Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 4089, column 17
Potential leak of memory pointed to by 'handshake_hashed_data.data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-08-30-100350-3660-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 { 0x0a0a, "GREASE" },
1539 { 0x1a1a, "GREASE" },
1540 { 0x2a2a, "GREASE" },
1541 { 0x3a3a, "GREASE" },
1542 { 0x4a4a, "GREASE" },
1543 { 0x5a5a, "GREASE" },
1544 { 0x6a6a, "GREASE" },
1545 { 0x7a7a, "GREASE" },
1546 { 0x8a8a, "GREASE" },
1547 { 0x9a9a, "GREASE" },
1548 { 0xaaaa, "GREASE" },
1549 { 0xbaba, "GREASE" },
1550 { 0xcaca, "GREASE" },
1551 { 0xdada, "GREASE" },
1552 { 0xeaea, "GREASE" },
1553 { 0xfafa, "GREASE" },
1554 /* PQC digital signature algorithms from OQS-OpenSSL,
1555 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1556 { 0xfea0, "dilithium2" },
1557 { 0xfea1, "p256_dilithium2" },
1558 { 0xfea2, "rsa3072_dilithium2" },
1559 { 0xfea3, "dilithium3" },
1560 { 0xfea4, "p384_dilithium3" },
1561 { 0xfea5, "dilithium5" },
1562 { 0xfea6, "p521_dilithium5" },
1563 { 0xfea7, "dilithium2_aes" },
1564 { 0xfea8, "p256_dilithium2_aes" },
1565 { 0xfea9, "rsa3072_dilithium2_aes" },
1566 { 0xfeaa, "dilithium3_aes" },
1567 { 0xfeab, "p384_dilithium3_aes" },
1568 { 0xfeac, "dilithium5_aes" },
1569 { 0xfead, "p521_dilithium5_aes" },
1570 { 0xfe0b, "falcon512" },
1571 { 0xfe0c, "p256_falcon512" },
1572 { 0xfe0d, "rsa3072_falcon512" },
1573 { 0xfe0e, "falcon1024" },
1574 { 0xfe0f, "p521_falcon1024" },
1575 { 0xfe96, "picnicl1full" },
1576 { 0xfe97, "p256_picnicl1full" },
1577 { 0xfe98, "rsa3072_picnicl1full" },
1578 { 0xfe1b, "picnic3l1" },
1579 { 0xfe1c, "p256_picnic3l1" },
1580 { 0xfe1d, "rsa3072_picnic3l1" },
1581 { 0xfe27, "rainbowIclassic" },
1582 { 0xfe28, "p256_rainbowIclassic" },
1583 { 0xfe29, "rsa3072_rainbowIclassic" },
1584 { 0xfe3c, "rainbowVclassic" },
1585 { 0xfe3d, "p521_rainbowVclassic" },
1586 { 0xfe42, "sphincsharaka128frobust" },
1587 { 0xfe43, "p256_sphincsharaka128frobust" },
1588 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1589 { 0xfe5e, "sphincssha256128frobust" },
1590 { 0xfe5f, "p256_sphincssha256128frobust" },
1591 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1592 { 0xfe7a, "sphincsshake256128frobust" },
1593 { 0xfe7b, "p256_sphincsshake256128frobust" },
1594 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1595 { 0, NULL((void*)0) }
1596};
1597
1598/* RFC 6091 3.1 */
1599const value_string tls_certificate_type[] = {
1600 { 0, "X.509" },
1601 { 1, "OpenPGP" },
1602 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1603 { 0, NULL((void*)0) }
1604};
1605
1606const value_string tls_cert_chain_type[] = {
1607 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1608 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1609 { 0, NULL((void*)0) }
1610};
1611
1612const value_string tls_cert_status_type[] = {
1613 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1614 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1615 { 0, NULL((void*)0) }
1616};
1617
1618/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1619 * Last-Modified Sat, 11 Jul 2026 13:58:00 GMT, 42 entries. */
1620static const bytes_string ct_logids[] = {
1621 { (const uint8_t[]){
1622 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1623 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1624 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1625 },
1626 32, "Google 'Argon2026h1' log" },
1627 { (const uint8_t[]){
1628 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1629 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1630 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1631 },
1632 32, "Google 'Argon2026h2' log" },
1633 { (const uint8_t[]){
1634 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1635 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1636 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1637 },
1638 32, "Google 'Argon2027h1'" },
1639 { (const uint8_t[]){
1640 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1641 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1642 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1643 },
1644 32, "Google 'Xenon2026h1' log" },
1645 { (const uint8_t[]){
1646 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1647 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1648 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1649 },
1650 32, "Google 'Xenon2026h2' log" },
1651 { (const uint8_t[]){
1652 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1653 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1654 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1655 },
1656 32, "Google 'Xenon2027h1'" },
1657 { (const uint8_t[]){
1658 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1659 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1660 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1661 },
1662 32, "Google 'Submariner' log" },
1663 { (const uint8_t[]){
1664 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1665 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1666 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1667 },
1668 32, "Google 'Daedalus' log" },
1669 { (const uint8_t[]){
1670 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1671 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1672 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1673 },
1674 32, "Google 'Testtube' log" },
1675 { (const uint8_t[]){
1676 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1677 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1678 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1679 },
1680 32, "Google 'Crucible' log" },
1681 { (const uint8_t[]){
1682 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1683 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1684 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1685 },
1686 32, "Google 'Solera2026h1' log" },
1687 { (const uint8_t[]){
1688 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1689 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1690 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1691 },
1692 32, "Google 'Solera2026h2' log" },
1693 { (const uint8_t[]){
1694 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1695 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1696 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1697 },
1698 32, "Google 'Solera2027h1' log" },
1699 { (const uint8_t[]){
1700 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1701 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1702 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1703 },
1704 32, "Cloudflare 'Nimbus2026'" },
1705 { (const uint8_t[]){
1706 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1707 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1708 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1709 },
1710 32, "Cloudflare 'Nimbus2027'" },
1711 { (const uint8_t[]){
1712 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1713 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1714 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1715 },
1716 32, "DigiCert 'Wyvern2026h1'" },
1717 { (const uint8_t[]){
1718 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1719 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1720 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1721 },
1722 32, "DigiCert 'Wyvern2026h2'" },
1723 { (const uint8_t[]){
1724 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1725 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1726 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1727 },
1728 32, "DigiCert 'Wyvern2027h1'" },
1729 { (const uint8_t[]){
1730 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1731 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1732 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1733 },
1734 32, "DigiCert 'Wyvern2027h2'" },
1735 { (const uint8_t[]){
1736 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1737 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1738 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1739 },
1740 32, "DigiCert 'Sphinx2026h1'" },
1741 { (const uint8_t[]){
1742 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1743 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1744 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1745 },
1746 32, "DigiCert 'Sphinx2026h2'" },
1747 { (const uint8_t[]){
1748 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1749 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1750 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1751 },
1752 32, "DigiCert 'sphinx2027h1'" },
1753 { (const uint8_t[]){
1754 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1755 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1756 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1757 },
1758 32, "DigiCert 'sphinx2027h2'" },
1759 { (const uint8_t[]){
1760 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1761 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1762 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1763 },
1764 32, "Sectigo 'Mammoth2026h1'" },
1765 { (const uint8_t[]){
1766 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1767 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1768 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1769 },
1770 32, "Sectigo 'Mammoth2026h2'" },
1771 { (const uint8_t[]){
1772 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1773 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1774 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1775 },
1776 32, "Sectigo 'Sabre2026h1'" },
1777 { (const uint8_t[]){
1778 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1779 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1780 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1781 },
1782 32, "Sectigo 'Sabre2026h2'" },
1783 { (const uint8_t[]){
1784 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1785 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1786 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1787 },
1788 32, "Sectigo 'Elephant2026h1'" },
1789 { (const uint8_t[]){
1790 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1791 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1792 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1793 },
1794 32, "Sectigo 'Elephant2026h2'" },
1795 { (const uint8_t[]){
1796 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1797 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1798 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1799 },
1800 32, "Sectigo 'Elephant2027h1'" },
1801 { (const uint8_t[]){
1802 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1803 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1804 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1805 },
1806 32, "Sectigo 'Elephant2027h2'" },
1807 { (const uint8_t[]){
1808 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1809 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1810 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1811 },
1812 32, "Sectigo 'Tiger2026h1'" },
1813 { (const uint8_t[]){
1814 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1815 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1816 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1817 },
1818 32, "Sectigo 'Tiger2026h2'" },
1819 { (const uint8_t[]){
1820 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1821 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1822 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1823 },
1824 32, "Sectigo 'Tiger2027h1'" },
1825 { (const uint8_t[]){
1826 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1827 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1828 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1829 },
1830 32, "Sectigo 'Tiger2027h2'" },
1831 { (const uint8_t[]){
1832 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1833 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1834 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1835 },
1836 32, "Let's Encrypt 'Oak2026h1'" },
1837 { (const uint8_t[]){
1838 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1839 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1840 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1841 },
1842 32, "Let's Encrypt 'Oak2026h2'" },
1843 { (const uint8_t[]){
1844 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1845 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1846 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1847 },
1848 32, "TrustAsia 'log2026a'" },
1849 { (const uint8_t[]){
1850 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1851 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1852 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1853 },
1854 32, "TrustAsia 'log2026b'" },
1855 { (const uint8_t[]){
1856 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1857 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1858 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1859 },
1860 32, "TrustAsia 'HETU2027'" },
1861 { (const uint8_t[]){
1862 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1863 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1864 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1865 },
1866 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1867 { (const uint8_t[]){
1868 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1869 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1870 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1871 },
1872 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1873 { NULL((void*)0), 0, NULL((void*)0) }
1874};
1875
1876/*
1877 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1878 */
1879static dissector_table_t ssl_alpn_dissector_table;
1880static dissector_table_t dtls_alpn_dissector_table;
1881
1882/*
1883 * Special cases for prefix matching of the ALPN, if the ALPN includes
1884 * a version number for a draft or protocol revision.
1885 */
1886typedef struct ssl_alpn_prefix_match_protocol {
1887 const char *proto_prefix;
1888 const char *dissector_name;
1889} ssl_alpn_prefix_match_protocol_t;
1890
1891static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1892 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1893 * already exists 3.1 as of this writing... match the prefix. */
1894 { "spdy/", "spdy" },
1895 /* draft-ietf-httpbis-http2-16 */
1896 { "h2-", "http2" }, /* draft versions */
1897};
1898
1899const value_string compress_certificate_algorithm_vals[] = {
1900 { 1, "zlib" },
1901 { 2, "brotli" },
1902 { 3, "zstd" },
1903 { 0, NULL((void*)0) }
1904};
1905
1906
1907const val64_string quic_transport_parameter_id[] = {
1908 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1909 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1910 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1911 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1912 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1913 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1914 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1915 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1916 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1917 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1918 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1919 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1920 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1921 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1922 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1923 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1924 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1925 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1926 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1927 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1928 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1929 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1930 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1931 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1932 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1933 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1934 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1935 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1936 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1937 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1938 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1939 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1940 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1941 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1942 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1943 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1944 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1945 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1946 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1947 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1948 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1949 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1950 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1951 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1952 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1953 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1954 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1955 { 0, NULL((void*)0) }
1956};
1957
1958/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1959const val64_string quic_address_discovery_vals[] = {
1960 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1961 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1962 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1963 { 0, NULL((void*)0) }
1964};
1965
1966/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1967const val64_string quic_enable_time_stamp_v2_vals[] = {
1968 { 1, "I would like to receive TIME_STAMP frames" },
1969 { 2, "I am able to generate TIME_STAMP frames" },
1970 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1971 { 0, NULL((void*)0) }
1972};
1973
1974/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1975const val64_string quic_enable_multipath_vals[] = {
1976 { 0, "don't support multipath" },
1977 { 1, "support multipath as defined in this document" },
1978 { 0, NULL((void*)0) }
1979};
1980
1981/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
1982const value_string tls_hello_ext_ech_clienthello_types[] = {
1983 { 0, "Outer Client Hello" },
1984 { 1, "Inner Client Hello" },
1985 { 0, NULL((void*)0) }
1986};
1987
1988/* RFC 9180 */
1989const value_string kem_id_type_vals[] = {
1990 { 0x0000, "Reserved" },
1991 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
1992 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
1993 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
1994 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
1995 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
1996 { 0, NULL((void*)0) }
1997};
1998const value_string kdf_id_type_vals[] = {
1999 { 0x0000, "Reserved" },
2000 { 0x0001, "HKDF-SHA256" },
2001 { 0x0002, "HKDF-SHA384" },
2002 { 0x0003, "HKDF-SHA512" },
2003 { 0, NULL((void*)0) }
2004};
2005const value_string aead_id_type_vals[] = {
2006 { 0x0000, "Reserved" },
2007 { 0x0001, "AES-128-GCM" },
2008 { 0x0002, "AES-256-GCM" },
2009 { 0x0003, "ChaCha20Poly1305" },
2010 { 0xFFFF, "Export-only" },
2011 { 0, NULL((void*)0) }
2012};
2013
2014const value_string token_binding_key_parameter_vals[] = {
2015 { 0, "rsa2048_pkcs1.5" },
2016 { 1, "rsa2048_pss" },
2017 { 2, "ecdsap256" },
2018 { 0, NULL((void*)0) }
2019};
2020
2021/* Lookup tables }}} */
2022
2023void
2024quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2025{
2026 const char *label;
2027 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2028 label = "GREASE";
2029 } else {
2030 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2031 }
2032 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2033}
2034
2035/* we keep this internal to packet-tls-utils, as there should be
2036 no need to access it any other way.
2037
2038 This also allows us to hide the dependency on zlib.
2039*/
2040struct _SslDecompress {
2041 int compression;
2042#ifdef USE_ZLIB_OR_ZLIBNG
2043 zlib_stream istream;
2044#endif
2045};
2046
2047/* To assist in parsing client/server key exchange messages
2048 0 indicates unknown */
2049int ssl_get_keyex_alg(int cipher)
2050{
2051 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2052 switch(cipher) {
2053 case 0x0017:
2054 case 0x0018:
2055 case 0x0019:
2056 case 0x001a:
2057 case 0x001b:
2058 case 0x0034:
2059 case 0x003a:
2060 case 0x0046:
2061 case 0x006c:
2062 case 0x006d:
2063 case 0x0089:
2064 case 0x009b:
2065 case 0x00a6:
2066 case 0x00a7:
2067 case 0x00bf:
2068 case 0x00c5:
2069 case 0xc084:
2070 case 0xc085:
2071 return KEX_DH_ANON0x13;
2072 case 0x000b:
2073 case 0x000c:
2074 case 0x000d:
2075 case 0x0030:
2076 case 0x0036:
2077 case 0x003e:
2078 case 0x0042:
2079 case 0x0068:
2080 case 0x0085:
2081 case 0x0097:
2082 case 0x00a4:
2083 case 0x00a5:
2084 case 0x00bb:
2085 case 0x00c1:
2086 case 0xc082:
2087 case 0xc083:
2088 return KEX_DH_DSS0x14;
2089 case 0x000e:
2090 case 0x000f:
2091 case 0x0010:
2092 case 0x0031:
2093 case 0x0037:
2094 case 0x003f:
2095 case 0x0043:
2096 case 0x0069:
2097 case 0x0086:
2098 case 0x0098:
2099 case 0x00a0:
2100 case 0x00a1:
2101 case 0x00bc:
2102 case 0x00c2:
2103 case 0xc07e:
2104 case 0xc07f:
2105 return KEX_DH_RSA0x15;
2106 case 0x0011:
2107 case 0x0012:
2108 case 0x0013:
2109 case 0x0032:
2110 case 0x0038:
2111 case 0x0040:
2112 case 0x0044:
2113 case 0x0063:
2114 case 0x0065:
2115 case 0x0066:
2116 case 0x006a:
2117 case 0x0087:
2118 case 0x0099:
2119 case 0x00a2:
2120 case 0x00a3:
2121 case 0x00bd:
2122 case 0x00c3:
2123 case 0xc080:
2124 case 0xc081:
2125 return KEX_DHE_DSS0x10;
2126 case 0x002d:
2127 case 0x008e:
2128 case 0x008f:
2129 case 0x0090:
2130 case 0x0091:
2131 case 0x00aa:
2132 case 0x00ab:
2133 case 0x00b2:
2134 case 0x00b3:
2135 case 0x00b4:
2136 case 0x00b5:
2137 case 0xc090:
2138 case 0xc091:
2139 case 0xc096:
2140 case 0xc097:
2141 case 0xc0a6:
2142 case 0xc0a7:
2143 case 0xc0aa:
2144 case 0xc0ab:
2145 case 0xccad:
2146 case 0xe41c:
2147 case 0xe41d:
2148 return KEX_DHE_PSK0x11;
2149 case 0x0014:
2150 case 0x0015:
2151 case 0x0016:
2152 case 0x0033:
2153 case 0x0039:
2154 case 0x0045:
2155 case 0x0067:
2156 case 0x006b:
2157 case 0x0088:
2158 case 0x009a:
2159 case 0x009e:
2160 case 0x009f:
2161 case 0x00be:
2162 case 0x00c4:
2163 case 0xc07c:
2164 case 0xc07d:
2165 case 0xc09e:
2166 case 0xc09f:
2167 case 0xc0a2:
2168 case 0xc0a3:
2169 case 0xccaa:
2170 case 0xe41e:
2171 case 0xe41f:
2172 return KEX_DHE_RSA0x12;
2173 case 0xc015:
2174 case 0xc016:
2175 case 0xc017:
2176 case 0xc018:
2177 case 0xc019:
2178 return KEX_ECDH_ANON0x19;
2179 case 0xc001:
2180 case 0xc002:
2181 case 0xc003:
2182 case 0xc004:
2183 case 0xc005:
2184 case 0xc025:
2185 case 0xc026:
2186 case 0xc02d:
2187 case 0xc02e:
2188 case 0xc074:
2189 case 0xc075:
2190 case 0xc088:
2191 case 0xc089:
2192 return KEX_ECDH_ECDSA0x1a;
2193 case 0xc00b:
2194 case 0xc00c:
2195 case 0xc00d:
2196 case 0xc00e:
2197 case 0xc00f:
2198 case 0xc029:
2199 case 0xc02a:
2200 case 0xc031:
2201 case 0xc032:
2202 case 0xc078:
2203 case 0xc079:
2204 case 0xc08c:
2205 case 0xc08d:
2206 return KEX_ECDH_RSA0x1b;
2207 case 0xc006:
2208 case 0xc007:
2209 case 0xc008:
2210 case 0xc009:
2211 case 0xc00a:
2212 case 0xc023:
2213 case 0xc024:
2214 case 0xc02b:
2215 case 0xc02c:
2216 case 0xc072:
2217 case 0xc073:
2218 case 0xc086:
2219 case 0xc087:
2220 case 0xc0ac:
2221 case 0xc0ad:
2222 case 0xc0ae:
2223 case 0xc0af:
2224 case 0xcca9:
2225 case 0xe414:
2226 case 0xe415:
2227 return KEX_ECDHE_ECDSA0x16;
2228 case 0xc033:
2229 case 0xc034:
2230 case 0xc035:
2231 case 0xc036:
2232 case 0xc037:
2233 case 0xc038:
2234 case 0xc039:
2235 case 0xc03a:
2236 case 0xc03b:
2237 case 0xc09a:
2238 case 0xc09b:
2239 case 0xccac:
2240 case 0xe418:
2241 case 0xe419:
2242 case 0xd001:
2243 case 0xd002:
2244 case 0xd003:
2245 case 0xd005:
2246 return KEX_ECDHE_PSK0x17;
2247 case 0xc010:
2248 case 0xc011:
2249 case 0xc012:
2250 case 0xc013:
2251 case 0xc014:
2252 case 0xc027:
2253 case 0xc028:
2254 case 0xc02f:
2255 case 0xc030:
2256 case 0xc076:
2257 case 0xc077:
2258 case 0xc08a:
2259 case 0xc08b:
2260 case 0xcca8:
2261 case 0xe412:
2262 case 0xe413:
2263 return KEX_ECDHE_RSA0x18;
2264 case 0x001e:
2265 case 0x001f:
2266 case 0x0020:
2267 case 0x0021:
2268 case 0x0022:
2269 case 0x0023:
2270 case 0x0024:
2271 case 0x0025:
2272 case 0x0026:
2273 case 0x0027:
2274 case 0x0028:
2275 case 0x0029:
2276 case 0x002a:
2277 case 0x002b:
2278 return KEX_KRB50x1c;
2279 case 0x002c:
2280 case 0x008a:
2281 case 0x008b:
2282 case 0x008c:
2283 case 0x008d:
2284 case 0x00a8:
2285 case 0x00a9:
2286 case 0x00ae:
2287 case 0x00af:
2288 case 0x00b0:
2289 case 0x00b1:
2290 case 0xc064:
2291 case 0xc065:
2292 case 0xc08e:
2293 case 0xc08f:
2294 case 0xc094:
2295 case 0xc095:
2296 case 0xc0a4:
2297 case 0xc0a5:
2298 case 0xc0a8:
2299 case 0xc0a9:
2300 case 0xccab:
2301 case 0xe416:
2302 case 0xe417:
2303 return KEX_PSK0x1d;
2304 case 0x0001:
2305 case 0x0002:
2306 case 0x0003:
2307 case 0x0004:
2308 case 0x0005:
2309 case 0x0006:
2310 case 0x0007:
2311 case 0x0008:
2312 case 0x0009:
2313 case 0x000a:
2314 case 0x002f:
2315 case 0x0035:
2316 case 0x003b:
2317 case 0x003c:
2318 case 0x003d:
2319 case 0x0041:
2320 case 0x0060:
2321 case 0x0061:
2322 case 0x0062:
2323 case 0x0064:
2324 case 0x0084:
2325 case 0x0096:
2326 case 0x009c:
2327 case 0x009d:
2328 case 0x00ba:
2329 case 0x00c0:
2330 case 0xc07a:
2331 case 0xc07b:
2332 case 0xc09c:
2333 case 0xc09d:
2334 case 0xc0a0:
2335 case 0xc0a1:
2336 case 0xe410:
2337 case 0xe411:
2338 case 0xfefe:
2339 case 0xfeff:
2340 case 0xffe0:
2341 case 0xffe1:
2342 return KEX_RSA0x1e;
2343 case 0x002e:
2344 case 0x0092:
2345 case 0x0093:
2346 case 0x0094:
2347 case 0x0095:
2348 case 0x00ac:
2349 case 0x00ad:
2350 case 0x00b6:
2351 case 0x00b7:
2352 case 0x00b8:
2353 case 0x00b9:
2354 case 0xc092:
2355 case 0xc093:
2356 case 0xc098:
2357 case 0xc099:
2358 case 0xccae:
2359 case 0xe41a:
2360 case 0xe41b:
2361 return KEX_RSA_PSK0x1f;
2362 case 0xc01a:
2363 case 0xc01d:
2364 case 0xc020:
2365 return KEX_SRP_SHA0x20;
2366 case 0xc01c:
2367 case 0xc01f:
2368 case 0xc022:
2369 return KEX_SRP_SHA_DSS0x21;
2370 case 0xc01b:
2371 case 0xc01e:
2372 case 0xc021:
2373 return KEX_SRP_SHA_RSA0x22;
2374 case 0xc0ff:
2375 return KEX_ECJPAKE0x24;
2376 case 0xe003:
2377 case 0xe013:
2378 case 0xe053:
2379 return KEX_ECC_SM20x26;
2380 default:
2381 break;
2382 }
2383
2384 return 0;
2385 /* }}} */
2386}
2387
2388static wmem_list_t *connection_id_session_list;
2389
2390void
2391ssl_init_cid_list(void) {
2392 connection_id_session_list = wmem_list_new(wmem_file_scope());
2393}
2394
2395void
2396ssl_cleanup_cid_list(void) {
2397 wmem_destroy_list(connection_id_session_list);
2398}
2399
2400void
2401ssl_add_session_by_cid(SslDecryptSession *session)
2402{
2403 wmem_list_append(connection_id_session_list, session);
2404}
2405
2406SslDecryptSession *
2407ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2408{
2409 SslDecryptSession * ssl_cid = NULL((void*)0);
2410 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2411
2412 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2413 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2414 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2414, "ssl != ((void*)0)"))));
2415 SslSession *session = &ssl->session;
2416
2417 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2418 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2419 ssl_cid = ssl;
2420 }
2421 }
2422
2423 if (session->server_cid_len > 0) {
2424 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2425 ssl_cid = ssl;
2426 }
2427 }
2428
2429 it = wmem_list_frame_next(it);
2430 }
2431
2432 return ssl_cid;
2433}
2434
2435/* StringInfo structure (len + data) functions {{{ */
2436
2437int
2438ssl_data_alloc(StringInfo* str, size_t len)
2439{
2440 str->data = (unsigned char *)g_malloc(len);
16
←
Memory is allocated
→
2441 /* the allocator can return a null pointer for a size equal to 0,
2442 * and that must be allowed */
2443 if (len
16.1
'len' is > 0
 > 0 && !str->data)
17
←
Assuming field 'data' is non-null
→
18
←
Taking false branch
→
2444 return -1;
2445 str->data_len = (unsigned) len;
2446 return 0;
2447}
2448
2449void
2450ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2451{
2452 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2452, "data"))));
2453 memcpy(str->data, data, len);
2454 str->data_len = len;
2455}
2456
2457static int
2458ssl_data_realloc(StringInfo* str, unsigned len)
2459{
2460 str->data = (unsigned char *)g_realloc(str->data, len);
2461 if (!str->data)
2462 return -1;
2463 str->data_len = len;
2464 return 0;
2465}
2466
2467static StringInfo *
2468ssl_data_clone(StringInfo *str)
2469{
2470 StringInfo *cloned_str;
2471 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2472 sizeof(StringInfo) + str->data_len);
2473 cloned_str->data = (unsigned char *) (cloned_str + 1);
2474 ssl_data_set(cloned_str, str->data, str->data_len);
2475 return cloned_str;
2476}
2477
2478static int
2479ssl_data_copy(StringInfo* dst, StringInfo* src)
2480{
2481 if (dst->data_len < src->data_len) {
2482 if (ssl_data_realloc(dst, src->data_len))
2483 return -1;
2484 }
2485 memcpy(dst->data, src->data, src->data_len);
2486 dst->data_len = src->data_len;
2487 return 0;
2488}
2489
2490/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2491 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2492 * success. */
2493static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2494 size_t i;
2495
2496 if (hex_len & 1)
2497 return false0;
2498
2499 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2500 for (i = 0; i < hex_len / 2; i++) {
2501 int a = ws_xton(in[i*2]);
2502 int b = ws_xton(in[i*2 + 1]);
2503 if (a == -1 || b == -1)
2504 return false0;
2505 out->data[i] = a << 4 | b;
2506 }
2507 out->data_len = (unsigned)hex_len / 2;
2508 return true1;
2509}
2510/* StringInfo structure (len + data) functions }}} */
2511
2512
2513/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2514/* hmac abstraction layer */
2515#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2516
2517static inline int
2518ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2519{
2520 gcry_error_t err;
2521 const char *err_str, *err_src;
2522
2523 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2524 if (err != 0) {
2525 err_str = gcry_strerror(err);
2526 err_src = gcry_strsource(err);
2527 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2528 return -1;
2529 }
2530 return 0;
2531}
2532
2533static inline int
2534ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2535{
2536 gcry_error_t err;
2537 const char *err_str, *err_src;
2538
2539 err = gcry_md_setkey (*(md), key, len);
2540 if (err != 0) {
2541 err_str = gcry_strerror(err);
2542 err_src = gcry_strsource(err);
2543 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2544 return -1;
2545 }
2546 return 0;
2547}
2548
2549static inline int
2550ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2551{
2552 gcry_md_reset(*md);
2553 return 0;
2554}
2555
2556static inline void
2557ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2558{
2559 gcry_md_write(*(md), data, len);
2560}
2561static inline void
2562ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2563{
2564 int algo;
2565 unsigned len;
2566
2567 algo = gcry_md_get_algo (*(md));
2568 len = gcry_md_get_algo_dlen(algo);
2569 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2569, "len <= *datalen"))));
2570 memcpy(data, gcry_md_read(*(md), algo), len);
2571 *datalen = len;
2572}
2573static inline void
2574ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2575{
2576 gcry_md_close(*(md));
2577}
2578
2579/* message digest abstraction layer*/
2580#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2581
2582static inline int
2583ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2584{
2585 gcry_error_t err;
2586 const char *err_str, *err_src;
2587 err = gcry_md_open(md,algo, 0);
2588 if (err != 0) {
2589 err_str = gcry_strerror(err);
2590 err_src = gcry_strsource(err);
2591 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2592 return -1;
2593 }
2594 return 0;
2595}
2596static inline void
2597ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2598{
2599 gcry_md_write(*(md), data, len);
2600}
2601static inline void
2602ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2603{
2604 int algo;
2605 int len;
2606 algo = gcry_md_get_algo (*(md));
2607 len = gcry_md_get_algo_dlen (algo);
2608 memcpy(data, gcry_md_read(*(md), algo), len);
2609 *datalen = len;
2610}
2611static inline void
2612ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2613{
2614 gcry_md_close(*(md));
2615}
2616
2617static inline void
2618ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2619{
2620 gcry_md_reset(*md);
2621}
2622
2623/* md5 /sha abstraction layer */
2624#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2625#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2626
2627static inline int
2628ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2629{
2630 gcry_error_t err;
2631 const char *err_str, *err_src;
2632 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2633 if (err != 0) {
2634 err_str = gcry_strerror(err);
2635 err_src = gcry_strsource(err);
2636 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2637 return -1;
2638 }
2639 return 0;
2640}
2641static inline void
2642ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2643{
2644 gcry_md_write(*(md), data, len);
2645}
2646static inline void
2647ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2648{
2649 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2650 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2651}
2652
2653static inline void
2654ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2655{
2656 gcry_md_reset(*md);
2657}
2658
2659static inline void
2660ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2661{
2662 gcry_md_close(*(md));
2663}
2664
2665static inline int
2666ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2667{
2668 gcry_error_t err;
2669 const char *err_str, *err_src;
2670 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2671 if (err != 0) {
2672 err_str = gcry_strerror(err);
2673 err_src = gcry_strsource(err);
2674 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2675 return -1;
2676 }
2677 return 0;
2678}
2679static inline void
2680ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2681{
2682 gcry_md_write(*(md), data, len);
2683}
2684static inline void
2685ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2686{
2687 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2688 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2689}
2690
2691static inline void
2692ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2693{
2694 gcry_md_reset(*md);
2695}
2696
2697static inline void
2698ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2699{
2700 gcry_md_close(*(md));
2701}
2702/* libgcrypt wrappers for HMAC/message digest operations }}} */
2703
2704/* libgcrypt wrappers for Cipher state manipulation {{{ */
2705int
2706ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2707{
2708 int ret;
2709#if 0
2710 unsigned char *ivp;
2711 int i;
2712 gcry_cipher_hd_t c;
2713 c=(gcry_cipher_hd_t)*cipher;
2714#endif
2715 ssl_debug_printf("--------------------------------------------------------------------");
2716#if 0
2717 for(ivp=c->iv,i=0; i < iv_len; i++ )
2718 {
2719 ssl_debug_printf("%d ",ivp[i]);
2720 i++;
2721 }
2722#endif
2723 ssl_debug_printf("--------------------------------------------------------------------");
2724 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2725#if 0
2726 for(ivp=c->iv,i=0; i < iv_len; i++ )
2727 {
2728 ssl_debug_printf("%d ",ivp[i]);
2729 i++;
2730 }
2731#endif
2732 ssl_debug_printf("--------------------------------------------------------------------");
2733 return ret;
2734}
2735/* stream cipher abstraction layer*/
2736static int
2737ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2738 unsigned char* iv, int mode)
2739{
2740 int gcry_modes[] = {
2741 GCRY_CIPHER_MODE_STREAM,
2742 GCRY_CIPHER_MODE_CBC,
2743 GCRY_CIPHER_MODE_GCM,
2744 GCRY_CIPHER_MODE_CCM,
2745 GCRY_CIPHER_MODE_CCM,
2746 GCRY_CIPHER_MODE_POLY1305,
2747 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2748 };
2749 int err;
2750 if (algo == -1) {
2751 /* NULL mode */
2752 *(cipher) = (gcry_cipher_hd_t)-1;
2753 return 0;
2754 }
2755 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2756 if (err !=0)
2757 return -1;
2758 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2759 if (err != 0)
2760 return -1;
2761 /* AEAD cipher suites will set the nonce later. */
2762 if (mode == MODE_CBC) {
2763 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2764 if (err != 0)
2765 return -1;
2766 }
2767 return 0;
2768}
2769static inline int
2770ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2771 const unsigned char * in, int inl)
2772{
2773 if ((*cipher) == (gcry_cipher_hd_t)-1)
2774 {
2775 if (in && inl)
2776 memcpy(out, in, outl < inl ? outl : inl);
2777 return 0;
2778 }
2779 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2780}
2781static inline int
2782ssl_get_digest_by_name(const char*name)
2783{
2784 return gcry_md_map_name(name);
2785}
2786static inline int
2787ssl_get_cipher_by_name(const char* name)
2788{
2789 return gcry_cipher_map_name(name);
2790}
2791
2792static inline void
2793ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2794{
2795 if ((*cipher) != (gcry_cipher_hd_t)-1)
2796 gcry_cipher_close(*cipher);
2797 *cipher = NULL((void*)0);
2798}
2799/* }}} */
2800
2801/* Digests, Ciphers and Cipher Suites registry {{{ */
2802static const SslDigestAlgo digests[]={
2803 {"MD5", 16},
2804 {"SHA1", 20},
2805 {"SHA256", 32},
2806 {"SHA384", 48},
2807 {"SM3", 32},
2808 {"Not Applicable", 0},
2809};
2810
2811#define DIGEST_MAX_SIZE48 48
2812
2813/* get index digest index */
2814static const SslDigestAlgo *
2815ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2816 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2817 return &digests[DIG_NA0x45 - DIG_MD50x40];
2818 }
2819 return &digests[cs->dig - DIG_MD50x40];
2820}
2821
2822static const char *ciphers[]={
2823 "DES",
2824 "3DES",
2825 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2826 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2827 "IDEA",
2828 "AES",
2829 "AES256",
2830 "CAMELLIA128",
2831 "CAMELLIA256",
2832 "SEED",
2833 "CHACHA20", /* since Libgcrypt 1.7.0 */
2834 "SM1",
2835 "SM4",
2836 "*UNKNOWN*"
2837};
2838
2839static const SslCipherSuite cipher_suites[]={
2840 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2841 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2842 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2843 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2844 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2845 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2846 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2847 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2848 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2849 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2850 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2851 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2852 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2853 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2854 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2855 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2856 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2857 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2858 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2859 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2860 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2861 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2862 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2863 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2864 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2865 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2866 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2867 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2868 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2869 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2870 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2871 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2872 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2873 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2874 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2875 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2876 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2877 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2878 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2879 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2880 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2881 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2882 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2883 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2884 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2885 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2886 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2887 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2888 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2889 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2890 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2891 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2892 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2893 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2894 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2895 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2896 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2897 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2898 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2899 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2900 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2901 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2902 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2903 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2904 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2905 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2906 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2907 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2908 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2909 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2910 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2911 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2912 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2913 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2914 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2915 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2916 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2917 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2918 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2919 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2920 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2921 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2922 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2923 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2924 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2925 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2926 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2927 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2928 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2929 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2930 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2931 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2932 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2933 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2934 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2935 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2936 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2937 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2938 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2939 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2940 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2941 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2942 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2943 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2944 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2945 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2946 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2947 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2948 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2949 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2950 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2951 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2952 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2953 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2954 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2955 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2956 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2957 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2958 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2959 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2960 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2961 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2962 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2963 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2964 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2965 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2966 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2967 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2968 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2969 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2970 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2971 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2972 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2973 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2974
2975 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2976 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2977 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
2978 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
2979 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
2980 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
2981 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
2982
2983 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
2984 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
2985 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
2986 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
2987 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
2988 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
2989 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
2990 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
2991 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
2992 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
2993 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
2994 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
2995 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
2996 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
2997 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
2998 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
2999 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3000 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3001 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3002 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3003 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3004 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3005 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3006 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3007 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3008 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3009 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3010 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3011 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3012 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3013 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3014 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3015 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3016 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3017 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3018 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3019 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3020 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3021 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3022 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3023 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3024 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3025 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3026 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3027 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3028 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3029 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3030 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3031 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3032 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3033 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3034 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3035 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3036 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3037 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3038 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3039 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3040 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3041 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3042 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3043 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3044 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3045 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3046 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3047 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3048 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3049 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3050 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3051 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3052 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3053 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3054 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3055 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3056 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3057 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3058 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3059 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3060 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3061 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3062 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3063 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3064 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3065 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3066 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3067 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3068 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3069 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3070 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3071 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3072 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3073 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3074 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3075 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3076 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3077 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3078 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3079 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3080 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3081 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3082 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3083 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3084 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3085 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3086 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3087 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3088 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3089 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3090 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3091 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3092 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3093 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3094 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3095 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3096 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3097 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3098 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3099 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3100 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3101 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3102 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3103 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3104 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3105 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3106 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3107 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3108 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3109 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3110 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3111 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3112 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3113 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3114 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3115 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3116 /* GM */
3117 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3118 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3119 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3120 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3121 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3122 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3123 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3124 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3125 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3126 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3127 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3128 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3129 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3130 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3131 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3132 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3133 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3134 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3135 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3136 {-1, 0, 0, 0, MODE_STREAM}
3137};
3138
3139#define MAX_BLOCK_SIZE16 16
3140#define MAX_KEY_SIZE32 32
3141
3142const SslCipherSuite *
3143ssl_find_cipher(int num)
3144{
3145 const SslCipherSuite *c;
3146 for(c=cipher_suites;c->number!=-1;c++){
3147 if(c->number==num){
3148 return c;
3149 }
3150 }
3151
3152 return NULL((void*)0);
3153}
3154
3155int
3156ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3157{
3158 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3159}
3160
3161unsigned
3162ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3163{
3164 int cipher_algo;
3165 if (cipher_suite->mode != MODE_CBC) return 0;
3166 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3167 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3168}
3169
3170static unsigned
3171ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3172{
3173 switch (cipher_suite_num) {
3174 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3175 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3176 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3177 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3178 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3179 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3180 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3181 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3182 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3183 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3184 return 5;
3185
3186 /* not defined in below draft, but "implemented by several vendors",
3187 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3188 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3189 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3190 return 7;
3191
3192 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3193 * used 7. Until a pcap proves 8, let's use the old value. Link:
3194 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3195 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3196 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3197 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3198 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3199 return 7;
3200
3201 default:
3202 return 0;
3203 }
3204}
3205
3206/* Digests, Ciphers and Cipher Suites registry }}} */
3207
3208
3209/* HMAC and the Pseudorandom function {{{ */
3210static int
3211tls_hash(StringInfo *secret, StringInfo *seed, int md,
3212 StringInfo *out, unsigned out_len)
3213{
3214 /* RFC 2246 5. HMAC and the pseudorandom function
3215 * '+' denotes concatenation.
