Bug Summary

File:builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
Warning:line 10601, column 17
Access to field 'dig' results in a dereference of a null pointer (loaded from field 'cipher_suite')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-22/lib/clang/22 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D CARES_NO_DEPRECATED -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-nonliteral -std=gnu17 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /builds/wireshark/wireshark/sbout/2026-10-28-100341-3660-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <[email protected]>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <[email protected]>
6 * Copyright (c) 2014, Peter Wu <[email protected]>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <[email protected]>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "conversation.h"
41#include "packet-ber.h"
42#include "packet-x509af.h"
43#include "packet-x509if.h"
44#include "packet-tls-utils.h"
45#include "packet-ocsp.h"
46#include "packet-tls.h"
47#include "packet-dtls.h"
48#include "packet-quic.h"
49#if defined(HAVE_LIBGNUTLS1)
50#include <gnutls/abstract.h>
51#include <gnutls/x509.h>
52#include <gnutls/pkcs12.h>
53#endif
54
55/* JA3/JA3S calculations must ignore GREASE values
56 * as described in RFC 8701.
57 */
58#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff))) ((((x) & 0x0f0f) == 0x0a0a) && \
59 (((x) & 0xff) == (((x)>>8) & 0xff)))
60
61/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
62 * form for a similar purpose as GREASE.
63 */
64#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
65
66#define DTLS13_MAX_EPOCH10 10
67
68/* Lookup tables {{{ */
69const value_string ssl_version_short_names[] = {
70 { SSLV2_VERSION0x0002, "SSLv2" },
71 { SSLV3_VERSION0x300, "SSLv3" },
72 { TLSV1_VERSION0x301, "TLSv1" },
73 { TLCPV1_VERSION0x101, "TLCP" },
74 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
75 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
76 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
77 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
78 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
79 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
80 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
81 { 0x00, NULL((void*)0) }
82};
83
84const value_string ssl_versions[] = {
85 { SSLV2_VERSION0x0002, "SSL 2.0" },
86 { SSLV3_VERSION0x300, "SSL 3.0" },
87 { TLSV1_VERSION0x301, "TLS 1.0" },
88 { TLCPV1_VERSION0x101, "TLCP" },
89 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
90 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
91 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
92 { 0x7F0E, "TLS 1.3 (draft 14)" },
93 { 0x7F0F, "TLS 1.3 (draft 15)" },
94 { 0x7F10, "TLS 1.3 (draft 16)" },
95 { 0x7F11, "TLS 1.3 (draft 17)" },
96 { 0x7F12, "TLS 1.3 (draft 18)" },
97 { 0x7F13, "TLS 1.3 (draft 19)" },
98 { 0x7F14, "TLS 1.3 (draft 20)" },
99 { 0x7F15, "TLS 1.3 (draft 21)" },
100 { 0x7F16, "TLS 1.3 (draft 22)" },
101 { 0x7F17, "TLS 1.3 (draft 23)" },
102 { 0x7F18, "TLS 1.3 (draft 24)" },
103 { 0x7F19, "TLS 1.3 (draft 25)" },
104 { 0x7F1A, "TLS 1.3 (draft 26)" },
105 { 0x7F1B, "TLS 1.3 (draft 27)" },
106 { 0x7F1C, "TLS 1.3 (draft 28)" },
107 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
108 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
109 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
110 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
111 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
112 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
113 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
127 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
128 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
129 { 0x00, NULL((void*)0) }
130};
131
132static const value_string ssl_version_ja4_names[] = {
133 { 0x0100, "s1" },
134 { SSLV2_VERSION0x0002, "s2" },
135 { SSLV3_VERSION0x300, "s3" },
136 { TLSV1_VERSION0x301, "10" },
137 { TLSV1DOT1_VERSION0x302, "11" },
138 { TLSV1DOT2_VERSION0x303, "12" },
139 { TLSV1DOT3_VERSION0x304, "13" },
140 { DTLSV1DOT0_VERSION0xfeff, "d1" },
141 { DTLSV1DOT2_VERSION0xfefd, "d2" },
142 { DTLSV1DOT3_VERSION0xfefc, "d3" },
143 { 0x00, NULL((void*)0) }
144};
145
146const value_string ssl_20_msg_types[] = {
147 { SSL2_HND_ERROR0x00, "Error" },
148 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
149 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
150 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
151 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
152 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
153 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
154 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
155 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
156 { 0x00, NULL((void*)0) }
157};
158/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
159/* Note: sorted by ascending value so value_string-ext can do a binary search */
160static const value_string ssl_20_cipher_suites[] = {
161 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
162 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
163 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
164 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
165 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
166 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
167 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
168 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
169 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
171 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
174 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
175 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
177 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
180 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
182 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
183 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
184 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
185 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
186 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
187 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
188 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
189 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
190 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
191#if 0
192 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
193#endif
194 /* RFC 2712 */
195 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
196 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
197 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
198 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
199 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
200 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
201 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
202 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
203 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
204 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
205 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
206 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
207 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
208 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
209 /* RFC 4785 */
210 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
211 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
212 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
213 /* RFC 5246 */
214 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
215 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
216 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
217 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
218 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
219 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
220 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
221 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
222 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
223 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
224 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
225 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
226 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
227 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
229 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
230 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
231 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
232 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
236 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
237 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
238 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
239 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
240 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
241 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
242 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
243 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
244 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
245 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
246 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
247 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
248 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
249 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
250 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
251 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
252 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
253 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
254 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
255 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
256 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
257 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
258 /* 0x00,0x6E-83 Unassigned */
259 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
262 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
263 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
264 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
265 /* RFC 4279 */
266 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
267 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
268 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
269 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
270 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
271 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
272 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
273 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
274 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
275 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
276 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
277 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
278 /* RFC 4162 */
279 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
280 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
281 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
282 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
283 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
284 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
285 /* RFC 5288 */
286 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
287 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
288 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
289 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
290 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
291 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
292 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
293 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
294 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
295 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
296 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
298 /* RFC 5487 */
299 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
300 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
301 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
302 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
303 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
304 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
305 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
306 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
307 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
308 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
309 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
310 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
311 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
312 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
313 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
314 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
315 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
316 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
317 /* From RFC 5932 */
318 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
322 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
323 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
324 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
327 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
328 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
329 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
330 /* 0x00,0xC6-FE Unassigned */
331 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
332 /* 0x01-BF,* Unassigned */
333 /* From RFC 4492 */
334 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
335 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
336 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
337 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
338 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
339 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
340 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
341 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
342 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
343 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
344 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
345 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
346 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
347 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
348 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
349 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
350 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
351 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
352 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
353 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
354 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
355 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
356 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
357 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
358 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
359 /* RFC 5054 */
360 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
361 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
362 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
363 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
364 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
365 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
366 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
367 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
368 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
369 /* RFC 5589 */
370 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
371 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
372 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
373 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
374 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
375 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
376 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
377 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
378 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
379 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
380 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
381 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
382 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
383 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
384 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
385 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
386 /* RFC 5489 */
387 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
388 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
389 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
390 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
391 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
392 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
393 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
394 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
395 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
396 /* 0xC0,0x3C-FF Unassigned
397 0xC1-FD,* Unassigned
398 0xFE,0x00-FD Unassigned
399 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
400 0xFF,0x00-FF Reserved for Private Use [RFC5246]
401 */
402
403 /* old numbers used in the beginning
404 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
405 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
406 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
407 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408
409 /* https://tools.ietf.org/html/rfc7905 */
410 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
415 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
416 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
417
418 /* GM/T 0024-2014 */
419 { 0x00e001, "ECDHE_SM1_SM3"},
420 { 0x00e003, "ECC_SM1_SM3"},
421 { 0x00e005, "IBSDH_SM1_SM3"},
422 { 0x00e007, "IBC_SM1_SM3"},
423 { 0x00e009, "RSA_SM1_SM3"},
424 { 0x00e00a, "RSA_SM1_SHA1"},
425 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
426 { 0x00e013, "ECC_SM4_CBC_SM3"},
427 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
428 { 0x00e017, "IBC_SM4_CBC_SM3"},
429 { 0x00e019, "RSA_SM4_CBC_SM3"},
430 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
431 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
432 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
433 { 0x00e053, "ECC_SM4_GCM_SM3"},
434 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
435 { 0x00e057, "IBC_SM4_GCM_SM3"},
436 { 0x00e059, "RSA_SM4_GCM_SM3"},
437 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
438
439 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
440 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
441 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
442 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
443 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
444 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
445 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
446 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
447 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
448 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
449 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
450 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
451 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
452 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
453 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
454 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
455 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
456
457 /* these from http://www.mozilla.org/projects/
458 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
459 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
461 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
462 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
463 /* note that ciphersuites of {0x00????} are TLS cipher suites in
464 * a sslv2 client hello message; the ???? above is the two-byte
465 * tls cipher suite id
466 */
467
468 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
469 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
470 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
471 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
472 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
473 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
474 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
475 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
476
477 { 0x00, NULL((void*)0) }
478};
479
480value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites", ((void*)0) };
481
482
483/*
484 * Supported Groups (formerly named "EC Named Curve").
485 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
486 */
487const value_string ssl_extension_curves[] = {
488 { 1, "sect163k1" },
489 { 2, "sect163r1" },
490 { 3, "sect163r2" },
491 { 4, "sect193r1" },
492 { 5, "sect193r2" },
493 { 6, "sect233k1" },
494 { 7, "sect233r1" },
495 { 8, "sect239k1" },
496 { 9, "sect283k1" },
497 { 10, "sect283r1" },
498 { 11, "sect409k1" },
499 { 12, "sect409r1" },
500 { 13, "sect571k1" },
501 { 14, "sect571r1" },
502 { 15, "secp160k1" },
503 { 16, "secp160r1" },
504 { 17, "secp160r2" },
505 { 18, "secp192k1" },
506 { 19, "secp192r1" },
507 { 20, "secp224k1" },
508 { 21, "secp224r1" },
509 { 22, "secp256k1" },
510 { 23, "secp256r1" },
511 { 24, "secp384r1" },
512 { 25, "secp521r1" },
513 { 26, "brainpoolP256r1" }, /* RFC 7027 */
514 { 27, "brainpoolP384r1" }, /* RFC 7027 */
515 { 28, "brainpoolP512r1" }, /* RFC 7027 */
516 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
517 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
518 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
519 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
520 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
521 { 34, "GC256A" }, /* RFC9189 */
522 { 35, "GC256B" }, /* RFC9189 */
523 { 36, "GC256C" }, /* RFC9189 */
524 { 37, "GC256D" }, /* RFC9189 */
525 { 38, "GC512A" }, /* RFC9189 */
526 { 39, "GC512B" }, /* RFC9189 */
527 { 40, "GC512C" }, /* RFC9189 */
528 { 41, "curveSM2" }, /* RFC 8998 */
529 { 256, "ffdhe2048" }, /* RFC 7919 */
530 { 257, "ffdhe3072" }, /* RFC 7919 */
531 { 258, "ffdhe4096" }, /* RFC 7919 */
532 { 259, "ffdhe6144" }, /* RFC 7919 */
533 { 260, "ffdhe8192" }, /* RFC 7919 */
534 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
535 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
536 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
537 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
538 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
539 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
540 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
541 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
544 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
545 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
547 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
548 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
556 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
557 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
558 { 0xFF01, "arbitrary_explicit_prime_curves" },
559 { 0xFF02, "arbitrary_explicit_char2_curves" },
560 /* Below are various unofficial values that have been used for testing. */
561 /* PQC key exchange algorithms from OQS-OpenSSL,
562 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
563 These use IANA unassigned values and this list may be incomplete.
564 */
565 { 0x2F00, "p256_frodo640aes" },
566 { 0x2F01, "p256_frodo640shake" },
567 { 0x2F02, "p384_frodo976aes" },
568 { 0x0203, "frodo976shake" },
569 { 0x2F03, "p384_frodo976shake" },
570 { 0x0204, "frodo1344aes" },
571 { 0x2F04, "p521_frodo1344aes" },
572 { 0x0205, "frodo1344shake" },
573 { 0x2F05, "p521_frodo1344shake" },
574 { 0x023A, "kyber512" },
575 { 0x2F3A, "p256_kyber512" },
576 { 0x023C, "kyber768" },
577 { 0x2F3C, "p384_kyber768" },
578 { 0x023D, "kyber1024" },
579 { 0x2F3D, "p521_kyber1024" },
580 { 0x0214, "ntru_hps2048509" },
581 { 0x2F14, "p256_ntru_hps2048509" },
582 { 0x0215, "ntru_hps2048677" },
583 { 0x2F15, "p384_ntru_hps2048677" },
584 { 0x0216, "ntru_hps4096821" },
585 { 0x2F16, "p521_ntru_hps4096821" },
586 { 0x0245, "ntru_hps40961229" },
587 { 0x2F45, "p521_ntru_hps40961229" },
588 { 0x0217, "ntru_hrss701" },
589 { 0x2F17, "p384_ntru_hrss701" },
590 { 0x0246, "ntru_hrss1373" },
591 { 0x2F46, "p521_ntru_hrss1373" },
592 { 0x0218, "lightsaber" },
593 { 0x2F18, "p256_lightsaber" },
594 { 0x0219, "saber" },
595 { 0x2F19, "p384_saber" },
596 { 0x021A, "firesaber" },
597 { 0x2F1A, "p521_firesaber" },
598 { 0x021B, "sidhp434" },
599 { 0x2F1B, "p256_sidhp434" },
600 { 0x021C, "sidhp503" },
601 { 0x2F1C, "p256_sidhp503" },
602 { 0x021D, "sidhp610" },
603 { 0x2F1D, "p384_sidhp610" },
604 { 0x021E, "sidhp751" },
605 { 0x2F1E, "p521_sidhp751" },
606 { 0x021F, "sikep434" },
607 { 0x2F1F, "p256_sikep434" },
608 { 0x0220, "sikep503" },
609 { 0x2F20, "p256_sikep503" },
610 { 0x0221, "sikep610" },
611 { 0x2F21, "p384_sikep610" },
612 { 0x0222, "sikep751" },
613 { 0x2F22, "p521_sikep751" },
614 { 0x0238, "bikel1" },
615 { 0x2F38, "p256_bikel1" },
616 { 0x023B, "bikel3" },
617 { 0x2F3B, "p384_bikel3" },
618 { 0x023E, "kyber90s512" },
619 { 0x2F3E, "p256_kyber90s512" },
620 { 0x023F, "kyber90s768" },
621 { 0x2F3F, "p384_kyber90s768" },
622 { 0x0240, "kyber90s1024" },
623 { 0x2F40, "p521_kyber90s1024" },
624 { 0x022C, "hqc128" },
625 { 0x2F2C, "p256_hqc128" },
626 { 0x022D, "hqc192" },
627 { 0x2F2D, "p384_hqc192" },
628 { 0x022E, "hqc256" },
629 { 0x2F2E, "p521_hqc256" },
630 { 0x022F, "ntrulpr653" },
631 { 0x2F2F, "p256_ntrulpr653" },
632 { 0x0230, "ntrulpr761" },
633 { 0x2F43, "p256_ntrulpr761" },
634 { 0x0231, "ntrulpr857" },
635 { 0x2F31, "p384_ntrulpr857" },
636 { 0x0241, "ntrulpr1277" },
637 { 0x2F41, "p521_ntrulpr1277" },
638 { 0x0232, "sntrup653" },
639 { 0x2F32, "p256_sntrup653" },
640 { 0x0233, "sntrup761" },
641 { 0x2F44, "p256_sntrup761" },
642 { 0x0234, "sntrup857" },
643 { 0x2F34, "p384_sntrup857" },
644 { 0x0242, "sntrup1277" },
645 { 0x2F42, "p521_sntrup1277" },
646 /* Other PQ key exchange algorithms, using Reserved for Private Use values
647 https://blog.cloudflare.com/post-quantum-for-all
648 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
649 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
650 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
651 { 0x00, NULL((void*)0) }
652};
653
654const value_string ssl_curve_types[] = {
655 { 1, "explicit_prime" },
656 { 2, "explicit_char2" },
657 { 3, "named_curve" },
658 { 0x00, NULL((void*)0) }
659};
660
661const value_string ssl_extension_ec_point_formats[] = {
662 { 0, "uncompressed" },
663 { 1, "ansiX962_compressed_prime" },
664 { 2, "ansiX962_compressed_char2" },
665 { 0x00, NULL((void*)0) }
666};
667
668const value_string ssl_20_certificate_type[] = {
669 { 0x00, "N/A" },
670 { 0x01, "X.509 Certificate" },
671 { 0x00, NULL((void*)0) }
672};
673
674const value_string ssl_31_content_type[] = {
675 { 20, "Change Cipher Spec" },
676 { 21, "Alert" },
677 { 22, "Handshake" },
678 { 23, "Application Data" },
679 { 24, "Heartbeat" },
680 { 25, "Connection ID" },
681 { 0x00, NULL((void*)0) }
682};
683
684#if 0
685/* XXX - would be used if we dissected the body of a Change Cipher Spec
686 message. */
687const value_string ssl_31_change_cipher_spec[] = {
688 { 1, "Change Cipher Spec" },
689 { 0x00, NULL((void*)0) }
690};
691#endif
692
693const value_string ssl_31_alert_level[] = {
694 { 1, "Warning" },
695 { 2, "Fatal" },
696 { 0x00, NULL((void*)0) }
697};
698
699const value_string ssl_31_alert_description[] = {
700 { 0, "Close Notify" },
701 { 1, "End of Early Data" },
702 { 10, "Unexpected Message" },
703 { 20, "Bad Record MAC" },
704 { 21, "Decryption Failed" },
705 { 22, "Record Overflow" },
706 { 30, "Decompression Failure" },
707 { 40, "Handshake Failure" },
708 { 41, "No Certificate" },
709 { 42, "Bad Certificate" },
710 { 43, "Unsupported Certificate" },
711 { 44, "Certificate Revoked" },
712 { 45, "Certificate Expired" },
713 { 46, "Certificate Unknown" },
714 { 47, "Illegal Parameter" },
715 { 48, "Unknown CA" },
716 { 49, "Access Denied" },
717 { 50, "Decode Error" },
718 { 51, "Decrypt Error" },
719 { 60, "Export Restriction" },
720 { 70, "Protocol Version" },
721 { 71, "Insufficient Security" },
722 { 80, "Internal Error" },
723 { 86, "Inappropriate Fallback" },
724 { 90, "User Canceled" },
725 { 100, "No Renegotiation" },
726 { 109, "Missing Extension" },
727 { 110, "Unsupported Extension" },
728 { 111, "Certificate Unobtainable" },
729 { 112, "Unrecognized Name" },
730 { 113, "Bad Certificate Status Response" },
731 { 114, "Bad Certificate Hash Value" },
732 { 115, "Unknown PSK Identity" },
733 { 116, "Certificate Required" },
