
8068
8069 break;
8070 default:
8071 break;
8072 }
8073
8074 return offset;
8075}
8076
8077static uint32_t
8078ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8079 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8080 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8081{
8082 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8083 uint32_t next_offset;
8084
8085 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8086 *
8087 * Note: the following structures are not literally defined in the spec,
8088 * they instead use an ASCII diagram.
8089 *
8090 * struct {
8091 * uint16 id;
8092 * opaque value<0..2^16-1>;
8093 * } TransportParameter; // before draft -27
8094 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8095 *
8096 * struct {
8097 * opaque ipv4Address[4];
8098 * uint16 ipv4Port;
8099 * opaque ipv6Address[16];
8100 * uint16 ipv6Port;
8101 * opaque connectionId<0..18>;
8102 * opaque statelessResetToken[16];
8103 * } PreferredAddress;
8104 */
8105
8106 if (offset_end - offset >= 6 &&
8107 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8108 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8109 // Assume encoding of Transport Parameters draft -26 or older with at
8110 // least one transport parameter that has a valid length.
8111 use_varint_encoding = false0;
8112 }
8113
8114 if (use_varint_encoding) {
8115 next_offset = offset_end;
8116 } else {
8117 uint32_t quic_length;
8118 // Assume draft -26 or earlier.
8119 /* TransportParameter TransportParameters<0..2^16-1>; */
8120 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8121 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8122 return offset_end;
8123 }
8124 offset += 2;
8125 next_offset = offset + quic_length;
8126 }
8127
8128 while (offset < next_offset) {
8129 uint64_t parameter_type; /* 62-bit space */
8130 uint32_t parameter_length;
8131 proto_tree *parameter_tree;
8132 uint32_t parameter_end_offset;
8133 uint64_t value;
8134 uint32_t i;
8135 unsigned len = 0;
8136
8137 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8138 NULL((void*)0), "Parameter");
8139 /* TransportParameter ID and Length. */
8140 if (use_varint_encoding) {
8141 uint64_t parameter_length64;
8142 unsigned type_len = 0;
8143
8144 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8145 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8146 offset += type_len;
8147
8148 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8149 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8150 parameter_length = (uint32_t)parameter_length64;
8151 offset += len;
8152
8153 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8154 } else {
8155 parameter_type = tvb_get_ntohs(tvb, offset);
8156 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8157 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8158 offset += 2;
8159
8160 /* opaque value<0..2^16-1> */
8161 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8162 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8163 return next_offset;
8164 }
8165 offset += 2;
8166
8167 proto_item_set_len(parameter_tree, 4 + parameter_length);
8168 }
8169
8170 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8171 proto_item_append_text(parameter_tree, ": GREASE");
8172 } else {
8173 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8174 }
8175
8176 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8177 parameter_end_offset = offset + parameter_length;
8178
8179 /* Omit the value field if the parameter's length is 0. */
8180 if (parameter_length != 0) {
8181 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8182 tvb, offset, parameter_length, ENC_NA0x00000000);
8183 }
8184
8185 switch (parameter_type) {
8186 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8187 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8188 tvb, offset, parameter_length, ENC_NA0x00000000);
8189 offset += parameter_length;
8190 break;
8191 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8192 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8193 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8194 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8195 offset += len;
8196 break;
8197 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8198 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8199 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8200 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8201 offset += 16;
8202 break;
8203 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8204 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8205 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8206 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8207 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8208 offset += len;
8209 break;
8210 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8211 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8212 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8213 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8214 offset += len;
8215 break;
8216 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8217 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8218 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8219 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8220 offset += len;
8221 break;
8222 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8223 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8224 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8225 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8226 offset += len;
8227 break;
8228 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8229 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8230 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8231 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8232 offset += len;
8233 break;
8234 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8235 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8236 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8237 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8238 offset += len;
8239 break;
8240 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8241 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8242 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8243 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8244 offset += len;
8245 break;
8246 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8247 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8248 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8249 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8250 offset += len;
8251 break;
8252 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8253 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8254 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8255 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8256 offset += len;
8257 break;
8258 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8259 /* No Payload */
8260 break;
8261 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8262 uint32_t connectionid_length;
8263 quic_cid_t cid;
8264
8265 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8266 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8267 offset += 4;
8268 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8269 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8270 offset += 2;
8271 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8272 tvb, offset, 16, ENC_NA0x00000000);
8273 offset += 16;
8274 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8275 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8276 offset += 2;
8277 /* XXX - Should we add these addresses and ports as addresses that the client
8278 * is allowed / expected to migrate the server address to? Right now we don't
8279 * enforce that (see RFC 9000 Section 9, which implies that while the client
8280 * can migrate to whatever address it wants, it can only migrate the server
8281 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8282 */
8283
8284 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8285 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8286 break;
8287 }
8288 offset += 1;
8289
8290 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8291 tvb, offset, connectionid_length, ENC_NA0x00000000);
8292 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8293 cid.len = connectionid_length;
8294 // RFC 9000 5.1.1 "If the preferred_address transport
8295 // parameter is sent, the sequence number of the supplied
8296 // connection ID is 1."
8297 cid.seq_num = 1;
8298 // Multipath draft-07 "Also, the Path Identifier for the
8299 // connection ID specified in the "preferred address"
8300 // transport parameter is 0."
8301 cid.path_id = 0;
8302 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8303 quic_add_connection(pinfo, &cid);
8304 }
8305 offset += connectionid_length;
8306
8307 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8308 tvb, offset, 16, ENC_NA0x00000000);
8309 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8310 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8311 }
8312 offset += 16;
8313 }
8314 break;
8315 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8316 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8317 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8318 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8319 offset += len;
8320 break;
8321 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8322 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8323 tvb, offset, parameter_length, ENC_NA0x00000000);
8324 offset += parameter_length;
8325 break;
8326 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8327 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8328 tvb, offset, parameter_length, ENC_NA0x00000000);
8329 offset += parameter_length;
8330 break;
8331 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8332 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8333 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8334 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8335 offset += len;
8336 break;
8337 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8338 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8339 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8340 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8341 offset += len;
8342 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8343 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8344 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8345 offset += len;
8346 break;
8347 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8348 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8349 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8350 if (len > 0) {
8351 quic_add_loss_bits(pinfo, value);
8352 }
8353 offset += 1;
8354 break;
8355 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8356 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8357 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8358 offset += len;
8359 break;
8360 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8361 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8362 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8363 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8364 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8365 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8366 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8367 offset += len;
8368 break;
8369 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8370 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8371 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8372 offset += parameter_length;
8373 break;
8374 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8375 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8376 tvb, offset, parameter_length, ENC_NA0x00000000);
8377 offset += parameter_length;
8378 break;
8379 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8380 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8381 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8382 offset += 4;
8383 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8384 uint32_t versions_length;
8385
8386 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8387 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8388 offset += 1;
8389 for (i = 0; i < versions_length / 4; i++) {
8390 quic_proto_tree_add_version(tvb, parameter_tree,
8391 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8392 offset += 4;
8393 }
8394 }
8395 break;
8396 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8397 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8398 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8399 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8400 offset += len;
8401 break;
8402 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8403 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8404 tvb, offset, parameter_length, ENC_NA0x00000000);
8405 offset += parameter_length;
8406 break;
8407 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8408 /* This field was used for non-standard Google-specific parameters encoded as a
8409 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8410 * parameters. Report it as a bytes blob... */
8411 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8412 tvb, offset, parameter_length, ENC_NA0x00000000);
8413 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8414 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8415 tvb, offset, 4, ENC_NA0x00000000);
8416 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8417 offset += parameter_length;
8418 break;
8419 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8420 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8421 tvb, offset, parameter_length, ENC_NA0x00000000);
8422 offset += parameter_length;
8423 break;
8424 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8425 /* No Payload */
8426 break;
8427 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8428 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8429 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8430 offset += parameter_length;
8431 break;
8432 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8433 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8434 quic_proto_tree_add_version(tvb, parameter_tree,
8435 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8436 offset += 4;
8437 for (i = 4; i < parameter_length; i += 4) {
8438 quic_proto_tree_add_version(tvb, parameter_tree,
8439 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8440 offset += 4;
8441 }
8442 break;
8443 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8444 /* No Payload */
8445 quic_add_grease_quic_bit(pinfo);
8446 break;
8447 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8448 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8449 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8450 offset += parameter_length;
8451 break;
8452 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8453 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8454 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8455 if (value == 1) {
8456 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8457 }
8458 offset += parameter_length;
8459 break;
8460 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8461 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8462 /* No Payload */
8463 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8464 break;
8465 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8466 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8467 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8468 if (value > 1) {
8469 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8470 }
8471 /* multipath draft-07: "The value of the initial_max_paths
8472 * parameter MUST be at least 2." TODO: Expert Info? */
8473 offset += parameter_length;
8474 break;
8475 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8476 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8477 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8478 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8479 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8480 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8481 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8482 /* multipath draft-09 and later: "If an endpoint receives an
8483 * initial_max_path_id transport parameter with value 0, the
8484 * peer aims to enable the multipath extension without allowing
8485 * extra paths immediately."
8486 */
8487 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8488 offset += parameter_length;
8489 break;
8490 default:
8491 offset += parameter_length;
8492 /*TODO display expert info about unknown ? */
8493 break;
8494 }
8495
8496 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8497 /* Dissection did not end at expected location, fix it. */
8498 offset = parameter_end_offset;
8499 }
8500 }
8501
8502 return offset;
8503}
8504
8505static int
8506ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8507 proto_tree *tree, uint32_t offset,
8508 SslSession *session, SslDecryptSession *ssl,
8509 bool_Bool from_server, bool_Bool is_hrr)
8510{
8511 uint8_t sessid_length;
8512 proto_item *ti;
8513 proto_tree *rnd_tree;
8514 proto_tree *ti_rnd;
8515 proto_tree *ech_confirm_tree;
8516 uint8_t draft_version = session->tls13_draft_version;
8517
8518 if (ssl) {
8519 StringInfo *rnd;
8520 if (from_server)
8521 rnd = &ssl->server_random;
8522 else
8523 rnd = &ssl->client_random;
8524
8525 /* save provided random for later keyring generation */
8526 tvb_memcpy(tvb, rnd->data, offset, 32);
8527 rnd->data_len = 32;
8528 if (from_server)
8529 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8530 else
8531 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8532 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8533 from_server ? "SERVER" : "CLIENT", ssl->state);
8534 }
8535
8536 if (!from_server && session->client_random.data_len == 0) {
8537 session->client_random.data_len = 32;
8538 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8539 }
8540
8541 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8542
8543 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8544
8545 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8546 /* show the time */
8547 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8548 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8549 offset += 4;
8550
8551 /* show the random bytes */
8552 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8553 tvb, offset, 28, ENC_NA0x00000000);
8554 offset += 28;
8555 } else {
8556 if (is_hrr) {
8557 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8558 } else if (from_server && session->ech) {
8559 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8560 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
8561 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
8562 session->ech_confirmation, 8);
8563 proto_item_set_generated(ti);
8564 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
8565 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
8566 } else {
8567 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
8568 }
8569 }
8570
8571 offset += 32;
8572 }
8573
8574 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8575 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8576 /* show the session id (length followed by actual Session ID) */
8577 sessid_length = tvb_get_uint8(tvb, offset);
8578 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8579 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8580 offset++;
8581
8582 if (ssl) {
8583 /* save the authoritative SID for later use in ChangeCipherSpec.
8584 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8585 * save more, so ignore larger ones. To support ECH, also save
8586 * the SID from the ClientHelloOuter. */
8587 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8588 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8589 ssl->session_id.data_len = sessid_length;
8590 }
8591 }
8592 if (sessid_length > 0) {
8593 proto_tree_add_item(tree, hf->hf.hs_session_id,
8594 tvb, offset, sessid_length, ENC_NA0x00000000);
8595 offset += sessid_length;
8596 }
8597 }
8598
8599 return offset;
8600}
8601
8602static int
8603ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8604 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8605 bool_Bool has_length)
8606{
8607 /* TLS 1.2/1.3 status_request Client Hello Extension.
8608 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8609 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8610 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8611 * struct {
8612 * CertificateStatusType status_type;
8613 * uint16 request_length; // for status_request_v2
8614 * select (status_type) {
8615 * case ocsp: OCSPStatusRequest;
8616 * case ocsp_multi: OCSPStatusRequest;
8617 * } request;
8618 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8619 *
8620 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8621 * struct {
8622 * ResponderID responder_id_list<0..2^16-1>;
8623 * Extensions request_extensions;
8624 * } OCSPStatusRequest;
8625 * opaque ResponderID<1..2^16-1>;
8626 * opaque Extensions<0..2^16-1>;
8627 */
8628 unsigned cert_status_type;
8629
8630 cert_status_type = tvb_get_uint8(tvb, offset);
8631 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8632 tvb, offset, 1, ENC_NA0x00000000);
8633 offset++;
8634
8635 if (has_length) {
8636 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8637 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8638 offset += 2;
8639 }
8640
8641 switch (cert_status_type) {
8642 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8643 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8644 {
8645 uint32_t responder_id_list_len;
8646 uint32_t request_extensions_len;
8647
8648 /* ResponderID responder_id_list<0..2^16-1> */
8649 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8650 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8651 return offset_end;
8652 }
8653 offset += 2;
8654 if (responder_id_list_len != 0) {
8655 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8656 tvb, offset, responder_id_list_len,
8657 "Responder ID list is not implemented, contact Wireshark"
8658 " developers if you want this to be supported");
8659 }
8660 offset += responder_id_list_len;
8661
8662 /* opaque Extensions<0..2^16-1> */
8663 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8664 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8665 return offset_end;
8666 }
8667 offset += 2;
8668 if (request_extensions_len != 0) {
8669 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8670 tvb, offset, request_extensions_len,
8671 "Request Extensions are not implemented, contact"
8672 " Wireshark developers if you want this to be supported");
8673 }
8674 offset += request_extensions_len;
8675 break;
8676 }
8677 }
8678
8679 return offset;
8680}
8681
8682static unsigned
8683ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8684 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8685{
8686 /* https://tools.ietf.org/html/rfc6961#section-2.2
8687 * struct {
8688 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8689 * } CertificateStatusRequestListV2;
8690 */
8691 uint32_t req_list_length, next_offset;
8692
8693 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8694 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8695 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8696 return offset_end;
8697 }
8698 offset += 2;
8699 next_offset = offset + req_list_length;
8700
8701 while (offset < next_offset) {
8702 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8703 }
8704
8705 return offset;
8706}
8707
8708static uint32_t
8709tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8710 uint32_t offset, uint32_t offset_end)
8711{
8712 uint32_t response_length;
8713 proto_item *ocsp_resp;
8714 proto_tree *ocsp_resp_tree;
8715 asn1_ctx_t asn1_ctx;
8716
8717 /* opaque OCSPResponse<1..2^24-1>; */
8718 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8719 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8720 return offset_end;
8721 }
8722 offset += 3;
8723
8724 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8725 response_length, ENC_BIG_ENDIAN0x00000000);
8726 proto_item_set_text(ocsp_resp, "OCSP Response");
8727 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8728 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8729 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8730 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8731 }
8732 offset += response_length;
8733
8734 return offset;
8735}
8736
8737uint32_t
8738tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8739 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8740{
8741 /* TLS 1.2 "CertificateStatus" handshake message.