3216 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3217 * HMAC_hash(secret, A(2) + seed) + ...
3218 * A(0) = seed
3219 * A(i) = HMAC_hash(secret, A(i - 1))
3220 */
3221 uint8_t *ptr;
3222 unsigned left, tocpy;
3223 uint8_t *A;
3224 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3225 unsigned A_l, tmp_l;
3226 SSL_HMACgcry_md_hd_t hm;
3227
3228 ptr = out->data;
3229 left = out_len;
3230
3231 ssl_print_string("tls_hash: hash secret", secret);
3232 ssl_print_string("tls_hash: hash seed", seed);
3233 /* A(0) = seed */
3234 A = seed->data;
3235 A_l = seed->data_len;
3236
3237 if (ssl_hmac_init(&hm, md) != 0) {
3238 return -1;
3239 }
3240 while (left) {
3241 /* A(i) = HMAC_hash(secret, A(i-1)) */
3242 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3243 ssl_hmac_update(&hm, A, A_l);
3244 A_l = sizeof(_A); /* upper bound len for hash output */
3245 ssl_hmac_final(&hm, _A, &A_l);
3246 A = _A;
3247
3248 /* HMAC_hash(secret, A(i) + seed) */
3249 ssl_hmac_reset(&hm);
3250 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3251 ssl_hmac_update(&hm, A, A_l);
3252 ssl_hmac_update(&hm, seed->data, seed->data_len);
3253 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3254 ssl_hmac_final(&hm, tmp, &tmp_l);
3255 ssl_hmac_reset(&hm);
3256
3257 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3258 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3259 memcpy(ptr, tmp, tocpy);
3260 ptr += tocpy;
3261 left -= tocpy;
3262 }
3263 ssl_hmac_cleanup(&hm);
3264 out->data_len = out_len;
3265
3266 ssl_print_string("hash out", out);
3267 return 0;
3268}
3269
3270static bool_Bool
3271tls_prf(StringInfo* secret, const char *usage,
3272 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3273{
3274 StringInfo seed, sha_out, md5_out;
3275 uint8_t *ptr;
3276 StringInfo s1, s2;
3277 unsigned i,s_l;
3278 size_t usage_len, rnd2_len;
3279 bool_Bool success = false0;
3280 usage_len = strlen(usage);
3281 rnd2_len = rnd2 ? rnd2->data_len : 0;
3282
3283 /* initialize buffer for sha, md5 random seed*/
3284 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3285 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3286 return false0;
3287 }
3288 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3289 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3290 goto free_sha;
3291 }
3292 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3293 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3294 (int) (usage_len+rnd1->data_len+rnd2_len));
3295 goto free_md5;
3296 }
3297
3298 ptr=seed.data;
3299 memcpy(ptr,usage,usage_len);
3300 ptr+=usage_len;
3301 memcpy(ptr,rnd1->data,rnd1->data_len);
3302 if (rnd2_len > 0) {
3303 ptr+=rnd1->data_len;
3304 memcpy(ptr,rnd2->data,rnd2->data_len);
3305 /*ptr+=rnd2->data_len;*/
3306 }
3307
3308 /* initialize buffer for client/server seeds*/
3309 s_l=secret->data_len/2 + secret->data_len%2;
3310 if (ssl_data_alloc(&s1, s_l) < 0) {
3311 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3312 goto free_seed;
3313 }
3314 if (ssl_data_alloc(&s2, s_l) < 0) {
3315 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3316 goto free_s1;
3317 }
3318
3319 memcpy(s1.data,secret->data,s_l);
3320 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3321
3322 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3323 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3324 goto free_s2;
3325 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3326 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3327 goto free_s2;
3328
3329 for (i = 0; i < out_len; i++)
3330 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3331 /* success, now store the new meaningful data length */
3332 out->data_len = out_len;
3333 success = true1;
3334
3335 ssl_print_string("PRF out",out);
3336free_s2:
3337 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3338free_s1:
3339 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3340free_seed:
3341 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3342free_md5:
3343 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3344free_sha:
3345 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3346 return success;
3347}
3348
3349static bool_Bool
3350tls12_prf(int md, StringInfo* secret, const char* usage,
3351 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3352{
3353 StringInfo label_seed;
3354 int success;
3355 size_t usage_len, rnd2_len;
3356 rnd2_len = rnd2 ? rnd2->data_len : 0;
3357
3358 usage_len = strlen(usage);
3359 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3360 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3361 return false0;
3362 }
3363 memcpy(label_seed.data, usage, usage_len);
3364 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3365 if (rnd2_len > 0)
3366 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3367
3368 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3369 success = tls_hash(secret, &label_seed, md, out, out_len);
3370 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3371 if(success != -1){
3372 ssl_print_string("PRF out", out);
3373 return true1;
3374 }
3375 return false0;
3376}
3377
3378static bool_Bool
3379ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3380 StringInfo *out, unsigned out_len)
3381{
3382 SSL_MD5_CTXgcry_md_hd_t md5;
3383 uint8_t tmp[16];
3384
3385 if (ssl_md5_init(&md5) != 0) {
3386 return false0;
3387 }
3388 ssl_md5_update(&md5,r1->data,r1->data_len);
3389 ssl_md5_update(&md5,r2->data,r2->data_len);
3390 ssl_md5_final(tmp,&md5);
3391 ssl_md5_cleanup(&md5);
3392
3393 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3393, "out_len <= sizeof(tmp)"))));
3394 ssl_data_set(out, tmp, out_len);
3395 ssl_print_string("export iv", out);
3396 return true1;
3397}
3398
3399static bool_Bool
3400ssl3_prf(StringInfo* secret, const char* usage,
3401 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3402{
3403 SSL_MD5_CTXgcry_md_hd_t md5;
3404 SSL_SHA_CTXgcry_md_hd_t sha;
3405 unsigned off;
3406 int i = 0,j;
3407 uint8_t buf[20];
3408
3409 if (ssl_sha_init(&sha) != 0) {
3410 return false0;
3411 }
3412 if (ssl_md5_init(&md5) != 0) {
3413 ssl_sha_cleanup(&sha);
3414 return false0;
3415 }
3416 for (off = 0; off < out_len; off += 16) {
3417 unsigned char outbuf[16];
3418 i++;
3419
3420 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3421 /* A, BB, CCC, ... */
3422 for(j=0;j<i;j++){
3423 buf[j]=64+i;
3424 }
3425
3426 ssl_sha_update(&sha,buf,i);
3427 ssl_sha_update(&sha,secret->data,secret->data_len);
3428
3429 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3430 if (rnd2)
3431 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3432 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3433 }
3434 else{
3435 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3436 if (rnd2)
3437 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3438 }
3439
3440 ssl_sha_final(buf,&sha);
3441 ssl_sha_reset(&sha);
3442
3443 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3444 secret->data_len);
3445 ssl_md5_update(&md5,secret->data,secret->data_len);
3446 ssl_md5_update(&md5,buf,20);
3447 ssl_md5_final(outbuf,&md5);
3448 ssl_md5_reset(&md5);
3449
3450 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3451 }
3452 ssl_sha_cleanup(&sha);
3453 ssl_md5_cleanup(&md5);
3454 out->data_len = out_len;
3455
3456 return true1;
3457}
3458
3459/* out_len is the wanted output length for the pseudorandom function.
3460 * Ensure that ssl->cipher_suite is set. */
3461static bool_Bool
3462prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3463 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3464{
3465 switch (ssl->session.version) {
3466 case SSLV3_VERSION0x300:
3467 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3468
3469 case TLSV1_VERSION0x301:
3470 case TLSV1DOT1_VERSION0x302:
3471 case DTLSV1DOT0_VERSION0xfeff:
3472 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3473 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3474
3475 default: /* TLSv1.2 */
3476 switch (ssl->cipher_suite->dig) {
3477 case DIG_SM30x44:
3478#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3479 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3480 out, out_len);
3481#else
3482 return false0;
3483#endif
3484 case DIG_SHA3840x43:
3485 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3486 out, out_len);
3487 default:
3488 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3489 out, out_len);
3490 }
3491 }
3492}
3493
3494static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3495{
3496 SSL_MD5_CTXgcry_md_hd_t md5;
3497 SSL_SHA_CTXgcry_md_hd_t sha;
3498
3499 if (ssl_data_alloc(out, 36) < 0)
15
←
Calling 'ssl_data_alloc'
→
19
←
Returned allocated memory
→
20
←
Taking false branch
→
3500 return -1;
3501
3502 if (ssl_md5_init(&md5) != 0)
21
←
Taking true branch
→
3503 return -1;
3504 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
3505 ssl_md5_final(out->data,&md5);
3506 ssl_md5_cleanup(&md5);
3507
3508 if (ssl_sha_init(&sha) != 0)
3509 return -1;
3510 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
3511 ssl_sha_final(out->data+16,&sha);
3512 ssl_sha_cleanup(&sha);
3513 return 0;
3514}
3515
3516static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3517{
3518 SSL_MDgcry_md_hd_t mc;
3519 uint8_t tmp[48];
3520 unsigned len;
3521
3522 if (ssl_md_init(&mc, md) != 0)
3523 return -1;
3524 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
3525 ssl_md_final(&mc, tmp, &len);
3526 ssl_md_cleanup(&mc);
3527
3528 if (ssl_data_alloc(out, len) < 0)
3529 return -1;
3530 memcpy(out->data, tmp, len);
3531 return 0;
3532}
3533
3534bool_Bool
3535tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3536{
3537 if (!tls_psk || (tls_psk[0] == 0)) {
3538 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3539 return false0;
3540 }
3541
3542 wmem_free(wmem_file_scope(), tls_session->psk.data);
3543 /* convert hex string into char*/
3544 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3545 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3546 G_STRFUNC((const char*) (__func__)));
3547 return false0;
3548 }
3549
3550 if (tls_session->psk.data_len >= (2 << 15)) {
3551 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3552 G_STRFUNC((const char*) (__func__)));
3553 wmem_free(wmem_file_scope(), tls_session->psk.data);
3554 tls_session->psk.data = NULL((void*)0);
3555 tls_session->psk.data_len = 0;
3556 return false0;
3557 }
3558
3559 return true1;
3560}
3561
3562/**
3563 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3564 * inlined and removed once support for draft 19 and before is dropped.
3565 */
3566static inline const char *
3567tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3568{
3569 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3570 return "TLS 1.3, ";
3571 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3572 return "dtls13";
3573 } else {
3574 return "tls13 ";
3575 }
3576}
3577
3578/*
3579 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3580 * custom label prefix. If "context_hash" is NULL, then an empty context is
3581 * used. Otherwise it must have the same length as the hash algorithm output.
3582 */
3583bool_Bool
3584tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3585 const char *label_prefix, const char *label,
3586 const uint8_t *context_hash, uint8_t context_length,
3587 uint16_t out_len, unsigned char **out)
3588{
3589 /* RFC 8446 Section 7.1:
3590 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3591 * HKDF-Expand(Secret, HkdfLabel, Length)
3592 * struct {
3593 * uint16 length = Length;
3594 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3595 * opaque context<0..255> = Context;
3596 * } HkdfLabel;
3597 *
3598 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3599 * HKDF-Expand(PRK, info, L) -> OKM
3600 */
3601 gcry_error_t err;
3602 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3603 const unsigned label_length = (unsigned) strlen(label);
3604
3605 /* Some sanity checks */
3606 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3606, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3607
3608 /* info = HkdfLabel { length, label, context } */
3609 GByteArray *info = g_byte_array_new();
3610 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3611 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3612
3613 const uint8_t label_vector_length = label_prefix_length + label_length;
3614 g_byte_array_append(info, &label_vector_length, 1);
3615 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3616 g_byte_array_append(info, (const uint8_t*)label, label_length);
3617
3618 g_byte_array_append(info, &context_length, 1);
3619 if (context_length) {
3620 g_byte_array_append(info, context_hash, context_length);
3621 }
3622
3623 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3624 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3625 g_byte_array_free(info, true1);
3626
3627 if (err) {
3628 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3629 wmem_free(NULL((void*)0), *out);
3630 *out = NULL((void*)0);
3631 return false0;
3632 }
3633
3634 return true1;
3635}
3636
3637bool_Bool
3638tls13_hkdf_expand_label(int md, const StringInfo *secret,
3639 const char *label_prefix, const char *label,
3640 uint16_t out_len, unsigned char **out)
3641{
3642 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3643}
3644
3645static bool_Bool
3646tls13_derive_secret(int md, const StringInfo *secret,
3647 const char *label_prefix, const char *label,
3648 const uint8_t *context, unsigned context_length,
3649 uint16_t out_len, unsigned char **out)
3650{
3651 SSL_MDgcry_md_hd_t mc;
3652 uint8_t context_hash[DIGEST_MAX_SIZE48];
3653 unsigned hash_len;
3654
3655 if (ssl_md_init(&mc, md) != 0)
3656 return false0;
3657 ssl_md_update(&mc, context, context_length);
3658 ssl_md_final(&mc, context_hash, &hash_len);
3659 ssl_md_cleanup(&mc);
3660
3661 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3662}
3663
3664/* HMAC and the Pseudorandom function }}} */
3665
3666/* Record Decompression (after decryption) {{{ */
3667#ifdef USE_ZLIB_OR_ZLIBNG
3668/* memory allocation functions for zlib initialization */
3669static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3670{
3671 return g_malloc0(no*size);
3672}
3673static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3674{
3675 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3676}
3677#endif /* USE_ZLIB_OR_ZLIBNG */
3678
3679static SslDecompress*
3680ssl_create_decompressor(int compression)
3681{
3682 SslDecompress *decomp;
3683#ifdef USE_ZLIB_OR_ZLIBNG
3684 int err;
3685#endif
3686
3687 if (compression == 0) return NULL((void*)0);
3688 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3689 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3690 decomp->compression = compression;
3691 switch (decomp->compression) {
3692#ifdef USE_ZLIB_OR_ZLIBNG
3693 case 1: /* DEFLATE */
3694 decomp->istream.zalloc = ssl_zalloc;
3695 decomp->istream.zfree = ssl_zfree;
3696 decomp->istream.opaque = Z_NULL0;
3697 decomp->istream.next_in = Z_NULL0;
3698 decomp->istream.next_out = Z_NULL0;
3699 decomp->istream.avail_in = 0;
3700 decomp->istream.avail_out = 0;
3701 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3702 if (err != Z_OK0) {
3703 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3704 return NULL((void*)0);
3705 }
3706 break;
3707#endif /* USE_ZLIB_OR_ZLIBNG */
3708 default:
3709 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3710 return NULL((void*)0);
3711 }
3712 return decomp;
3713}
3714
3715#ifdef USE_ZLIB_OR_ZLIBNG
3716static int
3717ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3718{
3719 int err;
3720
3721 switch (decomp->compression) {
3722 case 1: /* DEFLATE */
3723 err = Z_OK0;
3724 if (out_str->data_len < 16384) { /* maximal plain length */
3725 ssl_data_realloc(out_str, 16384);
3726 }
3727#ifdef z_constconst
3728 decomp->istream.next_in = in;
3729#else
3730DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3731 decomp->istream.next_in = (Bytef *)in;
3732DIAG_ON(cast-qual)clang diagnostic pop
3733#endif
3734 decomp->istream.avail_in = inl;
3735 decomp->istream.next_out = out_str->data;
3736 decomp->istream.avail_out = out_str->data_len;
3737 if (inl > 0)
3738 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3739 if (err != Z_OK0) {
3740 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3741 return -1;
3742 }
3743 *outl = out_str->data_len - decomp->istream.avail_out;
3744 break;
3745 default:
3746 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3747 return -1;
3748 }
3749 return 0;
3750}
3751#else /* USE_ZLIB_OR_ZLIBNG */
3752int
3753ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3754{
3755 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3756 return -1;
3757}
3758#endif /* USE_ZLIB_OR_ZLIBNG */
3759/* Record Decompression (after decryption) }}} */
3760
3761/* Create a new structure to store decrypted chunks. {{{ */
3762static SslFlow*
3763ssl_create_flow(void)
3764{
3765 SslFlow *flow;
3766
3767 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3768 flow->byte_seq = 0;
3769 flow->flags = 0;
3770 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3771 return flow;
3772}
3773/* }}} */
3774
3775/* Use the negotiated security parameters for decryption. {{{ */
3776void
3777ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3778{
3779 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3780 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3781 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3782 *new_decoder ? "" : " (No decoder found - retransmission?)");
3783 if (*new_decoder) {
3784 *dest = *new_decoder;
3785 *new_decoder = NULL((void*)0);
3786 }
3787}
3788/* }}} */
3789
3790/* Init cipher state given some security parameters. {{{ */
3791static bool_Bool
3792ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3793
3794static SslDecoder*
3795ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3796 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3797{
3798 SslDecoder *dec;
3799 ssl_cipher_mode_t mode = cipher_suite->mode;
3800
3801 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3802 /* init mac buffer: mac storage is embedded into decoder struct to save a
3803 memory allocation and waste samo more memory*/
3804 dec->cipher_suite=cipher_suite;
3805 dec->compression = compression;
3806 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
3807 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
3808 // the special case for NULL ciphers, even if there is insufficiency
3809 // keying material (including MAC key), we will can still create
3810 // decoders since "decryption" is easy for such ciphers.
3811 dec->mac_key.data = dec->_mac_key_or_write_iv;
3812 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
3813 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
3814 // Input for the nonce, to be used with AEAD ciphers.
3815 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3815, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
3816 dec->write_iv.data = dec->_mac_key_or_write_iv;
3817 ssl_data_set(&dec->write_iv, iv, iv_length);
3818 }
3819 dec->seq = 0;
3820 dec->decomp = ssl_create_decompressor(compression);
3821 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
3822
3823 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
3824 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
3825 cipher_algo, cipher_suite->mode);
3826 return NULL((void*)0);
3827 }
3828
3829 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
3830 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
3831 mode = MODE_ECB;
3832 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
3833 mode = MODE_STREAM;
3834 } else {
3835 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
3836 return NULL((void*)0);
3837 }
3838
3839 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
3840 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
3841 cipher_algo, MODE_ECB);
3842 ssl_cipher_cleanup(&dec->evp);
3843 dec->evp = NULL((void*)0);
3844 return NULL((void*)0);
3845 }
3846 } else {
3847 dec->sn_evp = NULL((void*)0);
3848 }
3849
3850 dec->dtls13_aad.data = NULL((void*)0);
3851 dec->dtls13_aad.data_len = 0;
3852 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
3853 return dec;
3854}
3855
3856static bool_Bool
3857ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
3858{
3859 SslDecoder *dec = (SslDecoder *) user_data;
3860
3861 if (dec->evp)
3862 ssl_cipher_cleanup(&dec->evp);
3863 if (dec->sn_evp)
3864 ssl_cipher_cleanup(&dec->sn_evp);
3865
3866#ifdef USE_ZLIB_OR_ZLIBNG
3867 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
3868 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
3869#endif
3870
3871 return false0;
3872}
3873/* }}} */
3874
3875/* (Pre-)master secrets calculations {{{ */
3876#ifdef HAVE_LIBGNUTLS1
3877static bool_Bool
3878ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
3879 StringInfo *encrypted_pre_master,
3880 GHashTable *key_hash);
3881#endif /* HAVE_LIBGNUTLS */
3882
3883static bool_Bool
3884ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
3885 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
3886
3887bool_Bool
3888ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
3889 uint32_t length, tvbuff_t *tvb, uint32_t offset,
3890 const char *ssl_psk, packet_info *pinfo,
3891#ifdef HAVE_LIBGNUTLS1
3892 GHashTable *key_hash,
3893#endif
3894 const ssl_master_key_map_t *mk_map)
3895{
3896 /* check for required session data */
3897 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
3898 G_STRFUNC((const char*) (__func__)), ssl_session->state);
3899 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
3900 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
3901 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
3902 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
3903 return false0;
3904 }
3905
3906 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
3907 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
3908 return false0;
3909 }
3910
3911 /* check to see if the PMS was provided to us*/
3912 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
3913 mk_map->pms, &ssl_session->client_random)) {
3914 return true1;
3915 }
3916
3917 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
3918 {
3919 /* calculate pre master secret*/
3920 StringInfo pre_master_secret;
3921 unsigned psk_len, pre_master_len;
3922
3923 if (!tls_load_psk(ssl_session, ssl_psk)) {
3924 return false0;
3925 }
3926 psk_len = ssl_session->psk.data_len;
3927
3928 pre_master_len = psk_len * 2 + 4;
3929
3930 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
3931 pre_master_secret.data_len = pre_master_len;
3932 /* 2 bytes psk_len*/
3933 pre_master_secret.data[0] = psk_len >> 8;
3934 pre_master_secret.data[1] = psk_len & 0xFF;
3935 /* psk_len bytes times 0*/
3936 memset(&pre_master_secret.data[2], 0, psk_len);
3937 /* 2 bytes psk_len*/
3938 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
3939 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
3940 /* psk*/
3941 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
3942
3943 ssl_session->pre_master_secret.data = pre_master_secret.data;
3944 ssl_session->pre_master_secret.data_len = pre_master_len;
3945 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
3946
3947 /* Remove the master secret if it was there.
3948 This forces keying material regeneration in
3949 case we're renegotiating */
3950 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
3951 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
3952 return true1;
3953 }
3954 else
3955 {
3956 unsigned encrlen, skip;
3957 encrlen = length;
3958 skip = 0;
3959
3960 /* get encrypted data, on tls1 we have to skip two bytes
3961 * (it's the encrypted len and should be equal to record len - 2)
3962 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
3963 */
3964 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
3965 (ssl_session->session.version == TLSV1_VERSION0x301 ||
3966 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
3967 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
3968 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
3969 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
3970 ssl_session->session.version == TLCPV1_VERSION0x101 ))
3971 {
3972 encrlen = tvb_get_ntohs(tvb, offset);
3973 skip = 2;
3974 if (encrlen > length - 2)
3975 {
3976 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
3977 G_STRFUNC((const char*) (__func__)), encrlen, length);
3978 return false0;
3979 }
3980 }
3981 /* the valid lower bound is higher than 8, but it is sufficient for the
3982 * ssl keylog file below */
3983 if (encrlen < 8) {
3984 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
3985 G_STRFUNC((const char*) (__func__)), encrlen);
3986 return false0;
3987 }
3988
3989 StringInfo encrypted_pre_master = {
3990 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
3991 .data_len = encrlen,
3992 };
3993
3994#ifdef HAVE_LIBGNUTLS1
3995 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
3996 if (ssl_session->cert_key_id) {
3997 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
3998 return true1;
3999
4000 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4001 G_STRFUNC((const char*) (__func__)));
4002 }
4003#endif /* HAVE_LIBGNUTLS */
4004
4005 /* try to find the pre-master secret from the encrypted one. The
4006 * ssl key logfile stores only the first 8 bytes, so truncate it */
4007 encrypted_pre_master.data_len = 8;
4008 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4009 true1, mk_map->pre_master, &encrypted_pre_master))
4010 return true1;
4011 }
4012 return false0;
4013}
4014
4015/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4016int
4017ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4018{
4019 StringInfo key_block = { NULL((void*)0), 0 };
4020 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4021 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4022 int needed;
4023 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4024 unsigned encr_key_len, write_iv_len = 0;
4025 bool_Bool is_export_cipher;
4026 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4027 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4028 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4029
4030 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4031 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
1
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
→
2
←
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
→
3
←
Taking false branch
→
4032 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4033 return -1;
4034 }
4035
4036 /* check for enough info to proceed */
4037 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4038 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4039 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4
←
Assuming the condition is false
→
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
4040 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4041 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4042 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4043 /* Special case: for NULL encryption, allow dissection of data even if
4044 * the Client Hello is missing (MAC keys are now skipped though). */
4045 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4046 if ((ssl_session->state & need_all) == need_all &&
4047 cipher_suite->enc == ENC_NULL0x3D) {
4048 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4049 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4050 goto create_decoders;
4051 }
4052
4053 return -1;
4054 }
4055
4056 /* if master key is not available, generate is from the pre-master secret */
4057 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
7
←
Assuming the condition is true
→
8
←
Taking true branch
→
4058 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
9
←
Assuming the condition is true
→
10
←
Taking true branch
→
4059 StringInfo handshake_hashed_data;
4060 int ret;
4061
4062 handshake_hashed_data.data = NULL((void*)0);
4063 handshake_hashed_data.data_len = 0;
4064
4065 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4066 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4067 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4067, "ssl_session->handshake_data.data_len > 0"
))));
11
←
Assuming field 'data_len' is > 0
→
12
←
'?' condition is true
→
4068
4069 switch(ssl_session->session.version) {
13
←
Control jumps to 'case 257:' at line 4074
→
4070 case TLSV1_VERSION0x301:
4071 case TLSV1DOT1_VERSION0x302:
4072 case DTLSV1DOT0_VERSION0xfeff:
4073 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4074 case TLCPV1_VERSION0x101:
4075 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
14
←
Calling 'tls_handshake_hash'
→
22
←
Returned allocated memory
→
4076 break;
4077 default:
4078 switch (cipher_suite->dig) {
4079 case DIG_SHA3840x43:
4080 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4081 break;
4082 default:
4083 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4084 break;
4085 }
4086 break;
4087 }
4088 if (ret
23.1
'ret' is -1
) {
23
←
 Execution continues on line 4088
→
24
←
Taking true branch
→
4089 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
25
←
Potential leak of memory pointed to by 'handshake_hashed_data.data'
4090 return -1;
4091 }
4092
4093 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4094 ssl_session->handshake_data.data = NULL((void*)0);
4095 ssl_session->handshake_data.data_len = 0;
4096
4097 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4098 &handshake_hashed_data,
4099 NULL((void*)0), &ssl_session->master_secret,
4100 SSL_MASTER_SECRET_LENGTH48)) {
4101 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4102 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4103 return -1;
4104 }
4105 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4106 } else {
4107 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4108 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4109 ssl_print_string("client random",&ssl_session->client_random);
4110 ssl_print_string("server random",&ssl_session->server_random);
4111 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4112 &ssl_session->client_random,
4113 &ssl_session->server_random, &ssl_session->master_secret,
4114 SSL_MASTER_SECRET_LENGTH48)) {
4115 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4116 return -1;
4117 }
4118 }
4119 ssl_print_string("master secret",&ssl_session->master_secret);
4120
4121 /* the pre-master secret has been 'consumed' so we must clear it now */
4122 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4123 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4124 }
4125
4126 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4127 if (cipher_suite->enc != ENC_NULL0x3D) {
4128 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4129 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4130 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4131 if (cipher_algo == 0) {
4132 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4133 return -1;
4134 }
4135 }
4136
4137 /* Export ciphers consume less material from the key block. */
4138 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4139 is_export_cipher = encr_key_len > 0;
4140 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4141 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4142 }
4143
4144 if (cipher_suite->mode == MODE_CBC) {
4145 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4146 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4147 /* account for a four-byte salt for client and server side (from
4148 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4149 write_iv_len = 4;
4150 } else if (cipher_suite->mode == MODE_POLY1305) {
4151 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4152 write_iv_len = 12;
4153 }
4154
4155 /* Compute the key block. First figure out how much data we need */
4156 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4157 needed += 2 * encr_key_len; /* encryption key */
4158 needed += 2 * write_iv_len; /* write IV */
4159
4160 key_block.data = (unsigned char *)g_malloc(needed);
4161 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4162 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4163 &ssl_session->server_random,&ssl_session->client_random,
4164 &key_block, needed)) {
4165 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4166 goto fail;
4167 }
4168 ssl_print_string("key expansion", &key_block);
4169
4170 ptr=key_block.data;
4171 /* client/server write MAC key (for non-AEAD ciphers) */
4172 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4173 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4174 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4175 }
4176 /* client/server write encryption key */
4177 c_wk=ptr; ptr += encr_key_len;
4178 s_wk=ptr; ptr += encr_key_len;
4179 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4180 if (write_iv_len > 0) {
4181 c_iv=ptr; ptr += write_iv_len;
4182 s_iv=ptr; /* ptr += write_iv_len; */
4183 }
4184
4185 /* export ciphers work with a smaller key length */
4186 if (is_export_cipher) {
4187 if (cipher_suite->mode == MODE_CBC) {
4188
4189 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4190 all we should need. This is a sanity check */
4191 if (write_iv_len > MAX_BLOCK_SIZE16) {
4192 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4193 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4194 goto fail;
4195 }
4196
4197 if(ssl_session->session.version==SSLV3_VERSION0x300){
4198 /* The length of these fields are ignored by this caller */
4199 StringInfo iv_c, iv_s;
4200 iv_c.data = _iv_c;
4201 iv_s.data = _iv_s;
4202
4203 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4204 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4205 &ssl_session->server_random, &iv_c, write_iv_len)) {
4206 goto fail;
4207 }
4208 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4209 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4210 &ssl_session->client_random, &iv_s, write_iv_len)) {
4211 goto fail;
4212 }
4213 }
4214 else{
4215 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4216 StringInfo iv_block;
4217 StringInfo key_null;
4218 uint8_t _key_null;
4219
4220 key_null.data = &_key_null;
4221 key_null.data_len = 0;
4222
4223 iv_block.data = _iv_block;
4224
4225 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4226 if (!prf(ssl_session, &key_null, "IV block",
4227 &ssl_session->client_random,
4228 &ssl_session->server_random, &iv_block,
4229 write_iv_len * 2)) {
4230 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4231 goto fail;
4232 }
4233
4234 memcpy(_iv_c, iv_block.data, write_iv_len);
4235 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4236 }
4237
4238 c_iv=_iv_c;
4239 s_iv=_iv_s;
4240 }
4241
4242 if (ssl_session->session.version==SSLV3_VERSION0x300){
4243
4244 SSL_MD5_CTXgcry_md_hd_t md5;
4245 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4246
4247 if (ssl_md5_init(&md5) != 0)
4248 goto fail;
4249 ssl_md5_update(&md5,c_wk,encr_key_len);
4250 ssl_md5_update(&md5,ssl_session->client_random.data,
4251 ssl_session->client_random.data_len);
4252 ssl_md5_update(&md5,ssl_session->server_random.data,
4253 ssl_session->server_random.data_len);
4254 ssl_md5_final(_key_c,&md5);
4255 ssl_md5_cleanup(&md5);
4256 c_wk=_key_c;
4257
4258 if (ssl_md5_init(&md5) != 0)
4259 goto fail;
4260 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4261 ssl_md5_update(&md5,s_wk,encr_key_len);
4262 ssl_md5_update(&md5,ssl_session->server_random.data,
4263 ssl_session->server_random.data_len);
4264 ssl_md5_update(&md5,ssl_session->client_random.data,
4265 ssl_session->client_random.data_len);
4266 ssl_md5_final(_key_s,&md5);
4267 ssl_md5_cleanup(&md5);
4268 s_wk=_key_s;
4269 }
4270 else{
4271 StringInfo key_c, key_s, k;
4272 key_c.data = _key_c;
4273 key_s.data = _key_s;
4274
4275 k.data = c_wk;
4276 k.data_len = encr_key_len;
4277 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4278 if (!prf(ssl_session, &k, "client write key",
4279 &ssl_session->client_random,
4280 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4281 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4282 goto fail;
4283 }
4284 c_wk=_key_c;
4285
4286 k.data = s_wk;
4287 k.data_len = encr_key_len;
4288 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4289 if (!prf(ssl_session, &k, "server write key",
4290 &ssl_session->client_random,
4291 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4292 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4293 goto fail;
4294 }
4295 s_wk=_key_s;
4296 }
4297 }
4298
4299 /* show key material info */
4300 if (c_mk != NULL((void*)0)) {
4301 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4302 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4303 }
4304 ssl_print_data("Client Write key", c_wk, encr_key_len);
4305 ssl_print_data("Server Write key", s_wk, encr_key_len);
4306 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4307 if (write_iv_len > 0) {
4308 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4309 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4310 }
4311
4312create_decoders:
4313 /* create both client and server ciphers*/
4314 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4315 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4316 if (!ssl_session->client_new) {
4317 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4318 goto fail;
4319 }
4320 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4321 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4322 if (!ssl_session->server_new) {
4323 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4324 goto fail;
4325 }
4326
4327 /* Continue the SSL stream after renegotiation with new keys. */
4328 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4329 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4330
4331 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4332 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4333 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4334 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4335 return 0;
4336
4337fail:
4338 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4339 return -1;
4340}
4341
4342/* Generated the key material based on the given secret. */
4343bool_Bool
4344tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4345{
4346 bool_Bool success = false0;
4347 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4348 unsigned char *sn_key = NULL((void*)0);
4349 SslDecoder *decoder;
4350 unsigned key_length, iv_length;
4351 int hash_algo;
4352 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4353 int cipher_algo;
4354
4355 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4356 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4357 ssl_session->session.version);
4358 return false0;
4359 }
4360
4361 if (cipher_suite == NULL((void*)0)) {
4362 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4363 return false0;
4364 }
4365
4366 if (cipher_suite->kex != KEX_TLS130x23) {
4367 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4368 return false0;
4369 }
4370
4371 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4372 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4373 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4374 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4375 if (cipher_algo == 0) {
4376 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4377 return false0;
4378 }
4379
4380 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4381 hash_algo = ssl_get_digest_by_name(hash_name);
4382 if (!hash_algo) {
4383 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4384 return false0;
4385 }
4386
4387 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4388 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4389 iv_length = 12;
4390 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4391
4392 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4393 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4394 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4395 return false0;
4396 }
4397 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4398 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4399 goto end;
4400 }
4401
4402 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4403 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4404 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4405 goto end;
4406 }
4407 }
4408
4409 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4410 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4411 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4412 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4413 }
4414
4415 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4416 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4417 if (!decoder) {
4418 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4419 goto end;
4420 }
4421
4422 /* Continue the TLS session with new keys, but reuse old flow to keep things
4423 * like "Follow TLS" working (by linking application data records). */
4424 if (is_from_server) {
4425 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4426 ssl_session->server = decoder;
4427 } else {
4428 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4429 ssl_session->client = decoder;
4430 }
4431 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4432 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4433 success = true1;
4434
4435end:
4436 wmem_free(NULL((void*)0), write_key);
4437 wmem_free(NULL((void*)0), write_iv);
4438 if (sn_key)
4439 wmem_free(NULL((void*)0), sn_key);
4440 return success;
4441}
4442/* (Pre-)master secrets calculations }}} */
4443
4444#ifdef HAVE_LIBGNUTLS1
4445/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4446static bool_Bool
4447ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4448 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4449{
4450 int ret;
4451
4452 if (!encrypted_pre_master)
4453 return false0;
4454
4455 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4456 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4457 "(cipher suite 0x%04X %s) and cannot be decrypted "
4458 "using a RSA private key file.\n",
4459 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4460 val_to_str_ext_const(ssl_session->session.cipher,
4461 &ssl_31_ciphersuite_ext, "unknown"));
4462 return false0;
4463 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4464 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4465 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4466 return false0;
4467 }
4468
4469 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4470
4471 ssl_print_string("pre master encrypted", encrypted_pre_master);
4472 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4473 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4474 gnutls_datum_t pms = { 0 };
4475 if (pk) {
4476 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4477 char *err = NULL((void*)0);
4478 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4479 if (!private_key) {
4480 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4481 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4482 return false0;
4483 }
4484
4485 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4486 rsa_private_key_free(private_key);
4487 if (pms.size == 0) {
4488 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4489 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4490 return false0;
4491 }
4492 } else {
4493 // Try to decrypt using a hardware token.
