Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 4107, column 17
Potential leak of memory pointed to by 'handshake_hashed_data.data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-10-27-101140-3661-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <[email protected]>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <[email protected]>
6 * Copyright (c) 2014, Peter Wu <[email protected]>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <[email protected]>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <[email protected]>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 { 0x0a0a, "GREASE" },
1539 { 0x1a1a, "GREASE" },
1540 { 0x2a2a, "GREASE" },
1541 { 0x3a3a, "GREASE" },
1542 { 0x4a4a, "GREASE" },
1543 { 0x5a5a, "GREASE" },
1544 { 0x6a6a, "GREASE" },
1545 { 0x7a7a, "GREASE" },
1546 { 0x8a8a, "GREASE" },
1547 { 0x9a9a, "GREASE" },
1548 { 0xaaaa, "GREASE" },
1549 { 0xbaba, "GREASE" },
1550 { 0xcaca, "GREASE" },
1551 { 0xdada, "GREASE" },
1552 { 0xeaea, "GREASE" },
1553 { 0xfafa, "GREASE" },
1554 /* PQC digital signature algorithms from OQS-OpenSSL,
1555 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1556 { 0xfea0, "dilithium2" },
1557 { 0xfea1, "p256_dilithium2" },
1558 { 0xfea2, "rsa3072_dilithium2" },
1559 { 0xfea3, "dilithium3" },
1560 { 0xfea4, "p384_dilithium3" },
1561 { 0xfea5, "dilithium5" },
1562 { 0xfea6, "p521_dilithium5" },
1563 { 0xfea7, "dilithium2_aes" },
1564 { 0xfea8, "p256_dilithium2_aes" },
1565 { 0xfea9, "rsa3072_dilithium2_aes" },
1566 { 0xfeaa, "dilithium3_aes" },
1567 { 0xfeab, "p384_dilithium3_aes" },
1568 { 0xfeac, "dilithium5_aes" },
1569 { 0xfead, "p521_dilithium5_aes" },
1570 { 0xfe0b, "falcon512" },
1571 { 0xfe0c, "p256_falcon512" },
1572 { 0xfe0d, "rsa3072_falcon512" },
1573 { 0xfe0e, "falcon1024" },
1574 { 0xfe0f, "p521_falcon1024" },
1575 { 0xfe96, "picnicl1full" },
1576 { 0xfe97, "p256_picnicl1full" },
1577 { 0xfe98, "rsa3072_picnicl1full" },
1578 { 0xfe1b, "picnic3l1" },
1579 { 0xfe1c, "p256_picnic3l1" },
1580 { 0xfe1d, "rsa3072_picnic3l1" },
1581 { 0xfe27, "rainbowIclassic" },
1582 { 0xfe28, "p256_rainbowIclassic" },
1583 { 0xfe29, "rsa3072_rainbowIclassic" },
1584 { 0xfe3c, "rainbowVclassic" },
1585 { 0xfe3d, "p521_rainbowVclassic" },
1586 { 0xfe42, "sphincsharaka128frobust" },
1587 { 0xfe43, "p256_sphincsharaka128frobust" },
1588 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1589 { 0xfe5e, "sphincssha256128frobust" },
1590 { 0xfe5f, "p256_sphincssha256128frobust" },
1591 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1592 { 0xfe7a, "sphincsshake256128frobust" },
1593 { 0xfe7b, "p256_sphincsshake256128frobust" },
1594 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1595 { 0, NULL((void*)0) }
1596};
1597
1598/* RFC 6091 3.1 */
1599const value_string tls_certificate_type[] = {
1600 { 0, "X.509" },
1601 { 1, "OpenPGP" },
1602 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1603 { 0, NULL((void*)0) }
1604};
1605
1606const value_string tls_cert_chain_type[] = {
1607 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1608 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1609 { 0, NULL((void*)0) }
1610};
1611
1612const value_string tls_cert_status_type[] = {
1613 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1614 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1615 { 0, NULL((void*)0) }
1616};
1617
1618/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1619 * Last-Modified Sat, 17 Oct 2026 14:08:00 GMT, 45 entries. */
1620static const bytes_string ct_logids[] = {
1621 { (const uint8_t[]){
1622 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1623 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1624 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1625 },
1626 32, "Google Argon2026h1" },
1627 { (const uint8_t[]){
1628 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1629 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1630 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1631 },
1632 32, "Google Argon2026h2" },
1633 { (const uint8_t[]){
1634 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1635 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1636 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1637 },
1638 32, "Google Argon2027h1" },
1639 { (const uint8_t[]){
1640 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1641 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1642 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1643 },
1644 32, "Google Xenon2026h1" },
1645 { (const uint8_t[]){
1646 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1647 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1648 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1649 },
1650 32, "Google Xenon2026h2" },
1651 { (const uint8_t[]){
1652 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1653 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1654 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1655 },
1656 32, "Google Xenon2027h1" },
1657 { (const uint8_t[]){
1658 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1659 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1660 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1661 },
1662 32, "Google Submariner" },
1663 { (const uint8_t[]){
1664 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1665 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1666 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1667 },
1668 32, "Google Daedalus" },
1669 { (const uint8_t[]){
1670 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1671 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1672 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1673 },
1674 32, "Google Testtube" },
1675 { (const uint8_t[]){
1676 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1677 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1678 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1679 },
1680 32, "Google Crucible" },
1681 { (const uint8_t[]){
1682 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1683 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1684 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1685 },
1686 32, "Google Solera2026h1" },
1687 { (const uint8_t[]){
1688 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1689 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1690 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1691 },
1692 32, "Google Solera2026h2" },
1693 { (const uint8_t[]){
1694 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1695 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1696 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1697 },
1698 32, "Google Solera2027h1" },
1699 { (const uint8_t[]){
1700 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1701 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1702 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1703 },
1704 32, "Cloudflare Nimbus2026" },
1705 { (const uint8_t[]){
1706 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1707 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1708 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1709 },
1710 32, "Cloudflare Nimbus2027" },
1711 { (const uint8_t[]){
1712 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1713 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1714 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1715 },
1716 32, "DigiCert Wyvern2026h1" },
1717 { (const uint8_t[]){
1718 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1719 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1720 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1721 },
1722 32, "DigiCert Wyvern2026h2" },
1723 { (const uint8_t[]){
1724 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1725 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1726 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1727 },
1728 32, "DigiCert Wyvern2027h1" },
1729 { (const uint8_t[]){
1730 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1731 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1732 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1733 },
1734 32, "DigiCert Wyvern2027h2" },
1735 { (const uint8_t[]){
1736 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1737 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1738 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1739 },
1740 32, "DigiCert Sphinx2026h1" },
1741 { (const uint8_t[]){
1742 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1743 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1744 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1745 },
1746 32, "DigiCert Sphinx2026h2" },
1747 { (const uint8_t[]){
1748 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1749 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1750 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1751 },
1752 32, "DigiCert Sphinx2027h1" },
1753 { (const uint8_t[]){
1754 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1755 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1756 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1757 },
1758 32, "DigiCert Sphinx2027h2" },
1759 { (const uint8_t[]){
1760 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1761 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1762 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1763 },
1764 32, "Sectigo Mammoth2026h1" },
1765 { (const uint8_t[]){
1766 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1767 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1768 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1769 },
1770 32, "Sectigo Mammoth2026h2" },
1771 { (const uint8_t[]){
1772 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1773 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1774 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1775 },
1776 32, "Sectigo Sabre2026h1" },
1777 { (const uint8_t[]){
1778 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1779 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1780 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1781 },
1782 32, "Sectigo Sabre2026h2" },
1783 { (const uint8_t[]){
1784 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1785 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1786 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1787 },
1788 32, "Sectigo Elephant2026h1" },
1789 { (const uint8_t[]){
1790 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1791 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1792 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1793 },
1794 32, "Sectigo Elephant2026h2" },
1795 { (const uint8_t[]){
1796 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1797 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1798 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1799 },
1800 32, "Sectigo Elephant2027h1" },
1801 { (const uint8_t[]){
1802 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1803 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1804 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1805 },
1806 32, "Sectigo Elephant2027h2" },
1807 { (const uint8_t[]){
1808 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1809 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1810 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1811 },
1812 32, "Sectigo Tiger2026h1" },
1813 { (const uint8_t[]){
1814 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1815 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1816 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1817 },
1818 32, "Sectigo Tiger2026h2" },
1819 { (const uint8_t[]){
1820 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1821 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1822 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1823 },
1824 32, "Sectigo Tiger2027h1" },
1825 { (const uint8_t[]){
1826 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1827 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1828 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1829 },
1830 32, "Sectigo Tiger2027h2" },
1831 { (const uint8_t[]){
1832 0x61, 0xa3, 0x5d, 0xc3, 0x98, 0x06, 0x1b, 0x2a, 0x59, 0x5b, 0xfe,
1833 0x34, 0x46, 0x89, 0x95, 0x18, 0xf0, 0xfe, 0xac, 0x14, 0xb0, 0x1b,
1834 0xe0, 0x2a, 0x93, 0xbf, 0x05, 0x21, 0x46, 0x3a, 0x9d, 0xbd,
1835 },
1836 32, "Sectigo Dumbo" },
1837 { (const uint8_t[]){
1838 0xbe, 0x31, 0xd3, 0x65, 0x88, 0xdf, 0xd8, 0x05, 0xc8, 0x6d, 0x35,
1839 0x20, 0x29, 0x84, 0xac, 0xc9, 0xaa, 0x44, 0xae, 0xe3, 0x84, 0x08,
1840 0x0b, 0x9f, 0xcf, 0x42, 0xeb, 0xc8, 0x73, 0x55, 0xe4, 0x9b,
1841 },
1842 32, "Sectigo Tigger2026" },
1843 { (const uint8_t[]){
1844 0xfa, 0x63, 0x12, 0x74, 0x9a, 0xdc, 0xc8, 0x19, 0x95, 0x4e, 0x3e,
1845 0xf3, 0x01, 0x1d, 0x42, 0x67, 0x76, 0x88, 0xd4, 0x47, 0x1c, 0xfe,
1846 0xf6, 0x35, 0x3f, 0x89, 0x1d, 0xc8, 0x7c, 0x12, 0xac, 0xd4,
1847 },
1848 32, "Sectigo Tigger2027" },
1849 { (const uint8_t[]){
1850 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1851 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1852 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1853 },
1854 32, "Let's Encrypt Oak2026h1" },
1855 { (const uint8_t[]){
1856 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1857 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1858 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1859 },
1860 32, "Let's Encrypt Oak2026h2" },
1861 { (const uint8_t[]){
1862 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1863 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1864 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1865 },
1866 32, "TrustAsia log2026a" },
1867 { (const uint8_t[]){
1868 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1869 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1870 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1871 },
1872 32, "TrustAsia log2026b" },
1873 { (const uint8_t[]){
1874 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1875 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1876 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1877 },
1878 32, "TrustAsia HETU2027" },
1879 { (const uint8_t[]){
1880 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1881 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1882 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1883 },
1884 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1885 { (const uint8_t[]){
1886 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1887 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1888 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1889 },
1890 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1891 { NULL((void*)0), 0, NULL((void*)0) }
1892};
1893
1894/*
1895 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1896 */
1897static dissector_table_t ssl_alpn_dissector_table;
1898static dissector_table_t dtls_alpn_dissector_table;
1899
1900/*
1901 * Special cases for prefix matching of the ALPN, if the ALPN includes
1902 * a version number for a draft or protocol revision.
1903 */
1904typedef struct ssl_alpn_prefix_match_protocol {
1905 const char *proto_prefix;
1906 const char *dissector_name;
1907} ssl_alpn_prefix_match_protocol_t;
1908
1909static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1910 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1911 * already exists 3.1 as of this writing... match the prefix. */
1912 { "spdy/", "spdy" },
1913 /* draft-ietf-httpbis-http2-16 */
1914 { "h2-", "http2" }, /* draft versions */
1915};
1916
1917const value_string compress_certificate_algorithm_vals[] = {
1918 { 1, "zlib" },
1919 { 2, "brotli" },
1920 { 3, "zstd" },
1921 { 0, NULL((void*)0) }
1922};
1923
1924
1925const val64_string quic_transport_parameter_id[] = {
1926 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1927 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1928 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1929 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1930 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1931 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1932 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1933 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1934 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1935 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1936 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1937 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1938 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1939 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1940 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1941 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1942 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1943 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1944 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1945 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1946 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1947 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1948 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1949 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1950 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1951 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1952 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1953 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1954 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1955 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1956 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1957 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1958 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1959 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1960 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1961 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1962 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1963 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1964 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1965 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1966 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1967 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1968 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1969 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1970 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1971 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1972 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1973 { 0, NULL((void*)0) }
1974};
1975
1976/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1977const val64_string quic_address_discovery_vals[] = {
1978 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1979 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1980 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1981 { 0, NULL((void*)0) }
1982};
1983
1984/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1985const val64_string quic_enable_time_stamp_v2_vals[] = {
1986 { 1, "I would like to receive TIME_STAMP frames" },
1987 { 2, "I am able to generate TIME_STAMP frames" },
1988 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1989 { 0, NULL((void*)0) }
1990};
1991
1992/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1993const val64_string quic_enable_multipath_vals[] = {
1994 { 0, "don't support multipath" },
1995 { 1, "support multipath as defined in this document" },
1996 { 0, NULL((void*)0) }
1997};
1998
1999/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2000const value_string tls_hello_ext_ech_clienthello_types[] = {
2001 { 0, "Outer Client Hello" },
2002 { 1, "Inner Client Hello" },
2003 { 0, NULL((void*)0) }
2004};
2005
2006/* RFC 9180 */
2007const value_string kem_id_type_vals[] = {
2008 { 0x0000, "Reserved" },
2009 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2010 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2011 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2012 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2013 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2014 { 0, NULL((void*)0) }
2015};
2016const value_string kdf_id_type_vals[] = {
2017 { 0x0000, "Reserved" },
2018 { 0x0001, "HKDF-SHA256" },
2019 { 0x0002, "HKDF-SHA384" },
2020 { 0x0003, "HKDF-SHA512" },
2021 { 0, NULL((void*)0) }
2022};
2023const value_string aead_id_type_vals[] = {
2024 { 0x0000, "Reserved" },
2025 { 0x0001, "AES-128-GCM" },
2026 { 0x0002, "AES-256-GCM" },
2027 { 0x0003, "ChaCha20Poly1305" },
2028 { 0xFFFF, "Export-only" },
2029 { 0, NULL((void*)0) }
2030};
2031
2032const value_string token_binding_key_parameter_vals[] = {
2033 { 0, "rsa2048_pkcs1.5" },
2034 { 1, "rsa2048_pss" },
2035 { 2, "ecdsap256" },
2036 { 0, NULL((void*)0) }
2037};
2038
2039/* Lookup tables }}} */
2040
2041void
2042quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2043{
2044 const char *label;
2045 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2046 label = "GREASE";
2047 } else {
2048 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2049 }
2050 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2051}
2052
2053/* we keep this internal to packet-tls-utils, as there should be
2054 no need to access it any other way.
2055
2056 This also allows us to hide the dependency on zlib.
2057*/
2058struct _SslDecompress {
2059 int compression;
2060#ifdef USE_ZLIB_OR_ZLIBNG
2061 zlib_stream istream;
2062#endif
2063};
2064
2065/* To assist in parsing client/server key exchange messages
2066 0 indicates unknown */
2067int ssl_get_keyex_alg(int cipher)
2068{
2069 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2070 switch(cipher) {
2071 case 0x0017:
2072 case 0x0018:
2073 case 0x0019:
2074 case 0x001a:
2075 case 0x001b:
2076 case 0x0034:
2077 case 0x003a:
2078 case 0x0046:
2079 case 0x006c:
2080 case 0x006d:
2081 case 0x0089:
2082 case 0x009b:
2083 case 0x00a6:
2084 case 0x00a7:
2085 case 0x00bf:
2086 case 0x00c5:
2087 case 0xc084:
2088 case 0xc085:
2089 return KEX_DH_ANON0x13;
2090 case 0x000b:
2091 case 0x000c:
2092 case 0x000d:
2093 case 0x0030:
2094 case 0x0036:
2095 case 0x003e:
2096 case 0x0042:
2097 case 0x0068:
2098 case 0x0085:
2099 case 0x0097:
2100 case 0x00a4:
2101 case 0x00a5:
2102 case 0x00bb:
2103 case 0x00c1:
2104 case 0xc082:
2105 case 0xc083:
2106 return KEX_DH_DSS0x14;
2107 case 0x000e:
2108 case 0x000f:
2109 case 0x0010:
2110 case 0x0031:
2111 case 0x0037:
2112 case 0x003f:
2113 case 0x0043:
2114 case 0x0069:
2115 case 0x0086:
2116 case 0x0098:
2117 case 0x00a0:
2118 case 0x00a1:
2119 case 0x00bc:
2120 case 0x00c2:
2121 case 0xc07e:
2122 case 0xc07f:
2123 return KEX_DH_RSA0x15;
2124 case 0x0011:
2125 case 0x0012:
2126 case 0x0013:
2127 case 0x0032:
2128 case 0x0038:
2129 case 0x0040:
2130 case 0x0044:
2131 case 0x0063:
2132 case 0x0065:
2133 case 0x0066:
2134 case 0x006a:
2135 case 0x0087:
2136 case 0x0099:
2137 case 0x00a2:
2138 case 0x00a3:
2139 case 0x00bd:
2140 case 0x00c3:
2141 case 0xc080:
2142 case 0xc081:
2143 return KEX_DHE_DSS0x10;
2144 case 0x002d:
2145 case 0x008e:
2146 case 0x008f:
2147 case 0x0090:
2148 case 0x0091:
2149 case 0x00aa:
2150 case 0x00ab:
2151 case 0x00b2:
2152 case 0x00b3:
2153 case 0x00b4:
2154 case 0x00b5:
2155 case 0xc090:
2156 case 0xc091:
2157 case 0xc096:
2158 case 0xc097:
2159 case 0xc0a6:
2160 case 0xc0a7:
2161 case 0xc0aa:
2162 case 0xc0ab:
2163 case 0xccad:
2164 case 0xe41c:
2165 case 0xe41d:
2166 return KEX_DHE_PSK0x11;
2167 case 0x0014:
2168 case 0x0015:
2169 case 0x0016:
2170 case 0x0033:
2171 case 0x0039:
2172 case 0x0045:
2173 case 0x0067:
2174 case 0x006b:
2175 case 0x0088:
2176 case 0x009a:
2177 case 0x009e:
2178 case 0x009f:
2179 case 0x00be:
2180 case 0x00c4:
2181 case 0xc07c:
2182 case 0xc07d:
2183 case 0xc09e:
2184 case 0xc09f:
2185 case 0xc0a2:
2186 case 0xc0a3:
2187 case 0xccaa:
2188 case 0xe41e:
2189 case 0xe41f:
2190 return KEX_DHE_RSA0x12;
2191 case 0xc015:
2192 case 0xc016:
2193 case 0xc017:
2194 case 0xc018:
2195 case 0xc019:
2196 return KEX_ECDH_ANON0x19;
2197 case 0xc001:
2198 case 0xc002:
2199 case 0xc003:
2200 case 0xc004:
2201 case 0xc005:
2202 case 0xc025:
2203 case 0xc026:
2204 case 0xc02d:
2205 case 0xc02e:
2206 case 0xc074:
2207 case 0xc075:
2208 case 0xc088:
2209 case 0xc089:
2210 return KEX_ECDH_ECDSA0x1a;
2211 case 0xc00b:
2212 case 0xc00c:
2213 case 0xc00d:
2214 case 0xc00e:
2215 case 0xc00f:
2216 case 0xc029:
2217 case 0xc02a:
2218 case 0xc031:
2219 case 0xc032:
2220 case 0xc078:
2221 case 0xc079:
2222 case 0xc08c:
2223 case 0xc08d:
2224 return KEX_ECDH_RSA0x1b;
2225 case 0xc006:
2226 case 0xc007:
2227 case 0xc008:
2228 case 0xc009:
2229 case 0xc00a:
2230 case 0xc023:
2231 case 0xc024:
2232 case 0xc02b:
2233 case 0xc02c:
2234 case 0xc072:
2235 case 0xc073:
2236 case 0xc086:
2237 case 0xc087:
2238 case 0xc0ac:
2239 case 0xc0ad:
2240 case 0xc0ae:
2241 case 0xc0af:
2242 case 0xcca9:
2243 case 0xe414:
2244 case 0xe415:
2245 return KEX_ECDHE_ECDSA0x16;
2246 case 0xc033:
2247 case 0xc034:
2248 case 0xc035:
2249 case 0xc036:
2250 case 0xc037:
2251 case 0xc038:
2252 case 0xc039:
2253 case 0xc03a:
2254 case 0xc03b:
2255 case 0xc09a:
2256 case 0xc09b:
2257 case 0xccac:
2258 case 0xe418:
2259 case 0xe419:
2260 case 0xd001:
2261 case 0xd002:
2262 case 0xd003:
2263 case 0xd005:
2264 return KEX_ECDHE_PSK0x17;
2265 case 0xc010:
2266 case 0xc011:
2267 case 0xc012:
2268 case 0xc013:
2269 case 0xc014:
2270 case 0xc027:
2271 case 0xc028:
2272 case 0xc02f:
2273 case 0xc030:
2274 case 0xc076:
2275 case 0xc077:
2276 case 0xc08a:
2277 case 0xc08b:
2278 case 0xcca8:
2279 case 0xe412:
2280 case 0xe413:
2281 return KEX_ECDHE_RSA0x18;
2282 case 0x001e:
2283 case 0x001f:
2284 case 0x0020:
2285 case 0x0021:
2286 case 0x0022:
2287 case 0x0023:
2288 case 0x0024:
2289 case 0x0025:
2290 case 0x0026:
2291 case 0x0027:
2292 case 0x0028:
2293 case 0x0029:
2294 case 0x002a:
2295 case 0x002b:
2296 return KEX_KRB50x1c;
2297 case 0x002c:
2298 case 0x008a:
2299 case 0x008b:
2300 case 0x008c:
2301 case 0x008d:
2302 case 0x00a8:
2303 case 0x00a9:
2304 case 0x00ae:
2305 case 0x00af:
2306 case 0x00b0:
2307 case 0x00b1:
2308 case 0xc064:
2309 case 0xc065:
2310 case 0xc08e:
2311 case 0xc08f:
2312 case 0xc094:
2313 case 0xc095:
2314 case 0xc0a4:
2315 case 0xc0a5:
2316 case 0xc0a8:
2317 case 0xc0a9:
2318 case 0xccab:
2319 case 0xe416:
2320 case 0xe417:
2321 return KEX_PSK0x1d;
2322 case 0x0001:
2323 case 0x0002:
2324 case 0x0003:
2325 case 0x0004:
2326 case 0x0005:
2327 case 0x0006:
2328 case 0x0007:
2329 case 0x0008:
2330 case 0x0009:
2331 case 0x000a:
2332 case 0x002f:
2333 case 0x0035:
2334 case 0x003b:
2335 case 0x003c:
2336 case 0x003d:
2337 case 0x0041:
2338 case 0x0060:
2339 case 0x0061:
2340 case 0x0062:
2341 case 0x0064:
2342 case 0x0084:
2343 case 0x0096:
2344 case 0x009c:
2345 case 0x009d:
2346 case 0x00ba:
2347 case 0x00c0:
2348 case 0xc07a:
2349 case 0xc07b:
2350 case 0xc09c:
2351 case 0xc09d:
2352 case 0xc0a0:
2353 case 0xc0a1:
2354 case 0xe410:
2355 case 0xe411:
2356 case 0xfefe:
2357 case 0xfeff:
2358 case 0xffe0:
2359 case 0xffe1:
2360 return KEX_RSA0x1e;
2361 case 0x002e:
2362 case 0x0092:
2363 case 0x0093:
2364 case 0x0094:
2365 case 0x0095:
2366 case 0x00ac:
2367 case 0x00ad:
2368 case 0x00b6:
2369 case 0x00b7:
2370 case 0x00b8:
2371 case 0x00b9:
2372 case 0xc092:
2373 case 0xc093:
2374 case 0xc098:
2375 case 0xc099:
2376 case 0xccae:
2377 case 0xe41a:
2378 case 0xe41b:
2379 return KEX_RSA_PSK0x1f;
2380 case 0xc01a:
2381 case 0xc01d:
2382 case 0xc020:
2383 return KEX_SRP_SHA0x20;
2384 case 0xc01c:
2385 case 0xc01f:
2386 case 0xc022:
2387 return KEX_SRP_SHA_DSS0x21;
2388 case 0xc01b:
2389 case 0xc01e:
2390 case 0xc021:
2391 return KEX_SRP_SHA_RSA0x22;
2392 case 0xc0ff:
2393 return KEX_ECJPAKE0x24;
2394 case 0xe003:
2395 case 0xe013:
2396 case 0xe053:
2397 return KEX_ECC_SM20x26;
2398 default:
2399 break;
2400 }
2401
2402 return 0;
2403 /* }}} */
2404}
2405
2406static wmem_list_t *connection_id_session_list;
2407
2408void
2409ssl_init_cid_list(void) {
2410 connection_id_session_list = wmem_list_new(wmem_file_scope());
2411}
2412
2413void
2414ssl_cleanup_cid_list(void) {
2415 wmem_destroy_list(connection_id_session_list);
2416}
2417
2418void
2419ssl_add_session_by_cid(SslDecryptSession *session)
2420{
2421 wmem_list_append(connection_id_session_list, session);
2422}
2423
2424SslDecryptSession *
2425ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2426{
2427 SslDecryptSession * ssl_cid = NULL((void*)0);
2428 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2429
2430 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2431 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2432 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2432, "ssl != ((void*)0)"))));
2433 SslSession *session = &ssl->session;
2434
2435 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2436 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2437 ssl_cid = ssl;
2438 }
2439 }
2440
2441 if (session->server_cid_len > 0) {
2442 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2443 ssl_cid = ssl;
2444 }
2445 }
2446
2447 it = wmem_list_frame_next(it);
2448 }
2449
2450 return ssl_cid;
2451}
2452
2453/* StringInfo structure (len + data) functions {{{ */
2454
2455int
2456ssl_data_alloc(StringInfo* str, size_t len)
2457{
2458 str->data = (unsigned char *)g_malloc(len);
16
←
Memory is allocated
→
2459 /* the allocator can return a null pointer for a size equal to 0,
2460 * and that must be allowed */
2461 if (len
16.1
'len' is > 0
 > 0 && !str->data)
17
←
Assuming field 'data' is non-null
→
18
←
Taking false branch
→
2462 return -1;
2463 str->data_len = (unsigned) len;
2464 return 0;
2465}
2466
2467void
2468ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2469{
2470 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2470, "data"))));
2471 memcpy(str->data, data, len);
2472 str->data_len = len;
2473}
2474
2475static int
2476ssl_data_realloc(StringInfo* str, unsigned len)
2477{
2478 str->data = (unsigned char *)g_realloc(str->data, len);
2479 if (!str->data)
2480 return -1;
2481 str->data_len = len;
2482 return 0;
2483}
2484
2485static StringInfo *
2486ssl_data_clone(StringInfo *str)
2487{
2488 StringInfo *cloned_str;
2489 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2490 sizeof(StringInfo) + str->data_len);
2491 cloned_str->data = (unsigned char *) (cloned_str + 1);
2492 ssl_data_set(cloned_str, str->data, str->data_len);
2493 return cloned_str;
2494}
2495
2496static int
2497ssl_data_copy(StringInfo* dst, StringInfo* src)
2498{
2499 if (dst->data_len < src->data_len) {
2500 if (ssl_data_realloc(dst, src->data_len))
2501 return -1;
2502 }
2503 memcpy(dst->data, src->data, src->data_len);
2504 dst->data_len = src->data_len;
2505 return 0;
2506}
2507
2508/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2509 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2510 * success. */
2511static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2512 size_t i;
2513
2514 if (hex_len & 1)
2515 return false0;
2516
2517 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2518 for (i = 0; i < hex_len / 2; i++) {
2519 int a = ws_xton(in[i*2]);
2520 int b = ws_xton(in[i*2 + 1]);
2521 if (a == -1 || b == -1)
2522 return false0;
2523 out->data[i] = a << 4 | b;
2524 }
2525 out->data_len = (unsigned)hex_len / 2;
2526 return true1;
2527}
2528/* StringInfo structure (len + data) functions }}} */
2529
2530
2531/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2532/* hmac abstraction layer */
2533#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2534
2535static inline int
2536ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2537{
2538 gcry_error_t err;
2539 const char *err_str, *err_src;
2540
2541 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2542 if (err != 0) {
2543 err_str = gcry_strerror(err);
2544 err_src = gcry_strsource(err);
2545 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2546 return -1;
2547 }
2548 return 0;
2549}
2550
2551static inline int
2552ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2553{
2554 gcry_error_t err;
2555 const char *err_str, *err_src;
2556
2557 err = gcry_md_setkey (*(md), key, len);
2558 if (err != 0) {
2559 err_str = gcry_strerror(err);
2560 err_src = gcry_strsource(err);
2561 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2562 return -1;
2563 }
2564 return 0;
2565}
2566
2567static inline int
2568ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2569{
2570 gcry_md_reset(*md);
2571 return 0;
2572}
2573
2574static inline void
2575ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2576{
2577 gcry_md_write(*(md), data, len);
2578}
2579static inline void
2580ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2581{
2582 int algo;
2583 unsigned len;
2584
2585 algo = gcry_md_get_algo (*(md));
2586 len = gcry_md_get_algo_dlen(algo);
2587 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2587, "len <= *datalen"))));
2588 memcpy(data, gcry_md_read(*(md), algo), len);
2589 *datalen = len;
2590}
2591static inline void
2592ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2593{
2594 gcry_md_close(*(md));
2595}
2596
2597/* message digest abstraction layer*/
2598#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2599
2600static inline int
2601ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2602{
2603 gcry_error_t err;
2604 const char *err_str, *err_src;
2605 err = gcry_md_open(md,algo, 0);
2606 if (err != 0) {
2607 err_str = gcry_strerror(err);
2608 err_src = gcry_strsource(err);
2609 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2610 return -1;
2611 }
2612 return 0;
2613}
2614static inline void
2615ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2616{
2617 gcry_md_write(*(md), data, len);
2618}
2619static inline void
2620ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2621{
2622 int algo;
2623 int len;
2624 algo = gcry_md_get_algo (*(md));
2625 len = gcry_md_get_algo_dlen (algo);
2626 memcpy(data, gcry_md_read(*(md), algo), len);
2627 *datalen = len;
2628}
2629static inline void
2630ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2631{
2632 gcry_md_close(*(md));
2633}
2634
2635static inline void
2636ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2637{
2638 gcry_md_reset(*md);
2639}
2640
2641/* md5 /sha abstraction layer */
2642#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2643#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2644
2645static inline int
2646ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2647{
2648 gcry_error_t err;
2649 const char *err_str, *err_src;
2650 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2651 if (err != 0) {
2652 err_str = gcry_strerror(err);
2653 err_src = gcry_strsource(err);
2654 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2655 return -1;
2656 }
2657 return 0;
2658}
2659static inline void
2660ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2661{
2662 gcry_md_write(*(md), data, len);
2663}
2664static inline void
2665ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2666{
2667 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2668 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2669}
2670
2671static inline void
2672ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2673{
2674 gcry_md_reset(*md);
2675}
2676
2677static inline void
2678ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2679{
2680 gcry_md_close(*(md));
2681}
2682
2683static inline int
2684ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2685{
2686 gcry_error_t err;
2687 const char *err_str, *err_src;
2688 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2689 if (err != 0) {
2690 err_str = gcry_strerror(err);
2691 err_src = gcry_strsource(err);
2692 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2693 return -1;
2694 }
2695 return 0;
2696}
2697static inline void
2698ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2699{
2700 gcry_md_write(*(md), data, len);
2701}
2702static inline void
2703ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2704{
2705 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2706 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2707}
2708
2709static inline void
2710ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2711{
2712 gcry_md_reset(*md);
2713}
2714
2715static inline void
2716ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2717{
2718 gcry_md_close(*(md));
2719}
2720/* libgcrypt wrappers for HMAC/message digest operations }}} */
2721
2722/* libgcrypt wrappers for Cipher state manipulation {{{ */
2723int
2724ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2725{
2726 int ret;
2727#if 0
2728 unsigned char *ivp;
2729 int i;
2730 gcry_cipher_hd_t c;
2731 c=(gcry_cipher_hd_t)*cipher;
2732#endif
2733 ssl_debug_printf("--------------------------------------------------------------------");
2734#if 0
2735 for(ivp=c->iv,i=0; i < iv_len; i++ )
2736 {
2737 ssl_debug_printf("%d ",ivp[i]);
2738 i++;
2739 }
2740#endif
2741 ssl_debug_printf("--------------------------------------------------------------------");
2742 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2743#if 0
2744 for(ivp=c->iv,i=0; i < iv_len; i++ )
2745 {
2746 ssl_debug_printf("%d ",ivp[i]);
2747 i++;
2748 }
2749#endif
2750 ssl_debug_printf("--------------------------------------------------------------------");
2751 return ret;
2752}
2753/* stream cipher abstraction layer*/
2754static int
2755ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2756 unsigned char* iv, int mode)
2757{
2758 int gcry_modes[] = {
2759 GCRY_CIPHER_MODE_STREAM,
2760 GCRY_CIPHER_MODE_CBC,
2761 GCRY_CIPHER_MODE_GCM,
2762 GCRY_CIPHER_MODE_CCM,
2763 GCRY_CIPHER_MODE_CCM,
2764 GCRY_CIPHER_MODE_POLY1305,
2765 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2766 };
2767 int err;
2768 if (algo == -1) {
2769 /* NULL mode */
2770 *(cipher) = (gcry_cipher_hd_t)-1;
2771 return 0;
2772 }
2773 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2774 if (err !=0)
2775 return -1;
2776 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2777 if (err != 0)
2778 return -1;
2779 /* AEAD cipher suites will set the nonce later. */
2780 if (mode == MODE_CBC) {
2781 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2782 if (err != 0)
2783 return -1;
2784 }
2785 return 0;
2786}
2787static inline int
2788ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2789 const unsigned char * in, int inl)
2790{
2791 if ((*cipher) == (gcry_cipher_hd_t)-1)
2792 {
2793 if (in && inl)
2794 memcpy(out, in, outl < inl ? outl : inl);
2795 return 0;
2796 }
2797 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2798}
2799static inline int
2800ssl_get_digest_by_name(const char*name)
2801{
2802 return gcry_md_map_name(name);
2803}
2804static inline int
2805ssl_get_cipher_by_name(const char* name)
2806{
2807 return gcry_cipher_map_name(name);
2808}
2809
2810static inline void
2811ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2812{
2813 if ((*cipher) != (gcry_cipher_hd_t)-1)
2814 gcry_cipher_close(*cipher);
2815 *cipher = NULL((void*)0);
2816}
2817/* }}} */
2818
2819/* Digests, Ciphers and Cipher Suites registry {{{ */
2820static const SslDigestAlgo digests[]={
2821 {"MD5", 16},
2822 {"SHA1", 20},
2823 {"SHA256", 32},
2824 {"SHA384", 48},
2825 {"SM3", 32},
2826 {"Not Applicable", 0},
2827};
2828
2829#define DIGEST_MAX_SIZE48 48
2830
2831/* get index digest index */
2832static const SslDigestAlgo *
2833ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2834 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2835 return &digests[DIG_NA0x45 - DIG_MD50x40];
2836 }
2837 return &digests[cs->dig - DIG_MD50x40];
2838}
2839
2840static const char *ciphers[]={
2841 "DES",
2842 "3DES",
2843 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2844 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2845 "IDEA",
2846 "AES",
2847 "AES256",
2848 "CAMELLIA128",
2849 "CAMELLIA256",
2850 "SEED",
2851 "CHACHA20", /* since Libgcrypt 1.7.0 */
2852 "SM1",
2853 "SM4",
2854 "*UNKNOWN*"
2855};
2856
2857static const SslCipherSuite cipher_suites[]={
2858 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2859 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2860 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2861 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2862 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2863 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2864 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2865 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2866 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2867 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2868 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2869 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2870 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2871 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2872 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2873 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2874 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2875 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2876 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2877 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2878 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2879 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2880 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2881 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2882 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2883 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2884 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2885 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2886 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2887 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2888 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2889 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2890 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2891 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2892 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2893 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2894 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2895 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2896 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2897 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2898 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2899 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2900 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2901 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2902 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2903 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2904 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2905 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2906 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2907 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2908 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2909 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2910 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2911 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2912 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2913 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2914 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2915 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2916 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2917 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2918 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2919 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2920 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2921 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2922 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2923 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2924 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2925 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2926 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2927 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2928 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2929 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2930 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2931 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2932 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2933 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2934 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2935 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2936 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2937 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2938 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2939 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2940 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2941 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2942 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2943 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2944 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2945 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2946 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2947 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2948 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2949 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2950 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2951 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2952 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2953 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2954 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2955 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2956 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2957 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2958 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2959 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2960 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2961 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2962 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2963 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2964 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2965 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2966 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2967 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2968 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2969 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2970 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2971 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2972 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2973 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2974 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2975 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2976 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2977 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2978 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2979 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2980 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2981 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2982 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2983 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2984 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2985 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2986 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2987 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2988 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2989 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2990 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2991 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2992
2993 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2994 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2995 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
2996 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
2997 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
2998 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
2999 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3000
3001 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3002 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3003 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3004 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3005 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3006 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3007 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3008 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3009 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3010 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3011 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3012 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3013 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3014 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3015 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3016 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3017 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3018 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3019 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3020 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3021 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3022 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3023 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3024 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3025 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3026 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3027 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3028 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3029 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3030 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3031 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3032 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3033 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3034 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3035 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3036 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3037 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3038 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3039 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3040 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3041 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3042 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3043 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3044 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3045 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3046 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3047 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3048 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3049 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3050 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3051 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3052 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3053 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3054 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3055 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3056 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3057 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3058 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3059 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3060 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3061 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3062 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3063 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3064 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3065 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3066 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3067 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3068 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3069 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3070 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3071 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3072 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3073 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3074 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3075 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3076 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3077 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3078 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3079 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3080 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3081 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3082 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3083 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3084 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3085 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3086 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3087 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3088 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3089 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3090 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3091 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3092 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3093 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3094 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3095 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3096 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3097 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3098 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3099 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3100 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3101 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3102 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3103 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3104 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3105 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3106 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3107 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3108 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3109 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3110 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3111 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3112 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3113 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3114 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3115 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3116 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3117 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3118 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3119 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3120 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3121 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3122 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3123 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3124 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3125 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3126 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3127 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3128 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3129 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3130 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3131 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3132 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3133 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3134 /* GM */
3135 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3136 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3137 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3138 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3139 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3140 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3141 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3142 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3143 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3144 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3145 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3146 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3147 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3148 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3149 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3150 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3151 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3152 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3153 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3154 {-1, 0, 0, 0, MODE_STREAM}
3155};
3156
3157#define MAX_BLOCK_SIZE16 16
3158#define MAX_KEY_SIZE32 32
3159
3160const SslCipherSuite *
3161ssl_find_cipher(int num)
3162{
3163 const SslCipherSuite *c;
3164 for(c=cipher_suites;c->number!=-1;c++){
3165 if(c->number==num){
3166 return c;
3167 }
3168 }
3169
3170 return NULL((void*)0);
3171}
3172
3173int
3174ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3175{
3176 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3177}
3178
3179unsigned
3180ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3181{
3182 int cipher_algo;
3183 if (cipher_suite->mode != MODE_CBC) return 0;
3184 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3185 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3186}
3187
3188static unsigned
3189ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3190{
3191 switch (cipher_suite_num) {
3192 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3193 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3194 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3195 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3196 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3197 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3198 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3199 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3200 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3201 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3202 return 5;
3203
3204 /* not defined in below draft, but "implemented by several vendors",
3205 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3206 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3207 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3208 return 7;
3209
3210 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3211 * used 7. Until a pcap proves 8, let's use the old value. Link:
3212 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3213 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3214 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3215 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3216 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3217 return 7;
3218
3219 default:
3220 return 0;
3221 }
3222}
3223
3224/* Digests, Ciphers and Cipher Suites registry }}} */
3225
3226
3227/* HMAC and the Pseudorandom function {{{ */
3228static int
3229tls_hash(StringInfo *secret, StringInfo *seed, int md,
3230 StringInfo *out, unsigned out_len)
3231{
3232 /* RFC 2246 5. HMAC and the pseudorandom function
3233 * '+' denotes concatenation.