8742 * TLS 1.3 "status_request" Certificate extension.
8743 * struct {
8744 * CertificateStatusType status_type;
8745 * select (status_type) {
8746 * case ocsp: OCSPResponse;
8747 * case ocsp_multi: OCSPResponseList; // status_request_v2
8748 * } response;
8749 * } CertificateStatus;
8750 * opaque OCSPResponse<1..2^24-1>;
8751 * struct {
8752 * OCSPResponse ocsp_response_list<1..2^24-1>;
8753 * } OCSPResponseList; // status_request_v2
8754 */
8755 uint32_t status_type, resp_list_length, next_offset;
8756
8757 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
8758 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
8759 offset += 1;
8760
8761 switch (status_type) {
8762 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8763 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
8764 break;
8765
8766 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8767 /* OCSPResponse ocsp_response_list<1..2^24-1> */
8768 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
8769 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8770 return offset_end;
8771 }
8772 offset += 3;
8773 next_offset = offset + resp_list_length;
8774
8775 while (offset < next_offset) {
8776 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
8777 }
8778 break;
8779 }
8780
8781 return offset;
8782}
8783
8784static unsigned
8785ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8786 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8787 wmem_strbuf_t *ja3)
8788{
8789 /* RFC 8446 Section 4.2.7
8790 * enum { ..., (0xFFFF) } NamedGroup;
8791 * struct {
8792 * NamedGroup named_group_list<2..2^16-1>
8793 * } NamedGroupList;
8794 *
8795 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
8796 * the extension itself from "elliptic_curves" to "supported_groups".
8797 */
8798 uint32_t groups_length, next_offset;
8799 proto_tree *groups_tree;
8800 proto_item *ti;
8801 char *ja3_dash = "";
8802
8803 /* NamedGroup named_group_list<2..2^16-1> */
8804 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
8805 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
8806 return offset_end;
8807 }
8808 offset += 2;
8809 next_offset = offset + groups_length;
8810
8811 ti = proto_tree_add_none_format(tree,
8812 hf->hf.hs_ext_supported_groups,
8813 tvb, offset, groups_length,
8814 "Supported Groups (%d group%s)",
8815 groups_length / 2,
8816 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
8817
8818 /* make this a subtree */
8819 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
8820
8821 if (ja3) {
8822 wmem_strbuf_append_c(ja3, ',');
8823 }
8824 /* loop over all groups */
8825 while (offset + 2 <= offset_end) {
8826 uint32_t ext_supported_group;
8827
8828 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
8829 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
8830 offset += 2;
8831 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
8832 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
8833 ja3_dash = "-";
8834 }
8835 }
8836 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
8837 offset = next_offset;
8838 }
8839
8840 return offset;
8841}
8842
8843static int
8844ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8845 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
8846{
8847 uint8_t ecpf_length;
8848 proto_tree *ecpf_tree;
8849 proto_item *ti;
8850
8851 ecpf_length = tvb_get_uint8(tvb, offset);
8852 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
8853 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8854
8855 offset += 1;
8856 ti = proto_tree_add_none_format(tree,
8857 hf->hf.hs_ext_ec_point_formats,
8858 tvb, offset, ecpf_length,
8859 "Elliptic curves point formats (%d)",
8860 ecpf_length);
8861
8862 /* make this a subtree */
8863 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
8864
8865 if (ja3) {
8866 wmem_strbuf_append_c(ja3, ',');
8867 }
8868
8869 /* loop over all point formats */
8870 while (ecpf_length > 0)
8871 {
8872 uint32_t ext_ec_point_format;
8873
8874 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
8875 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
8876 offset++;
8877 ecpf_length--;
8878 if (ja3) {
8879 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
8880 if (ecpf_length > 0) {
8881 wmem_strbuf_append_c(ja3, '-');
8882 }
8883 }
8884 }
8885
8886 return offset;
8887}
8888
8889static int
8890ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8891 packet_info *pinfo, proto_tree *tree,
8892 uint32_t offset, uint32_t next_offset)
8893{
8894 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
8895 * opaque srp_I<1..2^8-1>;
8896 */
8897 uint32_t username_len;
8898
8899 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
8900 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
8901 return next_offset;
8902 }
8903 offset++;
8904
8905 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
8906 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
8907 offset += username_len;
8908
8909 return offset;
8910}
8911
8912static uint32_t
8913tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8914 uint32_t offset, uint32_t offset_end, uint16_t version)
8915{
8916 /* https://tools.ietf.org/html/rfc6962#section-3.2
8917 * enum { v1(0), (255) } Version;
8918 * struct {
8919 * opaque key_id[32];
8920 * } LogID;
8921 * opaque CtExtensions<0..2^16-1>;
8922 * struct {
8923 * Version sct_version;
8924 * LogID id;
8925 * uint64 timestamp;
8926 * CtExtensions extensions;
8927 * digitally-signed struct { ... };
8928 * } SignedCertificateTimestamp;
8929 */
8930 uint32_t sct_version;
8931 uint64_t sct_timestamp_ms;
8932 nstime_t sct_timestamp;
8933 uint32_t exts_len;
8934 const char *log_name;
8935
8936 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
8937 offset++;
8938 if (sct_version != 0) {
8939 // TODO expert info about unknown SCT version?
8940 return offset;
8941 }
8942 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
8943 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
8944 proto_item_append_text(tree, " (%s)", log_name);
8945 offset += 32;
8946 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
8947 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
8948 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
8949 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
8950 offset += 8;
8951 /* opaque CtExtensions<0..2^16-1> */
8952 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
8953 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
8954 return offset_end;
8955 }
8956 offset += 2;
8957 if (exts_len > 0) {
8958 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
8959 offset += exts_len;
8960 }
8961 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
8962 hf->hf.sct_sct_signature_length,
8963 hf->hf.sct_sct_signature);
8964 return offset;
8965}
8966
8967uint32_t
8968tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8969 uint32_t offset, uint32_t offset_end, uint16_t version)
8970{
8971 /* https://tools.ietf.org/html/rfc6962#section-3.3
8972 * opaque SerializedSCT<1..2^16-1>;
8973 * struct {
8974 * SerializedSCT sct_list <1..2^16-1>;
8975 * } SignedCertificateTimestampList;
8976 */
8977 uint32_t list_length, sct_length, next_offset;
8978 proto_tree *subtree;
8979
8980 /* SerializedSCT sct_list <1..2^16-1> */
8981 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
8982 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
8983 return offset_end;
8984 }
8985 offset += 2;
8986
8987 while (offset < offset_end) {
8988 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
8989
8990 /* opaque SerializedSCT<1..2^16-1> */
8991 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
8992 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
8993 return offset_end;
8994 }
8995 offset += 2;
8996 next_offset = offset + sct_length;
8997 proto_item_set_len(subtree, 2 + sct_length);
8998 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
8999 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9000 offset = next_offset;
9001 }
9002 }
9003
9004 return offset;
9005}
9006
9007static int
9008dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9009 proto_tree *tree, uint32_t offset)
9010{
9011 uint32_t kdf_id, aead_id;
9012 proto_item *cs_ti;
9013 proto_tree *cs_tree;
9014
9015 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9016 tvb, offset, 4, ENC_NA0x00000000);
9017 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9018
9019 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9020 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9021 offset += 2;
9022 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9023 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9024 offset += 2;
9025
9026 proto_item_append_text(cs_ti, ": %s/%s",
9027 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9028 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9029 return offset;
9030}
9031
9032static int
9033dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9034 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9035 uint32_t *config_id)
9036{
9037 uint32_t length, cipher_suite_length;
9038 proto_item *kc_ti, *css_ti;
9039 proto_tree *kc_tree, *css_tree;
9040 uint32_t original_offset = offset, next_offset;
9041
9042 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9043 tvb, offset, -1, ENC_NA0x00000000);
9044 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9045
9046 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9047 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9048 offset += 1;
9049 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9050 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9051 offset += 2;
9052 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9053 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9054 offset += 2;
9055 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9056 tvb, offset, length, ENC_NA0x00000000);
9057 offset += length;
9058
9059 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9060 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9061 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9062 return offset_end;
9063 }
9064 offset += 2;
9065 next_offset = offset + cipher_suite_length;
9066
9067 css_ti = proto_tree_add_none_format(kc_tree,
9068 hf->hf.ech_hpke_keyconfig_cipher_suites,
9069 tvb, offset, cipher_suite_length,
9070 "Cipher Suites (%d suite%s)",
9071 cipher_suite_length / 4,
9072 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9073 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9074
9075
9076 while (offset + 4 <= next_offset) {
9077 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9078 }
9079
9080 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9081 offset = next_offset;
9082 }
9083
9084 proto_item_set_len(kc_ti, offset - original_offset);
9085
9086 return offset;
9087}
9088
9089static int
9090dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9091 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9092 const uint8_t **public_name, uint32_t *config_id)
9093{
9094 uint32_t public_name_length, extensions_length, next_offset;
9095
9096 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9097 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9098 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9099 offset += 1;
9100 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9101 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9102 offset += 1;
9103 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9104 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9105 offset += public_name_length;
9106
9107 /* Extension extensions<0..2^16-1>; */
9108 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9109 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9110 return offset_end;
9111 }
9112 offset += 2;
9113 next_offset = offset + extensions_length;
9114
9115 if (extensions_length > 0) {
9116 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9117 tvb, offset, extensions_length, ENC_NA0x00000000);
9118 }
9119 offset += extensions_length;
9120
9121 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9122 offset = next_offset;
9123 }
9124
9125 return offset;
9126}
9127
9128static int
9129dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9130 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9131{
9132 uint32_t version, length;
9133 proto_item *ech_ti;
9134 proto_tree *ech_tree;
9135 const uint8_t *public_name = NULL((void*)0);
9136 uint32_t config_id = 0;
9137
9138 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9139 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9140
9141 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9142 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9143 offset += 2;
9144 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9145 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9146 offset += 2;
9147
9148 proto_item_set_len(ech_ti, 4 + length);
9149
9150 switch(version) {
9151 case 0xfe0d:
9152 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9153 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9154 break;
9155
9156 default:
9157 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9158 }
9159
9160 return 4 + length;
9161}
9162
9163uint32_t
9164ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9165 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9166{
9167 uint32_t echconfiglist_length, next_offset;
9168
9169 /* ECHConfig ECHConfigList<1..2^16-1>; */
9170 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9171 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9172 return offset_end;
9173 }
9174 offset += 2;
9175 next_offset = offset + echconfiglist_length;
9176
9177 while (offset < next_offset) {
9178 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9179 }
9180
9181 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9182 offset = next_offset;
9183 }
9184
9185 return offset;
9186}
9187
9188static uint32_t
9189ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9190 uint32_t offset, uint32_t offset_end)
9191{
9192 uint32_t ext_length, next_offset;
9193 proto_tree *ext_tree;
9194 proto_item *ti;
9195
9196 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9197 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9198 return offset_end;
9199 }
9200 offset += 1;
9201 next_offset = offset + ext_length;
9202
9203 ti = proto_tree_add_none_format(tree,
9204 hf->hf.hs_ext_ech_outer_ext,
9205 tvb, offset, ext_length,
9206 "Outer Extensions (%d extension%s)",
9207 ext_length / 2,
9208 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9209
9210 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9211
9212 while (offset + 2 <= offset_end) {
9213 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9214 offset += 2;
9215 }
9216
9217 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9218 offset = next_offset;
9219 }
9220
9221 return offset;
9222}
9223
9224static uint32_t
9225// NOLINTNEXTLINE(misc-no-recursion)
9226ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9227 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9228 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9229{
9230 uint32_t ch_type, length;
9231 proto_item *ti, *payload_ti;
9232 proto_tree *retry_tree, *payload_tree;
9233 uint32_t hello_length = tvb_reported_length(tvb);
9234
9235 switch (hnd_type) {
9236 case SSL_HND_CLIENT_HELLO:
9237 /*
9238 * enum { outer(0), inner(1) } ECHClientHelloType;
9239 *
9240 * struct {
9241 * ECHClientHelloType type;
9242 * select (ECHClientHello.type) {
9243 * case outer:
9244 * HpkeSymmetricCipherSuite cipher_suite;
9245 * uint8 config_id;
9246 * opaque enc<0..2^16-1>;
9247 * opaque payload<1..2^16-1>;
9248 * case inner:
9249 * Empty;
9250 * };
9251 * } ECHClientHello;
9252 */
9253
9254 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9255 offset += 1;
9256 switch (ch_type) {
9257 case 0: /* outer */
9258 if (ssl && session->first_ch_ech_frame == 0) {
9259 session->first_ch_ech_frame = pinfo->num;
9260 }
9261 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9262 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9263 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9264
9265 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9266 uint8_t config_id = tvb_get_uint8(tvb, offset);
9267 offset += 1;
9268 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9269 offset += 2;
9270 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9271 offset += length;
9272 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9273 offset += 2;
9274 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9275 offset += length;
9276
9277 if (!mk_map) {
9278 break;
9279 }
9280 if (session->client_random.data_len == 0) {
9281 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9282 break;
9283 }
9284 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9285 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9286 if (!ech_secret || !ech_config) {
9287 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9288 G_STRFUNC((const char*) (__func__)));
9289 break;
9290 }
9291
9292 if (hpke_hkdf_len(kdf_id) == 0) {
9293 ssl_debug_printf("Unsupported KDF\n");
9294 break;
9295 }
9296
9297 if (hpke_aead_key_len(aead_id) == 0) {
9298 ssl_debug_printf("Unsupported AEAD\n");
9299 break;
9300 }
9301
9302 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9303
9304 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9305 if (length < aead_auth_tag_len) {
9306 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9307 break;
9308 }
9309 unsigned decrypted_len = length - aead_auth_tag_len;