4494 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4495 if (ret < 0) {
4496 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4497 return false0;
4498 }
4499 }
4500
4501 if (pms.size != 48) {
4502 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4503 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4504 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4505 return false0;
4506 }
4507
4508 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4509 ssl_session->pre_master_secret.data_len = 48;
4510 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4511 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4512
4513 /* Remove the master secret if it was there.
4514 This forces keying material regeneration in
4515 case we're renegotiating */
4516 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4517 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4518 return true1;
4519} /* }}} */
4520#endif /* HAVE_LIBGNUTLS */
4521
4522/* Decryption integrity check {{{ */
4523
4524static int
4525tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4526 uint32_t datalen, uint8_t* mac)
4527{
4528 SSL_HMACgcry_md_hd_t hm;
4529 int md;
4530 uint32_t len;
4531 uint8_t buf[DIGEST_MAX_SIZE48];
4532 int16_t temp;
4533
4534 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4535 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4536 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4537
4538 if (ssl_hmac_init(&hm,md) != 0)
4539 return -1;
4540 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4541 return -1;
4542
4543 /* hash sequence number */
4544 phtonu64(buf, decoder->seq);
4545
4546 decoder->seq++;
4547
4548 ssl_hmac_update(&hm,buf,8);
4549
4550 /* hash content type */
4551 buf[0]=ct;
4552 ssl_hmac_update(&hm,buf,1);
4553
4554 /* hash version,data length and data*/
4555 /* *((int16_t*)buf) = g_htons(ver); */
4556 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4557 memcpy(buf, &temp, 2);
4558 ssl_hmac_update(&hm,buf,2);
4559
4560 /* *((int16_t*)buf) = g_htons(datalen); */
4561 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4562 memcpy(buf, &temp, 2);
4563 ssl_hmac_update(&hm,buf,2);
4564 ssl_hmac_update(&hm,data,datalen);
4565
4566 /* get digest and digest len*/
4567 len = sizeof(buf);
4568 ssl_hmac_final(&hm,buf,&len);
4569 ssl_hmac_cleanup(&hm);
4570 ssl_print_data("Mac", buf, len);
4571 if(memcmp(mac,buf,len))
4572 return -1;
4573
4574 return 0;
4575}
4576
4577static int
4578ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4579 uint32_t datalen, uint8_t* mac)
4580{
4581 SSL_MDgcry_md_hd_t mc;
4582 int md;
4583 uint32_t len;
4584 uint8_t buf[64],dgst[20];
4585 int pad_ct;
4586 int16_t temp;
4587
4588 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4589
4590 /* get cipher used for digest computation */
4591 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4592 if (ssl_md_init(&mc,md) !=0)
4593 return -1;
4594
4595 /* do hash computation on data && padding */
4596 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4597
4598 /* hash padding*/
4599 memset(buf,0x36,pad_ct);
4600 ssl_md_update(&mc,buf,pad_ct);
4601
4602 /* hash sequence number */
4603 phtonu64(buf, decoder->seq);
4604 decoder->seq++;
4605 ssl_md_update(&mc,buf,8);
4606
4607 /* hash content type */
4608 buf[0]=ct;
4609 ssl_md_update(&mc,buf,1);
4610
4611 /* hash data length in network byte order and data*/
4612 /* *((int16_t* )buf) = g_htons(datalen); */
4613 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4614 memcpy(buf, &temp, 2);
4615 ssl_md_update(&mc,buf,2);
4616 ssl_md_update(&mc,data,datalen);
4617
4618 /* get partial digest */
4619 ssl_md_final(&mc,dgst,&len);
4620 ssl_md_reset(&mc);
4621
4622 /* hash mac key */
4623 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4624
4625 /* hash padding and partial digest*/
4626 memset(buf,0x5c,pad_ct);
4627 ssl_md_update(&mc,buf,pad_ct);
4628 ssl_md_update(&mc,dgst,len);
4629
4630 ssl_md_final(&mc,dgst,&len);
4631 ssl_md_cleanup(&mc);
4632
4633 if(memcmp(mac,dgst,len))
4634 return -1;
4635
4636 return 0;
4637}
4638
4639static int
4640dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4641 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4642{
4643 SSL_HMACgcry_md_hd_t hm;
4644 int md;
4645 uint32_t len;
4646 uint8_t buf[DIGEST_MAX_SIZE48];
4647 int16_t temp;
4648
4649 int ver = ssl->session.version;
4650 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4651
4652 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4653 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4654 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4655
4656 if (ssl_hmac_init(&hm,md) != 0)
4657 return -1;
4658 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4659 return -1;
4660
4661 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4662
4663 if (is_cid && !ssl->session.deprecated_cid) {
4664 /* hash seq num placeholder */
4665 memset(buf,0xFF,8);
4666 ssl_hmac_update(&hm,buf,8);
4667
4668 /* hash content type + cid length + content type */
4669 buf[0]=ct;
4670 buf[1]=cidl;
4671 buf[2]=ct;
4672 ssl_hmac_update(&hm,buf,3);
4673
4674 /* hash version */
4675 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4676 memcpy(buf, &temp, 2);
4677 ssl_hmac_update(&hm,buf,2);
4678
4679 /* hash sequence number */
4680 phtonu64(buf, decoder->seq);
4681 buf[0]=decoder->epoch>>8;
4682 buf[1]=(uint8_t)decoder->epoch;
4683 ssl_hmac_update(&hm,buf,8);
4684
4685 /* hash cid */
4686 ssl_hmac_update(&hm,cid,cidl);
4687 } else {
4688 /* hash sequence number */
4689 phtonu64(buf, decoder->seq);
4690 buf[0]=decoder->epoch>>8;
4691 buf[1]=(uint8_t)decoder->epoch;
4692 ssl_hmac_update(&hm,buf,8);
4693
4694 /* hash content type */
4695 buf[0]=ct;
4696 ssl_hmac_update(&hm,buf,1);
4697
4698 /* hash version */
4699 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4700 memcpy(buf, &temp, 2);
4701 ssl_hmac_update(&hm,buf,2);
4702
4703 if (is_cid && ssl->session.deprecated_cid) {
4704 /* hash cid */
4705 ssl_hmac_update(&hm,cid,cidl);
4706
4707 /* hash cid length */
4708 buf[0] = cidl;
4709 ssl_hmac_update(&hm,buf,1);
4710 }
4711 }
4712
4713 /* data length and data */
4714 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4715 memcpy(buf, &temp, 2);
4716 ssl_hmac_update(&hm,buf,2);
4717 ssl_hmac_update(&hm,data,datalen);
4718
4719 /* get digest and digest len */
4720 len = sizeof(buf);
4721 ssl_hmac_final(&hm,buf,&len);
4722 ssl_hmac_cleanup(&hm);
4723 ssl_print_data("Mac", buf, len);
4724 if(memcmp(mac,buf,len))
4725 return -1;
4726
4727 return 0;
4728}
4729/* Decryption integrity check }}} */
4730
4731
4732static bool_Bool
4733tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4734 uint8_t ct, uint16_t record_version,
4735 bool_Bool ignore_mac_failed,
4736 const unsigned char *in, uint16_t inl,
4737 const unsigned char *cid, uint8_t cidl,
4738 StringInfo *out_str, unsigned *outl)
4739{
4740 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4741 * GenericAEADCipher: { nonce_explicit, [content] }
4742 * In TLS 1.3 this explicit nonce is gone.
4743 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4744 * ciphertext and authentication tag.
4745 */
4746 const uint16_t version = ssl->session.version;
4747 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4748 gcry_error_t err;
4749 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4750 unsigned ciphertext_len, auth_tag_len;
4751 unsigned char nonce[12];
4752 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4753 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4754 const uint8_t draft_version = ssl->session.tls13_draft_version;
4755 const unsigned char *auth_tag_wire;
4756 unsigned char auth_tag_calc[16];
4757 unsigned char *aad = NULL((void*)0);
4758 unsigned aad_len = 0;
4759
4760 switch (cipher_mode) {
4761 case MODE_GCM:
4762 case MODE_CCM:
4763 case MODE_POLY1305:
4764 auth_tag_len = 16;
4765 break;
4766 case MODE_CCM_8:
4767 auth_tag_len = 8;
4768 break;
4769 default:
4770 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4771 return false0;
4772 }
4773
4774 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4775 if (is_v12 && cipher_mode != MODE_POLY1305) {
4776 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4777 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4778 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4779 return false0;
4780 }
4781 explicit_nonce = in;
4782 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4783 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4784 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4785 if (inl < auth_tag_len) {
4786 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4787 return false0;
4788 }
4789 ciphertext = in;
4790 ciphertext_len = inl - auth_tag_len;
4791 } else {
4792 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4793 return false0;
4794 }
4795 auth_tag_wire = ciphertext + ciphertext_len;
4796
4797 /*
4798 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4799 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4800 */
4801 if (is_v12 && cipher_mode != MODE_POLY1305) {
4802 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4802, "decoder->write_iv.data_len == 4"))));
4803 /* Implicit (4) and explicit (8) part of nonce. */
4804 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4805 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
4806
4807 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4808 /*
4809 * Technically the nonce length must be at least 8 bytes, but for
4810 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
4811 */
4812 const unsigned nonce_len = 12;
4813 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4813, "decoder->write_iv.data_len == nonce_len"
))));
4814 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
4815 /* Sequence number is left-padded with zeroes and XORed with write_iv */
4816 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
4817 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
4818 }
4819
4820 /* Set nonce and additional authentication data */
4821 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
4822 ssl_print_data("nonce", nonce, 12);
4823 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
4824 if (err) {
4825 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4826 return false0;
4827 }
4828
4829 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
4830 if (is_cid) { /* if connection ID */
4831 if (ssl->session.deprecated_cid) {
4832 aad_len = 14 + cidl;
4833 aad = wmem_alloc(allocator, aad_len);
4834 phtonu64(aad, decoder->seq); /* record sequence number */
4835 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4836 aad[8] = ct; /* TLSCompressed.type */
4837 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4838 memcpy(aad + 11, cid, cidl); /* cid */
4839 aad[11 + cidl] = cidl; /* cid_length */
4840 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
4841 } else {
4842 aad_len = 23 + cidl;
4843 aad = wmem_alloc(allocator, aad_len);
4844 memset(aad, 0xFF, 8); /* seq_num_placeholder */
4845 aad[8] = ct; /* TLSCompressed.type */
4846 aad[9] = cidl; /* cid_length */
4847 aad[10] = ct; /* TLSCompressed.type */
4848 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
4849 phtonu64(aad + 13, decoder->seq); /* record sequence number */
4850 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
4851 memcpy(aad + 21, cid, cidl); /* cid */
4852 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
4853 }
4854 } else if (is_v12) {
4855 aad_len = 13;
4856 aad = wmem_alloc(allocator, aad_len);
4857 phtonu64(aad, decoder->seq); /* record sequence number */
4858 if (version == DTLSV1DOT2_VERSION0xfefd) {
4859 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4860 }
4861 aad[8] = ct; /* TLSCompressed.type */
4862 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4863 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
4864 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
4865 aad_len = decoder->dtls13_aad.data_len;
4866 aad = decoder->dtls13_aad.data;
4867 } else if (draft_version >= 25 || draft_version == 0) {
4868 aad_len = 5;
4869 aad = wmem_alloc(allocator, aad_len);
4870 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
4871 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
4872 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
4873 }
4874
4875 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
4876 /* size of plaintext, additional authenticated data and auth tag. */
4877 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
4878
4879 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
4880 }
4881
4882 if (aad && aad_len > 0) {
4883 ssl_print_data("AAD", aad, aad_len);
4884 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
4885 if (err) {
4886 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4887 return false0;
4888 }
4889 }
4890
4891 /* Decrypt now that nonce and AAD are set. */
4892 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
4893 if (err) {
4894 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4895 return false0;
4896 }
4897
4898 /* Check authentication tag for authenticity (replaces MAC) */
4899 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
4900 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
4901 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
4902 } else {
4903 if (err) {
4904 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4905 } else {
4906 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
4907 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
4908 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
4909 }
4910 if (ignore_mac_failed) {
4911 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
4912 } else {
4913 return false0;
4914 }
4915 }
4916
4917 /*
4918 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
4919 * after successful authentication to ensure that early data is skipped when
4920 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
4921 */
4922 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
4923 decoder->seq++;
4924 }
4925
4926 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
4927 *outl = ciphertext_len;
4928 return true1;
4929}
4930
4931/* Record decryption glue based on security parameters {{{ */
4932/* Assume that we are called only for a non-NULL decoder which also means that
4933 * we have a non-NULL decoder->cipher_suite. */
4934int
4935ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
4936 bool_Bool ignore_mac_failed,
4937 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
4938 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
4939{
4940 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
4941 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
4942
4943 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
4944 ssl_print_data("Ciphertext",in, inl);
4945
4946 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
4947 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
4948 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
4949 return -1;
4950 }
4951
4952 /* ensure we have enough storage space for decrypted data */
4953 if (inl > out_str->data_len)
4954 {
4955 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
4956 inl + 32, out_str->data_len);
4957 ssl_data_realloc(out_str, inl + 32);
4958 }
4959
4960 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
4961 * a separate MAC, so use a different routine for simplicity. */
4962 if (decoder->cipher_suite->mode == MODE_GCM ||
4963 decoder->cipher_suite->mode == MODE_CCM ||
4964 decoder->cipher_suite->mode == MODE_CCM_8 ||
4965 decoder->cipher_suite->mode == MODE_POLY1305 ||
4966 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
4967 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
4968
4969 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
4970 /* decryption failed */
4971 return -1;
4972 }
4973
4974 goto skip_mac;
4975 }
4976
4977 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
4978 * (notation: { unencrypted, [ encrypted ] })
4979 * GenericStreamCipher: { [content, mac] }
4980 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
4981 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
4982 * GenericAEADCipher: { nonce_explicit, [content] }
4983 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
4984 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
4985 */
4986
4987 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
4988
4989 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
4990 if (decoder->cipher_suite->mode == MODE_CBC) {
4991 unsigned blocksize = 0;
4992
4993 switch (ssl->session.version) {
4994 case TLSV1DOT1_VERSION0x302:
4995 case TLSV1DOT2_VERSION0x303:
4996 case DTLSV1DOT0_VERSION0xfeff:
4997 case DTLSV1DOT2_VERSION0xfefd:
4998 case DTLSV1DOT3_VERSION0xfefc:
4999 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5000 case TLCPV1_VERSION0x101:
5001 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5002 if (inl < blocksize) {
5003 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5004 inl, blocksize);
5005 return -1;
5006 }
5007 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5008 if (pad != 0) {
5009 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5010 gcry_strsource (pad), gcry_strerror (pad));
5011 }
5012
5013 inl -= blocksize;
5014 in += blocksize;
5015 break;
5016 }
5017
5018 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5019 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5020 /*
5021 * MAC is calculated over (IV + ) ENCRYPTED contents:
5022 *
5023 * MAC(MAC_write_key, ... +
5024 * IV + // for TLS 1.1 or greater
5025 * TLSCiphertext.enc_content);
5026 */
5027 if (inl < maclen) {
5028 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5029 G_STRFUNC((const char*) (__func__)), inl, maclen);
5030 return -1;
5031 }
5032 inl -= maclen;
5033 mac = (uint8_t *)in + inl;
5034 mac_frag = (uint8_t *)in - blocksize;
5035 mac_fraglen = blocksize + inl;
5036 }
5037 }
5038
5039 /* First decrypt*/
5040 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5041 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5042 gcry_strerror (pad));
5043 return -1;
5044 }
5045
5046 ssl_print_data("Plaintext", out_str->data, inl);
5047 worklen=inl;
5048
5049
5050 /* strip padding for GenericBlockCipher */
5051 if (decoder->cipher_suite->mode == MODE_CBC) {
5052 if (inl < 1) { /* Should this check happen earlier? */
5053 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5054 return -1;
5055 }
5056 pad=out_str->data[inl-1];
5057 if (worklen <= pad) {
5058 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5059 pad, worklen);
5060 return -1;
5061 }
5062 worklen-=(pad+1);
5063 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5064 pad, worklen);
5065 }
5066
5067 /* MAC for GenericStreamCipher and GenericBlockCipher.
5068 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5069 if (!mac) {
5070 /*
5071 * MAC is calculated over the DECRYPTED contents:
5072 *
5073 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5074 */
5075 if (worklen < maclen) {
5076 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5077 return -1;
5078 }
5079 worklen -= maclen;
5080 mac = out_str->data + worklen;
5081 mac_frag = out_str->data;
5082 mac_fraglen = worklen;
5083 }
5084
5085 /* If NULL encryption active and no keys are available, do not bother
5086 * checking the MAC. We do not have keys for that. */
5087 if (decoder->cipher_suite->mode == MODE_STREAM &&
5088 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5089 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5090 ssl_debug_printf("MAC check skipped due to missing keys\n");
5091 decoder->seq++; // Increment this for display
5092 goto skip_mac;
5093 }
5094
5095 /* Now check the MAC */
5096 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5097 worklen, ssl->session.version, ct, decoder->seq);
5098 if(ssl->session.version==SSLV3_VERSION0x300){
5099 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5100 if(ignore_mac_failed) {
5101 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5102 }
5103 else{
5104 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5105 return -1;
5106 }
5107 }
5108 else{
5109 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5110 }
5111 }
5112 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5113 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5114 if(ignore_mac_failed) {
5115 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5116 }
5117 else{
5118 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5119 return -1;
5120 }
5121 }
5122 else{
5123 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5124 }
5125 }
5126 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5127 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5128 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5129 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5130 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5131 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5132 }
5133 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5134 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5135 }
5136 else if(ignore_mac_failed) {
5137 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5138 }
5139 else{
5140 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5141 return -1;
5142 }
5143 }
5144skip_mac:
5145
5146 *outl = worklen;
5147
5148 if (decoder->compression > 0) {
5149 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5150 ssl_data_copy(comp_str, out_str);
5151 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5152 if (!decoder->decomp) {
5153 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5154 return -1;
5155 }
5156 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5157 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5158 *outl = uncomplen;
5159 }
5160
5161 return 0;
5162}
5163/* Record decryption glue based on security parameters }}} */
5164
5165
5166
5167#ifdef HAVE_LIBGNUTLS1
5168
5169/* RSA private key file processing {{{ */
5170static void
5171ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5172 const gnutls_datum_t *subjectPublicKeyInfo)
5173{
5174 gnutls_pubkey_t pubkey = NULL((void*)0);
5175 cert_key_id_t key_id;
5176 size_t key_id_len = sizeof(key_id);
5177 int r;
5178
5179 if (!subjectPublicKeyInfo->size) {
5180 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5181 return;
5182 }
5183
5184 r = gnutls_pubkey_init(&pubkey);
5185 if (r < 0) {
5186 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5187 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5188 return;
5189 }
5190
5191 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5192 if (r < 0) {
5193 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5194 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5195 goto end;
5196 }
5197
5198 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5199 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5200 goto end;
5201 }
5202
5203 /* Generate a 20-byte SHA-1 hash. */
5204 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5205 if (r < 0) {
5206 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5207 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5208 goto end;
5209 }
5210
5211 if (key_id_len != sizeof(key_id)) {
5212 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5213 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5214 goto end;
5215 }
5216
5217 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5218 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5219 *ssl->cert_key_id = key_id;
5220
5221end:
5222 gnutls_pubkey_deinit(pubkey);
5223}
5224
5225/* RSA private key file processing }}} */
5226#endif /* HAVE_LIBGNUTLS */
5227
5228/*--- Start of dissector-related code below ---*/
5229
5230/* This is not a "protocol" but ensures that this gets called during
5231 * the handoff stage. */
5232void proto_reg_handoff_tls_utils(void);
5233
5234static dissector_handle_t base_tls_handle;
5235static dissector_handle_t dtls_handle;
5236
5237void
5238proto_reg_handoff_tls_utils(void)
5239{
5240 base_tls_handle = find_dissector("tls");
5241 dtls_handle = find_dissector("dtls");
5242}
5243
5244/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5245 * no session exists. */
5246SslDecryptSession *
5247tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5248{
5249 void *conv_data;
5250 wmem_map_t *session_map;
5251
5252 if (!conversation)
5253 return NULL((void*)0);
5254
5255 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5256 if (conv_data == NULL((void*)0))
5257 return NULL((void*)0);
5258
5259 session_map = (wmem_map_t *)conv_data;
5260
5261 return (SslDecryptSession *)wmem_map_lookup(session_map,
5262 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5263
5264}
5265
5266/* get ssl data for this session. if no ssl data is found allocate a new one*/
5267SslDecryptSession *
5268ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5269{
5270 void *conv_data;
5271 SslDecryptSession *ssl_session;
5272 int proto_ssl;
5273 wmem_map_t *session_map;
5274
5275 /* Note proto_ssl is tls for either the main tls_handle or the
5276 * tls13_handshake handle used by QUIC. */
5277 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5278 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5279
5280 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5281 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5282 * preventing memory leaks on capture reload. */
5283 if (conv_data != NULL((void*)0)) {
5284 session_map = (wmem_map_t *)conv_data;
5285 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5286 if (ssl_session != NULL((void*)0)) {
5287 return ssl_session;
5288 }
5289 } else {
5290 /* Create a new wmem map to store sessions by layer number */
5291 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5292 conversation_add_proto_data(conversation, proto_ssl, session_map);
5293 }
5294
5295 /* no previous SSL conversation info for this layer, initialize it. */
5296 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5297
5298 /* data_len is the part that is meaningful, not the allocated length */
5299 ssl_session->master_secret.data_len = 0;
5300 ssl_session->master_secret.data = ssl_session->_master_secret;
5301 ssl_session->session_id.data_len = 0;
5302 ssl_session->session_id.data = ssl_session->_session_id;
5303 ssl_session->client_random.data_len = 0;
5304 ssl_session->client_random.data = ssl_session->_client_random;
5305 ssl_session->server_random.data_len = 0;
5306 ssl_session->server_random.data = ssl_session->_server_random;
5307 ssl_session->session_ticket.data_len = 0;
5308 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5309 ssl_session->server_data_for_iv.data_len = 0;
5310 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5311 ssl_session->client_data_for_iv.data_len = 0;
5312 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5313 ssl_session->app_data_segment.data = NULL((void*)0);
5314 ssl_session->app_data_segment.data_len = 0;
5315 ssl_session->handshake_data.data=NULL((void*)0);
5316 ssl_session->handshake_data.data_len=0;
5317 ssl_session->ech_transcript.data=NULL((void*)0);
5318 ssl_session->ech_transcript.data_len=0;
5319
5320 /* Initialize parameters which are not necessary specific to decryption. */
5321 ssl_session->session.version = SSL_VER_UNKNOWN0;
5322 clear_address(&ssl_session->session.srv_addr);
5323 ssl_session->session.srv_ptype = PT_NONE;
5324 ssl_session->session.srv_port = 0;
5325 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5326 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5327 ssl_session->session.client_random.data_len = 0;
5328 ssl_session->session.client_random.data = ssl_session->session._client_random;
5329 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5330 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5331 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5332 ssl_session->session.ech = false0;
5333 ssl_session->session.hrr_ech_declined = false0;
5334 ssl_session->session.first_ch_ech_frame = 0;
5335
5336 /* We want to increment the stream count for the normal tls handle and
5337 * dtls handle, but presumably not for the tls13_handshake handle used
5338 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5339 * doesn't get sent to the TLS follow tap.)
5340 */
5341 if (tls_handle == base_tls_handle) {
5342 ssl_session->session.stream = tls_increment_stream_count();
5343 } else if (tls_handle == dtls_handle) {
5344 ssl_session->session.stream = dtls_increment_stream_count();
5345 }
5346
5347 /* Store the session in the wmem map indexed by layer number */
5348 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5349
5350 return ssl_session;
5351}
5352
5353void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5354{
5355 if (ssl) {
5356 /* Ensure that secrets are not restored using stale identifiers. Split
5357 * between client and server in case the packets somehow got out of order. */
5358 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5359
5360 if (is_client) {
5361 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5362 ssl->session_id.data_len = 0;
5363 ssl->session_ticket.data_len = 0;
5364 ssl->master_secret.data_len = 0;
5365 ssl->client_random.data_len = 0;
5366 ssl->has_early_data = false0;
5367 if (ssl->handshake_data.data_len > 0) {
5368 // The EMS handshake hash starts with at the Client Hello,
5369 // ensure that any messages before it are forgotten.
5370 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
5371 ssl->handshake_data.data = NULL((void*)0);
5372 ssl->handshake_data.data_len = 0;
5373 }
5374 } else {
5375 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5376 ssl->server_random.data_len = 0;
5377 ssl->pre_master_secret.data_len = 0;
5378#ifdef HAVE_LIBGNUTLS1
5379 ssl->cert_key_id = NULL((void*)0);
5380#endif
5381 ssl->has_psk = false0;
5382 ssl->has_key_share = false0;
5383 // There is no point in clearing the PSK when resetting the session,
5384 // we only store one global PSK in the prefs.
5385 //ssl->psk.data_len = 0;
5386 }
5387
5388 if (ssl->state & clear_flags) {
5389 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5390 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5391 ssl->state &= ~clear_flags;
5392 }
5393 }
5394
5395 /* These flags might be used for non-decryption purposes and may affect the
5396 * dissection, so reset them as well. */
5397 if (is_client) {
5398 session->client_cert_type = 0;
5399 } else {
5400 session->compression = 0;
5401 session->server_cert_type = 0;
5402 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5403 }
5404 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5405 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5406}
5407
5408void
5409tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5410 dissector_handle_t app_handle)
5411{
5412 conversation_t *conversation;
5413 SslSession *session;
5414
5415 /* Ignore if the TLS or other dissector is disabled. */
5416 /* XXX - find_dissector still works if a dissector is disabled,
5417 * this would be if the dissector isn't registered at all or the
5418 * caller is calling this with explicit NULL. */
5419 if (!tls_handle || !app_handle)
5420 return;
5421
5422 int proto = dissector_handle_get_protocol_index(tls_handle);
5423 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5424
5425 conversation = find_or_create_conversation(pinfo);
5426 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5427 session->app_handle = app_handle;
5428}
5429
5430static uint32_t
5431ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5432 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5433{
5434
5435 conversation_t *conversation;
5436 SslSession *session;
5437
5438 /* Ignore if the TLS dissector is disabled. */
5439 /* XXX - find_dissector still works if a dissector is disabled,
5440 * this would be if the dissector isn't registered at all (or the
5441 * caller has an error.) */
5442 if (!tls_handle)
5443 return 0;
5444
5445 int proto = dissector_handle_get_protocol_index(tls_handle);
5446 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5447
5448 /* The caller should always pass a valid handle to its own dissector. */
5449 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5449, "app_handle"))));
5450
5451 conversation = find_or_create_conversation(pinfo);
5452 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5453
5454 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5455 session->last_nontls_frame,
5456 (void *)session->app_handle,
5457 dissector_handle_get_dissector_name(session->app_handle));
5458 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5459 pinfo->num, (void *)app_handle,
5460 dissector_handle_get_dissector_name(app_handle));
5461
5462 /* Do not switch again if a dissector did it before. */
5463 if (session->last_nontls_frame) {
5464 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5465 return session->last_nontls_frame;
5466 }
5467
5468 session->app_handle = app_handle;
5469 /* The TLS dissector should be called first for this conversation. */
5470 conversation_set_dissector(conversation, tls_handle);
5471 /* TLS starts after this frame. */
5472 session->last_nontls_frame = last_nontls_frame;
5473 return 0;
5474}
5475
5476/* ssl_starttls_ack: mark future frames as encrypted. */
5477uint32_t
5478ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5479 dissector_handle_t app_handle)
5480{
5481 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5482}
5483
5484uint32_t
5485ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5486 dissector_handle_t app_handle)
5487{
5488 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5489}
5490
5491dissector_handle_t
5492ssl_find_appdata_dissector(const char *name)
5493{
5494 /* Accept 'http' for backwards compatibility and sanity. */
5495 if (!strcmp(name, "http"))
5496 name = "http-over-tls";
5497 /* XXX - Should this check to see if the dissector is actually added for
5498 * Decode As in the appropriate table?
5499 */
5500 return find_dissector(name);
5501}
5502
5503/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5504static int
5505ssl_equal (const void *v, const void *v2)
5506{
5507 const StringInfo *val1;
5508 const StringInfo *val2;
5509 val1 = (const StringInfo *)v;
5510 val2 = (const StringInfo *)v2;
5511
5512 if (val1->data_len == val2->data_len &&
5513 !memcmp(val1->data, val2->data, val2->data_len)) {
5514 return 1;
5515 }
5516 return 0;
5517}
5518
5519static unsigned
5520ssl_hash(const void *v)
5521{
5522 const StringInfo* id;
5523 id = (const StringInfo*) v;
5524
5525 return wmem_strong_hash(id->data, id->data_len);
5526}
5527/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5528
5529/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5530void
5531ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5532{
5533 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5533, "main_handle"))));
5534 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5534, "subdissector_handle"))));
5535 /* Registration is required for Export PDU feature to work properly. */
5536 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5537, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5537 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5537, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5538 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5539
5540 if (port) {
5541 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5542 if (tcp)
5543 dissector_add_uint("tcp.port", port, main_handle);
5544 else
5545 dissector_add_uint("udp.port", port, main_handle);
5546 dissector_add_uint("sctp.port", port, main_handle);
5547 } else {
5548 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5549 }
5550}
5551
5552void
5553ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5554{
5555 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5556 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5557 if (main_handle) {
5558 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5559 dissector_delete_uint("sctp.port", port, main_handle);
5560 }
5561
5562 if (port) {
5563 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5564 }
5565}
5566
5567void
5568ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5569{
5570 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5571 session->srv_ptype = ptype;
5572 session->srv_port = port;
5573}
5574
5575int
5576ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5577{
5578 int ret;
5579 if (session && session->srv_addr.type != AT_NONE) {
5580 ret = (session->srv_ptype == pinfo->ptype) &&
5581 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5582 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5583 } else {
5584 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5585 }
5586
5587 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5588 return ret;
5589}
5590/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5591
5592
5593/* Links SSL records with the real packet data. {{{ */
5594SslPacketInfo *
5595tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5596{
5597 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5598 if (!pi) {
5599 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5600 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5601 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5602 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5603 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5604 if (ssl_session) {
5605 /* This can also be called by the QUIC TLS1.3 handshake only
5606 * dissector. That is not associated with a session, or a stream,
5607 * and doesn't need the information for Follow or Decode As. */
5608 pi->stream = ssl_session->session.stream;
5609 }
5610 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5611 }
5612
5613 return pi;
5614}
5615
5616/**
5617 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5618 * avoid the need for a decoder in the second pass. Additionally, it remembers
5619 * sequence numbers (for reassembly and Follow TLS Stream).
5620 *
5621 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5622 * @param pinfo The packet where the record originates from.