734 { 120, "No application Protocol" },
735 { 121, "ECH Required" },
736 { 0x00, NULL((void*)0) }
737};
738
739const value_string ssl_31_handshake_type[] = {
740 { SSL_HND_HELLO_REQUEST, "Hello Request" },
741 { SSL_HND_CLIENT_HELLO, "Client Hello" },
742 { SSL_HND_SERVER_HELLO, "Server Hello" },
743 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
744 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
745 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
746 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
747 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
748 { SSL_HND_CERTIFICATE, "Certificate" },
749 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
750 { SSL_HND_CERT_REQUEST, "Certificate Request" },
751 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
752 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
753 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
754 { SSL_HND_FINISHED, "Finished" },
755 { SSL_HND_CERT_URL, "Client Certificate URL" },
756 { SSL_HND_CERT_STATUS, "Certificate Status" },
757 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
758 { SSL_HND_KEY_UPDATE, "Key Update" },
759 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
760 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
761 { 0x00, NULL((void*)0) }
762};
763
764const value_string tls_heartbeat_type[] = {
765 { 1, "Request" },
766 { 2, "Response" },
767 { 0x00, NULL((void*)0) }
768};
769
770const value_string tls_heartbeat_mode[] = {
771 { 1, "Peer allowed to send requests" },
772 { 2, "Peer not allowed to send requests" },
773 { 0x00, NULL((void*)0) }
774};
775
776const value_string ssl_31_compression_method[] = {
777 { 0, "null" },
778 { 1, "DEFLATE" },
779 { 64, "LZS" },
780 { 0x00, NULL((void*)0) }
781};
782
783#if 0
784/* XXX - would be used if we dissected a Signature, as would be
785 seen in a server key exchange or certificate verify message. */
786const value_string ssl_31_key_exchange_algorithm[] = {
787 { 0, "RSA" },
788 { 1, "Diffie Hellman" },
789 { 0x00, NULL((void*)0) }
790};
791
792const value_string ssl_31_signature_algorithm[] = {
793 { 0, "Anonymous" },
794 { 1, "RSA" },
795 { 2, "DSA" },
796 { 0x00, NULL((void*)0) }
797};
798#endif
799
800const value_string ssl_31_client_certificate_type[] = {
801 { 1, "RSA Sign" },
802 { 2, "DSS Sign" },
803 { 3, "RSA Fixed DH" },
804 { 4, "DSS Fixed DH" },
805 /* GOST certificate types */
806 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
807 { 21, "GOST R 34.10-94" },
808 { 22, "GOST R 34.10-2001" },
809 /* END GOST certificate types */
810 { 64, "ECDSA Sign" },
811 { 65, "RSA Fixed ECDH" },
812 { 66, "ECDSA Fixed ECDH" },
813 { 80, "IBC Params" },
814 { 0x00, NULL((void*)0) }
815};
816
817#if 0
818/* XXX - would be used if we dissected exchange keys, as would be
819 seen in a client key exchange message. */
820const value_string ssl_31_public_value_encoding[] = {
821 { 0, "Implicit" },
822 { 1, "Explicit" },
823 { 0x00, NULL((void*)0) }
824};
825#endif
826
827/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
828/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
829static const value_string ssl_31_ciphersuite[] = {
830 /* RFC 2246, RFC 4346, RFC 5246 */
831 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
832 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
833 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
834 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
835 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
836 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
837 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
838 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
839 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
841 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
844 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
845 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
847 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
850 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
852 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
853 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
854 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
855 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
856 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
857 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
858 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
859
860 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
861 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
862#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
863 to remove according to David Hopwood <[email protected]>
864 of the ietf-tls list */
865 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
866#endif
867 /* RFC 2712 */
868 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
869 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
870 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
871 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
872 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
873 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
874 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
875 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
876 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
877 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
878 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
879 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
880 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
881 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
882 /* RFC 4785 */
883 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
884 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
885 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
886 /* RFC 5246 */
887 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
888 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
889 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
890 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
891 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
892 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
893 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
894 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
895 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
896 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
897 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
898 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
899 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
900 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
902 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
903 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
904 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
905 /* RFC 4132 */
906 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
909 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
910 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
911 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
912 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
913 /* --- ??? --- */
914 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
915 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
916 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
917 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
918 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
919 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
920 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
921 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
922 /* --- ??? ---*/
923 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
924 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
925 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
926 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
927 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
928 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
929 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
930 /* draft-chudov-cryptopro-cptls-04.txt */
931 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
932 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
933 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
934 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
935 /* RFC 4132 */
936 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
939 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
940 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
941 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
942 /* RFC 4279 */
943 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
944 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
945 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
946 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
947 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
948 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
949 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
950 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
951 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
952 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
953 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
954 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
955 /* RFC 4162 */
956 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
957 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
958 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
959 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
960 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
961 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
962 /* RFC 5288 */
963 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
964 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
965 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
966 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
967 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
968 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
969 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
970 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
971 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
972 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
973 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
974 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
975 /* RFC 5487 */
976 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
977 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
978 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
979 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
980 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
981 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
982 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
983 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
984 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
985 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
986 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
987 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
988 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
989 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
990 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
991 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
992 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
993 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
994 /* From RFC 5932 */
995 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
999 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1000 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
1001 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1004 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1005 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1006 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1007 /* RFC 8998 */
1008 { 0x00C6, "TLS_SM4_GCM_SM3" },
1009 { 0x00C7, "TLS_SM4_CCM_SM3" },
1010 /* 0x00,0xC8-FE Unassigned */
1011 /* From RFC 5746 */
1012 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1013 /* RFC 8701 */
1014 { 0x0A0A, "Reserved (GREASE)" },
1015 /* RFC 8446 */
1016 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1017 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1018 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1019 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1020 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1021 /* RFC 8701 */
1022 { 0x1A1A, "Reserved (GREASE)" },
1023 { 0x2A2A, "Reserved (GREASE)" },
1024 { 0x3A3A, "Reserved (GREASE)" },
1025 { 0x4A4A, "Reserved (GREASE)" },
1026 /* From RFC 7507 */
1027 { 0x5600, "TLS_FALLBACK_SCSV" },
1028 /* RFC 8701 */
1029 { 0x5A5A, "Reserved (GREASE)" },
1030 { 0x6A6A, "Reserved (GREASE)" },
1031 { 0x7A7A, "Reserved (GREASE)" },
1032 { 0x8A8A, "Reserved (GREASE)" },
1033 { 0x9A9A, "Reserved (GREASE)" },
1034 { 0xAAAA, "Reserved (GREASE)" },
1035 { 0xBABA, "Reserved (GREASE)" },
1036 /* From RFC 4492 */
1037 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1038 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1039 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1040 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1041 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1042 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1043 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1044 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1045 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1046 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1047 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1048 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1049 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1050 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1051 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1052 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1053 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1054 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1055 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1056 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1057 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1058 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1059 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1060 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1061 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1062 /* RFC 5054 */
1063 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1064 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1065 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1066 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1067 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1068 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1069 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1070 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1071 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1072 /* RFC 5589 */
1073 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1074 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1075 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1076 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1077 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1078 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1079 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1080 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1081 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1082 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1083 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1084 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1085 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1086 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1087 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1088 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1089 /* RFC 5489 */
1090 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1091 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1092 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1093 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1094 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1095 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1096 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1097 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1098 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1099 /* RFC 6209 */
1100 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1101 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1102 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1103 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1104 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1105 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1106 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1107 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1108 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1109 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1110 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1111 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1112 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1113 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1114 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1115 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1116 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1117 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1118 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1119 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1120 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1121 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1122 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1123 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1124 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1125 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1126 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1127 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1128 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1129 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1130 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1131 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1132 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1133 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1134 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1135 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1136 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1137 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1138 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1139 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1140 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1141 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1142 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1143 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1144 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1145 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1146 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1147 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1148 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1149 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1150 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1151 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1152 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1153 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1154 /* RFC 6367 */
1155 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1156 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1157 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1158 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1159 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1160 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1161 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1162 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1163 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1164 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1165 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1166 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1167 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1168 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1169 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1170 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1171 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1172 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1173 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1174 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1175 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1176 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1177 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1178 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1179 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1180 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1181 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1182 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1183 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1184 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1185 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1186 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1187 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1188 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1189 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1190 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1191 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1192 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1193 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1194 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1195 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1196 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1197 /* RFC 6655 */
1198 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1199 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1200 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1201 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1202 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1203 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1204 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1205 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1206 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1207 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1208 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1209 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1210 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1211 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1212 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1213 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1214 /* RFC 7251 */
1215 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1216 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1217 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1218 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1219 /* RFC 8492 */
1220 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1221 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1222 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1223 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1224 /* draft-camwinget-tls-ts13-macciphersuites */
1225 { 0xC0B4, "TLS_SHA256_SHA256" },
1226 { 0xC0B5, "TLS_SHA384_SHA384" },
1227 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1228 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1229 /* draft-smyshlyaev-tls12-gost-suites */
1230 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1231 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1232 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1233 /* draft-smyshlyaev-tls13-gost-suites */
1234 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1235 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1236 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1237 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1238 /* RFC 8701 */
1239 { 0xCACA, "Reserved (GREASE)" },
1240/*
12410xC0,0xAB-FF Unassigned
12420xC1,0x03-FD,* Unassigned
12430xFE,0x00-FD Unassigned
12440xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12450xFF,0x00-FF Reserved for Private Use [RFC5246]
1246*/
1247 /* old numbers used in the beginning
1248 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1249 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1250 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 /* RFC 7905 */
1253 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1258 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1259 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1260 /* RFC 8442 */
1261 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1262 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1263 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1264 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1265 /* RFC 8701 */
1266 { 0xDADA, "Reserved (GREASE)" },
1267 /* GM/T 0024-2014 */
1268 { 0xe001, "ECDHE_SM1_SM3"},
1269 { 0xe003, "ECC_SM1_SM3"},
1270 { 0xe005, "IBSDH_SM1_SM3"},
1271 { 0xe007, "IBC_SM1_SM3"},
1272 { 0xe009, "RSA_SM1_SM3"},
1273 { 0xe00a, "RSA_SM1_SHA1"},
1274 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1275 { 0xe013, "ECC_SM4_CBC_SM3"},
1276 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1277 { 0xe017, "IBC_SM4_CBC_SM3"},
1278 { 0xe019, "RSA_SM4_CBC_SM3"},
1279 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1280 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1281 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1282 { 0xe053, "ECC_SM4_GCM_SM3"},
1283 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1284 { 0xe057, "IBC_SM4_GCM_SM3"},
1285 { 0xe059, "RSA_SM4_GCM_SM3"},
1286 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1287 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1288 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1289 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1290 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1291 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1292 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1293 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1294 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1295 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1296 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1297 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1298 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1299 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1300 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1301 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1302 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1303 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1304 /* RFC 8701 */
1305 { 0xEAEA, "Reserved (GREASE)" },
1306 { 0xFAFA, "Reserved (GREASE)" },
1307 /* these from http://www.mozilla.org/projects/
1308 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1309 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1310 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1312 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1313 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1314 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1315 /* note that ciphersuites 0xff00 - 0xffff are private */
1316 { 0x00, NULL((void*)0) }
1317};
1318
1319value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
, ((void*)0) };
1320
1321/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1322const value_string tls_hello_extension_types[] = {