9310
9311 uint16_t version = pntohu16(ech_config->data);
9312 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9313 ssl_debug_printf("Unexpected version in ECH Config\n");
9314 break;
9315 }
9316 uint32_t ech_config_offset = 2;
9317 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9318 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9319 break;
9320 }
9321 ech_config_offset += 2;
9322 if (*(ech_config->data + ech_config_offset) != config_id) {
9323 ssl_debug_printf("ECH Config version mismatch\n");
9324 break;
9325 }
9326 ech_config_offset += 1;
9327 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9328 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9329 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9330 GByteArray *info = g_byte_array_new();
9331 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9332 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9333 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9334 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9335 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9336 key, base_nonce)) {
9337 g_byte_array_free(info, TRUE(!(0)));
9338 break;
9339 }
9340 g_byte_array_free(info, TRUE(!(0)));
9341 gcry_cipher_hd_t cipher;
9342 if (hpke_setup_aead(&cipher, aead_id, key) ||
9343 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9344 gcry_cipher_close(cipher);
9345 break;
9346 }
9347 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9348 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9349 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9350 memset(ech_aad + offset - length, 0, length);
9351 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9352 gcry_cipher_close(cipher);
9353 wmem_free(NULL((void*)0), ech_aad);
9354 break;
9355 }
9356 wmem_free(NULL((void*)0), ech_aad);
9357 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9358 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9359 gcry_cipher_close(cipher);
9360 break;
9361 }
9362 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9363 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9364 gcry_cipher_close(cipher);
9365 break;
9366 }
9367 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9368 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9369 gcry_cipher_close(cipher);
9370 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9371 payload + decrypted_len, aead_auth_tag_len)) {
9372 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9373 } else {
9374 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9375 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9376 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9377 if (ssl) {
9378 /* Note the Outer Client Random for Inject TLS Secrets */
9379 tls_save_crandom(ssl, mk_map);
9380
9381 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9382 uint32_t len_offset = ssl->ech_transcript.data_len;
9383 if (ssl->ech_transcript.data_len > 0)
9384 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9385 ssl->ech_transcript.data_len + hello_length + 4);
9386 else
9387 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9388 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9389 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9390 /* Copy ClientHelloInner up to the legacy_session_id field. */
9391 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9392 ssl->ech_transcript.data_len += 38;
9393 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9394 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = ssl->session_id.data_len;
9395 ssl->ech_transcript.data_len++;
9396 memcpy(&ssl->ech_transcript.data[ssl->ech_transcript.data_len], ssl->session_id.data, ssl->session_id.data_len);
9397 ssl->ech_transcript.data_len += ssl->session_id.data_len;
9398 /* Skip past the legacy_session_id field in ClientHelloInner
9399 * (which should be the empty string, i.e. just a 0 size.) */
9400 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9401 /* Copy the Cipher Suites from ClientHelloInner. */
9402 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9403 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9404 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9405 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9406 /* Copy the Compression Methods */
9407 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9408 1 + tvb_get_uint8(ech_tvb, ech_offset));
9409 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9410 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9411 /* Now replace extensions in ech_outer_extensions with the
9412 * data from ClientHelloOuter. */
9413 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9414 ssl->ech_transcript.data_len += 2;
9415 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9416 ech_offset += 2;
9417 bool_Bool ech_outer_extensions_found = false0;
9418 while (extensions_end - ech_offset >= 4) {
9419 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9420 ech_offset += 2;
9421 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9422 ech_offset += 2;
9423 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9424 /* Copy this extension directly */
9425 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len,
9426 ech_offset - 4, 4 + ext_len);
9427 ssl->ech_transcript.data_len += 4 + ext_len;
9428 ech_offset += ext_len;
9429 } else if (ext_len > 0) {
9430 if (ech_outer_extensions_found) {
9431 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9432 /* This could lead to a buffer overflow by
9433 * making the post-copying ClientHelloInner
9434 * longer than ClientHelloOuter and is
9435 * illegal, so skip this and don't copy. */
9436 ech_offset += ext_len;
9437 continue;
9438 }
9439 ech_outer_extensions_found = true1;
9440 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9441 ech_offset += 1;
9442 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9443 /* In ClientHelloOuter, skip past the legacy_session_id */
9444 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9445 /* Skip past Cipher Suites */
9446 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9447 /* Skip past Compression Methods */
9448 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9449 /* Now at the start of ClientHelloOuter's extensions */
9450 while (ech_outer_extensions_end - ech_offset >= 2) {
9451 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9452 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9453 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9454 /* This could lead to a buffer overflow by
9455 * making the post-copying ClientHelloInner
9456 * longer than ClientHelloOuter and is
9457 * illegal, so don't copy. */
9458 break;
9459 }
9460 bool_Bool found = false0;
9461 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9462 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9463 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9464 if (ext_type == outer_ext_type) {
9465 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9466 4 + outer_ext_len);
9467 ssl->ech_transcript.data_len += 4 + outer_ext_len;
9468 outer_offset += 4 + outer_ext_len;
9469 found = true1;
9470 break;
9471 } else {
9472 outer_offset += 4 + outer_ext_len;
9473 }
9474 }
9475 if (!found) {
9476 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9477 }
9478 ech_offset += 2;
9479 }
9480 }
9481 }
9482 uint16_t ech_extensions_len = ssl->ech_transcript.data_len - ech_extensions_len_offset - 2;
9483 phtonu16(&ssl->ech_transcript.data[ech_extensions_len_offset], ech_extensions_len);
9484 phtonu16(&ssl->ech_transcript.data[len_offset + 2], ssl->ech_transcript.data_len - len_offset - 4);
9485 }
9486 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9487 ssl, NULL((void*)0), mk_map);
9488 if (ech_padding_begin < decrypted_len) {
9489 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9490 ENC_NA0x00000000);
9491 }
9492 }
9493
9494 break;
9495 case 1: /* inner */
9496 break;
9497 }
9498 break;
9499
9500 case SSL_HND_ENCRYPTED_EXTENSIONS:
9501 /*
9502 * struct {
9503 * ECHConfigList retry_configs;
9504 * } ECHEncryptedExtensions;
9505 */
9506
9507 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9508 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9509 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9510 break;
9511
9512 case SSL_HND_HELLO_RETRY_REQUEST:
9513 /*
9514 * struct {
9515 * opaque confirmation[8];
9516 * } ECHHelloRetryRequest;
9517 */
9518
9519 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9520 if (session->ech) {
9521 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9522 proto_item_set_generated(ti);
9523 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
9524 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9525 } else {
9526 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9527 }
9528 }
9529 offset += 8;
9530 break;
9531 }
9532
9533 return offset;
9534}
9535
9536static uint32_t
9537ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9538 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9539 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9540{
9541 uint32_t record_digest_length, encrypted_sni_length;
9542
9543 switch (hnd_type) {
9544 case SSL_HND_CLIENT_HELLO:
9545 /*
9546 * struct {
9547 * CipherSuite suite;
9548 * KeyShareEntry key_share;
9549 * opaque record_digest<0..2^16-1>;
9550 * opaque encrypted_sni<0..2^16-1>;
9551 * } ClientEncryptedSNI;
9552 */
9553 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9554 offset += 2;
9555 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9556
9557 /* opaque record_digest<0..2^16-1> */
9558 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9559 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9560 return offset_end;
9561 }
9562 offset += 2;
9563 if (record_digest_length > 0) {
9564 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9565 offset += record_digest_length;
9566 }
9567
9568 /* opaque encrypted_sni<0..2^16-1> */
9569 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9570 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9571 return offset_end;
9572 }
9573 offset += 2;
9574 if (encrypted_sni_length > 0) {
9575 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9576 offset += encrypted_sni_length;
9577 }
9578 break;
9579
9580 case SSL_HND_ENCRYPTED_EXTENSIONS:
9581 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9582 offset += 16;
9583 break;
9584 }
9585
9586 return offset;
9587}
9588/** TLS Extensions (in Client Hello and Server Hello). }}} */
9589
9590/* Connection ID dissection. {{{ */
9591static uint32_t
9592ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9593 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9594 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9595{
9596 /* keep track of the decrypt session only for the first pass */
9597 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9598 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9599 *session_cidl = cidl;
9600 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9601 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9602 if (ssl) {
9603 ssl_add_session_by_cid(ssl);
9604 }
9605 }
9606
9607 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9608 tvb, offset, 1, ENC_NA0x00000000);
9609 offset++;
9610
9611 if (cidl > 0) {
9612 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9613 tvb, offset, cidl, ENC_NA0x00000000);
9614 offset += cidl;
9615 }
9616
9617 return offset;
9618}
9619
9620static uint32_t
9621ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9622 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9623 SslSession *session, SslDecryptSession *ssl)
9624{
9625 uint8_t cidl = tvb_get_uint8(tvb, offset);
9626
9627 switch (hnd_type) {
9628 case SSL_HND_CLIENT_HELLO:
9629 session->client_cid_len_present = true1;
9630 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9631 cidl, &session->client_cid, &session->client_cid_len);
9632 case SSL_HND_SERVER_HELLO:
9633 session->server_cid_len_present = true1;
9634 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9635 cidl, &session->server_cid, &session->server_cid_len);
9636 default:
9637 return offset;
9638 }
9639} /* }}} */
9640
9641/* Trusted CA dissection. {{{ */
9642static uint32_t
9643ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9644 uint32_t offset, uint32_t offset_end)
9645{
9646 proto_item *ti;
9647 proto_tree *subtree;
9648 uint32_t keys_length, next_offset;
9649
9650 /*
9651 * struct {
9652 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9653 * } TrustedAuthorities;
9654 *
9655 * struct {
9656 * IdentifierType identifier_type;
9657 * select (identifier_type) {
9658 * case pre_agreed: struct {};
9659 * case key_sha1_hash: SHA1Hash;
9660 * case x509_name: DistinguishedName;
9661 * case cert_sha1_hash: SHA1Hash;
9662 * } identifier;
9663 * } TrustedAuthority;
9664 *
9665 * enum {
9666 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9667 * cert_sha1_hash(3), (255)
9668 * } IdentifierType;
9669 *
9670 * opaque DistinguishedName<1..2^16-1>;
9671 *
9672 */
9673
9674
9675 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9676 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9677 0, UINT16_MAX(65535)))
9678 {
9679 return offset_end;
9680 }
9681 offset += 2;
9682 next_offset = offset + keys_length;
9683
9684 if (keys_length > 0)
9685 {
9686 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9687 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9688 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9689
9690 while (offset < next_offset)
9691 {
9692 uint32_t identifier_type;
9693 proto_tree *trusted_key_tree;
9694 proto_item *trusted_key_item;
9695 asn1_ctx_t asn1_ctx;
9696 uint32_t key_len = 0;
9697
9698 identifier_type = tvb_get_uint8(tvb, offset);
9699
9700 // Use 0 as length for now as we'll only know the size when we decode the identifier
9701 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9702 offset, 0, "Trusted CA Key");
9703 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9704
9705 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9706 offset, 1, identifier_type);
9707 offset++;
9708
9709 /*
9710 * enum {
9711 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9712 * cert_sha1_hash(3), (255)
9713 * } IdentifierType;
9714 */
9715 switch (identifier_type)
9716 {
9717 case 0:
9718 key_len = 0;
9719 break;
9720 case 2:
9721 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9722
9723 uint32_t name_length;
9724 /* opaque DistinguishedName<1..2^16-1> */
9725 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9726 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9727 return next_offset;
9728 }
9729 offset += 2;
9730
9731 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9732 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9733 offset += name_length;
9734 break;
9735 case 1:
9736 case 3:
9737 key_len = 20;
9738 /* opaque SHA1Hash[20]; */
9739 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
9740 offset, 20, ENC_NA0x00000000);
9741 break;
9742
9743 default:
9744 key_len = 0;
9745 /*TODO display expert info about unknown ? */
9746 break;
9747 }
9748 proto_item_set_len(trusted_key_item, 1 + key_len);
9749 offset += key_len;
9750 }
9751 }
9752
9753 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
9754 {
9755 offset = next_offset;
9756 }
9757
9758 return offset;
9759} /* }}} */
9760
9761
9762/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
9763bool_Bool
9764ssl_is_valid_content_type(uint8_t type)
9765{
9766 switch ((ContentType) type) {
9767 case SSL_ID_CHG_CIPHER_SPEC:
9768 case SSL_ID_ALERT:
9769 case SSL_ID_HANDSHAKE:
9770 case SSL_ID_APP_DATA:
9771 case SSL_ID_HEARTBEAT:
9772 case SSL_ID_TLS12_CID:
9773 case SSL_ID_DTLS13_ACK:
9774 return true1;
9775 }
9776 return false0;
9777}
9778
9779bool_Bool
9780ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
9781{
9782 switch ((HandshakeType) hs_type) {
9783 case SSL_HND_HELLO_VERIFY_REQUEST:
9784 /* hello_verify_request is DTLS-only */
9785 return is_dtls;
9786
9787 case SSL_HND_HELLO_REQUEST:
9788 case SSL_HND_CLIENT_HELLO:
9789 case SSL_HND_SERVER_HELLO:
9790 case SSL_HND_NEWSESSION_TICKET:
9791 case SSL_HND_END_OF_EARLY_DATA:
9792 case SSL_HND_HELLO_RETRY_REQUEST:
9793 case SSL_HND_ENCRYPTED_EXTENSIONS:
9794 case SSL_HND_CERTIFICATE:
9795 case SSL_HND_SERVER_KEY_EXCHG:
9796 case SSL_HND_CERT_REQUEST:
9797 case SSL_HND_SVR_HELLO_DONE:
9798 case SSL_HND_CERT_VERIFY:
9799 case SSL_HND_CLIENT_KEY_EXCHG:
9800 case SSL_HND_FINISHED:
9801 case SSL_HND_CERT_URL:
9802 case SSL_HND_CERT_STATUS:
9803 case SSL_HND_SUPPLEMENTAL_DATA:
9804 case SSL_HND_KEY_UPDATE:
9805 case SSL_HND_COMPRESSED_CERTIFICATE:
9806 case SSL_HND_ENCRYPTED_EXTS:
9807 return true1;
9808 case SSL_HND_MESSAGE_HASH:
9809 return false0;
9810 }
9811 return false0;
9812}
9813
9814static bool_Bool
9815ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
9816 bool_Bool is_dtls)
9817{
9818 /* Consider all valid Handshake messages (except for Client Hello) and
9819 * all other valid record types (other than Handshake) */
9820 return (content_type == SSL_ID_HANDSHAKE &&
9821 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
9822 handshake_type != SSL_HND_CLIENT_HELLO) ||
9823 (content_type != SSL_ID_HANDSHAKE &&
9824 ssl_is_valid_content_type(content_type));
9825}
9826
9827/**
9828 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
9829 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
9830 * Returns true if the supported_versions extension was found, false if not.