5623 * @param plain_data Decrypted plaintext to store in the record.
5624 * @param plain_data_len Total length of the plaintext.
5625 * @param content_len Length of the plaintext section corresponding to the record content.
5626 * @param record_id The identifier for this record within the current packet.
5627 * @param flow Information about sequence numbers, etc.
5628 * @param type TLS Content Type (such as handshake or application_data).
5629 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5630 */
5631void
5632ssl_add_record_info(int proto, packet_info *pinfo,
5633 const unsigned char *plain_data, int plain_data_len, int content_len,
5634 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5635 uint64_t record_seq)
5636{
5637 SslRecordInfo* rec, **prec;
5638 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5639
5640 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5640
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5641
5642 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5643 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5644 rec->plain_data_len = plain_data_len;
5645 rec->content_len = content_len;
5646 rec->id = record_id;
5647 rec->type = type;
5648 rec->next = NULL((void*)0);
5649 rec->record_seq = record_seq;
5650
5651 if (flow && type == SSL_ID_APP_DATA) {
5652 rec->seq = flow->byte_seq;
5653 rec->flow = flow;
5654 flow->byte_seq += content_len;
5655 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5656 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5657 }
5658
5659 /* Remember decrypted records. */
5660 prec = &pi->records;
5661 while (*prec) prec = &(*prec)->next;
5662 *prec = rec;
5663}
5664
5665/* search in packet data for the specified id; return a newly created tvb for the associated data */
5666tvbuff_t*
5667ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5668{
5669 SslRecordInfo* rec;
5670 SslPacketInfo* pi;
5671 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5672
5673 if (!pi)
5674 return NULL((void*)0);
5675
5676 for (rec = pi->records; rec; rec = rec->next)
5677 if (rec->id == record_id) {
5678 *matched_record = rec;
5679 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5680 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5681 }
5682
5683 return NULL((void*)0);
5684}
5685/* Links SSL records with the real packet data. }}} */
5686
5687/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5688void
5689ssl_common_init(ssl_master_key_map_t *mk_map,
5690 StringInfo *decrypted_data, StringInfo *compressed_data)
5691{
5692 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5693 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5694 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5695 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5696 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5697 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5698 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5699 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5700 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5701 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5702 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5703 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5704
5705 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5706 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5707
5708 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5709
5710 ssl_data_alloc(decrypted_data, 32);
5711 ssl_data_alloc(compressed_data, 32);
5712}
5713
5714void
5715ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5716 StringInfo *decrypted_data, StringInfo *compressed_data)
5717{
5718 g_hash_table_destroy(mk_map->session);
5719 g_hash_table_destroy(mk_map->tickets);
5720 g_hash_table_destroy(mk_map->crandom);
5721 g_hash_table_destroy(mk_map->pre_master);
5722 g_hash_table_destroy(mk_map->pms);
5723 g_hash_table_destroy(mk_map->tls13_client_early);
5724 g_hash_table_destroy(mk_map->tls13_client_handshake);
5725 g_hash_table_destroy(mk_map->tls13_server_handshake);
5726 g_hash_table_destroy(mk_map->tls13_client_appdata);
5727 g_hash_table_destroy(mk_map->tls13_server_appdata);
5728 g_hash_table_destroy(mk_map->tls13_early_exporter);
5729 g_hash_table_destroy(mk_map->tls13_exporter);
5730
5731 g_hash_table_destroy(mk_map->ech_secret);
5732 g_hash_table_destroy(mk_map->ech_config);
5733
5734 g_hash_table_destroy(mk_map->used_crandom);
5735
5736 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5737 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5738
5739 /* close the previous keylog file now that the cache are cleared, this
5740 * allows the cache to be filled with the full keylog file contents. */
5741 if (*ssl_keylog_file) {
5742 fclose(*ssl_keylog_file);
5743 *ssl_keylog_file = NULL((void*)0);
5744 }
5745}
5746/* }}} */
5747
5748/* parse ssl related preferences (private keys and ports association strings) */
5749#if defined(HAVE_LIBGNUTLS1)
5750/* Load a single RSA key file item from preferences. {{{ */
5751void
5752ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5753{
5754 gnutls_x509_privkey_t x509_priv_key;
5755 gnutls_privkey_t priv_key = NULL((void*)0);
5756 FILE* fp = NULL((void*)0);
5757 int ret;
5758 size_t key_id_len = 20;
5759 unsigned char *key_id = NULL((void*)0);
5760 char *err = NULL((void*)0);
5761 dissector_handle_t handle;
5762 /* try to load keys file first */
5763 fp = ws_fopenfopen(uats->keyfile, "rb");
5764 if (!fp) {
5765 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5766 return;
5767 }
5768
5769 if ((int)strlen(uats->password) == 0) {
5770 x509_priv_key = rsa_load_pem_key(fp, &err);
5771 } else {
5772 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
5773 }
5774 fclose(fp);
5775
5776 if (!x509_priv_key) {
5777 if (err) {
5778 report_failure("Can't load private key from %s: %s",
5779 uats->keyfile, err);
5780 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5781 } else
5782 report_failure("Can't load private key from %s: unknown error",
5783 uats->keyfile);
5784 return;
5785 }
5786 if (err) {
5787 report_failure("Load of private key from %s \"succeeded\" with error %s",
5788 uats->keyfile, err);
5789 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5790 }
5791
5792 gnutls_privkey_init(&priv_key);
5793 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
5794 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
5795 if (ret < 0) {
5796 report_failure("Can't convert private key %s: %s",
5797 uats->keyfile, gnutls_strerror(ret));
5798 goto end;
5799 }
5800
5801 key_id = (unsigned char *) g_malloc0(key_id_len);
5802 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
5803 if (ret < 0) {
5804 report_failure("Can't calculate public key ID for %s: %s",
5805 uats->keyfile, gnutls_strerror(ret));
5806 goto end;
5807 }
5808 ssl_print_data("KeyID", key_id, key_id_len);
5809 if (key_id_len != 20) {
5810 report_failure("Expected Key ID size %u for %s, got %zu", 20,
5811 uats->keyfile, key_id_len);
5812 goto end;
5813 }
5814
5815 g_hash_table_replace(key_hash, key_id, priv_key);
5816 key_id = NULL((void*)0); /* used in key_hash, do not free. */
5817 priv_key = NULL((void*)0);
5818 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
5819
5820 handle = ssl_find_appdata_dissector(uats->protocol);
5821 if (handle) {
5822 /* Port to subprotocol mapping */
5823 uint16_t port = 0;
5824 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
5825 if (port > 0) {
5826 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
5827 port, uats->keyfile, uats->password);
5828
5829 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
5830 }
5831 } else {
5832 if (strcmp(uats->port, "start_tls"))
5833 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
5834 }
5835 }
5836
5837end:
5838 gnutls_x509_privkey_deinit(x509_priv_key);
5839 gnutls_privkey_deinit(priv_key);
5840 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
5841}
5842/* }}} */
5843#endif
5844
5845
5846/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
5847/** store a known (pre-)master secret into cache */
5848static void
5849ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
5850 StringInfo *mk)
5851{
5852 StringInfo *ht_key, *master_secret;
5853
5854 if (key->data_len == 0) {
5855 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
5856 return;
5857 }
5858
5859 if (mk->data_len == 0) {
5860 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
5861 G_STRFUNC((const char*) (__func__)), label);
5862 return;
5863 }
5864
5865 ht_key = ssl_data_clone(key);
5866 master_secret = ssl_data_clone(mk);
5867 g_hash_table_insert(ht, ht_key, master_secret);
5868
5869 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
5870 ssl_print_string("stored key", ht_key);
5871 ssl_print_string("stored (pre-)master secret", master_secret);
5872}
5873
5874/** restore a (pre-)master secret given some key in the cache */
5875static bool_Bool
5876ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
5877 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
5878{
5879 StringInfo *ms;
5880
5881 if (key->data_len == 0) {
5882 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
5883 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
5884 return false0;
5885 }
5886
5887 ms = (StringInfo *)g_hash_table_lookup(ht, key);
5888 if (!ms) {
5889 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
5890 is_pre_master ? "pre-" : "", label);
5891 return false0;
5892 }
5893
5894 /* (pre)master secret found, clear knowledge of other keys and set it in the
5895 * current conversation */
5896 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
5897 SSL_HAVE_SESSION_KEY(1<<3));
5898 if (is_pre_master) {
5899 /* unlike master secret, pre-master secret has a variable size (48 for
5900 * RSA, varying for PSK) and is therefore not statically allocated */
5901 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
5902 ms->data_len);
5903 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
5904 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
5905 } else {
5906 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
5907 ssl->state |= SSL_MASTER_SECRET(1<<5);
5908 }
5909 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
5910 is_pre_master ? "pre-" : "", label);
5911 ssl_print_string(label, key);
5912 ssl_print_string("(pre-)master secret", ms);
5913 return true1;
5914}
5915/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
5916
5917/* Should be called when all parameters are ready (after ChangeCipherSpec), and
5918 * the decoder should be attempted to be initialized. {{{*/
5919void
5920ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
5921{
5922 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
5923 /* TLS 1.3 implementations only provide secrets derived from the master
5924 * secret which are loaded in tls13_change_key. No master secrets can be
5925 * loaded here, so just return. */
5926 return;
5927 }
5928 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
5929 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
5930 ssl_debug_printf(" session key already available, nothing to do.\n");
5931 return;
5932 }
5933 if (!(ssl->state & SSL_CIPHER(1<<2))) {
5934 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
5935 return;
5936 }
5937
5938 /* for decryption, there needs to be a master secret (which can be derived
5939 * from pre-master secret). If missing, try to pick a master key from cache
5940 * (an earlier packet in the capture or key logfile). */
5941 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
5942 !ssl_restore_master_key(ssl, "Session ID", false0,
5943 mk_map->session, &ssl->session_id) &&
5944 (!ssl->session.is_session_resumed ||
5945 !ssl_restore_master_key(ssl, "Session Ticket", false0,
5946 mk_map->tickets, &ssl->session_ticket)) &&
5947 !ssl_restore_master_key(ssl, "Client Random", false0,
5948 mk_map->crandom, &ssl->client_random)) {
5949 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
5950 /* how unfortunate, the master secret could not be found */
5951 ssl_debug_printf(" Cannot find master secret\n");
5952 return;
5953 } else {
5954 ssl_debug_printf(" Cannot find master secret, continuing anyway "
5955 "because of a NULL cipher\n");
5956 }
5957 }
5958
5959 if (ssl_generate_keyring_material(ssl) < 0) {
5960 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
5961 return;
5962 }
5963 /* Save Client Random/ Session ID for "SSL Export Session keys" */
5964 ssl_save_master_key("Client Random", mk_map->crandom,
5965 &ssl->client_random, &ssl->master_secret);
5966 ssl_save_master_key("Session ID", mk_map->session,
5967 &ssl->session_id, &ssl->master_secret);
5968 /* Only save the new secrets if the server sent the ticket. The client
5969 * ticket might have become stale. */
5970 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
5971 ssl_save_master_key("Session Ticket", mk_map->tickets,
5972 &ssl->session_ticket, &ssl->master_secret);
5973 }
5974} /* }}} */
5975
5976static StringInfo*
5977tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
5978 TLSRecordType type)
5979{
5980 /* XXX - In addition to an out-of-bound PSK, we could also save the
5981 * PSK from a NewSessionTicket; we would also need to compute the
5982 * resumption_master_secret. */
5983 if (tls->psk.data_len == 0)
5984 return NULL((void*)0);
5985
5986 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
5987 * a UAT instead of a single global PSK string preference, preferably
5988 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
5989 * SHOULD be used. We will try the negotiated hash algorithm regardless
5990 * with the PSK, but fall back to SHA-256 for the Early Secret, since
5991 * that's before the Server Hello completes negotiation.
5992 */
5993 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
5994 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
5995 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
5996 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
5997 }
5998
5999 int hash_algo = ssl_get_digest_by_name(dig->name);
6000 if (!hash_algo) {
6001 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6002 return NULL((void*)0);
6003 }
6004
6005 /* We can re-use this to store the Pseudo Random Key for each epoch. */
6006 uint8_t prk[DIGEST_MAX_SIZE48];
6007 StringInfo prk_string = { prk, dig->len };
6008 uint8_t *derived_secret;
6009
6010 uint8_t zeroes[DIGEST_MAX_SIZE48];
6011 memset(zeroes, 0, dig->len);
6012
6013 StringInfo *secret = NULL((void*)0);
6014 const char *label;
6015
6016 /* PRK = Early Secret */
6017 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6018
6019 if (type == TLS_SECRET_0RTT_APP) {
6020 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6020, "!is_from_server"))));
6021 label = "c e traffic";
6022 } else {
6023 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6024 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6025 return NULL((void*)0);
6026
6027 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6028 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6029 wmem_free(NULL((void*)0), derived_secret);
6030
6031 if (type == TLS_SECRET_HANDSHAKE) {
6032 label = is_from_server ? "s hs traffic" : "c hs traffic";
6033 } else {
6034 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6035 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6036 return NULL((void*)0);
6037
6038 /* PRK = Master Secret */
6039 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6040 wmem_free(NULL((void*)0), derived_secret);
6041
6042 label = is_from_server ? "s ap traffic" : "c ap traffic";
6043 }
6044 }
6045
6046 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6047 * support ECHO with psk_ke?) then we should use ech_transcript instead
6048 * of handshake_data. Perhaps we should consolidate some of that handling,
6049 * though note that we would have to keep both transcripts around after
6050 * the ClientHello until the ServerHello indicated whether ECHO was
6051 * accepted or not. */
6052 if (!tls13_derive_secret(hash_algo, &prk_string,
6053 tls13_hkdf_label_prefix(tls), label,
6054 tls->handshake_data.data, tls->handshake_data.data_len,
6055 dig->len, &derived_secret))
6056 return NULL((void*)0);
6057
6058 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6059 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6060 secret->data_len = dig->len;
6061 wmem_free(NULL((void*)0), derived_secret);
6062 return secret;
6063}
6064
6065/* Load the traffic key secret from the keylog file. */
6066StringInfo *
6067tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6068 bool_Bool is_from_server, TLSRecordType type)
6069{
6070 GHashTable *key_map;
6071 const char *label;
6072
6073 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6074 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6075 return NULL((void*)0);
6076 }
6077
6078 if (ssl->client_random.data_len == 0) {
6079 /* May happen if Hello message is missing and Finished is found. */
6080 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6081 return NULL((void*)0);
6082 }
6083
6084 switch (type) {
6085 case TLS_SECRET_0RTT_APP:
6086 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6086, "!is_from_server"))));
6087 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6088 key_map = mk_map->tls13_client_early;
6089 break;
6090 case TLS_SECRET_HANDSHAKE:
6091 if (is_from_server) {
6092 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6093 key_map = mk_map->tls13_server_handshake;
6094 } else {
6095 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6096 key_map = mk_map->tls13_client_handshake;
6097 }
6098 break;
6099 case TLS_SECRET_APP:
6100 if (is_from_server) {
6101 label = "SERVER_TRAFFIC_SECRET_0";
6102 key_map = mk_map->tls13_server_appdata;
6103 } else {
6104 label = "CLIENT_TRAFFIC_SECRET_0";
6105 key_map = mk_map->tls13_client_appdata;
6106 }
6107 break;
6108 default:
6109 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6109, __func__, "assertion \"not reached\" failed");
6110 }
6111
6112 /* Transitioning to new keys, mark old ones as unusable. */
6113 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6114 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6115
6116 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6117 if (!secret) {
6118 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6119 if (secret) {
6120 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6121 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6122 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6123 }
6124 }
6125 if (!secret) {
6126 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6127 /* Disable decryption, the keys are invalid. */
6128 if (is_from_server) {
6129 ssl->server = NULL((void*)0);
6130 } else {
6131 ssl->client = NULL((void*)0);
6132 }
6133 return NULL((void*)0);
6134 }
6135
6136 /* TLS 1.3 secret found, set new keys. */
6137 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6138 ssl_print_string("Client Random", &ssl->client_random);
6139 ssl_print_string(label, secret);
6140 return secret;
6141}
6142
6143/* Load the new key. */
6144void
6145tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6146 bool_Bool is_from_server, TLSRecordType type)
6147{
6148 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6149 /*
6150 * QUIC does not use the TLS record layer for message protection.
6151 * The required keys will be extracted later by QUIC.
6152 */
6153 return;
6154 }
6155
6156 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6157 if (!secret) {
6158 if (type != TLS_SECRET_HANDSHAKE) {
6159 return;
6160 }
6161 /*
6162 * Workaround for when for some reason we don't have the handshake
6163 * secret but do have the application traffic secret. (#20240)
6164 * If we can't find the handshake secret, we'll never decrypt the
6165 * Finished message, so we won't know when to change to the app
6166 * traffic key, so we do so now.
6167 */
6168 type = TLS_SECRET_APP;
6169 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6170 if (!secret) {
6171 return;
6172 }
6173 }
6174
6175 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6176 /*
6177 * Remember the application traffic secret to support Key Update. The
6178 * other secrets cannot be used for this purpose, so free them.
6179 */
6180 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6181 StringInfo *app_secret = &decoder->app_traffic_secret;
6182 if (type == TLS_SECRET_APP) {
6183 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6184 app_secret->data,
6185 secret->data_len);
6186 ssl_data_set(app_secret, secret->data, secret->data_len);
6187 } else {
6188 wmem_free(wmem_file_scope(), app_secret->data);
6189 app_secret->data = NULL((void*)0);
6190 app_secret->data_len = 0;
6191 }
6192 }
6193}
6194
6195/**
6196 * Update to next application data traffic secret for TLS 1.3. The previous
6197 * secret should have been set by tls13_change_key.
6198 */
6199void
6200tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6201{
6202 /* RFC 8446 Section 7.2:
6203 * application_traffic_secret_N+1 =
6204 * HKDF-Expand-Label(application_traffic_secret_N,
6205 * "traffic upd", "", Hash.length)
6206 *
6207 * Both application_traffic_secret_N are of the same length (Hash.length).
6208 */
6209 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6210 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6211 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6212 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6213
6214 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6215 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6216 return;
6217 }
6218
6219 /*
6220 * Previous traffic secret is available, so find the hash function,
6221 * expand the new traffic secret and generate new keys.
6222 */
6223 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6224 int hash_algo = ssl_get_digest_by_name(hash_name);
6225 const unsigned hash_len = app_secret->data_len;
6226 unsigned char *new_secret;
6227 const char *label = "traffic upd";
6228 if (tls13_draft_version && tls13_draft_version < 20) {
6229 label = "application traffic secret";
6230 }
6231 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6232 tls13_hkdf_label_prefix(ssl),
6233 label, hash_len, &new_secret)) {
6234 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6235 return;
6236 }
6237 ssl_data_set(app_secret, new_secret, hash_len);
6238 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6239 /*
6240 * Remember the application traffic secret on the new decoder to
6241 * support another Key Update.
6242 */
6243 decoder = is_from_server ? ssl->server : ssl->client;
6244 app_secret = &decoder->app_traffic_secret;
6245 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6246 app_secret->data,
6247 hash_len);
6248 ssl_data_set(app_secret, new_secret, hash_len);
6249 }
6250 wmem_free(NULL((void*)0), new_secret);
6251}
6252
6253void
6254tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6255{
6256 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6257 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6258 }
6259}
6260
6261/** SSL keylog file handling. {{{ */
6262
6263static GRegex *
6264ssl_compile_keyfile_regex(void)
6265{
6266#define OCTET "(?:[[:xdigit:]]{2})"
6267 const char *pattern =
6268 "(?:"
6269 /* Matches Client Hellos having this Client Random */
6270 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6271 /* Matches first part of encrypted RSA pre-master secret */
6272 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6273 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6274 but it can be of any length for DHE */
6275 ")(?<pms>" OCTET "+)"
6276 "|(?:"
6277 /* Matches Server Hellos having a Session ID */
6278 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6279 /* Matches Client Hellos having this Client Random */
6280 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6281 /* Master-Secret is given, its length is fixed */
6282 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6283 "|(?"
6284 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6285 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6286 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6287 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6288 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6289 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6290 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6291 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6292 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6293 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6294 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6295 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6296 ") (?<derived_secret>" OCTET "+)";
6297#undef OCTET
6298 static GRegex *regex = NULL((void*)0);
6299 GError *gerr = NULL((void*)0);
6300
6301 if (!regex) {
6302 regex = g_regex_new(pattern,
6303 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6304 G_REGEX_MATCH_ANCHORED, &gerr);
6305 if (gerr) {
6306 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6307 gerr->message);
6308 g_error_free(gerr);
6309 regex = NULL((void*)0);
6310 }
6311 }
6312
6313 return regex;
6314}
6315
6316typedef struct ssl_master_key_match_group {
6317 const char *re_group_name;
6318 GHashTable *master_key_ht;
6319} ssl_master_key_match_group_t;
6320
6321void
6322tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6323{
6324 ssl_master_key_match_group_t mk_groups[] = {
6325 { "encrypted_pmk", mk_map->pre_master },
6326 { "session_id", mk_map->session },
6327 { "client_random", mk_map->crandom },
6328 { "client_random_pms", mk_map->pms },
6329 /* TLS 1.3 map from Client Random to derived secret. */
6330 { "client_early", mk_map->tls13_client_early },
6331 { "client_handshake", mk_map->tls13_client_handshake },
6332 { "server_handshake", mk_map->tls13_server_handshake },
6333 { "client_appdata", mk_map->tls13_client_appdata },
6334 { "server_appdata", mk_map->tls13_server_appdata },
6335 { "early_exporter", mk_map->tls13_early_exporter },
6336 { "exporter", mk_map->tls13_exporter },
6337 { "ech_secret", mk_map->ech_secret },
6338 { "ech_config", mk_map->ech_config },
6339 };
6340
6341 /* The format of the file is a series of records with one of the following formats:
6342 * - "RSA xxxx yyyy"
6343 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6344 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6345 * (this is the original format introduced with bug 4349)
6346 *
6347 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6348 * Where xxxx is the SSL session ID (hex-encoded)
6349 * Where yyyy is the cleartext master secret (hex-encoded)
6350 * (added to support openssl s_client Master-Key output)
6351 * This is somewhat is a misnomer because there's nothing RSA specific
6352 * about this.
6353 *
6354 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6355 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6356 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6357 * (This format allows SSL connections to be decrypted, if a user can
6358 * capture the PMS but could not recover the MS for a specific session
6359 * with a SSL Server.)
6360 *
6361 * - "CLIENT_RANDOM xxxx yyyy"
6362 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6363 * Where yyyy is the cleartext master secret (hex-encoded)
6364 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6365 * ECDHE-RSA.)
6366 *
6367 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6368 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6369 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6370 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6371 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6372 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6373 * - "EXPORTER_SECRET xxxx yyyy"
6374 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6375 * Where yyyy is the secret (hex-encoded) derived from the early,
6376 * handshake or master secrets. (This format is introduced with TLS 1.3
6377 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6378 */
6379 GRegex *regex = ssl_compile_keyfile_regex();
6380 if (!regex)
6381 return;
6382
6383 const char *next_line = (const char *)data;
6384 const char *line_end = next_line + datalen;
6385 while (next_line && next_line < line_end) {
6386 const char *line = next_line;
6387 next_line = (const char *)memchr(line, '\n', line_end - line);
6388 ssize_t linelen;
6389
6390 if (next_line) {
6391 linelen = next_line - line;
6392 next_line++; /* drop LF */
6393 } else {
6394 linelen = (ssize_t)(line_end - line);
6395 }
6396 if (linelen > 0 && line[linelen - 1] == '\r') {
6397 linelen--; /* drop CR */
6398 }
6399
6400 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6401 GMatchInfo *mi;
6402 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6403 char *hex_key, *hex_pre_ms_or_ms;
6404 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6405 StringInfo *pre_ms_or_ms = NULL((void*)0);
6406 GHashTable *ht = NULL((void*)0);
6407
6408 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6409 * otherwise we will use the Master Secret
6410 */
6411 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6412 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6413 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6414 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6415 }
6416 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6417 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6418 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6419 }
6420 /* There is always a match, otherwise the regex is wrong. */
6421 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6421, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6422
6423 /* convert from hex to bytes and save to hashtable */
6424 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6425 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6426 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6427
6428 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6429 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6430 ssl_master_key_match_group_t *g = &mk_groups[i];
6431 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6432 if (hex_key && *hex_key) {
6433 ssl_debug_printf(" matched %s\n", g->re_group_name);
6434 ht = g->master_key_ht;
6435 from_hex(key, hex_key, strlen(hex_key));
6436 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6437 break;
6438 }
6439 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6440 }
6441 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6441, "ht")))); /* Cannot be reached, or regex is wrong. */
6442
6443 g_hash_table_insert(ht, key, pre_ms_or_ms);
6444
6445 } else if (linelen > 0 && line[0] != '#') {
6446 ssl_debug_printf(" unrecognized line\n");
6447 }
6448 /* always free match info even if there is no match. */
6449 g_match_info_free(mi);
6450 }
6451}
6452
6453void
6454ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6455 const ssl_master_key_map_t *mk_map)
6456{
6457 /* no need to try if no key log file is configured. */
6458 if (!tls_keylog_filename || !*tls_keylog_filename) {
6459 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6460 G_STRFUNC((const char*) (__func__)));
6461 return;
6462 }
6463
6464 /* Validate regexes before even trying to use it. */
6465 if (!ssl_compile_keyfile_regex()) {
6466 return;
6467 }
6468
6469 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6470
6471 /* if the keylog file was deleted/overwritten, re-open it */
6472 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6473 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6474 fclose(*keylog_file);
6475 *keylog_file = NULL((void*)0);
6476 }
6477
6478 if (*keylog_file == NULL((void*)0)) {
6479 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6480 if (!*keylog_file) {
6481 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6482 return;
6483 }
6484 }
6485
6486 for (;;) {
6487 char buf[1110], *line;
6488 line = fgets(buf, sizeof(buf), *keylog_file);
6489 if (!line) {
6490 if (feof(*keylog_file)) {
6491 /* Ensure that newly appended keys can be read in the future. */
6492 clearerr(*keylog_file);
6493 } else if (ferror(*keylog_file)) {
6494 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6495 fclose(*keylog_file);
6496 *keylog_file = NULL((void*)0);
6497 }
6498 break;
6499 }
6500 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6501 }
6502}
6503/** SSL keylog file handling. }}} */
6504
6505#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6506
6507static FILE* ssl_debug_file;
6508
6509void
6510ssl_set_debug(const char* name)
6511{
6512 static int debug_file_must_be_closed;
6513 int use_stderr;
6514
6515 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6516
6517 if (debug_file_must_be_closed)
6518 fclose(ssl_debug_file);
6519
6520 if (use_stderr)
6521 ssl_debug_file = stderrstderr;
6522 else if (!name || (strcmp(name, "") ==0))
6523 ssl_debug_file = NULL((void*)0);
6524 else
6525 ssl_debug_file = ws_fopenfopen(name, "w");
6526
6527 if (!use_stderr && ssl_debug_file)
6528 debug_file_must_be_closed = 1;
6529 else
6530 debug_file_must_be_closed = 0;
6531
6532 ssl_debug_printf("Wireshark SSL debug log \n\n");
6533#ifdef HAVE_LIBGNUTLS1
6534 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6535#endif
6536 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6537 ssl_debug_printf("\n");
6538}
6539
6540void
6541ssl_debug_flush(void)
6542{
6543 if (ssl_debug_file)
6544 fflush(ssl_debug_file);
6545}
6546
6547void
6548ssl_debug_printf(const char* fmt, ...)
6549{
6550 va_list ap;
6551
6552 if (!ssl_debug_file)
6553 return;
6554
6555 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6556 vfprintf(ssl_debug_file, fmt, ap);
6557 va_end(ap)__builtin_va_end(ap);
6558}
6559
6560void
6561ssl_print_data(const char* name, const unsigned char* data, size_t len)
6562{
6563 size_t i, j, k;
6564 if (!ssl_debug_file)
6565 return;
6566 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6567 for (i=0; i<len; i+=16) {
6568 fprintf(ssl_debug_file,"| ");
6569 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6570 fprintf(ssl_debug_file,"%.2x ",data[j]);
6571 for (; k<16; ++k)
6572 fprintf(ssl_debug_file," ");
6573 fputc('|', ssl_debug_file);
6574 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6575 unsigned char c = data[j];
6576 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6577 fputc(c, ssl_debug_file);
6578 }
6579 for (; k<16; ++k)
6580 fputc(' ', ssl_debug_file);
6581 fprintf(ssl_debug_file,"|\n");
6582 }
6583}
6584
6585void
6586ssl_print_string(const char* name, const StringInfo* data)
6587{
6588 ssl_print_data(name, data->data, data->data_len);
6589}
6590#endif /* SSL_DECRYPT_DEBUG }}} */
6591
6592/* UAT preferences callbacks. {{{ */
6593/* checks for SSL and DTLS UAT key list fields */
6594
6595bool_Bool
6596ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6597{
6598 // This should be removed in favor of Decode As. Make it optional.
6599 *err = NULL((void*)0);
6600 return true1;
6601}
6602
6603bool_Bool
6604ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6605{
6606 if (!p || strlen(p) == 0u) {
6607 // This should be removed in favor of Decode As. Make it optional.
6608 *err = NULL((void*)0);
6609 return true1;
6610 }
6611
6612 if (strcmp(p, "start_tls") != 0){
6613 uint16_t port;
6614 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6615 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6616 return false0;
6617 }
6618 }
6619
6620 *err = NULL((void*)0);
6621 return true1;
6622}
6623
6624bool_Bool
6625ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6626{
6627 ws_statb64struct stat st;
6628
6629 if (!p || strlen(p) == 0u) {
6630 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6631 return false0;
6632 } else {
6633 if (ws_stat64stat(p, &st) != 0) {
6634 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6635 return false0;
6636 }
6637 }
6638
6639 *err = NULL((void*)0);
6640 return true1;
6641}
6642
6643bool_Bool
6644ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6645{
6646#if defined(HAVE_LIBGNUTLS1)
6647 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6648 FILE *fp = NULL((void*)0);
6649
6650 if (p && (strlen(p) > 0u)) {
6651 fp = ws_fopenfopen(f->keyfile, "rb");
6652 if (fp) {
6653 char *msg = NULL((void*)0);
6654 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6655 if (!priv_key) {
6656 fclose(fp);
6657 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6658 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6659 return false0;
6660 }
6661 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6662 gnutls_x509_privkey_deinit(priv_key);
6663 fclose(fp);
6664 } else {
6665 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6666 return false0;
6667 }
6668 }
6669
6670 *err = NULL((void*)0);
6671 return true1;
6672#else
6673 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6674 return false0;
6675#endif
6676}
6677/* UAT preferences callbacks. }}} */
6678
6679/** maximum size of ssl_association_info() string */
6680#define SSL_ASSOC_MAX_LEN8192 8192
6681
6682typedef struct ssl_association_info_callback_data
6683{
6684 char *str;
6685 const char *table_protocol;
6686} ssl_association_info_callback_data_t;
6687
6688/**
6689 * callback function used by ssl_association_info() to traverse the SSL associations.
6690 */
6691static void
6692ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6693{
6694 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6695 const int l = (const int)strlen(data->str);
6696 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6697}
6698
6699/**
6700 * @return an information string on the SSL protocol associations. The string must be freed.
6701 */
6702char*
6703ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6704{
6705 ssl_association_info_callback_data_t data;
6706
6707 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6708 data.table_protocol = table_protocol;
6709 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6710 return data.str;
6711}
6712
6713
6714/** Begin of code related to dissection of wire data. */
6715
6716/* Helpers for dissecting Variable-Length Vectors. {{{ */
6717bool_Bool
6718ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6719 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6720 int hf_length, uint32_t min_value, uint32_t max_value)
6721{
6722 unsigned veclen_size;
6723 uint32_t veclen_value;
6724 proto_item *pi;
6725
6726 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6726, (uint64_t)min_value, (uint64_t)max_value))));
6727 if (offset > offset_end) {
6728 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6729 "Vector offset is past buffer end offset (%u > %u)",
6730 offset, offset_end);
6731 *ret_length = 0;
6732 return false0; /* Cannot read length. */
6733 }
6734
6735 if (max_value > 0xffffff) {
6736 veclen_size = 4;
6737 } else if (max_value > 0xffff) {
6738 veclen_size = 3;
6739 } else if (max_value > 0xff) {
6740 veclen_size = 2;
6741 } else {
6742 veclen_size = 1;
6743 }
6744
6745 if (offset_end - offset < veclen_size) {
6746 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6747 tvb, offset, offset_end - offset,
6748 "No more room for vector of length %u",
6749 veclen_size);
6750 *ret_length = 0;
6751 return false0; /* Cannot read length. */
6752 }
6753
6754 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6755 offset += veclen_size;
6756
6757 if (veclen_value < min_value) {
6758 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6759 "Vector length %u is smaller than minimum %u",
6760 veclen_value, min_value);
6761 } else if (veclen_value > max_value) {
6762 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6763 "Vector length %u is larger than maximum %u",
6764 veclen_value, max_value);
6765 }
6766
6767 if (offset_end - offset < veclen_value) {
6768 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
6769 "Vector length %u is too large, truncating it to %u",
6770 veclen_value, offset_end - offset);
6771 *ret_length = offset_end - offset;
6772 return false0; /* Length is truncated to avoid overflow. */
6773 }
6774
6775 *ret_length = veclen_value;
6776 return true1; /* Length is OK. */
6777}
6778
6779bool_Bool
6780ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6781 unsigned offset, unsigned offset_end)
6782{
6783 if (offset < offset_end) {
6784 unsigned trailing = offset_end - offset;
6785 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
6786 tvb, offset, trailing,
6787 "%u trailing byte%s unprocessed",
6788 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
6789 return false0; /* unprocessed data warning */
6790 } else if (offset > offset_end) {
6791 /*
6792 * Returned offset runs past the end. This should not happen and is
6793 * possibly a dissector bug.
6794 */
6795 unsigned excess = offset - offset_end;
6796 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6797 tvb, offset_end, excess,
6798 "Dissector processed too much data (%u byte%s)",
6799 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
6800 return false0; /* overflow error */
6801 }
6802
6803 return true1; /* OK, offset matches. */
6804}
6805/** }}} */
6806
6807
6808static uint32_t
6809ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6810 proto_tree *tree, uint32_t offset, uint32_t offset_end,
6811 uint16_t version, int hf_sig_len, int hf_sig);
6812
6813/* change_cipher_spec(20) dissection */
6814void
6815ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
6816 packet_info *pinfo, proto_tree *tree,
6817 uint32_t offset, SslSession *session,
6818 bool_Bool is_from_server,
6819 const SslDecryptSession *ssl)
6820{
6821 /*
6822 * struct {
6823 * enum { change_cipher_spec(1), (255) } type;
6824 * } ChangeCipherSpec;
6825 */
6826 proto_item *ti;
6827 proto_item_set_text(tree,
6828 "%s Record Layer: %s Protocol: Change Cipher Spec",
6829 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
6830 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
6831 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
6832
6833 if (session->version == TLSV1DOT3_VERSION0x304) {
6834 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
6835 return;
6836 }
6837
6838 /* Remember frame number of first CCS */
6839 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
6840 if (*ccs_frame == 0)
6841 *ccs_frame = pinfo->num;
6842
6843 /* Use heuristics to detect an abbreviated handshake, assume that missing
6844 * ServerHelloDone implies reusing previously negotiating keys. Then when
6845 * a Session ID or ticket is present, it must be a resumed session.