1323 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1327 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1328 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1329 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1330 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1331 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1332 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1333 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1334 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1335 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1336 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1337 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1338 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1339 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1340 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1341 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1342 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1343 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1344 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1345 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1346 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1347 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1348 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1349 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1350 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1351 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1352 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1353 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1354 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1357 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1360 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1363 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1364 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1365 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1366 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1367 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1368 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1369 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1370 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1371 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1372 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1373 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1374 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1376 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */
1377 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1379 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1380 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1381 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1382 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1383 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1384 https://twitter.com/ericlaw/status/274237352531083264 */
1385 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1386 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1387 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1388 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1395 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1396 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1397 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1398 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1399 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1400 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1401 { 0, NULL((void*)0) }
1402};
1403
1404const value_string tls_hello_ext_server_name_type_vs[] = {
1405 { 0, "host_name" },
1406 { 0, NULL((void*)0) }
1407};
1408
1409/* RFC 6066 Section 4 */
1410const value_string tls_hello_ext_max_fragment_length[] = {
1411 { 1, "512" }, // 2^9
1412 { 2, "1024" }, // 2^10
1413 { 3, "2048" }, // 2^11
1414 { 4, "4096" }, // 2^12
1415 { 0, NULL((void*)0) }
1416};
1417
1418/* RFC 8446 Section 4.2.9 */
1419const value_string tls_hello_ext_psk_ke_mode[] = {
1420 { 0, "PSK-only key establishment (psk_ke)" },
1421 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1422 { 0, NULL((void*)0) }
1423};
1424
1425/* RFC 6066 Section 6 */
1426const value_string tls_hello_ext_trusted_ca_key_type[] = {
1427 {0, "pre_agreed"},
1428 {1, "key_sha1_hash"},
1429 {2, "x509_name"},
1430 {3, "cert_sha1_hash"},
1431 {0, NULL((void*)0)}
1432};
1433
1434const value_string tls13_key_update_request[] = {
1435 { 0, "update_not_requested" },
1436 { 1, "update_requested" },
1437 { 0, NULL((void*)0) }
1438};
1439
1440/* RFC 5246 7.4.1.4.1 */
1441/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1442/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1443 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1444 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1445 *
1446 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1447 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1448 * and TLS HashAlgorithm registries, but the new values are not compatible
1449 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1450 * cause confusion if used to interpret one of those schemes in a
1451 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1452 */
1453const value_string tls_hash_algorithm[] = {
1454 { 0, "None" },
1455 { 1, "MD5" },
1456 { 2, "SHA1" },
1457 { 3, "SHA224" },
1458 { 4, "SHA256" },
1459 { 5, "SHA384" },
1460 { 6, "SHA512" },
1461#if 0
1462 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1463 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1464 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1465 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1466 */
1467 { 8, "Intrinsic" },
1468#endif
1469 { 0, NULL((void*)0) }
1470};
1471
1472const value_string tls_signature_algorithm[] = {
1473 { 0, "Anonymous" },
1474 { 1, "RSA" },
1475 { 2, "DSA" },
1476 { 3, "ECDSA" },
1477#if 0
1478 /* As above. */
1479 { 7, "ED25519" },
1480 { 8, "ED448" },
1481 { 64, "GOSTR34102012_256" },
1482 { 65, "GOSTR34102012_512" },
1483#endif
1484 { 0, NULL((void*)0) }
1485};
1486
1487/* RFC 8446 Section 4.2.3 */
1488const value_string tls13_signature_algorithm[] = {
1489 { 0x0201, "rsa_pkcs1_sha1" },
1490 { 0x0203, "ecdsa_sha1" },
1491 { 0x0401, "rsa_pkcs1_sha256" },
1492 { 0x0403, "ecdsa_secp256r1_sha256" },
1493 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0501, "rsa_pkcs1_sha384" },
1495 { 0x0503, "ecdsa_secp384r1_sha384" },
1496 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0601, "rsa_pkcs1_sha512" },
1498 { 0x0603, "ecdsa_secp521r1_sha512" },
1499 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1500 { 0x0704, "eccsi_sha256" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1501 { 0x0705, "iso_ibs1" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1502 { 0x0706, "iso_ibs2" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1503 { 0x0707, "iso_chinese_ibs" }, /* draft-wang-tls-raw-public-key-with-ibc-02 */
1504 { 0x0708, "sm2sig_sm3" },
1505 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1506 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1507 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1508 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1509 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1510 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1511 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1512 { 0x0804, "rsa_pss_rsae_sha256" },
1513 { 0x0805, "rsa_pss_rsae_sha384" },
1514 { 0x0806, "rsa_pss_rsae_sha512" },
1515 { 0x0807, "ed25519" },
1516 { 0x0808, "ed448" },
1517 { 0x0809, "rsa_pss_pss_sha256" },
1518 { 0x080a, "rsa_pss_pss_sha384" },
1519 { 0x080b, "rsa_pss_pss_sha512" },
1520 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1521 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1522 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1523 { 0x0904, "mldsa44" }, /* draft-ietf-tls-mldsa-00 */
1524 { 0x0905, "mldsa65" }, /* draft-ietf-tls-mldsa-00 */
1525 { 0x0906, "mldsa87" }, /* draft-ietf-tls-mldsa-00 */
1526 { 0x0911, "slhdsa_sha2_128s" }, /* draft-reddy-tls-slhdsa-01 */
1527 { 0x0912, "slhdsa_sha2_128f" }, /* draft-reddy-tls-slhdsa-01 */
1528 { 0x0913, "slhdsa_sha2_192s" }, /* draft-reddy-tls-slhdsa-01 */
1529 { 0x0914, "slhdsa_sha2_192f" }, /* draft-reddy-tls-slhdsa-01 */
1530 { 0x0915, "slhdsa_sha2_256s" }, /* draft-reddy-tls-slhdsa-01 */
1531 { 0x0916, "slhdsa_sha2_256f" }, /* draft-reddy-tls-slhdsa-01 */
1532 { 0x0917, "slhdsa_shake_128s" }, /* draft-reddy-tls-slhdsa-01 */
1533 { 0x0918, "slhdsa_shake_128f" }, /* draft-reddy-tls-slhdsa-01 */
1534 { 0x0919, "slhdsa_shake_192s" }, /* draft-reddy-tls-slhdsa-01 */
1535 { 0x091a, "slhdsa_shake_192f" }, /* draft-reddy-tls-slhdsa-01 */
1536 { 0x091b, "slhdsa_shake_256s" }, /* draft-reddy-tls-slhdsa-01 */
1537 { 0x091c, "slhdsa_shake_256f" }, /* draft-reddy-tls-slhdsa-01 */
1538 { 0x0a0a, "GREASE" },
1539 { 0x1a1a, "GREASE" },
1540 { 0x2a2a, "GREASE" },
1541 { 0x3a3a, "GREASE" },
1542 { 0x4a4a, "GREASE" },
1543 { 0x5a5a, "GREASE" },
1544 { 0x6a6a, "GREASE" },
1545 { 0x7a7a, "GREASE" },
1546 { 0x8a8a, "GREASE" },
1547 { 0x9a9a, "GREASE" },
1548 { 0xaaaa, "GREASE" },
1549 { 0xbaba, "GREASE" },
1550 { 0xcaca, "GREASE" },
1551 { 0xdada, "GREASE" },
1552 { 0xeaea, "GREASE" },
1553 { 0xfafa, "GREASE" },
1554 /* PQC digital signature algorithms from OQS-OpenSSL,
1555 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-sig-info.md */
1556 { 0xfea0, "dilithium2" },
1557 { 0xfea1, "p256_dilithium2" },
1558 { 0xfea2, "rsa3072_dilithium2" },
1559 { 0xfea3, "dilithium3" },
1560 { 0xfea4, "p384_dilithium3" },
1561 { 0xfea5, "dilithium5" },
1562 { 0xfea6, "p521_dilithium5" },
1563 { 0xfea7, "dilithium2_aes" },
1564 { 0xfea8, "p256_dilithium2_aes" },
1565 { 0xfea9, "rsa3072_dilithium2_aes" },
1566 { 0xfeaa, "dilithium3_aes" },
1567 { 0xfeab, "p384_dilithium3_aes" },
1568 { 0xfeac, "dilithium5_aes" },
1569 { 0xfead, "p521_dilithium5_aes" },
1570 { 0xfe0b, "falcon512" },
1571 { 0xfe0c, "p256_falcon512" },
1572 { 0xfe0d, "rsa3072_falcon512" },
1573 { 0xfe0e, "falcon1024" },
1574 { 0xfe0f, "p521_falcon1024" },
1575 { 0xfe96, "picnicl1full" },
1576 { 0xfe97, "p256_picnicl1full" },
1577 { 0xfe98, "rsa3072_picnicl1full" },
1578 { 0xfe1b, "picnic3l1" },
1579 { 0xfe1c, "p256_picnic3l1" },
1580 { 0xfe1d, "rsa3072_picnic3l1" },
1581 { 0xfe27, "rainbowIclassic" },
1582 { 0xfe28, "p256_rainbowIclassic" },
1583 { 0xfe29, "rsa3072_rainbowIclassic" },
1584 { 0xfe3c, "rainbowVclassic" },
1585 { 0xfe3d, "p521_rainbowVclassic" },
1586 { 0xfe42, "sphincsharaka128frobust" },
1587 { 0xfe43, "p256_sphincsharaka128frobust" },
1588 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1589 { 0xfe5e, "sphincssha256128frobust" },
1590 { 0xfe5f, "p256_sphincssha256128frobust" },
1591 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1592 { 0xfe7a, "sphincsshake256128frobust" },
1593 { 0xfe7b, "p256_sphincsshake256128frobust" },
1594 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1595 { 0, NULL((void*)0) }
1596};
1597
1598/* RFC 6091 3.1 */
1599const value_string tls_certificate_type[] = {
1600 { 0, "X.509" },
1601 { 1, "OpenPGP" },
1602 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1603 { 0, NULL((void*)0) }
1604};
1605
1606const value_string tls_cert_chain_type[] = {
1607 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1608 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1609 { 0, NULL((void*)0) }
1610};
1611
1612const value_string tls_cert_status_type[] = {
1613 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1614 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1615 { 0, NULL((void*)0) }
1616};
1617
1618/* Generated by tools/dissector_generators/generate-tls-ct-logids.py
1619 * Last-Modified Sat, 17 Oct 2026 14:08:00 GMT, 45 entries. */
1620static const bytes_string ct_logids[] = {
1621 { (const uint8_t[]){
1622 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1623 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1624 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1625 },
1626 32, "Google Argon2026h1" },
1627 { (const uint8_t[]){
1628 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1629 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1630 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1631 },
1632 32, "Google Argon2026h2" },
1633 { (const uint8_t[]){
1634 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1635 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1636 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1637 },
1638 32, "Google Argon2027h1" },
1639 { (const uint8_t[]){
1640 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1641 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1642 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1643 },
1644 32, "Google Xenon2026h1" },
1645 { (const uint8_t[]){
1646 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1647 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1648 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1649 },
1650 32, "Google Xenon2026h2" },
1651 { (const uint8_t[]){
1652 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1653 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1654 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1655 },
1656 32, "Google Xenon2027h1" },
1657 { (const uint8_t[]){
1658 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1659 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1660 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1661 },
1662 32, "Google Submariner" },
1663 { (const uint8_t[]){
1664 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1665 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1666 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1667 },
1668 32, "Google Daedalus" },
1669 { (const uint8_t[]){
1670 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1671 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1672 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1673 },
1674 32, "Google Testtube" },
1675 { (const uint8_t[]){
1676 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1677 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1678 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1679 },
1680 32, "Google Crucible" },
1681 { (const uint8_t[]){
1682 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1683 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1684 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1685 },
1686 32, "Google Solera2026h1" },
1687 { (const uint8_t[]){
1688 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1689 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1690 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1691 },
1692 32, "Google Solera2026h2" },
1693 { (const uint8_t[]){
1694 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46,
1695 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e,
1696 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2,
1697 },
1698 32, "Google Solera2027h1" },
1699 { (const uint8_t[]){
1700 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1701 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1702 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1703 },
1704 32, "Cloudflare Nimbus2026" },
1705 { (const uint8_t[]){
1706 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1707 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1708 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1709 },
1710 32, "Cloudflare Nimbus2027" },
1711 { (const uint8_t[]){
1712 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
1713 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
1714 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
1715 },
1716 32, "DigiCert Wyvern2026h1" },
1717 { (const uint8_t[]){
1718 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
1719 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
1720 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
1721 },
1722 32, "DigiCert Wyvern2026h2" },
1723 { (const uint8_t[]){
1724 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55,
1725 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29,
1726 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e,
1727 },
1728 32, "DigiCert Wyvern2027h1" },
1729 { (const uint8_t[]){
1730 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70,
1731 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62,
1732 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd,
1733 },
1734 32, "DigiCert Wyvern2027h2" },
1735 { (const uint8_t[]){
1736 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
1737 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
1738 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
1739 },
1740 32, "DigiCert Sphinx2026h1" },
1741 { (const uint8_t[]){
1742 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
1743 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
1744 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
1745 },
1746 32, "DigiCert Sphinx2026h2" },
1747 { (const uint8_t[]){
1748 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f,
1749 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84,
1750 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46,
1751 },
1752 32, "DigiCert Sphinx2027h1" },
1753 { (const uint8_t[]){
1754 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c,
1755 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39,
1756 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d,
1757 },
1758 32, "DigiCert Sphinx2027h2" },
1759 { (const uint8_t[]){
1760 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
1761 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
1762 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
1763 },
1764 32, "Sectigo Mammoth2026h1" },
1765 { (const uint8_t[]){
1766 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
1767 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
1768 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
1769 },
1770 32, "Sectigo Mammoth2026h2" },
1771 { (const uint8_t[]){
1772 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
1773 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
1774 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
1775 },
1776 32, "Sectigo Sabre2026h1" },
1777 { (const uint8_t[]){
1778 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
1779 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
1780 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
1781 },
1782 32, "Sectigo Sabre2026h2" },
1783 { (const uint8_t[]){
1784 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
1785 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
1786 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
1787 },
1788 32, "Sectigo Elephant2026h1" },
1789 { (const uint8_t[]){
1790 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
1791 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
1792 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
1793 },
1794 32, "Sectigo Elephant2026h2" },
1795 { (const uint8_t[]){
1796 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
1797 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
1798 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
1799 },
1800 32, "Sectigo Elephant2027h1" },
1801 { (const uint8_t[]){
1802 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
1803 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
1804 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
1805 },
1806 32, "Sectigo Elephant2027h2" },
1807 { (const uint8_t[]){
1808 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
1809 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
1810 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
1811 },
1812 32, "Sectigo Tiger2026h1" },
1813 { (const uint8_t[]){
1814 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
1815 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
1816 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
1817 },
1818 32, "Sectigo Tiger2026h2" },
1819 { (const uint8_t[]){
1820 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
1821 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
1822 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
1823 },
1824 32, "Sectigo Tiger2027h1" },
1825 { (const uint8_t[]){
1826 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
1827 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
1828 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
1829 },
1830 32, "Sectigo Tiger2027h2" },
1831 { (const uint8_t[]){
1832 0x61, 0xa3, 0x5d, 0xc3, 0x98, 0x06, 0x1b, 0x2a, 0x59, 0x5b, 0xfe,
1833 0x34, 0x46, 0x89, 0x95, 0x18, 0xf0, 0xfe, 0xac, 0x14, 0xb0, 0x1b,
1834 0xe0, 0x2a, 0x93, 0xbf, 0x05, 0x21, 0x46, 0x3a, 0x9d, 0xbd,
1835 },
1836 32, "Sectigo Dumbo" },
1837 { (const uint8_t[]){
1838 0xbe, 0x31, 0xd3, 0x65, 0x88, 0xdf, 0xd8, 0x05, 0xc8, 0x6d, 0x35,
1839 0x20, 0x29, 0x84, 0xac, 0xc9, 0xaa, 0x44, 0xae, 0xe3, 0x84, 0x08,
1840 0x0b, 0x9f, 0xcf, 0x42, 0xeb, 0xc8, 0x73, 0x55, 0xe4, 0x9b,
1841 },
1842 32, "Sectigo Tigger2026" },
1843 { (const uint8_t[]){
1844 0xfa, 0x63, 0x12, 0x74, 0x9a, 0xdc, 0xc8, 0x19, 0x95, 0x4e, 0x3e,
1845 0xf3, 0x01, 0x1d, 0x42, 0x67, 0x76, 0x88, 0xd4, 0x47, 0x1c, 0xfe,
1846 0xf6, 0x35, 0x3f, 0x89, 0x1d, 0xc8, 0x7c, 0x12, 0xac, 0xd4,
1847 },
1848 32, "Sectigo Tigger2027" },
1849 { (const uint8_t[]){
1850 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
1851 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
1852 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
1853 },
1854 32, "Let's Encrypt Oak2026h1" },
1855 { (const uint8_t[]){
1856 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
1857 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
1858 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
1859 },
1860 32, "Let's Encrypt Oak2026h2" },
1861 { (const uint8_t[]){
1862 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
1863 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
1864 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
1865 },
1866 32, "TrustAsia log2026a" },
1867 { (const uint8_t[]){
1868 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
1869 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
1870 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
1871 },
1872 32, "TrustAsia log2026b" },
1873 { (const uint8_t[]){
1874 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
1875 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
1876 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
1877 },
1878 32, "TrustAsia HETU2027" },
1879 { (const uint8_t[]){
1880 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
1881 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
1882 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
1883 },
1884 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
1885 { (const uint8_t[]){
1886 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55,
1887 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3,
1888 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08,
1889 },
1890 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" },
1891 { NULL((void*)0), 0, NULL((void*)0) }
1892};
1893
1894/*
1895 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
1896 */
1897static dissector_table_t ssl_alpn_dissector_table;
1898static dissector_table_t dtls_alpn_dissector_table;
1899
1900/*
1901 * Special cases for prefix matching of the ALPN, if the ALPN includes
1902 * a version number for a draft or protocol revision.
1903 */
1904typedef struct ssl_alpn_prefix_match_protocol {
1905 const char *proto_prefix;
1906 const char *dissector_name;
1907} ssl_alpn_prefix_match_protocol_t;
1908
1909static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
1910 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
1911 * already exists 3.1 as of this writing... match the prefix. */
1912 { "spdy/", "spdy" },
1913 /* draft-ietf-httpbis-http2-16 */
1914 { "h2-", "http2" }, /* draft versions */
1915};
1916
1917const value_string compress_certificate_algorithm_vals[] = {
1918 { 1, "zlib" },
1919 { 2, "brotli" },
1920 { 3, "zstd" },
1921 { 0, NULL((void*)0) }
1922};
1923
1924
1925const val64_string quic_transport_parameter_id[] = {
1926 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
1927 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
1928 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
1929 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
1930 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
1931 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
1932 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
1933 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
1934 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
1935 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
1936 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
1937 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
1938 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
1939 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
1940 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
1941 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
1942 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
1943 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
1944 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
1945 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
1946 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
1947 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
1948 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
1949 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
1950 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
1951 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
1952 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
1953 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
1954 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
1955 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
1956 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
1957 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
1958 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
1959 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
1960 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
1961 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
1962 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
1963 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
1964 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
1965 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
1966 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
1967 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
1968 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
1969 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
1970 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
1971 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d, "initial_max_path_id (draft-13)" },
1972 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e, "initial_max_path_id" },
1973 { 0, NULL((void*)0) }
1974};
1975
1976/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
1977const val64_string quic_address_discovery_vals[] = {
1978 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
1979 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
1980 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
1981 { 0, NULL((void*)0) }
1982};
1983
1984/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
1985const val64_string quic_enable_time_stamp_v2_vals[] = {
1986 { 1, "I would like to receive TIME_STAMP frames" },
1987 { 2, "I am able to generate TIME_STAMP frames" },
1988 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
1989 { 0, NULL((void*)0) }
1990};
1991
1992/* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */
1993const val64_string quic_enable_multipath_vals[] = {
1994 { 0, "don't support multipath" },
1995 { 1, "support multipath as defined in this document" },
1996 { 0, NULL((void*)0) }
1997};
1998
1999/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2000const value_string tls_hello_ext_ech_clienthello_types[] = {
2001 { 0, "Outer Client Hello" },
2002 { 1, "Inner Client Hello" },
2003 { 0, NULL((void*)0) }
2004};
2005
2006/* RFC 9180 */
2007const value_string kem_id_type_vals[] = {
2008 { 0x0000, "Reserved" },
2009 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2010 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2011 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2012 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2013 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2014 { 0, NULL((void*)0) }
2015};
2016const value_string kdf_id_type_vals[] = {
2017 { 0x0000, "Reserved" },
2018 { 0x0001, "HKDF-SHA256" },
2019 { 0x0002, "HKDF-SHA384" },
2020 { 0x0003, "HKDF-SHA512" },
2021 { 0, NULL((void*)0) }
2022};
2023const value_string aead_id_type_vals[] = {
2024 { 0x0000, "Reserved" },
2025 { 0x0001, "AES-128-GCM" },
2026 { 0x0002, "AES-256-GCM" },
2027 { 0x0003, "ChaCha20Poly1305" },
2028 { 0xFFFF, "Export-only" },
2029 { 0, NULL((void*)0) }
2030};
2031
2032const value_string token_binding_key_parameter_vals[] = {
2033 { 0, "rsa2048_pkcs1.5" },
2034 { 1, "rsa2048_pss" },
2035 { 2, "ecdsap256" },
2036 { 0, NULL((void*)0) }
2037};
2038
2039/* Lookup tables }}} */
2040
2041void
2042quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2043{
2044 const char *label;
2045 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)) {
2046 label = "GREASE";
2047 } else {
2048 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2049 }
2050 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2051}
2052
2053/* we keep this internal to packet-tls-utils, as there should be
2054 no need to access it any other way.