3234 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3235 * HMAC_hash(secret, A(2) + seed) + ...
3236 * A(0) = seed
3237 * A(i) = HMAC_hash(secret, A(i - 1))
3238 */
3239 uint8_t *ptr;
3240 unsigned left, tocpy;
3241 uint8_t *A;
3242 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3243 unsigned A_l, tmp_l;
3244 SSL_HMACgcry_md_hd_t hm;
3245
3246 ptr = out->data;
3247 left = out_len;
3248
3249 ssl_print_string("tls_hash: hash secret", secret);
3250 ssl_print_string("tls_hash: hash seed", seed);
3251 /* A(0) = seed */
3252 A = seed->data;
3253 A_l = seed->data_len;
3254
3255 if (ssl_hmac_init(&hm, md) != 0) {
3256 return -1;
3257 }
3258 while (left) {
3259 /* A(i) = HMAC_hash(secret, A(i-1)) */
3260 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3261 ssl_hmac_update(&hm, A, A_l);
3262 A_l = sizeof(_A); /* upper bound len for hash output */
3263 ssl_hmac_final(&hm, _A, &A_l);
3264 A = _A;
3265
3266 /* HMAC_hash(secret, A(i) + seed) */
3267 ssl_hmac_reset(&hm);
3268 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3269 ssl_hmac_update(&hm, A, A_l);
3270 ssl_hmac_update(&hm, seed->data, seed->data_len);
3271 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3272 ssl_hmac_final(&hm, tmp, &tmp_l);
3273 ssl_hmac_reset(&hm);
3274
3275 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3276 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3277 memcpy(ptr, tmp, tocpy);
3278 ptr += tocpy;
3279 left -= tocpy;
3280 }
3281 ssl_hmac_cleanup(&hm);
3282 out->data_len = out_len;
3283
3284 ssl_print_string("hash out", out);
3285 return 0;
3286}
3287
3288static bool_Bool
3289tls_prf(StringInfo* secret, const char *usage,
3290 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3291{
3292 StringInfo seed, sha_out, md5_out;
3293 uint8_t *ptr;
3294 StringInfo s1, s2;
3295 unsigned i,s_l;
3296 size_t usage_len, rnd2_len;
3297 bool_Bool success = false0;
3298 usage_len = strlen(usage);
3299 rnd2_len = rnd2 ? rnd2->data_len : 0;
3300
3301 /* initialize buffer for sha, md5 random seed*/
3302 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3303 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3304 return false0;
3305 }
3306 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3307 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3308 goto free_sha;
3309 }
3310 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3311 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3312 (int) (usage_len+rnd1->data_len+rnd2_len));
3313 goto free_md5;
3314 }
3315
3316 ptr=seed.data;
3317 memcpy(ptr,usage,usage_len);
3318 ptr+=usage_len;
3319 memcpy(ptr,rnd1->data,rnd1->data_len);
3320 if (rnd2_len > 0) {
3321 ptr+=rnd1->data_len;
3322 memcpy(ptr,rnd2->data,rnd2->data_len);
3323 /*ptr+=rnd2->data_len;*/
3324 }
3325
3326 /* initialize buffer for client/server seeds*/
3327 s_l=secret->data_len/2 + secret->data_len%2;
3328 if (ssl_data_alloc(&s1, s_l) < 0) {
3329 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3330 goto free_seed;
3331 }
3332 if (ssl_data_alloc(&s2, s_l) < 0) {
3333 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3334 goto free_s1;
3335 }
3336
3337 memcpy(s1.data,secret->data,s_l);
3338 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3339
3340 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3341 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3342 goto free_s2;
3343 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3344 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3345 goto free_s2;
3346
3347 for (i = 0; i < out_len; i++)
3348 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3349 /* success, now store the new meaningful data length */
3350 out->data_len = out_len;
3351 success = true1;
3352
3353 ssl_print_string("PRF out",out);
3354free_s2:
3355 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3356free_s1:
3357 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3358free_seed:
3359 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3360free_md5:
3361 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3362free_sha:
3363 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3364 return success;
3365}
3366
3367static bool_Bool
3368tls12_prf(int md, StringInfo* secret, const char* usage,
3369 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3370{
3371 StringInfo label_seed;
3372 int success;
3373 size_t usage_len, rnd2_len;
3374 rnd2_len = rnd2 ? rnd2->data_len : 0;
3375
3376 usage_len = strlen(usage);
3377 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3378 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3379 return false0;
3380 }
3381 memcpy(label_seed.data, usage, usage_len);
3382 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3383 if (rnd2_len > 0)
3384 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3385
3386 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3387 success = tls_hash(secret, &label_seed, md, out, out_len);
3388 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3389 if(success != -1){
3390 ssl_print_string("PRF out", out);
3391 return true1;
3392 }
3393 return false0;
3394}
3395
3396static bool_Bool
3397ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3398 StringInfo *out, unsigned out_len)
3399{
3400 SSL_MD5_CTXgcry_md_hd_t md5;
3401 uint8_t tmp[16];
3402
3403 if (ssl_md5_init(&md5) != 0) {
3404 return false0;
3405 }
3406 ssl_md5_update(&md5,r1->data,r1->data_len);
3407 ssl_md5_update(&md5,r2->data,r2->data_len);
3408 ssl_md5_final(tmp,&md5);
3409 ssl_md5_cleanup(&md5);
3410
3411 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3411, "out_len <= sizeof(tmp)"))));
3412 ssl_data_set(out, tmp, out_len);
3413 ssl_print_string("export iv", out);
3414 return true1;
3415}
3416
3417static bool_Bool
3418ssl3_prf(StringInfo* secret, const char* usage,
3419 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3420{
3421 SSL_MD5_CTXgcry_md_hd_t md5;
3422 SSL_SHA_CTXgcry_md_hd_t sha;
3423 unsigned off;
3424 int i = 0,j;
3425 uint8_t buf[20];
3426
3427 if (ssl_sha_init(&sha) != 0) {
3428 return false0;
3429 }
3430 if (ssl_md5_init(&md5) != 0) {
3431 ssl_sha_cleanup(&sha);
3432 return false0;
3433 }
3434 for (off = 0; off < out_len; off += 16) {
3435 unsigned char outbuf[16];
3436 i++;
3437
3438 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3439 /* A, BB, CCC, ... */
3440 for(j=0;j<i;j++){
3441 buf[j]=64+i;
3442 }
3443
3444 ssl_sha_update(&sha,buf,i);
3445 ssl_sha_update(&sha,secret->data,secret->data_len);
3446
3447 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3448 if (rnd2)
3449 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3450 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3451 }
3452 else{
3453 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3454 if (rnd2)
3455 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3456 }
3457
3458 ssl_sha_final(buf,&sha);
3459 ssl_sha_reset(&sha);
3460
3461 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3462 secret->data_len);
3463 ssl_md5_update(&md5,secret->data,secret->data_len);
3464 ssl_md5_update(&md5,buf,20);
3465 ssl_md5_final(outbuf,&md5);
3466 ssl_md5_reset(&md5);
3467
3468 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3469 }
3470 ssl_sha_cleanup(&sha);
3471 ssl_md5_cleanup(&md5);
3472 out->data_len = out_len;
3473
3474 return true1;
3475}
3476
3477/* out_len is the wanted output length for the pseudorandom function.
3478 * Ensure that ssl->cipher_suite is set. */
3479static bool_Bool
3480prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3481 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3482{
3483 switch (ssl->session.version) {
3484 case SSLV3_VERSION0x300:
3485 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3486
3487 case TLSV1_VERSION0x301:
3488 case TLSV1DOT1_VERSION0x302:
3489 case DTLSV1DOT0_VERSION0xfeff:
3490 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3491 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3492
3493 default: /* TLSv1.2 */
3494 switch (ssl->cipher_suite->dig) {
3495 case DIG_SM30x44:
3496#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3497 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3498 out, out_len);
3499#else
3500 return false0;
3501#endif
3502 case DIG_SHA3840x43:
3503 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3504 out, out_len);
3505 default:
3506 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3507 out, out_len);
3508 }
3509 }
3510}
3511
3512static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3513{
3514 SSL_MD5_CTXgcry_md_hd_t md5;
3515 SSL_SHA_CTXgcry_md_hd_t sha;
3516
3517 if (ssl_data_alloc(out, 36) < 0)
15
←
Calling 'ssl_data_alloc'
→
19
←
Returned allocated memory
→
20
←
Taking false branch
→
3518 return -1;
3519
3520 if (ssl_md5_init(&md5) != 0)
21
←
Taking true branch
→
3521 return -1;
3522 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
3523 ssl_md5_final(out->data,&md5);
3524 ssl_md5_cleanup(&md5);
3525
3526 if (ssl_sha_init(&sha) != 0)
3527 return -1;
3528 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
3529 ssl_sha_final(out->data+16,&sha);
3530 ssl_sha_cleanup(&sha);
3531 return 0;
3532}
3533
3534static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3535{
3536 SSL_MDgcry_md_hd_t mc;
3537 uint8_t tmp[48];
3538 unsigned len;
3539
3540 if (ssl_md_init(&mc, md) != 0)
3541 return -1;
3542 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
3543 ssl_md_final(&mc, tmp, &len);
3544 ssl_md_cleanup(&mc);
3545
3546 if (ssl_data_alloc(out, len) < 0)
3547 return -1;
3548 memcpy(out->data, tmp, len);
3549 return 0;
3550}
3551
3552bool_Bool
3553tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3554{
3555 if (!tls_psk || (tls_psk[0] == 0)) {
3556 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3557 return false0;
3558 }
3559
3560 wmem_free(wmem_file_scope(), tls_session->psk.data);
3561 /* convert hex string into char*/
3562 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3563 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3564 G_STRFUNC((const char*) (__func__)));
3565 return false0;
3566 }
3567
3568 if (tls_session->psk.data_len >= (2 << 15)) {
3569 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3570 G_STRFUNC((const char*) (__func__)));
3571 wmem_free(wmem_file_scope(), tls_session->psk.data);
3572 tls_session->psk.data = NULL((void*)0);
3573 tls_session->psk.data_len = 0;
3574 return false0;
3575 }
3576
3577 return true1;
3578}
3579
3580/**
3581 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3582 * inlined and removed once support for draft 19 and before is dropped.
3583 */
3584static inline const char *
3585tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3586{
3587 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3588 return "TLS 1.3, ";
3589 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3590 return "dtls13";
3591 } else {
3592 return "tls13 ";
3593 }
3594}
3595
3596/*
3597 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3598 * custom label prefix. If "context_hash" is NULL, then an empty context is
3599 * used. Otherwise it must have the same length as the hash algorithm output.
3600 */
3601bool_Bool
3602tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3603 const char *label_prefix, const char *label,
3604 const uint8_t *context_hash, uint8_t context_length,
3605 uint16_t out_len, unsigned char **out)
3606{
3607 /* RFC 8446 Section 7.1:
3608 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3609 * HKDF-Expand(Secret, HkdfLabel, Length)
3610 * struct {
3611 * uint16 length = Length;
3612 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3613 * opaque context<0..255> = Context;
3614 * } HkdfLabel;
3615 *
3616 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3617 * HKDF-Expand(PRK, info, L) -> OKM
3618 */
3619 gcry_error_t err;
3620 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3621 const unsigned label_length = (unsigned) strlen(label);
3622
3623 /* Some sanity checks */
3624 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3624, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3625
3626 /* info = HkdfLabel { length, label, context } */
3627 GByteArray *info = g_byte_array_new();
3628 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3629 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3630
3631 const uint8_t label_vector_length = label_prefix_length + label_length;
3632 g_byte_array_append(info, &label_vector_length, 1);
3633 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3634 g_byte_array_append(info, (const uint8_t*)label, label_length);
3635
3636 g_byte_array_append(info, &context_length, 1);
3637 if (context_length) {
3638 g_byte_array_append(info, context_hash, context_length);
3639 }
3640
3641 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3642 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3643 g_byte_array_free(info, true1);
3644
3645 if (err) {
3646 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3647 wmem_free(NULL((void*)0), *out);
3648 *out = NULL((void*)0);
3649 return false0;
3650 }
3651
3652 return true1;
3653}
3654
3655bool_Bool
3656tls13_hkdf_expand_label(int md, const StringInfo *secret,
3657 const char *label_prefix, const char *label,
3658 uint16_t out_len, unsigned char **out)
3659{
3660 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3661}
3662
3663static bool_Bool
3664tls13_derive_secret(int md, const StringInfo *secret,
3665 const char *label_prefix, const char *label,
3666 const uint8_t *context, unsigned context_length,
3667 uint16_t out_len, unsigned char **out)
3668{
3669 SSL_MDgcry_md_hd_t mc;
3670 uint8_t context_hash[DIGEST_MAX_SIZE48];
3671 unsigned hash_len;
3672
3673 if (ssl_md_init(&mc, md) != 0)
3674 return false0;
3675 ssl_md_update(&mc, context, context_length);
3676 ssl_md_final(&mc, context_hash, &hash_len);
3677 ssl_md_cleanup(&mc);
3678
3679 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3680}
3681
3682/* HMAC and the Pseudorandom function }}} */
3683
3684/* Record Decompression (after decryption) {{{ */
3685#ifdef USE_ZLIB_OR_ZLIBNG
3686/* memory allocation functions for zlib initialization */
3687static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3688{
3689 return g_malloc0(no*size);
3690}
3691static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3692{
3693 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3694}
3695#endif /* USE_ZLIB_OR_ZLIBNG */
3696
3697static SslDecompress*
3698ssl_create_decompressor(int compression)
3699{
3700 SslDecompress *decomp;
3701#ifdef USE_ZLIB_OR_ZLIBNG
3702 int err;
3703#endif
3704
3705 if (compression == 0) return NULL((void*)0);
3706 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3707 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3708 decomp->compression = compression;
3709 switch (decomp->compression) {
3710#ifdef USE_ZLIB_OR_ZLIBNG
3711 case 1: /* DEFLATE */
3712 decomp->istream.zalloc = ssl_zalloc;
3713 decomp->istream.zfree = ssl_zfree;
3714 decomp->istream.opaque = Z_NULL0;
3715 decomp->istream.next_in = Z_NULL0;
3716 decomp->istream.next_out = Z_NULL0;
3717 decomp->istream.avail_in = 0;
3718 decomp->istream.avail_out = 0;
3719 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3720 if (err != Z_OK0) {
3721 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3722 return NULL((void*)0);
3723 }
3724 break;
3725#endif /* USE_ZLIB_OR_ZLIBNG */
3726 default:
3727 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3728 return NULL((void*)0);
3729 }
3730 return decomp;
3731}
3732
3733#ifdef USE_ZLIB_OR_ZLIBNG
3734static int
3735ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3736{
3737 int err;
3738
3739 switch (decomp->compression) {
3740 case 1: /* DEFLATE */
3741 err = Z_OK0;
3742 if (out_str->data_len < 16384) { /* maximal plain length */
3743 ssl_data_realloc(out_str, 16384);
3744 }
3745#ifdef z_constconst
3746 decomp->istream.next_in = in;
3747#else
3748DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3749 decomp->istream.next_in = (Bytef *)in;
3750DIAG_ON(cast-qual)clang diagnostic pop
3751#endif
3752 decomp->istream.avail_in = inl;
3753 decomp->istream.next_out = out_str->data;
3754 decomp->istream.avail_out = out_str->data_len;
3755 if (inl > 0)
3756 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3757 if (err != Z_OK0) {
3758 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3759 return -1;
3760 }
3761 *outl = out_str->data_len - decomp->istream.avail_out;
3762 break;
3763 default:
3764 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3765 return -1;
3766 }
3767 return 0;
3768}
3769#else /* USE_ZLIB_OR_ZLIBNG */
3770int
3771ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3772{
3773 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3774 return -1;
3775}
3776#endif /* USE_ZLIB_OR_ZLIBNG */
3777/* Record Decompression (after decryption) }}} */
3778
3779/* Create a new structure to store decrypted chunks. {{{ */
3780static SslFlow*
3781ssl_create_flow(void)
3782{
3783 SslFlow *flow;
3784
3785 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3786 flow->byte_seq = 0;
3787 flow->flags = 0;
3788 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3789 return flow;
3790}
3791/* }}} */
3792
3793/* Use the negotiated security parameters for decryption. {{{ */
3794void
3795ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3796{
3797 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3798 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3799 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3800 *new_decoder ? "" : " (No decoder found - retransmission?)");
3801 if (*new_decoder) {
3802 *dest = *new_decoder;
3803 *new_decoder = NULL((void*)0);
3804 }
3805}
3806/* }}} */
3807
3808/* Init cipher state given some security parameters. {{{ */
3809static bool_Bool
3810ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3811
3812static SslDecoder*
3813ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3814 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3815{
3816 SslDecoder *dec;
3817 ssl_cipher_mode_t mode = cipher_suite->mode;
3818
3819 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3820 /* init mac buffer: mac storage is embedded into decoder struct to save a
3821 memory allocation and waste samo more memory*/
3822 dec->cipher_suite=cipher_suite;
3823 dec->compression = compression;
3824 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
3825 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
3826 // the special case for NULL ciphers, even if there is insufficiency
3827 // keying material (including MAC key), we will can still create
3828 // decoders since "decryption" is easy for such ciphers.
3829 dec->mac_key.data = dec->_mac_key_or_write_iv;
3830 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
3831 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
3832 // Input for the nonce, to be used with AEAD ciphers.
3833 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3833, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
3834 dec->write_iv.data = dec->_mac_key_or_write_iv;
3835 ssl_data_set(&dec->write_iv, iv, iv_length);
3836 }
3837 dec->seq = 0;
3838 dec->decomp = ssl_create_decompressor(compression);
3839 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
3840
3841 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
3842 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
3843 cipher_algo, cipher_suite->mode);
3844 return NULL((void*)0);
3845 }
3846
3847 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
3848 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
3849 mode = MODE_ECB;
3850 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
3851 mode = MODE_STREAM;
3852 } else {
3853 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
3854 return NULL((void*)0);
3855 }
3856
3857 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
3858 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
3859 cipher_algo, MODE_ECB);
3860 ssl_cipher_cleanup(&dec->evp);
3861 dec->evp = NULL((void*)0);
3862 return NULL((void*)0);
3863 }
3864 } else {
3865 dec->sn_evp = NULL((void*)0);
3866 }
3867
3868 dec->dtls13_aad.data = NULL((void*)0);
3869 dec->dtls13_aad.data_len = 0;
3870 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
3871 return dec;
3872}
3873
3874static bool_Bool
3875ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
3876{
3877 SslDecoder *dec = (SslDecoder *) user_data;
3878
3879 if (dec->evp)
3880 ssl_cipher_cleanup(&dec->evp);
3881 if (dec->sn_evp)
3882 ssl_cipher_cleanup(&dec->sn_evp);
3883
3884#ifdef USE_ZLIB_OR_ZLIBNG
3885 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
3886 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
3887#endif
3888
3889 return false0;
3890}
3891/* }}} */
3892
3893/* (Pre-)master secrets calculations {{{ */
3894#ifdef HAVE_LIBGNUTLS1
3895static bool_Bool
3896ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
3897 StringInfo *encrypted_pre_master,
3898 GHashTable *key_hash);
3899#endif /* HAVE_LIBGNUTLS */
3900
3901static bool_Bool
3902ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
3903 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
3904
3905bool_Bool
3906ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
3907 uint32_t length, tvbuff_t *tvb, uint32_t offset,
3908 const char *ssl_psk, packet_info *pinfo,
3909#ifdef HAVE_LIBGNUTLS1
3910 GHashTable *key_hash,
3911#endif
3912 const ssl_master_key_map_t *mk_map)
3913{
3914 /* check for required session data */
3915 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
3916 G_STRFUNC((const char*) (__func__)), ssl_session->state);
3917 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
3918 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
3919 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
3920 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
3921 return false0;
3922 }
3923
3924 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
3925 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
3926 return false0;
3927 }
3928
3929 /* check to see if the PMS was provided to us*/
3930 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
3931 mk_map->pms, &ssl_session->client_random)) {
3932 return true1;
3933 }
3934
3935 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
3936 {
3937 /* calculate pre master secret*/
3938 StringInfo pre_master_secret;
3939 unsigned psk_len, pre_master_len;
3940
3941 if (!tls_load_psk(ssl_session, ssl_psk)) {
3942 return false0;
3943 }
3944 psk_len = ssl_session->psk.data_len;
3945
3946 pre_master_len = psk_len * 2 + 4;
3947
3948 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
3949 pre_master_secret.data_len = pre_master_len;
3950 /* 2 bytes psk_len*/
3951 pre_master_secret.data[0] = psk_len >> 8;
3952 pre_master_secret.data[1] = psk_len & 0xFF;
3953 /* psk_len bytes times 0*/
3954 memset(&pre_master_secret.data[2], 0, psk_len);
3955 /* 2 bytes psk_len*/
3956 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
3957 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
3958 /* psk*/
3959 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
3960
3961 ssl_session->pre_master_secret.data = pre_master_secret.data;
3962 ssl_session->pre_master_secret.data_len = pre_master_len;
3963 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
3964
3965 /* Remove the master secret if it was there.
3966 This forces keying material regeneration in
3967 case we're renegotiating */
3968 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
3969 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
3970 return true1;
3971 }
3972 else
3973 {
3974 unsigned encrlen, skip;
3975 encrlen = length;
3976 skip = 0;
3977
3978 /* get encrypted data, on tls1 we have to skip two bytes
3979 * (it's the encrypted len and should be equal to record len - 2)
3980 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
3981 */
3982 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
3983 (ssl_session->session.version == TLSV1_VERSION0x301 ||
3984 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
3985 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
3986 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
3987 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
3988 ssl_session->session.version == TLCPV1_VERSION0x101 ))
3989 {
3990 encrlen = tvb_get_ntohs(tvb, offset);
3991 skip = 2;
3992 if (encrlen > length - 2)
3993 {
3994 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
3995 G_STRFUNC((const char*) (__func__)), encrlen, length);
3996 return false0;
3997 }
3998 }
3999 /* the valid lower bound is higher than 8, but it is sufficient for the
4000 * ssl keylog file below */
4001 if (encrlen < 8) {
4002 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4003 G_STRFUNC((const char*) (__func__)), encrlen);
4004 return false0;
4005 }
4006
4007 StringInfo encrypted_pre_master = {
4008 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4009 .data_len = encrlen,
4010 };
4011
4012#ifdef HAVE_LIBGNUTLS1
4013 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4014 if (ssl_session->cert_key_id) {
4015 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4016 return true1;
4017
4018 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4019 G_STRFUNC((const char*) (__func__)));
4020 }
4021#endif /* HAVE_LIBGNUTLS */
4022
4023 /* try to find the pre-master secret from the encrypted one. The
4024 * ssl key logfile stores only the first 8 bytes, so truncate it */
4025 encrypted_pre_master.data_len = 8;
4026 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4027 true1, mk_map->pre_master, &encrypted_pre_master))
4028 return true1;
4029 }
4030 return false0;
4031}
4032
4033/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4034int
4035ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4036{
4037 StringInfo key_block = { NULL((void*)0), 0 };
4038 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4039 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4040 int needed;
4041 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4042 unsigned encr_key_len, write_iv_len = 0;
4043 bool_Bool is_export_cipher;
4044 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4045 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4046 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4047
4048 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4049 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
1
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
→
2
←
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
→
3
←
Taking false branch
→
4050 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4051 return -1;
4052 }
4053
4054 /* check for enough info to proceed */
4055 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4056 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4057 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4
←
Assuming the condition is false
→
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
4058 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4059 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4060 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4061 /* Special case: for NULL encryption, allow dissection of data even if
4062 * the Client Hello is missing (MAC keys are now skipped though). */
4063 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4064 if ((ssl_session->state & need_all) == need_all &&
4065 cipher_suite->enc == ENC_NULL0x3D) {
4066 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4067 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4068 goto create_decoders;
4069 }
4070
4071 return -1;
4072 }
4073
4074 /* if master key is not available, generate is from the pre-master secret */
4075 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
7
←
Assuming the condition is true
→
8
←
Taking true branch
→
4076 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
9
←
Assuming the condition is true
→
10
←
Taking true branch
→
4077 StringInfo handshake_hashed_data;
4078 int ret;
4079
4080 handshake_hashed_data.data = NULL((void*)0);
4081 handshake_hashed_data.data_len = 0;
4082
4083 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4084 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4085 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4085, "ssl_session->handshake_data.data_len > 0"
))));
11
←
Assuming field 'data_len' is > 0
→
12
←
'?' condition is true
→
4086
4087 switch(ssl_session->session.version) {
13
←
Control jumps to 'case 257:' at line 4092
→
4088 case TLSV1_VERSION0x301:
4089 case TLSV1DOT1_VERSION0x302:
4090 case DTLSV1DOT0_VERSION0xfeff:
4091 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4092 case TLCPV1_VERSION0x101:
4093 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
14
←
Calling 'tls_handshake_hash'
→
22
←
Returned allocated memory
→
4094 break;
4095 default:
4096 switch (cipher_suite->dig) {
4097 case DIG_SHA3840x43:
4098 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4099 break;
4100 default:
4101 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4102 break;
4103 }
4104 break;
4105 }
4106 if (ret
23.1
'ret' is -1
) {
23
←
 Execution continues on line 4106
→
24
←
Taking true branch
→
4107 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
25
←
Potential leak of memory pointed to by 'handshake_hashed_data.data'
4108 return -1;
4109 }
4110
4111 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4112 ssl_session->handshake_data.data = NULL((void*)0);
4113 ssl_session->handshake_data.data_len = 0;
4114
4115 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4116 &handshake_hashed_data,
4117 NULL((void*)0), &ssl_session->master_secret,
4118 SSL_MASTER_SECRET_LENGTH48)) {
4119 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4120 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4121 return -1;
4122 }
4123 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4124 } else {
4125 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4126 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4127 ssl_print_string("client random",&ssl_session->client_random);
4128 ssl_print_string("server random",&ssl_session->server_random);
4129 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4130 &ssl_session->client_random,
4131 &ssl_session->server_random, &ssl_session->master_secret,
4132 SSL_MASTER_SECRET_LENGTH48)) {
4133 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4134 return -1;
4135 }
4136 }
4137 ssl_print_string("master secret",&ssl_session->master_secret);
4138
4139 /* the pre-master secret has been 'consumed' so we must clear it now */
4140 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4141 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4142 }
4143
4144 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4145 if (cipher_suite->enc != ENC_NULL0x3D) {
4146 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4147 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4148 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4149 if (cipher_algo == 0) {
4150 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4151 return -1;
4152 }
4153 }
4154
4155 /* Export ciphers consume less material from the key block. */
4156 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4157 is_export_cipher = encr_key_len > 0;
4158 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4159 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4160 }
4161
4162 if (cipher_suite->mode == MODE_CBC) {
4163 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4164 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4165 /* account for a four-byte salt for client and server side (from
4166 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4167 write_iv_len = 4;
4168 } else if (cipher_suite->mode == MODE_POLY1305) {
4169 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4170 write_iv_len = 12;
4171 }
4172
4173 /* Compute the key block. First figure out how much data we need */
4174 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4175 needed += 2 * encr_key_len; /* encryption key */
4176 needed += 2 * write_iv_len; /* write IV */
4177
4178 key_block.data = (unsigned char *)g_malloc(needed);
4179 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4180 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4181 &ssl_session->server_random,&ssl_session->client_random,
4182 &key_block, needed)) {
4183 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4184 goto fail;
4185 }
4186 ssl_print_string("key expansion", &key_block);
4187
4188 ptr=key_block.data;
4189 /* client/server write MAC key (for non-AEAD ciphers) */
4190 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4191 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4192 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4193 }
4194 /* client/server write encryption key */
4195 c_wk=ptr; ptr += encr_key_len;
4196 s_wk=ptr; ptr += encr_key_len;
4197 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4198 if (write_iv_len > 0) {
4199 c_iv=ptr; ptr += write_iv_len;
4200 s_iv=ptr; /* ptr += write_iv_len; */
4201 }
4202
4203 /* export ciphers work with a smaller key length */
4204 if (is_export_cipher) {
4205 if (cipher_suite->mode == MODE_CBC) {
4206
4207 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4208 all we should need. This is a sanity check */
4209 if (write_iv_len > MAX_BLOCK_SIZE16) {
4210 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4211 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4212 goto fail;
4213 }
4214
4215 if(ssl_session->session.version==SSLV3_VERSION0x300){
4216 /* The length of these fields are ignored by this caller */
4217 StringInfo iv_c, iv_s;
4218 iv_c.data = _iv_c;
4219 iv_s.data = _iv_s;
4220
4221 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4222 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4223 &ssl_session->server_random, &iv_c, write_iv_len)) {
4224 goto fail;
4225 }
4226 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4227 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4228 &ssl_session->client_random, &iv_s, write_iv_len)) {
4229 goto fail;
4230 }
4231 }
4232 else{
4233 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4234 StringInfo iv_block;
4235 StringInfo key_null;
4236 uint8_t _key_null;
4237
4238 key_null.data = &_key_null;
4239 key_null.data_len = 0;
4240
4241 iv_block.data = _iv_block;
4242
4243 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4244 if (!prf(ssl_session, &key_null, "IV block",
4245 &ssl_session->client_random,
4246 &ssl_session->server_random, &iv_block,
4247 write_iv_len * 2)) {
4248 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4249 goto fail;
4250 }
4251
4252 memcpy(_iv_c, iv_block.data, write_iv_len);
4253 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4254 }
4255
4256 c_iv=_iv_c;
4257 s_iv=_iv_s;
4258 }
4259
4260 if (ssl_session->session.version==SSLV3_VERSION0x300){
4261
4262 SSL_MD5_CTXgcry_md_hd_t md5;
4263 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4264
4265 if (ssl_md5_init(&md5) != 0)
4266 goto fail;
4267 ssl_md5_update(&md5,c_wk,encr_key_len);
4268 ssl_md5_update(&md5,ssl_session->client_random.data,
4269 ssl_session->client_random.data_len);
4270 ssl_md5_update(&md5,ssl_session->server_random.data,
4271 ssl_session->server_random.data_len);
4272 ssl_md5_final(_key_c,&md5);
4273 ssl_md5_cleanup(&md5);
4274 c_wk=_key_c;
4275
4276 if (ssl_md5_init(&md5) != 0)
4277 goto fail;
4278 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4279 ssl_md5_update(&md5,s_wk,encr_key_len);
4280 ssl_md5_update(&md5,ssl_session->server_random.data,
4281 ssl_session->server_random.data_len);
4282 ssl_md5_update(&md5,ssl_session->client_random.data,
4283 ssl_session->client_random.data_len);
4284 ssl_md5_final(_key_s,&md5);
4285 ssl_md5_cleanup(&md5);
4286 s_wk=_key_s;
4287 }
4288 else{
4289 StringInfo key_c, key_s, k;
4290 key_c.data = _key_c;
4291 key_s.data = _key_s;
4292
4293 k.data = c_wk;
4294 k.data_len = encr_key_len;
4295 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4296 if (!prf(ssl_session, &k, "client write key",
4297 &ssl_session->client_random,
4298 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4299 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4300 goto fail;
4301 }
4302 c_wk=_key_c;
4303
4304 k.data = s_wk;
4305 k.data_len = encr_key_len;
4306 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4307 if (!prf(ssl_session, &k, "server write key",
4308 &ssl_session->client_random,
4309 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4310 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4311 goto fail;
4312 }
4313 s_wk=_key_s;
4314 }
4315 }
4316
4317 /* show key material info */
4318 if (c_mk != NULL((void*)0)) {
4319 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4320 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4321 }
4322 ssl_print_data("Client Write key", c_wk, encr_key_len);
4323 ssl_print_data("Server Write key", s_wk, encr_key_len);
4324 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4325 if (write_iv_len > 0) {
4326 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4327 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4328 }
4329
4330create_decoders:
4331 /* create both client and server ciphers*/
4332 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4333 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4334 if (!ssl_session->client_new) {
4335 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4336 goto fail;
4337 }
4338 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4339 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4340 if (!ssl_session->server_new) {
4341 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4342 goto fail;
4343 }
4344
4345 /* Continue the SSL stream after renegotiation with new keys. */
4346 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4347 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4348
4349 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4350 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4351 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4352 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4353 return 0;
4354
4355fail:
4356 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4357 return -1;
4358}
4359
4360/* Generated the key material based on the given secret. */
4361bool_Bool
4362tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4363{
4364 bool_Bool success = false0;
4365 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4366 unsigned char *sn_key = NULL((void*)0);
4367 SslDecoder *decoder;
4368 unsigned key_length, iv_length;
4369 int hash_algo;
4370 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4371 int cipher_algo;
4372
4373 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4374 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4375 ssl_session->session.version);
4376 return false0;
4377 }
4378
4379 if (cipher_suite == NULL((void*)0)) {
4380 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4381 return false0;
4382 }
4383
4384 if (cipher_suite->kex != KEX_TLS130x23) {
4385 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4386 return false0;
4387 }
4388
4389 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4390 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4391 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4392 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4393 if (cipher_algo == 0) {
4394 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4395 return false0;
4396 }
4397
4398 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4399 hash_algo = ssl_get_digest_by_name(hash_name);
4400 if (!hash_algo) {
4401 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4402 return false0;
4403 }
4404
4405 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4406 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4407 iv_length = 12;
4408 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4409
4410 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4411 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4412 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4413 return false0;
4414 }
4415 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4416 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4417 goto end;
4418 }
4419
4420 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4421 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4422 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4423 goto end;
4424 }
4425 }
4426
4427 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4428 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4429 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4430 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4431 }
4432
4433 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4434 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4435 if (!decoder) {
4436 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4437 goto end;
4438 }
4439
4440 /* Continue the TLS session with new keys, but reuse old flow to keep things
4441 * like "Follow TLS" working (by linking application data records). */
4442 if (is_from_server) {
4443 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4444 ssl_session->server = decoder;
4445 } else {
4446 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4447 ssl_session->client = decoder;
4448 }
4449 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4450 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4451 success = true1;
4452
4453end:
4454 wmem_free(NULL((void*)0), write_key);
4455 wmem_free(NULL((void*)0), write_iv);
4456 if (sn_key)
4457 wmem_free(NULL((void*)0), sn_key);
4458 return success;
4459}
4460/* (Pre-)master secrets calculations }}} */
4461
4462#ifdef HAVE_LIBGNUTLS1
4463/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4464static bool_Bool
4465ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4466 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4467{
4468 int ret;
4469
4470 if (!encrypted_pre_master)
4471 return false0;
4472
4473 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4474 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4475 "(cipher suite 0x%04X %s) and cannot be decrypted "
4476 "using a RSA private key file.\n",
4477 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4478 val_to_str_ext_const(ssl_session->session.cipher,
4479 &ssl_31_ciphersuite_ext, "unknown"));
4480 return false0;
4481 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4482 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4483 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4484 return false0;
4485 }
4486
4487 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4488
4489 ssl_print_string("pre master encrypted", encrypted_pre_master);
4490 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4491 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4492 gnutls_datum_t pms = { 0 };
4493 if (pk) {
4494 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4495 char *err = NULL((void*)0);
4496 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4497 if (!private_key) {
4498 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4499 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4500 return false0;
4501 }
4502
4503 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4504 rsa_private_key_free(private_key);
4505 if (pms.size == 0) {
4506 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4507 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4508 return false0;
4509 }
4510 } else {
4511 // Try to decrypt using a hardware token.