9831 */
9832bool_Bool
9833tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
9834 uint16_t *server_version, bool_Bool *is_hrr)
9835{
9836 /* SHA256("HelloRetryRequest") */
9837 static const uint8_t tls13_hrr_random_magic[] = {
9838 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
9839 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
9840 };
9841 uint8_t session_id_length;
9842
9843 *server_version = tvb_get_ntohs(tvb, offset);
9844
9845 /*
9846 * Try to look for supported_versions extension. Minimum length:
9847 * 2 + 32 + 1 = 35 (version, random, session id length)
9848 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9849 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9850 *
9851 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9852 * there's a separate expert info warning for that.
9853 */
9854 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9855 offset += 2;
9856 if (is_hrr) {
9857 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
9858 }
9859 offset += 32;
9860 session_id_length = tvb_get_uint8(tvb, offset);
9861 offset++;
9862 if (offset_end - offset < session_id_length + 5u) {
9863 return false0;
9864 }
9865 offset += session_id_length + 5;
9866
9867 while (offset_end - offset >= 6) {
9868 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9869 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9870 if (offset_end - offset < 4u + ext_len) {
9871 break; /* not enough data for type, length and data */
9872 }
9873 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9874 if (ext_len == 2) {
9875 *server_version = tvb_get_ntohs(tvb, offset + 4);
9876 }
9877 return true1;
9878 }
9879 offset += 4 + ext_len;
9880 }
9881 } else {
9882 if (is_hrr) {
9883 *is_hrr = false0;
9884 }
9885 }
9886 return false0;
9887}
9888
9889/**
9890 * Scan a Client Hello handshake message to see if the supported_versions
9891 * extension is found, in which case the version field is legacy_version.
9892 */
9893static bool_Bool
9894tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
9895{
9896 uint8_t session_id_length;
9897
9898 uint16_t client_version = tvb_get_ntohs(tvb, offset);
9899
9900 /*
9901 * Try to look for supported_versions extension. Minimum length:
9902 * 2 + 32 + 1 = 35 (version, random, session id length)
9903 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9904 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9905 *
9906 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9907 * there's a separate expert info warning for that.
9908 */
9909 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9910 offset += 2;
9911 offset += 32;
9912 session_id_length = tvb_get_uint8(tvb, offset);
9913 offset++;
9914 if (offset_end - offset < session_id_length + 2u) {
9915 return false0;
9916 }
9917 offset += session_id_length;
9918 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
9919 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
9920 offset++;
9921 if (offset_end - offset < cookie_length + 2u) {
9922 return false0;
9923 }
9924 }
9925 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
9926 offset += 2;
9927 if (offset_end - offset < cipher_suites_length + 1u) {
9928 return false0;
9929 }
9930 offset += cipher_suites_length;
9931 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
9932 offset++;
9933 if (offset_end - offset < compression_methods_length + 2u) {
9934 return false0;
9935 }
9936 offset += compression_methods_length + 2;
9937
9938 while (offset_end - offset >= 6) {
9939 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9940 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9941 if (offset_end - offset < 4u + ext_len) {
9942 break; /* not enough data for type, length and data */
9943 }
9944 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9945 return true1;
9946 }
9947 offset += 4 + ext_len;
9948 }
9949 }
9950 return false0;
9951}
9952void
9953ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
9954 uint8_t content_type, uint8_t handshake_type,
9955 bool_Bool is_dtls, uint16_t version)
9956{
9957 uint8_t tls13_draft = 0;
9958
9959 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
9960 is_dtls))
9961 return;
9962
9963 version = tls_try_get_version(is_dtls, version, &tls13_draft);
9964 if (version == SSL_VER_UNKNOWN0) {
9965 return;
9966 }
9967
9968 session->tls13_draft_version = tls13_draft;
9969 session->version = version;
9970 if (ssl) {
9971 ssl->state |= SSL_VERSION(1<<4);
9972 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
9973 }
9974}
9975
9976void
9977ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
9978 ContentType content_type,
9979 unsigned record_length, proto_item *length_pi,
9980 uint16_t version, tvbuff_t *decrypted_tvb)
9981{
9982 unsigned max_expansion;
9983 if (version == TLSV1DOT3_VERSION0x304) {
9984 /* TLS 1.3: Max length is 2^14 + 256 */
9985 max_expansion = 256;
9986 } else {
9987 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
9988 max_expansion = 2048;
9989 }
9990 /*
9991 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
9992 * and ChangeCipherSpec.
9993 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
9994 * so assume it is permitted.
9995 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
9996 * assume TLS 1.2 requirements.
9997 */
9998 if (record_length == 0 &&
9999 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10000 content_type == SSL_ID_ALERT ||
10001 content_type == SSL_ID_HANDSHAKE)) {
10002 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10003 "Zero-length %s fragments are not allowed",
10004 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10005 }
10006 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10007 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10008 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10009 }
10010 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10011 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10012 "TLSPlaintext length MUST NOT exceed 2^14");
10013 }
10014}
10015
10016static void
10017ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10018{
10019 /* store selected cipher suite for decryption */
10020 ssl->session.cipher = cipher;
10021
10022 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10023 if (!cs) {
10024 ssl->cipher_suite = NULL((void*)0);
10025 ssl->state &= ~SSL_CIPHER(1<<2);
10026 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10027 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10028 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10029 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10030 * to avoid a potential buffer overflow in ssl3_check_mac. */
10031 ssl->cipher_suite = NULL((void*)0);
10032 ssl->state &= ~SSL_CIPHER(1<<2);
10033 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10034 } else {
10035 /* Cipher found, save this for the delayed decoder init */
10036 ssl->cipher_suite = cs;
10037 ssl->state |= SSL_CIPHER(1<<2);
10038 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10039 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10040 ssl->state);
10041 }
10042}
10043/* }}} */
10044
10045
10046/* Client Hello and Server Hello dissections. {{{ */
10047static int
10048ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10049 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10050 SslSession *session, SslDecryptSession *ssl,
10051 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10052 ssl_master_key_map_t *mk_map);
10053int
10054// NOLINTNEXTLINE(misc-no-recursion)
10055ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10056 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10057 uint32_t offset_end, SslSession *session,
10058 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10059{
10060 /* struct {
10061 * ProtocolVersion client_version;
10062 * Random random;
10063 * SessionID session_id;
10064 * opaque cookie<0..32>; //new field for DTLS
10065 * CipherSuite cipher_suites<2..2^16-1>;
10066 * CompressionMethod compression_methods<1..2^8-1>;
10067 * Extension client_hello_extension_list<0..2^16-1>;
10068 * } ClientHello;
10069 */
10070 proto_item *ti;
10071 proto_tree *cs_tree;
10072 uint32_t client_version;
10073 uint32_t cipher_suite_length;
10074 uint32_t compression_methods_length;
10075 uint8_t compression_method;
10076 uint32_t next_offset;
10077 uint32_t initial_offset = offset;
10078 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10079 char *ja3_hash;
10080 char *ja3_dash = "";
10081 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10082 ja4_data_t ja4_data;
10083 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10084 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10085 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10086 wmem_list_frame_t *curr_entry;
10087
10088 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10088, (int64_t)initial_offset, (int64_t)offset_end))));
10089 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10090 offset = 0;
10091 offset_end = tvb_reported_length(hello_tvb);
10092
10093 ja4_data.max_version = 0;
10094 ja4_data.server_name_present = false0;
10095 ja4_data.num_cipher_suites = 0;
10096 ja4_data.num_extensions = 0;
10097 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10098 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10099 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10100 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10101
10102 /* show the client version */
10103 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10104 offset, 2, ENC_BIG_ENDIAN0x00000000,
10105 &client_version);
10106 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10107 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10108 }
10109 offset += 2;
10110 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10111
10112 /*
10113 * Is it version 1.3?
10114 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10115 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10116 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10117 * Hello".
10118 */
10119 if (dtls_hfs != NULL((void*)0)) {
10120 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10121 /* Don't do that. */
10122 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10123 }
10124 } else {
10125 if (client_version == TLSV1DOT3_VERSION0x304) {
10126 /* Don't do that. */
10127 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10128 }
10129 }
10130
10131 /* dissect fields that are present in both ClientHello and ServerHello */
10132 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10133
10134 /* fields specific for DTLS (cookie_len, cookie) */
10135 if (dtls_hfs != NULL((void*)0)) {
10136 uint32_t cookie_length;
10137 /* opaque cookie<0..32> (for DTLS only) */
10138 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10139 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10140 return offset;
10141 }
10142 offset++;
10143 if (cookie_length > 0) {
10144 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10145 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10146 offset += cookie_length;
10147 }
10148 }
10149
10150 /* CipherSuite cipher_suites<2..2^16-1> */
10151 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10152 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10153 return offset;
10154 }
10155 offset += 2;
10156 next_offset = offset + cipher_suite_length;
10157 ti = proto_tree_add_none_format(tree,
10158 hf->hf.hs_cipher_suites,
10159 hello_tvb, offset, cipher_suite_length,
10160 "Cipher Suites (%d suite%s)",
10161 cipher_suite_length / 2,
10162 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10163 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10164 while (offset + 2 <= next_offset) {
10165 uint32_t cipher_suite;
10166
10167 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10168 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10169 offset += 2;
10170 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10171 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10172 ja3_dash = "-";
10173 ja4_data.num_cipher_suites += 1;
10174 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10175 }
10176 }
10177 wmem_strbuf_append_c(ja3, ',');
10178 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10179 offset = next_offset;
10180 }
10181
10182 /* CompressionMethod compression_methods<1..2^8-1> */
10183 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10184 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10185 return offset;
10186 }
10187 offset++;
10188 next_offset = offset + compression_methods_length;
10189 ti = proto_tree_add_none_format(tree,
10190 hf->hf.hs_comp_methods,
10191 hello_tvb, offset, compression_methods_length,
10192 "Compression Methods (%u method%s)",
10193 compression_methods_length,
10194 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10195 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10196 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10197 while (offset < next_offset) {
10198 compression_method = tvb_get_uint8(hello_tvb, offset);
10199 /* TODO: make reserved/private comp meth. fields selectable */
10200 if (compression_method < 64)
10201 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10202 hello_tvb, offset, 1, compression_method);
10203 else if (compression_method < 193)
10204 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10205 compression_method, "Reserved - to be assigned by IANA (%u)",
10206 compression_method);
10207 else
10208 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10209 compression_method, "Private use range (%u)",
10210 compression_method);
10211 offset++;
10212 }
10213
10214 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10215 if (offset < offset_end) {
10216 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10217 offset_end, SSL_HND_CLIENT_HELLO,
10218 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10219 if (ja4_data.max_version > 0) {
10220 client_version = ja4_data.max_version;
10221 }
10222 } else {
10223 wmem_strbuf_append_printf(ja3, ",,");
10224 }
10225
10226 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10227 wmem_strbuf_append(ja4_a, "t");
10228 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10229 wmem_strbuf_append(ja4_a, "q");
10230 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10231 wmem_strbuf_append(ja4_a, "d");
10232 }
10233 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10234 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10235 if (ja4_data.num_cipher_suites > 99) {
10236 wmem_strbuf_append(ja4_a, "99");
10237 } else {
10238 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10239 }
10240 if (ja4_data.num_extensions > 99) {
10241 wmem_strbuf_append(ja4_a, "99");
10242 } else {
10243 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10244 }
10245 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10246 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10247 } else {
10248 wmem_strbuf_append(ja4_a, "00");
10249 }
10250
10251 curr_entry = wmem_list_head(ja4_data.cipher_list);
10252 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10253 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10254 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10255 wmem_strbuf_append(ja4_br, ",");
10256 }
10257 curr_entry = wmem_list_frame_next(curr_entry);
10258 }
10259
10260 curr_entry = wmem_list_head(ja4_data.extension_list);
10261 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10262 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10263 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10264 wmem_strbuf_append(ja4_cr, ",");
10265 }
10266 curr_entry = wmem_list_frame_next(curr_entry);
10267 }
10268
10269 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10270 wmem_strbuf_append(ja4_cr, "_");
10271 curr_entry = wmem_list_head(ja4_data.sighash_list);
10272 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10273 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10274 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10275 wmem_strbuf_append(ja4_cr, ",");
10276 }
10277 curr_entry = wmem_list_frame_next(curr_entry);
10278 }
10279 }
10280 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10281 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10282 } else {
10283 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10284 }
10285 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10286
10287 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10288 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10289 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10290 } else {
10291 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10292 }
10293 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10294 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10295
10296 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10297 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10298
10299 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10300 proto_item_set_generated(ti);
10301 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10302 proto_item_set_generated(ti);
10303
10304 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10305 wmem_strbuf_get_len(ja3));
10306 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10307 proto_item_set_generated(ti);
10308 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10309 proto_item_set_generated(ti);
10310 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10311 return initial_offset + offset;
10312}
10313
10314void
10315ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10316 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10317 SslSession *session, SslDecryptSession *ssl,
10318 bool_Bool is_dtls, bool_Bool is_hrr)
10319{
10320 /* struct {
10321 * ProtocolVersion server_version;
10322 * Random random;
10323 * SessionID session_id; // TLS 1.2 and before
10324 * CipherSuite cipher_suite;
10325 * CompressionMethod compression_method; // TLS 1.2 and before
10326 * Extension server_hello_extension_list<0..2^16-1>;
10327 * } ServerHello;
10328 */
10329 uint8_t draft_version = session->tls13_draft_version;
10330 proto_item *ti;
10331 uint32_t server_version;
10332 uint32_t cipher_suite;
10333 uint32_t initial_offset = offset;
10334 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10335 char *ja3_hash;
10336
10337 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10338 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10339
10340 /* Initially assume that the session is resumed. If this is not the case, a
10341 * ServerHelloDone will be observed before the ChangeCipherSpec message
10342 * which will reset this flag. */
10343 session->is_session_resumed = true1;
10344
10345 /* show the server version */
10346 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10347 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10348
10349 uint16_t supported_server_version;
10350 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
10351 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10352 }
10353 /*
10354 * Is it version 1.3?