6846 * Normally this should be done at the Finished message, but that may be
6847 * encrypted so we do it here, at the last cleartext message. */
6848 if (is_from_server && ssl) {
6849 if (session->is_session_resumed) {
6850 const char *resumed = NULL((void*)0);
6851 if (ssl->session_ticket.data_len) {
6852 resumed = "Session Ticket";
6853 } else if (ssl->session_id.data_len) {
6854 resumed = "Session ID";
6855 }
6856 if (resumed) {
6857 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
6858 } else {
6859 /* Can happen if the capture somehow starts in the middle */
6860 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
6861 }
6862 } else {
6863 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
6864 }
6865 }
6866 if (is_from_server && session->is_session_resumed)
6867 expert_add_info(pinfo, ti, &hf->ei.resumed);
6868}
6869
6870/** Begin of handshake(22) record dissections */
6871
6872/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
6873 * {{{ */
6874static void
6875tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
6876{
6877 uint32_t sighash, hashalg, sigalg;
6878 proto_item *ti_sigalg;
6879 proto_tree *sigalg_tree;
6880
6881 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
6882 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
6883 if (ja4_data && !IS_GREASE_TLS(sighash)((((sighash) & 0x0f0f) == 0x0a0a) && (((sighash) &
0xff) == (((sighash)>>8) & 0xff)))) {
6884 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
6885 }
6886
6887 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
6888
6889 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
6890 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
6891 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
6892 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
6893 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
6894
6895 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
6896 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
6897 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
6898 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
6899 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
6900 sighash);
6901 }
6902} /* }}} */
6903
6904/* dissect a list of hash algorithms, return the number of bytes dissected
6905 this is used for the signature algorithms extension and for the
6906 TLS1.2 certificate request. {{{ */
6907static int
6908ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
6909 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
6910{
6911 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
6912 * struct {
6913 * HashAlgorithm hash;
6914 * SignatureAlgorithm signature;
6915 * } SignatureAndHashAlgorithm;
6916 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
6917 */
6918 proto_tree *subtree;
6919 proto_item *ti;
6920 unsigned sh_alg_length;
6921 uint32_t next_offset;
6922
6923 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
6924 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
6925 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
6926 return offset_end;
6927 }
6928 offset += 2;
6929 next_offset = offset + sh_alg_length;
6930
6931 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
6932 "Signature Hash Algorithms (%u algorithm%s)",
6933 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
6934 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
6935
6936 while (offset + 2 <= next_offset) {
6937 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
6938 offset += 2;
6939 }
6940
6941 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
6942 offset = next_offset;
6943 }
6944
6945 return offset;
6946} /* }}} */
6947
6948/* Dissection of DistinguishedName (for CertificateRequest and
6949 * certificate_authorities extension). {{{ */
6950static uint32_t
6951tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6952 proto_tree *tree, uint32_t offset, uint32_t offset_end)
6953{
6954 proto_item *ti;
6955 proto_tree *subtree;
6956 uint32_t dnames_length, next_offset;
6957 asn1_ctx_t asn1_ctx;
6958 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
6959
6960 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
6961 /* DistinguishedName certificate_authorities<0..2^16-1> */
6962 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
6963 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
6964 return offset_end;
6965 }
6966 offset += 2;
6967 next_offset = offset + dnames_length;
6968
6969 if (dnames_length > 0) {
6970 ti = proto_tree_add_none_format(tree,
6971 hf->hf.hs_dnames,
6972 tvb, offset, dnames_length,
6973 "Distinguished Names (%d byte%s)",
6974 dnames_length,
6975 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
6976 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
6977
6978 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
6979
6980 while (offset < next_offset) {
6981 /* get the length of the current certificate */
6982 uint32_t name_length;
6983
6984 if (dnames_count-- == 0) {
6985 /* stop adding to tree when the list is considered too large
6986 * https://gitlab.com/wireshark/wireshark/-/issues/16202
6987 Note: dnames_count must be set low enough not to hit the
6988 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
6989 */
6990 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
6991 tvb, offset, next_offset - offset, ENC_NA0x00000000);
6992 proto_item_set_generated(ti);
6993 return next_offset;
6994 }
6995
6996 /* opaque DistinguishedName<1..2^16-1> */
6997 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
6998 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
6999 return next_offset;
7000 }
7001 offset += 2;
7002
7003 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7004 subtree, hf->hf.hs_dname);
7005 offset += name_length;
7006 }
7007 }
7008 return offset;
7009} /* }}} */
7010
7011
7012/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7013static int
7014ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7015 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7016{
7017 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7018}
7019
7020static int
7021ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7022 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7023{
7024 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7025 hnd_type == SSL_HND_CERT_REQUEST) {
7026 /*
7027 * struct {
7028 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7029 * } SignatureSchemeList;
7030 */
7031
7032 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7033 } else {
7034 asn1_ctx_t asn1_ctx;
7035 unsigned pubkey_length, sign_length;
7036
7037 /*
7038 * struct {
7039 * uint32 valid_time;
7040 * SignatureScheme expected_cert_verify_algorithm;
7041 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7042 * } Credential;
7043 *
7044 * struct {
7045 * Credential cred;
7046 * SignatureScheme algorithm;
7047 * opaque signature<0..2^16-1>;
7048 * } DelegatedCredential;
7049 */
7050
7051 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7052
7053 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7054 offset += 4;
7055
7056 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7057 offset += 2;
7058
7059 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7060 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7061 return offset_end;
7062 }
7063 offset += 3;
7064 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7065 offset += pubkey_length;
7066
7067 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7068 offset += 2;
7069
7070 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7071 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7072 return offset_end;
7073 }
7074 offset += 2;
7075 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7076 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7077 offset += sign_length;
7078
7079 return offset;
7080 }
7081}
7082
7083static int
7084ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7085 packet_info *pinfo, proto_tree *tree,
7086 uint32_t offset, uint32_t offset_end,
7087 uint8_t hnd_type)
7088{
7089
7090 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7091
7092 switch (hnd_type) {
7093 case SSL_HND_CLIENT_HELLO: {
7094 proto_tree *alps_tree;
7095 proto_item *ti;
7096 uint32_t next_offset, alps_length, name_length;
7097
7098 /*
7099 * opaque ProtocolName<1..2^8-1>;
7100 * struct {
7101 * ProtocolName supported_protocols<2..2^16-1>
7102 * } ApplicationSettingsSupport;
7103 */
7104
7105 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7106 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7107 return offset_end;
7108 }
7109 offset += 2;
7110 next_offset = offset + alps_length;
7111
7112 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7113 tvb, offset, alps_length, ENC_NA0x00000000);
7114 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7115
7116 /* Parse list (note missing check for end of vector, ssl_add_vector below
7117 * ensures that data is always available.) */
7118 while (offset < next_offset) {
7119 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7120 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7121 return next_offset;
7122 }
7123 offset++;
7124
7125 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7126 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7127 offset += name_length;
7128 }
7129
7130 return offset;
7131 }
7132 case SSL_HND_ENCRYPTED_EXTS:
7133 /* Opaque blob */
7134 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7135 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7136 break;
7137 }
7138
7139 return offset_end;
7140}
7141
7142static int
7143ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7144 packet_info *pinfo, proto_tree *tree,
7145 uint32_t offset, uint32_t offset_end,
7146 uint8_t hnd_type, SslSession *session,
7147 bool_Bool is_dtls, ja4_data_t *ja4_data)
7148{
7149
7150 /* https://tools.ietf.org/html/rfc7301#section-3.1
7151 * opaque ProtocolName<1..2^8-1>;
7152 * struct {
7153 * ProtocolName protocol_name_list<2..2^16-1>
7154 * } ProtocolNameList;
7155 */
7156 proto_tree *alpn_tree;
7157 proto_item *ti;
7158 uint32_t next_offset, alpn_length, name_length;
7159 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7160
7161 /* ProtocolName protocol_name_list<2..2^16-1> */
7162 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7163 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7164 return offset_end;
7165 }
7166 offset += 2;
7167 next_offset = offset + alpn_length;
7168
7169 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7170 tvb, offset, alpn_length, ENC_NA0x00000000);
7171 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7172
7173 /* Parse list (note missing check for end of vector, ssl_add_vector below
7174 * ensures that data is always available.) */
7175 while (offset < next_offset) {
7176 /* opaque ProtocolName<1..2^8-1> */
7177 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7178 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7179 return next_offset;
7180 }
7181 offset++;
7182
7183 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7184 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7185 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7186 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7187 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7188 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7189 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7190 }
7191 else {
7192 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7193 alpn_last_char & 0x0F);
7194 }
7195 }
7196 /* Remember first ALPN ProtocolName entry for server. */
7197 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7198 /* '\0'-terminated string for dissector table match and prefix
7199 * comparison purposes. */
7200 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7201 name_length, ENC_ASCII0x00000000);
7202 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7203 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7204 name_length, ENC_ASCII0x00000000);
7205 }
7206 offset += name_length;
7207 }
7208
7209 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7210 * exactly one "ProtocolName". */
7211 if (proto_name) {
7212 dissector_handle_t handle;
7213
7214 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7215
7216 if (is_dtls) {
7217 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7218 proto_name);
7219 } else {
7220 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7221 proto_name);
7222 if (handle == NULL((void*)0)) {
7223 /* Try prefix matching */
7224 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7225 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7226
7227 /* string_string is inappropriate as it compares strings
7228 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7229 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7230 handle = find_dissector(alpn_proto->dissector_name);
7231 break;
7232 }
7233 }
7234 }
7235 }
7236 if (handle != NULL((void*)0)) {
7237 /* ProtocolName match, so set the App data dissector handle.
7238 * This may override protocols given via the UAT dialog, but
7239 * since the ALPN hint is precise, do it anyway. */
7240 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7241 (void *)session->app_handle,
7242 (void *)handle,
7243 dissector_handle_get_dissector_name(handle));
7244 session->app_handle = handle;
7245 }
7246 } else if (client_proto_name) {
7247 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7248 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7249 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7250 }
7251
7252 return offset;
7253}
7254
7255static int
7256ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7257 packet_info *pinfo, proto_tree *tree,
7258 uint32_t offset, uint32_t offset_end)
7259{
7260 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7261 * The "extension_data" field of a "next_protocol_negotiation" extension
7262 * in a "ServerHello" contains an optional list of protocols advertised
7263 * by the server. Protocols are named by opaque, non-empty byte strings
7264 * and the list of protocols is serialized as a concatenation of 8-bit,
7265 * length prefixed byte strings. Implementations MUST ensure that the
7266 * empty string is not included and that no byte strings are truncated.
7267 */
7268 uint32_t npn_length;
7269 proto_tree *npn_tree;
7270
7271 /* List is optional, do not add tree if there are no entries. */
7272 if (offset == offset_end) {
7273 return offset;
7274 }
7275
7276 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7277
7278 while (offset < offset_end) {
7279 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7280 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7281 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7282 return offset_end;
7283 }
7284 offset++;
7285
7286 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7287 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7288 offset += npn_length;
7289 }
7290
7291 return offset;
7292}
7293
7294static int
7295ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7296 packet_info *pinfo, proto_tree *tree,
7297 uint32_t offset, uint32_t offset_end)
7298{
7299 /* https://tools.ietf.org/html/rfc5746#section-3.2
7300 * struct {
7301 * opaque renegotiated_connection<0..255>;
7302 * } RenegotiationInfo;
7303 *
7304 */
7305 proto_tree *reneg_info_tree;
7306 uint32_t reneg_info_length;
7307
7308 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7309
7310 /* opaque renegotiated_connection<0..255> */
7311 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7312 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7313 return offset_end;
7314 }
7315 offset++;
7316
7317 if (reneg_info_length > 0) {
7318 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7319 offset += reneg_info_length;
7320 }
7321
7322 return offset;
7323}
7324
7325static int
7326ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7327 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7328 const char **group_name_out)
7329{
7330 /* RFC 8446 Section 4.2.8
7331 * struct {
7332 * NamedGroup group;
7333 * opaque key_exchange<1..2^16-1>;
7334 * } KeyShareEntry;
7335 */
7336 uint32_t key_exchange_length, group;
7337 proto_tree *ks_tree;
7338
7339 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7340
7341 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7342 offset += 2;
7343 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7344 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7345 if (group_name_out) {
7346 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7347 }
7348
7349 /* opaque key_exchange<1..2^16-1> */
7350 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7351 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7352 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7353 }
7354 offset += 2;
7355 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7356 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7357
7358 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7359 offset += key_exchange_length;
7360
7361 return offset;
7362}
7363
7364static int
7365ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7366 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7367 uint8_t hnd_type, SslDecryptSession *ssl)
7368{
7369 proto_tree *key_share_tree;
7370 uint32_t next_offset;
7371 uint32_t client_shares_length;
7372 uint32_t group;
7373 const char *group_name = NULL((void*)0);
7374
7375 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7376 return offset;
7377 }
7378
7379 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7380
7381 switch(hnd_type){
7382 case SSL_HND_CLIENT_HELLO:
7383 /* KeyShareEntry client_shares<0..2^16-1> */
7384 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7385 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7386 return offset_end;
7387 }
7388 offset += 2;
7389 next_offset = offset + client_shares_length;
7390 const char *sep = " ";
7391 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7392 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7393 if (group_name) {
7394 proto_item_append_text(tree, "%s%s", sep, group_name);
7395 sep = ", ";
7396 }
7397 }
7398 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7399 return next_offset;
7400 }
7401 break;
7402 case SSL_HND_SERVER_HELLO:
7403 if (ssl) {
7404 ssl->has_key_share = true1;
7405 }
7406 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7407 if (group_name) {
7408 proto_item_append_text(tree, " %s", group_name);
7409 }
7410 break;
7411 case SSL_HND_HELLO_RETRY_REQUEST:
7412 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7413 offset += 2;
7414 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7415 proto_item_append_text(tree, " %s", group_name);
7416 break;
7417 default: /* no default */
7418 break;
7419 }
7420
7421 return offset;
7422}
7423
7424static int
7425ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7426 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7427 uint8_t hnd_type, SslDecryptSession *ssl)
7428{
7429 /* RFC 8446 Section 4.2.11
7430 * struct {
7431 * opaque identity<1..2^16-1>;
7432 * uint32 obfuscated_ticket_age;
7433 * } PskIdentity;
7434 * opaque PskBinderEntry<32..255>;
7435 * struct {
7436 * select (Handshake.msg_type) {
7437 * case client_hello:
7438 * PskIdentity identities<7..2^16-1>;
7439 * PskBinderEntry binders<33..2^16-1>;
7440 * case server_hello:
7441 * uint16 selected_identity;
7442 * };
7443 * } PreSharedKeyExtension;
7444 */
7445
7446 proto_tree *psk_tree;
7447
7448 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7449
7450 switch (hnd_type){
7451 case SSL_HND_CLIENT_HELLO: {
7452 uint32_t identities_length, identities_end, binders_length;
7453
7454 /* PskIdentity identities<7..2^16-1> */
7455 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7456 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7457 return offset_end;
7458 }
7459 offset += 2;
7460 identities_end = offset + identities_length;
7461
7462 while (offset < identities_end) {
7463 uint32_t identity_length;
7464 proto_tree *identity_tree;
7465
7466 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7467
7468 /* opaque identity<1..2^16-1> */
7469 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7470 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7471 return identities_end;
7472 }
7473 offset += 2;
7474 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7475
7476 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7477 offset += identity_length;
7478
7479 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7480 offset += 4;
7481
7482 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7483 }
7484 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7485 offset = identities_end;
7486 }
7487
7488 /* PskBinderEntry binders<33..2^16-1> */
7489 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7490 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7491 return offset_end;
7492 }
7493 offset += 2;
7494
7495 proto_item *binders_item;
7496 proto_tree *binders_tree;
7497 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7498 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7499 uint32_t binders_end = offset + binders_length;
7500 while (offset < binders_end) {
7501 uint32_t binder_length;
7502 proto_item *binder_item;
7503 proto_tree *binder_tree;
7504
7505 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7506 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7507
7508 /* opaque PskBinderEntry<32..255>; */
7509 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7510 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7511 return binders_end;
7512 }
7513 offset += 1;
7514 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7515
7516 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7517 offset += binder_length;
7518
7519 proto_item_set_end(binder_item, tvb, offset);
7520 }
7521 }
7522 break;
7523 case SSL_HND_SERVER_HELLO: {
7524 if (ssl) {
7525 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7526 ssl->has_psk = true1;
7527 }
7528 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7529 offset += 2;
7530 }
7531 break;
7532 default:
7533 break;
7534 }
7535
7536 return offset;
7537}
7538
7539static uint32_t
7540ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7541 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7542 uint8_t hnd_type, SslDecryptSession *ssl)
7543{
7544 /* RFC 8446 Section 4.2.10
7545 * struct {} Empty;
7546 * struct {
7547 * select (Handshake.msg_type) {
7548 * case new_session_ticket: uint32 max_early_data_size;
7549 * case client_hello: Empty;
7550 * case encrypted_extensions: Empty;
7551 * };
7552 * } EarlyDataIndication;
7553 */
7554 switch (hnd_type) {
7555 case SSL_HND_CLIENT_HELLO:
7556 /* Remember that early_data will follow the handshake. */
7557 if (ssl) {
7558 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7559 ssl->has_early_data = true1;
7560 }
7561 break;
7562 case SSL_HND_NEWSESSION_TICKET:
7563 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7564 offset += 4;
7565 break;
7566 default:
7567 break;
7568 }
7569 return offset;
7570}
7571
7572static uint16_t
7573tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7574{
7575 if (draft_version) {
7576 *draft_version = 0;
7577 }
7578 if (!is_dtls) {
7579 uint8_t tls13_draft = extract_tls13_draft_version(version);
7580 if (tls13_draft != 0) {
7581 /* This is TLS 1.3 (a draft version). */
7582 if (draft_version) {
7583 *draft_version = tls13_draft;
7584 }
7585 version = TLSV1DOT3_VERSION0x304;
7586 }
7587 if (version == 0xfb17 || version == 0xfb1a) {
7588 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7589 tls13_draft = (uint8_t)version;
7590 if (draft_version) {
7591 *draft_version = tls13_draft;
7592 }
7593 version = TLSV1DOT3_VERSION0x304;
7594 }
7595 }
7596
7597 switch (version) {
7598 case SSLV3_VERSION0x300:
7599 case TLSV1_VERSION0x301:
7600 case TLSV1DOT1_VERSION0x302:
7601 case TLSV1DOT2_VERSION0x303:
7602 case TLSV1DOT3_VERSION0x304:
7603 case TLCPV1_VERSION0x101:
7604 if (is_dtls)
7605 return SSL_VER_UNKNOWN0;
7606 break;
7607
7608 case DTLSV1DOT0_VERSION0xfeff:
7609 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7610 case DTLSV1DOT2_VERSION0xfefd:
7611 case DTLSV1DOT3_VERSION0xfefc:
7612 if (!is_dtls)
7613 return SSL_VER_UNKNOWN0;
7614 break;
7615
7616 default: /* invalid version number */
7617 return SSL_VER_UNKNOWN0;
7618 }
7619
7620 return version;
7621}
7622
7623static int
7624ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7625 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7626 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7627{
7628
7629 /* RFC 8446 Section 4.2.1
7630 * struct {
7631 * ProtocolVersion versions<2..254>; // ClientHello
7632 * } SupportedVersions;
7633 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7634 */
7635 uint32_t versions_length, next_offset;
7636 /* ProtocolVersion versions<2..254> */
7637 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7638 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7639 return offset_end;
7640 }
7641 offset++;
7642 next_offset = offset + versions_length;
7643
7644 unsigned version;
7645 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7646 uint8_t draft_version, max_draft_version = 0;
7647 const char *sep = " ";
7648 while (offset + 2 <= next_offset) {
7649 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7650 offset += 2;
7651
7652 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7653 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7654 sep = ", ";
7655 }
7656
7657 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7658 if (session->version == SSL_VER_UNKNOWN0) {
7659 if (lowest_version == SSL_VER_UNKNOWN0) {
7660 lowest_version = current_version;
7661 } else if (current_version != SSL_VER_UNKNOWN0) {
7662 if (!is_dtls) {
7663 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7664 } else {
7665 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7666 }
7667 }
7668 }
7669 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7670 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7671 /* The DTLS version numbers get mapped to "00" for unknown per
7672 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7673 * need to take the MIN instead of MAX here for DTLS.
7674 */
7675 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7676 }
7677 }
7678 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7679 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7680 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7681 }
7682 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7683 offset = next_offset;
7684 }
7685
7686 /* XXX remove this when draft 19 support is dropped,
7687 * this is only required for early data decryption. */
7688 if (max_draft_version) {
7689 session->tls13_draft_version = max_draft_version;
7690 }
7691
7692 return offset;
7693}
7694
7695static int
7696ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7697 packet_info *pinfo, proto_tree *tree,
7698 uint32_t offset, uint32_t offset_end)
7699{
7700 /* RFC 8446 Section 4.2.2
7701 * struct {
7702 * opaque cookie<1..2^16-1>;
7703 * } Cookie;
7704 */
7705 uint32_t cookie_length;
7706 /* opaque cookie<1..2^16-1> */
7707 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7708 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7709 return offset_end;
7710 }
7711 offset += 2;
7712
7713 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7714 offset += cookie_length;
7715
7716 return offset;
7717}
7718
7719static int
7720ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7721 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7722{
7723 /* RFC 8446 Section 4.2.9
7724 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7725 *
7726 * struct {
7727 * PskKeyExchangeMode ke_modes<1..255>;
7728 * } PskKeyExchangeModes;
7729 */
7730 uint32_t ke_modes_length, next_offset;
7731
7732 /* PskKeyExchangeMode ke_modes<1..255> */
7733 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7734 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7735 return offset_end;
7736 }
7737 offset++;
7738 next_offset = offset + ke_modes_length;
7739
7740 while (offset < next_offset) {
7741 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7742 offset++;
7743 }
7744
7745 return offset;
7746}
7747
7748static uint32_t
7749ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7750 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7751{
7752 /* RFC 8446 Section 4.2.4
7753 * opaque DistinguishedName<1..2^16-1>;
7754 * struct {
7755 * DistinguishedName authorities<3..2^16-1>;
7756 * } CertificateAuthoritiesExtension;
7757 */
7758 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7759}
7760
7761static int
7762ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7763 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7764{
7765 /* RFC 8446 Section 4.2.5
7766 * struct {
7767 * opaque certificate_extension_oid<1..2^8-1>;
7768 * opaque certificate_extension_values<0..2^16-1>;
7769 * } OIDFilter;
7770 * struct {
7771 * OIDFilter filters<0..2^16-1>;
7772 * } OIDFilterExtension;
7773 */
7774 proto_tree *subtree;
7775 uint32_t filters_length, oid_length, values_length, value_offset;
7776 asn1_ctx_t asn1_ctx;
7777 const char *oid, *name;
7778
7779 /* OIDFilter filters<0..2^16-1> */
7780 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
7781 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
7782 return offset_end;
7783 }
7784 offset += 2;
7785 offset_end = offset + filters_length;
7786
7787 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7788
7789 while (offset < offset_end) {
7790 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
7791 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
7792
7793 /* opaque certificate_extension_oid<1..2^8-1> */
7794 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
7795 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
7796 return offset_end;
7797 }
7798 offset++;
7799 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
7800 hf->hf.hs_ext_oid_filters_oid, &oid);
7801 offset += oid_length;
7802
7803 /* Append OID to tree label */
7804 name = oid_resolved_from_string(pinfo->pool, oid);
7805 proto_item_append_text(subtree, " (%s)", name ? name : oid);
7806
7807 /* opaque certificate_extension_values<0..2^16-1> */
7808 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
7809 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
7810 return offset_end;
7811 }
7812 offset += 2;
7813 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
7814 if (values_length > 0) {
7815 value_offset = offset;
7816 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
7817 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
7818 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
7819 }
7820 offset += values_length;
7821 }
7822
7823 return offset;
7824}
7825
7826static int
7827ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7828 packet_info *pinfo, proto_tree *tree,
7829 uint32_t offset, uint32_t offset_end)
7830{
7831 /* https://tools.ietf.org/html/rfc6066#section-3
7832 *
7833 * struct {
7834 * NameType name_type;
7835 * select (name_type) {
7836 * case host_name: HostName;
7837 * } name;
7838 * } ServerName;
7839 *
7840 * enum {
7841 * host_name(0), (255)
7842 * } NameType;
7843 *
7844 * opaque HostName<1..2^16-1>;
7845 *
7846 * struct {
7847 * ServerName server_name_list<1..2^16-1>
7848 * } ServerNameList;
7849 */
7850 proto_tree *server_name_tree;
7851 uint32_t list_length, server_name_length, next_offset;
7852
7853 /* The server SHALL include "server_name" extension with empty data. */
7854 if (offset == offset_end) {
7855 return offset;
7856 }
7857
7858 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
7859
7860 /* ServerName server_name_list<1..2^16-1> */
7861 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
7862 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
7863 return offset_end;
7864 }
7865 offset += 2;
7866 next_offset = offset + list_length;
7867
7868 while (offset < next_offset) {
7869 uint32_t name_type;
7870 const char *server_name = NULL((void*)0);
7871 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
7872 tvb, offset, 1, ENC_NA0x00000000, &name_type);
7873 offset++;
7874
7875 /* opaque HostName<1..2^16-1> */
7876 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
7877 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
7878 return next_offset;
7879 }
7880 offset += 2;
7881
7882 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
7883 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
7884 pinfo->pool, (const uint8_t**)&server_name);
7885 offset += server_name_length;
7886 // Each type must only occur once, so we don't check for duplicates.
7887 if (name_type == 0) {
7888 proto_item_append_text(tree, " name=%s", server_name);
7889 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
7890
7891 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
7892 // Client Hello: Client (Src) -> Server (Dst)
7893 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
7894 case AT_IPv4:
7895 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
7896 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7897 }
7898 break;
7899 case AT_IPv6:
7900 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
7901 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7902 }
7903 break;
7904 }
7905 }
7906 }
7907 }
7908 return offset;
7909}
7910
7911static int
7912ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7913 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
7914{
7915 unsigned ext_len = offset_end - offset;
7916 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
7917 tvb_ensure_bytes_exist(tvb, offset, ext_len);
7918 /* Save the Session Ticket such that it can be used as identifier for
7919 * restoring a previous Master Secret (in ChangeCipherSpec) */
7920 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
7921 ssl->session_ticket.data, ext_len);
7922 ssl->session_ticket.data_len = ext_len;
7923 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
7924 }
7925 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
7926 tvb, offset, ext_len, ENC_NA0x00000000);
7927 return offset + ext_len;
7928}
7929
7930static int
7931ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7932 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7933 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
7934{
7935 uint8_t cert_list_length;
7936 uint8_t cert_type;
7937 proto_tree *cert_list_tree;
7938 proto_item *ti;
7939
7940 switch(hnd_type){
7941 case SSL_HND_CLIENT_HELLO:
7942 cert_list_length = tvb_get_uint8(tvb, offset);
7943 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
7944 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7945 offset += 1;
7946 if (offset_end - offset != (uint32_t)cert_list_length)
7947 return offset;
7948
7949 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
7950 cert_list_length, cert_list_length);
7951 proto_item_append_text(ti, " (%d)", cert_list_length);
7952
7953 /* make this a subtree */
7954 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
7955
7956 /* loop over all point formats */
7957 while (cert_list_length > 0)
7958 {
7959 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7960 offset++;
7961 cert_list_length--;
7962 }
7963 break;
7964 case SSL_HND_SERVER_HELLO:
7965 case SSL_HND_ENCRYPTED_EXTENSIONS:
7966 case SSL_HND_CERTIFICATE:
7967 cert_type = tvb_get_uint8(tvb, offset);
7968 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7969 offset += 1;
7970 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
7971 session->client_cert_type = cert_type;
7972 }
7973 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
7974 session->server_cert_type = cert_type;
7975 }
7976 break;
7977 default: /* no default */
7978 break;
7979 }
7980
7981 return offset;
7982}
7983
7984static uint32_t
7985ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7986 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7987 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
7988{
7989 uint32_t compress_certificate_algorithms_length, next_offset;
7990
7991 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
7992 * enum {
7993 * zlib(1),
7994 * brotli(2),
7995 * (65535)
7996 * } CertificateCompressionAlgorithm;
7997 *
7998 * struct {
7999 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8000 * } CertificateCompressionAlgorithms;
8001 */
8002 switch (hnd_type) {
8003 case SSL_HND_CLIENT_HELLO:
8004 case SSL_HND_CERT_REQUEST:
8005 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8006 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8007 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8008 return offset_end;
8009 }
8010 offset += 1;
8011 next_offset = offset + compress_certificate_algorithms_length;
8012
8013 while (offset < next_offset) {
8014 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8015 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8016 offset += 2;
8017 }
8018 break;
8019 default:
8020 break;
8021 }
8022
8023 return offset;
8024}
8025
8026static uint32_t
8027ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8028 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8029 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8030{
8031 uint32_t key_parameters_length, next_offset;
8032 proto_item *p_ti;
8033 proto_tree *p_tree;
8034
8035 /* RFC 8472
8036 *
8037 * struct {
8038 * uint8 major;
8039 * uint8 minor;
8040 * } TB_ProtocolVersion;
8041 *
8042 * enum {
8043 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8044 * } TokenBindingKeyParameters;
8045 *
8046 * struct {
8047 * TB_ProtocolVersion token_binding_version;
8048 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8049 * } TokenBindingParameters;
8050 */
8051
8052 switch (hnd_type) {
8053 case SSL_HND_CLIENT_HELLO:
8054 case SSL_HND_SERVER_HELLO:
8055 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8056 offset += 1;
8057 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8058 offset += 1;
8059
8060 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8061 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8062 return offset_end;
8063 }
8064 offset += 1;
8065 next_offset = offset + key_parameters_length;
8066
8067 p_ti = proto_tree_add_none_format(tree,
8068 hf->hf.hs_ext_token_binding_key_parameters,
8069 tvb, offset, key_parameters_length,
8070 "Key parameters identifiers (%d identifier%s)",
8071 key_parameters_length,
8072 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8073 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8074
8075 while (offset < next_offset) {
8076 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8077 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8078 offset += 1;
8079 }
8080
8081 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8082 offset = next_offset;
8083 }
8084
8085 break;
8086 default:
8087 break;
8088 }
8089
8090 return offset;
8091}
8092
8093static uint32_t
8094ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8095 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8096 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8097{
8098 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8099 uint32_t next_offset;
8100
8101 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8102 *
8103 * Note: the following structures are not literally defined in the spec,
8104 * they instead use an ASCII diagram.
8105 *
8106 * struct {
8107 * uint16 id;
8108 * opaque value<0..2^16-1>;
8109 * } TransportParameter; // before draft -27
8110 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8111 *
8112 * struct {
8113 * opaque ipv4Address[4];
8114 * uint16 ipv4Port;
8115 * opaque ipv6Address[16];
8116 * uint16 ipv6Port;
8117 * opaque connectionId<0..18>;
8118 * opaque statelessResetToken[16];
8119 * } PreferredAddress;
8120 */
8121
8122 if (offset_end - offset >= 6 &&
8123 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8124 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8125 // Assume encoding of Transport Parameters draft -26 or older with at
8126 // least one transport parameter that has a valid length.
8127 use_varint_encoding = false0;
8128 }
8129
8130 if (use_varint_encoding) {
8131 next_offset = offset_end;
8132 } else {
8133 uint32_t quic_length;
8134 // Assume draft -26 or earlier.
8135 /* TransportParameter TransportParameters<0..2^16-1>; */
8136 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8137 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8138 return offset_end;
8139 }
8140 offset += 2;
8141 next_offset = offset + quic_length;
8142 }
8143
8144 while (offset < next_offset) {
8145 uint64_t parameter_type; /* 62-bit space */
8146 uint32_t parameter_length;
8147 proto_tree *parameter_tree;
8148 uint32_t parameter_end_offset;
8149 uint64_t value;
8150 uint32_t i;
8151 unsigned len = 0;
8152
8153 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8154 NULL((void*)0), "Parameter");
8155 /* TransportParameter ID and Length. */
8156 if (use_varint_encoding) {
8157 uint64_t parameter_length64;
8158 unsigned type_len = 0;
8159
8160 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8161 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8162 offset += type_len;
8163
8164 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8165 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8166 parameter_length = (uint32_t)parameter_length64;
8167 offset += len;
8168
8169 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8170 } else {
8171 parameter_type = tvb_get_ntohs(tvb, offset);
8172 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8173 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8174 offset += 2;
8175
8176 /* opaque value<0..2^16-1> */
8177 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8178 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8179 return next_offset;
8180 }
8181 offset += 2;
8182
8183 proto_item_set_len(parameter_tree, 4 + parameter_length);
8184 }
8185
8186 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8187 proto_item_append_text(parameter_tree, ": GREASE");
8188 } else {
8189 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8190 }
8191
8192 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8193 parameter_end_offset = offset + parameter_length;
8194
8195 /* Omit the value field if the parameter's length is 0. */
8196 if (parameter_length != 0) {
8197 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8198 tvb, offset, parameter_length, ENC_NA0x00000000);
8199 }
8200
8201 switch (parameter_type) {
8202 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8203 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8204 tvb, offset, parameter_length, ENC_NA0x00000000);
8205 offset += parameter_length;
8206 break;
8207 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8208 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8209 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8210 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8211 offset += len;
8212 break;
8213 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8214 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8215 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8216 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8217 offset += 16;
8218 break;
8219 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8220 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8221 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8222 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8223 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8224 offset += len;
8225 break;
8226 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8227 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8228 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8229 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8230 offset += len;
8231 break;
8232 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8233 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8234 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8235 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8236 offset += len;
8237 break;
8238 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8239 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8240 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8241 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8242 offset += len;
8243 break;
8244 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8245 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8246 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8247 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8248 offset += len;
8249 break;
8250 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8251 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8252 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8253 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8254 offset += len;
8255 break;
8256 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8257 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8258 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8259 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8260 offset += len;
8261 break;
8262 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8263 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8264 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8265 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8266 offset += len;
8267 break;
8268 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8269 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8270 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8271 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8272 offset += len;
8273 break;
8274 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8275 /* No Payload */
8276 break;
8277 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8278 uint32_t connectionid_length;
8279 quic_cid_t cid;
8280
8281 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8282 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8283 offset += 4;
8284 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8285 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8286 offset += 2;
8287 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8288 tvb, offset, 16, ENC_NA0x00000000);
8289 offset += 16;
8290 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8291 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8292 offset += 2;
8293 /* XXX - Should we add these addresses and ports as addresses that the client
8294 * is allowed / expected to migrate the server address to? Right now we don't
8295 * enforce that (see RFC 9000 Section 9, which implies that while the client
8296 * can migrate to whatever address it wants, it can only migrate the server
8297 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8298 */
8299
8300 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8301 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8302 break;
8303 }
8304 offset += 1;
8305
8306 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8307 tvb, offset, connectionid_length, ENC_NA0x00000000);
8308 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8309 cid.len = connectionid_length;
8310 // RFC 9000 5.1.1 "If the preferred_address transport
8311 // parameter is sent, the sequence number of the supplied
8312 // connection ID is 1."