4512 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4513 if (ret < 0) {
4514 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4515 return false0;
4516 }
4517 }
4518
4519 if (pms.size != 48) {
4520 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4521 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4522 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4523 return false0;
4524 }
4525
4526 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4527 ssl_session->pre_master_secret.data_len = 48;
4528 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4529 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4530
4531 /* Remove the master secret if it was there.
4532 This forces keying material regeneration in
4533 case we're renegotiating */
4534 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4535 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4536 return true1;
4537} /* }}} */
4538#endif /* HAVE_LIBGNUTLS */
4539
4540/* Decryption integrity check {{{ */
4541
4542static int
4543tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4544 uint32_t datalen, uint8_t* mac)
4545{
4546 SSL_HMACgcry_md_hd_t hm;
4547 int md;
4548 uint32_t len;
4549 uint8_t buf[DIGEST_MAX_SIZE48];
4550 int16_t temp;
4551
4552 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4553 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4554 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4555
4556 if (ssl_hmac_init(&hm,md) != 0)
4557 return -1;
4558 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4559 return -1;
4560
4561 /* hash sequence number */
4562 phtonu64(buf, decoder->seq);
4563
4564 decoder->seq++;
4565
4566 ssl_hmac_update(&hm,buf,8);
4567
4568 /* hash content type */
4569 buf[0]=ct;
4570 ssl_hmac_update(&hm,buf,1);
4571
4572 /* hash version,data length and data*/
4573 /* *((int16_t*)buf) = g_htons(ver); */
4574 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4575 memcpy(buf, &temp, 2);
4576 ssl_hmac_update(&hm,buf,2);
4577
4578 /* *((int16_t*)buf) = g_htons(datalen); */
4579 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4580 memcpy(buf, &temp, 2);
4581 ssl_hmac_update(&hm,buf,2);
4582 ssl_hmac_update(&hm,data,datalen);
4583
4584 /* get digest and digest len*/
4585 len = sizeof(buf);
4586 ssl_hmac_final(&hm,buf,&len);
4587 ssl_hmac_cleanup(&hm);
4588 ssl_print_data("Mac", buf, len);
4589 if(memcmp(mac,buf,len))
4590 return -1;
4591
4592 return 0;
4593}
4594
4595static int
4596ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4597 uint32_t datalen, uint8_t* mac)
4598{
4599 SSL_MDgcry_md_hd_t mc;
4600 int md;
4601 uint32_t len;
4602 uint8_t buf[64],dgst[20];
4603 int pad_ct;
4604 int16_t temp;
4605
4606 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4607
4608 /* get cipher used for digest computation */
4609 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4610 if (ssl_md_init(&mc,md) !=0)
4611 return -1;
4612
4613 /* do hash computation on data && padding */
4614 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4615
4616 /* hash padding*/
4617 memset(buf,0x36,pad_ct);
4618 ssl_md_update(&mc,buf,pad_ct);
4619
4620 /* hash sequence number */
4621 phtonu64(buf, decoder->seq);
4622 decoder->seq++;
4623 ssl_md_update(&mc,buf,8);
4624
4625 /* hash content type */
4626 buf[0]=ct;
4627 ssl_md_update(&mc,buf,1);
4628
4629 /* hash data length in network byte order and data*/
4630 /* *((int16_t* )buf) = g_htons(datalen); */
4631 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4632 memcpy(buf, &temp, 2);
4633 ssl_md_update(&mc,buf,2);
4634 ssl_md_update(&mc,data,datalen);
4635
4636 /* get partial digest */
4637 ssl_md_final(&mc,dgst,&len);
4638 ssl_md_reset(&mc);
4639
4640 /* hash mac key */
4641 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4642
4643 /* hash padding and partial digest*/
4644 memset(buf,0x5c,pad_ct);
4645 ssl_md_update(&mc,buf,pad_ct);
4646 ssl_md_update(&mc,dgst,len);
4647
4648 ssl_md_final(&mc,dgst,&len);
4649 ssl_md_cleanup(&mc);
4650
4651 if(memcmp(mac,dgst,len))
4652 return -1;
4653
4654 return 0;
4655}
4656
4657static int
4658dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4659 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4660{
4661 SSL_HMACgcry_md_hd_t hm;
4662 int md;
4663 uint32_t len;
4664 uint8_t buf[DIGEST_MAX_SIZE48];
4665 int16_t temp;
4666
4667 int ver = ssl->session.version;
4668 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4669
4670 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4671 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4672 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4673
4674 if (ssl_hmac_init(&hm,md) != 0)
4675 return -1;
4676 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4677 return -1;
4678
4679 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4680
4681 if (is_cid && !ssl->session.deprecated_cid) {
4682 /* hash seq num placeholder */
4683 memset(buf,0xFF,8);
4684 ssl_hmac_update(&hm,buf,8);
4685
4686 /* hash content type + cid length + content type */
4687 buf[0]=ct;
4688 buf[1]=cidl;
4689 buf[2]=ct;
4690 ssl_hmac_update(&hm,buf,3);
4691
4692 /* hash version */
4693 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4694 memcpy(buf, &temp, 2);
4695 ssl_hmac_update(&hm,buf,2);
4696
4697 /* hash sequence number */
4698 phtonu64(buf, decoder->seq);
4699 buf[0]=decoder->epoch>>8;
4700 buf[1]=(uint8_t)decoder->epoch;
4701 ssl_hmac_update(&hm,buf,8);
4702
4703 /* hash cid */
4704 ssl_hmac_update(&hm,cid,cidl);
4705 } else {
4706 /* hash sequence number */
4707 phtonu64(buf, decoder->seq);
4708 buf[0]=decoder->epoch>>8;
4709 buf[1]=(uint8_t)decoder->epoch;
4710 ssl_hmac_update(&hm,buf,8);
4711
4712 /* hash content type */
4713 buf[0]=ct;
4714 ssl_hmac_update(&hm,buf,1);
4715
4716 /* hash version */
4717 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4718 memcpy(buf, &temp, 2);
4719 ssl_hmac_update(&hm,buf,2);
4720
4721 if (is_cid && ssl->session.deprecated_cid) {
4722 /* hash cid */
4723 ssl_hmac_update(&hm,cid,cidl);
4724
4725 /* hash cid length */
4726 buf[0] = cidl;
4727 ssl_hmac_update(&hm,buf,1);
4728 }
4729 }
4730
4731 /* data length and data */
4732 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4733 memcpy(buf, &temp, 2);
4734 ssl_hmac_update(&hm,buf,2);
4735 ssl_hmac_update(&hm,data,datalen);
4736
4737 /* get digest and digest len */
4738 len = sizeof(buf);
4739 ssl_hmac_final(&hm,buf,&len);
4740 ssl_hmac_cleanup(&hm);
4741 ssl_print_data("Mac", buf, len);
4742 if(memcmp(mac,buf,len))
4743 return -1;
4744
4745 return 0;
4746}
4747/* Decryption integrity check }}} */
4748
4749
4750static bool_Bool
4751tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4752 uint8_t ct, uint16_t record_version,
4753 bool_Bool ignore_mac_failed,
4754 const unsigned char *in, uint16_t inl,
4755 const unsigned char *cid, uint8_t cidl,
4756 StringInfo *out_str, unsigned *outl)
4757{
4758 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4759 * GenericAEADCipher: { nonce_explicit, [content] }
4760 * In TLS 1.3 this explicit nonce is gone.
4761 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4762 * ciphertext and authentication tag.
4763 */
4764 const uint16_t version = ssl->session.version;
4765 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4766 gcry_error_t err;
4767 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4768 unsigned ciphertext_len, auth_tag_len;
4769 unsigned char nonce[12];
4770 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4771 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4772 const uint8_t draft_version = ssl->session.tls13_draft_version;
4773 const unsigned char *auth_tag_wire;
4774 unsigned char auth_tag_calc[16];
4775 unsigned char *aad = NULL((void*)0);
4776 unsigned aad_len = 0;
4777
4778 switch (cipher_mode) {
4779 case MODE_GCM:
4780 case MODE_CCM:
4781 case MODE_POLY1305:
4782 auth_tag_len = 16;
4783 break;
4784 case MODE_CCM_8:
4785 auth_tag_len = 8;
4786 break;
4787 default:
4788 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4789 return false0;
4790 }
4791
4792 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4793 if (is_v12 && cipher_mode != MODE_POLY1305) {
4794 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4795 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4796 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4797 return false0;
4798 }
4799 explicit_nonce = in;
4800 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4801 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4802 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4803 if (inl < auth_tag_len) {
4804 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4805 return false0;
4806 }
4807 ciphertext = in;
4808 ciphertext_len = inl - auth_tag_len;
4809 } else {
4810 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4811 return false0;
4812 }
4813 auth_tag_wire = ciphertext + ciphertext_len;
4814
4815 /*
4816 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4817 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4818 */
4819 if (is_v12 && cipher_mode != MODE_POLY1305) {
4820 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4820, "decoder->write_iv.data_len == 4"))));
4821 /* Implicit (4) and explicit (8) part of nonce. */
4822 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4823 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
4824
4825 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4826 /*
4827 * Technically the nonce length must be at least 8 bytes, but for
4828 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
4829 */
4830 const unsigned nonce_len = 12;
4831 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4831, "decoder->write_iv.data_len == nonce_len"
))));
4832 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
4833 /* Sequence number is left-padded with zeroes and XORed with write_iv */
4834 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
4835 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
4836 }
4837
4838 /* Set nonce and additional authentication data */
4839 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
4840 ssl_print_data("nonce", nonce, 12);
4841 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
4842 if (err) {
4843 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4844 return false0;
4845 }
4846
4847 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
4848 if (is_cid) { /* if connection ID */
4849 if (ssl->session.deprecated_cid) {
4850 aad_len = 14 + cidl;
4851 aad = wmem_alloc(allocator, aad_len);
4852 phtonu64(aad, decoder->seq); /* record sequence number */
4853 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4854 aad[8] = ct; /* TLSCompressed.type */
4855 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4856 memcpy(aad + 11, cid, cidl); /* cid */
4857 aad[11 + cidl] = cidl; /* cid_length */
4858 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
4859 } else {
4860 aad_len = 23 + cidl;
4861 aad = wmem_alloc(allocator, aad_len);
4862 memset(aad, 0xFF, 8); /* seq_num_placeholder */
4863 aad[8] = ct; /* TLSCompressed.type */
4864 aad[9] = cidl; /* cid_length */
4865 aad[10] = ct; /* TLSCompressed.type */
4866 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
4867 phtonu64(aad + 13, decoder->seq); /* record sequence number */
4868 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
4869 memcpy(aad + 21, cid, cidl); /* cid */
4870 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
4871 }
4872 } else if (is_v12) {
4873 aad_len = 13;
4874 aad = wmem_alloc(allocator, aad_len);
4875 phtonu64(aad, decoder->seq); /* record sequence number */
4876 if (version == DTLSV1DOT2_VERSION0xfefd) {
4877 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
4878 }
4879 aad[8] = ct; /* TLSCompressed.type */
4880 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
4881 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
4882 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
4883 aad_len = decoder->dtls13_aad.data_len;
4884 aad = decoder->dtls13_aad.data;
4885 } else if (draft_version >= 25 || draft_version == 0) {
4886 aad_len = 5;
4887 aad = wmem_alloc(allocator, aad_len);
4888 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
4889 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
4890 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
4891 }
4892
4893 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
4894 /* size of plaintext, additional authenticated data and auth tag. */
4895 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
4896
4897 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
4898 }
4899
4900 if (aad && aad_len > 0) {
4901 ssl_print_data("AAD", aad, aad_len);
4902 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
4903 if (err) {
4904 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4905 return false0;
4906 }
4907 }
4908
4909 /* Decrypt now that nonce and AAD are set. */
4910 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
4911 if (err) {
4912 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4913 return false0;
4914 }
4915
4916 /* Check authentication tag for authenticity (replaces MAC) */
4917 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
4918 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
4919 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
4920 } else {
4921 if (err) {
4922 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
4923 } else {
4924 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
4925 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
4926 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
4927 }
4928 if (ignore_mac_failed) {
4929 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
4930 } else {
4931 return false0;
4932 }
4933 }
4934
4935 /*
4936 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
4937 * after successful authentication to ensure that early data is skipped when
4938 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
4939 */
4940 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
4941 decoder->seq++;
4942 }
4943
4944 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
4945 *outl = ciphertext_len;
4946 return true1;
4947}
4948
4949/* Record decryption glue based on security parameters {{{ */
4950/* Assume that we are called only for a non-NULL decoder which also means that
4951 * we have a non-NULL decoder->cipher_suite. */
4952int
4953ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
4954 bool_Bool ignore_mac_failed,
4955 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
4956 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
4957{
4958 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
4959 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
4960
4961 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
4962 ssl_print_data("Ciphertext",in, inl);
4963
4964 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
4965 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
4966 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
4967 return -1;
4968 }
4969
4970 /* ensure we have enough storage space for decrypted data */
4971 if (inl > out_str->data_len)
4972 {
4973 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
4974 inl + 32, out_str->data_len);
4975 ssl_data_realloc(out_str, inl + 32);
4976 }
4977
4978 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
4979 * a separate MAC, so use a different routine for simplicity. */
4980 if (decoder->cipher_suite->mode == MODE_GCM ||
4981 decoder->cipher_suite->mode == MODE_CCM ||
4982 decoder->cipher_suite->mode == MODE_CCM_8 ||
4983 decoder->cipher_suite->mode == MODE_POLY1305 ||
4984 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
4985 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
4986
4987 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
4988 /* decryption failed */
4989 return -1;
4990 }
4991
4992 goto skip_mac;
4993 }
4994
4995 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
4996 * (notation: { unencrypted, [ encrypted ] })
4997 * GenericStreamCipher: { [content, mac] }
4998 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
4999 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5000 * GenericAEADCipher: { nonce_explicit, [content] }
5001 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5002 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5003 */
5004
5005 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5006
5007 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5008 if (decoder->cipher_suite->mode == MODE_CBC) {
5009 unsigned blocksize = 0;
5010
5011 switch (ssl->session.version) {
5012 case TLSV1DOT1_VERSION0x302:
5013 case TLSV1DOT2_VERSION0x303:
5014 case DTLSV1DOT0_VERSION0xfeff:
5015 case DTLSV1DOT2_VERSION0xfefd:
5016 case DTLSV1DOT3_VERSION0xfefc:
5017 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5018 case TLCPV1_VERSION0x101:
5019 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5020 if (inl < blocksize) {
5021 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5022 inl, blocksize);
5023 return -1;
5024 }
5025 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5026 if (pad != 0) {
5027 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5028 gcry_strsource (pad), gcry_strerror (pad));
5029 }
5030
5031 inl -= blocksize;
5032 in += blocksize;
5033 break;
5034 }
5035
5036 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5037 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5038 /*
5039 * MAC is calculated over (IV + ) ENCRYPTED contents:
5040 *
5041 * MAC(MAC_write_key, ... +
5042 * IV + // for TLS 1.1 or greater
5043 * TLSCiphertext.enc_content);
5044 */
5045 if (inl < maclen) {
5046 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5047 G_STRFUNC((const char*) (__func__)), inl, maclen);
5048 return -1;
5049 }
5050 inl -= maclen;
5051 mac = (uint8_t *)in + inl;
5052 mac_frag = (uint8_t *)in - blocksize;
5053 mac_fraglen = blocksize + inl;
5054 }
5055 }
5056
5057 /* First decrypt*/
5058 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5059 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5060 gcry_strerror (pad));
5061 return -1;
5062 }
5063
5064 ssl_print_data("Plaintext", out_str->data, inl);
5065 worklen=inl;
5066
5067
5068 /* strip padding for GenericBlockCipher */
5069 if (decoder->cipher_suite->mode == MODE_CBC) {
5070 if (inl < 1) { /* Should this check happen earlier? */
5071 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5072 return -1;
5073 }
5074 pad=out_str->data[inl-1];
5075 if (worklen <= pad) {
5076 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5077 pad, worklen);
5078 return -1;
5079 }
5080 worklen-=(pad+1);
5081 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5082 pad, worklen);
5083 }
5084
5085 /* MAC for GenericStreamCipher and GenericBlockCipher.
5086 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5087 if (!mac) {
5088 /*
5089 * MAC is calculated over the DECRYPTED contents:
5090 *
5091 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5092 */
5093 if (worklen < maclen) {
5094 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5095 return -1;
5096 }
5097 worklen -= maclen;
5098 mac = out_str->data + worklen;
5099 mac_frag = out_str->data;
5100 mac_fraglen = worklen;
5101 }
5102
5103 /* If NULL encryption active and no keys are available, do not bother
5104 * checking the MAC. We do not have keys for that. */
5105 if (decoder->cipher_suite->mode == MODE_STREAM &&
5106 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5107 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5108 ssl_debug_printf("MAC check skipped due to missing keys\n");
5109 decoder->seq++; // Increment this for display
5110 goto skip_mac;
5111 }
5112
5113 /* Now check the MAC */
5114 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5115 worklen, ssl->session.version, ct, decoder->seq);
5116 if(ssl->session.version==SSLV3_VERSION0x300){
5117 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5118 if(ignore_mac_failed) {
5119 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5120 }
5121 else{
5122 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5123 return -1;
5124 }
5125 }
5126 else{
5127 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5128 }
5129 }
5130 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5131 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5132 if(ignore_mac_failed) {
5133 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5134 }
5135 else{
5136 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5137 return -1;
5138 }
5139 }
5140 else{
5141 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5142 }
5143 }
5144 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5145 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5146 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5147 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5148 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5149 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5150 }
5151 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5152 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5153 }
5154 else if(ignore_mac_failed) {
5155 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5156 }
5157 else{
5158 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5159 return -1;
5160 }
5161 }
5162skip_mac:
5163
5164 *outl = worklen;
5165
5166 if (decoder->compression > 0) {
5167 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5168 ssl_data_copy(comp_str, out_str);
5169 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5170 if (!decoder->decomp) {
5171 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5172 return -1;
5173 }
5174 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5175 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5176 *outl = uncomplen;
5177 }
5178
5179 return 0;
5180}
5181/* Record decryption glue based on security parameters }}} */
5182
5183
5184
5185#ifdef HAVE_LIBGNUTLS1
5186
5187/* RSA private key file processing {{{ */
5188static void
5189ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5190 const gnutls_datum_t *subjectPublicKeyInfo)
5191{
5192 gnutls_pubkey_t pubkey = NULL((void*)0);
5193 cert_key_id_t key_id;
5194 size_t key_id_len = sizeof(key_id);
5195 int r;
5196
5197 if (!subjectPublicKeyInfo->size) {
5198 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5199 return;
5200 }
5201
5202 r = gnutls_pubkey_init(&pubkey);
5203 if (r < 0) {
5204 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5205 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5206 return;
5207 }
5208
5209 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5210 if (r < 0) {
5211 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5212 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5213 goto end;
5214 }
5215
5216 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5217 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5218 goto end;
5219 }
5220
5221 /* Generate a 20-byte SHA-1 hash. */
5222 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5223 if (r < 0) {
5224 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5225 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5226 goto end;
5227 }
5228
5229 if (key_id_len != sizeof(key_id)) {
5230 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5231 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5232 goto end;
5233 }
5234
5235 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5236 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5237 *ssl->cert_key_id = key_id;
5238
5239end:
5240 gnutls_pubkey_deinit(pubkey);
5241}
5242
5243/* RSA private key file processing }}} */
5244#endif /* HAVE_LIBGNUTLS */
5245
5246/*--- Start of dissector-related code below ---*/
5247
5248/* This is not a "protocol" but ensures that this gets called during
5249 * the handoff stage. */
5250void proto_reg_handoff_tls_utils(void);
5251
5252static dissector_handle_t base_tls_handle;
5253static dissector_handle_t dtls_handle;
5254
5255void
5256proto_reg_handoff_tls_utils(void)
5257{
5258 base_tls_handle = find_dissector("tls");
5259 dtls_handle = find_dissector("dtls");
5260}
5261
5262/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5263 * no session exists. */
5264SslDecryptSession *
5265tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5266{
5267 void *conv_data;
5268 wmem_map_t *session_map;
5269
5270 if (!conversation)
5271 return NULL((void*)0);
5272
5273 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5274 if (conv_data == NULL((void*)0))
5275 return NULL((void*)0);
5276
5277 session_map = (wmem_map_t *)conv_data;
5278
5279 return (SslDecryptSession *)wmem_map_lookup(session_map,
5280 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5281
5282}
5283
5284/* get ssl data for this session. if no ssl data is found allocate a new one*/
5285SslDecryptSession *
5286ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5287{
5288 void *conv_data;
5289 SslDecryptSession *ssl_session;
5290 int proto_ssl;
5291 wmem_map_t *session_map;
5292
5293 /* Note proto_ssl is tls for either the main tls_handle or the
5294 * tls13_handshake handle used by QUIC. */
5295 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5296 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5297
5298 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5299 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5300 * preventing memory leaks on capture reload. */
5301 if (conv_data != NULL((void*)0)) {
5302 session_map = (wmem_map_t *)conv_data;
5303 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5304 if (ssl_session != NULL((void*)0)) {
5305 return ssl_session;
5306 }
5307 } else {
5308 /* Create a new wmem map to store sessions by layer number */
5309 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5310 conversation_add_proto_data(conversation, proto_ssl, session_map);
5311 }
5312
5313 /* no previous SSL conversation info for this layer, initialize it. */
5314 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5315
5316 /* data_len is the part that is meaningful, not the allocated length */
5317 ssl_session->master_secret.data_len = 0;
5318 ssl_session->master_secret.data = ssl_session->_master_secret;
5319 ssl_session->session_id.data_len = 0;
5320 ssl_session->session_id.data = ssl_session->_session_id;
5321 ssl_session->client_random.data_len = 0;
5322 ssl_session->client_random.data = ssl_session->_client_random;
5323 ssl_session->server_random.data_len = 0;
5324 ssl_session->server_random.data = ssl_session->_server_random;
5325 ssl_session->session_ticket.data_len = 0;
5326 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5327 ssl_session->server_data_for_iv.data_len = 0;
5328 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5329 ssl_session->client_data_for_iv.data_len = 0;
5330 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5331 ssl_session->app_data_segment.data = NULL((void*)0);
5332 ssl_session->app_data_segment.data_len = 0;
5333 ssl_session->handshake_data.data=NULL((void*)0);
5334 ssl_session->handshake_data.data_len=0;
5335 ssl_session->ech_transcript.data=NULL((void*)0);
5336 ssl_session->ech_transcript.data_len=0;
5337
5338 /* Initialize parameters which are not necessary specific to decryption. */
5339 ssl_session->session.version = SSL_VER_UNKNOWN0;
5340 clear_address(&ssl_session->session.srv_addr);
5341 ssl_session->session.srv_ptype = PT_NONE;
5342 ssl_session->session.srv_port = 0;
5343 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5344 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5345 ssl_session->session.client_random.data_len = 0;
5346 ssl_session->session.client_random.data = ssl_session->session._client_random;
5347 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5348 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5349 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5350 ssl_session->session.ech = false0;
5351 ssl_session->session.hrr_ech_declined = false0;
5352 ssl_session->session.first_ch_ech_frame = 0;
5353
5354 /* We want to increment the stream count for the normal tls handle and
5355 * dtls handle, but presumably not for the tls13_handshake handle used
5356 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5357 * doesn't get sent to the TLS follow tap.)
5358 */
5359 if (tls_handle == base_tls_handle) {
5360 ssl_session->session.stream = tls_increment_stream_count();
5361 } else if (tls_handle == dtls_handle) {
5362 ssl_session->session.stream = dtls_increment_stream_count();
5363 }
5364
5365 /* Store the session in the wmem map indexed by layer number */
5366 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5367
5368 return ssl_session;
5369}
5370
5371void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5372{
5373 if (ssl) {
5374 /* Ensure that secrets are not restored using stale identifiers. Split
5375 * between client and server in case the packets somehow got out of order. */
5376 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5377
5378 if (is_client) {
5379 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5380 ssl->session_id.data_len = 0;
5381 ssl->session_ticket.data_len = 0;
5382 ssl->master_secret.data_len = 0;
5383 ssl->client_random.data_len = 0;
5384 ssl->has_early_data = false0;
5385 if (ssl->handshake_data.data_len > 0) {
5386 // The EMS handshake hash starts with at the Client Hello,
5387 // ensure that any messages before it are forgotten.
5388 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
5389 ssl->handshake_data.data = NULL((void*)0);
5390 ssl->handshake_data.data_len = 0;
5391 }
5392 } else {
5393 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5394 ssl->server_random.data_len = 0;
5395 ssl->pre_master_secret.data_len = 0;
5396#ifdef HAVE_LIBGNUTLS1
5397 ssl->cert_key_id = NULL((void*)0);
5398#endif
5399 ssl->has_psk = false0;
5400 ssl->has_key_share = false0;
5401 // There is no point in clearing the PSK when resetting the session,
5402 // we only store one global PSK in the prefs.
5403 //ssl->psk.data_len = 0;
5404 }
5405
5406 if (ssl->state & clear_flags) {
5407 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5408 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5409 ssl->state &= ~clear_flags;
5410 }
5411 }
5412
5413 /* These flags might be used for non-decryption purposes and may affect the
5414 * dissection, so reset them as well. */
5415 if (is_client) {
5416 session->client_cert_type = 0;
5417 } else {
5418 session->compression = 0;
5419 session->server_cert_type = 0;
5420 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5421 }
5422 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5423 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5424}
5425
5426void
5427tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5428 dissector_handle_t app_handle)
5429{
5430 conversation_t *conversation;
5431 SslSession *session;
5432
5433 /* Ignore if the TLS or other dissector is disabled. */
5434 /* XXX - find_dissector still works if a dissector is disabled,
5435 * this would be if the dissector isn't registered at all or the
5436 * caller is calling this with explicit NULL. */
5437 if (!tls_handle || !app_handle)
5438 return;
5439
5440 int proto = dissector_handle_get_protocol_index(tls_handle);
5441 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5442
5443 conversation = find_or_create_conversation(pinfo);
5444 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5445 session->app_handle = app_handle;
5446}
5447
5448static uint32_t
5449ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5450 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5451{
5452
5453 conversation_t *conversation;
5454 SslSession *session;
5455
5456 /* Ignore if the TLS dissector is disabled. */
5457 /* XXX - find_dissector still works if a dissector is disabled,
5458 * this would be if the dissector isn't registered at all (or the
5459 * caller has an error.) */
5460 if (!tls_handle)
5461 return 0;
5462
5463 int proto = dissector_handle_get_protocol_index(tls_handle);
5464 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5465
5466 /* The caller should always pass a valid handle to its own dissector. */
5467 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5467, "app_handle"))));
5468
5469 conversation = find_or_create_conversation(pinfo);
5470 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5471
5472 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5473 session->last_nontls_frame,
5474 (void *)session->app_handle,
5475 dissector_handle_get_dissector_name(session->app_handle));
5476 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5477 pinfo->num, (void *)app_handle,
5478 dissector_handle_get_dissector_name(app_handle));
5479
5480 /* Do not switch again if a dissector did it before. */
5481 if (session->last_nontls_frame) {
5482 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5483 return session->last_nontls_frame;
5484 }
5485
5486 session->app_handle = app_handle;
5487 /* The TLS dissector should be called first for this conversation. */
5488 conversation_set_dissector(conversation, tls_handle);
5489 /* TLS starts after this frame. */
5490 session->last_nontls_frame = last_nontls_frame;
5491 return 0;
5492}
5493
5494/* ssl_starttls_ack: mark future frames as encrypted. */
5495uint32_t
5496ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5497 dissector_handle_t app_handle)
5498{
5499 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5500}
5501
5502uint32_t
5503ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5504 dissector_handle_t app_handle)
5505{
5506 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5507}
5508
5509dissector_handle_t
5510ssl_find_appdata_dissector(const char *name)
5511{
5512 /* Accept 'http' for backwards compatibility and sanity. */
5513 if (!strcmp(name, "http"))
5514 name = "http-over-tls";
5515 /* XXX - Should this check to see if the dissector is actually added for
5516 * Decode As in the appropriate table?
5517 */
5518 return find_dissector(name);
5519}
5520
5521/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5522static int
5523ssl_equal (const void *v, const void *v2)
5524{
5525 const StringInfo *val1;
5526 const StringInfo *val2;
5527 val1 = (const StringInfo *)v;
5528 val2 = (const StringInfo *)v2;
5529
5530 if (val1->data_len == val2->data_len &&
5531 !memcmp(val1->data, val2->data, val2->data_len)) {
5532 return 1;
5533 }
5534 return 0;
5535}
5536
5537static unsigned
5538ssl_hash(const void *v)
5539{
5540 const StringInfo* id;
5541 id = (const StringInfo*) v;
5542
5543 return wmem_strong_hash(id->data, id->data_len);
5544}
5545/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5546
5547/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5548void
5549ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5550{
5551 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5551, "main_handle"))));
5552 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5552, "subdissector_handle"))));
5553 /* Registration is required for Export PDU feature to work properly. */
5554 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5555, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5555 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5555, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5556 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5557
5558 if (port) {
5559 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5560 if (tcp)
5561 dissector_add_uint("tcp.port", port, main_handle);
5562 else
5563 dissector_add_uint("udp.port", port, main_handle);
5564 dissector_add_uint("sctp.port", port, main_handle);
5565 } else {
5566 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5567 }
5568}
5569
5570void
5571ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5572{
5573 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5574 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5575 if (main_handle) {
5576 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5577 dissector_delete_uint("sctp.port", port, main_handle);
5578 }
5579
5580 if (port) {
5581 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5582 }
5583}
5584
5585void
5586ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5587{
5588 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5589 session->srv_ptype = ptype;
5590 session->srv_port = port;
5591}
5592
5593int
5594ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5595{
5596 int ret;
5597 if (session && session->srv_addr.type != AT_NONE) {
5598 ret = (session->srv_ptype == pinfo->ptype) &&
5599 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5600 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5601 } else {
5602 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5603 }
5604
5605 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5606 return ret;
5607}
5608/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5609
5610
5611/* Links SSL records with the real packet data. {{{ */
5612SslPacketInfo *
5613tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5614{
5615 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5616 if (!pi) {
5617 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5618 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5619 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5620 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5621 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5622 if (ssl_session) {
5623 /* This can also be called by the QUIC TLS1.3 handshake only
5624 * dissector. That is not associated with a session, or a stream,
5625 * and doesn't need the information for Follow or Decode As. */
5626 pi->stream = ssl_session->session.stream;
5627 }
5628 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5629 }
5630
5631 return pi;
5632}
5633
5634/**
5635 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5636 * avoid the need for a decoder in the second pass. Additionally, it remembers
5637 * sequence numbers (for reassembly and Follow TLS Stream).
5638 *
5639 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5640 * @param pinfo The packet where the record originates from.
5641 * @param plain_data Decrypted plaintext to store in the record.
5642 * @param plain_data_len Total length of the plaintext.
5643 * @param content_len Length of the plaintext section corresponding to the record content.
5644 * @param record_id The identifier for this record within the current packet.
5645 * @param flow Information about sequence numbers, etc.
5646 * @param type TLS Content Type (such as handshake or application_data).