2055
2056 This also allows us to hide the dependency on zlib.
2057*/
2058struct _SslDecompress {
2059 int compression;
2060#ifdef USE_ZLIB_OR_ZLIBNG
2061 zlib_stream istream;
2062#endif
2063};
2064
2065/* To assist in parsing client/server key exchange messages
2066 0 indicates unknown */
2067int ssl_get_keyex_alg(int cipher)
2068{
2069 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2070 switch(cipher) {
2071 case 0x0017:
2072 case 0x0018:
2073 case 0x0019:
2074 case 0x001a:
2075 case 0x001b:
2076 case 0x0034:
2077 case 0x003a:
2078 case 0x0046:
2079 case 0x006c:
2080 case 0x006d:
2081 case 0x0089:
2082 case 0x009b:
2083 case 0x00a6:
2084 case 0x00a7:
2085 case 0x00bf:
2086 case 0x00c5:
2087 case 0xc084:
2088 case 0xc085:
2089 return KEX_DH_ANON0x13;
2090 case 0x000b:
2091 case 0x000c:
2092 case 0x000d:
2093 case 0x0030:
2094 case 0x0036:
2095 case 0x003e:
2096 case 0x0042:
2097 case 0x0068:
2098 case 0x0085:
2099 case 0x0097:
2100 case 0x00a4:
2101 case 0x00a5:
2102 case 0x00bb:
2103 case 0x00c1:
2104 case 0xc082:
2105 case 0xc083:
2106 return KEX_DH_DSS0x14;
2107 case 0x000e:
2108 case 0x000f:
2109 case 0x0010:
2110 case 0x0031:
2111 case 0x0037:
2112 case 0x003f:
2113 case 0x0043:
2114 case 0x0069:
2115 case 0x0086:
2116 case 0x0098:
2117 case 0x00a0:
2118 case 0x00a1:
2119 case 0x00bc:
2120 case 0x00c2:
2121 case 0xc07e:
2122 case 0xc07f:
2123 return KEX_DH_RSA0x15;
2124 case 0x0011:
2125 case 0x0012:
2126 case 0x0013:
2127 case 0x0032:
2128 case 0x0038:
2129 case 0x0040:
2130 case 0x0044:
2131 case 0x0063:
2132 case 0x0065:
2133 case 0x0066:
2134 case 0x006a:
2135 case 0x0087:
2136 case 0x0099:
2137 case 0x00a2:
2138 case 0x00a3:
2139 case 0x00bd:
2140 case 0x00c3:
2141 case 0xc080:
2142 case 0xc081:
2143 return KEX_DHE_DSS0x10;
2144 case 0x002d:
2145 case 0x008e:
2146 case 0x008f:
2147 case 0x0090:
2148 case 0x0091:
2149 case 0x00aa:
2150 case 0x00ab:
2151 case 0x00b2:
2152 case 0x00b3:
2153 case 0x00b4:
2154 case 0x00b5:
2155 case 0xc090:
2156 case 0xc091:
2157 case 0xc096:
2158 case 0xc097:
2159 case 0xc0a6:
2160 case 0xc0a7:
2161 case 0xc0aa:
2162 case 0xc0ab:
2163 case 0xccad:
2164 case 0xe41c:
2165 case 0xe41d:
2166 return KEX_DHE_PSK0x11;
2167 case 0x0014:
2168 case 0x0015:
2169 case 0x0016:
2170 case 0x0033:
2171 case 0x0039:
2172 case 0x0045:
2173 case 0x0067:
2174 case 0x006b:
2175 case 0x0088:
2176 case 0x009a:
2177 case 0x009e:
2178 case 0x009f:
2179 case 0x00be:
2180 case 0x00c4:
2181 case 0xc07c:
2182 case 0xc07d:
2183 case 0xc09e:
2184 case 0xc09f:
2185 case 0xc0a2:
2186 case 0xc0a3:
2187 case 0xccaa:
2188 case 0xe41e:
2189 case 0xe41f:
2190 return KEX_DHE_RSA0x12;
2191 case 0xc015:
2192 case 0xc016:
2193 case 0xc017:
2194 case 0xc018:
2195 case 0xc019:
2196 return KEX_ECDH_ANON0x19;
2197 case 0xc001:
2198 case 0xc002:
2199 case 0xc003:
2200 case 0xc004:
2201 case 0xc005:
2202 case 0xc025:
2203 case 0xc026:
2204 case 0xc02d:
2205 case 0xc02e:
2206 case 0xc074:
2207 case 0xc075:
2208 case 0xc088:
2209 case 0xc089:
2210 return KEX_ECDH_ECDSA0x1a;
2211 case 0xc00b:
2212 case 0xc00c:
2213 case 0xc00d:
2214 case 0xc00e:
2215 case 0xc00f:
2216 case 0xc029:
2217 case 0xc02a:
2218 case 0xc031:
2219 case 0xc032:
2220 case 0xc078:
2221 case 0xc079:
2222 case 0xc08c:
2223 case 0xc08d:
2224 return KEX_ECDH_RSA0x1b;
2225 case 0xc006:
2226 case 0xc007:
2227 case 0xc008:
2228 case 0xc009:
2229 case 0xc00a:
2230 case 0xc023:
2231 case 0xc024:
2232 case 0xc02b:
2233 case 0xc02c:
2234 case 0xc072:
2235 case 0xc073:
2236 case 0xc086:
2237 case 0xc087:
2238 case 0xc0ac:
2239 case 0xc0ad:
2240 case 0xc0ae:
2241 case 0xc0af:
2242 case 0xcca9:
2243 case 0xe414:
2244 case 0xe415:
2245 return KEX_ECDHE_ECDSA0x16;
2246 case 0xc033:
2247 case 0xc034:
2248 case 0xc035:
2249 case 0xc036:
2250 case 0xc037:
2251 case 0xc038:
2252 case 0xc039:
2253 case 0xc03a:
2254 case 0xc03b:
2255 case 0xc09a:
2256 case 0xc09b:
2257 case 0xccac:
2258 case 0xe418:
2259 case 0xe419:
2260 case 0xd001:
2261 case 0xd002:
2262 case 0xd003:
2263 case 0xd005:
2264 return KEX_ECDHE_PSK0x17;
2265 case 0xc010:
2266 case 0xc011:
2267 case 0xc012:
2268 case 0xc013:
2269 case 0xc014:
2270 case 0xc027:
2271 case 0xc028:
2272 case 0xc02f:
2273 case 0xc030:
2274 case 0xc076:
2275 case 0xc077:
2276 case 0xc08a:
2277 case 0xc08b:
2278 case 0xcca8:
2279 case 0xe412:
2280 case 0xe413:
2281 return KEX_ECDHE_RSA0x18;
2282 case 0x001e:
2283 case 0x001f:
2284 case 0x0020:
2285 case 0x0021:
2286 case 0x0022:
2287 case 0x0023:
2288 case 0x0024:
2289 case 0x0025:
2290 case 0x0026:
2291 case 0x0027:
2292 case 0x0028:
2293 case 0x0029:
2294 case 0x002a:
2295 case 0x002b:
2296 return KEX_KRB50x1c;
2297 case 0x002c:
2298 case 0x008a:
2299 case 0x008b:
2300 case 0x008c:
2301 case 0x008d:
2302 case 0x00a8:
2303 case 0x00a9:
2304 case 0x00ae:
2305 case 0x00af:
2306 case 0x00b0:
2307 case 0x00b1:
2308 case 0xc064:
2309 case 0xc065:
2310 case 0xc08e:
2311 case 0xc08f:
2312 case 0xc094:
2313 case 0xc095:
2314 case 0xc0a4:
2315 case 0xc0a5:
2316 case 0xc0a8:
2317 case 0xc0a9:
2318 case 0xccab:
2319 case 0xe416:
2320 case 0xe417:
2321 return KEX_PSK0x1d;
2322 case 0x0001:
2323 case 0x0002:
2324 case 0x0003:
2325 case 0x0004:
2326 case 0x0005:
2327 case 0x0006:
2328 case 0x0007:
2329 case 0x0008:
2330 case 0x0009:
2331 case 0x000a:
2332 case 0x002f:
2333 case 0x0035:
2334 case 0x003b:
2335 case 0x003c:
2336 case 0x003d:
2337 case 0x0041:
2338 case 0x0060:
2339 case 0x0061:
2340 case 0x0062:
2341 case 0x0064:
2342 case 0x0084:
2343 case 0x0096:
2344 case 0x009c:
2345 case 0x009d:
2346 case 0x00ba:
2347 case 0x00c0:
2348 case 0xc07a:
2349 case 0xc07b:
2350 case 0xc09c:
2351 case 0xc09d:
2352 case 0xc0a0:
2353 case 0xc0a1:
2354 case 0xe410:
2355 case 0xe411:
2356 case 0xfefe:
2357 case 0xfeff:
2358 case 0xffe0:
2359 case 0xffe1:
2360 return KEX_RSA0x1e;
2361 case 0x002e:
2362 case 0x0092:
2363 case 0x0093:
2364 case 0x0094:
2365 case 0x0095:
2366 case 0x00ac:
2367 case 0x00ad:
2368 case 0x00b6:
2369 case 0x00b7:
2370 case 0x00b8:
2371 case 0x00b9:
2372 case 0xc092:
2373 case 0xc093:
2374 case 0xc098:
2375 case 0xc099:
2376 case 0xccae:
2377 case 0xe41a:
2378 case 0xe41b:
2379 return KEX_RSA_PSK0x1f;
2380 case 0xc01a:
2381 case 0xc01d:
2382 case 0xc020:
2383 return KEX_SRP_SHA0x20;
2384 case 0xc01c:
2385 case 0xc01f:
2386 case 0xc022:
2387 return KEX_SRP_SHA_DSS0x21;
2388 case 0xc01b:
2389 case 0xc01e:
2390 case 0xc021:
2391 return KEX_SRP_SHA_RSA0x22;
2392 case 0xc0ff:
2393 return KEX_ECJPAKE0x24;
2394 case 0xe003:
2395 case 0xe013:
2396 case 0xe053:
2397 return KEX_ECC_SM20x26;
2398 default:
2399 break;
2400 }
2401
2402 return 0;
2403 /* }}} */
2404}
2405
2406static wmem_list_t *connection_id_session_list;
2407
2408void
2409ssl_init_cid_list(void) {
2410 connection_id_session_list = wmem_list_new(wmem_file_scope());
2411}
2412
2413void
2414ssl_cleanup_cid_list(void) {
2415 wmem_destroy_list(connection_id_session_list);
2416}
2417
2418void
2419ssl_add_session_by_cid(SslDecryptSession *session)
2420{
2421 wmem_list_append(connection_id_session_list, session);
2422}
2423
2424SslDecryptSession *
2425ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
2426{
2427 SslDecryptSession * ssl_cid = NULL((void*)0);
2428 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
2429
2430 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
2431 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
2432 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2432, "ssl != ((void*)0)"))));
2433 SslSession *session = &ssl->session;
2434
2435 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
2436 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
2437 ssl_cid = ssl;
2438 }
2439 }
2440
2441 if (session->server_cid_len > 0) {
2442 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
2443 ssl_cid = ssl;
2444 }
2445 }
2446
2447 it = wmem_list_frame_next(it);
2448 }
2449
2450 return ssl_cid;
2451}
2452
2453/* StringInfo structure (len + data) functions {{{ */
2454
2455int
2456ssl_data_alloc(StringInfo* str, size_t len)
2457{
2458 str->data = (unsigned char *)g_malloc(len);
2459 /* the allocator can return a null pointer for a size equal to 0,
2460 * and that must be allowed */
2461 if (len > 0 && !str->data)
2462 return -1;
2463 str->data_len = (unsigned) len;
2464 return 0;
2465}
2466
2467void
2468ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
2469{
2470 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 2470, "data"))));
2471 memcpy(str->data, data, len);
2472 str->data_len = len;
2473}
2474
2475static int
2476ssl_data_realloc(StringInfo* str, unsigned len)
2477{
2478 str->data = (unsigned char *)g_realloc(str->data, len);
2479 if (!str->data)
2480 return -1;
2481 str->data_len = len;
2482 return 0;
2483}
2484
2485static StringInfo *
2486ssl_data_clone(StringInfo *str)
2487{
2488 StringInfo *cloned_str;
2489 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
2490 sizeof(StringInfo) + str->data_len);
2491 cloned_str->data = (unsigned char *) (cloned_str + 1);
2492 ssl_data_set(cloned_str, str->data, str->data_len);
2493 return cloned_str;
2494}
2495
2496static int
2497ssl_data_copy(StringInfo* dst, StringInfo* src)
2498{
2499 if (dst->data_len < src->data_len) {
2500 if (ssl_data_realloc(dst, src->data_len))
2501 return -1;
2502 }
2503 memcpy(dst->data, src->data, src->data_len);
2504 dst->data_len = src->data_len;
2505 return 0;
2506}
2507
2508/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
2509 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
2510 * success. */
2511static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
2512 size_t i;
2513
2514 if (hex_len & 1)
2515 return false0;
2516
2517 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
2518 for (i = 0; i < hex_len / 2; i++) {
2519 int a = ws_xton(in[i*2]);
2520 int b = ws_xton(in[i*2 + 1]);
2521 if (a == -1 || b == -1)
2522 return false0;
2523 out->data[i] = a << 4 | b;
2524 }
2525 out->data_len = (unsigned)hex_len / 2;
2526 return true1;
2527}
2528/* StringInfo structure (len + data) functions }}} */
2529
2530
2531/* libgcrypt wrappers for HMAC/message digest operations {{{ */
2532/* hmac abstraction layer */
2533#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
2534
2535static inline int
2536ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
2537{
2538 gcry_error_t err;
2539 const char *err_str, *err_src;
2540
2541 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
2542 if (err != 0) {
2543 err_str = gcry_strerror(err);
2544 err_src = gcry_strsource(err);
2545 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
2546 return -1;
2547 }
2548 return 0;
2549}
2550
2551static inline int
2552ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
2553{
2554 gcry_error_t err;
2555 const char *err_str, *err_src;
2556
2557 err = gcry_md_setkey (*(md), key, len);
2558 if (err != 0) {
2559 err_str = gcry_strerror(err);
2560 err_src = gcry_strsource(err);
2561 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
2562 return -1;
2563 }
2564 return 0;
2565}
2566
2567static inline int
2568ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
2569{
2570 gcry_md_reset(*md);
2571 return 0;
2572}
2573
2574static inline void
2575ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
2576{
2577 gcry_md_write(*(md), data, len);
2578}
2579static inline void
2580ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2581{
2582 int algo;
2583 unsigned len;
2584
2585 algo = gcry_md_get_algo (*(md));
2586 len = gcry_md_get_algo_dlen(algo);
2587 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 2587, "len <= *datalen"))));
2588 memcpy(data, gcry_md_read(*(md), algo), len);
2589 *datalen = len;
2590}
2591static inline void
2592ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
2593{
2594 gcry_md_close(*(md));
2595}
2596
2597/* message digest abstraction layer*/
2598#define SSL_MDgcry_md_hd_t gcry_md_hd_t
2599
2600static inline int
2601ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
2602{
2603 gcry_error_t err;
2604 const char *err_str, *err_src;
2605 err = gcry_md_open(md,algo, 0);
2606 if (err != 0) {
2607 err_str = gcry_strerror(err);
2608 err_src = gcry_strsource(err);
2609 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
2610 return -1;
2611 }
2612 return 0;
2613}
2614static inline void
2615ssl_md_update(SSL_MDgcry_md_hd_t* md, const unsigned char* data, unsigned len)
2616{
2617 gcry_md_write(*(md), data, len);
2618}
2619static inline void
2620ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
2621{
2622 int algo;
2623 int len;
2624 algo = gcry_md_get_algo (*(md));
2625 len = gcry_md_get_algo_dlen (algo);
2626 memcpy(data, gcry_md_read(*(md), algo), len);
2627 *datalen = len;
2628}
2629static inline void
2630ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
2631{
2632 gcry_md_close(*(md));
2633}
2634
2635static inline void
2636ssl_md_reset(SSL_MDgcry_md_hd_t* md)
2637{
2638 gcry_md_reset(*md);
2639}
2640
2641/* md5 /sha abstraction layer */
2642#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
2643#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
2644
2645static inline int
2646ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
2647{
2648 gcry_error_t err;
2649 const char *err_str, *err_src;
2650 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
2651 if (err != 0) {
2652 err_str = gcry_strerror(err);
2653 err_src = gcry_strsource(err);
2654 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
2655 return -1;
2656 }
2657 return 0;
2658}
2659static inline void
2660ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2661{
2662 gcry_md_write(*(md), data, len);
2663}
2664static inline void
2665ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
2666{
2667 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
2668 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
2669}
2670
2671static inline void
2672ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
2673{
2674 gcry_md_reset(*md);
2675}
2676
2677static inline void
2678ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
2679{
2680 gcry_md_close(*(md));
2681}
2682
2683static inline int
2684ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
2685{
2686 gcry_error_t err;
2687 const char *err_str, *err_src;
2688 err = gcry_md_open(md,GCRY_MD_MD5, 0);
2689 if (err != 0) {
2690 err_str = gcry_strerror(err);
2691 err_src = gcry_strsource(err);
2692 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
2693 return -1;
2694 }
2695 return 0;
2696}
2697static inline void
2698ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
2699{
2700 gcry_md_write(*(md), data, len);
2701}
2702static inline void
2703ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
2704{
2705 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
2706 gcry_md_get_algo_dlen(GCRY_MD_MD5));
2707}
2708
2709static inline void
2710ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
2711{
2712 gcry_md_reset(*md);
2713}
2714
2715static inline void
2716ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
2717{
2718 gcry_md_close(*(md));
2719}
2720/* libgcrypt wrappers for HMAC/message digest operations }}} */
2721
2722/* libgcrypt wrappers for Cipher state manipulation {{{ */
2723int
2724ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
2725{
2726 int ret;
2727#if 0
2728 unsigned char *ivp;
2729 int i;
2730 gcry_cipher_hd_t c;
2731 c=(gcry_cipher_hd_t)*cipher;
2732#endif
2733 ssl_debug_printf("--------------------------------------------------------------------");
2734#if 0
2735 for(ivp=c->iv,i=0; i < iv_len; i++ )
2736 {
2737 ssl_debug_printf("%d ",ivp[i]);
2738 i++;
2739 }
2740#endif
2741 ssl_debug_printf("--------------------------------------------------------------------");
2742 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
2743#if 0
2744 for(ivp=c->iv,i=0; i < iv_len; i++ )
2745 {
2746 ssl_debug_printf("%d ",ivp[i]);
2747 i++;
2748 }
2749#endif
2750 ssl_debug_printf("--------------------------------------------------------------------");
2751 return ret;
2752}
2753/* stream cipher abstraction layer*/
2754static int
2755ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
2756 unsigned char* iv, int mode)
2757{
2758 int gcry_modes[] = {
2759 GCRY_CIPHER_MODE_STREAM,
2760 GCRY_CIPHER_MODE_CBC,
2761 GCRY_CIPHER_MODE_GCM,
2762 GCRY_CIPHER_MODE_CCM,
2763 GCRY_CIPHER_MODE_CCM,
2764 GCRY_CIPHER_MODE_POLY1305,
2765 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
2766 };
2767 int err;
2768 if (algo == -1) {
2769 /* NULL mode */
2770 *(cipher) = (gcry_cipher_hd_t)-1;
2771 return 0;
2772 }
2773 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
2774 if (err !=0)
2775 return -1;
2776 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
2777 if (err != 0)
2778 return -1;
2779 /* AEAD cipher suites will set the nonce later. */
2780 if (mode == MODE_CBC) {
2781 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
2782 if (err != 0)
2783 return -1;
2784 }
2785 return 0;
2786}
2787static inline int
2788ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
2789 const unsigned char * in, int inl)
2790{
2791 if ((*cipher) == (gcry_cipher_hd_t)-1)
2792 {
2793 if (in && inl)
2794 memcpy(out, in, outl < inl ? outl : inl);
2795 return 0;
2796 }
2797 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
2798}
2799static inline int
2800ssl_get_digest_by_name(const char*name)
2801{
2802 return gcry_md_map_name(name);
2803}
2804static inline int
2805ssl_get_cipher_by_name(const char* name)
2806{
2807 return gcry_cipher_map_name(name);
2808}
2809
2810static inline void
2811ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
2812{
2813 if ((*cipher) != (gcry_cipher_hd_t)-1)
2814 gcry_cipher_close(*cipher);
2815 *cipher = NULL((void*)0);
2816}
2817/* }}} */
2818
2819/* Digests, Ciphers and Cipher Suites registry {{{ */
2820static const SslDigestAlgo digests[]={
2821 {"MD5", 16},
2822 {"SHA1", 20},
2823 {"SHA256", 32},
2824 {"SHA384", 48},
2825 {"SM3", 32},
2826 {"Not Applicable", 0},
2827};
2828
2829#define DIGEST_MAX_SIZE48 48
2830
2831/* get index digest index */
2832static const SslDigestAlgo *
2833ssl_cipher_suite_dig(const SslCipherSuite *cs) {
2834 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
2835 return &digests[DIG_NA0x45 - DIG_MD50x40];
2836 }
2837 return &digests[cs->dig - DIG_MD50x40];
2838}
2839
2840static const char *ciphers[]={
2841 "DES",
2842 "3DES",
2843 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
2844 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
2845 "IDEA",
2846 "AES",
2847 "AES256",
2848 "CAMELLIA128",
2849 "CAMELLIA256",
2850 "SEED",
2851 "CHACHA20", /* since Libgcrypt 1.7.0 */
2852 "SM1",
2853 "SM4",
2854 "*UNKNOWN*"
2855};
2856
2857static const SslCipherSuite cipher_suites[]={
2858 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
2859 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
2860 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
2861 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
2862 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
2863 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
2864 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
2865 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
2866 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
2867 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
2868 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
2869 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
2870 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
2871 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
2872 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
2873 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
2874 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
2875 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
2876 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
2877 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
2878 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
2879 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
2880 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
2881 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
2882 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
2883 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
2884 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
2885 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
2886 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
2887 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
2888 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
2889 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
2890 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
2891 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
2892 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
2893 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
2894 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
2895 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
2896 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
2897 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
2898 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
2899 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
2900 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
2901 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
2902 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
2903 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
2904 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
2905 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
2906 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
2907 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
2908 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
2909 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
2910 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
2911 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
2912 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
2913 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
2914 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
2915 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
2916 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
2917 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
2918 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
2919 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
2920 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
2921 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
2922 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
2923 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
2924 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
2925 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
2926 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
2927 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
2928 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
2929 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
2930 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
2931 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
2932 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
2933 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
2934 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
2935 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
2936 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