8313 cid.seq_num = 1;
8314 // Multipath draft-07 "Also, the Path Identifier for the
8315 // connection ID specified in the "preferred address"
8316 // transport parameter is 0."
8317 cid.path_id = 0;
8318 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8319 quic_add_connection(pinfo, &cid);
8320 }
8321 offset += connectionid_length;
8322
8323 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8324 tvb, offset, 16, ENC_NA0x00000000);
8325 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8326 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8327 }
8328 offset += 16;
8329 }
8330 break;
8331 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8332 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8333 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8334 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8335 offset += len;
8336 break;
8337 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8338 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8339 tvb, offset, parameter_length, ENC_NA0x00000000);
8340 offset += parameter_length;
8341 break;
8342 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8343 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8344 tvb, offset, parameter_length, ENC_NA0x00000000);
8345 offset += parameter_length;
8346 break;
8347 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8348 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8349 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8350 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8351 offset += len;
8352 break;
8353 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8354 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8355 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8356 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8357 offset += len;
8358 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8359 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8360 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8361 offset += len;
8362 break;
8363 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8364 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8365 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8366 if (len > 0) {
8367 quic_add_loss_bits(pinfo, value);
8368 }
8369 offset += 1;
8370 break;
8371 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8372 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8373 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8374 offset += len;
8375 break;
8376 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8377 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8378 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8379 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8380 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8381 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8382 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8383 offset += len;
8384 break;
8385 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8386 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8387 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8388 offset += parameter_length;
8389 break;
8390 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8391 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8392 tvb, offset, parameter_length, ENC_NA0x00000000);
8393 offset += parameter_length;
8394 break;
8395 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8396 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8397 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8398 offset += 4;
8399 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8400 uint32_t versions_length;
8401
8402 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8403 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8404 offset += 1;
8405 for (i = 0; i < versions_length / 4; i++) {
8406 quic_proto_tree_add_version(tvb, parameter_tree,
8407 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8408 offset += 4;
8409 }
8410 }
8411 break;
8412 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8413 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8414 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8415 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8416 offset += len;
8417 break;
8418 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8419 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8420 tvb, offset, parameter_length, ENC_NA0x00000000);
8421 offset += parameter_length;
8422 break;
8423 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8424 /* This field was used for non-standard Google-specific parameters encoded as a
8425 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8426 * parameters. Report it as a bytes blob... */
8427 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8428 tvb, offset, parameter_length, ENC_NA0x00000000);
8429 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8430 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8431 tvb, offset, 4, ENC_NA0x00000000);
8432 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8433 offset += parameter_length;
8434 break;
8435 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8436 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8437 tvb, offset, parameter_length, ENC_NA0x00000000);
8438 offset += parameter_length;
8439 break;
8440 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8441 /* No Payload */
8442 break;
8443 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8444 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8445 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8446 offset += parameter_length;
8447 break;
8448 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8449 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8450 quic_proto_tree_add_version(tvb, parameter_tree,
8451 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8452 offset += 4;
8453 for (i = 4; i < parameter_length; i += 4) {
8454 quic_proto_tree_add_version(tvb, parameter_tree,
8455 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8456 offset += 4;
8457 }
8458 break;
8459 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8460 /* No Payload */
8461 quic_add_grease_quic_bit(pinfo);
8462 break;
8463 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8464 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8465 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8466 offset += parameter_length;
8467 break;
8468 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8469 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8470 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8471 if (value == 1) {
8472 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8473 }
8474 offset += parameter_length;
8475 break;
8476 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8477 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8478 /* No Payload */
8479 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8480 break;
8481 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8482 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8483 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8484 if (value > 1) {
8485 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8486 }
8487 /* multipath draft-07: "The value of the initial_max_paths
8488 * parameter MUST be at least 2." TODO: Expert Info? */
8489 offset += parameter_length;
8490 break;
8491 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8492 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8493 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8494 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8495 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8496 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8497 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8498 /* multipath draft-09 and later: "If an endpoint receives an
8499 * initial_max_path_id transport parameter with value 0, the
8500 * peer aims to enable the multipath extension without allowing
8501 * extra paths immediately."
8502 */
8503 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8504 offset += parameter_length;
8505 break;
8506 default:
8507 offset += parameter_length;
8508 /*TODO display expert info about unknown ? */
8509 break;
8510 }
8511
8512 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8513 /* Dissection did not end at expected location, fix it. */
8514 offset = parameter_end_offset;
8515 }
8516 }
8517
8518 return offset;
8519}
8520
8521static int
8522ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8523 proto_tree *tree, uint32_t offset,
8524 SslSession *session, SslDecryptSession *ssl,
8525 bool_Bool from_server, bool_Bool is_hrr)
8526{
8527 uint8_t sessid_length;
8528 proto_item *ti;
8529 proto_tree *rnd_tree;
8530 proto_tree *ti_rnd;
8531 proto_tree *ech_confirm_tree;
8532 uint8_t draft_version = session->tls13_draft_version;
8533
8534 if (ssl) {
8535 StringInfo *rnd;
8536 if (from_server)
8537 rnd = &ssl->server_random;
8538 else
8539 rnd = &ssl->client_random;
8540
8541 /* save provided random for later keyring generation */
8542 tvb_memcpy(tvb, rnd->data, offset, 32);
8543 rnd->data_len = 32;
8544 if (from_server)
8545 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8546 else
8547 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8548 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8549 from_server ? "SERVER" : "CLIENT", ssl->state);
8550 }
8551
8552 if (!from_server && session->client_random.data_len == 0) {
8553 session->client_random.data_len = 32;
8554 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8555 }
8556
8557 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8558
8559 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8560
8561 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8562 /* show the time */
8563 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8564 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8565 offset += 4;
8566
8567 /* show the random bytes */
8568 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8569 tvb, offset, 28, ENC_NA0x00000000);
8570 offset += 28;
8571 } else {
8572 if (is_hrr) {
8573 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8574 } else if (from_server && session->ech) {
8575 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8576 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
8577 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
8578 session->ech_confirmation, 8);
8579 proto_item_set_generated(ti);
8580 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
8581 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
8582 } else {
8583 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
8584 }
8585 }
8586
8587 offset += 32;
8588 }
8589
8590 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8591 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8592 /* show the session id (length followed by actual Session ID) */
8593 sessid_length = tvb_get_uint8(tvb, offset);
8594 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8595 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8596 offset++;
8597
8598 if (ssl) {
8599 /* save the authoritative SID for later use in ChangeCipherSpec.
8600 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8601 * save more, so ignore larger ones. To support ECH, also save
8602 * the SID from the ClientHelloOuter. */
8603 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8604 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8605 ssl->session_id.data_len = sessid_length;
8606 }
8607 }
8608 if (sessid_length > 0) {
8609 proto_tree_add_item(tree, hf->hf.hs_session_id,
8610 tvb, offset, sessid_length, ENC_NA0x00000000);
8611 offset += sessid_length;
8612 }
8613 }
8614
8615 return offset;
8616}
8617
8618static int
8619ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8620 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8621 bool_Bool has_length)
8622{
8623 /* TLS 1.2/1.3 status_request Client Hello Extension.
8624 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8625 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8626 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8627 * struct {
8628 * CertificateStatusType status_type;
8629 * uint16 request_length; // for status_request_v2
8630 * select (status_type) {
8631 * case ocsp: OCSPStatusRequest;
8632 * case ocsp_multi: OCSPStatusRequest;
8633 * } request;
8634 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8635 *
8636 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8637 * struct {
8638 * ResponderID responder_id_list<0..2^16-1>;
8639 * Extensions request_extensions;
8640 * } OCSPStatusRequest;
8641 * opaque ResponderID<1..2^16-1>;
8642 * opaque Extensions<0..2^16-1>;
8643 */
8644 unsigned cert_status_type;
8645
8646 cert_status_type = tvb_get_uint8(tvb, offset);
8647 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8648 tvb, offset, 1, ENC_NA0x00000000);
8649 offset++;
8650
8651 if (has_length) {
8652 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8653 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8654 offset += 2;
8655 }
8656
8657 switch (cert_status_type) {
8658 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8659 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8660 {
8661 uint32_t responder_id_list_len;
8662 uint32_t request_extensions_len;
8663
8664 /* ResponderID responder_id_list<0..2^16-1> */
8665 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8666 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8667 return offset_end;
8668 }
8669 offset += 2;
8670 if (responder_id_list_len != 0) {
8671 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8672 tvb, offset, responder_id_list_len,
8673 "Responder ID list is not implemented, contact Wireshark"
8674 " developers if you want this to be supported");
8675 }
8676 offset += responder_id_list_len;
8677
8678 /* opaque Extensions<0..2^16-1> */
8679 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8680 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8681 return offset_end;
8682 }
8683 offset += 2;
8684 if (request_extensions_len != 0) {
8685 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8686 tvb, offset, request_extensions_len,
8687 "Request Extensions are not implemented, contact"
8688 " Wireshark developers if you want this to be supported");
8689 }
8690 offset += request_extensions_len;
8691 break;
8692 }
8693 }
8694
8695 return offset;
8696}
8697
8698static unsigned
8699ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8700 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8701{
8702 /* https://tools.ietf.org/html/rfc6961#section-2.2
8703 * struct {
8704 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8705 * } CertificateStatusRequestListV2;
8706 */
8707 uint32_t req_list_length, next_offset;
8708
8709 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8710 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8711 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8712 return offset_end;
8713 }
8714 offset += 2;
8715 next_offset = offset + req_list_length;
8716
8717 while (offset < next_offset) {
8718 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8719 }
8720
8721 return offset;
8722}
8723
8724static uint32_t
8725tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8726 uint32_t offset, uint32_t offset_end)
8727{
8728 uint32_t response_length;
8729 proto_item *ocsp_resp;
8730 proto_tree *ocsp_resp_tree;
8731 asn1_ctx_t asn1_ctx;
8732
8733 /* opaque OCSPResponse<1..2^24-1>; */
8734 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8735 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8736 return offset_end;
8737 }
8738 offset += 3;
8739
8740 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8741 response_length, ENC_BIG_ENDIAN0x00000000);
8742 proto_item_set_text(ocsp_resp, "OCSP Response");
8743 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8744 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8745 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8746 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8747 }
8748 offset += response_length;
8749
8750 return offset;
8751}
8752
8753uint32_t
8754tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8755 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8756{
8757 /* TLS 1.2 "CertificateStatus" handshake message.
8758 * TLS 1.3 "status_request" Certificate extension.
8759 * struct {
8760 * CertificateStatusType status_type;
8761 * select (status_type) {
8762 * case ocsp: OCSPResponse;
8763 * case ocsp_multi: OCSPResponseList; // status_request_v2
8764 * } response;
8765 * } CertificateStatus;
8766 * opaque OCSPResponse<1..2^24-1>;
8767 * struct {
8768 * OCSPResponse ocsp_response_list<1..2^24-1>;
8769 * } OCSPResponseList; // status_request_v2
8770 */
8771 uint32_t status_type, resp_list_length, next_offset;
8772
8773 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
8774 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
8775 offset += 1;
8776
8777 switch (status_type) {
8778 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8779 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
8780 break;
8781
8782 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8783 /* OCSPResponse ocsp_response_list<1..2^24-1> */
8784 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
8785 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8786 return offset_end;
8787 }
8788 offset += 3;
8789 next_offset = offset + resp_list_length;
8790
8791 while (offset < next_offset) {
8792 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
8793 }
8794 break;
8795 }
8796
8797 return offset;
8798}
8799
8800static unsigned
8801ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8802 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8803 wmem_strbuf_t *ja3)
8804{
8805 /* RFC 8446 Section 4.2.7
8806 * enum { ..., (0xFFFF) } NamedGroup;
8807 * struct {
8808 * NamedGroup named_group_list<2..2^16-1>
8809 * } NamedGroupList;
8810 *
8811 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
8812 * the extension itself from "elliptic_curves" to "supported_groups".
8813 */
8814 uint32_t groups_length, next_offset;
8815 proto_tree *groups_tree;
8816 proto_item *ti;
8817 char *ja3_dash = "";
8818
8819 /* NamedGroup named_group_list<2..2^16-1> */
8820 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
8821 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
8822 return offset_end;
8823 }
8824 offset += 2;
8825 next_offset = offset + groups_length;
8826
8827 ti = proto_tree_add_none_format(tree,
8828 hf->hf.hs_ext_supported_groups,
8829 tvb, offset, groups_length,
8830 "Supported Groups (%d group%s)",
8831 groups_length / 2,
8832 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
8833
8834 /* make this a subtree */
8835 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
8836
8837 if (ja3) {
8838 wmem_strbuf_append_c(ja3, ',');
8839 }
8840 /* loop over all groups */
8841 while (offset + 2 <= offset_end) {
8842 uint32_t ext_supported_group;
8843
8844 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
8845 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
8846 offset += 2;
8847 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
8848 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
8849 ja3_dash = "-";
8850 }
8851 }
8852 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
8853 offset = next_offset;
8854 }
8855
8856 return offset;
8857}
8858
8859static int
8860ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8861 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
8862{
8863 uint8_t ecpf_length;
8864 proto_tree *ecpf_tree;
8865 proto_item *ti;
8866
8867 ecpf_length = tvb_get_uint8(tvb, offset);
8868 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
8869 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8870
8871 offset += 1;
8872 ti = proto_tree_add_none_format(tree,
8873 hf->hf.hs_ext_ec_point_formats,
8874 tvb, offset, ecpf_length,
8875 "Elliptic curves point formats (%d)",
8876 ecpf_length);
8877
8878 /* make this a subtree */
8879 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
8880
8881 if (ja3) {
8882 wmem_strbuf_append_c(ja3, ',');
8883 }
8884
8885 /* loop over all point formats */
8886 while (ecpf_length > 0)
8887 {
8888 uint32_t ext_ec_point_format;
8889
8890 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
8891 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
8892 offset++;
8893 ecpf_length--;
8894 if (ja3) {
8895 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
8896 if (ecpf_length > 0) {
8897 wmem_strbuf_append_c(ja3, '-');
8898 }
8899 }
8900 }
8901
8902 return offset;
8903}
8904
8905static int
8906ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8907 packet_info *pinfo, proto_tree *tree,
8908 uint32_t offset, uint32_t next_offset)
8909{
8910 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
8911 * opaque srp_I<1..2^8-1>;
8912 */
8913 uint32_t username_len;
8914
8915 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
8916 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
8917 return next_offset;
8918 }
8919 offset++;
8920
8921 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
8922 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
8923 offset += username_len;
8924
8925 return offset;
8926}
8927
8928static uint32_t
8929tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8930 uint32_t offset, uint32_t offset_end, uint16_t version)
8931{
8932 /* https://tools.ietf.org/html/rfc6962#section-3.2
8933 * enum { v1(0), (255) } Version;
8934 * struct {
8935 * opaque key_id[32];
8936 * } LogID;
8937 * opaque CtExtensions<0..2^16-1>;
8938 * struct {
8939 * Version sct_version;
8940 * LogID id;
8941 * uint64 timestamp;
8942 * CtExtensions extensions;
8943 * digitally-signed struct { ... };
8944 * } SignedCertificateTimestamp;
8945 */
8946 uint32_t sct_version;
8947 uint64_t sct_timestamp_ms;
8948 nstime_t sct_timestamp;
8949 uint32_t exts_len;
8950 const char *log_name;
8951
8952 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
8953 offset++;
8954 if (sct_version != 0) {
8955 // TODO expert info about unknown SCT version?
8956 return offset;
8957 }
8958 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
8959 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
8960 proto_item_append_text(tree, " (%s)", log_name);
8961 offset += 32;
8962 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
8963 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
8964 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
8965 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
8966 offset += 8;
8967 /* opaque CtExtensions<0..2^16-1> */
8968 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
8969 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
8970 return offset_end;
8971 }
8972 offset += 2;
8973 if (exts_len > 0) {
8974 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
8975 offset += exts_len;
8976 }
8977 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
8978 hf->hf.sct_sct_signature_length,
8979 hf->hf.sct_sct_signature);
8980 return offset;
8981}
8982
8983uint32_t
8984tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8985 uint32_t offset, uint32_t offset_end, uint16_t version)
8986{
8987 /* https://tools.ietf.org/html/rfc6962#section-3.3
8988 * opaque SerializedSCT<1..2^16-1>;
8989 * struct {
8990 * SerializedSCT sct_list <1..2^16-1>;
8991 * } SignedCertificateTimestampList;
8992 */
8993 uint32_t list_length, sct_length, next_offset;
8994 proto_tree *subtree;
8995
8996 /* SerializedSCT sct_list <1..2^16-1> */
8997 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
8998 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
8999 return offset_end;
9000 }
9001 offset += 2;
9002
9003 while (offset < offset_end) {
9004 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9005
9006 /* opaque SerializedSCT<1..2^16-1> */
9007 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9008 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9009 return offset_end;
9010 }
9011 offset += 2;
9012 next_offset = offset + sct_length;
9013 proto_item_set_len(subtree, 2 + sct_length);
9014 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9015 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9016 offset = next_offset;
9017 }
9018 }
9019
9020 return offset;
9021}
9022
9023static int
9024dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9025 proto_tree *tree, uint32_t offset)
9026{
9027 uint32_t kdf_id, aead_id;
9028 proto_item *cs_ti;
9029 proto_tree *cs_tree;
9030
9031 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9032 tvb, offset, 4, ENC_NA0x00000000);
9033 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9034
9035 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9036 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9037 offset += 2;
9038 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9039 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9040 offset += 2;
9041
9042 proto_item_append_text(cs_ti, ": %s/%s",
9043 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9044 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9045 return offset;
9046}
9047
9048static int
9049dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9050 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9051 uint32_t *config_id)
9052{
9053 uint32_t length, cipher_suite_length;
9054 proto_item *kc_ti, *css_ti;
9055 proto_tree *kc_tree, *css_tree;
9056 uint32_t original_offset = offset, next_offset;
9057
9058 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9059 tvb, offset, -1, ENC_NA0x00000000);
9060 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9061
9062 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9063 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9064 offset += 1;
9065 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9066 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9067 offset += 2;
9068 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9069 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9070 offset += 2;
9071 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9072 tvb, offset, length, ENC_NA0x00000000);
9073 offset += length;
9074
9075 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9076 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9077 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9078 return offset_end;
9079 }
9080 offset += 2;
9081 next_offset = offset + cipher_suite_length;
9082
9083 css_ti = proto_tree_add_none_format(kc_tree,
9084 hf->hf.ech_hpke_keyconfig_cipher_suites,
9085 tvb, offset, cipher_suite_length,
9086 "Cipher Suites (%d suite%s)",
9087 cipher_suite_length / 4,
9088 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9089 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9090
9091
9092 while (offset + 4 <= next_offset) {
9093 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9094 }
9095
9096 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9097 offset = next_offset;
9098 }
9099
9100 proto_item_set_len(kc_ti, offset - original_offset);
9101
9102 return offset;
9103}
9104
9105static int
9106dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9107 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9108 const uint8_t **public_name, uint32_t *config_id)
9109{
9110 uint32_t public_name_length, extensions_length, next_offset;
9111
9112 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9113 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9114 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9115 offset += 1;
9116 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9117 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9118 offset += 1;
9119 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9120 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9121 offset += public_name_length;
9122
9123 /* Extension extensions<0..2^16-1>; */
9124 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9125 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9126 return offset_end;
9127 }
9128 offset += 2;
9129 next_offset = offset + extensions_length;
9130
9131 if (extensions_length > 0) {
9132 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9133 tvb, offset, extensions_length, ENC_NA0x00000000);
9134 }
9135 offset += extensions_length;
9136
9137 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9138 offset = next_offset;
9139 }
9140
9141 return offset;
9142}
9143
9144static int
9145dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9146 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9147{
9148 uint32_t version, length;
9149 proto_item *ech_ti;
9150 proto_tree *ech_tree;
9151 const uint8_t *public_name = NULL((void*)0);
9152 uint32_t config_id = 0;
9153
9154 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9155 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9156
9157 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9158 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9159 offset += 2;
9160 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9161 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9162 offset += 2;
9163
9164 proto_item_set_len(ech_ti, 4 + length);
9165
9166 switch(version) {
9167 case 0xfe0d:
9168 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9169 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9170 break;
9171
9172 default:
9173 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9174 }
9175
9176 return 4 + length;
9177}
9178
9179uint32_t
9180ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9181 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9182{
9183 uint32_t echconfiglist_length, next_offset;
9184
9185 /* ECHConfig ECHConfigList<1..2^16-1>; */
9186 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9187 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9188 return offset_end;
9189 }
9190 offset += 2;
9191 next_offset = offset + echconfiglist_length;
9192
9193 while (offset < next_offset) {
9194 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9195 }
9196
9197 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9198 offset = next_offset;
9199 }
9200
9201 return offset;
9202}
9203
9204static uint32_t
9205ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9206 uint32_t offset, uint32_t offset_end)
9207{
9208 uint32_t ext_length, next_offset;
9209 proto_tree *ext_tree;
9210 proto_item *ti;
9211
9212 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9213 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9214 return offset_end;
9215 }
9216 offset += 1;
9217 next_offset = offset + ext_length;
9218
9219 ti = proto_tree_add_none_format(tree,
9220 hf->hf.hs_ext_ech_outer_ext,
9221 tvb, offset, ext_length,
9222 "Outer Extensions (%d extension%s)",
9223 ext_length / 2,
9224 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9225
9226 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9227
9228 while (offset + 2 <= offset_end) {
9229 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9230 offset += 2;
9231 }
9232
9233 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9234 offset = next_offset;
9235 }
9236
9237 return offset;
9238}
9239
9240static uint32_t
9241// NOLINTNEXTLINE(misc-no-recursion)
9242ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9243 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9244 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9245{
9246 uint32_t ch_type, length;
9247 proto_item *ti, *payload_ti;
9248 proto_tree *retry_tree, *payload_tree;
9249 uint32_t hello_length = tvb_reported_length(tvb);
9250
9251 switch (hnd_type) {
9252 case SSL_HND_CLIENT_HELLO:
9253 /*
9254 * enum { outer(0), inner(1) } ECHClientHelloType;
9255 *
9256 * struct {
9257 * ECHClientHelloType type;
9258 * select (ECHClientHello.type) {
9259 * case outer:
9260 * HpkeSymmetricCipherSuite cipher_suite;
9261 * uint8 config_id;
9262 * opaque enc<0..2^16-1>;
9263 * opaque payload<1..2^16-1>;
9264 * case inner:
9265 * Empty;
9266 * };
9267 * } ECHClientHello;
9268 */
9269
9270 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9271 offset += 1;
9272 switch (ch_type) {
9273 case 0: /* outer */
9274 if (ssl && session->first_ch_ech_frame == 0) {
9275 session->first_ch_ech_frame = pinfo->num;
9276 }
9277 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9278 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9279 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9280
9281 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9282 uint8_t config_id = tvb_get_uint8(tvb, offset);
9283 offset += 1;
9284 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9285 offset += 2;
9286 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9287 offset += length;
9288 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9289 offset += 2;
9290 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9291 offset += length;
9292
9293 if (!mk_map) {
9294 break;
9295 }
9296 if (session->client_random.data_len == 0) {
9297 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9298 break;
9299 }
9300 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9301 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9302 if (!ech_secret || !ech_config) {
9303 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9304 G_STRFUNC((const char*) (__func__)));
9305 break;
9306 }
9307
9308 if (hpke_hkdf_len(kdf_id) == 0) {
9309 ssl_debug_printf("Unsupported KDF\n");
9310 break;
9311 }
9312
9313 if (hpke_aead_key_len(aead_id) == 0) {
9314 ssl_debug_printf("Unsupported AEAD\n");
9315 break;
9316 }
9317
9318 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9319
9320 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9321 if (length < aead_auth_tag_len) {
9322 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9323 break;
9324 }
9325 unsigned decrypted_len = length - aead_auth_tag_len;
9326
9327 uint16_t version = pntohu16(ech_config->data);
9328 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9329 ssl_debug_printf("Unexpected version in ECH Config\n");
9330 break;
9331 }
9332 uint32_t ech_config_offset = 2;
9333 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9334 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9335 break;
9336 }
9337 ech_config_offset += 2;
9338 if (*(ech_config->data + ech_config_offset) != config_id) {
9339 ssl_debug_printf("ECH Config version mismatch\n");
9340 break;
9341 }
9342 ech_config_offset += 1;
9343 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9344 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9345 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9346 GByteArray *info = g_byte_array_new();
9347 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9348 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9349 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9350 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9351 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9352 key, base_nonce)) {
9353 g_byte_array_free(info, TRUE(!(0)));
9354 break;
9355 }
9356 g_byte_array_free(info, TRUE(!(0)));
9357 gcry_cipher_hd_t cipher;
9358 if (hpke_setup_aead(&cipher, aead_id, key) ||
9359 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9360 gcry_cipher_close(cipher);
9361 break;
9362 }
9363 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9364 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9365 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9366 memset(ech_aad + offset - length, 0, length);
9367 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9368 gcry_cipher_close(cipher);
9369 wmem_free(NULL((void*)0), ech_aad);
9370 break;
9371 }
9372 wmem_free(NULL((void*)0), ech_aad);
9373 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9374 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9375 gcry_cipher_close(cipher);
9376 break;
9377 }
9378 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9379 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9380 gcry_cipher_close(cipher);
9381 break;
9382 }
9383 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9384 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9385 gcry_cipher_close(cipher);
9386 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9387 payload + decrypted_len, aead_auth_tag_len)) {
9388 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9389 } else {
9390 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9391 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9392 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9393 if (ssl) {
9394 /* Note the Outer Client Random for Inject TLS Secrets */
9395 tls_save_crandom(ssl, mk_map);
9396
9397 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9398 uint32_t len_offset = ssl->ech_transcript.data_len;
9399 if (ssl->ech_transcript.data_len > 0)
9400 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9401 ssl->ech_transcript.data_len + hello_length + 4);
9402 else
9403 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9404 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9405 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9406 /* Copy ClientHelloInner up to the legacy_session_id field. */
9407 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9408 ssl->ech_transcript.data_len += 38;
9409 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9410 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = ssl->session_id.data_len;
9411 ssl->ech_transcript.data_len++;
9412 memcpy(&ssl->ech_transcript.data[ssl->ech_transcript.data_len], ssl->session_id.data, ssl->session_id.data_len);
9413 ssl->ech_transcript.data_len += ssl->session_id.data_len;
9414 /* Skip past the legacy_session_id field in ClientHelloInner
9415 * (which should be the empty string, i.e. just a 0 size.) */
9416 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9417 /* Copy the Cipher Suites from ClientHelloInner. */
9418 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9419 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9420 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9421 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9422 /* Copy the Compression Methods */
9423 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9424 1 + tvb_get_uint8(ech_tvb, ech_offset));
9425 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9426 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9427 /* Now replace extensions in ech_outer_extensions with the
9428 * data from ClientHelloOuter. */
9429 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9430 ssl->ech_transcript.data_len += 2;
9431 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9432 ech_offset += 2;
9433 bool_Bool ech_outer_extensions_found = false0;
9434 while (extensions_end - ech_offset >= 4) {
9435 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9436 ech_offset += 2;
9437 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9438 ech_offset += 2;
9439 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9440 /* Copy this extension directly */
9441 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len,
9442 ech_offset - 4, 4 + ext_len);
9443 ssl->ech_transcript.data_len += 4 + ext_len;
9444 ech_offset += ext_len;
9445 } else if (ext_len > 0) {
9446 if (ech_outer_extensions_found) {
9447 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9448 /* This could lead to a buffer overflow by
9449 * making the post-copying ClientHelloInner
9450 * longer than ClientHelloOuter and is
9451 * illegal, so skip this and don't copy. */
9452 ech_offset += ext_len;
9453 continue;
9454 }
9455 ech_outer_extensions_found = true1;
9456 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9457 ech_offset += 1;
9458 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9459 /* In ClientHelloOuter, skip past the legacy_session_id */
9460 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9461 /* Skip past Cipher Suites */
9462 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9463 /* Skip past Compression Methods */
9464 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9465 /* Now at the start of ClientHelloOuter's extensions */
9466 while (ech_outer_extensions_end - ech_offset >= 2) {
9467 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9468 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9469 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9470 /* This could lead to a buffer overflow by
9471 * making the post-copying ClientHelloInner
9472 * longer than ClientHelloOuter and is
9473 * illegal, so don't copy. */
9474 break;
9475 }
9476 bool_Bool found = false0;
9477 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9478 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9479 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9480 if (ext_type == outer_ext_type) {
9481 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9482 4 + outer_ext_len);
9483 ssl->ech_transcript.data_len += 4 + outer_ext_len;
9484 outer_offset += 4 + outer_ext_len;
9485 found = true1;
9486 break;
9487 } else {
9488 outer_offset += 4 + outer_ext_len;
9489 }
9490 }
9491 if (!found) {
9492 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9493 }
9494 ech_offset += 2;
9495 }
9496 }
9497 }
9498 uint16_t ech_extensions_len = ssl->ech_transcript.data_len - ech_extensions_len_offset - 2;
9499 phtonu16(&ssl->ech_transcript.data[ech_extensions_len_offset], ech_extensions_len);
9500 phtonu16(&ssl->ech_transcript.data[len_offset + 2], ssl->ech_transcript.data_len - len_offset - 4);
9501 }
9502 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9503 ssl, NULL((void*)0), mk_map);
9504 if (ech_padding_begin < decrypted_len) {
9505 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9506 ENC_NA0x00000000);
9507 }
9508 }
9509
9510 break;
9511 case 1: /* inner */
9512 break;
9513 }
9514 break;
9515
9516 case SSL_HND_ENCRYPTED_EXTENSIONS:
9517 /*
9518 * struct {
9519 * ECHConfigList retry_configs;
9520 * } ECHEncryptedExtensions;
9521 */
9522
9523 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9524 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9525 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9526 break;
9527
9528 case SSL_HND_HELLO_RETRY_REQUEST:
9529 /*
9530 * struct {
9531 * opaque confirmation[8];
9532 * } ECHHelloRetryRequest;
9533 */
9534
9535 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9536 if (session->ech) {
9537 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9538 proto_item_set_generated(ti);
9539 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
9540 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9541 } else {
9542 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9543 }
9544 }
9545 offset += 8;
9546 break;
9547 }
9548
9549 return offset;
9550}
9551
9552static uint32_t
9553ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9554 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9555 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9556{
9557 uint32_t record_digest_length, encrypted_sni_length;
9558
9559 switch (hnd_type) {
9560 case SSL_HND_CLIENT_HELLO:
9561 /*
9562 * struct {
9563 * CipherSuite suite;
9564 * KeyShareEntry key_share;
9565 * opaque record_digest<0..2^16-1>;
9566 * opaque encrypted_sni<0..2^16-1>;
9567 * } ClientEncryptedSNI;
9568 */
9569 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9570 offset += 2;
9571 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9572
9573 /* opaque record_digest<0..2^16-1> */
9574 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9575 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9576 return offset_end;
9577 }
9578 offset += 2;
9579 if (record_digest_length > 0) {
9580 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9581 offset += record_digest_length;
9582 }
9583
9584 /* opaque encrypted_sni<0..2^16-1> */
9585 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9586 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9587 return offset_end;
9588 }
9589 offset += 2;
9590 if (encrypted_sni_length > 0) {
9591 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9592 offset += encrypted_sni_length;
9593 }
9594 break;
9595
9596 case SSL_HND_ENCRYPTED_EXTENSIONS:
9597 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9598 offset += 16;
9599 break;
9600 }
9601
9602 return offset;
9603}
9604/** TLS Extensions (in Client Hello and Server Hello). }}} */
9605
9606/* Connection ID dissection. {{{ */
9607static uint32_t
9608ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9609 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9610 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9611{
9612 /* keep track of the decrypt session only for the first pass */
9613 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9614 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9615 *session_cidl = cidl;
9616 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9617 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9618 if (ssl) {
9619 ssl_add_session_by_cid(ssl);
9620 }
9621 }
9622
9623 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9624 tvb, offset, 1, ENC_NA0x00000000);
9625 offset++;
9626
9627 if (cidl > 0) {
9628 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9629 tvb, offset, cidl, ENC_NA0x00000000);
9630 offset += cidl;
9631 }
9632
9633 return offset;
9634}
9635
9636static uint32_t
9637ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9638 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9639 SslSession *session, SslDecryptSession *ssl)
9640{
9641 uint8_t cidl = tvb_get_uint8(tvb, offset);
9642
9643 switch (hnd_type) {
9644 case SSL_HND_CLIENT_HELLO:
9645 session->client_cid_len_present = true1;
9646 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9647 cidl, &session->client_cid, &session->client_cid_len);
9648 case SSL_HND_SERVER_HELLO:
9649 session->server_cid_len_present = true1;
9650 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9651 cidl, &session->server_cid, &session->server_cid_len);
9652 default:
9653 return offset;
9654 }
9655} /* }}} */
9656
9657/* Trusted CA dissection. {{{ */
9658static uint32_t
9659ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9660 uint32_t offset, uint32_t offset_end)
9661{
9662 proto_item *ti;
9663 proto_tree *subtree;
9664 uint32_t keys_length, next_offset;
9665
9666 /*
9667 * struct {
9668 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9669 * } TrustedAuthorities;
9670 *
9671 * struct {
9672 * IdentifierType identifier_type;
9673 * select (identifier_type) {
9674 * case pre_agreed: struct {};
9675 * case key_sha1_hash: SHA1Hash;
9676 * case x509_name: DistinguishedName;
9677 * case cert_sha1_hash: SHA1Hash;
9678 * } identifier;
9679 * } TrustedAuthority;
9680 *
9681 * enum {
9682 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9683 * cert_sha1_hash(3), (255)
9684 * } IdentifierType;
9685 *
9686 * opaque DistinguishedName<1..2^16-1>;
9687 *
9688 */
9689
9690
9691 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9692 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9693 0, UINT16_MAX(65535)))
9694 {
9695 return offset_end;
9696 }
9697 offset += 2;
9698 next_offset = offset + keys_length;
9699
9700 if (keys_length > 0)
9701 {
9702 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9703 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9704 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9705
9706 while (offset < next_offset)
9707 {
9708 uint32_t identifier_type;
9709 proto_tree *trusted_key_tree;
9710 proto_item *trusted_key_item;
9711 asn1_ctx_t asn1_ctx;
9712 uint32_t key_len = 0;
9713
9714 identifier_type = tvb_get_uint8(tvb, offset);
9715
9716 // Use 0 as length for now as we'll only know the size when we decode the identifier
9717 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9718 offset, 0, "Trusted CA Key");
9719 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9720
9721 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9722 offset, 1, identifier_type);
9723 offset++;
9724
9725 /*
9726 * enum {
9727 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9728 * cert_sha1_hash(3), (255)
9729 * } IdentifierType;
9730 */
9731 switch (identifier_type)
9732 {
9733 case 0:
9734 key_len = 0;
9735 break;
9736 case 2:
9737 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9738
9739 uint32_t name_length;
9740 /* opaque DistinguishedName<1..2^16-1> */
9741 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9742 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9743 return next_offset;
9744 }
9745 offset += 2;
9746
9747 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9748 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9749 offset += name_length;
9750 break;
9751 case 1:
9752 case 3:
9753 key_len = 20;
9754 /* opaque SHA1Hash[20]; */
9755 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
9756 offset, 20, ENC_NA0x00000000);
9757 break;
9758
9759 default:
9760 key_len = 0;
9761 /*TODO display expert info about unknown ? */
9762 break;
9763 }
9764 proto_item_set_len(trusted_key_item, 1 + key_len);
9765 offset += key_len;
9766 }
9767 }
9768
9769 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
9770 {
9771 offset = next_offset;
9772 }
9773
9774 return offset;
9775} /* }}} */
9776
9777
9778/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
9779bool_Bool
9780ssl_is_valid_content_type(uint8_t type)
9781{
9782 switch ((ContentType) type) {
9783 case SSL_ID_CHG_CIPHER_SPEC:
9784 case SSL_ID_ALERT:
9785 case SSL_ID_HANDSHAKE:
9786 case SSL_ID_APP_DATA:
9787 case SSL_ID_HEARTBEAT:
9788 case SSL_ID_TLS12_CID:
9789 case SSL_ID_DTLS13_ACK:
9790 return true1;
9791 }
9792 return false0;
9793}
9794
9795bool_Bool
9796ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
9797{
9798 switch ((HandshakeType) hs_type) {
9799 case SSL_HND_HELLO_VERIFY_REQUEST:
9800 /* hello_verify_request is DTLS-only */
9801 return is_dtls;
9802
9803 case SSL_HND_HELLO_REQUEST:
9804 case SSL_HND_CLIENT_HELLO:
9805 case SSL_HND_SERVER_HELLO:
9806 case SSL_HND_NEWSESSION_TICKET:
9807 case SSL_HND_END_OF_EARLY_DATA:
9808 case SSL_HND_HELLO_RETRY_REQUEST:
9809 case SSL_HND_ENCRYPTED_EXTENSIONS:
9810 case SSL_HND_CERTIFICATE:
9811 case SSL_HND_SERVER_KEY_EXCHG:
9812 case SSL_HND_CERT_REQUEST:
9813 case SSL_HND_SVR_HELLO_DONE:
9814 case SSL_HND_CERT_VERIFY:
9815 case SSL_HND_CLIENT_KEY_EXCHG:
9816 case SSL_HND_FINISHED:
9817 case SSL_HND_CERT_URL:
9818 case SSL_HND_CERT_STATUS:
9819 case SSL_HND_SUPPLEMENTAL_DATA:
9820 case SSL_HND_KEY_UPDATE:
9821 case SSL_HND_COMPRESSED_CERTIFICATE:
9822 case SSL_HND_ENCRYPTED_EXTS:
9823 return true1;
9824 case SSL_HND_MESSAGE_HASH:
9825 return false0;
9826 }
9827 return false0;
9828}
9829
9830static bool_Bool
9831ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
9832 bool_Bool is_dtls)
9833{
9834 /* Consider all valid Handshake messages (except for Client Hello) and
9835 * all other valid record types (other than Handshake) */
9836 return (content_type == SSL_ID_HANDSHAKE &&
9837 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
9838 handshake_type != SSL_HND_CLIENT_HELLO) ||
9839 (content_type != SSL_ID_HANDSHAKE &&
9840 ssl_is_valid_content_type(content_type));
9841}
9842
9843/**
9844 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
9845 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
9846 * Returns true if the supported_versions extension was found, false if not.