5647 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5648 */
5649void
5650ssl_add_record_info(int proto, packet_info *pinfo,
5651 const unsigned char *plain_data, int plain_data_len, int content_len,
5652 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5653 uint64_t record_seq)
5654{
5655 SslRecordInfo* rec, **prec;
5656 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5657
5658 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5658
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5659
5660 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5661 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5662 rec->plain_data_len = plain_data_len;
5663 rec->content_len = content_len;
5664 rec->id = record_id;
5665 rec->type = type;
5666 rec->next = NULL((void*)0);
5667 rec->record_seq = record_seq;
5668
5669 if (flow && type == SSL_ID_APP_DATA) {
5670 rec->seq = flow->byte_seq;
5671 rec->flow = flow;
5672 flow->byte_seq += content_len;
5673 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5674 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5675 }
5676
5677 /* Remember decrypted records. */
5678 prec = &pi->records;
5679 while (*prec) prec = &(*prec)->next;
5680 *prec = rec;
5681}
5682
5683/* search in packet data for the specified id; return a newly created tvb for the associated data */
5684tvbuff_t*
5685ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5686{
5687 SslRecordInfo* rec;
5688 SslPacketInfo* pi;
5689 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5690
5691 if (!pi)
5692 return NULL((void*)0);
5693
5694 for (rec = pi->records; rec; rec = rec->next)
5695 if (rec->id == record_id) {
5696 *matched_record = rec;
5697 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5698 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5699 }
5700
5701 return NULL((void*)0);
5702}
5703/* Links SSL records with the real packet data. }}} */
5704
5705/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5706void
5707ssl_common_init(ssl_master_key_map_t *mk_map,
5708 StringInfo *decrypted_data, StringInfo *compressed_data)
5709{
5710 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5711 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5712 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5713 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5714 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5715 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5716 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5717 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5718 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5719 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5720 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5721 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5722
5723 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5724 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5725
5726 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5727
5728 ssl_data_alloc(decrypted_data, 32);
5729 ssl_data_alloc(compressed_data, 32);
5730}
5731
5732void
5733ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5734 StringInfo *decrypted_data, StringInfo *compressed_data)
5735{
5736 g_hash_table_destroy(mk_map->session);
5737 g_hash_table_destroy(mk_map->tickets);
5738 g_hash_table_destroy(mk_map->crandom);
5739 g_hash_table_destroy(mk_map->pre_master);
5740 g_hash_table_destroy(mk_map->pms);
5741 g_hash_table_destroy(mk_map->tls13_client_early);
5742 g_hash_table_destroy(mk_map->tls13_client_handshake);
5743 g_hash_table_destroy(mk_map->tls13_server_handshake);
5744 g_hash_table_destroy(mk_map->tls13_client_appdata);
5745 g_hash_table_destroy(mk_map->tls13_server_appdata);
5746 g_hash_table_destroy(mk_map->tls13_early_exporter);
5747 g_hash_table_destroy(mk_map->tls13_exporter);
5748
5749 g_hash_table_destroy(mk_map->ech_secret);
5750 g_hash_table_destroy(mk_map->ech_config);
5751
5752 g_hash_table_destroy(mk_map->used_crandom);
5753
5754 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5755 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5756
5757 /* close the previous keylog file now that the cache are cleared, this
5758 * allows the cache to be filled with the full keylog file contents. */
5759 if (*ssl_keylog_file) {
5760 fclose(*ssl_keylog_file);
5761 *ssl_keylog_file = NULL((void*)0);
5762 }
5763}
5764/* }}} */
5765
5766/* parse ssl related preferences (private keys and ports association strings) */
5767#if defined(HAVE_LIBGNUTLS1)
5768/* Load a single RSA key file item from preferences. {{{ */
5769void
5770ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5771{
5772 gnutls_x509_privkey_t x509_priv_key;
5773 gnutls_privkey_t priv_key = NULL((void*)0);
5774 FILE* fp = NULL((void*)0);
5775 int ret;
5776 size_t key_id_len = 20;
5777 unsigned char *key_id = NULL((void*)0);
5778 char *err = NULL((void*)0);
5779 dissector_handle_t handle;
5780 /* try to load keys file first */
5781 fp = ws_fopenfopen(uats->keyfile, "rb");
5782 if (!fp) {
5783 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5784 return;
5785 }
5786
5787 if ((int)strlen(uats->password) == 0) {
5788 x509_priv_key = rsa_load_pem_key(fp, &err);
5789 } else {
5790 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
5791 }
5792 fclose(fp);
5793
5794 if (!x509_priv_key) {
5795 if (err) {
5796 report_failure("Can't load private key from %s: %s",
5797 uats->keyfile, err);
5798 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5799 } else
5800 report_failure("Can't load private key from %s: unknown error",
5801 uats->keyfile);
5802 return;
5803 }
5804 if (err) {
5805 report_failure("Load of private key from %s \"succeeded\" with error %s",
5806 uats->keyfile, err);
5807 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
5808 }
5809
5810 gnutls_privkey_init(&priv_key);
5811 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
5812 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
5813 if (ret < 0) {
5814 report_failure("Can't convert private key %s: %s",
5815 uats->keyfile, gnutls_strerror(ret));
5816 goto end;
5817 }
5818
5819 key_id = (unsigned char *) g_malloc0(key_id_len);
5820 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
5821 if (ret < 0) {
5822 report_failure("Can't calculate public key ID for %s: %s",
5823 uats->keyfile, gnutls_strerror(ret));
5824 goto end;
5825 }
5826 ssl_print_data("KeyID", key_id, key_id_len);
5827 if (key_id_len != 20) {
5828 report_failure("Expected Key ID size %u for %s, got %zu", 20,
5829 uats->keyfile, key_id_len);
5830 goto end;
5831 }
5832
5833 g_hash_table_replace(key_hash, key_id, priv_key);
5834 key_id = NULL((void*)0); /* used in key_hash, do not free. */
5835 priv_key = NULL((void*)0);
5836 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
5837
5838 handle = ssl_find_appdata_dissector(uats->protocol);
5839 if (handle) {
5840 /* Port to subprotocol mapping */
5841 uint16_t port = 0;
5842 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
5843 if (port > 0) {
5844 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
5845 port, uats->keyfile, uats->password);
5846
5847 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
5848 }
5849 } else {
5850 if (strcmp(uats->port, "start_tls"))
5851 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
5852 }
5853 }
5854
5855end:
5856 gnutls_x509_privkey_deinit(x509_priv_key);
5857 gnutls_privkey_deinit(priv_key);
5858 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
5859}
5860/* }}} */
5861#endif
5862
5863
5864/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
5865/** store a known (pre-)master secret into cache */
5866static void
5867ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
5868 StringInfo *mk)
5869{
5870 StringInfo *ht_key, *master_secret;
5871
5872 if (key->data_len == 0) {
5873 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
5874 return;
5875 }
5876
5877 if (mk->data_len == 0) {
5878 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
5879 G_STRFUNC((const char*) (__func__)), label);
5880 return;
5881 }
5882
5883 ht_key = ssl_data_clone(key);
5884 master_secret = ssl_data_clone(mk);
5885 g_hash_table_insert(ht, ht_key, master_secret);
5886
5887 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
5888 ssl_print_string("stored key", ht_key);
5889 ssl_print_string("stored (pre-)master secret", master_secret);
5890}
5891
5892/** restore a (pre-)master secret given some key in the cache */
5893static bool_Bool
5894ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
5895 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
5896{
5897 StringInfo *ms;
5898
5899 if (key->data_len == 0) {
5900 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
5901 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
5902 return false0;
5903 }
5904
5905 ms = (StringInfo *)g_hash_table_lookup(ht, key);
5906 if (!ms) {
5907 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
5908 is_pre_master ? "pre-" : "", label);
5909 return false0;
5910 }
5911
5912 /* (pre)master secret found, clear knowledge of other keys and set it in the
5913 * current conversation */
5914 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
5915 SSL_HAVE_SESSION_KEY(1<<3));
5916 if (is_pre_master) {
5917 /* unlike master secret, pre-master secret has a variable size (48 for
5918 * RSA, varying for PSK) and is therefore not statically allocated */
5919 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
5920 ms->data_len);
5921 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
5922 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
5923 } else {
5924 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
5925 ssl->state |= SSL_MASTER_SECRET(1<<5);
5926 }
5927 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
5928 is_pre_master ? "pre-" : "", label);
5929 ssl_print_string(label, key);
5930 ssl_print_string("(pre-)master secret", ms);
5931 return true1;
5932}
5933/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
5934
5935/* Should be called when all parameters are ready (after ChangeCipherSpec), and
5936 * the decoder should be attempted to be initialized. {{{*/
5937void
5938ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
5939{
5940 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
5941 /* TLS 1.3 implementations only provide secrets derived from the master
5942 * secret which are loaded in tls13_change_key. No master secrets can be
5943 * loaded here, so just return. */
5944 return;
5945 }
5946 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
5947 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
5948 ssl_debug_printf(" session key already available, nothing to do.\n");
5949 return;
5950 }
5951 if (!(ssl->state & SSL_CIPHER(1<<2))) {
5952 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
5953 return;
5954 }
5955
5956 /* for decryption, there needs to be a master secret (which can be derived
5957 * from pre-master secret). If missing, try to pick a master key from cache
5958 * (an earlier packet in the capture or key logfile). */
5959 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
5960 !ssl_restore_master_key(ssl, "Session ID", false0,
5961 mk_map->session, &ssl->session_id) &&
5962 (!ssl->session.is_session_resumed ||
5963 !ssl_restore_master_key(ssl, "Session Ticket", false0,
5964 mk_map->tickets, &ssl->session_ticket)) &&
5965 !ssl_restore_master_key(ssl, "Client Random", false0,
5966 mk_map->crandom, &ssl->client_random)) {
5967 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
5968 /* how unfortunate, the master secret could not be found */
5969 ssl_debug_printf(" Cannot find master secret\n");
5970 return;
5971 } else {
5972 ssl_debug_printf(" Cannot find master secret, continuing anyway "
5973 "because of a NULL cipher\n");
5974 }
5975 }
5976
5977 if (ssl_generate_keyring_material(ssl) < 0) {
5978 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
5979 return;
5980 }
5981 /* Save Client Random/ Session ID for "SSL Export Session keys" */
5982 ssl_save_master_key("Client Random", mk_map->crandom,
5983 &ssl->client_random, &ssl->master_secret);
5984 ssl_save_master_key("Session ID", mk_map->session,
5985 &ssl->session_id, &ssl->master_secret);
5986 /* Only save the new secrets if the server sent the ticket. The client
5987 * ticket might have become stale. */
5988 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
5989 ssl_save_master_key("Session Ticket", mk_map->tickets,
5990 &ssl->session_ticket, &ssl->master_secret);
5991 }
5992} /* }}} */
5993
5994static StringInfo*
5995tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
5996 TLSRecordType type)
5997{
5998 /* XXX - In addition to an out-of-bound PSK, we could also save the
5999 * PSK from a NewSessionTicket; we would also need to compute the
6000 * resumption_master_secret. */
6001 if (tls->psk.data_len == 0)
6002 return NULL((void*)0);
6003
6004 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
6005 * a UAT instead of a single global PSK string preference, preferably
6006 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
6007 * SHOULD be used. We will try the negotiated hash algorithm regardless
6008 * with the PSK, but fall back to SHA-256 for the Early Secret, since
6009 * that's before the Server Hello completes negotiation.
6010 */
6011 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
6012 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
6013 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
6014 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6015 }
6016
6017 int hash_algo = ssl_get_digest_by_name(dig->name);
6018 if (!hash_algo) {
6019 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6020 return NULL((void*)0);
6021 }
6022
6023 /* We can re-use this to store the Pseudo Random Key for each epoch. */
6024 uint8_t prk[DIGEST_MAX_SIZE48];
6025 StringInfo prk_string = { prk, dig->len };
6026 uint8_t *derived_secret;
6027
6028 uint8_t zeroes[DIGEST_MAX_SIZE48];
6029 memset(zeroes, 0, dig->len);
6030
6031 StringInfo *secret = NULL((void*)0);
6032 const char *label;
6033
6034 /* PRK = Early Secret */
6035 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6036
6037 if (type == TLS_SECRET_0RTT_APP) {
6038 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6038, "!is_from_server"))));
6039 label = "c e traffic";
6040 } else {
6041 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6042 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6043 return NULL((void*)0);
6044
6045 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6046 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6047 wmem_free(NULL((void*)0), derived_secret);
6048
6049 if (type == TLS_SECRET_HANDSHAKE) {
6050 label = is_from_server ? "s hs traffic" : "c hs traffic";
6051 } else {
6052 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6053 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6054 return NULL((void*)0);
6055
6056 /* PRK = Master Secret */
6057 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6058 wmem_free(NULL((void*)0), derived_secret);
6059
6060 label = is_from_server ? "s ap traffic" : "c ap traffic";
6061 }
6062 }
6063
6064 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6065 * support ECHO with psk_ke?) then we should use ech_transcript instead
6066 * of handshake_data. Perhaps we should consolidate some of that handling,
6067 * though note that we would have to keep both transcripts around after
6068 * the ClientHello until the ServerHello indicated whether ECHO was
6069 * accepted or not. */
6070 if (!tls13_derive_secret(hash_algo, &prk_string,
6071 tls13_hkdf_label_prefix(tls), label,
6072 tls->handshake_data.data, tls->handshake_data.data_len,
6073 dig->len, &derived_secret))
6074 return NULL((void*)0);
6075
6076 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6077 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6078 secret->data_len = dig->len;
6079 wmem_free(NULL((void*)0), derived_secret);
6080 return secret;
6081}
6082
6083/* Load the traffic key secret from the keylog file. */
6084StringInfo *
6085tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6086 bool_Bool is_from_server, TLSRecordType type)
6087{
6088 GHashTable *key_map;
6089 const char *label;
6090
6091 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6092 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6093 return NULL((void*)0);
6094 }
6095
6096 if (ssl->client_random.data_len == 0) {
6097 /* May happen if Hello message is missing and Finished is found. */
6098 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6099 return NULL((void*)0);
6100 }
6101
6102 switch (type) {
6103 case TLS_SECRET_0RTT_APP:
6104 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6104, "!is_from_server"))));
6105 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6106 key_map = mk_map->tls13_client_early;
6107 break;
6108 case TLS_SECRET_HANDSHAKE:
6109 if (is_from_server) {
6110 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6111 key_map = mk_map->tls13_server_handshake;
6112 } else {
6113 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6114 key_map = mk_map->tls13_client_handshake;
6115 }
6116 break;
6117 case TLS_SECRET_APP:
6118 if (is_from_server) {
6119 label = "SERVER_TRAFFIC_SECRET_0";
6120 key_map = mk_map->tls13_server_appdata;
6121 } else {
6122 label = "CLIENT_TRAFFIC_SECRET_0";
6123 key_map = mk_map->tls13_client_appdata;
6124 }
6125 break;
6126 default:
6127 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6127, __func__, "assertion \"not reached\" failed");
6128 }
6129
6130 /* Transitioning to new keys, mark old ones as unusable. */
6131 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6132 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6133
6134 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6135 if (!secret) {
6136 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6137 if (secret) {
6138 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6139 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6140 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6141 }
6142 }
6143 if (!secret) {
6144 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6145 /* Disable decryption, the keys are invalid. */
6146 if (is_from_server) {
6147 ssl->server = NULL((void*)0);
6148 } else {
6149 ssl->client = NULL((void*)0);
6150 }
6151 return NULL((void*)0);
6152 }
6153
6154 /* TLS 1.3 secret found, set new keys. */
6155 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6156 ssl_print_string("Client Random", &ssl->client_random);
6157 ssl_print_string(label, secret);
6158 return secret;
6159}
6160
6161/* Load the new key. */
6162void
6163tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6164 bool_Bool is_from_server, TLSRecordType type)
6165{
6166 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6167 /*
6168 * QUIC does not use the TLS record layer for message protection.
6169 * The required keys will be extracted later by QUIC.
6170 */
6171 return;
6172 }
6173
6174 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6175 if (!secret) {
6176 if (type != TLS_SECRET_HANDSHAKE) {
6177 return;
6178 }
6179 /*
6180 * Workaround for when for some reason we don't have the handshake
6181 * secret but do have the application traffic secret. (#20240)
6182 * If we can't find the handshake secret, we'll never decrypt the
6183 * Finished message, so we won't know when to change to the app
6184 * traffic key, so we do so now.
6185 */
6186 type = TLS_SECRET_APP;
6187 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6188 if (!secret) {
6189 return;
6190 }
6191 }
6192
6193 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6194 /*
6195 * Remember the application traffic secret to support Key Update. The
6196 * other secrets cannot be used for this purpose, so free them.
6197 */
6198 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6199 StringInfo *app_secret = &decoder->app_traffic_secret;
6200 if (type == TLS_SECRET_APP) {
6201 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6202 app_secret->data,
6203 secret->data_len);
6204 ssl_data_set(app_secret, secret->data, secret->data_len);
6205 } else {
6206 wmem_free(wmem_file_scope(), app_secret->data);
6207 app_secret->data = NULL((void*)0);
6208 app_secret->data_len = 0;
6209 }
6210 }
6211}
6212
6213/**
6214 * Update to next application data traffic secret for TLS 1.3. The previous
6215 * secret should have been set by tls13_change_key.
6216 */
6217void
6218tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6219{
6220 /* RFC 8446 Section 7.2:
6221 * application_traffic_secret_N+1 =
6222 * HKDF-Expand-Label(application_traffic_secret_N,
6223 * "traffic upd", "", Hash.length)
6224 *
6225 * Both application_traffic_secret_N are of the same length (Hash.length).
6226 */
6227 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6228 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6229 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6230 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6231
6232 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6233 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6234 return;
6235 }
6236
6237 /*
6238 * Previous traffic secret is available, so find the hash function,
6239 * expand the new traffic secret and generate new keys.
6240 */
6241 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6242 int hash_algo = ssl_get_digest_by_name(hash_name);
6243 const unsigned hash_len = app_secret->data_len;
6244 unsigned char *new_secret;
6245 const char *label = "traffic upd";
6246 if (tls13_draft_version && tls13_draft_version < 20) {
6247 label = "application traffic secret";
6248 }
6249 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6250 tls13_hkdf_label_prefix(ssl),
6251 label, hash_len, &new_secret)) {
6252 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6253 return;
6254 }
6255 ssl_data_set(app_secret, new_secret, hash_len);
6256 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6257 /*
6258 * Remember the application traffic secret on the new decoder to
6259 * support another Key Update.
6260 */
6261 decoder = is_from_server ? ssl->server : ssl->client;
6262 app_secret = &decoder->app_traffic_secret;
6263 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6264 app_secret->data,
6265 hash_len);
6266 ssl_data_set(app_secret, new_secret, hash_len);
6267 }
6268 wmem_free(NULL((void*)0), new_secret);
6269}
6270
6271void
6272tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6273{
6274 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6275 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6276 }
6277}
6278
6279/** SSL keylog file handling. {{{ */
6280
6281static GRegex *
6282ssl_compile_keyfile_regex(void)
6283{
6284#define OCTET "(?:[[:xdigit:]]{2})"
6285 const char *pattern =
6286 "(?:"
6287 /* Matches Client Hellos having this Client Random */
6288 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6289 /* Matches first part of encrypted RSA pre-master secret */
6290 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6291 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6292 but it can be of any length for DHE */
6293 ")(?<pms>" OCTET "+)"
6294 "|(?:"
6295 /* Matches Server Hellos having a Session ID */
6296 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6297 /* Matches Client Hellos having this Client Random */
6298 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6299 /* Master-Secret is given, its length is fixed */
6300 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6301 "|(?"
6302 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6303 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6304 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6305 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6306 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6307 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6308 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6309 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6310 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6311 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6312 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6313 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6314 ") (?<derived_secret>" OCTET "+)";
6315#undef OCTET
6316 static GRegex *regex = NULL((void*)0);
6317 GError *gerr = NULL((void*)0);
6318
6319 if (!regex) {
6320 regex = g_regex_new(pattern,
6321 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6322 G_REGEX_MATCH_ANCHORED, &gerr);
6323 if (gerr) {
6324 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6325 gerr->message);
6326 g_error_free(gerr);
6327 regex = NULL((void*)0);
6328 }
6329 }
6330
6331 return regex;
6332}
6333
6334typedef struct ssl_master_key_match_group {
6335 const char *re_group_name;
6336 GHashTable *master_key_ht;
6337} ssl_master_key_match_group_t;
6338
6339void
6340tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6341{
6342 ssl_master_key_match_group_t mk_groups[] = {
6343 { "encrypted_pmk", mk_map->pre_master },
6344 { "session_id", mk_map->session },
6345 { "client_random", mk_map->crandom },
6346 { "client_random_pms", mk_map->pms },
6347 /* TLS 1.3 map from Client Random to derived secret. */
6348 { "client_early", mk_map->tls13_client_early },
6349 { "client_handshake", mk_map->tls13_client_handshake },
6350 { "server_handshake", mk_map->tls13_server_handshake },
6351 { "client_appdata", mk_map->tls13_client_appdata },
6352 { "server_appdata", mk_map->tls13_server_appdata },
6353 { "early_exporter", mk_map->tls13_early_exporter },
6354 { "exporter", mk_map->tls13_exporter },
6355 { "ech_secret", mk_map->ech_secret },
6356 { "ech_config", mk_map->ech_config },
6357 };
6358
6359 /* The format of the file is a series of records with one of the following formats:
6360 * - "RSA xxxx yyyy"
6361 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6362 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6363 * (this is the original format introduced with bug 4349)
6364 *
6365 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6366 * Where xxxx is the SSL session ID (hex-encoded)
6367 * Where yyyy is the cleartext master secret (hex-encoded)
6368 * (added to support openssl s_client Master-Key output)
6369 * This is somewhat is a misnomer because there's nothing RSA specific
6370 * about this.
6371 *
6372 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6373 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6374 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6375 * (This format allows SSL connections to be decrypted, if a user can
6376 * capture the PMS but could not recover the MS for a specific session
6377 * with a SSL Server.)
6378 *
6379 * - "CLIENT_RANDOM xxxx yyyy"
6380 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6381 * Where yyyy is the cleartext master secret (hex-encoded)
6382 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6383 * ECDHE-RSA.)
6384 *
6385 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6386 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6387 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6388 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6389 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6390 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6391 * - "EXPORTER_SECRET xxxx yyyy"
6392 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6393 * Where yyyy is the secret (hex-encoded) derived from the early,
6394 * handshake or master secrets. (This format is introduced with TLS 1.3
6395 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6396 */
6397 GRegex *regex = ssl_compile_keyfile_regex();
6398 if (!regex)
6399 return;
6400
6401 const char *next_line = (const char *)data;
6402 const char *line_end = next_line + datalen;
6403 while (next_line && next_line < line_end) {
6404 const char *line = next_line;
6405 next_line = (const char *)memchr(line, '\n', line_end - line);
6406 ssize_t linelen;
6407
6408 if (next_line) {
6409 linelen = next_line - line;
6410 next_line++; /* drop LF */
6411 } else {
6412 linelen = (ssize_t)(line_end - line);
6413 }
6414 if (linelen > 0 && line[linelen - 1] == '\r') {
6415 linelen--; /* drop CR */
6416 }
6417
6418 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6419 GMatchInfo *mi;
6420 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6421 char *hex_key, *hex_pre_ms_or_ms;
6422 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6423 StringInfo *pre_ms_or_ms = NULL((void*)0);
6424 GHashTable *ht = NULL((void*)0);
6425
6426 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6427 * otherwise we will use the Master Secret
6428 */
6429 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6430 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6431 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6432 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6433 }
6434 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6435 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6436 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6437 }
6438 /* There is always a match, otherwise the regex is wrong. */
6439 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6439, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6440
6441 /* convert from hex to bytes and save to hashtable */
6442 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6443 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6444 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6445
6446 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6447 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6448 ssl_master_key_match_group_t *g = &mk_groups[i];
6449 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6450 if (hex_key && *hex_key) {
6451 ssl_debug_printf(" matched %s\n", g->re_group_name);
6452 ht = g->master_key_ht;
6453 from_hex(key, hex_key, strlen(hex_key));
6454 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6455 break;
6456 }
6457 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6458 }
6459 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6459, "ht")))); /* Cannot be reached, or regex is wrong. */
6460
6461 g_hash_table_insert(ht, key, pre_ms_or_ms);
6462
6463 } else if (linelen > 0 && line[0] != '#') {
6464 ssl_debug_printf(" unrecognized line\n");
6465 }
6466 /* always free match info even if there is no match. */
6467 g_match_info_free(mi);
6468 }
6469}
6470
6471void
6472ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6473 const ssl_master_key_map_t *mk_map)
6474{
6475 /* no need to try if no key log file is configured. */
6476 if (!tls_keylog_filename || !*tls_keylog_filename) {
6477 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6478 G_STRFUNC((const char*) (__func__)));
6479 return;
6480 }
6481
6482 /* Validate regexes before even trying to use it. */
6483 if (!ssl_compile_keyfile_regex()) {
6484 return;
6485 }
6486
6487 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6488
6489 /* if the keylog file was deleted/overwritten, re-open it */
6490 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6491 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6492 fclose(*keylog_file);
6493 *keylog_file = NULL((void*)0);
6494 }
6495
6496 if (*keylog_file == NULL((void*)0)) {
6497 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6498 if (!*keylog_file) {
6499 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6500 return;
6501 }
6502 }
6503
6504 for (;;) {
6505 char buf[1110], *line;
6506 line = fgets(buf, sizeof(buf), *keylog_file);
6507 if (!line) {
6508 if (feof(*keylog_file)) {
6509 /* Ensure that newly appended keys can be read in the future. */
6510 clearerr(*keylog_file);
6511 } else if (ferror(*keylog_file)) {
6512 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6513 fclose(*keylog_file);
6514 *keylog_file = NULL((void*)0);
6515 }
6516 break;
6517 }
6518 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6519 }
6520}
6521/** SSL keylog file handling. }}} */
6522
6523#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6524
6525static FILE* ssl_debug_file;
6526
6527void
6528ssl_set_debug(const char* name)
6529{
6530 static int debug_file_must_be_closed;
6531 int use_stderr;
6532
6533 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6534
6535 if (debug_file_must_be_closed)
6536 fclose(ssl_debug_file);
6537
6538 if (use_stderr)
6539 ssl_debug_file = stderrstderr;
6540 else if (!name || (strcmp(name, "") ==0))
6541 ssl_debug_file = NULL((void*)0);
6542 else
6543 ssl_debug_file = ws_fopenfopen(name, "w");
6544
6545 if (!use_stderr && ssl_debug_file)
6546 debug_file_must_be_closed = 1;
6547 else
6548 debug_file_must_be_closed = 0;
6549
6550 ssl_debug_printf("Wireshark SSL debug log \n\n");
6551#ifdef HAVE_LIBGNUTLS1
6552 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6553#endif
6554 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6555 ssl_debug_printf("\n");
6556}
6557
6558void
6559ssl_debug_flush(void)
6560{
6561 if (ssl_debug_file)
6562 fflush(ssl_debug_file);
6563}
6564
6565void
6566ssl_debug_printf(const char* fmt, ...)
6567{
6568 va_list ap;
6569
6570 if (!ssl_debug_file)
6571 return;
6572
6573 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6574 vfprintf(ssl_debug_file, fmt, ap);
6575 va_end(ap)__builtin_va_end(ap);
6576}
6577
6578void
6579ssl_print_data(const char* name, const unsigned char* data, size_t len)
6580{
6581 size_t i, j, k;
6582 if (!ssl_debug_file)
6583 return;
6584 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6585 for (i=0; i<len; i+=16) {
6586 fprintf(ssl_debug_file,"| ");
6587 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6588 fprintf(ssl_debug_file,"%.2x ",data[j]);
6589 for (; k<16; ++k)
6590 fprintf(ssl_debug_file," ");
6591 fputc('|', ssl_debug_file);
6592 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6593 unsigned char c = data[j];
6594 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6595 fputc(c, ssl_debug_file);
6596 }
6597 for (; k<16; ++k)
6598 fputc(' ', ssl_debug_file);
6599 fprintf(ssl_debug_file,"|\n");
6600 }
6601}
6602
6603void
6604ssl_print_string(const char* name, const StringInfo* data)
6605{
6606 ssl_print_data(name, data->data, data->data_len);
6607}
6608#endif /* SSL_DECRYPT_DEBUG }}} */
6609
6610/* UAT preferences callbacks. {{{ */
6611/* checks for SSL and DTLS UAT key list fields */
6612
6613bool_Bool
6614ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6615{
6616 // This should be removed in favor of Decode As. Make it optional.
6617 *err = NULL((void*)0);
6618 return true1;
6619}
6620
6621bool_Bool
6622ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6623{
6624 if (!p || strlen(p) == 0u) {
6625 // This should be removed in favor of Decode As. Make it optional.
6626 *err = NULL((void*)0);
6627 return true1;
6628 }
6629
6630 if (strcmp(p, "start_tls") != 0){
6631 uint16_t port;
6632 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6633 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6634 return false0;
6635 }
6636 }
6637
6638 *err = NULL((void*)0);
6639 return true1;
6640}
6641
6642bool_Bool
6643ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6644{
6645 ws_statb64struct stat st;
6646
6647 if (!p || strlen(p) == 0u) {
6648 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6649 return false0;
6650 } else {
6651 if (ws_stat64stat(p, &st) != 0) {
6652 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6653 return false0;
6654 }
6655 }
6656
6657 *err = NULL((void*)0);
6658 return true1;
6659}
6660
6661bool_Bool
6662ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6663{
6664#if defined(HAVE_LIBGNUTLS1)
6665 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6666 FILE *fp = NULL((void*)0);
6667
6668 if (p && (strlen(p) > 0u)) {
6669 fp = ws_fopenfopen(f->keyfile, "rb");
6670 if (fp) {
6671 char *msg = NULL((void*)0);
6672 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6673 if (!priv_key) {
6674 fclose(fp);
6675 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6676 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6677 return false0;
6678 }
6679 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6680 gnutls_x509_privkey_deinit(priv_key);
6681 fclose(fp);
6682 } else {
6683 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6684 return false0;
6685 }
6686 }
6687
6688 *err = NULL((void*)0);
6689 return true1;
6690#else
6691 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6692 return false0;
6693#endif
6694}
6695/* UAT preferences callbacks. }}} */
6696
6697/** maximum size of ssl_association_info() string */
6698#define SSL_ASSOC_MAX_LEN8192 8192
6699
6700typedef struct ssl_association_info_callback_data
6701{
6702 char *str;
6703 const char *table_protocol;
6704} ssl_association_info_callback_data_t;
6705
6706/**
6707 * callback function used by ssl_association_info() to traverse the SSL associations.
6708 */
6709static void
6710ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6711{
6712 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6713 const int l = (const int)strlen(data->str);
6714 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6715}
6716
6717/**
6718 * @return an information string on the SSL protocol associations. The string must be freed.
6719 */
6720char*
6721ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6722{
6723 ssl_association_info_callback_data_t data;
6724
6725 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6726 data.table_protocol = table_protocol;
6727 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6728 return data.str;
6729}
6730
6731
6732/** Begin of code related to dissection of wire data. */
6733
6734/* Helpers for dissecting Variable-Length Vectors. {{{ */
6735bool_Bool
6736ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6737 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6738 int hf_length, uint32_t min_value, uint32_t max_value)
6739{
6740 unsigned veclen_size;
6741 uint32_t veclen_value;
6742 proto_item *pi;
6743
6744 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6744, (uint64_t)min_value, (uint64_t)max_value))));
6745 if (offset > offset_end) {
6746 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6747 "Vector offset is past buffer end offset (%u > %u)",
6748 offset, offset_end);
6749 *ret_length = 0;
6750 return false0; /* Cannot read length. */
6751 }
6752
6753 if (max_value > 0xffffff) {
6754 veclen_size = 4;
6755 } else if (max_value > 0xffff) {
6756 veclen_size = 3;
6757 } else if (max_value > 0xff) {
6758 veclen_size = 2;
6759 } else {
6760 veclen_size = 1;
6761 }
6762
6763 if (offset_end - offset < veclen_size) {
6764 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6765 tvb, offset, offset_end - offset,
6766 "No more room for vector of length %u",
6767 veclen_size);
6768 *ret_length = 0;
6769 return false0; /* Cannot read length. */
6770 }
6771
6772 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6773 offset += veclen_size;
6774
6775 if (veclen_value < min_value) {
6776 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6777 "Vector length %u is smaller than minimum %u",
6778 veclen_value, min_value);
6779 } else if (veclen_value > max_value) {
6780 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6781 "Vector length %u is larger than maximum %u",
6782 veclen_value, max_value);
6783 }
6784
6785 if (offset_end - offset < veclen_value) {
6786 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
6787 "Vector length %u is too large, truncating it to %u",
6788 veclen_value, offset_end - offset);
6789 *ret_length = offset_end - offset;
6790 return false0; /* Length is truncated to avoid overflow. */
6791 }
6792
6793 *ret_length = veclen_value;
6794 return true1; /* Length is OK. */
6795}
6796
6797bool_Bool
6798ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6799 unsigned offset, unsigned offset_end)
6800{
6801 if (offset < offset_end) {
6802 unsigned trailing = offset_end - offset;
6803 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
6804 tvb, offset, trailing,
6805 "%u trailing byte%s unprocessed",
6806 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
6807 return false0; /* unprocessed data warning */
6808 } else if (offset > offset_end) {
6809 /*
6810 * Returned offset runs past the end. This should not happen and is
6811 * possibly a dissector bug.
6812 */
6813 unsigned excess = offset - offset_end;
6814 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6815 tvb, offset_end, excess,
6816 "Dissector processed too much data (%u byte%s)",
6817 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
6818 return false0; /* overflow error */
6819 }
6820
6821 return true1; /* OK, offset matches. */
6822}
6823/** }}} */
6824
6825
6826static uint32_t
6827ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6828 proto_tree *tree, uint32_t offset, uint32_t offset_end,
6829 uint16_t version, int hf_sig_len, int hf_sig);
6830
6831/* change_cipher_spec(20) dissection */
6832void
6833ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
6834 packet_info *pinfo, proto_tree *tree,
6835 uint32_t offset, SslSession *session,
6836 bool_Bool is_from_server,
6837 const SslDecryptSession *ssl)
6838{
6839 /*
6840 * struct {
6841 * enum { change_cipher_spec(1), (255) } type;
6842 * } ChangeCipherSpec;
6843 */
6844 proto_item *ti;
6845 proto_item_set_text(tree,
6846 "%s Record Layer: %s Protocol: Change Cipher Spec",
6847 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
6848 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
6849 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
6850
6851 if (session->version == TLSV1DOT3_VERSION0x304) {
6852 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
6853 return;
6854 }
6855
6856 /* Remember frame number of first CCS */
6857 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
6858 if (*ccs_frame == 0)
6859 *ccs_frame = pinfo->num;
6860
6861 /* Use heuristics to detect an abbreviated handshake, assume that missing
6862 * ServerHelloDone implies reusing previously negotiating keys. Then when
6863 * a Session ID or ticket is present, it must be a resumed session.