10355 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10356 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10357 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10358 * Hello".
10359 */
10360 if (is_dtls) {
10361 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10362 /* Don't do that. */
10363 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10364 }
10365 } else {
10366 if (server_version == TLSV1DOT3_VERSION0x304) {
10367 /* Don't do that. */
10368 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10369 }
10370 }
10371
10372 offset += 2;
10373 wmem_strbuf_append_printf(ja3, "%i", server_version);
10374
10375 /* dissect fields that are present in both ClientHello and ServerHello */
10376 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10377
10378 if (ssl) {
10379 /* store selected cipher suite for decryption */
10380 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10381 }
10382
10383 /* now the server-selected cipher suite */
10384 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10385 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10386 offset += 2;
10387 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10388
10389 /* No compression with TLS 1.3 before draft -22 */
10390 if (!(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
10391 if (ssl) {
10392 /* store selected compression method for decryption */
10393 ssl->session.compression = tvb_get_uint8(tvb, offset);
10394 }
10395 /* and the server-selected compression method */
10396 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10397 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10398 offset++;
10399 }
10400
10401 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10402 if (offset < offset_end) {
10403 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10404 offset_end,
10405 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10406 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10407 }
10408
10409 if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
10410 /* RFC 9849 7.2 Backend Server */
10411 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10412 SSL_MDgcry_md_hd_t mc;
10413 if (hash_algo && ssl_md_init(&mc, hash_algo) == 0) {
10414 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10415 unsigned char prk[DIGEST_MAX_SIZE48];
10416 unsigned char *ech_verify_out = NULL((void*)0);
10417 unsigned int len;
10418 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10419 if (is_hrr) {
10420 /* RFC 8446 4.4.1 The Transcript Hash
10421 * Special synthetic handshake following a HelloRetryRequest */
10422 ssl_md_final(&mc, transcript_hash, &len);
10423 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10424 ssl->ech_transcript.data_len = 4 + len;
10425 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10426 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10427 ssl->ech_transcript.data[1] = 0;
10428 ssl->ech_transcript.data[2] = 0;
10429 ssl->ech_transcript.data[3] = len;
10430 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10431 ssl_md_reset(&mc);
10432 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10433 } else {
10434 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10435 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10436 }
10437 if (initial_offset > 4) {
10438 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10439 4 + offset_end - initial_offset);
10440 if (is_hrr)
10441 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10442 else
10443 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10444 } else {
10445 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10446 prefix[2] = ((offset - initial_offset) >> 8);
10447 prefix[3] = (offset - initial_offset) & 0xff;
10448 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10449 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
10450 offset_end - initial_offset);
10451 ssl_md_update(&mc, prefix, 4);
10452 if (is_hrr)
10453 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 34), 34);
10454 else
10455 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 26), 26);
10456 }
10457 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
10458 uint8_t zeros[8] = { 0 };
10459 uint32_t confirmation_offset = initial_offset + 26;
10460 if (is_hrr) {
10461 uint32_t hrr_offset = initial_offset + 34;
10462 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset,
10463 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
10464 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
10465 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 3), 3);
10466 hrr_offset += 3;
10467 uint32_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
10468 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 2), 2);
10469 hrr_offset += 2;
10470 while (extensions_end - hrr_offset >= 4) {
10471 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
10472 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
10473 confirmation_offset = hrr_offset + 4;
10474 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 4), 4);
10475 ssl_md_update(&mc, zeros, 8);
10476 hrr_offset += 12;
10477 } else {
10478 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
10479 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
10480 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
10481 }
10482 }
10483 } else {
10484 ssl_md_update(&mc, zeros, 8);
10485 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
10486 offset - initial_offset - 34);
10487 }
10488 ssl_md_final(&mc, transcript_hash, &len);
10489 ssl_md_cleanup(&mc);
10490 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10491 StringInfo prk_string = {prk, len};
10492 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10493 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10494 transcript_hash, len, 8, &ech_verify_out)) {
10495 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10496 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10497 if (is_hrr) {
10498 ssl->session.hrr_ech_declined = true1;
10499 ssl->session.first_ch_ech_frame = 0;
10500 }
10501 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10502 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10503 }
10504 wmem_free(NULL((void*)0), ech_verify_out);
10505 }
10506 ssl->session.ech = true1;
10507 }
10508 }
10509
10510 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10511 wmem_strbuf_get_len(ja3));
10512 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10513 proto_item_set_generated(ti);
10514 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10515 proto_item_set_generated(ti);
10516 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10517}
10518/* Client Hello and Server Hello dissections. }}} */
10519
10520/* New Session Ticket dissection. {{{ */
10521void
10522ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10523 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10524 SslSession *session, SslDecryptSession *ssl,
10525 bool_Bool is_dtls, GHashTable *session_hash)
10526{
10527 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10528 * struct {
10529 * uint32 ticket_lifetime_hint;
10530 * opaque ticket<0..2^16-1>;
10531 * } NewSessionTicket;
10532 *
10533 * RFC 8446 Section 4.6.1 (TLS 1.3):
10534 * struct {
10535 * uint32 ticket_lifetime;
10536 * uint32 ticket_age_add;
10537 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10538 * opaque ticket<1..2^16-1>;
10539 * Extension extensions<0..2^16-2>;
10540 * } NewSessionTicket;
10541 */
10542 proto_tree *subtree;
10543 proto_item *subitem;
10544 uint32_t ticket_len;
10545 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10546 unsigned char draft_version = session->tls13_draft_version;
10547 uint32_t lifetime_hint;
10548
10549 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10550 hf->ett.session_ticket, NULL((void*)0),
10551 "TLS Session Ticket");
10552
10553 /* ticket lifetime hint */
10554 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10555 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10556 offset += 4;
10557
10558 if (lifetime_hint >= 60) {
10559 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10560 proto_item_append_text(subitem, " (%s)", time_str);
10561 }
10562
10563 if (is_tls13) {
10564
10565 /* for TLS 1.3: ticket_age_add */
10566 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10567 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10568 offset += 4;
10569
10570 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10571 if (draft_version == 0 || draft_version >= 21) {
10572 uint32_t ticket_nonce_len;
10573
10574 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10575 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10576 return;
10577 }
10578 offset++;
10579
10580 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10581 offset += ticket_nonce_len;
10582 }
10583
10584 }
10585
10586 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10587 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10588 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10589 return;
10590 }
10591 offset += 2;
10592
10593 /* Content depends on implementation, so just show data! */
10594 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10595 tvb, offset, ticket_len, ENC_NA0x00000000);
10596 /* save the session ticket to cache for ssl_finalize_decryption */
10597 if (ssl && !is_tls13) {
10598 if (ssl->session.is_session_resumed) {
10599 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10600 * (Abbreviated Handshake Using New Session Ticket).
10601 * Restore the master key for this session ticket before saving
10602 * it to the new session ticket. */
10603 ssl_restore_master_key(ssl, "Session Ticket", false0,
10604 session_hash, &ssl->session_ticket);
10605 }
10606 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10607 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10608 ssl->session_ticket.data, ticket_len);
10609 ssl->session_ticket.data_len = ticket_len;
10610 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10611 /* NewSessionTicket is received after the first (client)
10612 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10613 * Since the second CCS has already the session key available it will
10614 * just return. To ensure that the session ticket is mapped to a
10615 * master key (from the first CCS), save the ticket here too. */
10616 ssl_save_master_key("Session Ticket", session_hash,
10617 &ssl->session_ticket, &ssl->master_secret);
10618 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10619 }
10620 offset += ticket_len;
10621
10622 if (is_tls13) {
10623 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10624 offset_end, SSL_HND_NEWSESSION_TICKET,
10625 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10626 }
10627} /* }}} */
10628
10629void
10630ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10631 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10632 SslSession *session, SslDecryptSession *ssl,
10633 bool_Bool is_dtls)
10634{
10635 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10636 * struct {
10637 * ProtocolVersion server_version;
10638 * CipherSuite cipher_suite; // not before draft -19
10639 * Extension extensions<2..2^16-1>;
10640 * } HelloRetryRequest;
10641 * Note: no longer used since draft -22
10642 */
10643 uint32_t version;
10644 uint8_t draft_version;
10645
10646 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10647 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
10648 draft_version = extract_tls13_draft_version(version);
10649 offset += 2;
10650
10651 if (draft_version == 0 || draft_version >= 19) {
10652 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
10653 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10654 offset += 2;
10655 }
10656
10657 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10658 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
10659 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10660}
10661
10662void
10663ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10664 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10665 SslSession *session, SslDecryptSession *ssl,
10666 bool_Bool is_dtls)
10667{
10668 /* RFC 8446 Section 4.3.1
10669 * struct {
10670 * Extension extensions<0..2^16-1>;
10671 * } EncryptedExtensions;
10672 */
10673 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10674 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
10675 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10676}
10677
10678/* Certificate and Certificate Request dissections. {{{ */
10679void
10680ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10681 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
10682 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
10683 bool_Bool is_from_server, bool_Bool is_dtls)
10684{
10685 /* opaque ASN.1Cert<1..2^24-1>;
10686 *
10687 * Before RFC 8446 (TLS <= 1.2):
10688 * struct {
10689 * select(certificate_type) {
10690 *
10691 * // certificate type defined in RFC 7250
10692 * case RawPublicKey:
10693 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
10694 *
10695 * // X.509 certificate defined in RFC 5246
10696 * case X.509:
10697 * ASN.1Cert certificate_list<0..2^24-1>;
10698 * };
10699 * } Certificate;
10700 *
10701 * RFC 8446 (since draft -20):
10702 * struct {
10703 * select(certificate_type){
10704 * case RawPublicKey:
10705 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
10706 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
10707 *
10708 * case X.509:
10709 * opaque cert_data<1..2^24-1>;
10710 * }
10711 * Extension extensions<0..2^16-1>;
10712 * } CertificateEntry;
10713 * struct {
10714 * opaque certificate_request_context<0..2^8-1>;
10715 * CertificateEntry certificate_list<0..2^24-1>;
10716 * } Certificate;
10717 */
10718 enum { CERT_X509, CERT_RPK } cert_type;
10719 asn1_ctx_t asn1_ctx;
10720#if defined(HAVE_LIBGNUTLS1)
10721 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
10722 unsigned certificate_index = 0;
10723#endif
10724 uint32_t next_offset, certificate_list_length, cert_length;
10725 proto_tree *subtree = tree;
10726
10727 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10728
10729 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
10730 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
10731 cert_type = CERT_RPK;
10732 } else {
10733 cert_type = CERT_X509;
10734 }
10735
10736#if defined(HAVE_LIBGNUTLS1)
10737 /* Ask the pkcs1 dissector to return the public key details */
10738 if (ssl)
10739 asn1_ctx.private_data = &subjectPublicKeyInfo;
10740#endif
10741
10742 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
10743 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
10744 uint32_t context_length;
10745 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10746 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10747 return;
10748 }
10749 offset++;
10750 if (context_length > 0) {
10751 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10752 tvb, offset, context_length, ENC_NA0x00000000);
10753 offset += context_length;
10754 }
10755 }
10756
10757 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
10758 /* For RPK before TLS 1.3, the single RPK is stored directly without
10759 * another "certificate_list" field. */
10760 certificate_list_length = offset_end - offset;
10761 next_offset = offset_end;
10762 } else {
10763 /* CertificateEntry certificate_list<0..2^24-1> */
10764 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
10765 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
10766 return;
10767 }
10768 offset += 3; /* 24-bit length value */
10769 next_offset = offset + certificate_list_length;
10770 }
10771
10772 /* RawPublicKey must have one cert, but X.509 can have multiple. */
10773 if (certificate_list_length > 0 && cert_type == CERT_X509) {
10774 proto_item *ti;
10775
10776 ti = proto_tree_add_none_format(tree,
10777 hf->hf.hs_certificates,
10778 tvb, offset, certificate_list_length,
10779 "Certificates (%u bytes)",
10780 certificate_list_length);
10781
10782 /* make it a subtree */
10783 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
10784 }
10785
10786 while (offset < next_offset) {
10787 switch (cert_type) {
10788 case CERT_RPK:
10789 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
10790 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
10791 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10792 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10793 return;
10794 }
10795 offset += 3;