9847 */
9848bool_Bool
9849tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
9850 uint16_t *server_version, bool_Bool *is_hrr)
9851{
9852 /* SHA256("HelloRetryRequest") */
9853 static const uint8_t tls13_hrr_random_magic[] = {
9854 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
9855 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
9856 };
9857 uint8_t session_id_length;
9858
9859 *server_version = tvb_get_ntohs(tvb, offset);
9860
9861 /*
9862 * Try to look for supported_versions extension. Minimum length:
9863 * 2 + 32 + 1 = 35 (version, random, session id length)
9864 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9865 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9866 *
9867 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9868 * there's a separate expert info warning for that.
9869 */
9870 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9871 offset += 2;
9872 if (is_hrr) {
9873 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
9874 }
9875 offset += 32;
9876 session_id_length = tvb_get_uint8(tvb, offset);
9877 offset++;
9878 if (offset_end - offset < session_id_length + 5u) {
9879 return false0;
9880 }
9881 offset += session_id_length + 5;
9882
9883 while (offset_end - offset >= 6) {
9884 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9885 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9886 if (offset_end - offset < 4u + ext_len) {
9887 break; /* not enough data for type, length and data */
9888 }
9889 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9890 if (ext_len == 2) {
9891 *server_version = tvb_get_ntohs(tvb, offset + 4);
9892 }
9893 return true1;
9894 }
9895 offset += 4 + ext_len;
9896 }
9897 } else {
9898 if (is_hrr) {
9899 *is_hrr = false0;
9900 }
9901 }
9902 return false0;
9903}
9904
9905/**
9906 * Scan a Client Hello handshake message to see if the supported_versions
9907 * extension is found, in which case the version field is legacy_version.
9908 */
9909static bool_Bool
9910tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
9911{
9912 uint8_t session_id_length;
9913
9914 uint16_t client_version = tvb_get_ntohs(tvb, offset);
9915
9916 /*
9917 * Try to look for supported_versions extension. Minimum length:
9918 * 2 + 32 + 1 = 35 (version, random, session id length)
9919 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9920 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9921 *
9922 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9923 * there's a separate expert info warning for that.
9924 */
9925 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9926 offset += 2;
9927 offset += 32;
9928 session_id_length = tvb_get_uint8(tvb, offset);
9929 offset++;
9930 if (offset_end - offset < session_id_length + 2u) {
9931 return false0;
9932 }
9933 offset += session_id_length;
9934 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
9935 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
9936 offset++;
9937 if (offset_end - offset < cookie_length + 2u) {
9938 return false0;
9939 }
9940 }
9941 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
9942 offset += 2;
9943 if (offset_end - offset < cipher_suites_length + 1u) {
9944 return false0;
9945 }
9946 offset += cipher_suites_length;
9947 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
9948 offset++;
9949 if (offset_end - offset < compression_methods_length + 2u) {
9950 return false0;
9951 }
9952 offset += compression_methods_length + 2;
9953
9954 while (offset_end - offset >= 6) {
9955 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9956 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9957 if (offset_end - offset < 4u + ext_len) {
9958 break; /* not enough data for type, length and data */
9959 }
9960 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9961 return true1;
9962 }
9963 offset += 4 + ext_len;
9964 }
9965 }
9966 return false0;
9967}
9968void
9969ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
9970 uint8_t content_type, uint8_t handshake_type,
9971 bool_Bool is_dtls, uint16_t version)
9972{
9973 uint8_t tls13_draft = 0;
9974
9975 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
9976 is_dtls))
9977 return;
9978
9979 version = tls_try_get_version(is_dtls, version, &tls13_draft);
9980 if (version == SSL_VER_UNKNOWN0) {
9981 return;
9982 }
9983
9984 session->tls13_draft_version = tls13_draft;
9985 session->version = version;
9986 if (ssl) {
9987 ssl->state |= SSL_VERSION(1<<4);
9988 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
9989 }
9990}
9991
9992void
9993ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
9994 ContentType content_type,
9995 unsigned record_length, proto_item *length_pi,
9996 uint16_t version, tvbuff_t *decrypted_tvb)
9997{
9998 unsigned max_expansion;
9999 if (version == TLSV1DOT3_VERSION0x304) {
10000 /* TLS 1.3: Max length is 2^14 + 256 */
10001 max_expansion = 256;
10002 } else {
10003 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10004 max_expansion = 2048;
10005 }
10006 /*
10007 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10008 * and ChangeCipherSpec.
10009 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10010 * so assume it is permitted.
10011 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10012 * assume TLS 1.2 requirements.
10013 */
10014 if (record_length == 0 &&
10015 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10016 content_type == SSL_ID_ALERT ||
10017 content_type == SSL_ID_HANDSHAKE)) {
10018 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10019 "Zero-length %s fragments are not allowed",
10020 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10021 }
10022 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10023 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10024 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10025 }
10026 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10027 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10028 "TLSPlaintext length MUST NOT exceed 2^14");
10029 }
10030}
10031
10032static void
10033ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10034{
10035 /* store selected cipher suite for decryption */
10036 ssl->session.cipher = cipher;
10037
10038 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10039 if (!cs) {
10040 ssl->cipher_suite = NULL((void*)0);
10041 ssl->state &= ~SSL_CIPHER(1<<2);
10042 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10043 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10044 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10045 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10046 * to avoid a potential buffer overflow in ssl3_check_mac. */
10047 ssl->cipher_suite = NULL((void*)0);
10048 ssl->state &= ~SSL_CIPHER(1<<2);
10049 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10050 } else {
10051 /* Cipher found, save this for the delayed decoder init */
10052 ssl->cipher_suite = cs;
10053 ssl->state |= SSL_CIPHER(1<<2);
10054 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10055 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10056 ssl->state);
10057 }
10058}
10059/* }}} */
10060
10061
10062/* Client Hello and Server Hello dissections. {{{ */
10063static int
10064ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10065 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10066 SslSession *session, SslDecryptSession *ssl,
10067 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10068 ssl_master_key_map_t *mk_map);
10069int
10070// NOLINTNEXTLINE(misc-no-recursion)
10071ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10072 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10073 uint32_t offset_end, SslSession *session,
10074 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10075{
10076 /* struct {
10077 * ProtocolVersion client_version;
10078 * Random random;
10079 * SessionID session_id;
10080 * opaque cookie<0..32>; //new field for DTLS
10081 * CipherSuite cipher_suites<2..2^16-1>;
10082 * CompressionMethod compression_methods<1..2^8-1>;
10083 * Extension client_hello_extension_list<0..2^16-1>;
10084 * } ClientHello;
10085 */
10086 proto_item *ti;
10087 proto_tree *cs_tree;
10088 uint32_t client_version;
10089 uint32_t cipher_suite_length;
10090 uint32_t compression_methods_length;
10091 uint8_t compression_method;
10092 uint32_t next_offset;
10093 uint32_t initial_offset = offset;
10094 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10095 char *ja3_hash;
10096 char *ja3_dash = "";
10097 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10098 ja4_data_t ja4_data;
10099 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10100 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10101 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10102 wmem_list_frame_t *curr_entry;
10103
10104 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10104, (int64_t)initial_offset, (int64_t)offset_end))));
10105 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10106 offset = 0;
10107 offset_end = tvb_reported_length(hello_tvb);
10108
10109 ja4_data.max_version = 0;
10110 ja4_data.server_name_present = false0;
10111 ja4_data.num_cipher_suites = 0;
10112 ja4_data.num_extensions = 0;
10113 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10114 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10115 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10116 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10117
10118 /* show the client version */
10119 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10120 offset, 2, ENC_BIG_ENDIAN0x00000000,
10121 &client_version);
10122 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10123 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10124 }
10125 offset += 2;
10126 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10127
10128 /*
10129 * Is it version 1.3?
10130 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10131 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10132 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10133 * Hello".
10134 */
10135 if (dtls_hfs != NULL((void*)0)) {
10136 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10137 /* Don't do that. */
10138 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10139 }
10140 } else {
10141 if (client_version == TLSV1DOT3_VERSION0x304) {
10142 /* Don't do that. */
10143 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10144 }
10145 }
10146
10147 /* dissect fields that are present in both ClientHello and ServerHello */
10148 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10149
10150 /* fields specific for DTLS (cookie_len, cookie) */
10151 if (dtls_hfs != NULL((void*)0)) {
10152 uint32_t cookie_length;
10153 /* opaque cookie<0..32> (for DTLS only) */
10154 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10155 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10156 return offset;
10157 }
10158 offset++;
10159 if (cookie_length > 0) {
10160 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10161 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10162 offset += cookie_length;
10163 }
10164 }
10165
10166 /* CipherSuite cipher_suites<2..2^16-1> */
10167 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10168 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10169 return offset;
10170 }
10171 offset += 2;
10172 next_offset = offset + cipher_suite_length;
10173 ti = proto_tree_add_none_format(tree,
10174 hf->hf.hs_cipher_suites,
10175 hello_tvb, offset, cipher_suite_length,
10176 "Cipher Suites (%d suite%s)",
10177 cipher_suite_length / 2,
10178 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10179 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10180 while (offset + 2 <= next_offset) {
10181 uint32_t cipher_suite;
10182
10183 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10184 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10185 offset += 2;
10186 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10187 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10188 ja3_dash = "-";
10189 ja4_data.num_cipher_suites += 1;
10190 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10191 }
10192 }
10193 wmem_strbuf_append_c(ja3, ',');
10194 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10195 offset = next_offset;
10196 }
10197
10198 /* CompressionMethod compression_methods<1..2^8-1> */
10199 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10200 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10201 return offset;
10202 }
10203 offset++;
10204 next_offset = offset + compression_methods_length;
10205 ti = proto_tree_add_none_format(tree,
10206 hf->hf.hs_comp_methods,
10207 hello_tvb, offset, compression_methods_length,
10208 "Compression Methods (%u method%s)",
10209 compression_methods_length,
10210 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10211 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10212 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10213 while (offset < next_offset) {
10214 compression_method = tvb_get_uint8(hello_tvb, offset);
10215 /* TODO: make reserved/private comp meth. fields selectable */
10216 if (compression_method < 64)
10217 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10218 hello_tvb, offset, 1, compression_method);
10219 else if (compression_method < 193)
10220 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10221 compression_method, "Reserved - to be assigned by IANA (%u)",
10222 compression_method);
10223 else
10224 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10225 compression_method, "Private use range (%u)",
10226 compression_method);
10227 offset++;
10228 }
10229
10230 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10231 if (offset < offset_end) {
10232 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10233 offset_end, SSL_HND_CLIENT_HELLO,
10234 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10235 if (ja4_data.max_version > 0) {
10236 client_version = ja4_data.max_version;
10237 }
10238 } else {
10239 wmem_strbuf_append_printf(ja3, ",,");
10240 }
10241
10242 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10243 wmem_strbuf_append(ja4_a, "t");
10244 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10245 wmem_strbuf_append(ja4_a, "q");
10246 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10247 wmem_strbuf_append(ja4_a, "d");
10248 }
10249 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10250 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10251 if (ja4_data.num_cipher_suites > 99) {
10252 wmem_strbuf_append(ja4_a, "99");
10253 } else {
10254 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10255 }
10256 if (ja4_data.num_extensions > 99) {
10257 wmem_strbuf_append(ja4_a, "99");
10258 } else {
10259 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10260 }
10261 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10262 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10263 } else {
10264 wmem_strbuf_append(ja4_a, "00");
10265 }
10266
10267 curr_entry = wmem_list_head(ja4_data.cipher_list);
10268 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10269 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10270 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10271 wmem_strbuf_append(ja4_br, ",");
10272 }
10273 curr_entry = wmem_list_frame_next(curr_entry);
10274 }
10275
10276 curr_entry = wmem_list_head(ja4_data.extension_list);
10277 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10278 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10279 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10280 wmem_strbuf_append(ja4_cr, ",");
10281 }
10282 curr_entry = wmem_list_frame_next(curr_entry);
10283 }
10284
10285 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10286 wmem_strbuf_append(ja4_cr, "_");
10287 curr_entry = wmem_list_head(ja4_data.sighash_list);
10288 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10289 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10290 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10291 wmem_strbuf_append(ja4_cr, ",");
10292 }
10293 curr_entry = wmem_list_frame_next(curr_entry);
10294 }
10295 }
10296 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10297 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10298 } else {
10299 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10300 }
10301 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10302
10303 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10304 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10305 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10306 } else {
10307 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10308 }
10309 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10310 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10311
10312 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10313 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10314
10315 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10316 proto_item_set_generated(ti);
10317 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10318 proto_item_set_generated(ti);
10319
10320 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10321 wmem_strbuf_get_len(ja3));
10322 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10323 proto_item_set_generated(ti);
10324 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10325 proto_item_set_generated(ti);
10326 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10327 return initial_offset + offset;
10328}
10329
10330void
10331ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10332 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10333 SslSession *session, SslDecryptSession *ssl,
10334 bool_Bool is_dtls, bool_Bool is_hrr)
10335{
10336 /* struct {
10337 * ProtocolVersion server_version;
10338 * Random random;
10339 * SessionID session_id; // TLS 1.2 and before
10340 * CipherSuite cipher_suite;
10341 * CompressionMethod compression_method; // TLS 1.2 and before
10342 * Extension server_hello_extension_list<0..2^16-1>;
10343 * } ServerHello;
10344 */
10345 uint8_t draft_version = session->tls13_draft_version;
10346 proto_item *ti;
10347 uint32_t server_version;
10348 uint32_t cipher_suite;
10349 uint32_t initial_offset = offset;
10350 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10351 char *ja3_hash;
10352
10353 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10354 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10355
10356 /* Initially assume that the session is resumed. If this is not the case, a
10357 * ServerHelloDone will be observed before the ChangeCipherSpec message
10358 * which will reset this flag. */
10359 session->is_session_resumed = true1;
10360
10361 /* show the server version */
10362 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10363 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10364
10365 uint16_t supported_server_version;
10366 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
10367 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10368 }
10369 /*
10370 * Is it version 1.3?
10371 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10372 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10373 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10374 * Hello".
10375 */
10376 if (is_dtls) {
10377 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10378 /* Don't do that. */
10379 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10380 }
10381 } else {
10382 if (server_version == TLSV1DOT3_VERSION0x304) {
10383 /* Don't do that. */
10384 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10385 }
10386 }
10387
10388 offset += 2;
10389 wmem_strbuf_append_printf(ja3, "%i", server_version);
10390
10391 /* dissect fields that are present in both ClientHello and ServerHello */
10392 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10393
10394 if (ssl) {
10395 /* store selected cipher suite for decryption */
10396 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10397 }
10398
10399 /* now the server-selected cipher suite */
10400 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10401 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10402 offset += 2;
10403 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10404
10405 /* No compression with TLS 1.3 before draft -22 */
10406 if (!(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
10407 if (ssl) {
10408 /* store selected compression method for decryption */
10409 ssl->session.compression = tvb_get_uint8(tvb, offset);
10410 }
10411 /* and the server-selected compression method */
10412 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10413 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10414 offset++;
10415 }
10416
10417 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10418 if (offset < offset_end) {
10419 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10420 offset_end,
10421 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10422 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10423 }
10424
10425 if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
10426 /* RFC 9849 7.2 Backend Server */
10427 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10428 SSL_MDgcry_md_hd_t mc;
10429 if (hash_algo && ssl_md_init(&mc, hash_algo) == 0) {
10430 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10431 unsigned char prk[DIGEST_MAX_SIZE48];
10432 unsigned char *ech_verify_out = NULL((void*)0);
10433 unsigned int len;
10434 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10435 if (is_hrr) {
10436 /* RFC 8446 4.4.1 The Transcript Hash
10437 * Special synthetic handshake following a HelloRetryRequest */
10438 ssl_md_final(&mc, transcript_hash, &len);
10439 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10440 ssl->ech_transcript.data_len = 4 + len;
10441 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10442 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10443 ssl->ech_transcript.data[1] = 0;
10444 ssl->ech_transcript.data[2] = 0;
10445 ssl->ech_transcript.data[3] = len;
10446 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10447 ssl_md_reset(&mc);
10448 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10449 } else {
10450 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10451 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10452 }
10453 if (initial_offset > 4) {
10454 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10455 4 + offset_end - initial_offset);
10456 if (is_hrr)
10457 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10458 else
10459 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10460 } else {
10461 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10462 prefix[2] = ((offset - initial_offset) >> 8);
10463 prefix[3] = (offset - initial_offset) & 0xff;
10464 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10465 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
10466 offset_end - initial_offset);
10467 ssl_md_update(&mc, prefix, 4);
10468 if (is_hrr)
10469 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 34), 34);
10470 else
10471 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 26), 26);
10472 }
10473 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
10474 uint8_t zeros[8] = { 0 };
10475 uint32_t confirmation_offset = initial_offset + 26;
10476 if (is_hrr) {
10477 uint32_t hrr_offset = initial_offset + 34;
10478 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset,
10479 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
10480 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
10481 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 3), 3);
10482 hrr_offset += 3;
10483 uint32_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
10484 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 2), 2);
10485 hrr_offset += 2;
10486 while (extensions_end - hrr_offset >= 4) {
10487 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
10488 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
10489 confirmation_offset = hrr_offset + 4;
10490 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 4), 4);
10491 ssl_md_update(&mc, zeros, 8);
10492 hrr_offset += 12;
10493 } else {
10494 ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
10495 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
10496 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
10497 }
10498 }
10499 } else {
10500 ssl_md_update(&mc, zeros, 8);
10501 ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
10502 offset - initial_offset - 34);
10503 }
10504 ssl_md_final(&mc, transcript_hash, &len);
10505 ssl_md_cleanup(&mc);
10506 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10507 StringInfo prk_string = {prk, len};
10508 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10509 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10510 transcript_hash, len, 8, &ech_verify_out)) {
10511 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10512 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10513 if (is_hrr) {
10514 ssl->session.hrr_ech_declined = true1;
10515 ssl->session.first_ch_ech_frame = 0;
10516 }
10517 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10518 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10519 }
10520 wmem_free(NULL((void*)0), ech_verify_out);
10521 }
10522 ssl->session.ech = true1;
10523 }
10524 }
10525
10526 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10527 wmem_strbuf_get_len(ja3));
10528 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10529 proto_item_set_generated(ti);
10530 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10531 proto_item_set_generated(ti);
10532 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10533}
10534/* Client Hello and Server Hello dissections. }}} */
10535
10536/* New Session Ticket dissection. {{{ */
10537void
10538ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10539 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10540 SslSession *session, SslDecryptSession *ssl,
10541 bool_Bool is_dtls, GHashTable *session_hash)
10542{
10543 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10544 * struct {
10545 * uint32 ticket_lifetime_hint;
10546 * opaque ticket<0..2^16-1>;
10547 * } NewSessionTicket;
10548 *
10549 * RFC 8446 Section 4.6.1 (TLS 1.3):
10550 * struct {
10551 * uint32 ticket_lifetime;
10552 * uint32 ticket_age_add;
10553 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10554 * opaque ticket<1..2^16-1>;
10555 * Extension extensions<0..2^16-2>;
10556 * } NewSessionTicket;
10557 */
10558 proto_tree *subtree;
10559 proto_item *subitem;
10560 uint32_t ticket_len;
10561 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10562 unsigned char draft_version = session->tls13_draft_version;
10563 uint32_t lifetime_hint;
10564
10565 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10566 hf->ett.session_ticket, NULL((void*)0),
10567 "TLS Session Ticket");
10568
10569 /* ticket lifetime hint */
10570 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10571 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10572 offset += 4;
10573
10574 if (lifetime_hint >= 60) {
10575 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10576 proto_item_append_text(subitem, " (%s)", time_str);
10577 }
10578
10579 if (is_tls13) {
10580
10581 /* for TLS 1.3: ticket_age_add */
10582 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10583 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10584 offset += 4;
10585
10586 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10587 if (draft_version == 0 || draft_version >= 21) {
10588 uint32_t ticket_nonce_len;
10589
10590 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10591 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10592 return;
10593 }
10594 offset++;
10595
10596 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10597 offset += ticket_nonce_len;
10598 }
10599
10600 }
10601
10602 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10603 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10604 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10605 return;
10606 }
10607 offset += 2;
10608
10609 /* Content depends on implementation, so just show data! */
10610 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10611 tvb, offset, ticket_len, ENC_NA0x00000000);
10612 /* save the session ticket to cache for ssl_finalize_decryption */
10613 if (ssl && !is_tls13) {
10614 if (ssl->session.is_session_resumed) {
10615 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10616 * (Abbreviated Handshake Using New Session Ticket).
10617 * Restore the master key for this session ticket before saving
10618 * it to the new session ticket. */
10619 ssl_restore_master_key(ssl, "Session Ticket", false0,
10620 session_hash, &ssl->session_ticket);
10621 }
10622 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10623 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10624 ssl->session_ticket.data, ticket_len);
10625 ssl->session_ticket.data_len = ticket_len;
10626 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10627 /* NewSessionTicket is received after the first (client)
10628 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10629 * Since the second CCS has already the session key available it will
10630 * just return. To ensure that the session ticket is mapped to a
10631 * master key (from the first CCS), save the ticket here too. */
10632 ssl_save_master_key("Session Ticket", session_hash,
10633 &ssl->session_ticket, &ssl->master_secret);
10634 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10635 }
10636 offset += ticket_len;
10637
10638 if (is_tls13) {
10639 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10640 offset_end, SSL_HND_NEWSESSION_TICKET,
10641 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10642 }
10643} /* }}} */
10644
10645void
10646ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10647 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10648 SslSession *session, SslDecryptSession *ssl,
10649 bool_Bool is_dtls)
10650{
10651 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10652 * struct {
10653 * ProtocolVersion server_version;
10654 * CipherSuite cipher_suite; // not before draft -19
10655 * Extension extensions<2..2^16-1>;
10656 * } HelloRetryRequest;
10657 * Note: no longer used since draft -22
10658 */
10659 uint32_t version;
10660 uint8_t draft_version;
10661
10662 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10663 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
10664 draft_version = extract_tls13_draft_version(version);
10665 offset += 2;
10666
10667 if (draft_version == 0 || draft_version >= 19) {
10668 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
10669 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10670 offset += 2;
10671 }
10672
10673 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10674 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
10675 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10676}
10677
10678void
10679ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10680 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10681 SslSession *session, SslDecryptSession *ssl,
10682 bool_Bool is_dtls)
10683{
10684 /* RFC 8446 Section 4.3.1
10685 * struct {
10686 * Extension extensions<0..2^16-1>;
10687 * } EncryptedExtensions;
10688 */
10689 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10690 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
10691 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10692}
10693
10694/* Certificate and Certificate Request dissections. {{{ */
10695void
10696ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10697 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
10698 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
10699 bool_Bool is_from_server, bool_Bool is_dtls)
10700{
10701 /* opaque ASN.1Cert<1..2^24-1>;
10702 *
10703 * Before RFC 8446 (TLS <= 1.2):
10704 * struct {
10705 * select(certificate_type) {
10706 *
10707 * // certificate type defined in RFC 7250
10708 * case RawPublicKey:
10709 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
10710 *
10711 * // X.509 certificate defined in RFC 5246
10712 * case X.509:
10713 * ASN.1Cert certificate_list<0..2^24-1>;
10714 * };
10715 * } Certificate;
10716 *
10717 * RFC 8446 (since draft -20):
10718 * struct {
10719 * select(certificate_type){
10720 * case RawPublicKey:
10721 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
10722 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
10723 *
10724 * case X.509:
10725 * opaque cert_data<1..2^24-1>;
10726 * }
10727 * Extension extensions<0..2^16-1>;
10728 * } CertificateEntry;
10729 * struct {
10730 * opaque certificate_request_context<0..2^8-1>;
10731 * CertificateEntry certificate_list<0..2^24-1>;
10732 * } Certificate;
10733 */
10734 enum { CERT_X509, CERT_RPK } cert_type;
10735 asn1_ctx_t asn1_ctx;
10736#if defined(HAVE_LIBGNUTLS1)
10737 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
10738 unsigned certificate_index = 0;
10739#endif
10740 uint32_t next_offset, certificate_list_length, cert_length;
10741 proto_tree *subtree = tree;
10742
10743 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10744
10745 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
10746 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
10747 cert_type = CERT_RPK;
10748 } else {
10749 cert_type = CERT_X509;
10750 }
10751
10752#if defined(HAVE_LIBGNUTLS1)
10753 /* Ask the pkcs1 dissector to return the public key details */
10754 if (ssl)
10755 asn1_ctx.private_data = &subjectPublicKeyInfo;
10756#endif
10757
10758 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
10759 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
10760 uint32_t context_length;
10761 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10762 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10763 return;
10764 }
10765 offset++;
10766 if (context_length > 0) {
10767 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10768 tvb, offset, context_length, ENC_NA0x00000000);
10769 offset += context_length;
10770 }
10771 }
10772
10773 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
10774 /* For RPK before TLS 1.3, the single RPK is stored directly without
10775 * another "certificate_list" field. */
10776 certificate_list_length = offset_end - offset;
10777 next_offset = offset_end;
10778 } else {
10779 /* CertificateEntry certificate_list<0..2^24-1> */
10780 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
10781 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
10782 return;
10783 }
10784 offset += 3; /* 24-bit length value */
10785 next_offset = offset + certificate_list_length;
10786 }
10787
10788 /* RawPublicKey must have one cert, but X.509 can have multiple. */
10789 if (certificate_list_length > 0 && cert_type == CERT_X509) {
10790 proto_item *ti;
10791
10792 ti = proto_tree_add_none_format(tree,
10793 hf->hf.hs_certificates,
10794 tvb, offset, certificate_list_length,
10795 "Certificates (%u bytes)",
10796 certificate_list_length);
10797
10798 /* make it a subtree */
10799 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
10800 }
10801
10802 while (offset < next_offset) {
10803 switch (cert_type) {
10804 case CERT_RPK:
10805 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
10806 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
10807 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10808 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10809 return;
10810 }
10811 offset += 3;
10812
10813 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10814 offset += cert_length;
10815 break;
10816 case CERT_X509:
10817 /* opaque ASN1Cert<1..2^24-1> */
10818 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10819 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10820 return;
10821 }
10822 offset += 3;
10823
10824 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10825#if defined(HAVE_LIBGNUTLS1)
10826 if (is_from_server && ssl && certificate_index == 0) {
10827 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
10828 /* Only attempt to get the RSA modulus for the first cert. */
10829 asn1_ctx.private_data = NULL((void*)0);
10830 }
10831#endif
10832 offset += cert_length;
10833 break;
10834 }
10835
10836 /* TLS 1.3: Extension extensions<0..2^16-1> */
10837 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
10838 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10839 next_offset, SSL_HND_CERTIFICATE,
10840 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10841 }
10842
10843#if defined(HAVE_LIBGNUTLS1)
10844 certificate_index++;
10845#endif
10846 }
10847}
10848
10849void
10850ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10851 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10852 SslSession *session, bool_Bool is_dtls)
10853{
10854 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
10855 * enum {
10856 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10857 * (255)
10858 * } ClientCertificateType;
10859 *
10860 * opaque DistinguishedName<1..2^16-1>;
10861 *
10862 * struct {
10863 * ClientCertificateType certificate_types<1..2^8-1>;
10864 * DistinguishedName certificate_authorities<3..2^16-1>;
10865 * } CertificateRequest;
10866 *
10867 *
10868 * As per TLSv1.2 (RFC 5246) the format has changed to:
10869 *
10870 * enum {
10871 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10872 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
10873 * fortezza_dms_RESERVED(20), (255)
10874 * } ClientCertificateType;
10875 *
10876 * enum {
10877 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
10878 * sha512(6), (255)
10879 * } HashAlgorithm;
10880 *
10881 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
10882 * SignatureAlgorithm;
10883 *
10884 * struct {
10885 * HashAlgorithm hash;
10886 * SignatureAlgorithm signature;
10887 * } SignatureAndHashAlgorithm;
10888 *
10889 * SignatureAndHashAlgorithm
10890 * supported_signature_algorithms<2..2^16-2>;
10891 *
10892 * opaque DistinguishedName<1..2^16-1>;
10893 *
10894 * struct {
10895 * ClientCertificateType certificate_types<1..2^8-1>;
10896 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
10897 * DistinguishedName certificate_authorities<0..2^16-1>;
10898 * } CertificateRequest;
10899 *
10900 * draft-ietf-tls-tls13-18:
10901 * struct {
10902 * opaque certificate_request_context<0..2^8-1>;
10903 * SignatureScheme
10904 * supported_signature_algorithms<2..2^16-2>;
10905 * DistinguishedName certificate_authorities<0..2^16-1>;
10906 * CertificateExtension certificate_extensions<0..2^16-1>;
10907 * } CertificateRequest;
10908 *
10909 * RFC 8446 (since draft-ietf-tls-tls13-19):
10910 *
10911 * struct {
10912 * opaque certificate_request_context<0..2^8-1>;
10913 * Extension extensions<2..2^16-1>;
10914 * } CertificateRequest;
10915 */
10916 proto_item *ti;
10917 proto_tree *subtree;
10918 uint32_t next_offset;
10919 asn1_ctx_t asn1_ctx;
10920 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
10921 unsigned char draft_version = session->tls13_draft_version;
10922
10923 if (!tree)
10924 return;
10925
10926 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10927
10928 if (is_tls13) {
10929 uint32_t context_length;
10930 /* opaque certificate_request_context<0..2^8-1> */
10931 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10932 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10933 return;
10934 }
10935 offset++;
10936 if (context_length > 0) {
10937 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10938 tvb, offset, context_length, ENC_NA0x00000000);
10939 offset += context_length;
10940 }
10941 } else {
10942 uint32_t cert_types_count;
10943 /* ClientCertificateType certificate_types<1..2^8-1> */
10944 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
10945 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
10946 return;
10947 }
10948 offset++;
10949 next_offset = offset + cert_types_count;
10950
10951 ti = proto_tree_add_none_format(tree,
10952 hf->hf.hs_cert_types,
10953 tvb, offset, cert_types_count,
10954 "Certificate types (%u type%s)",
10955 cert_types_count,
10956 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
10957 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
10958
10959 while (offset < next_offset) {
10960 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10961 offset++;
10962 }
10963 }
10964
10965 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
10966 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
10967 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
10968 }
10969
10970 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
10971 /*
10972 * TLS 1.3 draft 19 and newer: Extensions.
10973 * SslDecryptSession pointer is NULL because Certificate Extensions
10974 * should not influence decryption state.
10975 */
10976 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10977 offset_end, SSL_HND_CERT_REQUEST,
10978 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10979 } else if (is_tls13 && draft_version <= 18) {
10980 /*
10981 * TLS 1.3 draft 18 and older: certificate_authorities and
10982 * certificate_extensions (a vector of OID mappings).