6864 * Normally this should be done at the Finished message, but that may be
6865 * encrypted so we do it here, at the last cleartext message. */
6866 if (is_from_server && ssl) {
6867 if (session->is_session_resumed) {
6868 const char *resumed = NULL((void*)0);
6869 if (ssl->session_ticket.data_len) {
6870 resumed = "Session Ticket";
6871 } else if (ssl->session_id.data_len) {
6872 resumed = "Session ID";
6873 }
6874 if (resumed) {
6875 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
6876 } else {
6877 /* Can happen if the capture somehow starts in the middle */
6878 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
6879 }
6880 } else {
6881 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
6882 }
6883 }
6884 if (is_from_server && session->is_session_resumed)
6885 expert_add_info(pinfo, ti, &hf->ei.resumed);
6886}
6887
6888/** Begin of handshake(22) record dissections */
6889
6890/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
6891 * {{{ */
6892static void
6893tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
6894{
6895 uint32_t sighash, hashalg, sigalg;
6896 proto_item *ti_sigalg;
6897 proto_tree *sigalg_tree;
6898
6899 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
6900 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
6901 if (ja4_data && !IS_GREASE_TLS(sighash)((((sighash) & 0x0f0f) == 0x0a0a) && (((sighash) &
0xff) == (((sighash)>>8) & 0xff)))) {
6902 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
6903 }
6904
6905 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
6906
6907 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
6908 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
6909 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
6910 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
6911 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
6912
6913 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
6914 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
6915 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
6916 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
6917 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
6918 sighash);
6919 }
6920} /* }}} */
6921
6922/* dissect a list of hash algorithms, return the number of bytes dissected
6923 this is used for the signature algorithms extension and for the
6924 TLS1.2 certificate request. {{{ */
6925static int
6926ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
6927 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
6928{
6929 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
6930 * struct {
6931 * HashAlgorithm hash;
6932 * SignatureAlgorithm signature;
6933 * } SignatureAndHashAlgorithm;
6934 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
6935 */
6936 proto_tree *subtree;
6937 proto_item *ti;
6938 unsigned sh_alg_length;
6939 uint32_t next_offset;
6940
6941 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
6942 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
6943 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
6944 return offset_end;
6945 }
6946 offset += 2;
6947 next_offset = offset + sh_alg_length;
6948
6949 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
6950 "Signature Hash Algorithms (%u algorithm%s)",
6951 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
6952 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
6953
6954 while (offset + 2 <= next_offset) {
6955 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
6956 offset += 2;
6957 }
6958
6959 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
6960 offset = next_offset;
6961 }
6962
6963 return offset;
6964} /* }}} */
6965
6966/* Dissection of DistinguishedName (for CertificateRequest and
6967 * certificate_authorities extension). {{{ */
6968static uint32_t
6969tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
6970 proto_tree *tree, uint32_t offset, uint32_t offset_end)
6971{
6972 proto_item *ti;
6973 proto_tree *subtree;
6974 uint32_t dnames_length, next_offset;
6975 asn1_ctx_t asn1_ctx;
6976 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
6977
6978 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
6979 /* DistinguishedName certificate_authorities<0..2^16-1> */
6980 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
6981 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
6982 return offset_end;
6983 }
6984 offset += 2;
6985 next_offset = offset + dnames_length;
6986
6987 if (dnames_length > 0) {
6988 ti = proto_tree_add_none_format(tree,
6989 hf->hf.hs_dnames,
6990 tvb, offset, dnames_length,
6991 "Distinguished Names (%d byte%s)",
6992 dnames_length,
6993 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
6994 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
6995
6996 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
6997
6998 while (offset < next_offset) {
6999 /* get the length of the current certificate */
7000 uint32_t name_length;
7001
7002 if (dnames_count-- == 0) {
7003 /* stop adding to tree when the list is considered too large
7004 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7005 Note: dnames_count must be set low enough not to hit the
7006 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7007 */
7008 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7009 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7010 proto_item_set_generated(ti);
7011 return next_offset;
7012 }
7013
7014 /* opaque DistinguishedName<1..2^16-1> */
7015 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7016 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7017 return next_offset;
7018 }
7019 offset += 2;
7020
7021 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7022 subtree, hf->hf.hs_dname);
7023 offset += name_length;
7024 }
7025 }
7026 return offset;
7027} /* }}} */
7028
7029
7030/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7031static int
7032ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7033 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7034{
7035 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7036}
7037
7038static int
7039ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7040 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7041{
7042 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7043 hnd_type == SSL_HND_CERT_REQUEST) {
7044 /*
7045 * struct {
7046 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7047 * } SignatureSchemeList;
7048 */
7049
7050 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7051 } else {
7052 asn1_ctx_t asn1_ctx;
7053 unsigned pubkey_length, sign_length;
7054
7055 /*
7056 * struct {
7057 * uint32 valid_time;
7058 * SignatureScheme expected_cert_verify_algorithm;
7059 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7060 * } Credential;
7061 *
7062 * struct {
7063 * Credential cred;
7064 * SignatureScheme algorithm;
7065 * opaque signature<0..2^16-1>;
7066 * } DelegatedCredential;
7067 */
7068
7069 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7070
7071 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7072 offset += 4;
7073
7074 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7075 offset += 2;
7076
7077 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7078 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7079 return offset_end;
7080 }
7081 offset += 3;
7082 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7083 offset += pubkey_length;
7084
7085 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7086 offset += 2;
7087
7088 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7089 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7090 return offset_end;
7091 }
7092 offset += 2;
7093 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7094 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7095 offset += sign_length;
7096
7097 return offset;
7098 }
7099}
7100
7101static int
7102ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7103 packet_info *pinfo, proto_tree *tree,
7104 uint32_t offset, uint32_t offset_end,
7105 uint8_t hnd_type)
7106{
7107
7108 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7109
7110 switch (hnd_type) {
7111 case SSL_HND_CLIENT_HELLO: {
7112 proto_tree *alps_tree;
7113 proto_item *ti;
7114 uint32_t next_offset, alps_length, name_length;
7115
7116 /*
7117 * opaque ProtocolName<1..2^8-1>;
7118 * struct {
7119 * ProtocolName supported_protocols<2..2^16-1>
7120 * } ApplicationSettingsSupport;
7121 */
7122
7123 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7124 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7125 return offset_end;
7126 }
7127 offset += 2;
7128 next_offset = offset + alps_length;
7129
7130 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7131 tvb, offset, alps_length, ENC_NA0x00000000);
7132 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7133
7134 /* Parse list (note missing check for end of vector, ssl_add_vector below
7135 * ensures that data is always available.) */
7136 while (offset < next_offset) {
7137 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7138 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7139 return next_offset;
7140 }
7141 offset++;
7142
7143 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7144 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7145 offset += name_length;
7146 }
7147
7148 return offset;
7149 }
7150 case SSL_HND_ENCRYPTED_EXTS:
7151 /* Opaque blob */
7152 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7153 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7154 break;
7155 }
7156
7157 return offset_end;
7158}
7159
7160static int
7161ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7162 packet_info *pinfo, proto_tree *tree,
7163 uint32_t offset, uint32_t offset_end,
7164 uint8_t hnd_type, SslSession *session,
7165 bool_Bool is_dtls, ja4_data_t *ja4_data)
7166{
7167
7168 /* https://tools.ietf.org/html/rfc7301#section-3.1
7169 * opaque ProtocolName<1..2^8-1>;
7170 * struct {
7171 * ProtocolName protocol_name_list<2..2^16-1>
7172 * } ProtocolNameList;
7173 */
7174 proto_tree *alpn_tree;
7175 proto_item *ti;
7176 uint32_t next_offset, alpn_length, name_length;
7177 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7178
7179 /* ProtocolName protocol_name_list<2..2^16-1> */
7180 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7181 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7182 return offset_end;
7183 }
7184 offset += 2;
7185 next_offset = offset + alpn_length;
7186
7187 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7188 tvb, offset, alpn_length, ENC_NA0x00000000);
7189 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7190
7191 /* Parse list (note missing check for end of vector, ssl_add_vector below
7192 * ensures that data is always available.) */
7193 while (offset < next_offset) {
7194 /* opaque ProtocolName<1..2^8-1> */
7195 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7196 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7197 return next_offset;
7198 }
7199 offset++;
7200
7201 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7202 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7203 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7204 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7205 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7206 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7207 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7208 }
7209 else {
7210 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7211 alpn_last_char & 0x0F);
7212 }
7213 }
7214 /* Remember first ALPN ProtocolName entry for server. */
7215 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7216 /* '\0'-terminated string for dissector table match and prefix
7217 * comparison purposes. */
7218 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7219 name_length, ENC_ASCII0x00000000);
7220 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7221 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7222 name_length, ENC_ASCII0x00000000);
7223 }
7224 offset += name_length;
7225 }
7226
7227 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7228 * exactly one "ProtocolName". */
7229 if (proto_name) {
7230 dissector_handle_t handle;
7231
7232 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7233
7234 if (is_dtls) {
7235 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7236 proto_name);
7237 } else {
7238 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7239 proto_name);
7240 if (handle == NULL((void*)0)) {
7241 /* Try prefix matching */
7242 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7243 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7244
7245 /* string_string is inappropriate as it compares strings
7246 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7247 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7248 handle = find_dissector(alpn_proto->dissector_name);
7249 break;
7250 }
7251 }
7252 }
7253 }
7254 if (handle != NULL((void*)0)) {
7255 /* ProtocolName match, so set the App data dissector handle.
7256 * This may override protocols given via the UAT dialog, but
7257 * since the ALPN hint is precise, do it anyway. */
7258 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7259 (void *)session->app_handle,
7260 (void *)handle,
7261 dissector_handle_get_dissector_name(handle));
7262 session->app_handle = handle;
7263 }
7264 } else if (client_proto_name) {
7265 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7266 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7267 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7268 }
7269
7270 return offset;
7271}
7272
7273static int
7274ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7275 packet_info *pinfo, proto_tree *tree,
7276 uint32_t offset, uint32_t offset_end)
7277{
7278 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7279 * The "extension_data" field of a "next_protocol_negotiation" extension
7280 * in a "ServerHello" contains an optional list of protocols advertised
7281 * by the server. Protocols are named by opaque, non-empty byte strings
7282 * and the list of protocols is serialized as a concatenation of 8-bit,
7283 * length prefixed byte strings. Implementations MUST ensure that the
7284 * empty string is not included and that no byte strings are truncated.
7285 */
7286 uint32_t npn_length;
7287 proto_tree *npn_tree;
7288
7289 /* List is optional, do not add tree if there are no entries. */
7290 if (offset == offset_end) {
7291 return offset;
7292 }
7293
7294 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7295
7296 while (offset < offset_end) {
7297 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7298 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7299 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7300 return offset_end;
7301 }
7302 offset++;
7303
7304 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7305 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7306 offset += npn_length;
7307 }
7308
7309 return offset;
7310}
7311
7312static int
7313ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7314 packet_info *pinfo, proto_tree *tree,
7315 uint32_t offset, uint32_t offset_end)
7316{
7317 /* https://tools.ietf.org/html/rfc5746#section-3.2
7318 * struct {
7319 * opaque renegotiated_connection<0..255>;
7320 * } RenegotiationInfo;
7321 *
7322 */
7323 proto_tree *reneg_info_tree;
7324 uint32_t reneg_info_length;
7325
7326 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7327
7328 /* opaque renegotiated_connection<0..255> */
7329 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7330 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7331 return offset_end;
7332 }
7333 offset++;
7334
7335 if (reneg_info_length > 0) {
7336 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7337 offset += reneg_info_length;
7338 }
7339
7340 return offset;
7341}
7342
7343static int
7344ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7345 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7346 const char **group_name_out)
7347{
7348 /* RFC 8446 Section 4.2.8
7349 * struct {
7350 * NamedGroup group;
7351 * opaque key_exchange<1..2^16-1>;
7352 * } KeyShareEntry;
7353 */
7354 uint32_t key_exchange_length, group;
7355 proto_tree *ks_tree;
7356
7357 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7358
7359 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7360 offset += 2;
7361 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7362 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7363 if (group_name_out) {
7364 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7365 }
7366
7367 /* opaque key_exchange<1..2^16-1> */
7368 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7369 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7370 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7371 }
7372 offset += 2;
7373 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7374 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7375
7376 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7377 offset += key_exchange_length;
7378
7379 return offset;
7380}
7381
7382static int
7383ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7384 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7385 uint8_t hnd_type, SslDecryptSession *ssl)
7386{
7387 proto_tree *key_share_tree;
7388 uint32_t next_offset;
7389 uint32_t client_shares_length;
7390 uint32_t group;
7391 const char *group_name = NULL((void*)0);
7392
7393 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7394 return offset;
7395 }
7396
7397 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7398
7399 switch(hnd_type){
7400 case SSL_HND_CLIENT_HELLO:
7401 /* KeyShareEntry client_shares<0..2^16-1> */
7402 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7403 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7404 return offset_end;
7405 }
7406 offset += 2;
7407 next_offset = offset + client_shares_length;
7408 const char *sep = " ";
7409 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7410 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7411 if (group_name) {
7412 proto_item_append_text(tree, "%s%s", sep, group_name);
7413 sep = ", ";
7414 }
7415 }
7416 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7417 return next_offset;
7418 }
7419 break;
7420 case SSL_HND_SERVER_HELLO:
7421 if (ssl) {
7422 ssl->has_key_share = true1;
7423 }
7424 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7425 if (group_name) {
7426 proto_item_append_text(tree, " %s", group_name);
7427 }
7428 break;
7429 case SSL_HND_HELLO_RETRY_REQUEST:
7430 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7431 offset += 2;
7432 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7433 proto_item_append_text(tree, " %s", group_name);
7434 break;
7435 default: /* no default */
7436 break;
7437 }
7438
7439 return offset;
7440}
7441
7442static int
7443ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7444 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7445 uint8_t hnd_type, SslDecryptSession *ssl)
7446{
7447 /* RFC 8446 Section 4.2.11
7448 * struct {
7449 * opaque identity<1..2^16-1>;
7450 * uint32 obfuscated_ticket_age;
7451 * } PskIdentity;
7452 * opaque PskBinderEntry<32..255>;
7453 * struct {
7454 * select (Handshake.msg_type) {
7455 * case client_hello:
7456 * PskIdentity identities<7..2^16-1>;
7457 * PskBinderEntry binders<33..2^16-1>;
7458 * case server_hello:
7459 * uint16 selected_identity;
7460 * };
7461 * } PreSharedKeyExtension;
7462 */
7463
7464 proto_tree *psk_tree;
7465
7466 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7467
7468 switch (hnd_type){
7469 case SSL_HND_CLIENT_HELLO: {
7470 uint32_t identities_length, identities_end, binders_length;
7471
7472 /* PskIdentity identities<7..2^16-1> */
7473 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7474 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7475 return offset_end;
7476 }
7477 offset += 2;
7478 identities_end = offset + identities_length;
7479
7480 while (offset < identities_end) {
7481 uint32_t identity_length;
7482 proto_tree *identity_tree;
7483
7484 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7485
7486 /* opaque identity<1..2^16-1> */
7487 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7488 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7489 return identities_end;
7490 }
7491 offset += 2;
7492 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7493
7494 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7495 offset += identity_length;
7496
7497 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7498 offset += 4;
7499
7500 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7501 }
7502 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7503 offset = identities_end;
7504 }
7505
7506 /* PskBinderEntry binders<33..2^16-1> */
7507 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7508 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7509 return offset_end;
7510 }
7511 offset += 2;
7512
7513 proto_item *binders_item;
7514 proto_tree *binders_tree;
7515 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7516 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7517 uint32_t binders_end = offset + binders_length;
7518 while (offset < binders_end) {
7519 uint32_t binder_length;
7520 proto_item *binder_item;
7521 proto_tree *binder_tree;
7522
7523 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7524 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7525
7526 /* opaque PskBinderEntry<32..255>; */
7527 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7528 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7529 return binders_end;
7530 }
7531 offset += 1;
7532 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7533
7534 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7535 offset += binder_length;
7536
7537 proto_item_set_end(binder_item, tvb, offset);
7538 }
7539 }
7540 break;
7541 case SSL_HND_SERVER_HELLO: {
7542 if (ssl) {
7543 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7544 ssl->has_psk = true1;
7545 }
7546 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7547 offset += 2;
7548 }
7549 break;
7550 default:
7551 break;
7552 }
7553
7554 return offset;
7555}
7556
7557static uint32_t
7558ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7559 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7560 uint8_t hnd_type, SslDecryptSession *ssl)
7561{
7562 /* RFC 8446 Section 4.2.10
7563 * struct {} Empty;
7564 * struct {
7565 * select (Handshake.msg_type) {
7566 * case new_session_ticket: uint32 max_early_data_size;
7567 * case client_hello: Empty;
7568 * case encrypted_extensions: Empty;
7569 * };
7570 * } EarlyDataIndication;
7571 */
7572 switch (hnd_type) {
7573 case SSL_HND_CLIENT_HELLO:
7574 /* Remember that early_data will follow the handshake. */
7575 if (ssl) {
7576 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7577 ssl->has_early_data = true1;
7578 }
7579 break;
7580 case SSL_HND_NEWSESSION_TICKET:
7581 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7582 offset += 4;
7583 break;
7584 default:
7585 break;
7586 }
7587 return offset;
7588}
7589
7590static uint16_t
7591tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7592{
7593 if (draft_version) {
7594 *draft_version = 0;
7595 }
7596 if (!is_dtls) {
7597 uint8_t tls13_draft = extract_tls13_draft_version(version);
7598 if (tls13_draft != 0) {
7599 /* This is TLS 1.3 (a draft version). */
7600 if (draft_version) {
7601 *draft_version = tls13_draft;
7602 }
7603 version = TLSV1DOT3_VERSION0x304;
7604 }
7605 if (version == 0xfb17 || version == 0xfb1a) {
7606 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7607 tls13_draft = (uint8_t)version;
7608 if (draft_version) {
7609 *draft_version = tls13_draft;
7610 }
7611 version = TLSV1DOT3_VERSION0x304;
7612 }
7613 }
7614
7615 switch (version) {
7616 case SSLV3_VERSION0x300:
7617 case TLSV1_VERSION0x301:
7618 case TLSV1DOT1_VERSION0x302:
7619 case TLSV1DOT2_VERSION0x303:
7620 case TLSV1DOT3_VERSION0x304:
7621 case TLCPV1_VERSION0x101:
7622 if (is_dtls)
7623 return SSL_VER_UNKNOWN0;
7624 break;
7625
7626 case DTLSV1DOT0_VERSION0xfeff:
7627 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7628 case DTLSV1DOT2_VERSION0xfefd:
7629 case DTLSV1DOT3_VERSION0xfefc:
7630 if (!is_dtls)
7631 return SSL_VER_UNKNOWN0;
7632 break;
7633
7634 default: /* invalid version number */
7635 return SSL_VER_UNKNOWN0;
7636 }
7637
7638 return version;
7639}
7640
7641static int
7642ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7643 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7644 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7645{
7646
7647 /* RFC 8446 Section 4.2.1
7648 * struct {
7649 * ProtocolVersion versions<2..254>; // ClientHello
7650 * } SupportedVersions;
7651 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7652 */
7653 uint32_t versions_length, next_offset;
7654 /* ProtocolVersion versions<2..254> */
7655 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7656 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7657 return offset_end;
7658 }
7659 offset++;
7660 next_offset = offset + versions_length;
7661
7662 unsigned version;
7663 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7664 uint8_t draft_version, max_draft_version = 0;
7665 const char *sep = " ";
7666 while (offset + 2 <= next_offset) {
7667 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7668 offset += 2;
7669
7670 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7671 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7672 sep = ", ";
7673 }
7674
7675 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7676 if (session->version == SSL_VER_UNKNOWN0) {
7677 if (lowest_version == SSL_VER_UNKNOWN0) {
7678 lowest_version = current_version;
7679 } else if (current_version != SSL_VER_UNKNOWN0) {
7680 if (!is_dtls) {
7681 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7682 } else {
7683 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7684 }
7685 }
7686 }
7687 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7688 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7689 /* The DTLS version numbers get mapped to "00" for unknown per
7690 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7691 * need to take the MIN instead of MAX here for DTLS.
7692 */
7693 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7694 }
7695 }
7696 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7697 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7698 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7699 }
7700 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7701 offset = next_offset;
7702 }
7703
7704 /* XXX remove this when draft 19 support is dropped,
7705 * this is only required for early data decryption. */
7706 if (max_draft_version) {
7707 session->tls13_draft_version = max_draft_version;
7708 }
7709
7710 return offset;
7711}
7712
7713static int
7714ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7715 packet_info *pinfo, proto_tree *tree,
7716 uint32_t offset, uint32_t offset_end)
7717{
7718 /* RFC 8446 Section 4.2.2
7719 * struct {
7720 * opaque cookie<1..2^16-1>;
7721 * } Cookie;
7722 */
7723 uint32_t cookie_length;
7724 /* opaque cookie<1..2^16-1> */
7725 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7726 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7727 return offset_end;
7728 }
7729 offset += 2;
7730
7731 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7732 offset += cookie_length;
7733
7734 return offset;
7735}
7736
7737static int
7738ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7739 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7740{
7741 /* RFC 8446 Section 4.2.9
7742 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7743 *
7744 * struct {
7745 * PskKeyExchangeMode ke_modes<1..255>;
7746 * } PskKeyExchangeModes;
7747 */
7748 uint32_t ke_modes_length, next_offset;
7749
7750 /* PskKeyExchangeMode ke_modes<1..255> */
7751 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7752 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7753 return offset_end;
7754 }
7755 offset++;
7756 next_offset = offset + ke_modes_length;
7757
7758 while (offset < next_offset) {
7759 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7760 offset++;
7761 }
7762
7763 return offset;
7764}
7765
7766static uint32_t
7767ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7768 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7769{
7770 /* RFC 8446 Section 4.2.4
7771 * opaque DistinguishedName<1..2^16-1>;
7772 * struct {
7773 * DistinguishedName authorities<3..2^16-1>;
7774 * } CertificateAuthoritiesExtension;
7775 */
7776 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7777}
7778
7779static int
7780ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7781 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7782{
7783 /* RFC 8446 Section 4.2.5
7784 * struct {
7785 * opaque certificate_extension_oid<1..2^8-1>;
7786 * opaque certificate_extension_values<0..2^16-1>;
7787 * } OIDFilter;
7788 * struct {
7789 * OIDFilter filters<0..2^16-1>;
7790 * } OIDFilterExtension;
7791 */
7792 proto_tree *subtree;
7793 uint32_t filters_length, oid_length, values_length, value_offset;
7794 asn1_ctx_t asn1_ctx;
7795 const char *oid, *name;
7796
7797 /* OIDFilter filters<0..2^16-1> */
7798 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
7799 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
7800 return offset_end;
7801 }
7802 offset += 2;
7803 offset_end = offset + filters_length;
7804
7805 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7806
7807 while (offset < offset_end) {
7808 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
7809 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
7810
7811 /* opaque certificate_extension_oid<1..2^8-1> */
7812 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
7813 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
7814 return offset_end;
7815 }
7816 offset++;
7817 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
7818 hf->hf.hs_ext_oid_filters_oid, &oid);
7819 offset += oid_length;
7820
7821 /* Append OID to tree label */
7822 name = oid_resolved_from_string(pinfo->pool, oid);
7823 proto_item_append_text(subtree, " (%s)", name ? name : oid);
7824
7825 /* opaque certificate_extension_values<0..2^16-1> */
7826 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
7827 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
7828 return offset_end;
7829 }
7830 offset += 2;
7831 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
7832 if (values_length > 0) {
7833 value_offset = offset;
7834 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
7835 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
7836 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
7837 }
7838 offset += values_length;
7839 }
7840
7841 return offset;
7842}
7843
7844static int
7845ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7846 packet_info *pinfo, proto_tree *tree,
7847 uint32_t offset, uint32_t offset_end)
7848{
7849 /* https://tools.ietf.org/html/rfc6066#section-3
7850 *
7851 * struct {
7852 * NameType name_type;
7853 * select (name_type) {
7854 * case host_name: HostName;
7855 * } name;
7856 * } ServerName;
7857 *
7858 * enum {
7859 * host_name(0), (255)
7860 * } NameType;
7861 *
7862 * opaque HostName<1..2^16-1>;
7863 *
7864 * struct {
7865 * ServerName server_name_list<1..2^16-1>
7866 * } ServerNameList;
7867 */
7868 proto_tree *server_name_tree;
7869 uint32_t list_length, server_name_length, next_offset;
7870
7871 /* The server SHALL include "server_name" extension with empty data. */
7872 if (offset == offset_end) {
7873 return offset;
7874 }
7875
7876 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
7877
7878 /* ServerName server_name_list<1..2^16-1> */
7879 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
7880 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
7881 return offset_end;
7882 }
7883 offset += 2;
7884 next_offset = offset + list_length;
7885
7886 while (offset < next_offset) {
7887 uint32_t name_type;
7888 const char *server_name = NULL((void*)0);
7889 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
7890 tvb, offset, 1, ENC_NA0x00000000, &name_type);
7891 offset++;
7892
7893 /* opaque HostName<1..2^16-1> */
7894 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
7895 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
7896 return next_offset;
7897 }
7898 offset += 2;
7899
7900 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
7901 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
7902 pinfo->pool, (const uint8_t**)&server_name);
7903 offset += server_name_length;
7904 // Each type must only occur once, so we don't check for duplicates.
7905 if (name_type == 0) {
7906 proto_item_append_text(tree, " name=%s", server_name);
7907 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
7908
7909 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
7910 // Client Hello: Client (Src) -> Server (Dst)
7911 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
7912 case AT_IPv4:
7913 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
7914 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7915 }
7916 break;
7917 case AT_IPv6:
7918 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
7919 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
7920 }
7921 break;
7922 }
7923 }
7924 }
7925 }
7926 return offset;
7927}
7928
7929static int
7930ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7931 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
7932{
7933 unsigned ext_len = offset_end - offset;
7934 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
7935 tvb_ensure_bytes_exist(tvb, offset, ext_len);
7936 /* Save the Session Ticket such that it can be used as identifier for
7937 * restoring a previous Master Secret (in ChangeCipherSpec) */
7938 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
7939 ssl->session_ticket.data, ext_len);
7940 ssl->session_ticket.data_len = ext_len;
7941 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
7942 }
7943 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
7944 tvb, offset, ext_len, ENC_NA0x00000000);
7945 return offset + ext_len;
7946}
7947
7948static int
7949ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7950 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7951 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
7952{
7953 uint8_t cert_list_length;
7954 uint8_t cert_type;
7955 proto_tree *cert_list_tree;
7956 proto_item *ti;
7957
7958 switch(hnd_type){
7959 case SSL_HND_CLIENT_HELLO:
7960 cert_list_length = tvb_get_uint8(tvb, offset);
7961 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
7962 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7963 offset += 1;
7964 if (offset_end - offset != (uint32_t)cert_list_length)
7965 return offset;
7966
7967 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
7968 cert_list_length, cert_list_length);
7969 proto_item_append_text(ti, " (%d)", cert_list_length);
7970
7971 /* make this a subtree */
7972 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
7973
7974 /* loop over all point formats */
7975 while (cert_list_length > 0)
7976 {
7977 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7978 offset++;
7979 cert_list_length--;
7980 }
7981 break;
7982 case SSL_HND_SERVER_HELLO:
7983 case SSL_HND_ENCRYPTED_EXTENSIONS:
7984 case SSL_HND_CERTIFICATE:
7985 cert_type = tvb_get_uint8(tvb, offset);
7986 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
7987 offset += 1;
7988 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
7989 session->client_cert_type = cert_type;
7990 }
7991 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
7992 session->server_cert_type = cert_type;
7993 }
7994 break;
7995 default: /* no default */
7996 break;
7997 }
7998
7999 return offset;
8000}
8001
8002static uint32_t
8003ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8004 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8005 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8006{
8007 uint32_t compress_certificate_algorithms_length, next_offset;
8008
8009 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8010 * enum {
8011 * zlib(1),
8012 * brotli(2),
8013 * (65535)
8014 * } CertificateCompressionAlgorithm;
8015 *
8016 * struct {
8017 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8018 * } CertificateCompressionAlgorithms;
8019 */
8020 switch (hnd_type) {
8021 case SSL_HND_CLIENT_HELLO:
8022 case SSL_HND_CERT_REQUEST:
8023 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8024 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8025 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8026 return offset_end;
8027 }
8028 offset += 1;
8029 next_offset = offset + compress_certificate_algorithms_length;
8030
8031 while (offset < next_offset) {
8032 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8033 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8034 offset += 2;
8035 }
8036 break;
8037 default:
8038 break;
8039 }
8040
8041 return offset;
8042}
8043
8044static uint32_t
8045ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8046 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8047 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8048{
8049 uint32_t key_parameters_length, next_offset;
8050 proto_item *p_ti;
8051 proto_tree *p_tree;
8052
8053 /* RFC 8472
8054 *
8055 * struct {
8056 * uint8 major;
8057 * uint8 minor;
8058 * } TB_ProtocolVersion;
8059 *
8060 * enum {
8061 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8062 * } TokenBindingKeyParameters;
8063 *
8064 * struct {
8065 * TB_ProtocolVersion token_binding_version;
8066 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8067 * } TokenBindingParameters;
8068 */
8069
8070 switch (hnd_type) {
8071 case SSL_HND_CLIENT_HELLO:
8072 case SSL_HND_SERVER_HELLO:
8073 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8074 offset += 1;
8075 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8076 offset += 1;
8077
8078 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8079 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8080 return offset_end;
8081 }
8082 offset += 1;
8083 next_offset = offset + key_parameters_length;
8084
8085 p_ti = proto_tree_add_none_format(tree,
8086 hf->hf.hs_ext_token_binding_key_parameters,
8087 tvb, offset, key_parameters_length,
8088 "Key parameters identifiers (%d identifier%s)",
8089 key_parameters_length,
8090 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8091 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8092
8093 while (offset < next_offset) {
8094 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8095 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8096 offset += 1;
8097 }
8098
8099 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8100 offset = next_offset;
8101 }
8102
8103 break;
8104 default:
8105 break;
8106 }
8107
8108 return offset;
8109}
8110
8111static uint32_t
8112ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8113 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8114 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8115{
8116 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8117 uint32_t next_offset;
8118
8119 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8120 *
8121 * Note: the following structures are not literally defined in the spec,
8122 * they instead use an ASCII diagram.
8123 *
8124 * struct {
8125 * uint16 id;
8126 * opaque value<0..2^16-1>;
8127 * } TransportParameter; // before draft -27
8128 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8129 *
8130 * struct {
8131 * opaque ipv4Address[4];
8132 * uint16 ipv4Port;
8133 * opaque ipv6Address[16];
8134 * uint16 ipv6Port;
8135 * opaque connectionId<0..18>;
8136 * opaque statelessResetToken[16];
8137 * } PreferredAddress;
8138 */
8139
8140 if (offset_end - offset >= 6 &&
8141 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8142 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8143 // Assume encoding of Transport Parameters draft -26 or older with at
8144 // least one transport parameter that has a valid length.
8145 use_varint_encoding = false0;
8146 }
8147
8148 if (use_varint_encoding) {
8149 next_offset = offset_end;
8150 } else {
8151 uint32_t quic_length;
8152 // Assume draft -26 or earlier.
8153 /* TransportParameter TransportParameters<0..2^16-1>; */
8154 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8155 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8156 return offset_end;
8157 }
8158 offset += 2;
8159 next_offset = offset + quic_length;
8160 }
8161
8162 while (offset < next_offset) {
8163 uint64_t parameter_type; /* 62-bit space */
8164 uint32_t parameter_length;
8165 proto_tree *parameter_tree;
8166 uint32_t parameter_end_offset;
8167 uint64_t value;
8168 uint32_t i;
8169 unsigned len = 0;
8170
8171 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8172 NULL((void*)0), "Parameter");
8173 /* TransportParameter ID and Length. */
8174 if (use_varint_encoding) {
8175 uint64_t parameter_length64;
8176 unsigned type_len = 0;
8177
8178 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8179 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8180 offset += type_len;
8181
8182 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8183 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8184 parameter_length = (uint32_t)parameter_length64;
8185 offset += len;
8186
8187 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8188 } else {
8189 parameter_type = tvb_get_ntohs(tvb, offset);
8190 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8191 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8192 offset += 2;
8193
8194 /* opaque value<0..2^16-1> */
8195 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8196 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8197 return next_offset;
8198 }
8199 offset += 2;
8200
8201 proto_item_set_len(parameter_tree, 4 + parameter_length);
8202 }
8203
8204 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8205 proto_item_append_text(parameter_tree, ": GREASE");
8206 } else {
8207 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8208 }
8209
8210 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8211 parameter_end_offset = offset + parameter_length;
8212
8213 /* Omit the value field if the parameter's length is 0. */
8214 if (parameter_length != 0) {
8215 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8216 tvb, offset, parameter_length, ENC_NA0x00000000);
8217 }
8218
8219 switch (parameter_type) {
8220 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8221 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8222 tvb, offset, parameter_length, ENC_NA0x00000000);
8223 offset += parameter_length;
8224 break;
8225 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8226 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8227 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8228 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8229 offset += len;
8230 break;
8231 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8232 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8233 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8234 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8235 offset += 16;
8236 break;
8237 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8238 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8239 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8240 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8241 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8242 offset += len;
8243 break;
8244 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8245 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8246 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8247 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8248 offset += len;
8249 break;
8250 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8251 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8252 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8253 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8254 offset += len;
8255 break;
8256 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8257 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8258 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8259 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8260 offset += len;
8261 break;
8262 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8263 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8264 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8265 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8266 offset += len;
8267 break;
8268 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8269 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8270 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8271 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8272 offset += len;
8273 break;
8274 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8275 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8276 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8277 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8278 offset += len;
8279 break;
8280 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8281 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8282 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8283 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8284 offset += len;
8285 break;
8286 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8287 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8288 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8289 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8290 offset += len;
8291 break;
8292 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8293 /* No Payload */
8294 break;
8295 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8296 uint32_t connectionid_length;
8297 quic_cid_t cid;
8298
8299 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8300 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8301 offset += 4;
8302 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8303 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8304 offset += 2;
8305 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8306 tvb, offset, 16, ENC_NA0x00000000);
8307 offset += 16;
8308 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8309 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8310 offset += 2;
8311 /* XXX - Should we add these addresses and ports as addresses that the client
8312 * is allowed / expected to migrate the server address to? Right now we don't
8313 * enforce that (see RFC 9000 Section 9, which implies that while the client
8314 * can migrate to whatever address it wants, it can only migrate the server
8315 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8316 */
8317
8318 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8319 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8320 break;
8321 }
8322 offset += 1;
8323
8324 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8325 tvb, offset, connectionid_length, ENC_NA0x00000000);
8326 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8327 cid.len = connectionid_length;
8328 // RFC 9000 5.1.1 "If the preferred_address transport
8329 // parameter is sent, the sequence number of the supplied
8330 // connection ID is 1."
8331 cid.seq_num = 1;
8332 // Multipath draft-07 "Also, the Path Identifier for the
8333 // connection ID specified in the "preferred address"
8334 // transport parameter is 0."
8335 cid.path_id = 0;
8336 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8337 quic_add_connection(pinfo, &cid);
8338 }
8339 offset += connectionid_length;
8340
8341 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8342 tvb, offset, 16, ENC_NA0x00000000);
8343 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8344 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8345 }
8346 offset += 16;
8347 }
8348 break;
8349 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8350 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8351 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8352 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8353 offset += len;
8354 break;
8355 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8356 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8357 tvb, offset, parameter_length, ENC_NA0x00000000);
8358 offset += parameter_length;
8359 break;
8360 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8361 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8362 tvb, offset, parameter_length, ENC_NA0x00000000);
8363 offset += parameter_length;
8364 break;
8365 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8366 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8367 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8368 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8369 offset += len;
8370 break;
8371 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8372 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8373 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8374 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8375 offset += len;
8376 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8377 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8378 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8379 offset += len;
8380 break;
8381 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8382 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8383 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8384 if (len > 0) {
8385 quic_add_loss_bits(pinfo, value);
8386 }
8387 offset += 1;
8388 break;
8389 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8390 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8391 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8392 offset += len;
8393 break;
8394 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8395 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8396 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8397 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8398 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8399 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8400 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8401 offset += len;
8402 break;
8403 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8404 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8405 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8406 offset += parameter_length;
8407 break;
8408 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8409 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8410 tvb, offset, parameter_length, ENC_NA0x00000000);
8411 offset += parameter_length;
8412 break;
8413 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8414 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8415 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8416 offset += 4;
8417 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8418 uint32_t versions_length;
8419
8420 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8421 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8422 offset += 1;
8423 for (i = 0; i < versions_length / 4; i++) {
8424 quic_proto_tree_add_version(tvb, parameter_tree,
8425 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8426 offset += 4;
8427 }
8428 }
8429 break;
8430 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8431 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8432 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8433 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8434 offset += len;
8435 break;
8436 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8437 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8438 tvb, offset, parameter_length, ENC_NA0x00000000);
8439 offset += parameter_length;
8440 break;
8441 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8442 /* This field was used for non-standard Google-specific parameters encoded as a
8443 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8444 * parameters. Report it as a bytes blob... */
8445 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8446 tvb, offset, parameter_length, ENC_NA0x00000000);
8447 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8448 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8449 tvb, offset, 4, ENC_NA0x00000000);
8450 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8451 offset += parameter_length;
8452 break;
8453 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8454 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8455 tvb, offset, parameter_length, ENC_NA0x00000000);
8456 offset += parameter_length;
8457 break;
8458 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8459 /* No Payload */
8460 break;
8461 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8462 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8463 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8464 offset += parameter_length;
8465 break;
8466 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8467 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8468 quic_proto_tree_add_version(tvb, parameter_tree,
8469 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8470 offset += 4;
8471 for (i = 4; i < parameter_length; i += 4) {
8472 quic_proto_tree_add_version(tvb, parameter_tree,
8473 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8474 offset += 4;
8475 }
8476 break;
8477 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8478 /* No Payload */
8479 quic_add_grease_quic_bit(pinfo);
8480 break;
8481 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8482 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8483 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8484 offset += parameter_length;
8485 break;
8486 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8487 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8488 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8489 if (value == 1) {
8490 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8491 }
8492 offset += parameter_length;
8493 break;
8494 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8495 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8496 /* No Payload */
8497 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8498 break;
8499 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8500 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8501 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8502 if (value > 1) {
8503 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8504 }
8505 /* multipath draft-07: "The value of the initial_max_paths
8506 * parameter MUST be at least 2." TODO: Expert Info? */
8507 offset += parameter_length;
8508 break;
8509 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8510 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8511 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8512 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8513 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8514 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8515 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8516 /* multipath draft-09 and later: "If an endpoint receives an
8517 * initial_max_path_id transport parameter with value 0, the
8518 * peer aims to enable the multipath extension without allowing
8519 * extra paths immediately."