10796
10797 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10798 offset += cert_length;
10799 break;
10800 case CERT_X509:
10801 /* opaque ASN1Cert<1..2^24-1> */
10802 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10803 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10804 return;
10805 }
10806 offset += 3;
10807
10808 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10809#if defined(HAVE_LIBGNUTLS1)
10810 if (is_from_server && ssl && certificate_index == 0) {
10811 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
10812 /* Only attempt to get the RSA modulus for the first cert. */
10813 asn1_ctx.private_data = NULL((void*)0);
10814 }
10815#endif
10816 offset += cert_length;
10817 break;
10818 }
10819
10820 /* TLS 1.3: Extension extensions<0..2^16-1> */
10821 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
10822 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10823 next_offset, SSL_HND_CERTIFICATE,
10824 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10825 }
10826
10827#if defined(HAVE_LIBGNUTLS1)
10828 certificate_index++;
10829#endif
10830 }
10831}
10832
10833void
10834ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10835 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10836 SslSession *session, bool_Bool is_dtls)
10837{
10838 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
10839 * enum {
10840 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10841 * (255)
10842 * } ClientCertificateType;
10843 *
10844 * opaque DistinguishedName<1..2^16-1>;
10845 *
10846 * struct {
10847 * ClientCertificateType certificate_types<1..2^8-1>;
10848 * DistinguishedName certificate_authorities<3..2^16-1>;
10849 * } CertificateRequest;
10850 *
10851 *
10852 * As per TLSv1.2 (RFC 5246) the format has changed to:
10853 *
10854 * enum {
10855 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10856 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
10857 * fortezza_dms_RESERVED(20), (255)
10858 * } ClientCertificateType;
10859 *
10860 * enum {
10861 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
10862 * sha512(6), (255)
10863 * } HashAlgorithm;
10864 *
10865 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
10866 * SignatureAlgorithm;
10867 *
10868 * struct {
10869 * HashAlgorithm hash;
10870 * SignatureAlgorithm signature;
10871 * } SignatureAndHashAlgorithm;
10872 *
10873 * SignatureAndHashAlgorithm
10874 * supported_signature_algorithms<2..2^16-2>;
10875 *
10876 * opaque DistinguishedName<1..2^16-1>;
10877 *
10878 * struct {
10879 * ClientCertificateType certificate_types<1..2^8-1>;
10880 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
10881 * DistinguishedName certificate_authorities<0..2^16-1>;
10882 * } CertificateRequest;
10883 *
10884 * draft-ietf-tls-tls13-18:
10885 * struct {
10886 * opaque certificate_request_context<0..2^8-1>;
10887 * SignatureScheme
10888 * supported_signature_algorithms<2..2^16-2>;
10889 * DistinguishedName certificate_authorities<0..2^16-1>;
10890 * CertificateExtension certificate_extensions<0..2^16-1>;
10891 * } CertificateRequest;
10892 *
10893 * RFC 8446 (since draft-ietf-tls-tls13-19):
10894 *
10895 * struct {
10896 * opaque certificate_request_context<0..2^8-1>;
10897 * Extension extensions<2..2^16-1>;
10898 * } CertificateRequest;
10899 */
10900 proto_item *ti;
10901 proto_tree *subtree;
10902 uint32_t next_offset;
10903 asn1_ctx_t asn1_ctx;
10904 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
10905 unsigned char draft_version = session->tls13_draft_version;
10906
10907 if (!tree)
10908 return;
10909
10910 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10911
10912 if (is_tls13) {
10913 uint32_t context_length;
10914 /* opaque certificate_request_context<0..2^8-1> */
10915 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10916 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10917 return;
10918 }
10919 offset++;
10920 if (context_length > 0) {
10921 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10922 tvb, offset, context_length, ENC_NA0x00000000);
10923 offset += context_length;
10924 }
10925 } else {
10926 uint32_t cert_types_count;
10927 /* ClientCertificateType certificate_types<1..2^8-1> */
10928 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
10929 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
10930 return;
10931 }
10932 offset++;
10933 next_offset = offset + cert_types_count;
10934
10935 ti = proto_tree_add_none_format(tree,
10936 hf->hf.hs_cert_types,
10937 tvb, offset, cert_types_count,
10938 "Certificate types (%u type%s)",
10939 cert_types_count,
10940 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
10941 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
10942
10943 while (offset < next_offset) {
10944 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10945 offset++;
10946 }
10947 }
10948
10949 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
10950 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
10951 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
10952 }
10953
10954 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
10955 /*
10956 * TLS 1.3 draft 19 and newer: Extensions.
10957 * SslDecryptSession pointer is NULL because Certificate Extensions
10958 * should not influence decryption state.
10959 */
10960 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10961 offset_end, SSL_HND_CERT_REQUEST,
10962 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10963 } else if (is_tls13 && draft_version <= 18) {
10964 /*
10965 * TLS 1.3 draft 18 and older: certificate_authorities and
10966 * certificate_extensions (a vector of OID mappings).
10967 */
10968 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
10969 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
10970 } else {
10971 /* for TLS 1.2 and older, the certificate_authorities field. */
10972 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
10973 }
10974}
10975/* Certificate and Certificate Request dissections. }}} */
10976
10977void
10978ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10979 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
10980{
10981 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
10982 hf->hf.hs_client_cert_vrfy_sig_len,
10983 hf->hf.hs_client_cert_vrfy_sig);
10984}
10985
10986/* Finished dissection. {{{ */
10987void
10988ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10989 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10990 const SslSession *session, ssl_hfs_t *ssl_hfs)
10991{
10992 /* For SSLv3:
10993 * struct {
10994 * opaque md5_hash[16];
10995 * opaque sha_hash[20];
10996 * } Finished;
10997 *
10998 * For (D)TLS:
10999 * struct {
11000 * opaque verify_data[12];
11001 * } Finished;
11002 *
11003 * For TLS 1.3:
11004 * struct {
11005 * opaque verify_data[Hash.length];
11006 * }
11007 */
11008 if (!tree)
11009 return;
11010
11011 if (session->version == SSLV3_VERSION0x300) {
11012 if (ssl_hfs != NULL((void*)0)) {
11013 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11014 tvb, offset, 16, ENC_NA0x00000000);
11015 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11016 tvb, offset + 16, 20, ENC_NA0x00000000);
11017 }
11018 } else {
11019 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11020 proto_tree_add_item(tree, hf->hf.hs_finished,
11021 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11022 }
11023} /* }}} */
11024
11025/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11026void
11027ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11028{
11029 uint16_t url_hash_len;
11030
11031 /* enum {
11032 * individual_certs(0), pkipath(1), (255)
11033 * } CertChainType;
11034 *
11035 * struct {
11036 * CertChainType type;
11037 * URLAndHash url_and_hash_list<1..2^16-1>;
11038 * } CertificateURL;
11039 *
11040 * struct {
11041 * opaque url<1..2^16-1>;
11042 * uint8 padding;
11043 * opaque SHA1Hash[20];
11044 * } URLAndHash;
11045 */
11046
11047 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11048 tvb, offset, 1, ENC_NA0x00000000);
11049 offset++;
11050
11051 url_hash_len = tvb_get_ntohs(tvb, offset);
11052 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11053 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11054 offset += 2;
11055 while (url_hash_len-- > 0) {
11056 proto_item *urlhash_item;
11057 proto_tree *urlhash_tree;
11058 uint16_t url_len;
11059
11060 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11061 tvb, offset, -1, ENC_NA0x00000000);
11062 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11063
11064 url_len = tvb_get_ntohs(tvb, offset);
11065 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11066 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11067 offset += 2;
11068
11069 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11070 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11071 offset += url_len;
11072
11073 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11074 tvb, offset, 1, ENC_NA0x00000000);
11075 offset++;
11076 /* Note: RFC 6066 says that padding must be 0x01 */
11077
11078 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11079 tvb, offset, 20, ENC_NA0x00000000);
11080 offset += 20;
11081 }
11082} /* }}} */
11083
11084void
11085ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11086 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11087 SslSession *session, SslDecryptSession *ssl,
11088 bool_Bool is_from_server, bool_Bool is_dtls)
11089{
11090 uint32_t algorithm, uncompressed_length;
11091 uint32_t compressed_certificate_message_length;
11092 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11093 proto_item *ti;
11094 /*
11095 * enum {
11096 * zlib(1),
11097 * brotli(2),
11098 * zstd(3),
11099 * (65535)
11100 * } CertificateCompressionAlgorithm;
11101 *
11102 * struct {
11103 * CertificateCompressionAlgorithm algorithm;
11104 * uint24 uncompressed_length;
11105 * opaque compressed_certificate_message<1..2^24-1>;
11106 * } CompressedCertificate;
11107 */
11108
11109 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11110 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11111 offset += 2;
11112
11113 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11114 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11115 offset += 3;
11116
11117 /* opaque compressed_certificate_message<1..2^24-1>; */
11118 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11119 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11120 return;
11121 }
11122 offset += 3;
11123
11124 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11125 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11126
11127 /* Certificate decompression following algorithm */
11128 switch (algorithm) {
11129 case 1: /* zlib */
11130 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11131 break;
11132 case 2: /* brotli */
11133 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11134 break;
11135 case 3: /* zstd */
11136 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11137 break;
11138 }
11139
11140 if (uncompressed_tvb) {
11141 proto_tree *uncompressed_tree;
11142
11143 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11144 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11145 tvb, offset, offset_end - offset,
11146 "Invalid uncompressed length %u (expected %u)",
11147 tvb_captured_length(uncompressed_tvb),
11148 uncompressed_length);
11149 } else {
11150 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11151 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11152 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11153 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11154 }
11155 }
11156}
11157
11158/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11159static int
11160// NOLINTNEXTLINE(misc-no-recursion)
11161ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11162 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11163 SslSession *session, SslDecryptSession *ssl,
11164 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11165 ssl_master_key_map_t *mk_map)
11166{
11167 uint32_t exts_len;
11168 uint16_t ext_type;
11169 uint32_t ext_len;
11170 uint32_t next_offset;
11171 proto_item *ext_item;
11172 proto_tree *ext_tree;
11173 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11174 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11175 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11176 char *ja3_dash = "";
11177 unsigned supported_version;
11178
11179 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11180 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11181 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11182 return offset_end;
11183 }
11184 offset += 2;
11185 offset_end = offset + exts_len;
11186
11187 if (ja4_data) {
11188 ja4_data->num_extensions = 0;
11189 }
11190 while (offset_end - offset >= 4)
11191 {
11192 ext_type = tvb_get_ntohs(tvb, offset);
11193 ext_len = tvb_get_ntohs(tvb, offset + 2);
11194
11195 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11196 ja4_data->num_extensions += 1;
11197 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11198 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11199 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11200 }
11201 }
11202
11203 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11204 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11205 tls_hello_extension_types,
11206 "Unknown type %u"), ext_len);
11207 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11208
11209 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11210 tvb, offset, 2, ext_type);
11211 offset += 2;
11212 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11213 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11214 ja3_dash = "-";
11215 }
11216
11217 /* opaque extension_data<0..2^16-1> */
11218 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11219 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11220 return offset_end;
11221 }
11222 offset += 2;
11223 next_offset = offset + ext_len;
11224
11225 switch (ext_type) {
11226 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11227 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11228 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11229 if (ja4_data) {
11230 ja4_data->server_name_present = true1;
11231 }
11232 }
11233 break;
11234 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11235 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11236 offset += 1;
11237 break;
11238 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11239 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11240 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11241 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11242 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11243 }
11244 break;
11245 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11246 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11247 offset, next_offset,
11248 hnd_type, ext_type,
11249 session);
11250 break;
11251 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11252 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11253 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11254 next_offset, ja3_sg);
11255 } else {
11256 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11257 next_offset, NULL((void*)0));
11258 }
11259 break;
11260 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11261 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11262 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11263 } else {
11264 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11265 }
11266 break;
11267 case SSL_HND_HELLO_EXT_SRP12:
11268 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11269 break;
11270 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11271 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11272 break;
11273 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11274 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11275 break;
11276 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11277 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11278 break;
11279 case SSL_HND_HELLO_EXT_USE_SRTP14:
11280 if (is_dtls) {
11281 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11282 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11283 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11284 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11285 }
11286 } else {
11287 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11288 }