2937 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
2938 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
2939 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
2940 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
2941 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
2942 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
2943 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
2944 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
2945 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
2946 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
2947 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
2948 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
2949 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
2950 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
2951 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
2952 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
2953 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
2954 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
2955 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
2956 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
2957 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
2958 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
2959 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
2960 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
2961 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
2962 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
2963 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
2964 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
2965 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
2966 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
2967 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
2968 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
2969 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
2970 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
2971 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
2972 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
2973 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
2974 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
2975 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
2976 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
2977 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
2978 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
2979 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
2980 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2981 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2982 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2983 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
2984 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
2985 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
2986 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2987 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2988 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2989 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
2990 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
2991 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
2992
2993 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
2994 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
2995 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
2996 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
2997 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
2998 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
2999 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3000
3001 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3002 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3003 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3004 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3005 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3006 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3007 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3008 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3009 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3010 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3011 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3012 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3013 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3014 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3015 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3016 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3017 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3018 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3019 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3020 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3021 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3022 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3023 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3024 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3025 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3026 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3027 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3028 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3029 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3030 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3031 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3032 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3033 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3034 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3035 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3036 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3037 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3038 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3039 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3040 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3041 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3042 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3043 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3044 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3045 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3046 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3047 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3048 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3049 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3050 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3051 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3052 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3053 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3054 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3055 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3056 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3057 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3058 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3059 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3060 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3061 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3062 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3063 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3064 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3065 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3066 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3067 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3068 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3069 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3070 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3071 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3072 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3073 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3074 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3075 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3076 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3077 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3078 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3079 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3080 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3081 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3082 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3083 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3084 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3085 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3086 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3087 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3088 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3089 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3090 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3091 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3092 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3093 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3094 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3095 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3096 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3097 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3098 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3099 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3100 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3101 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3102 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3103 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3104 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3105 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3106 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3107 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3108 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3109 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3110 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3111 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3112 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3113 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3114 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3115 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3116 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3117 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3118 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3119 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3120 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3121 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3122 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3123 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3124 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3125 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3126 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3127 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3128 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3129 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3130 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3131 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3132 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3133 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3134 /* GM */
3135 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3136 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3137 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3138 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3139 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3140 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3141 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3142 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3143 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3144 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3145 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3146 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3147 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3148 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3149 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3150 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3151 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3152 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3153 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3154 {-1, 0, 0, 0, MODE_STREAM}
3155};
3156
3157#define MAX_BLOCK_SIZE16 16
3158#define MAX_KEY_SIZE32 32
3159
3160const SslCipherSuite *
3161ssl_find_cipher(int num)
3162{
3163 const SslCipherSuite *c;
3164 for(c=cipher_suites;c->number!=-1;c++){
9
←
Assuming the condition is false
→
10
←
Loop condition is false. Execution continues on line 3170
→
3165 if(c->number==num){
3166 return c;
3167 }
3168 }
3169
3170 return NULL((void*)0);
11
←
Returning null pointer, which participates in a condition later
→
3171}
3172
3173int
3174ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3175{
3176 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3177}
3178
3179unsigned
3180ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3181{
3182 int cipher_algo;
3183 if (cipher_suite->mode != MODE_CBC) return 0;
3184 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3185 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3186}
3187
3188static unsigned
3189ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3190{
3191 switch (cipher_suite_num) {
3192 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3193 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3194 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3195 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3196 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3197 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3198 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3199 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3200 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3201 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3202 return 5;
3203
3204 /* not defined in below draft, but "implemented by several vendors",
3205 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3206 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3207 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3208 return 7;
3209
3210 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3211 * used 7. Until a pcap proves 8, let's use the old value. Link:
3212 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3213 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3214 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3215 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3216 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3217 return 7;
3218
3219 default:
3220 return 0;
3221 }
3222}
3223
3224/* Digests, Ciphers and Cipher Suites registry }}} */
3225
3226
3227/* HMAC and the Pseudorandom function {{{ */
3228static int
3229tls_hash(StringInfo *secret, StringInfo *seed, int md,
3230 StringInfo *out, unsigned out_len)
3231{
3232 /* RFC 2246 5. HMAC and the pseudorandom function
3233 * '+' denotes concatenation.
3234 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3235 * HMAC_hash(secret, A(2) + seed) + ...
3236 * A(0) = seed
3237 * A(i) = HMAC_hash(secret, A(i - 1))
3238 */
3239 uint8_t *ptr;
3240 unsigned left, tocpy;
3241 uint8_t *A;
3242 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
3243 unsigned A_l, tmp_l;
3244 SSL_HMACgcry_md_hd_t hm;
3245
3246 ptr = out->data;
3247 left = out_len;
3248
3249 ssl_print_string("tls_hash: hash secret", secret);
3250 ssl_print_string("tls_hash: hash seed", seed);
3251 /* A(0) = seed */
3252 A = seed->data;
3253 A_l = seed->data_len;
3254
3255 if (ssl_hmac_init(&hm, md) != 0) {
3256 return -1;
3257 }
3258 while (left) {
3259 /* A(i) = HMAC_hash(secret, A(i-1)) */
3260 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3261 ssl_hmac_update(&hm, A, A_l);
3262 A_l = sizeof(_A); /* upper bound len for hash output */
3263 ssl_hmac_final(&hm, _A, &A_l);
3264 A = _A;
3265
3266 /* HMAC_hash(secret, A(i) + seed) */
3267 ssl_hmac_reset(&hm);
3268 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
3269 ssl_hmac_update(&hm, A, A_l);
3270 ssl_hmac_update(&hm, seed->data, seed->data_len);
3271 tmp_l = sizeof(tmp); /* upper bound len for hash output */
3272 ssl_hmac_final(&hm, tmp, &tmp_l);
3273 ssl_hmac_reset(&hm);
3274
3275 /* ssl_hmac_final puts the actual digest output size in tmp_l */
3276 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
3277 memcpy(ptr, tmp, tocpy);
3278 ptr += tocpy;
3279 left -= tocpy;
3280 }
3281 ssl_hmac_cleanup(&hm);
3282 out->data_len = out_len;
3283
3284 ssl_print_string("hash out", out);
3285 return 0;
3286}
3287
3288static bool_Bool
3289tls_prf(StringInfo* secret, const char *usage,
3290 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3291{
3292 StringInfo seed, sha_out, md5_out;
3293 uint8_t *ptr;
3294 StringInfo s1, s2;
3295 unsigned i,s_l;
3296 size_t usage_len, rnd2_len;
3297 bool_Bool success = false0;
3298 usage_len = strlen(usage);
3299 rnd2_len = rnd2 ? rnd2->data_len : 0;
3300
3301 /* initialize buffer for sha, md5 random seed*/
3302 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
3303 ssl_debug_printf("tls_prf: can't allocate sha out\n");
3304 return false0;
3305 }
3306 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
3307 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
3308 goto free_sha;
3309 }
3310 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3311 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
3312 (int) (usage_len+rnd1->data_len+rnd2_len));
3313 goto free_md5;
3314 }
3315
3316 ptr=seed.data;
3317 memcpy(ptr,usage,usage_len);
3318 ptr+=usage_len;
3319 memcpy(ptr,rnd1->data,rnd1->data_len);
3320 if (rnd2_len > 0) {
3321 ptr+=rnd1->data_len;
3322 memcpy(ptr,rnd2->data,rnd2->data_len);
3323 /*ptr+=rnd2->data_len;*/
3324 }
3325
3326 /* initialize buffer for client/server seeds*/
3327 s_l=secret->data_len/2 + secret->data_len%2;
3328 if (ssl_data_alloc(&s1, s_l) < 0) {
3329 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
3330 goto free_seed;
3331 }
3332 if (ssl_data_alloc(&s2, s_l) < 0) {
3333 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
3334 goto free_s1;
3335 }
3336
3337 memcpy(s1.data,secret->data,s_l);
3338 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
3339
3340 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
3341 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
3342 goto free_s2;
3343 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
3344 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
3345 goto free_s2;
3346
3347 for (i = 0; i < out_len; i++)
3348 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
3349 /* success, now store the new meaningful data length */
3350 out->data_len = out_len;
3351 success = true1;
3352
3353 ssl_print_string("PRF out",out);
3354free_s2:
3355 g_free(s2.data)(__builtin_object_size ((s2.data), 0) != ((size_t) - 1)) ? g_free_sized
(s2.data, __builtin_object_size ((s2.data), 0)) : (g_free) (
s2.data);
3356free_s1:
3357 g_free(s1.data)(__builtin_object_size ((s1.data), 0) != ((size_t) - 1)) ? g_free_sized
(s1.data, __builtin_object_size ((s1.data), 0)) : (g_free) (
s1.data);
3358free_seed:
3359 g_free(seed.data)(__builtin_object_size ((seed.data), 0) != ((size_t) - 1)) ? g_free_sized
(seed.data, __builtin_object_size ((seed.data), 0)) : (g_free
) (seed.data);
3360free_md5:
3361 g_free(md5_out.data)(__builtin_object_size ((md5_out.data), 0) != ((size_t) - 1))
? g_free_sized (md5_out.data, __builtin_object_size ((md5_out
.data), 0)) : (g_free) (md5_out.data);
3362free_sha:
3363 g_free(sha_out.data)(__builtin_object_size ((sha_out.data), 0) != ((size_t) - 1))
? g_free_sized (sha_out.data, __builtin_object_size ((sha_out
.data), 0)) : (g_free) (sha_out.data);
3364 return success;
3365}
3366
3367static bool_Bool
3368tls12_prf(int md, StringInfo* secret, const char* usage,
3369 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3370{
3371 StringInfo label_seed;
3372 int success;
3373 size_t usage_len, rnd2_len;
3374 rnd2_len = rnd2 ? rnd2->data_len : 0;
3375
3376 usage_len = strlen(usage);
3377 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
3378 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
3379 return false0;
3380 }
3381 memcpy(label_seed.data, usage, usage_len);
3382 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
3383 if (rnd2_len > 0)
3384 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
3385
3386 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
3387 success = tls_hash(secret, &label_seed, md, out, out_len);
3388 g_free(label_seed.data)(__builtin_object_size ((label_seed.data), 0) != ((size_t) - 1
)) ? g_free_sized (label_seed.data, __builtin_object_size ((label_seed
.data), 0)) : (g_free) (label_seed.data);
3389 if(success != -1){
3390 ssl_print_string("PRF out", out);
3391 return true1;
3392 }
3393 return false0;
3394}
3395
3396static bool_Bool
3397ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
3398 StringInfo *out, unsigned out_len)
3399{
3400 SSL_MD5_CTXgcry_md_hd_t md5;
3401 uint8_t tmp[16];
3402
3403 if (ssl_md5_init(&md5) != 0) {
3404 return false0;
3405 }
3406 ssl_md5_update(&md5,r1->data,r1->data_len);
3407 ssl_md5_update(&md5,r2->data,r2->data_len);
3408 ssl_md5_final(tmp,&md5);
3409 ssl_md5_cleanup(&md5);
3410
3411 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3411, "out_len <= sizeof(tmp)"))));
3412 ssl_data_set(out, tmp, out_len);
3413 ssl_print_string("export iv", out);
3414 return true1;
3415}
3416
3417static bool_Bool
3418ssl3_prf(StringInfo* secret, const char* usage,
3419 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
3420{
3421 SSL_MD5_CTXgcry_md_hd_t md5;
3422 SSL_SHA_CTXgcry_md_hd_t sha;
3423 unsigned off;
3424 int i = 0,j;
3425 uint8_t buf[20];
3426
3427 if (ssl_sha_init(&sha) != 0) {
3428 return false0;
3429 }
3430 if (ssl_md5_init(&md5) != 0) {
3431 ssl_sha_cleanup(&sha);
3432 return false0;
3433 }
3434 for (off = 0; off < out_len; off += 16) {
3435 unsigned char outbuf[16];
3436 i++;
3437
3438 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
3439 /* A, BB, CCC, ... */
3440 for(j=0;j<i;j++){
3441 buf[j]=64+i;
3442 }
3443
3444 ssl_sha_update(&sha,buf,i);
3445 ssl_sha_update(&sha,secret->data,secret->data_len);
3446
3447 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
3448 if (rnd2)
3449 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3450 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3451 }
3452 else{
3453 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
3454 if (rnd2)
3455 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
3456 }
3457
3458 ssl_sha_final(buf,&sha);
3459 ssl_sha_reset(&sha);
3460
3461 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
3462 secret->data_len);
3463 ssl_md5_update(&md5,secret->data,secret->data_len);
3464 ssl_md5_update(&md5,buf,20);
3465 ssl_md5_final(outbuf,&md5);
3466 ssl_md5_reset(&md5);
3467
3468 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
3469 }
3470 ssl_sha_cleanup(&sha);
3471 ssl_md5_cleanup(&md5);
3472 out->data_len = out_len;
3473
3474 return true1;
3475}
3476
3477/* out_len is the wanted output length for the pseudorandom function.