8520 */
8521 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8522 offset += parameter_length;
8523 break;
8524 default:
8525 offset += parameter_length;
8526 /*TODO display expert info about unknown ? */
8527 break;
8528 }
8529
8530 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8531 /* Dissection did not end at expected location, fix it. */
8532 offset = parameter_end_offset;
8533 }
8534 }
8535
8536 return offset;
8537}
8538
8539typedef struct tls_ech_confirm {
8540 tvbuff_t *confirm_tvb;
8541 proto_item *parent_item;
8542} tls_ech_confirm_t;
8543
8544static int
8545ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8546 proto_tree *tree, uint32_t offset,
8547 SslSession *session, SslDecryptSession *ssl,
8548 bool_Bool from_server, bool_Bool is_hrr)
8549{
8550 uint8_t sessid_length;
8551 proto_tree *rnd_tree;
8552 proto_tree *ti_rnd;
8553 uint8_t draft_version = session->tls13_draft_version;
8554
8555 if (ssl) {
8556 StringInfo *rnd;
8557 if (from_server)
8558 rnd = &ssl->server_random;
8559 else
8560 rnd = &ssl->client_random;
8561
8562 /* save provided random for later keyring generation */
8563 tvb_memcpy(tvb, rnd->data, offset, 32);
8564 rnd->data_len = 32;
8565 if (from_server)
8566 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8567 else
8568 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8569 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8570 from_server ? "SERVER" : "CLIENT", ssl->state);
8571 }
8572
8573 if (!from_server && session->client_random.data_len == 0) {
8574 session->client_random.data_len = 32;
8575 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8576 }
8577
8578 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8579
8580 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8581
8582 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8583 /* show the time */
8584 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8585 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8586 offset += 4;
8587
8588 /* show the random bytes */
8589 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8590 tvb, offset, 28, ENC_NA0x00000000);
8591 offset += 28;
8592 } else {
8593 if (is_hrr) {
8594 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8595 } else if (from_server && (session->ech || (ssl && ssl->ech_transcript.data_len))) {
8596 /* We can't calculate the transcript hash until we have the Cipher
8597 * Suite, which comes later, so save this so we can show it in the
8598 * tree on the first pass. */
8599 tls_ech_confirm_t *ech_confirm = wmem_new(pinfo->pool, tls_ech_confirm_t)((tls_ech_confirm_t*)wmem_alloc((pinfo->pool), sizeof(tls_ech_confirm_t
)));
8600 ech_confirm->parent_item = ti_rnd;
8601 ech_confirm->confirm_tvb = tvb_new_subset_length(tvb, offset + 24, 8);
8602 /* We can use a hf id instead of a proto id (they're allocated from
8603 * the same pool and the latter are just a subset of the former),
8604 * which is convenient as we don't seem to store the proto id (TLS v
8605 * DTLS) in ssl_common_dissect_t or anywhere else. Arguably it
8606 * relies on undocumented behavior, though using it as the key too
8607 * means that the chance of collision is ~zero even if behavior
8608 * changes.
8609 */
8610 p_add_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm, ech_confirm);
8611 }
8612
8613 offset += 32;
8614 }
8615
8616 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8617 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8618 /* show the session id (length followed by actual Session ID) */
8619 sessid_length = tvb_get_uint8(tvb, offset);
8620 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8621 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8622 offset++;
8623
8624 if (ssl) {
8625 /* save the authoritative SID for later use in ChangeCipherSpec.
8626 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8627 * save more, so ignore larger ones. To support ECH, also save
8628 * the SID from the ClientHelloOuter. */
8629 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8630 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8631 ssl->session_id.data_len = sessid_length;
8632 }
8633 }
8634 if (sessid_length > 0) {
8635 proto_tree_add_item(tree, hf->hf.hs_session_id,
8636 tvb, offset, sessid_length, ENC_NA0x00000000);
8637 offset += sessid_length;
8638 }
8639 }
8640
8641 return offset;
8642}
8643
8644static int
8645ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8646 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8647 bool_Bool has_length)
8648{
8649 /* TLS 1.2/1.3 status_request Client Hello Extension.
8650 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8651 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8652 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8653 * struct {
8654 * CertificateStatusType status_type;
8655 * uint16 request_length; // for status_request_v2
8656 * select (status_type) {
8657 * case ocsp: OCSPStatusRequest;
8658 * case ocsp_multi: OCSPStatusRequest;
8659 * } request;
8660 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8661 *
8662 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8663 * struct {
8664 * ResponderID responder_id_list<0..2^16-1>;
8665 * Extensions request_extensions;
8666 * } OCSPStatusRequest;
8667 * opaque ResponderID<1..2^16-1>;
8668 * opaque Extensions<0..2^16-1>;
8669 */
8670 unsigned cert_status_type;
8671
8672 cert_status_type = tvb_get_uint8(tvb, offset);
8673 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8674 tvb, offset, 1, ENC_NA0x00000000);
8675 offset++;
8676
8677 if (has_length) {
8678 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8679 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8680 offset += 2;
8681 }
8682
8683 switch (cert_status_type) {
8684 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8685 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8686 {
8687 uint32_t responder_id_list_len;
8688 uint32_t request_extensions_len;
8689
8690 /* ResponderID responder_id_list<0..2^16-1> */
8691 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8692 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8693 return offset_end;
8694 }
8695 offset += 2;
8696 if (responder_id_list_len != 0) {
8697 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8698 tvb, offset, responder_id_list_len,
8699 "Responder ID list is not implemented, contact Wireshark"
8700 " developers if you want this to be supported");
8701 }
8702 offset += responder_id_list_len;
8703
8704 /* opaque Extensions<0..2^16-1> */
8705 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8706 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8707 return offset_end;
8708 }
8709 offset += 2;
8710 if (request_extensions_len != 0) {
8711 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8712 tvb, offset, request_extensions_len,
8713 "Request Extensions are not implemented, contact"
8714 " Wireshark developers if you want this to be supported");
8715 }
8716 offset += request_extensions_len;
8717 break;
8718 }
8719 }
8720
8721 return offset;
8722}
8723
8724static unsigned
8725ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8726 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8727{
8728 /* https://tools.ietf.org/html/rfc6961#section-2.2
8729 * struct {
8730 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8731 * } CertificateStatusRequestListV2;
8732 */
8733 uint32_t req_list_length, next_offset;
8734
8735 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8736 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8737 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8738 return offset_end;
8739 }
8740 offset += 2;
8741 next_offset = offset + req_list_length;
8742
8743 while (offset < next_offset) {
8744 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8745 }
8746
8747 return offset;
8748}
8749
8750static uint32_t
8751tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8752 uint32_t offset, uint32_t offset_end)
8753{
8754 uint32_t response_length;
8755 proto_item *ocsp_resp;
8756 proto_tree *ocsp_resp_tree;
8757 asn1_ctx_t asn1_ctx;
8758
8759 /* opaque OCSPResponse<1..2^24-1>; */
8760 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8761 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8762 return offset_end;
8763 }
8764 offset += 3;
8765
8766 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8767 response_length, ENC_BIG_ENDIAN0x00000000);
8768 proto_item_set_text(ocsp_resp, "OCSP Response");
8769 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8770 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8771 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8772 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8773 }
8774 offset += response_length;
8775
8776 return offset;
8777}
8778
8779uint32_t
8780tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8781 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8782{
8783 /* TLS 1.2 "CertificateStatus" handshake message.
8784 * TLS 1.3 "status_request" Certificate extension.
8785 * struct {
8786 * CertificateStatusType status_type;
8787 * select (status_type) {
8788 * case ocsp: OCSPResponse;
8789 * case ocsp_multi: OCSPResponseList; // status_request_v2
8790 * } response;
8791 * } CertificateStatus;
8792 * opaque OCSPResponse<1..2^24-1>;
8793 * struct {
8794 * OCSPResponse ocsp_response_list<1..2^24-1>;
8795 * } OCSPResponseList; // status_request_v2
8796 */
8797 uint32_t status_type, resp_list_length, next_offset;
8798
8799 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
8800 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
8801 offset += 1;
8802
8803 switch (status_type) {
8804 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8805 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
8806 break;
8807
8808 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8809 /* OCSPResponse ocsp_response_list<1..2^24-1> */
8810 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
8811 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8812 return offset_end;
8813 }
8814 offset += 3;
8815 next_offset = offset + resp_list_length;
8816
8817 while (offset < next_offset) {
8818 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
8819 }
8820 break;
8821 }
8822
8823 return offset;
8824}
8825
8826static unsigned
8827ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8828 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8829 wmem_strbuf_t *ja3)
8830{
8831 /* RFC 8446 Section 4.2.7
8832 * enum { ..., (0xFFFF) } NamedGroup;
8833 * struct {
8834 * NamedGroup named_group_list<2..2^16-1>
8835 * } NamedGroupList;
8836 *
8837 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
8838 * the extension itself from "elliptic_curves" to "supported_groups".
8839 */
8840 uint32_t groups_length, next_offset;
8841 proto_tree *groups_tree;
8842 proto_item *ti;
8843 char *ja3_dash = "";
8844
8845 /* NamedGroup named_group_list<2..2^16-1> */
8846 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
8847 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
8848 return offset_end;
8849 }
8850 offset += 2;
8851 next_offset = offset + groups_length;
8852
8853 ti = proto_tree_add_none_format(tree,
8854 hf->hf.hs_ext_supported_groups,
8855 tvb, offset, groups_length,
8856 "Supported Groups (%d group%s)",
8857 groups_length / 2,
8858 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
8859
8860 /* make this a subtree */
8861 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
8862
8863 if (ja3) {
8864 wmem_strbuf_append_c(ja3, ',');
8865 }
8866 /* loop over all groups */
8867 while (offset + 2 <= offset_end) {
8868 uint32_t ext_supported_group;
8869
8870 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
8871 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
8872 offset += 2;
8873 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
8874 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
8875 ja3_dash = "-";
8876 }
8877 }
8878 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
8879 offset = next_offset;
8880 }
8881
8882 return offset;
8883}
8884
8885static int
8886ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8887 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
8888{
8889 uint8_t ecpf_length;
8890 proto_tree *ecpf_tree;
8891 proto_item *ti;
8892
8893 ecpf_length = tvb_get_uint8(tvb, offset);
8894 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
8895 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8896
8897 offset += 1;
8898 ti = proto_tree_add_none_format(tree,
8899 hf->hf.hs_ext_ec_point_formats,
8900 tvb, offset, ecpf_length,
8901 "Elliptic curves point formats (%d)",
8902 ecpf_length);
8903
8904 /* make this a subtree */
8905 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
8906
8907 if (ja3) {
8908 wmem_strbuf_append_c(ja3, ',');
8909 }
8910
8911 /* loop over all point formats */
8912 while (ecpf_length > 0)
8913 {
8914 uint32_t ext_ec_point_format;
8915
8916 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
8917 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
8918 offset++;
8919 ecpf_length--;
8920 if (ja3) {
8921 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
8922 if (ecpf_length > 0) {
8923 wmem_strbuf_append_c(ja3, '-');
8924 }
8925 }
8926 }
8927
8928 return offset;
8929}
8930
8931static int
8932ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8933 packet_info *pinfo, proto_tree *tree,
8934 uint32_t offset, uint32_t next_offset)
8935{
8936 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
8937 * opaque srp_I<1..2^8-1>;
8938 */
8939 uint32_t username_len;
8940
8941 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
8942 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
8943 return next_offset;
8944 }
8945 offset++;
8946
8947 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
8948 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
8949 offset += username_len;
8950
8951 return offset;
8952}
8953
8954static uint32_t
8955tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8956 uint32_t offset, uint32_t offset_end, uint16_t version)
8957{
8958 /* https://tools.ietf.org/html/rfc6962#section-3.2
8959 * enum { v1(0), (255) } Version;
8960 * struct {
8961 * opaque key_id[32];
8962 * } LogID;
8963 * opaque CtExtensions<0..2^16-1>;
8964 * struct {
8965 * Version sct_version;
8966 * LogID id;
8967 * uint64 timestamp;
8968 * CtExtensions extensions;
8969 * digitally-signed struct { ... };
8970 * } SignedCertificateTimestamp;
8971 */
8972 uint32_t sct_version;
8973 uint64_t sct_timestamp_ms;
8974 nstime_t sct_timestamp;
8975 uint32_t exts_len;
8976 const char *log_name;
8977
8978 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
8979 offset++;
8980 if (sct_version != 0) {
8981 // TODO expert info about unknown SCT version?
8982 return offset;
8983 }
8984 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
8985 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
8986 proto_item_append_text(tree, " (%s)", log_name);
8987 offset += 32;
8988 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
8989 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
8990 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
8991 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
8992 offset += 8;
8993 /* opaque CtExtensions<0..2^16-1> */
8994 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
8995 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
8996 return offset_end;
8997 }
8998 offset += 2;
8999 if (exts_len > 0) {
9000 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9001 offset += exts_len;
9002 }
9003 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9004 hf->hf.sct_sct_signature_length,
9005 hf->hf.sct_sct_signature);
9006 return offset;
9007}
9008
9009uint32_t
9010tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9011 uint32_t offset, uint32_t offset_end, uint16_t version)
9012{
9013 /* https://tools.ietf.org/html/rfc6962#section-3.3
9014 * opaque SerializedSCT<1..2^16-1>;
9015 * struct {
9016 * SerializedSCT sct_list <1..2^16-1>;
9017 * } SignedCertificateTimestampList;
9018 */
9019 uint32_t list_length, sct_length, next_offset;
9020 proto_tree *subtree;
9021
9022 /* SerializedSCT sct_list <1..2^16-1> */
9023 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9024 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9025 return offset_end;
9026 }
9027 offset += 2;
9028
9029 while (offset < offset_end) {
9030 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9031
9032 /* opaque SerializedSCT<1..2^16-1> */
9033 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9034 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9035 return offset_end;
9036 }
9037 offset += 2;
9038 next_offset = offset + sct_length;
9039 proto_item_set_len(subtree, 2 + sct_length);
9040 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9041 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9042 offset = next_offset;
9043 }
9044 }
9045
9046 return offset;
9047}
9048
9049static int
9050dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9051 proto_tree *tree, uint32_t offset)
9052{
9053 uint32_t kdf_id, aead_id;
9054 proto_item *cs_ti;
9055 proto_tree *cs_tree;
9056
9057 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9058 tvb, offset, 4, ENC_NA0x00000000);
9059 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9060
9061 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9062 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9063 offset += 2;
9064 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9065 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9066 offset += 2;
9067
9068 proto_item_append_text(cs_ti, ": %s/%s",
9069 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9070 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9071 return offset;
9072}
9073
9074static int
9075dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9076 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9077 uint32_t *config_id)
9078{
9079 uint32_t length, cipher_suite_length;
9080 proto_item *kc_ti, *css_ti;
9081 proto_tree *kc_tree, *css_tree;
9082 uint32_t original_offset = offset, next_offset;
9083
9084 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9085 tvb, offset, -1, ENC_NA0x00000000);
9086 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9087
9088 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9089 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9090 offset += 1;
9091 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9092 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9093 offset += 2;
9094 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9095 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9096 offset += 2;
9097 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9098 tvb, offset, length, ENC_NA0x00000000);
9099 offset += length;
9100
9101 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9102 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9103 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9104 return offset_end;
9105 }
9106 offset += 2;
9107 next_offset = offset + cipher_suite_length;
9108
9109 css_ti = proto_tree_add_none_format(kc_tree,
9110 hf->hf.ech_hpke_keyconfig_cipher_suites,
9111 tvb, offset, cipher_suite_length,
9112 "Cipher Suites (%d suite%s)",
9113 cipher_suite_length / 4,
9114 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9115 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9116
9117
9118 while (offset + 4 <= next_offset) {
9119 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9120 }
9121
9122 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9123 offset = next_offset;
9124 }
9125
9126 proto_item_set_len(kc_ti, offset - original_offset);
9127
9128 return offset;
9129}
9130
9131static int
9132dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9133 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9134 const uint8_t **public_name, uint32_t *config_id)
9135{
9136 uint32_t public_name_length, extensions_length, next_offset;
9137
9138 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9139 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9140 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9141 offset += 1;
9142 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9143 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9144 offset += 1;
9145 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9146 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9147 offset += public_name_length;
9148
9149 /* Extension extensions<0..2^16-1>; */
9150 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9151 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9152 return offset_end;
9153 }
9154 offset += 2;
9155 next_offset = offset + extensions_length;
9156
9157 if (extensions_length > 0) {
9158 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9159 tvb, offset, extensions_length, ENC_NA0x00000000);
9160 }
9161 offset += extensions_length;
9162
9163 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9164 offset = next_offset;
9165 }
9166
9167 return offset;
9168}
9169
9170static int
9171dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9172 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9173{
9174 uint32_t version, length;
9175 proto_item *ech_ti;
9176 proto_tree *ech_tree;
9177 const uint8_t *public_name = NULL((void*)0);
9178 uint32_t config_id = 0;
9179
9180 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9181 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9182
9183 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9184 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9185 offset += 2;
9186 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9187 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9188 offset += 2;
9189
9190 proto_item_set_len(ech_ti, 4 + length);
9191
9192 switch(version) {
9193 case 0xfe0d:
9194 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9195 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9196 break;
9197
9198 default:
9199 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9200 }
9201
9202 return 4 + length;
9203}
9204
9205uint32_t
9206ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9207 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9208{
9209 uint32_t echconfiglist_length, next_offset;
9210
9211 /* ECHConfig ECHConfigList<1..2^16-1>; */
9212 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9213 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9214 return offset_end;
9215 }
9216 offset += 2;
9217 next_offset = offset + echconfiglist_length;
9218
9219 while (offset < next_offset) {
9220 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9221 }
9222
9223 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9224 offset = next_offset;
9225 }
9226
9227 return offset;
9228}
9229
9230static uint32_t
9231ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9232 uint32_t offset, uint32_t offset_end)
9233{
9234 uint32_t ext_length, next_offset;
9235 proto_tree *ext_tree;
9236 proto_item *ti;
9237
9238 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9239 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9240 return offset_end;
9241 }
9242 offset += 1;
9243 next_offset = offset + ext_length;
9244
9245 ti = proto_tree_add_none_format(tree,
9246 hf->hf.hs_ext_ech_outer_ext,
9247 tvb, offset, ext_length,
9248 "Outer Extensions (%d extension%s)",
9249 ext_length / 2,
9250 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9251
9252 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9253
9254 while (offset + 2 <= offset_end) {
9255 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9256 offset += 2;
9257 }
9258
9259 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9260 offset = next_offset;
9261 }
9262
9263 return offset;
9264}
9265
9266static uint32_t
9267// NOLINTNEXTLINE(misc-no-recursion)
9268ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9269 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9270 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9271{
9272 uint32_t ch_type, length;
9273 proto_item *ti, *payload_ti;
9274 proto_tree *retry_tree, *payload_tree;
9275 uint32_t hello_length = tvb_reported_length(tvb);
9276
9277 switch (hnd_type) {
9278 case SSL_HND_CLIENT_HELLO:
9279 /*
9280 * enum { outer(0), inner(1) } ECHClientHelloType;
9281 *
9282 * struct {
9283 * ECHClientHelloType type;
9284 * select (ECHClientHello.type) {
9285 * case outer:
9286 * HpkeSymmetricCipherSuite cipher_suite;
9287 * uint8 config_id;
9288 * opaque enc<0..2^16-1>;
9289 * opaque payload<1..2^16-1>;
9290 * case inner:
9291 * Empty;
9292 * };
9293 * } ECHClientHello;
9294 */
9295
9296 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9297 offset += 1;
9298 switch (ch_type) {
9299 case 0: /* outer */
9300 if (ssl && session->first_ch_ech_frame == 0) {
9301 session->first_ch_ech_frame = pinfo->num;
9302 }
9303 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9304 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9305 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9306
9307 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9308 uint8_t config_id = tvb_get_uint8(tvb, offset);
9309 offset += 1;
9310 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9311 offset += 2;
9312 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9313 offset += length;
9314 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9315 offset += 2;
9316 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9317 offset += length;
9318
9319 /* XXX - We could save the decrypted Client Hello instead of
9320 * recalculating it every pass, similar to what is done with
9321 * normal encrypted records. Normally there shouldn't be many
9322 * ECH so it doesn't make much difference either way. */
9323 if (!mk_map) {
9324 break;
9325 }
9326 if (session->client_random.data_len == 0) {
9327 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9328 break;
9329 }
9330 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9331 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9332 if (!ech_secret || !ech_config) {
9333 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9334 G_STRFUNC((const char*) (__func__)));
9335 break;
9336 }
9337
9338 if (hpke_hkdf_len(kdf_id) == 0) {
9339 ssl_debug_printf("Unsupported KDF\n");
9340 break;
9341 }
9342
9343 if (hpke_aead_key_len(aead_id) == 0) {
9344 ssl_debug_printf("Unsupported AEAD\n");
9345 break;
9346 }
9347
9348 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9349
9350 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9351 if (length < aead_auth_tag_len) {
9352 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9353 break;
9354 }
9355 unsigned decrypted_len = length - aead_auth_tag_len;
9356
9357 uint16_t version = pntohu16(ech_config->data);
9358 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9359 ssl_debug_printf("Unexpected version in ECH Config\n");
9360 break;
9361 }
9362 uint32_t ech_config_offset = 2;
9363 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9364 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9365 break;
9366 }
9367 ech_config_offset += 2;
9368 if (*(ech_config->data + ech_config_offset) != config_id) {
9369 ssl_debug_printf("ECH Config version mismatch\n");
9370 break;
9371 }
9372 ech_config_offset += 1;
9373 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9374 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9375 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9376 GByteArray *info = g_byte_array_new();
9377 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9378 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9379 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9380 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9381 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9382 key, base_nonce)) {
9383 g_byte_array_free(info, TRUE(!(0)));
9384 break;
9385 }
9386 g_byte_array_free(info, TRUE(!(0)));
9387 gcry_cipher_hd_t cipher;
9388 if (hpke_setup_aead(&cipher, aead_id, key) ||
9389 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9390 gcry_cipher_close(cipher);
9391 break;
9392 }
9393 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9394 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9395 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9396 memset(ech_aad + offset - length, 0, length);
9397 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9398 gcry_cipher_close(cipher);
9399 wmem_free(NULL((void*)0), ech_aad);
9400 break;
9401 }
9402 wmem_free(NULL((void*)0), ech_aad);
9403 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9404 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9405 gcry_cipher_close(cipher);
9406 break;
9407 }
9408 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9409 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9410 gcry_cipher_close(cipher);
9411 break;
9412 }
9413 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9414 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9415 gcry_cipher_close(cipher);
9416 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9417 payload + decrypted_len, aead_auth_tag_len)) {
9418 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9419 } else {
9420 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9421 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9422 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9423 if (ssl) {
9424 /* Note the Outer Client Random for Inject TLS Secrets */
9425 tls_save_crandom(ssl, mk_map);
9426
9427 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9428 if (ssl->ech_transcript.data_len > UINT32_MAX(4294967295U) - 4 - hello_length) {
9429 /* This can't be a valid transcript; start over. */
9430 ssl_debug_printf("%s ECH transcript too long\n", G_STRFUNC((const char*) (__func__)));
9431 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
9432 ssl->ech_transcript.data = NULL((void*)0);
9433 ssl->ech_transcript.data_len = 0;
9434 }
9435 uint32_t len_offset = ssl->ech_transcript.data_len;
9436 if (ssl->ech_transcript.data_len > 0)
9437 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9438 ssl->ech_transcript.data_len + hello_length + 4);
9439 else
9440 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9441 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9442 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9443 /* Copy ClientHelloInner up to the legacy_session_id field. */
9444 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9445 ssl->ech_transcript.data_len += 38;
9446 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9447 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = ssl->session_id.data_len;
9448 ssl->ech_transcript.data_len++;
9449 memcpy(&ssl->ech_transcript.data[ssl->ech_transcript.data_len], ssl->session_id.data, ssl->session_id.data_len);
9450 ssl->ech_transcript.data_len += ssl->session_id.data_len;
9451 /* Skip past the legacy_session_id field in ClientHelloInner
9452 * (which should be the empty string, i.e. just a 0 size.) */
9453 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9454 /* Copy the Cipher Suites from ClientHelloInner. */
9455 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9456 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9457 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9458 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9459 /* Copy the Compression Methods */
9460 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9461 1 + tvb_get_uint8(ech_tvb, ech_offset));
9462 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9463 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9464 /* Now replace extensions in ech_outer_extensions with the
9465 * data from ClientHelloOuter. */
9466 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
9467 ssl->ech_transcript.data_len += 2;
9468 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9469 ech_offset += 2;
9470 bool_Bool ech_outer_extensions_found = false0;
9471 while (extensions_end - ech_offset >= 4) {
9472 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9473 ech_offset += 2;
9474 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9475 ech_offset += 2;
9476 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9477 /* Copy this extension directly */
9478 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len,
9479 ech_offset - 4, 4 + ext_len);
9480 ssl->ech_transcript.data_len += 4 + ext_len;
9481 ech_offset += ext_len;
9482 } else if (ext_len > 0) {
9483 if (ech_outer_extensions_found) {
9484 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9485 /* This could lead to a buffer overflow by
9486 * making the post-copying ClientHelloInner
9487 * longer than ClientHelloOuter and is
9488 * illegal, so skip this and don't copy. */
9489 ech_offset += ext_len;
9490 continue;
9491 }
9492 ech_outer_extensions_found = true1;
9493 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9494 ech_offset += 1;
9495 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9496 /* In ClientHelloOuter, skip past the legacy_session_id */
9497 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9498 /* Skip past Cipher Suites */
9499 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9500 /* Skip past Compression Methods */
9501 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9502 /* Now at the start of ClientHelloOuter's extensions */
9503 while (ech_outer_extensions_end - ech_offset >= 2) {
9504 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9505 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9506 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9507 /* This could lead to a buffer overflow by
9508 * making the post-copying ClientHelloInner
9509 * longer than ClientHelloOuter and is
9510 * illegal, so don't copy. */
9511 break;
9512 }
9513 bool_Bool found = false0;
9514 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9515 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9516 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9517 if (ext_type == outer_ext_type) {
9518 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
9519 4 + outer_ext_len);
9520 ssl->ech_transcript.data_len += 4 + outer_ext_len;
9521 outer_offset += 4 + outer_ext_len;
9522 found = true1;
9523 break;
9524 } else {
9525 outer_offset += 4 + outer_ext_len;
9526 }
9527 }
9528 if (!found) {
9529 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9530 }
9531 ech_offset += 2;
9532 }
9533 }
9534 }
9535 uint16_t ech_extensions_len = ssl->ech_transcript.data_len - ech_extensions_len_offset - 2;
9536 phtonu16(&ssl->ech_transcript.data[ech_extensions_len_offset], ech_extensions_len);
9537 phtonu16(&ssl->ech_transcript.data[len_offset + 2], ssl->ech_transcript.data_len - len_offset - 4);
9538 }
9539 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9540 ssl, NULL((void*)0), mk_map);
9541 if (ech_padding_begin < decrypted_len) {
9542 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9543 ENC_NA0x00000000);
9544 }
9545 }
9546
9547 break;
9548 case 1: /* inner */
9549 break;
9550 }
9551 break;
9552
9553 case SSL_HND_ENCRYPTED_EXTENSIONS:
9554 /*
9555 * struct {
9556 * ECHConfigList retry_configs;
9557 * } ECHEncryptedExtensions;
9558 */
9559
9560 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9561 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9562 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9563 break;
9564
9565 case SSL_HND_HELLO_RETRY_REQUEST:
9566 /*
9567 * struct {
9568 * opaque confirmation[8];
9569 * } ECHHelloRetryRequest;
9570 */
9571
9572 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9573 if (session->ech) {
9574 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9575 proto_item_set_generated(ti);
9576 if (tvb_memeql(tvb, offset, session->hrr_ech_confirmation, 8) != 0) {
9577 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9578 } else {
9579 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9580 }
9581 }
9582 offset += 8;
9583 break;
9584 }
9585
9586 return offset;
9587}
9588
9589static uint32_t
9590ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9591 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9592 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9593{
9594 uint32_t record_digest_length, encrypted_sni_length;
9595
9596 switch (hnd_type) {
9597 case SSL_HND_CLIENT_HELLO:
9598 /*
9599 * struct {
9600 * CipherSuite suite;
9601 * KeyShareEntry key_share;
9602 * opaque record_digest<0..2^16-1>;
9603 * opaque encrypted_sni<0..2^16-1>;
9604 * } ClientEncryptedSNI;
9605 */
9606 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9607 offset += 2;
9608 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9609
9610 /* opaque record_digest<0..2^16-1> */
9611 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9612 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9613 return offset_end;
9614 }
9615 offset += 2;
9616 if (record_digest_length > 0) {
9617 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9618 offset += record_digest_length;
9619 }
9620
9621 /* opaque encrypted_sni<0..2^16-1> */
9622 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9623 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9624 return offset_end;
9625 }
9626 offset += 2;
9627 if (encrypted_sni_length > 0) {
9628 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9629 offset += encrypted_sni_length;
9630 }
9631 break;
9632
9633 case SSL_HND_ENCRYPTED_EXTENSIONS:
9634 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9635 offset += 16;
9636 break;
9637 }
9638
9639 return offset;
9640}
9641/** TLS Extensions (in Client Hello and Server Hello). }}} */
9642
9643/* Connection ID dissection. {{{ */
9644static uint32_t
9645ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9646 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9647 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9648{
9649 /* keep track of the decrypt session only for the first pass */
9650 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9651 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9652 *session_cidl = cidl;
9653 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9654 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9655 if (ssl) {
9656 ssl_add_session_by_cid(ssl);
9657 }
9658 }
9659
9660 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9661 tvb, offset, 1, ENC_NA0x00000000);
9662 offset++;
9663
9664 if (cidl > 0) {
9665 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9666 tvb, offset, cidl, ENC_NA0x00000000);
9667 offset += cidl;
9668 }
9669
9670 return offset;
9671}
9672
9673static uint32_t
9674ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9675 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9676 SslSession *session, SslDecryptSession *ssl)
9677{
9678 uint8_t cidl = tvb_get_uint8(tvb, offset);
9679
9680 switch (hnd_type) {
9681 case SSL_HND_CLIENT_HELLO:
9682 session->client_cid_len_present = true1;
9683 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9684 cidl, &session->client_cid, &session->client_cid_len);
9685 case SSL_HND_SERVER_HELLO:
9686 session->server_cid_len_present = true1;
9687 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9688 cidl, &session->server_cid, &session->server_cid_len);
9689 default:
9690 return offset;
9691 }
9692} /* }}} */
9693
9694/* Trusted CA dissection. {{{ */
9695static uint32_t
9696ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9697 uint32_t offset, uint32_t offset_end)
9698{
9699 proto_item *ti;
9700 proto_tree *subtree;
9701 uint32_t keys_length, next_offset;
9702
9703 /*
9704 * struct {
9705 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9706 * } TrustedAuthorities;
9707 *
9708 * struct {
9709 * IdentifierType identifier_type;
9710 * select (identifier_type) {
9711 * case pre_agreed: struct {};
9712 * case key_sha1_hash: SHA1Hash;
9713 * case x509_name: DistinguishedName;
9714 * case cert_sha1_hash: SHA1Hash;
9715 * } identifier;
9716 * } TrustedAuthority;
9717 *
9718 * enum {
9719 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9720 * cert_sha1_hash(3), (255)
9721 * } IdentifierType;
9722 *
9723 * opaque DistinguishedName<1..2^16-1>;
9724 *
9725 */
9726
9727
9728 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9729 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9730 0, UINT16_MAX(65535)))
9731 {
9732 return offset_end;
9733 }
9734 offset += 2;
9735 next_offset = offset + keys_length;
9736
9737 if (keys_length > 0)
9738 {
9739 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9740 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9741 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9742
9743 while (offset < next_offset)
9744 {
9745 uint32_t identifier_type;
9746 proto_tree *trusted_key_tree;
9747 proto_item *trusted_key_item;
9748 asn1_ctx_t asn1_ctx;
9749 uint32_t key_len = 0;
9750
9751 identifier_type = tvb_get_uint8(tvb, offset);
9752
9753 // Use 0 as length for now as we'll only know the size when we decode the identifier
9754 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9755 offset, 0, "Trusted CA Key");
9756 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9757
9758 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9759 offset, 1, identifier_type);
9760 offset++;
9761
9762 /*
9763 * enum {
9764 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9765 * cert_sha1_hash(3), (255)
9766 * } IdentifierType;
9767 */
9768 switch (identifier_type)
9769 {
9770 case 0:
9771 key_len = 0;
9772 break;
9773 case 2:
9774 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9775
9776 uint32_t name_length;
9777 /* opaque DistinguishedName<1..2^16-1> */
9778 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9779 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9780 return next_offset;
9781 }
9782 offset += 2;
9783
9784 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9785 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9786 offset += name_length;
9787 break;
9788 case 1:
9789 case 3:
9790 key_len = 20;
9791 /* opaque SHA1Hash[20]; */
9792 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
9793 offset, 20, ENC_NA0x00000000);
9794 break;
9795
9796 default:
9797 key_len = 0;
9798 /*TODO display expert info about unknown ? */
9799 break;
9800 }
9801 proto_item_set_len(trusted_key_item, 1 + key_len);
9802 offset += key_len;
9803 }
9804 }
9805
9806 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
9807 {
9808 offset = next_offset;
9809 }
9810
9811 return offset;
9812} /* }}} */
9813
9814
9815/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
9816bool_Bool
9817ssl_is_valid_content_type(uint8_t type)
9818{
9819 switch ((ContentType) type) {
9820 case SSL_ID_CHG_CIPHER_SPEC:
9821 case SSL_ID_ALERT:
9822 case SSL_ID_HANDSHAKE:
9823 case SSL_ID_APP_DATA:
9824 case SSL_ID_HEARTBEAT:
9825 case SSL_ID_TLS12_CID:
9826 case SSL_ID_DTLS13_ACK:
9827 return true1;
9828 }
9829 return false0;
9830}
9831
9832bool_Bool
9833ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
9834{
9835 switch ((HandshakeType) hs_type) {
9836 case SSL_HND_HELLO_VERIFY_REQUEST:
9837 /* hello_verify_request is DTLS-only */
9838 return is_dtls;
9839
9840 case SSL_HND_HELLO_REQUEST:
9841 case SSL_HND_CLIENT_HELLO:
9842 case SSL_HND_SERVER_HELLO:
9843 case SSL_HND_NEWSESSION_TICKET:
9844 case SSL_HND_END_OF_EARLY_DATA:
9845 case SSL_HND_HELLO_RETRY_REQUEST:
9846 case SSL_HND_ENCRYPTED_EXTENSIONS:
9847 case SSL_HND_CERTIFICATE:
9848 case SSL_HND_SERVER_KEY_EXCHG:
9849 case SSL_HND_CERT_REQUEST:
9850 case SSL_HND_SVR_HELLO_DONE:
9851 case SSL_HND_CERT_VERIFY:
9852 case SSL_HND_CLIENT_KEY_EXCHG:
9853 case SSL_HND_FINISHED:
9854 case SSL_HND_CERT_URL:
9855 case SSL_HND_CERT_STATUS:
9856 case SSL_HND_SUPPLEMENTAL_DATA:
9857 case SSL_HND_KEY_UPDATE:
9858 case SSL_HND_COMPRESSED_CERTIFICATE:
9859 case SSL_HND_ENCRYPTED_EXTS:
9860 return true1;
9861 case SSL_HND_MESSAGE_HASH:
9862 return false0;
9863 }
9864 return false0;
9865}
9866
9867static bool_Bool
9868ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
9869 bool_Bool is_dtls)
9870{
9871 /* Consider all valid Handshake messages (except for Client Hello) and
9872 * all other valid record types (other than Handshake) */
9873 return (content_type == SSL_ID_HANDSHAKE &&
9874 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
9875 handshake_type != SSL_HND_CLIENT_HELLO) ||
9876 (content_type != SSL_ID_HANDSHAKE &&
9877 ssl_is_valid_content_type(content_type));
9878}
9879
9880/**
9881 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
9882 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
9883 * Returns true if the supported_versions extension was found, false if not.