11289 break;
11290 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11291 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11292 break;
11293 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11294 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11295 break;
11296 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11297 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11298 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11299 offset++;
11300 break;
11301 case SSL_HND_HELLO_EXT_ALPN16:
11302 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11303 break;
11304 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11305 if (hnd_type == SSL_HND_CLIENT_HELLO)
11306 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11307 break;
11308 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11309 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11310 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11311 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11312 break;
11313 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11314 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11315 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11316 offset, next_offset,
11317 hnd_type, ext_type,
11318 session);
11319 break;
11320 case SSL_HND_HELLO_EXT_PADDING21:
11321 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11322 offset += ext_len;
11323 break;
11324 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11325 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11326 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11327 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11328 }
11329 break;
11330 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11331 if (ssl) {
11332 switch (hnd_type) {
11333 case SSL_HND_CLIENT_HELLO:
11334 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11335 break;
11336 case SSL_HND_SERVER_HELLO:
11337 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11338 break;
11339 default: /* no default */
11340 break;
11341 }
11342 }
11343 break;
11344 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11345 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11346 break;
11347 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11348 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11349 break;
11350 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11351 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11352 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11353 offset += 2;
11354 break;
11355 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11356 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11357 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11358 break;
11359 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11360 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11361 break;
11362 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11363 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11364 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11365 break;
11366 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11367 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11368 break;
11369 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11370 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11371 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11372 break;
11373 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11374 switch (hnd_type) {
11375 case SSL_HND_CLIENT_HELLO:
11376 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11377 break;
11378 case SSL_HND_SERVER_HELLO:
11379 case SSL_HND_HELLO_RETRY_REQUEST:
11380 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11381 offset += 2;
11382 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11383 break;
11384 }
11385 break;
11386 case SSL_HND_HELLO_EXT_COOKIE44:
11387 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11388 break;
11389 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11390 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11391 break;
11392 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11393 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11394 break;
11395 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11396 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11397 break;
11398 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11399 break;
11400 case SSL_HND_HELLO_EXT_NPN13172:
11401 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11402 break;
11403 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11404 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11405 break;
11406 case SSL_HND_HELLO_EXT_ALPS17613:
11407 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11408 break;
11409 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11410 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11411 break;
11412 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11413 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11414 break;
11415 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11416 session->deprecated_cid = true1;
11417 /* FALLTHRU */
11418 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11419 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11420 break;
11421 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11422 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11423 break;
11424 default:
11425 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11426 tvb, offset, ext_len, ENC_NA0x00000000);
11427 offset += ext_len;
11428 break;
11429 }
11430
11431 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11432 /* Dissection did not end at expected location, fix it. */
11433 offset = next_offset;
11434 }
11435 }
11436
11437 if (ja3) {
11438 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11439 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11440 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11441 } else {
11442 wmem_strbuf_append_c(ja3, ',');
11443 }
11444 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11445 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11446 } else {
11447 wmem_strbuf_append_c(ja3, ',');
11448 }
11449 }
11450 }
11451
11452 /* Check if Extensions vector is correctly terminated. */
11453 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11454 offset = offset_end;
11455 }
11456
11457 return offset;
11458} /* }}} */
11459
11460
11461/* ClientKeyExchange algo-specific dissectors. {{{ */
11462
11463static void
11464dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11465 proto_tree *tree, uint32_t offset,
11466 uint32_t length)
11467{
11468 int point_len;
11469 proto_tree *ssl_ecdh_tree;
11470
11471 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11472 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11473
11474 /* point */
11475 point_len = tvb_get_uint8(tvb, offset);
11476 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11477 offset, 1, ENC_BIG_ENDIAN0x00000000);
11478 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11479 offset + 1, point_len, ENC_NA0x00000000);
11480}
11481
11482static void
11483dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11484 proto_tree *tree, uint32_t offset, uint32_t length)
11485{
11486 int yc_len;
11487 proto_tree *ssl_dh_tree;
11488
11489 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11490 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11491
11492 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11493 yc_len = tvb_get_ntohs(tvb, offset);
11494 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11495 offset, 2, ENC_BIG_ENDIAN0x00000000);
11496 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11497 offset + 2, yc_len, ENC_NA0x00000000);
11498}
11499
11500static void
11501dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11502 proto_tree *tree, uint32_t offset,
11503 uint32_t length, const SslSession *session)
11504{
11505 int epms_len;
11506 proto_tree *ssl_rsa_tree;
11507
11508 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11509 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11510
11511 /* EncryptedPreMasterSecret.pre_master_secret */
11512 switch (session->version) {
11513 case SSLV2_VERSION0x0002:
11514 case SSLV3_VERSION0x300:
11515 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11516 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11517 * not present. The handshake contents represents the EPMS, see:
11518 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11519 epms_len = length;
11520 break;
11521
11522 default:
11523 /* TLS and DTLS include vector length before EPMS */
11524 epms_len = tvb_get_ntohs(tvb, offset);
11525 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11526 offset, 2, ENC_BIG_ENDIAN0x00000000);
11527 offset += 2;
11528 break;
11529 }
11530 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11531 offset, epms_len, ENC_NA0x00000000);
11532}
11533
11534/* Used in PSK cipher suites */
11535static uint32_t
11536dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11537 proto_tree *tree, uint32_t offset)
11538{
11539 unsigned identity_len;
11540 proto_tree *ssl_psk_tree;
11541
11542 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11543 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11544 /* identity */
11545 identity_len = tvb_get_ntohs(tvb, offset);
11546 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11547 offset, 2, ENC_BIG_ENDIAN0x00000000);
11548 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11549 offset + 2, identity_len, ENC_NA0x00000000);
11550
11551 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11552 return 2 + identity_len;
11553}
11554
11555/* Used in RSA PSK cipher suites */
11556static void
11557dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11558 proto_tree *tree, uint32_t offset,
11559 uint32_t length)
11560{
11561 int identity_len, epms_len;
11562 proto_tree *ssl_psk_tree;
11563
11564 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11565 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11566
11567 /* identity */
11568 identity_len = tvb_get_ntohs(tvb, offset);
11569 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11570 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11571 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11572 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11573 offset += 2 + identity_len;
11574
11575 /* Yc */
11576 epms_len = tvb_get_ntohs(tvb, offset);
11577 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11578 offset, 2, ENC_BIG_ENDIAN0x00000000);
11579 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11580 offset + 2, epms_len, ENC_NA0x00000000);
11581}
11582
11583/* Used in Diffie-Hellman PSK cipher suites */
11584static void
11585dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11586 proto_tree *tree, uint32_t offset, uint32_t length)
11587{
11588 /*
11589 * struct {
11590 * select (KeyExchangeAlgorithm) {
11591 * case diffie_hellman_psk:
11592 * opaque psk_identity<0..2^16-1>;
11593 * ClientDiffieHellmanPublic public;
11594 * } exchange_keys;
11595 * } ClientKeyExchange;
11596 */
11597
11598 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11599 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11600}
11601
11602/* Used in EC Diffie-Hellman PSK cipher suites */
11603static void
11604dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11605 proto_tree *tree, uint32_t offset, uint32_t length)
11606{
11607 /*
11608 * struct {
11609 * select (KeyExchangeAlgorithm) {
11610 * case ec_diffie_hellman_psk:
11611 * opaque psk_identity<0..2^16-1>;
11612 * ClientECDiffieHellmanPublic public;
11613 * } exchange_keys;
11614 * } ClientKeyExchange;
11615 */
11616
11617 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11618 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11619}
11620
11621/* Used in EC J-PAKE cipher suites */
11622static void
11623dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11624 proto_tree *tree, uint32_t offset,
11625 uint32_t length)
11626{
11627 /*
11628 * struct {
11629 * ECPoint V;
11630 * opaque r<1..2^8-1>;
11631 * } ECSchnorrZKP;
11632 *
11633 * struct {
11634 * ECPoint X;
11635 * ECSchnorrZKP zkp;
11636 * } ECJPAKEKeyKP;
11637 *
11638 * struct {
11639 * ECJPAKEKeyKP ecjpake_key_kp;
11640 * } ClientECJPAKEParams;
11641 *
11642 * select (KeyExchangeAlgorithm) {
11643 * case ecjpake:
11644 * ClientECJPAKEParams params;
11645 * } ClientKeyExchange;
11646 */
11647
11648 int point_len;
11649 proto_tree *ssl_ecjpake_tree;
11650
11651 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11652 hf->ett.keyex_params, NULL((void*)0),
11653 "EC J-PAKE Client Params");
11654
11655 /* ECJPAKEKeyKP.X */
11656 point_len = tvb_get_uint8(tvb, offset);
11657 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
11658 offset, 1, ENC_BIG_ENDIAN0x00000000);
11659 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
11660 offset + 1, point_len, ENC_NA0x00000000);
11661 offset += 1 + point_len;
11662
11663 /* ECJPAKEKeyKP.zkp.V */
11664 point_len = tvb_get_uint8(tvb, offset);
11665 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
11666 offset, 1, ENC_BIG_ENDIAN0x00000000);
11667 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
11668 offset + 1, point_len, ENC_NA0x00000000);
11669 offset += 1 + point_len;
11670
11671 /* ECJPAKEKeyKP.zkp.r */
11672 point_len = tvb_get_uint8(tvb, offset);
11673 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
11674 offset, 1, ENC_BIG_ENDIAN0x00000000);
11675 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
11676 offset + 1, point_len, ENC_NA0x00000000);
11677}
11678
11679static void
11680dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11681 proto_tree *tree, uint32_t offset,
11682 uint32_t length)
11683{
11684 int epms_len;
11685 proto_tree *ssl_ecc_sm2_tree;
11686
11687 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11688 hf->ett.keyex_params, NULL((void*)0),
11689 "ECC-SM2 Encrypted PreMaster Secret");
11690
11691 epms_len = tvb_get_ntohs(tvb, offset);
11692 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11693 offset, 2, ENC_BIG_ENDIAN0x00000000);
11694 offset += 2;
11695 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
11696 offset, epms_len, ENC_NA0x00000000);
11697}
11698/* ClientKeyExchange algo-specific dissectors. }}} */
11699
11700
11701/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
11702static uint32_t
11703ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11704 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11705 uint16_t version, int hf_sig_len, int hf_sig)
11706{
11707 uint32_t sig_len;
11708
11709 switch (version) {
11710 case TLSV1DOT2_VERSION0x303:
11711 case DTLSV1DOT2_VERSION0xfefd:
11712 case TLSV1DOT3_VERSION0x304:
11713 case DTLSV1DOT3_VERSION0xfefc:
11714 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
11715 offset += 2;
11716 break;
11717
11718 default:
11719 break;
11720 }
11721
11722 /* Sig */
11723 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
11724 hf_sig_len, 0, UINT16_MAX(65535))) {
11725 return offset_end;
11726 }
11727 offset += 2;
11728 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
11729 offset += sig_len;
11730 return offset;
11731} /* }}} */
11732
11733/* ServerKeyExchange algo-specific dissectors. {{{ */
11734
11735/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
11736static void
11737dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11738 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11739 uint16_t version)
11740{
11741 /*
11742 * TLSv1.2 (RFC 5246 sec 7.4.8)
11743 * struct {
11744 * digitally-signed struct {
11745 * opaque handshake_messages[handshake_messages_length];
11746 * }
11747 * } CertificateVerify;
11748 *
11749 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
11750 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
11751 *
11752 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
11753 * does more hashing including the master secret and padding.
11754 */
11755 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11756 hf->hf.hs_server_keyex_sig_len,
11757 hf->hf.hs_server_keyex_sig);
11758}
11759
11760static uint32_t
11761dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
11762{
11763 /*
11764 * RFC 4492 ECC cipher suites for TLS
11765 *
11766 * struct {
11767 * ECCurveType curve_type;
11768 * select (curve_type) {
11769 * case explicit_prime:
11770 * ...
11771 * case explicit_char2:
11772 * ...