3478 * Ensure that ssl->cipher_suite is set. */
3479static bool_Bool
3480prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
3481 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
3482{
3483 switch (ssl->session.version) {
3484 case SSLV3_VERSION0x300:
3485 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
3486
3487 case TLSV1_VERSION0x301:
3488 case TLSV1DOT1_VERSION0x302:
3489 case DTLSV1DOT0_VERSION0xfeff:
3490 case DTLSV1DOT0_OPENSSL_VERSION0x100:
3491 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
3492
3493 default: /* TLSv1.2 */
3494 switch (ssl->cipher_suite->dig) {
3495 case DIG_SM30x44:
3496#if GCRYPT_VERSION_NUMBER0x010c00 >= 0x010900
3497 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
3498 out, out_len);
3499#else
3500 return false0;
3501#endif
3502 case DIG_SHA3840x43:
3503 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
3504 out, out_len);
3505 default:
3506 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
3507 out, out_len);
3508 }
3509 }
3510}
3511
3512/* Handshake transcript {{{ */
3513
3514/* Only the messages before the hash function is known (the ClientHello and
3515 * the ServerHello or HelloRetryRequest, each at most 2^24 + 11 bytes) are
3516 * buffered, so this should only be reached with bogus messages, such as
3517 * repeated ClientHellos after a TLS 1.3 draft HelloRetryRequest. */
3518#define TLS_TRANSCRIPT_MAX_BUFFER(64 * 1024 * 1024) (64 * 1024 * 1024)
3519
3520static void
3521tls_transcript_close(tls_transcript_t *transcript)
3522{
3523 if (transcript->md) {
3524 gcry_md_close(transcript->md);
3525 transcript->md = NULL((void*)0);
3526 }
3527}
3528
3529void
3530tls_transcript_reset(tls_transcript_t *transcript)
3531{
3532 wmem_free(wmem_file_scope(), transcript->buffer.data);
3533 transcript->buffer.data = NULL((void*)0);
3534 transcript->buffer.data_len = 0;
3535 tls_transcript_close(transcript);
3536 transcript->failed = false0;
3537}
3538
3539/* Gives up on the transcript until it is reset. */
3540static void
3541tls_transcript_fail(tls_transcript_t *transcript)
3542{
3543 tls_transcript_reset(transcript);
3544 transcript->failed = true1;
3545}
3546
3547static bool_Bool
3548tls_transcript_is_empty(const tls_transcript_t *transcript)
3549{
3550 return transcript->md == NULL((void*)0) && transcript->buffer.data_len == 0;
3551}
3552
3553static void
3554tls_transcript_add(tls_transcript_t *transcript, const uint8_t *data, unsigned len)
3555{
3556 if (transcript->failed || len == 0)
3557 return;
3558
3559 if (transcript->md) {
3560 gcry_md_write(transcript->md, data, len);
3561 return;
3562 }
3563
3564 if (len > TLS_TRANSCRIPT_MAX_BUFFER(64 * 1024 * 1024) - transcript->buffer.data_len) {
3565 ssl_debug_printf("%s transcript too long before the hash is known\n", G_STRFUNC((const char*) (__func__)));
3566 tls_transcript_fail(transcript);
3567 return;
3568 }
3569 transcript->buffer.data = (unsigned char *)wmem_realloc(wmem_file_scope(), transcript->buffer.data,
3570 transcript->buffer.data_len + len);
3571 memcpy(transcript->buffer.data + transcript->buffer.data_len, data, len);
3572 transcript->buffer.data_len += len;
3573}
3574
3575/* Returns a new digest handle (which must be closed) with the transcript so
3576 * far for the given hash function(s), or NULL. algo2 is 0 or a second hash
3577 * function, for the concatenated MD5 and SHA-1 of TLS 1.0 and 1.1. */
3578static gcry_md_hd_t
3579tls_transcript_copy(const tls_transcript_t *transcript, int algo, int algo2)
3580{
3581 gcry_md_hd_t md = NULL((void*)0);
3582
3583 if (transcript->failed)
3584 return NULL((void*)0);
3585
3586 if (transcript->md) {
3587 if (!gcry_md_is_enabled(transcript->md, algo) ||
3588 (algo2 && !gcry_md_is_enabled(transcript->md, algo2))) {
3589 ssl_debug_printf("%s transcript uses a different hash\n", G_STRFUNC((const char*) (__func__)));
3590 return NULL((void*)0);
3591 }
3592 if (gcry_md_copy(&md, transcript->md) != 0)
3593 return NULL((void*)0);
3594 } else {
3595 if (gcry_md_open(&md, algo, 0) != 0)
3596 return NULL((void*)0);
3597 if (algo2 && gcry_md_enable(md, algo2) != 0) {
3598 gcry_md_close(md);
3599 return NULL((void*)0);
3600 }
3601 gcry_md_write(md, transcript->buffer.data, transcript->buffer.data_len);
3602 }
3603 return md;
3604}
3605
3606/* Gets the hash of the transcript so far, which can be continued. */
3607static bool_Bool
3608tls_transcript_hash(const tls_transcript_t *transcript, int algo,
3609 uint8_t *out, unsigned *out_len)
3610{
3611 gcry_md_hd_t md = tls_transcript_copy(transcript, algo, 0);
3612
3613 if (!md)
3614 return false0;
3615 *out_len = gcry_md_get_algo_dlen(algo);
3616 memcpy(out, gcry_md_read(md, algo), *out_len);
3617 gcry_md_close(md);
3618 return true1;
3619}
3620
3621/* Starts hashing the transcript with the given hash function(s) (see
3622 * tls_transcript_copy), keeping only the digest state from now on. */
3623static bool_Bool
3624tls_transcript_set_hash(tls_transcript_t *transcript, int algo, int algo2)
3625{
3626 if (transcript->failed)
3627 return false0;
3628
3629 if (transcript->md) {
3630 /* Already started, e.g. after a HelloRetryRequest. */
3631 if (gcry_md_is_enabled(transcript->md, algo) &&
3632 (!algo2 || gcry_md_is_enabled(transcript->md, algo2))) {
3633 return true1;
3634 }
3635 ssl_debug_printf("%s hash function changed\n", G_STRFUNC((const char*) (__func__)));
3636 tls_transcript_fail(transcript);
3637 return false0;
3638 }
3639
3640 gcry_md_hd_t md = tls_transcript_copy(transcript, algo, algo2);
3641 if (!md) {
3642 tls_transcript_fail(transcript);
3643 return false0;
3644 }
3645 tls_transcript_reset(transcript);
3646 transcript->md = md;
3647 return true1;
3648}
3649
3650/* RFC 8446 4.4.1: After a HelloRetryRequest, ClientHello1 is replaced in
3651 * the transcript by a message_hash message containing its hash. Everything
3652 * in the transcript except the last keep_len bytes (the HelloRetryRequest,
3653 * if it has already been added) is replaced. */
3654static bool_Bool
3655tls_transcript_hello_retry(tls_transcript_t *transcript, int algo, unsigned keep_len)
3656{
3657 uint8_t message_hash[4 + DIGEST_MAX_SIZE48];
3658 uint8_t *keep = NULL((void*)0);
3659 gcry_md_hd_t md;
3660
3661 if (transcript->failed)
3662 return false0;
3663
3664 if (keep_len > 0) {
3665 /* The start of the HelloRetryRequest isn't known after a previous one
3666 * (which isn't allowed anyway.) */
3667 if (transcript->md || keep_len > transcript->buffer.data_len) {
3668 tls_transcript_fail(transcript);
3669 return false0;
3670 }
3671 transcript->buffer.data_len -= keep_len;
3672 keep = transcript->buffer.data + transcript->buffer.data_len;
3673 }
3674
3675 md = tls_transcript_copy(transcript, algo, 0);
3676 if (!md) {
3677 tls_transcript_fail(transcript);
3678 return false0;
3679 }
3680 message_hash[0] = SSL_HND_MESSAGE_HASH;
3681 message_hash[1] = 0;
3682 message_hash[2] = 0;
3683 message_hash[3] = gcry_md_get_algo_dlen(algo);
3684 memcpy(message_hash + 4, gcry_md_read(md, algo), message_hash[3]);
3685 gcry_md_reset(md);
3686 gcry_md_write(md, message_hash, 4 + message_hash[3]);
3687 if (keep_len > 0)
3688 gcry_md_write(md, keep, keep_len);
3689
3690 tls_transcript_reset(transcript);
3691 transcript->md = md;
3692 return true1;
3693}
3694/* Handshake transcript }}} */
3695
3696static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
3697{
3698 gcry_md_hd_t md;
3699
3700 md = tls_transcript_copy(&ssl->handshake_transcript, GCRY_MD_MD5, GCRY_MD_SHA1);
3701 if (!md)
3702 return -1;
3703 if (ssl_data_alloc(out, 36) < 0) {
3704 gcry_md_close(md);
3705 return -1;
3706 }
3707 memcpy(out->data, gcry_md_read(md, GCRY_MD_MD5), 16);
3708 memcpy(out->data + 16, gcry_md_read(md, GCRY_MD_SHA1), 20);
3709 gcry_md_close(md);
3710 return 0;
3711}
3712
3713static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
3714{
3715 uint8_t tmp[DIGEST_MAX_SIZE48];
3716 unsigned len;
3717
3718 if (!tls_transcript_hash(&ssl->handshake_transcript, md, tmp, &len))
3719 return -1;
3720
3721 if (ssl_data_alloc(out, len) < 0)
3722 return -1;
3723 memcpy(out->data, tmp, len);
3724 return 0;
3725}
3726
3727bool_Bool
3728tls_load_psk(SslDecryptSession* tls_session, const char *tls_psk)
3729{
3730 if (!tls_psk || (tls_psk[0] == 0)) {
3731 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
3732 return false0;
3733 }
3734
3735 wmem_free(wmem_file_scope(), tls_session->psk.data);
3736 /* convert hex string into char*/
3737 if (!from_hex(&tls_session->psk, tls_psk, strlen(tls_psk))) {
3738 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
3739 G_STRFUNC((const char*) (__func__)));
3740 return false0;
3741 }
3742
3743 if (tls_session->psk.data_len >= (2 << 15)) {
3744 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
3745 G_STRFUNC((const char*) (__func__)));
3746 wmem_free(wmem_file_scope(), tls_session->psk.data);
3747 tls_session->psk.data = NULL((void*)0);
3748 tls_session->psk.data_len = 0;
3749 return false0;
3750 }
3751
3752 return true1;
3753}
3754
3755/**
3756 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
3757 * inlined and removed once support for draft 19 and before is dropped.
3758 */
3759static inline const char *
3760tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
3761{
3762 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
3763 return "TLS 1.3, ";
3764 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
3765 return "dtls13";
3766 } else {
3767 return "tls13 ";
3768 }
3769}
3770
3771/*
3772 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
3773 * custom label prefix. If "context_hash" is NULL, then an empty context is
3774 * used. Otherwise it must have the same length as the hash algorithm output.
3775 */
3776bool_Bool
3777tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
3778 const char *label_prefix, const char *label,
3779 const uint8_t *context_hash, uint8_t context_length,
3780 uint16_t out_len, unsigned char **out)
3781{
3782 /* RFC 8446 Section 7.1:
3783 * HKDF-Expand-Label(Secret, Label, Context, Length) =
3784 * HKDF-Expand(Secret, HkdfLabel, Length)
3785 * struct {
3786 * uint16 length = Length;
3787 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
3788 * opaque context<0..255> = Context;
3789 * } HkdfLabel;
3790 *
3791 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
3792 * HKDF-Expand(PRK, info, L) -> OKM
3793 */
3794 gcry_error_t err;
3795 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
3796 const unsigned label_length = (unsigned) strlen(label);
3797
3798 /* Some sanity checks */
3799 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3799, "label_length > 0 && label_prefix_length + label_length <= 255"
))));
3800
3801 /* info = HkdfLabel { length, label, context } */
3802 GByteArray *info = g_byte_array_new();
3803 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))));
3804 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
3805
3806 const uint8_t label_vector_length = label_prefix_length + label_length;
3807 g_byte_array_append(info, &label_vector_length, 1);
3808 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
3809 g_byte_array_append(info, (const uint8_t*)label, label_length);
3810
3811 g_byte_array_append(info, &context_length, 1);
3812 if (context_length) {
3813 g_byte_array_append(info, context_hash, context_length);
3814 }
3815
3816 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
3817 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
3818 g_byte_array_free(info, true1);
3819
3820 if (err) {
3821 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
3822 wmem_free(NULL((void*)0), *out);
3823 *out = NULL((void*)0);
3824 return false0;
3825 }
3826
3827 return true1;
3828}
3829
3830bool_Bool
3831tls13_hkdf_expand_label(int md, const StringInfo *secret,
3832 const char *label_prefix, const char *label,
3833 uint16_t out_len, unsigned char **out)
3834{
3835 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
3836}
3837
3838static bool_Bool
3839tls13_derive_secret(int md, const StringInfo *secret,
3840 const char *label_prefix, const char *label,
3841 const uint8_t *context, unsigned context_length,
3842 uint16_t out_len, unsigned char **out)
3843{
3844 SSL_MDgcry_md_hd_t mc;
3845 uint8_t context_hash[DIGEST_MAX_SIZE48];
3846 unsigned hash_len;
3847
3848 if (ssl_md_init(&mc, md) != 0)
3849 return false0;
3850 ssl_md_update(&mc, context, context_length);
3851 ssl_md_final(&mc, context_hash, &hash_len);
3852 ssl_md_cleanup(&mc);
3853
3854 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, context_hash, hash_len, out_len, out);
3855}
3856
3857/* HMAC and the Pseudorandom function }}} */
3858
3859/* Record Decompression (after decryption) {{{ */
3860#ifdef USE_ZLIB_OR_ZLIBNG
3861/* memory allocation functions for zlib initialization */
3862static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
3863{
3864 return g_malloc0(no*size);
3865}
3866static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
3867{
3868 g_free(addr)(__builtin_object_size ((addr), 0) != ((size_t) - 1)) ? g_free_sized
(addr, __builtin_object_size ((addr), 0)) : (g_free) (addr);
3869}
3870#endif /* USE_ZLIB_OR_ZLIBNG */
3871
3872static SslDecompress*
3873ssl_create_decompressor(int compression)
3874{
3875 SslDecompress *decomp;
3876#ifdef USE_ZLIB_OR_ZLIBNG
3877 int err;
3878#endif
3879
3880 if (compression == 0) return NULL((void*)0);
3881 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
3882 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)));
3883 decomp->compression = compression;
3884 switch (decomp->compression) {
3885#ifdef USE_ZLIB_OR_ZLIBNG
3886 case 1: /* DEFLATE */
3887 decomp->istream.zalloc = ssl_zalloc;
3888 decomp->istream.zfree = ssl_zfree;
3889 decomp->istream.opaque = Z_NULL0;
3890 decomp->istream.next_in = Z_NULL0;
3891 decomp->istream.next_out = Z_NULL0;
3892 decomp->istream.avail_in = 0;
3893 decomp->istream.avail_out = 0;
3894 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3.1", (int)sizeof(
z_stream));
3895 if (err != Z_OK0) {
3896 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
3897 return NULL((void*)0);
3898 }
3899 break;
3900#endif /* USE_ZLIB_OR_ZLIBNG */
3901 default:
3902 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
3903 return NULL((void*)0);
3904 }
3905 return decomp;
3906}
3907
3908#ifdef USE_ZLIB_OR_ZLIBNG
3909static int
3910ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
3911{
3912 int err;
3913
3914 switch (decomp->compression) {
3915 case 1: /* DEFLATE */
3916 err = Z_OK0;
3917 if (out_str->data_len < 16384) { /* maximal plain length */
3918 ssl_data_realloc(out_str, 16384);
3919 }
3920#ifdef z_constconst
3921 decomp->istream.next_in = in;
3922#else
3923DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
3924 decomp->istream.next_in = (Bytef *)in;
3925DIAG_ON(cast-qual)clang diagnostic pop
3926#endif
3927 decomp->istream.avail_in = inl;
3928 decomp->istream.next_out = out_str->data;
3929 decomp->istream.avail_out = out_str->data_len;
3930 if (inl > 0)
3931 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
3932 if (err != Z_OK0) {
3933 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
3934 return -1;
3935 }
3936 *outl = out_str->data_len - decomp->istream.avail_out;
3937 break;
3938 default:
3939 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3940 return -1;
3941 }
3942 return 0;
3943}
3944#else /* USE_ZLIB_OR_ZLIBNG */
3945int
3946ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
3947{
3948 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
3949 return -1;
3950}
3951#endif /* USE_ZLIB_OR_ZLIBNG */
3952/* Record Decompression (after decryption) }}} */
3953
3954/* Create a new structure to store decrypted chunks. {{{ */
3955static SslFlow*
3956ssl_create_flow(void)
3957{
3958 SslFlow *flow;
3959
3960 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
3961 flow->byte_seq = 0;
3962 flow->flags = 0;
3963 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
3964 return flow;
3965}
3966/* }}} */
3967
3968/* Use the negotiated security parameters for decryption. {{{ */
3969void
3970ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
3971{
3972 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
3973 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
3974 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
3975 *new_decoder ? "" : " (No decoder found - retransmission?)");
3976 if (*new_decoder) {
3977 *dest = *new_decoder;
3978 *new_decoder = NULL((void*)0);
3979 }
3980}
3981/* }}} */
3982
3983/* Init cipher state given some security parameters. {{{ */
3984static bool_Bool
3985ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
3986
3987static SslDecoder*
3988ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
3989 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
3990{
3991 SslDecoder *dec;
3992 ssl_cipher_mode_t mode = cipher_suite->mode;
3993
3994 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)));
3995 /* init mac buffer: mac storage is embedded into decoder struct to save a
3996 memory allocation and waste samo more memory*/
3997 dec->cipher_suite=cipher_suite;
3998 dec->compression = compression;
3999 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4000 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4001 // the special case for NULL ciphers, even if there is insufficiency
4002 // keying material (including MAC key), we will can still create
4003 // decoders since "decryption" is easy for such ciphers.
4004 dec->mac_key.data = dec->_mac_key_or_write_iv;
4005 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4006 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4007 // Input for the nonce, to be used with AEAD ciphers.