9884 */
9885bool_Bool
9886tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
9887 uint16_t *server_version, bool_Bool *is_hrr)
9888{
9889 /* SHA256("HelloRetryRequest") */
9890 static const uint8_t tls13_hrr_random_magic[] = {
9891 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
9892 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
9893 };
9894 uint8_t session_id_length;
9895
9896 *server_version = tvb_get_ntohs(tvb, offset);
9897
9898 /*
9899 * Try to look for supported_versions extension. Minimum length:
9900 * 2 + 32 + 1 = 35 (version, random, session id length)
9901 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9902 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9903 *
9904 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9905 * there's a separate expert info warning for that.
9906 */
9907 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9908 offset += 2;
9909 if (is_hrr) {
9910 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
9911 }
9912 offset += 32;
9913 session_id_length = tvb_get_uint8(tvb, offset);
9914 offset++;
9915 if (offset_end - offset < session_id_length + 5u) {
9916 return false0;
9917 }
9918 offset += session_id_length + 5;
9919
9920 while (offset_end - offset >= 6) {
9921 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9922 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9923 if (offset_end - offset < 4u + ext_len) {
9924 break; /* not enough data for type, length and data */
9925 }
9926 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9927 if (ext_len == 2) {
9928 *server_version = tvb_get_ntohs(tvb, offset + 4);
9929 }
9930 return true1;
9931 }
9932 offset += 4 + ext_len;
9933 }
9934 } else {
9935 if (is_hrr) {
9936 *is_hrr = false0;
9937 }
9938 }
9939 return false0;
9940}
9941
9942/**
9943 * Scan a Client Hello handshake message to see if the supported_versions
9944 * extension is found, in which case the version field is legacy_version.
9945 */
9946static bool_Bool
9947tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
9948{
9949 uint8_t session_id_length;
9950
9951 uint16_t client_version = tvb_get_ntohs(tvb, offset);
9952
9953 /*
9954 * Try to look for supported_versions extension. Minimum length:
9955 * 2 + 32 + 1 = 35 (version, random, session id length)
9956 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
9957 * 2 + 2 + 2 = 6 (ext type, ext len, version)
9958 *
9959 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
9960 * there's a separate expert info warning for that.
9961 */
9962 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
9963 offset += 2;
9964 offset += 32;
9965 session_id_length = tvb_get_uint8(tvb, offset);
9966 offset++;
9967 if (offset_end - offset < session_id_length + 2u) {
9968 return false0;
9969 }
9970 offset += session_id_length;
9971 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
9972 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
9973 offset++;
9974 if (offset_end - offset < cookie_length + 2u) {
9975 return false0;
9976 }
9977 }
9978 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
9979 offset += 2;
9980 if (offset_end - offset < cipher_suites_length + 1u) {
9981 return false0;
9982 }
9983 offset += cipher_suites_length;
9984 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
9985 offset++;
9986 if (offset_end - offset < compression_methods_length + 2u) {
9987 return false0;
9988 }
9989 offset += compression_methods_length + 2;
9990
9991 while (offset_end - offset >= 6) {
9992 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
9993 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
9994 if (offset_end - offset < 4u + ext_len) {
9995 break; /* not enough data for type, length and data */
9996 }
9997 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
9998 return true1;
9999 }
10000 offset += 4 + ext_len;
10001 }
10002 }
10003 return false0;
10004}
10005void
10006ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10007 uint8_t content_type, uint8_t handshake_type,
10008 bool_Bool is_dtls, uint16_t version)
10009{
10010 uint8_t tls13_draft = 0;
10011
10012 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10013 is_dtls))
10014 return;
10015
10016 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10017 if (version == SSL_VER_UNKNOWN0) {
10018 return;
10019 }
10020
10021 session->tls13_draft_version = tls13_draft;
10022 session->version = version;
10023 if (ssl) {
10024 ssl->state |= SSL_VERSION(1<<4);
10025 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10026 }
10027}
10028
10029void
10030ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10031 ContentType content_type,
10032 unsigned record_length, proto_item *length_pi,
10033 uint16_t version, tvbuff_t *decrypted_tvb)
10034{
10035 unsigned max_expansion;
10036 if (version == TLSV1DOT3_VERSION0x304) {
10037 /* TLS 1.3: Max length is 2^14 + 256 */
10038 max_expansion = 256;
10039 } else {
10040 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10041 max_expansion = 2048;
10042 }
10043 /*
10044 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10045 * and ChangeCipherSpec.
10046 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10047 * so assume it is permitted.
10048 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10049 * assume TLS 1.2 requirements.
10050 */
10051 if (record_length == 0 &&
10052 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10053 content_type == SSL_ID_ALERT ||
10054 content_type == SSL_ID_HANDSHAKE)) {
10055 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10056 "Zero-length %s fragments are not allowed",
10057 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10058 }
10059 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10060 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10061 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10062 }
10063 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10064 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10065 "TLSPlaintext length MUST NOT exceed 2^14");
10066 }
10067}
10068
10069static void
10070ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10071{
10072 /* store selected cipher suite for decryption */
10073 ssl->session.cipher = cipher;
10074
10075 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10076 if (!cs) {
10077 ssl->cipher_suite = NULL((void*)0);
10078 ssl->state &= ~SSL_CIPHER(1<<2);
10079 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10080 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10081 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10082 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10083 * to avoid a potential buffer overflow in ssl3_check_mac. */
10084 ssl->cipher_suite = NULL((void*)0);
10085 ssl->state &= ~SSL_CIPHER(1<<2);
10086 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10087 } else {
10088 /* Cipher found, save this for the delayed decoder init */
10089 ssl->cipher_suite = cs;
10090 ssl->state |= SSL_CIPHER(1<<2);
10091 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10092 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10093 ssl->state);
10094 }
10095}
10096/* }}} */
10097
10098
10099/* Client Hello and Server Hello dissections. {{{ */
10100static int
10101ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10102 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10103 SslSession *session, SslDecryptSession *ssl,
10104 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10105 ssl_master_key_map_t *mk_map);
10106int
10107// NOLINTNEXTLINE(misc-no-recursion)
10108ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10109 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10110 uint32_t offset_end, SslSession *session,
10111 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10112{
10113 /* struct {
10114 * ProtocolVersion client_version;
10115 * Random random;
10116 * SessionID session_id;
10117 * opaque cookie<0..32>; //new field for DTLS
10118 * CipherSuite cipher_suites<2..2^16-1>;
10119 * CompressionMethod compression_methods<1..2^8-1>;
10120 * Extension client_hello_extension_list<0..2^16-1>;
10121 * } ClientHello;
10122 */
10123 proto_item *ti;
10124 proto_tree *cs_tree;
10125 uint32_t client_version;
10126 uint32_t cipher_suite_length;
10127 uint32_t compression_methods_length;
10128 uint8_t compression_method;
10129 uint32_t next_offset;
10130 uint32_t initial_offset = offset;
10131 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10132 char *ja3_hash;
10133 char *ja3_dash = "";
10134 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10135 ja4_data_t ja4_data;
10136 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10137 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10138 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10139 wmem_list_frame_t *curr_entry;
10140
10141 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10141, (int64_t)initial_offset, (int64_t)offset_end))));
10142 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10143 offset = 0;
10144 offset_end = tvb_reported_length(hello_tvb);
10145
10146 ja4_data.max_version = 0;
10147 ja4_data.server_name_present = false0;
10148 ja4_data.num_cipher_suites = 0;
10149 ja4_data.num_extensions = 0;
10150 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10151 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10152 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10153 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10154
10155 /* show the client version */
10156 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10157 offset, 2, ENC_BIG_ENDIAN0x00000000,
10158 &client_version);
10159 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10160 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10161 }
10162 offset += 2;
10163 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10164
10165 /*
10166 * Is it version 1.3?
10167 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10168 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10169 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10170 * Hello".
10171 */
10172 if (dtls_hfs != NULL((void*)0)) {
10173 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10174 /* Don't do that. */
10175 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10176 }
10177 } else {
10178 if (client_version == TLSV1DOT3_VERSION0x304) {
10179 /* Don't do that. */
10180 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10181 }
10182 }
10183
10184 /* dissect fields that are present in both ClientHello and ServerHello */
10185 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10186
10187 /* fields specific for DTLS (cookie_len, cookie) */
10188 if (dtls_hfs != NULL((void*)0)) {
10189 uint32_t cookie_length;
10190 /* opaque cookie<0..32> (for DTLS only) */
10191 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10192 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10193 return offset;
10194 }
10195 offset++;
10196 if (cookie_length > 0) {
10197 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10198 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10199 offset += cookie_length;
10200 }
10201 }
10202
10203 /* CipherSuite cipher_suites<2..2^16-1> */
10204 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10205 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10206 return offset;
10207 }
10208 offset += 2;
10209 next_offset = offset + cipher_suite_length;
10210 ti = proto_tree_add_none_format(tree,
10211 hf->hf.hs_cipher_suites,
10212 hello_tvb, offset, cipher_suite_length,
10213 "Cipher Suites (%d suite%s)",
10214 cipher_suite_length / 2,
10215 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10216 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10217 while (offset + 2 <= next_offset) {
10218 uint32_t cipher_suite;
10219
10220 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10221 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10222 offset += 2;
10223 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10224 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10225 ja3_dash = "-";
10226 ja4_data.num_cipher_suites += 1;
10227 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10228 }
10229 }
10230 wmem_strbuf_append_c(ja3, ',');
10231 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10232 offset = next_offset;
10233 }
10234
10235 /* CompressionMethod compression_methods<1..2^8-1> */
10236 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10237 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10238 return offset;
10239 }
10240 offset++;
10241 next_offset = offset + compression_methods_length;
10242 ti = proto_tree_add_none_format(tree,
10243 hf->hf.hs_comp_methods,
10244 hello_tvb, offset, compression_methods_length,
10245 "Compression Methods (%u method%s)",
10246 compression_methods_length,
10247 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10248 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10249 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10250 while (offset < next_offset) {
10251 compression_method = tvb_get_uint8(hello_tvb, offset);
10252 /* TODO: make reserved/private comp meth. fields selectable */
10253 if (compression_method < 64)
10254 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10255 hello_tvb, offset, 1, compression_method);
10256 else if (compression_method < 193)
10257 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10258 compression_method, "Reserved - to be assigned by IANA (%u)",
10259 compression_method);
10260 else
10261 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10262 compression_method, "Private use range (%u)",
10263 compression_method);
10264 offset++;
10265 }
10266
10267 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10268 if (offset < offset_end) {
10269 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10270 offset_end, SSL_HND_CLIENT_HELLO,
10271 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10272 if (ja4_data.max_version > 0) {
10273 client_version = ja4_data.max_version;
10274 }
10275 } else {
10276 wmem_strbuf_append_printf(ja3, ",,");
10277 }
10278
10279 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10280 wmem_strbuf_append(ja4_a, "t");
10281 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10282 wmem_strbuf_append(ja4_a, "q");
10283 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10284 wmem_strbuf_append(ja4_a, "d");
10285 }
10286 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10287 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10288 if (ja4_data.num_cipher_suites > 99) {
10289 wmem_strbuf_append(ja4_a, "99");
10290 } else {
10291 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10292 }
10293 if (ja4_data.num_extensions > 99) {
10294 wmem_strbuf_append(ja4_a, "99");
10295 } else {
10296 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10297 }
10298 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10299 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10300 } else {
10301 wmem_strbuf_append(ja4_a, "00");
10302 }
10303
10304 curr_entry = wmem_list_head(ja4_data.cipher_list);
10305 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10306 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10307 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10308 wmem_strbuf_append(ja4_br, ",");
10309 }
10310 curr_entry = wmem_list_frame_next(curr_entry);
10311 }
10312
10313 curr_entry = wmem_list_head(ja4_data.extension_list);
10314 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10315 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10316 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10317 wmem_strbuf_append(ja4_cr, ",");
10318 }
10319 curr_entry = wmem_list_frame_next(curr_entry);
10320 }
10321
10322 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10323 wmem_strbuf_append(ja4_cr, "_");
10324 curr_entry = wmem_list_head(ja4_data.sighash_list);
10325 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10326 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10327 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10328 wmem_strbuf_append(ja4_cr, ",");
10329 }
10330 curr_entry = wmem_list_frame_next(curr_entry);
10331 }
10332 }
10333 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10334 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10335 } else {
10336 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10337 }
10338 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10339
10340 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10341 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10342 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10343 } else {
10344 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10345 }
10346 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10347 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10348
10349 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10350 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10351
10352 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10353 proto_item_set_generated(ti);
10354 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10355 proto_item_set_generated(ti);
10356
10357 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10358 wmem_strbuf_get_len(ja3));
10359 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10360 proto_item_set_generated(ti);
10361 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10362 proto_item_set_generated(ti);
10363 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10364 return initial_offset + offset;
10365}
10366
10367static void
10368tls_calculate_ech_handshake_hash(SslDecryptSession *ssl, tvbuff_t *tvb, uint32_t offset, uint32_t length, bool_Bool is_hrr)
10369{
10370 /* Note length here, unlike ssh_calculate_handshake_hash, does *not* include
10371 * the 4 bytes for the handshake type and length fields themselves. */
10372 if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
10373 /* RFC 9849 7.2 Backend Server */
10374 /* Check that the entire message is present and find the confirmation
10375 * before doing anything else, so that a truncated or malformed message
10376 * doesn't throw an exception here (leaking the digest context and
10377 * preventing the extensions from being dissected.) */
10378 if (length < 34 || !tvb_bytes_exist(tvb, offset, length)) {
10379 return;
10380 }
10381 if (ssl->ech_transcript.data_len > UINT32_MAX(4294967295U) - 4 - length) {
10382 ssl_debug_printf("%s ECH transcript too long\n", G_STRFUNC((const char*) (__func__)));
10383 return;
10384 }
10385 /* The ServerHello confirmation is the last 8 bytes of the random. */
10386 uint32_t confirmation_offset = offset + 26;
10387 bool_Bool zero_confirmation = !is_hrr;
10388 if (is_hrr) {
10389 /* The HelloRetryRequest confirmation is in the extension. */
10390 uint32_t hrr_offset = offset + 34;
10391 uint32_t message_end = offset + length;
10392 uint32_t extensions_end = hrr_offset;
10393 if (message_end - hrr_offset >= 1) {
10394 /* legacy_session_id_echo, cipher_suite, legacy_compression_method */
10395 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1 + 3;
10396 if (hrr_offset <= message_end && message_end - hrr_offset >= 2) {
10397 extensions_end = hrr_offset + 2 + tvb_get_ntohs(tvb, hrr_offset);
10398 hrr_offset += 2;
10399 if (extensions_end > message_end) {
10400 extensions_end = message_end;
10401 }
10402 }
10403 }
10404 while (hrr_offset <= extensions_end && extensions_end - hrr_offset >= 4) {
10405 uint16_t ext_type = tvb_get_ntohs(tvb, hrr_offset);
10406 uint16_t ext_len = tvb_get_ntohs(tvb, hrr_offset + 2);
10407 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 && ext_len == 8 &&
10408 extensions_end - hrr_offset >= 12) {
10409 confirmation_offset = hrr_offset + 4;
10410 zero_confirmation = true1;
10411 break;
10412 }
10413 hrr_offset += 4 + ext_len;
10414 }
10415 }
10416 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10417 SSL_MDgcry_md_hd_t mc;
10418 if (hash_algo && ssl_md_init(&mc, hash_algo) == 0) {
10419 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10420 unsigned char prk[DIGEST_MAX_SIZE48];
10421 unsigned char *ech_verify_out = NULL((void*)0);
10422 unsigned int len;
10423 const uint8_t *message = tvb_get_ptr(tvb, offset, length);
10424 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10425 phtonu24(&prefix[1], length);
10426 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10427 if (is_hrr) {
10428 /* RFC 8446 4.4.1 The Transcript Hash
10429 * Special synthetic handshake following a HelloRetryRequest */
10430 ssl_md_final(&mc, transcript_hash, &len);
10431 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10432 ssl->ech_transcript.data_len = 4 + len;
10433 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + length);
10434 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10435 ssl->ech_transcript.data[1] = 0;
10436 ssl->ech_transcript.data[2] = 0;
10437 ssl->ech_transcript.data[3] = len;
10438 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10439 ssl_md_reset(&mc);
10440 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10441 } else {
10442 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10443 ssl->ech_transcript.data_len + 4 + length);
10444 }
10445 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
10446 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, message, length);
10447 ssl->ech_transcript.data_len += 4 + length;
10448 /* The confirmation is calculated with the confirmation bytes
10449 * set to zero. */
10450 ssl_md_update(&mc, prefix, 4);
10451 if (zero_confirmation) {
10452 uint8_t zeros[8] = { 0 };
10453 uint32_t confirmation_pos = confirmation_offset - offset;
10454 ssl_md_update(&mc, message, confirmation_pos);
10455 ssl_md_update(&mc, zeros, 8);
10456 ssl_md_update(&mc, message + confirmation_pos + 8, length - confirmation_pos - 8);
10457 } else {
10458 ssl_md_update(&mc, message, length);
10459 }
10460 ssl_md_final(&mc, transcript_hash, &len);
10461 ssl_md_cleanup(&mc);
10462 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10463 StringInfo prk_string = {prk, len};
10464 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10465 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10466 transcript_hash, len, 8, &ech_verify_out)) {
10467 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10468 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10469 if (is_hrr) {
10470 ssl->session.hrr_ech_declined = true1;
10471 ssl->session.first_ch_ech_frame = 0;
10472 }
10473 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10474 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10475 }
10476 wmem_free(NULL((void*)0), ech_verify_out);
10477 }
10478 /* XXX - If ECH is accepted, then the ECH transcript should be used
10479 * instead of the handshake_data for various purposes, like PSK KE.
10480 * If declined, then we don't need the full transcript anymore.
10481 */
10482 ssl->session.ech = true1;
10483 }
10484 }
10485}
10486
10487void
10488ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10489 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10490 SslSession *session, SslDecryptSession *ssl,
10491 bool_Bool is_dtls, bool_Bool is_hrr)
10492{
10493 /* struct {
10494 * ProtocolVersion server_version;
10495 * Random random;
10496 * SessionID session_id; // TLS 1.2 and before
10497 * CipherSuite cipher_suite;
10498 * CompressionMethod compression_method; // TLS 1.2 and before
10499 * Extension server_hello_extension_list<0..2^16-1>;
10500 * } ServerHello;
10501 */
10502 uint8_t draft_version = session->tls13_draft_version;
10503 proto_item *ti;
10504 uint32_t server_version;
10505 uint32_t cipher_suite;
10506 uint32_t initial_offset = offset;
10507 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10508 char *ja3_hash;
10509
10510 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10511 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10512
10513 /* Initially assume that the session is resumed. If this is not the case, a
10514 * ServerHelloDone will be observed before the ChangeCipherSpec message
10515 * which will reset this flag. */
10516 session->is_session_resumed = true1;
10517
10518 /* show the server version */
10519 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10520 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10521
10522 uint16_t supported_server_version;
10523 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
10524 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10525 }
10526 /*
10527 * Is it version 1.3?
10528 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10529 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10530 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10531 * Hello".
10532 */
10533 if (is_dtls) {
10534 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10535 /* Don't do that. */
10536 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10537 }
10538 } else {
10539 if (server_version == TLSV1DOT3_VERSION0x304) {
10540 /* Don't do that. */
10541 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10542 }
10543 }
10544
10545 offset += 2;
10546 wmem_strbuf_append_printf(ja3, "%i", server_version);
10547
10548 /* dissect fields that are present in both ClientHello and ServerHello */
10549 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10550
10551 if (ssl) {
10552 /* store selected cipher suite for decryption */
10553 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10554 }
10555
10556 /* now the server-selected cipher suite */
10557 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10558 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10559 offset += 2;
10560 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10561
10562 /* With the Cipher Suite, we can now calculate the ECH handshake hash.
10563 * Do it now so we have it before the encrypted_client_hello extension
10564 * in a HRR. */
10565 tls_calculate_ech_handshake_hash(ssl, tvb, initial_offset, offset_end - initial_offset, is_hrr);
10566
10567 if (session->ech) {
10568 tls_ech_confirm_t *ech_confirm = p_get_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm);
10569 if (ech_confirm) {
10570 proto_tree *ech_confirm_tree = proto_item_add_subtree(ech_confirm->parent_item, hf->ett.hs_random);
10571 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, ech_confirm->confirm_tvb, 0, 8, ENC_NA0x00000000);
10572 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute,
10573 ech_confirm->confirm_tvb, 0, 0,
10574 session->ech_confirmation, 8);
10575 proto_item_set_generated(ti);
10576 if (tvb_memeql(ech_confirm->confirm_tvb, 0, session->ech_confirmation, 8)) {
10577 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10578 } else {
10579 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10580 }
10581 }
10582 }
10583
10584 /* No compression with TLS 1.3 before draft -22 */
10585 if (!(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
10586 if (ssl) {
10587 /* store selected compression method for decryption */
10588 ssl->session.compression = tvb_get_uint8(tvb, offset);
10589 }
10590 /* and the server-selected compression method */
10591 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10592 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10593 offset++;
10594 }
10595
10596 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10597 if (offset < offset_end) {
10598 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10599 offset_end,
10600 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10601 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10602 }
10603
10604 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10605 wmem_strbuf_get_len(ja3));
10606 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10607 proto_item_set_generated(ti);
10608 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10609 proto_item_set_generated(ti);
10610 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10611}
10612/* Client Hello and Server Hello dissections. }}} */
10613
10614/* New Session Ticket dissection. {{{ */
10615void
10616ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10617 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10618 SslSession *session, SslDecryptSession *ssl,
10619 bool_Bool is_dtls, GHashTable *session_hash)
10620{
10621 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10622 * struct {
10623 * uint32 ticket_lifetime_hint;
10624 * opaque ticket<0..2^16-1>;
10625 * } NewSessionTicket;
10626 *
10627 * RFC 8446 Section 4.6.1 (TLS 1.3):
10628 * struct {
10629 * uint32 ticket_lifetime;
10630 * uint32 ticket_age_add;
10631 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10632 * opaque ticket<1..2^16-1>;
10633 * Extension extensions<0..2^16-2>;
10634 * } NewSessionTicket;
10635 */
10636 proto_tree *subtree;
10637 proto_item *subitem;
10638 uint32_t ticket_len;
10639 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10640 unsigned char draft_version = session->tls13_draft_version;
10641 uint32_t lifetime_hint;
10642
10643 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10644 hf->ett.session_ticket, NULL((void*)0),
10645 "TLS Session Ticket");
10646
10647 /* ticket lifetime hint */
10648 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10649 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10650 offset += 4;
10651
10652 if (lifetime_hint >= 60) {
10653 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10654 proto_item_append_text(subitem, " (%s)", time_str);
10655 }
10656
10657 if (is_tls13) {
10658
10659 /* for TLS 1.3: ticket_age_add */
10660 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10661 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10662 offset += 4;
10663
10664 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10665 if (draft_version == 0 || draft_version >= 21) {
10666 uint32_t ticket_nonce_len;
10667
10668 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10669 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10670 return;
10671 }
10672 offset++;
10673
10674 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10675 offset += ticket_nonce_len;
10676 }
10677
10678 }
10679
10680 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10681 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10682 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10683 return;
10684 }
10685 offset += 2;
10686
10687 /* Content depends on implementation, so just show data! */
10688 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10689 tvb, offset, ticket_len, ENC_NA0x00000000);
10690 /* save the session ticket to cache for ssl_finalize_decryption */
10691 if (ssl && !is_tls13) {
10692 if (ssl->session.is_session_resumed) {
10693 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10694 * (Abbreviated Handshake Using New Session Ticket).
10695 * Restore the master key for this session ticket before saving
10696 * it to the new session ticket. */
10697 ssl_restore_master_key(ssl, "Session Ticket", false0,
10698 session_hash, &ssl->session_ticket);
10699 }
10700 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10701 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10702 ssl->session_ticket.data, ticket_len);
10703 ssl->session_ticket.data_len = ticket_len;
10704 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10705 /* NewSessionTicket is received after the first (client)
10706 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10707 * Since the second CCS has already the session key available it will
10708 * just return. To ensure that the session ticket is mapped to a
10709 * master key (from the first CCS), save the ticket here too. */
10710 ssl_save_master_key("Session Ticket", session_hash,
10711 &ssl->session_ticket, &ssl->master_secret);
10712 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10713 }
10714 offset += ticket_len;
10715
10716 if (is_tls13) {
10717 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10718 offset_end, SSL_HND_NEWSESSION_TICKET,
10719 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10720 }
10721} /* }}} */
10722
10723void
10724ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10725 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10726 SslSession *session, SslDecryptSession *ssl,
10727 bool_Bool is_dtls)
10728{
10729 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10730 * struct {
10731 * ProtocolVersion server_version;
10732 * CipherSuite cipher_suite; // not before draft -19
10733 * Extension extensions<2..2^16-1>;
10734 * } HelloRetryRequest;
10735 * Note: no longer used since draft -22
10736 */
10737 uint32_t version;
10738 uint8_t draft_version;
10739
10740 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10741 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
10742 draft_version = extract_tls13_draft_version(version);
10743 offset += 2;
10744
10745 if (draft_version == 0 || draft_version >= 19) {
10746 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
10747 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10748 offset += 2;
10749 }
10750
10751 /* We assume that there's nothing out there that supports only TLS 1.3
10752 * draft-22 but also Encrypted Client Hello, or else we should set the
10753 * cipher suite and call tls_calculate_ech_handshake_hash here. */
10754
10755 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10756 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
10757 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10758}
10759
10760void
10761ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10762 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10763 SslSession *session, SslDecryptSession *ssl,
10764 bool_Bool is_dtls)
10765{
10766 /* RFC 8446 Section 4.3.1
10767 * struct {
10768 * Extension extensions<0..2^16-1>;
10769 * } EncryptedExtensions;
10770 */
10771 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10772 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
10773 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10774}
10775
10776/* Certificate and Certificate Request dissections. {{{ */
10777void
10778ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10779 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
10780 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
10781 bool_Bool is_from_server, bool_Bool is_dtls)
10782{
10783 /* opaque ASN.1Cert<1..2^24-1>;
10784 *
10785 * Before RFC 8446 (TLS <= 1.2):
10786 * struct {
10787 * select(certificate_type) {
10788 *
10789 * // certificate type defined in RFC 7250
10790 * case RawPublicKey:
10791 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
10792 *
10793 * // X.509 certificate defined in RFC 5246
10794 * case X.509:
10795 * ASN.1Cert certificate_list<0..2^24-1>;
10796 * };
10797 * } Certificate;
10798 *
10799 * RFC 8446 (since draft -20):
10800 * struct {
10801 * select(certificate_type){
10802 * case RawPublicKey:
10803 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
10804 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
10805 *
10806 * case X.509:
10807 * opaque cert_data<1..2^24-1>;
10808 * }
10809 * Extension extensions<0..2^16-1>;
10810 * } CertificateEntry;
10811 * struct {
10812 * opaque certificate_request_context<0..2^8-1>;
10813 * CertificateEntry certificate_list<0..2^24-1>;
10814 * } Certificate;
10815 */
10816 enum { CERT_X509, CERT_RPK } cert_type;
10817 asn1_ctx_t asn1_ctx;
10818#if defined(HAVE_LIBGNUTLS1)
10819 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
10820 unsigned certificate_index = 0;
10821#endif
10822 uint32_t next_offset, certificate_list_length, cert_length;
10823 proto_tree *subtree = tree;
10824
10825 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10826
10827 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
10828 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
10829 cert_type = CERT_RPK;
10830 } else {
10831 cert_type = CERT_X509;
10832 }
10833
10834#if defined(HAVE_LIBGNUTLS1)
10835 /* Ask the pkcs1 dissector to return the public key details */
10836 if (ssl)
10837 asn1_ctx.private_data = &subjectPublicKeyInfo;
10838#endif
10839
10840 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
10841 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
10842 uint32_t context_length;
10843 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
10844 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
10845 return;
10846 }
10847 offset++;
10848 if (context_length > 0) {
10849 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
10850 tvb, offset, context_length, ENC_NA0x00000000);
10851 offset += context_length;
10852 }
10853 }
10854
10855 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
10856 /* For RPK before TLS 1.3, the single RPK is stored directly without
10857 * another "certificate_list" field. */
10858 certificate_list_length = offset_end - offset;
10859 next_offset = offset_end;
10860 } else {
10861 /* CertificateEntry certificate_list<0..2^24-1> */
10862 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
10863 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
10864 return;
10865 }
10866 offset += 3; /* 24-bit length value */
10867 next_offset = offset + certificate_list_length;
10868 }
10869
10870 /* RawPublicKey must have one cert, but X.509 can have multiple. */
10871 if (certificate_list_length > 0 && cert_type == CERT_X509) {
10872 proto_item *ti;
10873
10874 ti = proto_tree_add_none_format(tree,
10875 hf->hf.hs_certificates,
10876 tvb, offset, certificate_list_length,
10877 "Certificates (%u bytes)",
10878 certificate_list_length);
10879
10880 /* make it a subtree */
10881 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
10882 }
10883
10884 while (offset < next_offset) {
10885 switch (cert_type) {
10886 case CERT_RPK:
10887 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
10888 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
10889 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10890 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10891 return;
10892 }
10893 offset += 3;
10894
10895 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10896 offset += cert_length;
10897 break;
10898 case CERT_X509:
10899 /* opaque ASN1Cert<1..2^24-1> */
10900 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
10901 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
10902 return;
10903 }
10904 offset += 3;
10905
10906 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
10907#if defined(HAVE_LIBGNUTLS1)
10908 if (is_from_server && ssl && certificate_index == 0) {
10909 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
10910 /* Only attempt to get the RSA modulus for the first cert. */
10911 asn1_ctx.private_data = NULL((void*)0);
10912 }
10913#endif
10914 offset += cert_length;
10915 break;
10916 }
10917
10918 /* TLS 1.3: Extension extensions<0..2^16-1> */
10919 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
10920 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10921 next_offset, SSL_HND_CERTIFICATE,
10922 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10923 }
10924
10925#if defined(HAVE_LIBGNUTLS1)
10926 certificate_index++;
10927#endif
10928 }
10929}
10930
10931void
10932ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10933 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10934 SslSession *session, bool_Bool is_dtls)
10935{
10936 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
10937 * enum {
10938 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10939 * (255)
10940 * } ClientCertificateType;
10941 *
10942 * opaque DistinguishedName<1..2^16-1>;
10943 *
10944 * struct {
10945 * ClientCertificateType certificate_types<1..2^8-1>;
10946 * DistinguishedName certificate_authorities<3..2^16-1>;
10947 * } CertificateRequest;
10948 *
10949 *
10950 * As per TLSv1.2 (RFC 5246) the format has changed to:
10951 *
10952 * enum {
10953 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
10954 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
10955 * fortezza_dms_RESERVED(20), (255)
10956 * } ClientCertificateType;
10957 *
10958 * enum {
10959 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
10960 * sha512(6), (255)
10961 * } HashAlgorithm;
10962 *
10963 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
10964 * SignatureAlgorithm;
10965 *
10966 * struct {
10967 * HashAlgorithm hash;
10968 * SignatureAlgorithm signature;
10969 * } SignatureAndHashAlgorithm;
10970 *
10971 * SignatureAndHashAlgorithm
10972 * supported_signature_algorithms<2..2^16-2>;
10973 *
10974 * opaque DistinguishedName<1..2^16-1>;
10975 *
10976 * struct {
10977 * ClientCertificateType certificate_types<1..2^8-1>;
10978 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
10979 * DistinguishedName certificate_authorities<0..2^16-1>;
10980 * } CertificateRequest;
10981 *
10982 * draft-ietf-tls-tls13-18:
10983 * struct {
10984 * opaque certificate_request_context<0..2^8-1>;
10985 * SignatureScheme
10986 * supported_signature_algorithms<2..2^16-2>;
10987 * DistinguishedName certificate_authorities<0..2^16-1>;
10988 * CertificateExtension certificate_extensions<0..2^16-1>;
10989 * } CertificateRequest;
10990 *
10991 * RFC 8446 (since draft-ietf-tls-tls13-19):
10992 *
10993 * struct {
10994 * opaque certificate_request_context<0..2^8-1>;
10995 * Extension extensions<2..2^16-1>;
10996 * } CertificateRequest;
10997 */
10998 proto_item *ti;
10999 proto_tree *subtree;
11000 uint32_t next_offset;
11001 asn1_ctx_t asn1_ctx;
11002 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11003 unsigned char draft_version = session->tls13_draft_version;
11004
11005 if (!tree)
11006 return;
11007
11008 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11009
11010 if (is_tls13) {
11011 uint32_t context_length;
11012 /* opaque certificate_request_context<0..2^8-1> */
11013 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11014 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11015 return;
11016 }
11017 offset++;
11018 if (context_length > 0) {
11019 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11020 tvb, offset, context_length, ENC_NA0x00000000);
11021 offset += context_length;
11022 }
11023 } else {
11024 uint32_t cert_types_count;
11025 /* ClientCertificateType certificate_types<1..2^8-1> */
11026 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11027 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11028 return;
11029 }
11030 offset++;
11031 next_offset = offset + cert_types_count;
11032
11033 ti = proto_tree_add_none_format(tree,
11034 hf->hf.hs_cert_types,
11035 tvb, offset, cert_types_count,
11036 "Certificate types (%u type%s)",
11037 cert_types_count,
11038 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11039 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11040
11041 while (offset < next_offset) {
11042 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11043 offset++;
11044 }
11045 }
11046
11047 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11048 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11049 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11050 }
11051
11052 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11053 /*
11054 * TLS 1.3 draft 19 and newer: Extensions.
11055 * SslDecryptSession pointer is NULL because Certificate Extensions
11056 * should not influence decryption state.
11057 */
11058 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11059 offset_end, SSL_HND_CERT_REQUEST,
11060 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11061 } else if (is_tls13 && draft_version <= 18) {
11062 /*
11063 * TLS 1.3 draft 18 and older: certificate_authorities and
11064 * certificate_extensions (a vector of OID mappings).