11773 * case named_curve:
11774 * NamedCurve namedcurve;
11775 * };
11776 * } ECParameters;
11777 */
11778
11779 int curve_type;
11780
11781 /* ECParameters.curve_type */
11782 curve_type = tvb_get_uint8(tvb, offset);
11783 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
11784 offset, 1, ENC_BIG_ENDIAN0x00000000);
11785 offset++;
11786
11787 if (curve_type != 3)
11788 return offset_end; /* only named_curves are supported */
11789
11790 /* case curve_type == named_curve; ECParameters.namedcurve */
11791 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
11792 offset, 2, ENC_BIG_ENDIAN0x00000000);
11793 offset += 2;
11794
11795 return offset;
11796}
11797
11798static void
11799dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11800 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11801 uint16_t version, bool_Bool anon)
11802{
11803 /*
11804 * RFC 4492 ECC cipher suites for TLS
11805 *
11806 * struct {
11807 * opaque point <1..2^8-1>;
11808 * } ECPoint;
11809 *
11810 * struct {
11811 * ECParameters curve_params;
11812 * ECPoint public;
11813 * } ServerECDHParams;
11814 *
11815 * select (KeyExchangeAlgorithm) {
11816 * case ec_diffie_hellman:
11817 * ServerECDHParams params;
11818 * Signature signed_params;
11819 * } ServerKeyExchange;
11820 */
11821
11822 int point_len;
11823 proto_tree *ssl_ecdh_tree;
11824
11825 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11826 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
11827
11828 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
11829 if (offset >= offset_end)
11830 return; /* only named_curves are supported */
11831
11832 /* ECPoint.point */
11833 point_len = tvb_get_uint8(tvb, offset);
11834 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
11835 offset, 1, ENC_BIG_ENDIAN0x00000000);
11836 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
11837 offset + 1, point_len, ENC_NA0x00000000);
11838 offset += 1 + point_len;
11839
11840 /* Signature (if non-anonymous KEX) */
11841 if (!anon) {
11842 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
11843 }
11844}
11845
11846static void
11847dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11848 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11849 uint16_t version, bool_Bool anon)
11850{
11851 int p_len, g_len, ys_len;
11852 proto_tree *ssl_dh_tree;
11853
11854 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11855 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
11856
11857 /* p */
11858 p_len = tvb_get_ntohs(tvb, offset);
11859 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
11860 offset, 2, ENC_BIG_ENDIAN0x00000000);
11861 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
11862 offset + 2, p_len, ENC_NA0x00000000);
11863 offset += 2 + p_len;
11864
11865 /* g */
11866 g_len = tvb_get_ntohs(tvb, offset);
11867 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
11868 offset, 2, ENC_BIG_ENDIAN0x00000000);
11869 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
11870 offset + 2, g_len, ENC_NA0x00000000);
11871 offset += 2 + g_len;
11872
11873 /* Ys */
11874 ys_len = tvb_get_ntohs(tvb, offset);
11875 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
11876 offset, 2, ys_len);
11877 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
11878 offset + 2, ys_len, ENC_NA0x00000000);
11879 offset += 2 + ys_len;
11880
11881 /* Signature (if non-anonymous KEX) */
11882 if (!anon) {
11883 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
11884 }
11885}
11886
11887/* Only used in RSA-EXPORT cipher suites */
11888static void
11889dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11890 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11891 uint16_t version)
11892{
11893 int modulus_len, exponent_len;
11894 proto_tree *ssl_rsa_tree;
11895
11896 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11897 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
11898
11899 /* modulus */
11900 modulus_len = tvb_get_ntohs(tvb, offset);
11901 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
11902 offset, 2, ENC_BIG_ENDIAN0x00000000);
11903 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
11904 offset + 2, modulus_len, ENC_NA0x00000000);
11905 offset += 2 + modulus_len;
11906
11907 /* exponent */
11908 exponent_len = tvb_get_ntohs(tvb, offset);
11909 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
11910 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11911 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
11912 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
11913 offset += 2 + exponent_len;
11914
11915 /* Signature */
11916 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
11917}
11918
11919/* Used in RSA PSK and PSK cipher suites */
11920static uint32_t
11921dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11922 proto_tree *tree, uint32_t offset)
11923{
11924 unsigned hint_len;
11925 proto_tree *ssl_psk_tree;
11926
11927 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11928 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
11929
11930 /* hint */
11931 hint_len = tvb_get_ntohs(tvb, offset);
11932 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
11933 offset, 2, ENC_BIG_ENDIAN0x00000000);
11934 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
11935 offset + 2, hint_len, ENC_NA0x00000000);
11936
11937 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
11938 return 2 + hint_len;
11939}
11940
11941/* Used in Diffie-Hellman PSK cipher suites */
11942static void
11943dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11944 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11945{
11946 /*
11947 * struct {
11948 * select (KeyExchangeAlgorithm) {
11949 * case diffie_hellman_psk:
11950 * opaque psk_identity_hint<0..2^16-1>;
11951 * ServerDHParams params;
11952 * };
11953 * } ServerKeyExchange;
11954 */
11955
11956 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
11957 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
11958}
11959
11960/* Used in EC Diffie-Hellman PSK cipher suites */
11961static void
11962dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11963 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11964{
11965 /*
11966 * struct {
11967 * select (KeyExchangeAlgorithm) {
11968 * case ec_diffie_hellman_psk:
11969 * opaque psk_identity_hint<0..2^16-1>;
11970 * ServerECDHParams params;
11971 * };
11972 * } ServerKeyExchange;
11973 */
11974
11975 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
11976 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
11977}
11978
11979/* Used in EC J-PAKE cipher suites */
11980static void
11981dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11982 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11983{
11984 /*
11985 * struct {
11986 * ECPoint V;
11987 * opaque r<1..2^8-1>;
11988 * } ECSchnorrZKP;
11989 *
11990 * struct {
11991 * ECPoint X;
11992 * ECSchnorrZKP zkp;
11993 * } ECJPAKEKeyKP;
11994 *
11995 * struct {
11996 * ECParameters curve_params;
11997 * ECJPAKEKeyKP ecjpake_key_kp;
11998 * } ServerECJPAKEParams;
11999 *
12000 * select (KeyExchangeAlgorithm) {
12001 * case ecjpake:
12002 * ServerECJPAKEParams params;
12003 * } ServerKeyExchange;
12004 */
12005
12006 int point_len;
12007 proto_tree *ssl_ecjpake_tree;
12008
12009 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12010 hf->ett.keyex_params, NULL((void*)0),
12011 "EC J-PAKE Server Params");
12012
12013 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12014 if (offset >= offset_end)
12015 return; /* only named_curves are supported */
12016
12017 /* ECJPAKEKeyKP.X */
12018 point_len = tvb_get_uint8(tvb, offset);
12019 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12020 offset, 1, ENC_BIG_ENDIAN0x00000000);
12021 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12022 offset + 1, point_len, ENC_NA0x00000000);
12023 offset += 1 + point_len;
12024
12025 /* ECJPAKEKeyKP.zkp.V */
12026 point_len = tvb_get_uint8(tvb, offset);
12027 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12028 offset, 1, ENC_BIG_ENDIAN0x00000000);
12029 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12030 offset + 1, point_len, ENC_NA0x00000000);
12031 offset += 1 + point_len;
12032
12033 /* ECJPAKEKeyKP.zkp.r */
12034 point_len = tvb_get_uint8(tvb, offset);
12035 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12036 offset, 1, ENC_BIG_ENDIAN0x00000000);
12037 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12038 offset + 1, point_len, ENC_NA0x00000000);
12039}
12040
12041/* Only used in ECC-SM2-EXPORT cipher suites */
12042static void
12043dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12044 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12045 uint16_t version)
12046{
12047 proto_tree *ssl_ecc_sm2_tree;
12048
12049 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12050 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12051
12052 /* Signature */
12053 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12054}
12055/* ServerKeyExchange algo-specific dissectors. }}} */
12056
12057/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12058void
12059ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12060 proto_tree *tree, uint32_t offset, uint32_t length,
12061 const SslSession *session)
12062{
12063 switch (ssl_get_keyex_alg(session->cipher)) {
12064 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12065 case KEX_DH_DSS0x14:
12066 case KEX_DH_RSA0x15:
12067 case KEX_DHE_DSS0x10:
12068 case KEX_DHE_RSA0x12:
12069 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12070 break;
12071 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12072 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12073 break;
12074 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12075 case KEX_ECDH_ECDSA0x1a:
12076 case KEX_ECDH_RSA0x1b:
12077 case KEX_ECDHE_ECDSA0x16:
12078 case KEX_ECDHE_RSA0x18:
12079 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12080 break;
12081 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12082 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12083 break;
12084 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12085 /* XXX: implement support for KRB5 */
12086 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12087 tvb, offset, length,
12088 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12089 " developers if you want them to be supported");
12090 break;
12091 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12092 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12093 break;
12094 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12095 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12096 break;
12097 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12098 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12099 break;
12100 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12101 case KEX_SRP_SHA_DSS0x21:
12102 case KEX_SRP_SHA_RSA0x22:
12103 /* XXX: implement support for SRP_SHA* */
12104 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12105 tvb, offset, length,
12106 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12107 " developers if you want them to be supported");
12108 break;
12109 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12110 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12111 break;
12112 case KEX_ECC_SM20x26: /* GB/T 38636 */
12113 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12114 break;
12115 default:
12116 if (session->cipher == 0) {
12117 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12118 tvb, offset, length,
12119 "Cipher Suite not found");
12120 } else {
12121 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12122 tvb, offset, length,
12123 "Cipher Suite 0x%04x is not implemented, "
12124 "contact Wireshark developers if you want this to be supported",
12125 session->cipher);
12126 }
12127 break;
12128 }
12129}
12130
12131void
12132ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12133 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12134 const SslSession *session)
12135{
12136 switch (ssl_get_keyex_alg(session->cipher)) {
12137 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12138 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12139 break;
12140 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12141 case KEX_DH_RSA0x15:
12142 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12143 tvb, offset, offset_end - offset);
12144 break;
12145 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12146 case KEX_DHE_RSA0x12:
12147 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12148 break;
12149 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12150 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12151 break;
12152 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12153 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12154 break;
12155 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12156 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12157 break;
12158 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12159 case KEX_ECDH_RSA0x1b:
12160 case KEX_ECDHE_ECDSA0x16:
12161 case KEX_ECDHE_RSA0x18:
12162 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12163 break;
12164 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12165 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12166 tvb, offset, offset_end - offset);
12167 break;
12168 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12169 case KEX_RSA_PSK0x1f:
12170 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12171 break;
12172 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12173 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12174 break;
12175 case KEX_ECC_SM20x26: /* GB/T 38636 */
12176 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12177 break;
12178 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12179 case KEX_SRP_SHA_DSS0x21:
12180 case KEX_SRP_SHA_RSA0x22:
12181 /* XXX: implement support for SRP_SHA* */
12182 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12183 tvb, offset, offset_end - offset,
12184 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12185 " developers if you want them to be supported");
12186 break;
12187 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12188 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12189 break;
12190 default:
12191 if (session->cipher == 0) {
12192 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12193 tvb, offset, offset_end - offset,
12194 "Cipher Suite not found");
12195 } else {
12196 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12197 tvb, offset, offset_end - offset,
12198 "Cipher Suite 0x%04x is not implemented, "
12199 "contact Wireshark developers if you want this to be supported",
12200 session->cipher);
12201 }
12202 break;
12203 }
12204}
12205/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12206
12207void
12208tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12209 proto_tree *tree, uint32_t offset)
12210{
12211 /* RFC 8446 Section 4.6.3
12212 * enum {
12213 * update_not_requested(0), update_requested(1), (255)
12214 * } KeyUpdateRequest;
12215 *
12216 * struct {
12217 * KeyUpdateRequest request_update;
12218 * } KeyUpdate;
12219 */
12220 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12221}
12222
12223void
12224ssl_common_register_ssl_alpn_dissector_table(const char *name,
12225 const char *ui_name, const int proto)
12226{
12227 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12228 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12229 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12230}
12231
12232void
12233ssl_common_register_dtls_alpn_dissector_table(const char *name,
12234 const char *ui_name, const int proto)
12235{
12236 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12237 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12238 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12239}
12240
12241void
12242ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12243{
12244 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12245 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12246 &(options->psk));
12247
12248 if (is_dtls) {
12249 prefs_register_obsolete_preference(module, "keylog_file");
12250 prefs_register_static_text_preference(module, "keylog_file_removed",
12251 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12252 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12253 return;
12254 }
12255
12256 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12257 "The name of a file which contains a list of \n"
12258 "(pre-)master secrets in one of the following formats:\n"
12259 "\n"
12260 "RSA <EPMS> <PMS>\n"
12261 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12262 "CLIENT_RANDOM <CRAND> <MS>\n"
12263 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12264 "\n"
12265 "Where:\n"
12266 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12267 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12268 "<SSLID> = The SSL Session ID\n"
12269 "<MS> = The Master-Secret (MS)\n"
12270 "<CRAND> = The Client's random number from the ClientHello message\n"
12271 "\n"
12272 "(All fields are in hex notation)",
12273 &(options->keylog_filename), false0);
12274}
12275
12276void
12277ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12278{
12279 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12280 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12281 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12282 * negotiated. */
12283 if (!ssl_session)
12284 return;
12285
12286 switch (ssl_session->session.version) {
12287 /* The handshake message types used in the handshake hash are different
12288 * in different versions. [D]TLS 1.3 tracks the messages up to the
12289 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12290 * at the ClientHello and include the messages up to the ServerHello, at
12291 * which point we know the version.
12292 *
12293 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12294 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12295 * format as TLS 1.3). We don't know at the point of the ClientHello which
12296 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12297 *
12298 * XXX - When the server responds with a HelloRetryRequest, for subsequent
12299 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12300 * replaced with a synthentic handhsake message of type "message_hash",
12301 * per RFC 8446 4.4.1. We aren't concerned with that now, as a HRR generally
12302 * rules out PSK-only key exchange, which is what we calculate the hash for
12303 * here. (The possible exception is when a server sends a HRR to reject
12304 * early data but the server and client otherwise agree on psk_ke, if
12305 * any client/server pairs support that.) We do support that in the context
12306 * of computing the hash for Encrypted Client Hello; see elsewhere.
12307 */
12308 case TLSV1DOT3_VERSION0x304:
12309 case DTLSV1DOT3_VERSION0xfefc:
12310 /* In [D]TLS 1.3 only the following handshake messages are used in the
12311 * handshake transcript. EndOfEarlyData and the Client Certificate,
12312 * Certificate Verify, and Finished are used in deriving the
12313 * resumption_master_secret but not the other secrets derived from
12314 * the master secret (client or server app traffic secret, exporter
12315 * secret). We don't yet support calculating a PSK to resume via
12316 * the resumption_master_secret, so we simply stop the transcript
12317 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12318 switch (msg_type) {
12319 case SSL_HND_CLIENT_HELLO:
12320 case SSL_HND_SERVER_HELLO:
12321 case SSL_HND_HELLO_RETRY_REQUEST:
12322 case SSL_HND_ENCRYPTED_EXTENSIONS:
12323 case SSL_HND_CERT_REQUEST:
12324 break;
12325 case SSL_HND_CERTIFICATE:
12326 case SSL_HND_CERT_VERIFY:
12327 case SSL_HND_FINISHED:
12328 if (!is_from_server)
12329 return;
12330 break;
12331 case SSL_HND_END_OF_EARLY_DATA:
12332 default:
12333 return;
12334 }
12335 break;
12336 default:
12337 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12338 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12339 * but the keys are not retrieved until ChangeCipherSpec later. If
12340 * mutual authentication is requested by the server, an intervening
12341 * CertificateVerify message can be sent but is not to be included
12342 * in the hash. */
12343 if (msg_type == SSL_HND_CERT_VERIFY)
12344 return;
12345 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12346 return;
12347 break;
12348 }
12349
12350 uint32_t old_length = ssl_session->handshake_data.data_len;
12351 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12352 if (tvb) {
12353 if (tvb_bytes_exist(tvb, offset, length)) {
12354 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12355 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12356 ssl_session->handshake_data.data_len += length;
12357 }
12358 } else {
12359 /* DTLS calculates the hash as if each handshake message had been
12360 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12361 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12362 */
12363 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12363, (int64_t)length, (int64_t)4))));
12364 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12365 memset(ssl_session->handshake_data.data + old_length, 0, length);
12366 ssl_session->handshake_data.data_len += length;
12367 }
12368}
12369
12370
12371/*
12372 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12373 *
12374 * Local variables:
12375 * c-basic-offset: 4
12376 * tab-width: 8
12377 * indent-tabs-mode: nil
12378 * End:
12379 *
12380 * vi: set shiftwidth=4 tabstop=8 expandtab:
12381 * :indentSize=4:tabSize=8:noTabs=true:
12382 */