4008 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4008, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))));
4009 dec->write_iv.data = dec->_mac_key_or_write_iv;
4010 ssl_data_set(&dec->write_iv, iv, iv_length);
4011 }
4012 dec->seq = 0;
4013 dec->decomp = ssl_create_decompressor(compression);
4014 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4015
4016 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4017 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4018 cipher_algo, cipher_suite->mode);
4019 return NULL((void*)0);
4020 }
4021
4022 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4023 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4024 mode = MODE_ECB;
4025 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4026 mode = MODE_STREAM;
4027 } else {
4028 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4029 return NULL((void*)0);
4030 }
4031
4032 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4033 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4034 cipher_algo, MODE_ECB);
4035 ssl_cipher_cleanup(&dec->evp);
4036 dec->evp = NULL((void*)0);
4037 return NULL((void*)0);
4038 }
4039 } else {
4040 dec->sn_evp = NULL((void*)0);
4041 }
4042
4043 dec->dtls13_aad.data = NULL((void*)0);
4044 dec->dtls13_aad.data_len = 0;
4045 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4046 return dec;
4047}
4048
4049static bool_Bool
4050ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4051{
4052 SslDecoder *dec = (SslDecoder *) user_data;
4053
4054 if (dec->evp)
4055 ssl_cipher_cleanup(&dec->evp);
4056 if (dec->sn_evp)
4057 ssl_cipher_cleanup(&dec->sn_evp);
4058
4059#ifdef USE_ZLIB_OR_ZLIBNG
4060 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4061 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4062#endif
4063
4064 return false0;
4065}
4066/* }}} */
4067
4068/* (Pre-)master secrets calculations {{{ */
4069#ifdef HAVE_LIBGNUTLS1
4070static bool_Bool
4071ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4072 StringInfo *encrypted_pre_master,
4073 GHashTable *key_hash);
4074#endif /* HAVE_LIBGNUTLS */
4075
4076static bool_Bool
4077ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4078 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4079
4080bool_Bool
4081ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4082 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4083 const char *ssl_psk, packet_info *pinfo,
4084#ifdef HAVE_LIBGNUTLS1
4085 GHashTable *key_hash,
4086#endif
4087 const ssl_master_key_map_t *mk_map)
4088{
4089 /* check for required session data */
4090 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4091 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4092 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4093 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4094 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4095 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4096 return false0;
4097 }
4098
4099 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4100 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4101 return false0;
4102 }
4103
4104 /* check to see if the PMS was provided to us*/
4105 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4106 mk_map->pms, &ssl_session->client_random)) {
4107 return true1;
4108 }
4109
4110 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4111 {
4112 /* calculate pre master secret*/
4113 StringInfo pre_master_secret;
4114 unsigned psk_len, pre_master_len;
4115
4116 if (!tls_load_psk(ssl_session, ssl_psk)) {
4117 return false0;
4118 }
4119 psk_len = ssl_session->psk.data_len;
4120
4121 pre_master_len = psk_len * 2 + 4;
4122
4123 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4124 pre_master_secret.data_len = pre_master_len;
4125 /* 2 bytes psk_len*/
4126 pre_master_secret.data[0] = psk_len >> 8;
4127 pre_master_secret.data[1] = psk_len & 0xFF;
4128 /* psk_len bytes times 0*/
4129 memset(&pre_master_secret.data[2], 0, psk_len);
4130 /* 2 bytes psk_len*/
4131 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4132 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4133 /* psk*/
4134 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4135
4136 ssl_session->pre_master_secret.data = pre_master_secret.data;
4137 ssl_session->pre_master_secret.data_len = pre_master_len;
4138 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4139
4140 /* Remove the master secret if it was there.
4141 This forces keying material regeneration in
4142 case we're renegotiating */
4143 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4144 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4145 return true1;
4146 }
4147 else
4148 {
4149 unsigned encrlen, skip;
4150 encrlen = length;
4151 skip = 0;
4152
4153 /* get encrypted data, on tls1 we have to skip two bytes
4154 * (it's the encrypted len and should be equal to record len - 2)
4155 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4156 */
4157 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4158 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4159 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4160 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4161 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4162 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4163 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4164 {
4165 encrlen = tvb_get_ntohs(tvb, offset);
4166 skip = 2;
4167 if (encrlen > length - 2)
4168 {
4169 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4170 G_STRFUNC((const char*) (__func__)), encrlen, length);
4171 return false0;
4172 }
4173 }
4174 /* the valid lower bound is higher than 8, but it is sufficient for the
4175 * ssl keylog file below */
4176 if (encrlen < 8) {
4177 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4178 G_STRFUNC((const char*) (__func__)), encrlen);
4179 return false0;
4180 }
4181
4182 StringInfo encrypted_pre_master = {
4183 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4184 .data_len = encrlen,
4185 };
4186
4187#ifdef HAVE_LIBGNUTLS1
4188 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4189 if (ssl_session->cert_key_id) {
4190 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4191 return true1;
4192
4193 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4194 G_STRFUNC((const char*) (__func__)));
4195 }
4196#endif /* HAVE_LIBGNUTLS */
4197
4198 /* try to find the pre-master secret from the encrypted one. The
4199 * ssl key logfile stores only the first 8 bytes, so truncate it */
4200 encrypted_pre_master.data_len = 8;
4201 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4202 true1, mk_map->pre_master, &encrypted_pre_master))
4203 return true1;
4204 }
4205 return false0;
4206}
4207
4208/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4209int
4210ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4211{
4212 StringInfo key_block = { NULL((void*)0), 0 };
4213 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4214 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4215 int needed;
4216 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4217 unsigned encr_key_len, write_iv_len = 0;
4218 bool_Bool is_export_cipher;
4219 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4220 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4221 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4222
4223 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4224 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4225 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4226 return -1;
4227 }
4228
4229 /* check for enough info to proceed */
4230 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4231 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4232 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4233 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4234 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4235 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4236 /* Special case: for NULL encryption, allow dissection of data even if
4237 * the Client Hello is missing (MAC keys are now skipped though). */
4238 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4239 if ((ssl_session->state & need_all) == need_all &&
4240 cipher_suite->enc == ENC_NULL0x3D) {
4241 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4242 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4243 goto create_decoders;
4244 }
4245
4246 return -1;
4247 }
4248
4249 /* if master key is not available, generate is from the pre-master secret */
4250 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
4251 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
4252 StringInfo handshake_hashed_data;
4253 int ret;
4254
4255 handshake_hashed_data.data = NULL((void*)0);
4256 handshake_hashed_data.data_len = 0;
4257
4258 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4259 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4260
4261 switch(ssl_session->session.version) {
4262 case TLSV1_VERSION0x301:
4263 case TLSV1DOT1_VERSION0x302:
4264 case DTLSV1DOT0_VERSION0xfeff:
4265 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4266 case TLCPV1_VERSION0x101:
4267 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
4268 break;
4269 default:
4270 switch (cipher_suite->dig) {
4271 case DIG_SHA3840x43:
4272 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4273 break;
4274 default:
4275 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4276 break;
4277 }
4278 break;
4279 }
4280 if (ret) {
4281 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
4282 return -1;
4283 }
4284
4285 tls_transcript_reset(&ssl_session->handshake_transcript);
4286
4287 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4288 &handshake_hashed_data,
4289 NULL((void*)0), &ssl_session->master_secret,
4290 SSL_MASTER_SECRET_LENGTH48)) {
4291 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4292 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4293 return -1;
4294 }
4295 g_free(handshake_hashed_data.data)(__builtin_object_size ((handshake_hashed_data.data), 0) != (
(size_t) - 1)) ? g_free_sized (handshake_hashed_data.data, __builtin_object_size
((handshake_hashed_data.data), 0)) : (g_free) (handshake_hashed_data
.data);
4296 } else {
4297 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4298 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4299 ssl_print_string("client random",&ssl_session->client_random);
4300 ssl_print_string("server random",&ssl_session->server_random);
4301 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4302 &ssl_session->client_random,
4303 &ssl_session->server_random, &ssl_session->master_secret,
4304 SSL_MASTER_SECRET_LENGTH48)) {
4305 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4306 return -1;
4307 }
4308 }
4309 ssl_print_string("master secret",&ssl_session->master_secret);
4310
4311 /* the pre-master secret has been 'consumed' so we must clear it now */
4312 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4313 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4314 }
4315
4316 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4317 if (cipher_suite->enc != ENC_NULL0x3D) {
4318 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4319 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4320 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4321 if (cipher_algo == 0) {
4322 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4323 return -1;
4324 }
4325 }
4326
4327 /* Export ciphers consume less material from the key block. */
4328 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4329 is_export_cipher = encr_key_len > 0;
4330 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4331 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4332 }
4333
4334 if (cipher_suite->mode == MODE_CBC) {
4335 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4336 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4337 /* account for a four-byte salt for client and server side (from
4338 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4339 write_iv_len = 4;
4340 } else if (cipher_suite->mode == MODE_POLY1305) {
4341 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4342 write_iv_len = 12;
4343 }
4344
4345 /* Compute the key block. First figure out how much data we need */
4346 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4347 needed += 2 * encr_key_len; /* encryption key */
4348 needed += 2 * write_iv_len; /* write IV */
4349
4350 key_block.data = (unsigned char *)g_malloc(needed);
4351 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4352 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4353 &ssl_session->server_random,&ssl_session->client_random,
4354 &key_block, needed)) {
4355 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4356 goto fail;
4357 }
4358 ssl_print_string("key expansion", &key_block);
4359
4360 ptr=key_block.data;
4361 /* client/server write MAC key (for non-AEAD ciphers) */
4362 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4363 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4364 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4365 }
4366 /* client/server write encryption key */
4367 c_wk=ptr; ptr += encr_key_len;
4368 s_wk=ptr; ptr += encr_key_len;
4369 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4370 if (write_iv_len > 0) {
4371 c_iv=ptr; ptr += write_iv_len;
4372 s_iv=ptr; /* ptr += write_iv_len; */
4373 }
4374
4375 /* export ciphers work with a smaller key length */
4376 if (is_export_cipher) {
4377 if (cipher_suite->mode == MODE_CBC) {
4378
4379 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4380 all we should need. This is a sanity check */
4381 if (write_iv_len > MAX_BLOCK_SIZE16) {
4382 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4383 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4384 goto fail;
4385 }
4386
4387 if(ssl_session->session.version==SSLV3_VERSION0x300){
4388 /* The length of these fields are ignored by this caller */
4389 StringInfo iv_c, iv_s;
4390 iv_c.data = _iv_c;
4391 iv_s.data = _iv_s;
4392
4393 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4394 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4395 &ssl_session->server_random, &iv_c, write_iv_len)) {
4396 goto fail;
4397 }
4398 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4399 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4400 &ssl_session->client_random, &iv_s, write_iv_len)) {
4401 goto fail;
4402 }
4403 }
4404 else{
4405 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4406 StringInfo iv_block;
4407 StringInfo key_null;
4408 uint8_t _key_null;
4409
4410 key_null.data = &_key_null;
4411 key_null.data_len = 0;
4412
4413 iv_block.data = _iv_block;
4414
4415 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4416 if (!prf(ssl_session, &key_null, "IV block",
4417 &ssl_session->client_random,
4418 &ssl_session->server_random, &iv_block,
4419 write_iv_len * 2)) {
4420 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4421 goto fail;
4422 }
4423
4424 memcpy(_iv_c, iv_block.data, write_iv_len);
4425 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4426 }
4427
4428 c_iv=_iv_c;
4429 s_iv=_iv_s;
4430 }
4431
4432 if (ssl_session->session.version==SSLV3_VERSION0x300){
4433
4434 SSL_MD5_CTXgcry_md_hd_t md5;
4435 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
4436
4437 if (ssl_md5_init(&md5) != 0)
4438 goto fail;
4439 ssl_md5_update(&md5,c_wk,encr_key_len);
4440 ssl_md5_update(&md5,ssl_session->client_random.data,
4441 ssl_session->client_random.data_len);
4442 ssl_md5_update(&md5,ssl_session->server_random.data,
4443 ssl_session->server_random.data_len);
4444 ssl_md5_final(_key_c,&md5);
4445 ssl_md5_cleanup(&md5);
4446 c_wk=_key_c;
4447
4448 if (ssl_md5_init(&md5) != 0)
4449 goto fail;
4450 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
4451 ssl_md5_update(&md5,s_wk,encr_key_len);
4452 ssl_md5_update(&md5,ssl_session->server_random.data,
4453 ssl_session->server_random.data_len);
4454 ssl_md5_update(&md5,ssl_session->client_random.data,
4455 ssl_session->client_random.data_len);
4456 ssl_md5_final(_key_s,&md5);
4457 ssl_md5_cleanup(&md5);
4458 s_wk=_key_s;
4459 }
4460 else{
4461 StringInfo key_c, key_s, k;
4462 key_c.data = _key_c;
4463 key_s.data = _key_s;
4464
4465 k.data = c_wk;
4466 k.data_len = encr_key_len;
4467 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
4468 if (!prf(ssl_session, &k, "client write key",
4469 &ssl_session->client_random,
4470 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
4471 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
4472 goto fail;
4473 }
4474 c_wk=_key_c;
4475
4476 k.data = s_wk;
4477 k.data_len = encr_key_len;
4478 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
4479 if (!prf(ssl_session, &k, "server write key",
4480 &ssl_session->client_random,
4481 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
4482 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
4483 goto fail;
4484 }
4485 s_wk=_key_s;
4486 }
4487 }
4488
4489 /* show key material info */
4490 if (c_mk != NULL((void*)0)) {
4491 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4492 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
4493 }
4494 ssl_print_data("Client Write key", c_wk, encr_key_len);
4495 ssl_print_data("Server Write key", s_wk, encr_key_len);
4496 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
4497 if (write_iv_len > 0) {
4498 ssl_print_data("Client Write IV", c_iv, write_iv_len);
4499 ssl_print_data("Server Write IV", s_iv, write_iv_len);
4500 }
4501
4502create_decoders:
4503 /* create both client and server ciphers*/
4504 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
4505 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
4506 if (!ssl_session->client_new) {
4507 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
4508 goto fail;
4509 }
4510 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
4511 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
4512 if (!ssl_session->server_new) {
4513 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
4514 goto fail;
4515 }
4516
4517 /* Continue the SSL stream after renegotiation with new keys. */
4518 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4519 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4520
4521 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
4522 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
4523 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4524 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
4525 return 0;
4526
4527fail:
4528 g_free(key_block.data)(__builtin_object_size ((key_block.data), 0) != ((size_t) - 1
)) ? g_free_sized (key_block.data, __builtin_object_size ((key_block
.data), 0)) : (g_free) (key_block.data);
4529 return -1;
4530}
4531
4532/* Generated the key material based on the given secret. */
4533bool_Bool
4534tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
4535{
4536 bool_Bool success = false0;
4537 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
4538 unsigned char *sn_key = NULL((void*)0);
4539 SslDecoder *decoder;
4540 unsigned key_length, iv_length;
4541 int hash_algo;
4542 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4543 int cipher_algo;
4544
4545 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
4546 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
4547 ssl_session->session.version);
4548 return false0;
4549 }
4550
4551 if (cipher_suite == NULL((void*)0)) {
4552 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
4553 return false0;
4554 }
4555
4556 if (cipher_suite->kex != KEX_TLS130x23) {
4557 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
4558 return false0;
4559 }
4560
4561 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4562 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4563 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4564 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4565 if (cipher_algo == 0) {
4566 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4567 return false0;
4568 }
4569
4570 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
4571 hash_algo = ssl_get_digest_by_name(hash_name);
4572 if (!hash_algo) {
4573 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
4574 return false0;
4575 }
4576
4577 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
4578 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
4579 iv_length = 12;
4580 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
4581
4582 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
4583 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
4584 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4585 return false0;
4586 }
4587 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
4588 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
4589 goto end;
4590 }
4591
4592 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4593 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
4594 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
4595 goto end;
4596 }
4597 }
4598
4599 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
4600 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
4601 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4602 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
4603 }
4604
4605 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4606 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
4607 if (!decoder) {
4608 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
4609 goto end;
4610 }
4611
4612 /* Continue the TLS session with new keys, but reuse old flow to keep things
4613 * like "Follow TLS" working (by linking application data records). */
4614 if (is_from_server) {
4615 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
4616 ssl_session->server = decoder;
4617 } else {
4618 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
4619 ssl_session->client = decoder;
4620 }
4621 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
4622 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
4623 success = true1;
4624
4625end:
4626 wmem_free(NULL((void*)0), write_key);
4627 wmem_free(NULL((void*)0), write_iv);
4628 if (sn_key)
4629 wmem_free(NULL((void*)0), sn_key);
4630 return success;
4631}
4632/* (Pre-)master secrets calculations }}} */
4633
4634#ifdef HAVE_LIBGNUTLS1
4635/* Decrypt RSA pre-master secret using RSA private key. {{{ */
4636static bool_Bool
4637ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4638 StringInfo *encrypted_pre_master, GHashTable *key_hash)
4639{
4640 int ret;
4641
4642 if (!encrypted_pre_master)
4643 return false0;
4644
4645 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)) {
4646 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
4647 "(cipher suite 0x%04X %s) and cannot be decrypted "
4648 "using a RSA private key file.\n",
4649 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
4650 val_to_str_ext_const(ssl_session->session.cipher,
4651 &ssl_31_ciphersuite_ext, "unknown"));
4652 return false0;
4653 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
4654 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
4655 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
4656 return false0;
4657 }
4658
4659 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
4660
4661 ssl_print_string("pre master encrypted", encrypted_pre_master);
4662 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
4663 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
4664 gnutls_datum_t pms = { 0 };
4665 if (pk) {
4666 // Try to decrypt using the RSA keys table from (D)TLS preferences.