11065 */
11066 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11067 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11068 } else {
11069 /* for TLS 1.2 and older, the certificate_authorities field. */
11070 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11071 }
11072}
11073/* Certificate and Certificate Request dissections. }}} */
11074
11075void
11076ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11077 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11078{
11079 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11080 hf->hf.hs_client_cert_vrfy_sig_len,
11081 hf->hf.hs_client_cert_vrfy_sig);
11082}
11083
11084/* Finished dissection. {{{ */
11085void
11086ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11087 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11088 const SslSession *session, ssl_hfs_t *ssl_hfs)
11089{
11090 /* For SSLv3:
11091 * struct {
11092 * opaque md5_hash[16];
11093 * opaque sha_hash[20];
11094 * } Finished;
11095 *
11096 * For (D)TLS:
11097 * struct {
11098 * opaque verify_data[12];
11099 * } Finished;
11100 *
11101 * For TLS 1.3:
11102 * struct {
11103 * opaque verify_data[Hash.length];
11104 * }
11105 */
11106 if (!tree)
11107 return;
11108
11109 if (session->version == SSLV3_VERSION0x300) {
11110 if (ssl_hfs != NULL((void*)0)) {
11111 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11112 tvb, offset, 16, ENC_NA0x00000000);
11113 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11114 tvb, offset + 16, 20, ENC_NA0x00000000);
11115 }
11116 } else {
11117 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11118 proto_tree_add_item(tree, hf->hf.hs_finished,
11119 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11120 }
11121} /* }}} */
11122
11123/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11124void
11125ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11126{
11127 uint16_t url_hash_len;
11128
11129 /* enum {
11130 * individual_certs(0), pkipath(1), (255)
11131 * } CertChainType;
11132 *
11133 * struct {
11134 * CertChainType type;
11135 * URLAndHash url_and_hash_list<1..2^16-1>;
11136 * } CertificateURL;
11137 *
11138 * struct {
11139 * opaque url<1..2^16-1>;
11140 * uint8 padding;
11141 * opaque SHA1Hash[20];
11142 * } URLAndHash;
11143 */
11144
11145 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11146 tvb, offset, 1, ENC_NA0x00000000);
11147 offset++;
11148
11149 url_hash_len = tvb_get_ntohs(tvb, offset);
11150 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11151 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11152 offset += 2;
11153 while (url_hash_len-- > 0) {
11154 proto_item *urlhash_item;
11155 proto_tree *urlhash_tree;
11156 uint16_t url_len;
11157
11158 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11159 tvb, offset, -1, ENC_NA0x00000000);
11160 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11161
11162 url_len = tvb_get_ntohs(tvb, offset);
11163 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11164 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11165 offset += 2;
11166
11167 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11168 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11169 offset += url_len;
11170
11171 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11172 tvb, offset, 1, ENC_NA0x00000000);
11173 offset++;
11174 /* Note: RFC 6066 says that padding must be 0x01 */
11175
11176 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11177 tvb, offset, 20, ENC_NA0x00000000);
11178 offset += 20;
11179 }
11180} /* }}} */
11181
11182void
11183ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11184 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11185 SslSession *session, SslDecryptSession *ssl,
11186 bool_Bool is_from_server, bool_Bool is_dtls)
11187{
11188 uint32_t algorithm, uncompressed_length;
11189 uint32_t compressed_certificate_message_length;
11190 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11191 proto_item *ti;
11192 /*
11193 * enum {
11194 * zlib(1),
11195 * brotli(2),
11196 * zstd(3),
11197 * (65535)
11198 * } CertificateCompressionAlgorithm;
11199 *
11200 * struct {
11201 * CertificateCompressionAlgorithm algorithm;
11202 * uint24 uncompressed_length;
11203 * opaque compressed_certificate_message<1..2^24-1>;
11204 * } CompressedCertificate;
11205 */
11206
11207 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11208 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11209 offset += 2;
11210
11211 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11212 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11213 offset += 3;
11214
11215 /* opaque compressed_certificate_message<1..2^24-1>; */
11216 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11217 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11218 return;
11219 }
11220 offset += 3;
11221
11222 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11223 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11224
11225 /* Certificate decompression following algorithm */
11226 switch (algorithm) {
11227 case 1: /* zlib */
11228 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11229 break;
11230 case 2: /* brotli */
11231 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11232 break;
11233 case 3: /* zstd */
11234 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11235 break;
11236 }
11237
11238 if (uncompressed_tvb) {
11239 proto_tree *uncompressed_tree;
11240
11241 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11242 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11243 tvb, offset, offset_end - offset,
11244 "Invalid uncompressed length %u (expected %u)",
11245 tvb_captured_length(uncompressed_tvb),
11246 uncompressed_length);
11247 } else {
11248 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11249 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11250 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11251 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11252 }
11253 }
11254}
11255
11256/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11257static int
11258// NOLINTNEXTLINE(misc-no-recursion)
11259ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11260 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11261 SslSession *session, SslDecryptSession *ssl,
11262 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11263 ssl_master_key_map_t *mk_map)
11264{
11265 uint32_t exts_len;
11266 uint16_t ext_type;
11267 uint32_t ext_len;
11268 uint32_t next_offset;
11269 proto_item *ext_item;
11270 proto_tree *ext_tree;
11271 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11272 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11273 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11274 char *ja3_dash = "";
11275 unsigned supported_version;
11276
11277 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11278 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11279 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11280 return offset_end;
11281 }
11282 offset += 2;
11283 offset_end = offset + exts_len;
11284
11285 if (ja4_data) {
11286 ja4_data->num_extensions = 0;
11287 }
11288 while (offset_end - offset >= 4)
11289 {
11290 ext_type = tvb_get_ntohs(tvb, offset);
11291 ext_len = tvb_get_ntohs(tvb, offset + 2);
11292
11293 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11294 ja4_data->num_extensions += 1;
11295 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11296 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11297 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11298 }
11299 }
11300
11301 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11302 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11303 tls_hello_extension_types,
11304 "Unknown type %u"), ext_len);
11305 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11306
11307 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11308 tvb, offset, 2, ext_type);
11309 offset += 2;
11310 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11311 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11312 ja3_dash = "-";
11313 }
11314
11315 /* opaque extension_data<0..2^16-1> */
11316 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11317 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11318 return offset_end;
11319 }
11320 offset += 2;
11321 next_offset = offset + ext_len;
11322
11323 switch (ext_type) {
11324 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11325 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11326 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11327 if (ja4_data) {
11328 ja4_data->server_name_present = true1;
11329 }
11330 }
11331 break;
11332 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11333 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11334 offset += 1;
11335 break;
11336 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11337 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11338 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11339 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11340 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11341 }
11342 break;
11343 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11344 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11345 offset, next_offset,
11346 hnd_type, ext_type,
11347 session);
11348 break;
11349 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11350 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11351 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11352 next_offset, ja3_sg);
11353 } else {
11354 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11355 next_offset, NULL((void*)0));
11356 }
11357 break;
11358 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11359 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11360 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11361 } else {
11362 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11363 }
11364 break;
11365 case SSL_HND_HELLO_EXT_SRP12:
11366 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11367 break;
11368 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11369 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11370 break;
11371 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11372 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11373 break;
11374 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11375 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11376 break;
11377 case SSL_HND_HELLO_EXT_USE_SRTP14:
11378 if (is_dtls) {
11379 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11380 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11381 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11382 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11383 }
11384 } else {
11385 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11386 }
11387 break;
11388 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11389 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11390 break;
11391 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11392 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11393 break;
11394 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11395 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11396 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11397 offset++;
11398 break;
11399 case SSL_HND_HELLO_EXT_ALPN16:
11400 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11401 break;
11402 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11403 if (hnd_type == SSL_HND_CLIENT_HELLO)
11404 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11405 break;
11406 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11407 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11408 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11409 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11410 break;
11411 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11412 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11413 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11414 offset, next_offset,
11415 hnd_type, ext_type,
11416 session);
11417 break;
11418 case SSL_HND_HELLO_EXT_PADDING21:
11419 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11420 offset += ext_len;
11421 break;
11422 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11423 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11424 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11425 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11426 }
11427 break;
11428 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11429 if (ssl) {
11430 switch (hnd_type) {
11431 case SSL_HND_CLIENT_HELLO:
11432 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11433 break;
11434 case SSL_HND_SERVER_HELLO:
11435 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11436 break;
11437 default: /* no default */
11438 break;
11439 }
11440 }
11441 break;
11442 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11443 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11444 break;
11445 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11446 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11447 break;
11448 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11449 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11450 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11451 offset += 2;
11452 break;
11453 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11454 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11455 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11456 break;
11457 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11458 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11459 break;
11460 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11461 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11462 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11463 break;
11464 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11465 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11466 break;
11467 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11468 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11469 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11470 break;
11471 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11472 switch (hnd_type) {
11473 case SSL_HND_CLIENT_HELLO:
11474 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11475 break;
11476 case SSL_HND_SERVER_HELLO:
11477 case SSL_HND_HELLO_RETRY_REQUEST:
11478 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11479 offset += 2;
11480 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11481 break;
11482 }
11483 break;
11484 case SSL_HND_HELLO_EXT_COOKIE44:
11485 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11486 break;
11487 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11488 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11489 break;
11490 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11491 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11492 break;
11493 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11494 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11495 break;
11496 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11497 break;
11498 case SSL_HND_HELLO_EXT_NPN13172:
11499 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11500 break;
11501 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11502 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11503 break;
11504 case SSL_HND_HELLO_EXT_ALPS17613:
11505 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11506 break;
11507 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11508 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11509 break;
11510 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11511 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11512 break;
11513 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11514 session->deprecated_cid = true1;
11515 /* FALLTHRU */
11516 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11517 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11518 break;
11519 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11520 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11521 break;
11522 default:
11523 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11524 tvb, offset, ext_len, ENC_NA0x00000000);
11525 offset += ext_len;
11526 break;
11527 }
11528
11529 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11530 /* Dissection did not end at expected location, fix it. */
11531 offset = next_offset;
11532 }
11533 }
11534
11535 if (ja3) {
11536 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11537 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11538 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11539 } else {
11540 wmem_strbuf_append_c(ja3, ',');
11541 }
11542 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11543 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11544 } else {
11545 wmem_strbuf_append_c(ja3, ',');
11546 }
11547 }
11548 }
11549
11550 /* Check if Extensions vector is correctly terminated. */
11551 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11552 offset = offset_end;
11553 }
11554
11555 return offset;
11556} /* }}} */
11557
11558
11559/* ClientKeyExchange algo-specific dissectors. {{{ */
11560
11561static void
11562dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11563 proto_tree *tree, uint32_t offset,
11564 uint32_t length)
11565{
11566 int point_len;
11567 proto_tree *ssl_ecdh_tree;
11568
11569 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11570 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11571
11572 /* point */
11573 point_len = tvb_get_uint8(tvb, offset);
11574 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11575 offset, 1, ENC_BIG_ENDIAN0x00000000);
11576 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11577 offset + 1, point_len, ENC_NA0x00000000);
11578}
11579
11580static void
11581dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11582 proto_tree *tree, uint32_t offset, uint32_t length)
11583{
11584 int yc_len;
11585 proto_tree *ssl_dh_tree;
11586
11587 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11588 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11589
11590 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11591 yc_len = tvb_get_ntohs(tvb, offset);
11592 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11593 offset, 2, ENC_BIG_ENDIAN0x00000000);
11594 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11595 offset + 2, yc_len, ENC_NA0x00000000);
11596}
11597
11598static void
11599dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11600 proto_tree *tree, uint32_t offset,
11601 uint32_t length, const SslSession *session)
11602{
11603 int epms_len;
11604 proto_tree *ssl_rsa_tree;
11605
11606 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11607 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11608
11609 /* EncryptedPreMasterSecret.pre_master_secret */
11610 switch (session->version) {
11611 case SSLV2_VERSION0x0002:
11612 case SSLV3_VERSION0x300:
11613 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11614 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11615 * not present. The handshake contents represents the EPMS, see:
11616 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11617 epms_len = length;
11618 break;
11619
11620 default:
11621 /* TLS and DTLS include vector length before EPMS */
11622 epms_len = tvb_get_ntohs(tvb, offset);
11623 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11624 offset, 2, ENC_BIG_ENDIAN0x00000000);
11625 offset += 2;
11626 break;
11627 }
11628 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11629 offset, epms_len, ENC_NA0x00000000);
11630}
11631
11632/* Used in PSK cipher suites */
11633static uint32_t
11634dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11635 proto_tree *tree, uint32_t offset)
11636{
11637 unsigned identity_len;
11638 proto_tree *ssl_psk_tree;
11639
11640 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11641 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11642 /* identity */
11643 identity_len = tvb_get_ntohs(tvb, offset);
11644 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11645 offset, 2, ENC_BIG_ENDIAN0x00000000);
11646 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11647 offset + 2, identity_len, ENC_NA0x00000000);
11648
11649 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11650 return 2 + identity_len;
11651}
11652
11653/* Used in RSA PSK cipher suites */
11654static void
11655dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11656 proto_tree *tree, uint32_t offset,
11657 uint32_t length)
11658{
11659 int identity_len, epms_len;
11660 proto_tree *ssl_psk_tree;
11661
11662 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11663 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11664
11665 /* identity */
11666 identity_len = tvb_get_ntohs(tvb, offset);
11667 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11668 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11669 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11670 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11671 offset += 2 + identity_len;
11672
11673 /* Yc */
11674 epms_len = tvb_get_ntohs(tvb, offset);
11675 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11676 offset, 2, ENC_BIG_ENDIAN0x00000000);
11677 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11678 offset + 2, epms_len, ENC_NA0x00000000);
11679}
11680
11681/* Used in Diffie-Hellman PSK cipher suites */
11682static void
11683dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11684 proto_tree *tree, uint32_t offset, uint32_t length)
11685{
11686 /*
11687 * struct {
11688 * select (KeyExchangeAlgorithm) {
11689 * case diffie_hellman_psk:
11690 * opaque psk_identity<0..2^16-1>;
11691 * ClientDiffieHellmanPublic public;
11692 * } exchange_keys;
11693 * } ClientKeyExchange;
11694 */
11695
11696 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11697 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11698}
11699
11700/* Used in EC Diffie-Hellman PSK cipher suites */
11701static void
11702dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11703 proto_tree *tree, uint32_t offset, uint32_t length)
11704{
11705 /*
11706 * struct {
11707 * select (KeyExchangeAlgorithm) {
11708 * case ec_diffie_hellman_psk:
11709 * opaque psk_identity<0..2^16-1>;
11710 * ClientECDiffieHellmanPublic public;
11711 * } exchange_keys;
11712 * } ClientKeyExchange;
11713 */
11714
11715 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11716 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11717}
11718
11719/* Used in EC J-PAKE cipher suites */
11720static void
11721dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11722 proto_tree *tree, uint32_t offset,
11723 uint32_t length)
11724{
11725 /*
11726 * struct {
11727 * ECPoint V;
11728 * opaque r<1..2^8-1>;
11729 * } ECSchnorrZKP;
11730 *
11731 * struct {
11732 * ECPoint X;
11733 * ECSchnorrZKP zkp;
11734 * } ECJPAKEKeyKP;
11735 *
11736 * struct {
11737 * ECJPAKEKeyKP ecjpake_key_kp;
11738 * } ClientECJPAKEParams;
11739 *
11740 * select (KeyExchangeAlgorithm) {
11741 * case ecjpake:
11742 * ClientECJPAKEParams params;
11743 * } ClientKeyExchange;
11744 */
11745
11746 int point_len;
11747 proto_tree *ssl_ecjpake_tree;
11748
11749 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11750 hf->ett.keyex_params, NULL((void*)0),
11751 "EC J-PAKE Client Params");
11752
11753 /* ECJPAKEKeyKP.X */
11754 point_len = tvb_get_uint8(tvb, offset);
11755 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
11756 offset, 1, ENC_BIG_ENDIAN0x00000000);
11757 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
11758 offset + 1, point_len, ENC_NA0x00000000);
11759 offset += 1 + point_len;
11760
11761 /* ECJPAKEKeyKP.zkp.V */
11762 point_len = tvb_get_uint8(tvb, offset);
11763 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
11764 offset, 1, ENC_BIG_ENDIAN0x00000000);
11765 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
11766 offset + 1, point_len, ENC_NA0x00000000);
11767 offset += 1 + point_len;
11768
11769 /* ECJPAKEKeyKP.zkp.r */
11770 point_len = tvb_get_uint8(tvb, offset);
11771 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
11772 offset, 1, ENC_BIG_ENDIAN0x00000000);
11773 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
11774 offset + 1, point_len, ENC_NA0x00000000);
11775}
11776
11777static void
11778dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11779 proto_tree *tree, uint32_t offset,
11780 uint32_t length)
11781{
11782 int epms_len;
11783 proto_tree *ssl_ecc_sm2_tree;
11784
11785 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11786 hf->ett.keyex_params, NULL((void*)0),
11787 "ECC-SM2 Encrypted PreMaster Secret");
11788
11789 epms_len = tvb_get_ntohs(tvb, offset);
11790 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11791 offset, 2, ENC_BIG_ENDIAN0x00000000);
11792 offset += 2;
11793 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
11794 offset, epms_len, ENC_NA0x00000000);
11795}
11796/* ClientKeyExchange algo-specific dissectors. }}} */
11797
11798
11799/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
11800static uint32_t
11801ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11802 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11803 uint16_t version, int hf_sig_len, int hf_sig)
11804{
11805 uint32_t sig_len;
11806
11807 switch (version) {
11808 case TLSV1DOT2_VERSION0x303:
11809 case DTLSV1DOT2_VERSION0xfefd:
11810 case TLSV1DOT3_VERSION0x304:
11811 case DTLSV1DOT3_VERSION0xfefc:
11812 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
11813 offset += 2;
11814 break;
11815
11816 default:
11817 break;
11818 }
11819
11820 /* Sig */
11821 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
11822 hf_sig_len, 0, UINT16_MAX(65535))) {
11823 return offset_end;
11824 }
11825 offset += 2;
11826 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
11827 offset += sig_len;
11828 return offset;
11829} /* }}} */
11830
11831/* ServerKeyExchange algo-specific dissectors. {{{ */
11832
11833/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
11834static void
11835dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11836 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11837 uint16_t version)
11838{
11839 /*
11840 * TLSv1.2 (RFC 5246 sec 7.4.8)
11841 * struct {
11842 * digitally-signed struct {
11843 * opaque handshake_messages[handshake_messages_length];
11844 * }
11845 * } CertificateVerify;
11846 *
11847 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
11848 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
11849 *
11850 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
11851 * does more hashing including the master secret and padding.
11852 */
11853 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11854 hf->hf.hs_server_keyex_sig_len,
11855 hf->hf.hs_server_keyex_sig);
11856}
11857
11858static uint32_t
11859dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
11860{
11861 /*
11862 * RFC 4492 ECC cipher suites for TLS
11863 *
11864 * struct {
11865 * ECCurveType curve_type;
11866 * select (curve_type) {
11867 * case explicit_prime:
11868 * ...
11869 * case explicit_char2:
11870 * ...
11871 * case named_curve:
11872 * NamedCurve namedcurve;
11873 * };
11874 * } ECParameters;
11875 */
11876
11877 int curve_type;
11878
11879 /* ECParameters.curve_type */
11880 curve_type = tvb_get_uint8(tvb, offset);
11881 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
11882 offset, 1, ENC_BIG_ENDIAN0x00000000);
11883 offset++;
11884
11885 if (curve_type != 3)
11886 return offset_end; /* only named_curves are supported */
11887
11888 /* case curve_type == named_curve; ECParameters.namedcurve */
11889 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
11890 offset, 2, ENC_BIG_ENDIAN0x00000000);
11891 offset += 2;
11892
11893 return offset;
11894}
11895
11896static void
11897dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11898 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11899 uint16_t version, bool_Bool anon)
11900{
11901 /*
11902 * RFC 4492 ECC cipher suites for TLS
11903 *
11904 * struct {
11905 * opaque point <1..2^8-1>;
11906 * } ECPoint;
11907 *
11908 * struct {
11909 * ECParameters curve_params;
11910 * ECPoint public;
11911 * } ServerECDHParams;
11912 *
11913 * select (KeyExchangeAlgorithm) {
11914 * case ec_diffie_hellman:
11915 * ServerECDHParams params;
11916 * Signature signed_params;
11917 * } ServerKeyExchange;
11918 */
11919
11920 int point_len;
11921 proto_tree *ssl_ecdh_tree;
11922
11923 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11924 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
11925
11926 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
11927 if (offset >= offset_end)
11928 return; /* only named_curves are supported */
11929
11930 /* ECPoint.point */
11931 point_len = tvb_get_uint8(tvb, offset);
11932 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
11933 offset, 1, ENC_BIG_ENDIAN0x00000000);
11934 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
11935 offset + 1, point_len, ENC_NA0x00000000);
11936 offset += 1 + point_len;
11937
11938 /* Signature (if non-anonymous KEX) */
11939 if (!anon) {
11940 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
11941 }
11942}
11943
11944static void
11945dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11946 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11947 uint16_t version, bool_Bool anon)
11948{
11949 int p_len, g_len, ys_len;
11950 proto_tree *ssl_dh_tree;
11951
11952 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11953 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
11954
11955 /* p */
11956 p_len = tvb_get_ntohs(tvb, offset);
11957 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
11958 offset, 2, ENC_BIG_ENDIAN0x00000000);
11959 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
11960 offset + 2, p_len, ENC_NA0x00000000);
11961 offset += 2 + p_len;
11962
11963 /* g */
11964 g_len = tvb_get_ntohs(tvb, offset);
11965 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
11966 offset, 2, ENC_BIG_ENDIAN0x00000000);
11967 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
11968 offset + 2, g_len, ENC_NA0x00000000);
11969 offset += 2 + g_len;
11970
11971 /* Ys */
11972 ys_len = tvb_get_ntohs(tvb, offset);
11973 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
11974 offset, 2, ys_len);
11975 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
11976 offset + 2, ys_len, ENC_NA0x00000000);
11977 offset += 2 + ys_len;
11978
11979 /* Signature (if non-anonymous KEX) */
11980 if (!anon) {
11981 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
11982 }
11983}
11984
11985/* Only used in RSA-EXPORT cipher suites */
11986static void
11987dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11988 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11989 uint16_t version)
11990{
11991 int modulus_len, exponent_len;
11992 proto_tree *ssl_rsa_tree;
11993
11994 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11995 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
11996
11997 /* modulus */
11998 modulus_len = tvb_get_ntohs(tvb, offset);
11999 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12000 offset, 2, ENC_BIG_ENDIAN0x00000000);
12001 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12002 offset + 2, modulus_len, ENC_NA0x00000000);
12003 offset += 2 + modulus_len;
12004
12005 /* exponent */
12006 exponent_len = tvb_get_ntohs(tvb, offset);
12007 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12008 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12009 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12010 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12011 offset += 2 + exponent_len;
12012
12013 /* Signature */
12014 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12015}
12016
12017/* Used in RSA PSK and PSK cipher suites */
12018static uint32_t
12019dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12020 proto_tree *tree, uint32_t offset)
12021{
12022 unsigned hint_len;
12023 proto_tree *ssl_psk_tree;
12024
12025 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12026 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12027
12028 /* hint */
12029 hint_len = tvb_get_ntohs(tvb, offset);
12030 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12031 offset, 2, ENC_BIG_ENDIAN0x00000000);
12032 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12033 offset + 2, hint_len, ENC_NA0x00000000);
12034
12035 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12036 return 2 + hint_len;
12037}
12038
12039/* Used in Diffie-Hellman PSK cipher suites */
12040static void
12041dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12042 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12043{
12044 /*
12045 * struct {
12046 * select (KeyExchangeAlgorithm) {
12047 * case diffie_hellman_psk:
12048 * opaque psk_identity_hint<0..2^16-1>;
12049 * ServerDHParams params;
12050 * };
12051 * } ServerKeyExchange;
12052 */
12053
12054 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12055 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12056}
12057
12058/* Used in EC Diffie-Hellman PSK cipher suites */
12059static void
12060dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12061 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12062{
12063 /*
12064 * struct {
12065 * select (KeyExchangeAlgorithm) {
12066 * case ec_diffie_hellman_psk:
12067 * opaque psk_identity_hint<0..2^16-1>;
12068 * ServerECDHParams params;
12069 * };
12070 * } ServerKeyExchange;
12071 */
12072
12073 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12074 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12075}
12076
12077/* Used in EC J-PAKE cipher suites */
12078static void
12079dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12080 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12081{
12082 /*
12083 * struct {
12084 * ECPoint V;
12085 * opaque r<1..2^8-1>;
12086 * } ECSchnorrZKP;
12087 *
12088 * struct {
12089 * ECPoint X;
12090 * ECSchnorrZKP zkp;
12091 * } ECJPAKEKeyKP;
12092 *
12093 * struct {
12094 * ECParameters curve_params;
12095 * ECJPAKEKeyKP ecjpake_key_kp;
12096 * } ServerECJPAKEParams;
12097 *
12098 * select (KeyExchangeAlgorithm) {
12099 * case ecjpake:
12100 * ServerECJPAKEParams params;
12101 * } ServerKeyExchange;
12102 */
12103
12104 int point_len;
12105 proto_tree *ssl_ecjpake_tree;
12106
12107 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12108 hf->ett.keyex_params, NULL((void*)0),
12109 "EC J-PAKE Server Params");
12110
12111 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12112 if (offset >= offset_end)
12113 return; /* only named_curves are supported */
12114
12115 /* ECJPAKEKeyKP.X */
12116 point_len = tvb_get_uint8(tvb, offset);
12117 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12118 offset, 1, ENC_BIG_ENDIAN0x00000000);
12119 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12120 offset + 1, point_len, ENC_NA0x00000000);
12121 offset += 1 + point_len;
12122
12123 /* ECJPAKEKeyKP.zkp.V */
12124 point_len = tvb_get_uint8(tvb, offset);
12125 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12126 offset, 1, ENC_BIG_ENDIAN0x00000000);
12127 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12128 offset + 1, point_len, ENC_NA0x00000000);
12129 offset += 1 + point_len;
12130
12131 /* ECJPAKEKeyKP.zkp.r */
12132 point_len = tvb_get_uint8(tvb, offset);
12133 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12134 offset, 1, ENC_BIG_ENDIAN0x00000000);
12135 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12136 offset + 1, point_len, ENC_NA0x00000000);
12137}
12138
12139/* Only used in ECC-SM2-EXPORT cipher suites */
12140static void
12141dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12142 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12143 uint16_t version)
12144{
12145 proto_tree *ssl_ecc_sm2_tree;
12146
12147 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12148 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12149
12150 /* Signature */
12151 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12152}
12153/* ServerKeyExchange algo-specific dissectors. }}} */
12154
12155/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12156void
12157ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12158 proto_tree *tree, uint32_t offset, uint32_t length,
12159 const SslSession *session)
12160{
12161 switch (ssl_get_keyex_alg(session->cipher)) {
12162 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12163 case KEX_DH_DSS0x14:
12164 case KEX_DH_RSA0x15:
12165 case KEX_DHE_DSS0x10:
12166 case KEX_DHE_RSA0x12:
12167 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12168 break;
12169 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12170 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12171 break;
12172 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12173 case KEX_ECDH_ECDSA0x1a:
12174 case KEX_ECDH_RSA0x1b:
12175 case KEX_ECDHE_ECDSA0x16:
12176 case KEX_ECDHE_RSA0x18:
12177 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12178 break;
12179 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12180 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12181 break;
12182 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12183 /* XXX: implement support for KRB5 */
12184 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12185 tvb, offset, length,
12186 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12187 " developers if you want them to be supported");
12188 break;
12189 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12190 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12191 break;
12192 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12193 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12194 break;
12195 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12196 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12197 break;
12198 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12199 case KEX_SRP_SHA_DSS0x21:
12200 case KEX_SRP_SHA_RSA0x22:
12201 /* XXX: implement support for SRP_SHA* */
12202 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12203 tvb, offset, length,
12204 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12205 " developers if you want them to be supported");
12206 break;
12207 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12208 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12209 break;
12210 case KEX_ECC_SM20x26: /* GB/T 38636 */
12211 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12212 break;
12213 default:
12214 if (session->cipher == 0) {
12215 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12216 tvb, offset, length,
12217 "Cipher Suite not found");
12218 } else {
12219 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12220 tvb, offset, length,
12221 "Cipher Suite 0x%04x is not implemented, "
12222 "contact Wireshark developers if you want this to be supported",
12223 session->cipher);
12224 }
12225 break;
12226 }
12227}
12228
12229void
12230ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12231 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12232 const SslSession *session)
12233{
12234 switch (ssl_get_keyex_alg(session->cipher)) {
12235 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12236 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12237 break;
12238 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12239 case KEX_DH_RSA0x15:
12240 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12241 tvb, offset, offset_end - offset);
12242 break;
12243 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12244 case KEX_DHE_RSA0x12:
12245 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12246 break;
12247 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12248 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12249 break;
12250 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12251 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12252 break;
12253 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12254 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12255 break;
12256 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12257 case KEX_ECDH_RSA0x1b:
12258 case KEX_ECDHE_ECDSA0x16:
12259 case KEX_ECDHE_RSA0x18:
12260 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12261 break;
12262 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12263 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12264 tvb, offset, offset_end - offset);
12265 break;
12266 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12267 case KEX_RSA_PSK0x1f:
12268 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12269 break;
12270 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12271 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12272 break;
12273 case KEX_ECC_SM20x26: /* GB/T 38636 */
12274 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12275 break;
12276 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12277 case KEX_SRP_SHA_DSS0x21:
12278 case KEX_SRP_SHA_RSA0x22:
12279 /* XXX: implement support for SRP_SHA* */
12280 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12281 tvb, offset, offset_end - offset,
12282 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12283 " developers if you want them to be supported");
12284 break;
12285 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12286 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12287 break;
12288 default:
12289 if (session->cipher == 0) {
12290 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12291 tvb, offset, offset_end - offset,
12292 "Cipher Suite not found");
12293 } else {
12294 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12295 tvb, offset, offset_end - offset,
12296 "Cipher Suite 0x%04x is not implemented, "
12297 "contact Wireshark developers if you want this to be supported",
12298 session->cipher);
12299 }
12300 break;
12301 }
12302}
12303/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12304
12305void
12306tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12307 proto_tree *tree, uint32_t offset)
12308{
12309 /* RFC 8446 Section 4.6.3
12310 * enum {
12311 * update_not_requested(0), update_requested(1), (255)
12312 * } KeyUpdateRequest;
12313 *
12314 * struct {
12315 * KeyUpdateRequest request_update;
12316 * } KeyUpdate;
12317 */
12318 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12319}
12320
12321void
12322ssl_common_register_ssl_alpn_dissector_table(const char *name,
12323 const char *ui_name, const int proto)
12324{
12325 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12326 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12327 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12328}
12329
12330void
12331ssl_common_register_dtls_alpn_dissector_table(const char *name,
12332 const char *ui_name, const int proto)
12333{
12334 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12335 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12336 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12337}
12338
12339void
12340ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12341{
12342 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12343 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12344 &(options->psk));
12345
12346 if (is_dtls) {
12347 prefs_register_obsolete_preference(module, "keylog_file");
12348 prefs_register_static_text_preference(module, "keylog_file_removed",
12349 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12350 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12351 return;
12352 }
12353
12354 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12355 "The name of a file which contains a list of \n"
12356 "(pre-)master secrets in one of the following formats:\n"
12357 "\n"
12358 "RSA <EPMS> <PMS>\n"
12359 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12360 "CLIENT_RANDOM <CRAND> <MS>\n"
12361 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12362 "\n"
12363 "Where:\n"
12364 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12365 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12366 "<SSLID> = The SSL Session ID\n"
12367 "<MS> = The Master-Secret (MS)\n"
12368 "<CRAND> = The Client's random number from the ClientHello message\n"
12369 "\n"
12370 "(All fields are in hex notation)",
12371 &(options->keylog_filename), false0);
12372}
12373
12374void
12375ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12376{
12377 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12378 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12379 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12380 * negotiated. */
12381 if (!ssl_session)
12382 return;
12383
12384 switch (ssl_session->session.version) {
12385 /* The handshake message types used in the handshake hash are different
12386 * in different versions. [D]TLS 1.3 tracks the messages up to the
12387 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12388 * at the ClientHello and include the messages up to the ServerHello, at
12389 * which point we know the version.
12390 *
12391 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12392 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12393 * format as TLS 1.3). We don't know at the point of the ClientHello which
12394 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12395 *
12396 * XXX - When the server responds with a HelloRetryRequest, for subsequent
12397 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12398 * replaced with a synthetic handhsake message of type "message_hash",
12399 * per RFC 8446 4.4.1. We aren't concerned with that now, as a HRR generally
12400 * rules out PSK-only key exchange, which is what we calculate the hash for
12401 * here. (The possible exception is when a server sends a HRR to reject
12402 * early data but the server and client otherwise agree on psk_ke, if
12403 * any client/server pairs support that.) We do support that in the context
12404 * of computing the hash for Encrypted Client Hello; see elsewhere.
12405 */
12406 case TLSV1DOT3_VERSION0x304:
12407 case DTLSV1DOT3_VERSION0xfefc:
12408 /* In [D]TLS 1.3 only the following handshake messages are used in the
12409 * handshake transcript. EndOfEarlyData and the Client Certificate,
12410 * Certificate Verify, and Finished are used in deriving the
12411 * resumption_master_secret but not the other secrets derived from
12412 * the master secret (client or server app traffic secret, exporter
12413 * secret). We don't yet support calculating a PSK to resume via
12414 * the resumption_master_secret, so we simply stop the transcript
12415 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12416 switch (msg_type) {
12417 case SSL_HND_CLIENT_HELLO:
12418 case SSL_HND_SERVER_HELLO:
12419 case SSL_HND_HELLO_RETRY_REQUEST:
12420 case SSL_HND_ENCRYPTED_EXTENSIONS:
12421 case SSL_HND_CERT_REQUEST:
12422 break;
12423 case SSL_HND_CERTIFICATE:
12424 case SSL_HND_CERT_VERIFY:
12425 case SSL_HND_FINISHED:
12426 if (!is_from_server)
12427 return;
12428 break;
12429 case SSL_HND_END_OF_EARLY_DATA:
12430 default:
12431 return;
12432 }
12433 break;
12434 default:
12435 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12436 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12437 * but the keys are not retrieved until ChangeCipherSpec later. If
12438 * mutual authentication is requested by the server, an intervening
12439 * CertificateVerify message can be sent but is not to be included
12440 * in the hash. */
12441 if (msg_type == SSL_HND_CERT_VERIFY)
12442 return;
12443 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12444 return;
12445 break;
12446 }
12447
12448 uint32_t old_length = ssl_session->handshake_data.data_len;
12449 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12450 if (length > UINT32_MAX(4294967295U) - old_length) {
12451 /* This can't be a valid transcript; leave it as is. */
12452 ssl_debug_printf("%s handshake transcript too long\n", G_STRFUNC((const char*) (__func__)));
12453 return;
12454 }
12455 if (tvb) {
12456 if (tvb_bytes_exist(tvb, offset, length)) {
12457 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12458 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12459 ssl_session->handshake_data.data_len += length;
12460 }
12461 } else {
12462 /* DTLS calculates the hash as if each handshake message had been
12463 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12464 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12465 */
12466 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12466, (int64_t)length, (int64_t)4))));
12467 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12468 memset(ssl_session->handshake_data.data + old_length, 0, length);
12469 ssl_session->handshake_data.data_len += length;
12470 }
12471}
12472
12473
12474/*
12475 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12476 *
12477 * Local variables:
12478 * c-basic-offset: 4
12479 * tab-width: 8
12480 * indent-tabs-mode: nil
12481 * End:
12482 *
12483 * vi: set shiftwidth=4 tabstop=8 expandtab:
12484 * :indentSize=4:tabSize=8:noTabs=true:
12485 */