10983 */
10984 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
10985 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
10986 } else {
10987 /* for TLS 1.2 and older, the certificate_authorities field. */
10988 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
10989 }
10990}
10991/* Certificate and Certificate Request dissections. }}} */
10992
10993void
10994ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10995 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
10996{
10997 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
10998 hf->hf.hs_client_cert_vrfy_sig_len,
10999 hf->hf.hs_client_cert_vrfy_sig);
11000}
11001
11002/* Finished dissection. {{{ */
11003void
11004ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11005 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11006 const SslSession *session, ssl_hfs_t *ssl_hfs)
11007{
11008 /* For SSLv3:
11009 * struct {
11010 * opaque md5_hash[16];
11011 * opaque sha_hash[20];
11012 * } Finished;
11013 *
11014 * For (D)TLS:
11015 * struct {
11016 * opaque verify_data[12];
11017 * } Finished;
11018 *
11019 * For TLS 1.3:
11020 * struct {
11021 * opaque verify_data[Hash.length];
11022 * }
11023 */
11024 if (!tree)
11025 return;
11026
11027 if (session->version == SSLV3_VERSION0x300) {
11028 if (ssl_hfs != NULL((void*)0)) {
11029 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11030 tvb, offset, 16, ENC_NA0x00000000);
11031 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11032 tvb, offset + 16, 20, ENC_NA0x00000000);
11033 }
11034 } else {
11035 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11036 proto_tree_add_item(tree, hf->hf.hs_finished,
11037 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11038 }
11039} /* }}} */
11040
11041/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11042void
11043ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11044{
11045 uint16_t url_hash_len;
11046
11047 /* enum {
11048 * individual_certs(0), pkipath(1), (255)
11049 * } CertChainType;
11050 *
11051 * struct {
11052 * CertChainType type;
11053 * URLAndHash url_and_hash_list<1..2^16-1>;
11054 * } CertificateURL;
11055 *
11056 * struct {
11057 * opaque url<1..2^16-1>;
11058 * uint8 padding;
11059 * opaque SHA1Hash[20];
11060 * } URLAndHash;
11061 */
11062
11063 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11064 tvb, offset, 1, ENC_NA0x00000000);
11065 offset++;
11066
11067 url_hash_len = tvb_get_ntohs(tvb, offset);
11068 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11069 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11070 offset += 2;
11071 while (url_hash_len-- > 0) {
11072 proto_item *urlhash_item;
11073 proto_tree *urlhash_tree;
11074 uint16_t url_len;
11075
11076 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11077 tvb, offset, -1, ENC_NA0x00000000);
11078 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11079
11080 url_len = tvb_get_ntohs(tvb, offset);
11081 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11082 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11083 offset += 2;
11084
11085 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11086 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11087 offset += url_len;
11088
11089 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11090 tvb, offset, 1, ENC_NA0x00000000);
11091 offset++;
11092 /* Note: RFC 6066 says that padding must be 0x01 */
11093
11094 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11095 tvb, offset, 20, ENC_NA0x00000000);
11096 offset += 20;
11097 }
11098} /* }}} */
11099
11100void
11101ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11102 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11103 SslSession *session, SslDecryptSession *ssl,
11104 bool_Bool is_from_server, bool_Bool is_dtls)
11105{
11106 uint32_t algorithm, uncompressed_length;
11107 uint32_t compressed_certificate_message_length;
11108 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11109 proto_item *ti;
11110 /*
11111 * enum {
11112 * zlib(1),
11113 * brotli(2),
11114 * zstd(3),
11115 * (65535)
11116 * } CertificateCompressionAlgorithm;
11117 *
11118 * struct {
11119 * CertificateCompressionAlgorithm algorithm;
11120 * uint24 uncompressed_length;
11121 * opaque compressed_certificate_message<1..2^24-1>;
11122 * } CompressedCertificate;
11123 */
11124
11125 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11126 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11127 offset += 2;
11128
11129 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11130 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11131 offset += 3;
11132
11133 /* opaque compressed_certificate_message<1..2^24-1>; */
11134 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11135 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11136 return;
11137 }
11138 offset += 3;
11139
11140 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11141 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11142
11143 /* Certificate decompression following algorithm */
11144 switch (algorithm) {
11145 case 1: /* zlib */
11146 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11147 break;
11148 case 2: /* brotli */
11149 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11150 break;
11151 case 3: /* zstd */
11152 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11153 break;
11154 }
11155
11156 if (uncompressed_tvb) {
11157 proto_tree *uncompressed_tree;
11158
11159 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11160 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11161 tvb, offset, offset_end - offset,
11162 "Invalid uncompressed length %u (expected %u)",
11163 tvb_captured_length(uncompressed_tvb),
11164 uncompressed_length);
11165 } else {
11166 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11167 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11168 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11169 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11170 }
11171 }
11172}
11173
11174/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11175static int
11176// NOLINTNEXTLINE(misc-no-recursion)
11177ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11178 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11179 SslSession *session, SslDecryptSession *ssl,
11180 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11181 ssl_master_key_map_t *mk_map)
11182{
11183 uint32_t exts_len;
11184 uint16_t ext_type;
11185 uint32_t ext_len;
11186 uint32_t next_offset;
11187 proto_item *ext_item;
11188 proto_tree *ext_tree;
11189 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11190 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11191 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11192 char *ja3_dash = "";
11193 unsigned supported_version;
11194
11195 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11196 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11197 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11198 return offset_end;
11199 }
11200 offset += 2;
11201 offset_end = offset + exts_len;
11202
11203 if (ja4_data) {
11204 ja4_data->num_extensions = 0;
11205 }
11206 while (offset_end - offset >= 4)
11207 {
11208 ext_type = tvb_get_ntohs(tvb, offset);
11209 ext_len = tvb_get_ntohs(tvb, offset + 2);
11210
11211 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11212 ja4_data->num_extensions += 1;
11213 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11214 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11215 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11216 }
11217 }
11218
11219 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11220 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11221 tls_hello_extension_types,
11222 "Unknown type %u"), ext_len);
11223 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11224
11225 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11226 tvb, offset, 2, ext_type);
11227 offset += 2;
11228 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11229 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11230 ja3_dash = "-";
11231 }
11232
11233 /* opaque extension_data<0..2^16-1> */
11234 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11235 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11236 return offset_end;
11237 }
11238 offset += 2;
11239 next_offset = offset + ext_len;
11240
11241 switch (ext_type) {
11242 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11243 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11244 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11245 if (ja4_data) {
11246 ja4_data->server_name_present = true1;
11247 }
11248 }
11249 break;
11250 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11251 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11252 offset += 1;
11253 break;
11254 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11255 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11256 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11257 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11258 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11259 }
11260 break;
11261 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11262 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11263 offset, next_offset,
11264 hnd_type, ext_type,
11265 session);
11266 break;
11267 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11268 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11269 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11270 next_offset, ja3_sg);
11271 } else {
11272 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11273 next_offset, NULL((void*)0));
11274 }
11275 break;
11276 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11277 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11278 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11279 } else {
11280 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11281 }
11282 break;
11283 case SSL_HND_HELLO_EXT_SRP12:
11284 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11285 break;
11286 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11287 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11288 break;
11289 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11290 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11291 break;
11292 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11293 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11294 break;
11295 case SSL_HND_HELLO_EXT_USE_SRTP14:
11296 if (is_dtls) {
11297 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11298 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11299 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11300 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11301 }
11302 } else {
11303 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11304 }
11305 break;
11306 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11307 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11308 break;
11309 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11310 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11311 break;
11312 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11313 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11314 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11315 offset++;
11316 break;
11317 case SSL_HND_HELLO_EXT_ALPN16:
11318 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11319 break;
11320 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11321 if (hnd_type == SSL_HND_CLIENT_HELLO)
11322 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11323 break;
11324 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11325 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11326 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11327 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11328 break;
11329 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11330 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11331 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11332 offset, next_offset,
11333 hnd_type, ext_type,
11334 session);
11335 break;
11336 case SSL_HND_HELLO_EXT_PADDING21:
11337 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11338 offset += ext_len;
11339 break;
11340 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11341 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11342 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11343 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11344 }
11345 break;
11346 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11347 if (ssl) {
11348 switch (hnd_type) {
11349 case SSL_HND_CLIENT_HELLO:
11350 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11351 break;
11352 case SSL_HND_SERVER_HELLO:
11353 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11354 break;
11355 default: /* no default */
11356 break;
11357 }
11358 }
11359 break;
11360 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11361 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11362 break;
11363 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11364 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11365 break;
11366 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11367 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11368 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11369 offset += 2;
11370 break;
11371 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11372 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11373 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11374 break;
11375 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11376 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11377 break;
11378 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11379 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11380 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11381 break;
11382 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11383 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11384 break;
11385 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11386 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11387 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11388 break;
11389 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11390 switch (hnd_type) {
11391 case SSL_HND_CLIENT_HELLO:
11392 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11393 break;
11394 case SSL_HND_SERVER_HELLO:
11395 case SSL_HND_HELLO_RETRY_REQUEST:
11396 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11397 offset += 2;
11398 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11399 break;
11400 }
11401 break;
11402 case SSL_HND_HELLO_EXT_COOKIE44:
11403 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11404 break;
11405 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11406 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11407 break;
11408 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11409 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11410 break;
11411 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11412 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11413 break;
11414 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11415 break;
11416 case SSL_HND_HELLO_EXT_NPN13172:
11417 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11418 break;
11419 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11420 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11421 break;
11422 case SSL_HND_HELLO_EXT_ALPS17613:
11423 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11424 break;
11425 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11426 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11427 break;
11428 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11429 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11430 break;
11431 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11432 session->deprecated_cid = true1;
11433 /* FALLTHRU */
11434 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11435 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11436 break;
11437 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11438 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11439 break;
11440 default:
11441 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11442 tvb, offset, ext_len, ENC_NA0x00000000);
11443 offset += ext_len;
11444 break;
11445 }
11446
11447 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11448 /* Dissection did not end at expected location, fix it. */
11449 offset = next_offset;
11450 }
11451 }
11452
11453 if (ja3) {
11454 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11455 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11456 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11457 } else {
11458 wmem_strbuf_append_c(ja3, ',');
11459 }
11460 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11461 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11462 } else {
11463 wmem_strbuf_append_c(ja3, ',');
11464 }
11465 }
11466 }
11467
11468 /* Check if Extensions vector is correctly terminated. */
11469 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11470 offset = offset_end;
11471 }
11472
11473 return offset;
11474} /* }}} */
11475
11476
11477/* ClientKeyExchange algo-specific dissectors. {{{ */
11478
11479static void
11480dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11481 proto_tree *tree, uint32_t offset,
11482 uint32_t length)
11483{
11484 int point_len;
11485 proto_tree *ssl_ecdh_tree;
11486
11487 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11488 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11489
11490 /* point */
11491 point_len = tvb_get_uint8(tvb, offset);
11492 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11493 offset, 1, ENC_BIG_ENDIAN0x00000000);
11494 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11495 offset + 1, point_len, ENC_NA0x00000000);
11496}
11497
11498static void
11499dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11500 proto_tree *tree, uint32_t offset, uint32_t length)
11501{
11502 int yc_len;
11503 proto_tree *ssl_dh_tree;
11504
11505 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11506 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11507
11508 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11509 yc_len = tvb_get_ntohs(tvb, offset);
11510 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11511 offset, 2, ENC_BIG_ENDIAN0x00000000);
11512 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11513 offset + 2, yc_len, ENC_NA0x00000000);
11514}
11515
11516static void
11517dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11518 proto_tree *tree, uint32_t offset,
11519 uint32_t length, const SslSession *session)
11520{
11521 int epms_len;
11522 proto_tree *ssl_rsa_tree;
11523
11524 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11525 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11526
11527 /* EncryptedPreMasterSecret.pre_master_secret */
11528 switch (session->version) {
11529 case SSLV2_VERSION0x0002:
11530 case SSLV3_VERSION0x300:
11531 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11532 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11533 * not present. The handshake contents represents the EPMS, see:
11534 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11535 epms_len = length;
11536 break;
11537
11538 default:
11539 /* TLS and DTLS include vector length before EPMS */
11540 epms_len = tvb_get_ntohs(tvb, offset);
11541 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11542 offset, 2, ENC_BIG_ENDIAN0x00000000);
11543 offset += 2;
11544 break;
11545 }
11546 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11547 offset, epms_len, ENC_NA0x00000000);
11548}
11549
11550/* Used in PSK cipher suites */
11551static uint32_t
11552dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11553 proto_tree *tree, uint32_t offset)
11554{
11555 unsigned identity_len;
11556 proto_tree *ssl_psk_tree;
11557
11558 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11559 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11560 /* identity */
11561 identity_len = tvb_get_ntohs(tvb, offset);
11562 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11563 offset, 2, ENC_BIG_ENDIAN0x00000000);
11564 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11565 offset + 2, identity_len, ENC_NA0x00000000);
11566
11567 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11568 return 2 + identity_len;
11569}
11570
11571/* Used in RSA PSK cipher suites */
11572static void
11573dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11574 proto_tree *tree, uint32_t offset,
11575 uint32_t length)
11576{
11577 int identity_len, epms_len;
11578 proto_tree *ssl_psk_tree;
11579
11580 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11581 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11582
11583 /* identity */
11584 identity_len = tvb_get_ntohs(tvb, offset);
11585 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11586 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11587 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11588 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11589 offset += 2 + identity_len;
11590
11591 /* Yc */
11592 epms_len = tvb_get_ntohs(tvb, offset);
11593 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11594 offset, 2, ENC_BIG_ENDIAN0x00000000);
11595 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11596 offset + 2, epms_len, ENC_NA0x00000000);
11597}
11598
11599/* Used in Diffie-Hellman PSK cipher suites */
11600static void
11601dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11602 proto_tree *tree, uint32_t offset, uint32_t length)
11603{
11604 /*
11605 * struct {
11606 * select (KeyExchangeAlgorithm) {
11607 * case diffie_hellman_psk:
11608 * opaque psk_identity<0..2^16-1>;
11609 * ClientDiffieHellmanPublic public;
11610 * } exchange_keys;
11611 * } ClientKeyExchange;
11612 */
11613
11614 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11615 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11616}
11617
11618/* Used in EC Diffie-Hellman PSK cipher suites */
11619static void
11620dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11621 proto_tree *tree, uint32_t offset, uint32_t length)
11622{
11623 /*
11624 * struct {
11625 * select (KeyExchangeAlgorithm) {
11626 * case ec_diffie_hellman_psk:
11627 * opaque psk_identity<0..2^16-1>;
11628 * ClientECDiffieHellmanPublic public;
11629 * } exchange_keys;
11630 * } ClientKeyExchange;
11631 */
11632
11633 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11634 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11635}
11636
11637/* Used in EC J-PAKE cipher suites */
11638static void
11639dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11640 proto_tree *tree, uint32_t offset,
11641 uint32_t length)
11642{
11643 /*
11644 * struct {
11645 * ECPoint V;
11646 * opaque r<1..2^8-1>;
11647 * } ECSchnorrZKP;
11648 *
11649 * struct {
11650 * ECPoint X;
11651 * ECSchnorrZKP zkp;
11652 * } ECJPAKEKeyKP;
11653 *
11654 * struct {
11655 * ECJPAKEKeyKP ecjpake_key_kp;
11656 * } ClientECJPAKEParams;
11657 *
11658 * select (KeyExchangeAlgorithm) {
11659 * case ecjpake:
11660 * ClientECJPAKEParams params;
11661 * } ClientKeyExchange;
11662 */
11663
11664 int point_len;
11665 proto_tree *ssl_ecjpake_tree;
11666
11667 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11668 hf->ett.keyex_params, NULL((void*)0),
11669 "EC J-PAKE Client Params");
11670
11671 /* ECJPAKEKeyKP.X */
11672 point_len = tvb_get_uint8(tvb, offset);
11673 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
11674 offset, 1, ENC_BIG_ENDIAN0x00000000);
11675 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
11676 offset + 1, point_len, ENC_NA0x00000000);
11677 offset += 1 + point_len;
11678
11679 /* ECJPAKEKeyKP.zkp.V */
11680 point_len = tvb_get_uint8(tvb, offset);
11681 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
11682 offset, 1, ENC_BIG_ENDIAN0x00000000);
11683 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
11684 offset + 1, point_len, ENC_NA0x00000000);
11685 offset += 1 + point_len;
11686
11687 /* ECJPAKEKeyKP.zkp.r */
11688 point_len = tvb_get_uint8(tvb, offset);
11689 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
11690 offset, 1, ENC_BIG_ENDIAN0x00000000);
11691 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
11692 offset + 1, point_len, ENC_NA0x00000000);
11693}
11694
11695static void
11696dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11697 proto_tree *tree, uint32_t offset,
11698 uint32_t length)
11699{
11700 int epms_len;
11701 proto_tree *ssl_ecc_sm2_tree;
11702
11703 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11704 hf->ett.keyex_params, NULL((void*)0),
11705 "ECC-SM2 Encrypted PreMaster Secret");
11706
11707 epms_len = tvb_get_ntohs(tvb, offset);
11708 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11709 offset, 2, ENC_BIG_ENDIAN0x00000000);
11710 offset += 2;
11711 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
11712 offset, epms_len, ENC_NA0x00000000);
11713}
11714/* ClientKeyExchange algo-specific dissectors. }}} */
11715
11716
11717/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
11718static uint32_t
11719ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11720 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11721 uint16_t version, int hf_sig_len, int hf_sig)
11722{
11723 uint32_t sig_len;
11724
11725 switch (version) {
11726 case TLSV1DOT2_VERSION0x303:
11727 case DTLSV1DOT2_VERSION0xfefd:
11728 case TLSV1DOT3_VERSION0x304:
11729 case DTLSV1DOT3_VERSION0xfefc:
11730 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
11731 offset += 2;
11732 break;
11733
11734 default:
11735 break;
11736 }
11737
11738 /* Sig */
11739 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
11740 hf_sig_len, 0, UINT16_MAX(65535))) {
11741 return offset_end;
11742 }
11743 offset += 2;
11744 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
11745 offset += sig_len;
11746 return offset;
11747} /* }}} */
11748
11749/* ServerKeyExchange algo-specific dissectors. {{{ */
11750
11751/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
11752static void
11753dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11754 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11755 uint16_t version)
11756{
11757 /*
11758 * TLSv1.2 (RFC 5246 sec 7.4.8)
11759 * struct {
11760 * digitally-signed struct {
11761 * opaque handshake_messages[handshake_messages_length];
11762 * }
11763 * } CertificateVerify;
11764 *
11765 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
11766 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
11767 *
11768 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
11769 * does more hashing including the master secret and padding.
11770 */
11771 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11772 hf->hf.hs_server_keyex_sig_len,
11773 hf->hf.hs_server_keyex_sig);
11774}
11775
11776static uint32_t
11777dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
11778{
11779 /*
11780 * RFC 4492 ECC cipher suites for TLS
11781 *
11782 * struct {
11783 * ECCurveType curve_type;
11784 * select (curve_type) {
11785 * case explicit_prime:
11786 * ...
11787 * case explicit_char2:
11788 * ...
11789 * case named_curve:
11790 * NamedCurve namedcurve;
11791 * };
11792 * } ECParameters;
11793 */
11794
11795 int curve_type;
11796
11797 /* ECParameters.curve_type */
11798 curve_type = tvb_get_uint8(tvb, offset);
11799 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
11800 offset, 1, ENC_BIG_ENDIAN0x00000000);
11801 offset++;
11802
11803 if (curve_type != 3)
11804 return offset_end; /* only named_curves are supported */
11805
11806 /* case curve_type == named_curve; ECParameters.namedcurve */
11807 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
11808 offset, 2, ENC_BIG_ENDIAN0x00000000);
11809 offset += 2;
11810
11811 return offset;
11812}
11813
11814static void
11815dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11816 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11817 uint16_t version, bool_Bool anon)
11818{
11819 /*
11820 * RFC 4492 ECC cipher suites for TLS
11821 *
11822 * struct {
11823 * opaque point <1..2^8-1>;
11824 * } ECPoint;
11825 *
11826 * struct {
11827 * ECParameters curve_params;
11828 * ECPoint public;
11829 * } ServerECDHParams;
11830 *
11831 * select (KeyExchangeAlgorithm) {
11832 * case ec_diffie_hellman:
11833 * ServerECDHParams params;
11834 * Signature signed_params;
11835 * } ServerKeyExchange;
11836 */
11837
11838 int point_len;
11839 proto_tree *ssl_ecdh_tree;
11840
11841 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11842 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
11843
11844 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
11845 if (offset >= offset_end)
11846 return; /* only named_curves are supported */
11847
11848 /* ECPoint.point */
11849 point_len = tvb_get_uint8(tvb, offset);
11850 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
11851 offset, 1, ENC_BIG_ENDIAN0x00000000);
11852 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
11853 offset + 1, point_len, ENC_NA0x00000000);
11854 offset += 1 + point_len;
11855
11856 /* Signature (if non-anonymous KEX) */
11857 if (!anon) {
11858 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
11859 }
11860}
11861
11862static void
11863dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11864 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11865 uint16_t version, bool_Bool anon)
11866{
11867 int p_len, g_len, ys_len;
11868 proto_tree *ssl_dh_tree;
11869
11870 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11871 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
11872
11873 /* p */
11874 p_len = tvb_get_ntohs(tvb, offset);
11875 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
11876 offset, 2, ENC_BIG_ENDIAN0x00000000);
11877 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
11878 offset + 2, p_len, ENC_NA0x00000000);
11879 offset += 2 + p_len;
11880
11881 /* g */
11882 g_len = tvb_get_ntohs(tvb, offset);
11883 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
11884 offset, 2, ENC_BIG_ENDIAN0x00000000);
11885 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
11886 offset + 2, g_len, ENC_NA0x00000000);
11887 offset += 2 + g_len;
11888
11889 /* Ys */
11890 ys_len = tvb_get_ntohs(tvb, offset);
11891 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
11892 offset, 2, ys_len);
11893 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
11894 offset + 2, ys_len, ENC_NA0x00000000);
11895 offset += 2 + ys_len;
11896
11897 /* Signature (if non-anonymous KEX) */
11898 if (!anon) {
11899 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
11900 }
11901}
11902
11903/* Only used in RSA-EXPORT cipher suites */
11904static void
11905dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11906 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11907 uint16_t version)
11908{
11909 int modulus_len, exponent_len;
11910 proto_tree *ssl_rsa_tree;
11911
11912 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11913 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
11914
11915 /* modulus */
11916 modulus_len = tvb_get_ntohs(tvb, offset);
11917 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
11918 offset, 2, ENC_BIG_ENDIAN0x00000000);
11919 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
11920 offset + 2, modulus_len, ENC_NA0x00000000);
11921 offset += 2 + modulus_len;
11922
11923 /* exponent */
11924 exponent_len = tvb_get_ntohs(tvb, offset);
11925 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
11926 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11927 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
11928 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
11929 offset += 2 + exponent_len;
11930
11931 /* Signature */
11932 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
11933}
11934
11935/* Used in RSA PSK and PSK cipher suites */
11936static uint32_t
11937dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11938 proto_tree *tree, uint32_t offset)
11939{
11940 unsigned hint_len;
11941 proto_tree *ssl_psk_tree;
11942
11943 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11944 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
11945
11946 /* hint */
11947 hint_len = tvb_get_ntohs(tvb, offset);
11948 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
11949 offset, 2, ENC_BIG_ENDIAN0x00000000);
11950 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
11951 offset + 2, hint_len, ENC_NA0x00000000);
11952
11953 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
11954 return 2 + hint_len;
11955}
11956
11957/* Used in Diffie-Hellman PSK cipher suites */
11958static void
11959dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11960 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11961{
11962 /*
11963 * struct {
11964 * select (KeyExchangeAlgorithm) {
11965 * case diffie_hellman_psk:
11966 * opaque psk_identity_hint<0..2^16-1>;
11967 * ServerDHParams params;
11968 * };
11969 * } ServerKeyExchange;
11970 */
11971
11972 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
11973 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
11974}
11975
11976/* Used in EC Diffie-Hellman PSK cipher suites */
11977static void
11978dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11979 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11980{
11981 /*
11982 * struct {
11983 * select (KeyExchangeAlgorithm) {
11984 * case ec_diffie_hellman_psk:
11985 * opaque psk_identity_hint<0..2^16-1>;
11986 * ServerECDHParams params;
11987 * };
11988 * } ServerKeyExchange;
11989 */
11990
11991 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
11992 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
11993}
11994
11995/* Used in EC J-PAKE cipher suites */
11996static void
11997dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11998 proto_tree *tree, uint32_t offset, uint32_t offset_end)
11999{
12000 /*
12001 * struct {
12002 * ECPoint V;
12003 * opaque r<1..2^8-1>;
12004 * } ECSchnorrZKP;
12005 *
12006 * struct {
12007 * ECPoint X;
12008 * ECSchnorrZKP zkp;
12009 * } ECJPAKEKeyKP;
12010 *
12011 * struct {
12012 * ECParameters curve_params;
12013 * ECJPAKEKeyKP ecjpake_key_kp;
12014 * } ServerECJPAKEParams;
12015 *
12016 * select (KeyExchangeAlgorithm) {
12017 * case ecjpake:
12018 * ServerECJPAKEParams params;
12019 * } ServerKeyExchange;
12020 */
12021
12022 int point_len;
12023 proto_tree *ssl_ecjpake_tree;
12024
12025 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12026 hf->ett.keyex_params, NULL((void*)0),
12027 "EC J-PAKE Server Params");
12028
12029 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12030 if (offset >= offset_end)
12031 return; /* only named_curves are supported */
12032
12033 /* ECJPAKEKeyKP.X */
12034 point_len = tvb_get_uint8(tvb, offset);
12035 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12036 offset, 1, ENC_BIG_ENDIAN0x00000000);
12037 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12038 offset + 1, point_len, ENC_NA0x00000000);
12039 offset += 1 + point_len;
12040
12041 /* ECJPAKEKeyKP.zkp.V */
12042 point_len = tvb_get_uint8(tvb, offset);
12043 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12044 offset, 1, ENC_BIG_ENDIAN0x00000000);
12045 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12046 offset + 1, point_len, ENC_NA0x00000000);
12047 offset += 1 + point_len;
12048
12049 /* ECJPAKEKeyKP.zkp.r */
12050 point_len = tvb_get_uint8(tvb, offset);
12051 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12052 offset, 1, ENC_BIG_ENDIAN0x00000000);
12053 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12054 offset + 1, point_len, ENC_NA0x00000000);
12055}
12056
12057/* Only used in ECC-SM2-EXPORT cipher suites */
12058static void
12059dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12060 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12061 uint16_t version)
12062{
12063 proto_tree *ssl_ecc_sm2_tree;
12064
12065 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12066 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12067
12068 /* Signature */
12069 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12070}
12071/* ServerKeyExchange algo-specific dissectors. }}} */
12072
12073/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12074void
12075ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12076 proto_tree *tree, uint32_t offset, uint32_t length,
12077 const SslSession *session)
12078{
12079 switch (ssl_get_keyex_alg(session->cipher)) {
12080 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12081 case KEX_DH_DSS0x14:
12082 case KEX_DH_RSA0x15:
12083 case KEX_DHE_DSS0x10:
12084 case KEX_DHE_RSA0x12:
12085 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12086 break;
12087 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12088 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12089 break;
12090 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12091 case KEX_ECDH_ECDSA0x1a:
12092 case KEX_ECDH_RSA0x1b:
12093 case KEX_ECDHE_ECDSA0x16:
12094 case KEX_ECDHE_RSA0x18:
12095 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12096 break;
12097 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12098 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12099 break;
12100 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12101 /* XXX: implement support for KRB5 */
12102 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12103 tvb, offset, length,
12104 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12105 " developers if you want them to be supported");
12106 break;
12107 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12108 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12109 break;
12110 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12111 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12112 break;
12113 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12114 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12115 break;
12116 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12117 case KEX_SRP_SHA_DSS0x21:
12118 case KEX_SRP_SHA_RSA0x22:
12119 /* XXX: implement support for SRP_SHA* */
12120 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12121 tvb, offset, length,
12122 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12123 " developers if you want them to be supported");
12124 break;
12125 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12126 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12127 break;
12128 case KEX_ECC_SM20x26: /* GB/T 38636 */
12129 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12130 break;
12131 default:
12132 if (session->cipher == 0) {
12133 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12134 tvb, offset, length,
12135 "Cipher Suite not found");
12136 } else {
12137 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12138 tvb, offset, length,
12139 "Cipher Suite 0x%04x is not implemented, "
12140 "contact Wireshark developers if you want this to be supported",
12141 session->cipher);
12142 }
12143 break;
12144 }
12145}
12146
12147void
12148ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12149 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12150 const SslSession *session)
12151{
12152 switch (ssl_get_keyex_alg(session->cipher)) {
12153 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12154 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12155 break;
12156 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12157 case KEX_DH_RSA0x15:
12158 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12159 tvb, offset, offset_end - offset);
12160 break;
12161 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12162 case KEX_DHE_RSA0x12:
12163 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12164 break;
12165 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12166 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12167 break;
12168 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12169 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12170 break;
12171 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12172 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12173 break;
12174 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12175 case KEX_ECDH_RSA0x1b:
12176 case KEX_ECDHE_ECDSA0x16:
12177 case KEX_ECDHE_RSA0x18:
12178 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12179 break;
12180 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12181 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12182 tvb, offset, offset_end - offset);
12183 break;
12184 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12185 case KEX_RSA_PSK0x1f:
12186 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12187 break;
12188 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12189 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12190 break;
12191 case KEX_ECC_SM20x26: /* GB/T 38636 */
12192 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12193 break;
12194 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12195 case KEX_SRP_SHA_DSS0x21:
12196 case KEX_SRP_SHA_RSA0x22:
12197 /* XXX: implement support for SRP_SHA* */
12198 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12199 tvb, offset, offset_end - offset,
12200 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12201 " developers if you want them to be supported");
12202 break;
12203 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12204 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12205 break;
12206 default:
12207 if (session->cipher == 0) {
12208 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12209 tvb, offset, offset_end - offset,
12210 "Cipher Suite not found");
12211 } else {
12212 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12213 tvb, offset, offset_end - offset,
12214 "Cipher Suite 0x%04x is not implemented, "
12215 "contact Wireshark developers if you want this to be supported",
12216 session->cipher);
12217 }
12218 break;
12219 }
12220}
12221/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12222
12223void
12224tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12225 proto_tree *tree, uint32_t offset)
12226{
12227 /* RFC 8446 Section 4.6.3
12228 * enum {
12229 * update_not_requested(0), update_requested(1), (255)
12230 * } KeyUpdateRequest;
12231 *
12232 * struct {
12233 * KeyUpdateRequest request_update;
12234 * } KeyUpdate;
12235 */
12236 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12237}
12238
12239void
12240ssl_common_register_ssl_alpn_dissector_table(const char *name,
12241 const char *ui_name, const int proto)
12242{
12243 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12244 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12245 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12246}
12247
12248void
12249ssl_common_register_dtls_alpn_dissector_table(const char *name,
12250 const char *ui_name, const int proto)
12251{
12252 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12253 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12254 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12255}
12256
12257void
12258ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12259{
12260 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12261 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12262 &(options->psk));
12263
12264 if (is_dtls) {
12265 prefs_register_obsolete_preference(module, "keylog_file");
12266 prefs_register_static_text_preference(module, "keylog_file_removed",
12267 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12268 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12269 return;
12270 }
12271
12272 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12273 "The name of a file which contains a list of \n"
12274 "(pre-)master secrets in one of the following formats:\n"
12275 "\n"
12276 "RSA <EPMS> <PMS>\n"
12277 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12278 "CLIENT_RANDOM <CRAND> <MS>\n"
12279 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12280 "\n"
12281 "Where:\n"
12282 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12283 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12284 "<SSLID> = The SSL Session ID\n"
12285 "<MS> = The Master-Secret (MS)\n"
12286 "<CRAND> = The Client's random number from the ClientHello message\n"
12287 "\n"
12288 "(All fields are in hex notation)",
12289 &(options->keylog_filename), false0);
12290}
12291
12292void
12293ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12294{
12295 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12296 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12297 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12298 * negotiated. */
12299 if (!ssl_session)
12300 return;
12301
12302 switch (ssl_session->session.version) {
12303 /* The handshake message types used in the handshake hash are different
12304 * in different versions. [D]TLS 1.3 tracks the messages up to the
12305 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12306 * at the ClientHello and include the messages up to the ServerHello, at
12307 * which point we know the version.
12308 *
12309 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12310 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12311 * format as TLS 1.3). We don't know at the point of the ClientHello which
12312 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12313 *
12314 * XXX - When the server responds with a HelloRetryRequest, for subsequent
12315 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12316 * replaced with a synthentic handhsake message of type "message_hash",
12317 * per RFC 8446 4.4.1. We aren't concerned with that now, as a HRR generally
12318 * rules out PSK-only key exchange, which is what we calculate the hash for
12319 * here. (The possible exception is when a server sends a HRR to reject
12320 * early data but the server and client otherwise agree on psk_ke, if
12321 * any client/server pairs support that.) We do support that in the context
12322 * of computing the hash for Encrypted Client Hello; see elsewhere.
12323 */
12324 case TLSV1DOT3_VERSION0x304:
12325 case DTLSV1DOT3_VERSION0xfefc:
12326 /* In [D]TLS 1.3 only the following handshake messages are used in the
12327 * handshake transcript. EndOfEarlyData and the Client Certificate,
12328 * Certificate Verify, and Finished are used in deriving the
12329 * resumption_master_secret but not the other secrets derived from
12330 * the master secret (client or server app traffic secret, exporter
12331 * secret). We don't yet support calculating a PSK to resume via
12332 * the resumption_master_secret, so we simply stop the transcript
12333 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12334 switch (msg_type) {
12335 case SSL_HND_CLIENT_HELLO:
12336 case SSL_HND_SERVER_HELLO:
12337 case SSL_HND_HELLO_RETRY_REQUEST:
12338 case SSL_HND_ENCRYPTED_EXTENSIONS:
12339 case SSL_HND_CERT_REQUEST:
12340 break;
12341 case SSL_HND_CERTIFICATE:
12342 case SSL_HND_CERT_VERIFY:
12343 case SSL_HND_FINISHED:
12344 if (!is_from_server)
12345 return;
12346 break;
12347 case SSL_HND_END_OF_EARLY_DATA:
12348 default:
12349 return;
12350 }
12351 break;
12352 default:
12353 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12354 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12355 * but the keys are not retrieved until ChangeCipherSpec later. If
12356 * mutual authentication is requested by the server, an intervening
12357 * CertificateVerify message can be sent but is not to be included
12358 * in the hash. */
12359 if (msg_type == SSL_HND_CERT_VERIFY)
12360 return;
12361 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12362 return;
12363 break;
12364 }
12365
12366 uint32_t old_length = ssl_session->handshake_data.data_len;
12367 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12368 if (tvb) {
12369 if (tvb_bytes_exist(tvb, offset, length)) {
12370 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12371 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12372 ssl_session->handshake_data.data_len += length;
12373 }
12374 } else {
12375 /* DTLS calculates the hash as if each handshake message had been
12376 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12377 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12378 */
12379 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12379, (int64_t)length, (int64_t)4))));
12380 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12381 memset(ssl_session->handshake_data.data + old_length, 0, length);
12382 ssl_session->handshake_data.data_len += length;
12383 }
12384}
12385
12386
12387/*
12388 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12389 *
12390 * Local variables:
12391 * c-basic-offset: 4
12392 * tab-width: 8
12393 * indent-tabs-mode: nil
12394 * End:
12395 *
12396 * vi: set shiftwidth=4 tabstop=8 expandtab:
12397 * :indentSize=4:tabSize=8:noTabs=true:
12398 */