4667 char *err = NULL((void*)0);
4668 gcry_sexp_t private_key = rsa_abstract_privkey_to_sexp(pk, &err);
4669 if (!private_key) {
4670 ssl_debug_printf("%s: decryption failed: Can't export private key: %s", G_STRFUNC((const char*) (__func__)), err);
4671 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4672 return false0;
4673 }
4674
4675 pms.size = (int)rsa_decrypt(encrypted_pre_master->data_len, encrypted_pre_master->data, &pms.data, private_key, "pkcs1", &err);
4676 rsa_private_key_free(private_key);
4677 if (pms.size == 0) {
4678 ssl_debug_printf("%s: decryption failed: %s\n", G_STRFUNC((const char*) (__func__)), err);
4679 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
4680 return false0;
4681 }
4682 } else {
4683 // Try to decrypt using a hardware token.
4684 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
4685 if (ret < 0) {
4686 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
4687 return false0;
4688 }
4689 }
4690
4691 if (pms.size != 48) {
4692 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
4693 G_STRFUNC((const char*) (__func__)), pms.size, 48);
4694 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4695 return false0;
4696 }
4697
4698 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
4699 ssl_session->pre_master_secret.data_len = 48;
4700 g_free(pms.data)(__builtin_object_size ((pms.data), 0) != ((size_t) - 1)) ? g_free_sized
(pms.data, __builtin_object_size ((pms.data), 0)) : (g_free)
(pms.data);
4701 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
4702
4703 /* Remove the master secret if it was there.
4704 This forces keying material regeneration in
4705 case we're renegotiating */
4706 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4707 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4708 return true1;
4709} /* }}} */
4710#endif /* HAVE_LIBGNUTLS */
4711
4712/* Decryption integrity check {{{ */
4713
4714static int
4715tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
4716 uint32_t datalen, uint8_t* mac)
4717{
4718 SSL_HMACgcry_md_hd_t hm;
4719 int md;
4720 uint32_t len;
4721 uint8_t buf[DIGEST_MAX_SIZE48];
4722 int16_t temp;
4723
4724 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4725 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
4726 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4727
4728 if (ssl_hmac_init(&hm,md) != 0)
4729 return -1;
4730 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4731 return -1;
4732
4733 /* hash sequence number */
4734 phtonu64(buf, decoder->seq);
4735
4736 decoder->seq++;
4737
4738 ssl_hmac_update(&hm,buf,8);
4739
4740 /* hash content type */
4741 buf[0]=ct;
4742 ssl_hmac_update(&hm,buf,1);
4743
4744 /* hash version,data length and data*/
4745 /* *((int16_t*)buf) = g_htons(ver); */
4746 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4747 memcpy(buf, &temp, 2);
4748 ssl_hmac_update(&hm,buf,2);
4749
4750 /* *((int16_t*)buf) = g_htons(datalen); */
4751 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4752 memcpy(buf, &temp, 2);
4753 ssl_hmac_update(&hm,buf,2);
4754 ssl_hmac_update(&hm,data,datalen);
4755
4756 /* get digest and digest len*/
4757 len = sizeof(buf);
4758 ssl_hmac_final(&hm,buf,&len);
4759 ssl_hmac_cleanup(&hm);
4760 ssl_print_data("Mac", buf, len);
4761 if(memcmp(mac,buf,len))
4762 return -1;
4763
4764 return 0;
4765}
4766
4767static int
4768ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
4769 uint32_t datalen, uint8_t* mac)
4770{
4771 SSL_MDgcry_md_hd_t mc;
4772 int md;
4773 uint32_t len;
4774 uint8_t buf[64],dgst[20];
4775 int pad_ct;
4776 int16_t temp;
4777
4778 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
4779
4780 /* get cipher used for digest computation */
4781 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4782 if (ssl_md_init(&mc,md) !=0)
4783 return -1;
4784
4785 /* do hash computation on data && padding */
4786 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4787
4788 /* hash padding*/
4789 memset(buf,0x36,pad_ct);
4790 ssl_md_update(&mc,buf,pad_ct);
4791
4792 /* hash sequence number */
4793 phtonu64(buf, decoder->seq);
4794 decoder->seq++;
4795 ssl_md_update(&mc,buf,8);
4796
4797 /* hash content type */
4798 buf[0]=ct;
4799 ssl_md_update(&mc,buf,1);
4800
4801 /* hash data length in network byte order and data*/
4802 /* *((int16_t* )buf) = g_htons(datalen); */
4803 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4804 memcpy(buf, &temp, 2);
4805 ssl_md_update(&mc,buf,2);
4806 ssl_md_update(&mc,data,datalen);
4807
4808 /* get partial digest */
4809 ssl_md_final(&mc,dgst,&len);
4810 ssl_md_reset(&mc);
4811
4812 /* hash mac key */
4813 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
4814
4815 /* hash padding and partial digest*/
4816 memset(buf,0x5c,pad_ct);
4817 ssl_md_update(&mc,buf,pad_ct);
4818 ssl_md_update(&mc,dgst,len);
4819
4820 ssl_md_final(&mc,dgst,&len);
4821 ssl_md_cleanup(&mc);
4822
4823 if(memcmp(mac,dgst,len))
4824 return -1;
4825
4826 return 0;
4827}
4828
4829static int
4830dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
4831 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
4832{
4833 SSL_HMACgcry_md_hd_t hm;
4834 int md;
4835 uint32_t len;
4836 uint8_t buf[DIGEST_MAX_SIZE48];
4837 int16_t temp;
4838
4839 int ver = ssl->session.version;
4840 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
4841
4842 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
4843 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
4844 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
4845
4846 if (ssl_hmac_init(&hm,md) != 0)
4847 return -1;
4848 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
4849 return -1;
4850
4851 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
4852
4853 if (is_cid && !ssl->session.deprecated_cid) {
4854 /* hash seq num placeholder */
4855 memset(buf,0xFF,8);
4856 ssl_hmac_update(&hm,buf,8);
4857
4858 /* hash content type + cid length + content type */
4859 buf[0]=ct;
4860 buf[1]=cidl;
4861 buf[2]=ct;
4862 ssl_hmac_update(&hm,buf,3);
4863
4864 /* hash version */
4865 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4866 memcpy(buf, &temp, 2);
4867 ssl_hmac_update(&hm,buf,2);
4868
4869 /* hash sequence number */
4870 phtonu64(buf, decoder->seq);
4871 buf[0]=decoder->epoch>>8;
4872 buf[1]=(uint8_t)decoder->epoch;
4873 ssl_hmac_update(&hm,buf,8);
4874
4875 /* hash cid */
4876 ssl_hmac_update(&hm,cid,cidl);
4877 } else {
4878 /* hash sequence number */
4879 phtonu64(buf, decoder->seq);
4880 buf[0]=decoder->epoch>>8;
4881 buf[1]=(uint8_t)decoder->epoch;
4882 ssl_hmac_update(&hm,buf,8);
4883
4884 /* hash content type */
4885 buf[0]=ct;
4886 ssl_hmac_update(&hm,buf,1);
4887
4888 /* hash version */
4889 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))));
4890 memcpy(buf, &temp, 2);
4891 ssl_hmac_update(&hm,buf,2);
4892
4893 if (is_cid && ssl->session.deprecated_cid) {
4894 /* hash cid */
4895 ssl_hmac_update(&hm,cid,cidl);
4896
4897 /* hash cid length */
4898 buf[0] = cidl;
4899 ssl_hmac_update(&hm,buf,1);
4900 }
4901 }
4902
4903 /* data length and data */
4904 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))));
4905 memcpy(buf, &temp, 2);
4906 ssl_hmac_update(&hm,buf,2);
4907 ssl_hmac_update(&hm,data,datalen);
4908
4909 /* get digest and digest len */
4910 len = sizeof(buf);
4911 ssl_hmac_final(&hm,buf,&len);
4912 ssl_hmac_cleanup(&hm);
4913 ssl_print_data("Mac", buf, len);
4914 if(memcmp(mac,buf,len))
4915 return -1;
4916
4917 return 0;
4918}
4919/* Decryption integrity check }}} */
4920
4921
4922static bool_Bool
4923tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
4924 uint8_t ct, uint16_t record_version,
4925 bool_Bool ignore_mac_failed,
4926 const unsigned char *in, uint16_t inl,
4927 const unsigned char *cid, uint8_t cidl,
4928 StringInfo *out_str, unsigned *outl)
4929{
4930 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
4931 * GenericAEADCipher: { nonce_explicit, [content] }
4932 * In TLS 1.3 this explicit nonce is gone.
4933 * With AES GCM/CCM, "[content]" is actually the concatenation of the
4934 * ciphertext and authentication tag.
4935 */
4936 const uint16_t version = ssl->session.version;
4937 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
4938 gcry_error_t err;
4939 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
4940 unsigned ciphertext_len, auth_tag_len;
4941 unsigned char nonce[12];
4942 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
4943 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
4944 const uint8_t draft_version = ssl->session.tls13_draft_version;
4945 const unsigned char *auth_tag_wire;
4946 unsigned char auth_tag_calc[16];
4947 unsigned char *aad = NULL((void*)0);
4948 unsigned aad_len = 0;
4949
4950 switch (cipher_mode) {
4951 case MODE_GCM:
4952 case MODE_CCM:
4953 case MODE_POLY1305:
4954 auth_tag_len = 16;
4955 break;
4956 case MODE_CCM_8:
4957 auth_tag_len = 8;
4958 break;
4959 default:
4960 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
4961 return false0;
4962 }
4963
4964 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
4965 if (is_v12 && cipher_mode != MODE_POLY1305) {
4966 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
4967 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
4968 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
4969 return false0;
4970 }
4971 explicit_nonce = in;
4972 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
4973 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
4974 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4975 if (inl < auth_tag_len) {
4976 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
4977 return false0;
4978 }
4979 ciphertext = in;
4980 ciphertext_len = inl - auth_tag_len;
4981 } else {
4982 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
4983 return false0;
4984 }
4985 auth_tag_wire = ciphertext + ciphertext_len;
4986
4987 /*
4988 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
4989 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
4990 */
4991 if (is_v12 && cipher_mode != MODE_POLY1305) {
4992 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4992, "decoder->write_iv.data_len == 4"))));
4993 /* Implicit (4) and explicit (8) part of nonce. */
4994 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
4995 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
4996
4997 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
4998 /*
4999 * Technically the nonce length must be at least 8 bytes, but for
5000 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5001 */
5002 const unsigned nonce_len = 12;
5003 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5003, "decoder->write_iv.data_len == nonce_len"
))));
5004 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5005 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5006 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
5007 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5008 }
5009
5010 /* Set nonce and additional authentication data */
5011 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0);
5012 ssl_print_data("nonce", nonce, 12);
5013 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5014 if (err) {
5015 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5016 return false0;
5017 }
5018
5019 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5020 if (is_cid) { /* if connection ID */
5021 if (ssl->session.deprecated_cid) {
5022 aad_len = 14 + cidl;
5023 aad = wmem_alloc(allocator, aad_len);
5024 phtonu64(aad, decoder->seq); /* record sequence number */
5025 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5026 aad[8] = ct; /* TLSCompressed.type */
5027 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5028 memcpy(aad + 11, cid, cidl); /* cid */
5029 aad[11 + cidl] = cidl; /* cid_length */
5030 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5031 } else {
5032 aad_len = 23 + cidl;
5033 aad = wmem_alloc(allocator, aad_len);
5034 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5035 aad[8] = ct; /* TLSCompressed.type */
5036 aad[9] = cidl; /* cid_length */
5037 aad[10] = ct; /* TLSCompressed.type */
5038 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
5039 phtonu64(aad + 13, decoder->seq); /* record sequence number */
5040 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5041 memcpy(aad + 21, cid, cidl); /* cid */
5042 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5043 }
5044 } else if (is_v12) {
5045 aad_len = 13;
5046 aad = wmem_alloc(allocator, aad_len);
5047 phtonu64(aad, decoder->seq); /* record sequence number */
5048 if (version == DTLSV1DOT2_VERSION0xfefd) {
5049 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5050 }
5051 aad[8] = ct; /* TLSCompressed.type */
5052 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5053 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5054 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5055 aad_len = decoder->dtls13_aad.data_len;
5056 aad = decoder->dtls13_aad.data;
5057 } else if (draft_version >= 25 || draft_version == 0) {
5058 aad_len = 5;
5059 aad = wmem_alloc(allocator, aad_len);
5060 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5061 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5062 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
5063 }
5064
5065 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5066 /* size of plaintext, additional authenticated data and auth tag. */
5067 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5068
5069 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5070 }
5071
5072 if (aad && aad_len > 0) {
5073 ssl_print_data("AAD", aad, aad_len);
5074 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5075 if (err) {
5076 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5077 return false0;
5078 }
5079 }
5080
5081 /* Decrypt now that nonce and AAD are set. */
5082 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5083 if (err) {
5084 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5085 return false0;
5086 }
5087
5088 /* Check authentication tag for authenticity (replaces MAC) */
5089 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5090 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5091 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5092 } else {
5093 if (err) {
5094 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5095 } else {
5096 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5097 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5098 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5099 }
5100 if (ignore_mac_failed) {
5101 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5102 } else {
5103 return false0;
5104 }
5105 }
5106
5107 /*
5108 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5109 * after successful authentication to ensure that early data is skipped when
5110 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5111 */
5112 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5113 decoder->seq++;
5114 }
5115
5116 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5117 *outl = ciphertext_len;
5118 return true1;
5119}
5120
5121/* Record decryption glue based on security parameters {{{ */
5122/* Assume that we are called only for a non-NULL decoder which also means that
5123 * we have a non-NULL decoder->cipher_suite. */
5124int
5125ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5126 bool_Bool ignore_mac_failed,
5127 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5128 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5129{
5130 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5131 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5132
5133 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5134 ssl_print_data("Ciphertext",in, inl);
5135
5136 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5137 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5138 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5139 return -1;
5140 }
5141
5142 /* ensure we have enough storage space for decrypted data */
5143 if (inl > out_str->data_len)
5144 {
5145 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5146 inl + 32, out_str->data_len);
5147 ssl_data_realloc(out_str, inl + 32);
5148 }
5149
5150 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5151 * a separate MAC, so use a different routine for simplicity. */
5152 if (decoder->cipher_suite->mode == MODE_GCM ||
5153 decoder->cipher_suite->mode == MODE_CCM ||
5154 decoder->cipher_suite->mode == MODE_CCM_8 ||
5155 decoder->cipher_suite->mode == MODE_POLY1305 ||
5156 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5157 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5158
5159 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5160 /* decryption failed */
5161 return -1;
5162 }
5163
5164 goto skip_mac;
5165 }
5166
5167 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5168 * (notation: { unencrypted, [ encrypted ] })
5169 * GenericStreamCipher: { [content, mac] }
5170 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5171 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5172 * GenericAEADCipher: { nonce_explicit, [content] }
5173 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5174 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5175 */
5176
5177 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5178
5179 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5180 if (decoder->cipher_suite->mode == MODE_CBC) {
5181 unsigned blocksize = 0;
5182
5183 switch (ssl->session.version) {
5184 case TLSV1DOT1_VERSION0x302:
5185 case TLSV1DOT2_VERSION0x303:
5186 case DTLSV1DOT0_VERSION0xfeff:
5187 case DTLSV1DOT2_VERSION0xfefd:
5188 case DTLSV1DOT3_VERSION0xfefc:
5189 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5190 case TLCPV1_VERSION0x101:
5191 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5192 if (inl < blocksize) {
5193 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5194 inl, blocksize);
5195 return -1;
5196 }
5197 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5198 if (pad != 0) {
5199 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5200 gcry_strsource (pad), gcry_strerror (pad));
5201 }
5202
5203 inl -= blocksize;
5204 in += blocksize;
5205 break;
5206 }
5207
5208 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5209 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5210 /*
5211 * MAC is calculated over (IV + ) ENCRYPTED contents:
5212 *
5213 * MAC(MAC_write_key, ... +
5214 * IV + // for TLS 1.1 or greater
5215 * TLSCiphertext.enc_content);
5216 */
5217 if (inl < maclen) {
5218 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5219 G_STRFUNC((const char*) (__func__)), inl, maclen);
5220 return -1;
5221 }
5222 inl -= maclen;
5223 mac = (uint8_t *)in + inl;
5224 mac_frag = (uint8_t *)in - blocksize;
5225 mac_fraglen = blocksize + inl;
5226 }
5227 }
5228
5229 /* First decrypt*/
5230 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5231 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5232 gcry_strerror (pad));
5233 return -1;
5234 }
5235
5236 ssl_print_data("Plaintext", out_str->data, inl);
5237 worklen=inl;
5238
5239
5240 /* strip padding for GenericBlockCipher */
5241 if (decoder->cipher_suite->mode == MODE_CBC) {
5242 if (inl < 1) { /* Should this check happen earlier? */
5243 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5244 return -1;
5245 }
5246 pad=out_str->data[inl-1];
5247 if (worklen <= pad) {
5248 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5249 pad, worklen);
5250 return -1;
5251 }
5252 worklen-=(pad+1);
5253 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5254 pad, worklen);
5255 }
5256
5257 /* MAC for GenericStreamCipher and GenericBlockCipher.
5258 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5259 if (!mac) {
5260 /*
5261 * MAC is calculated over the DECRYPTED contents:
5262 *
5263 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5264 */
5265 if (worklen < maclen) {
5266 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5267 return -1;
5268 }
5269 worklen -= maclen;
5270 mac = out_str->data + worklen;
5271 mac_frag = out_str->data;
5272 mac_fraglen = worklen;
5273 }
5274
5275 /* If NULL encryption active and no keys are available, do not bother
5276 * checking the MAC. We do not have keys for that. */
5277 if (decoder->cipher_suite->mode == MODE_STREAM &&
5278 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5279 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5280 ssl_debug_printf("MAC check skipped due to missing keys\n");
5281 decoder->seq++; // Increment this for display
5282 goto skip_mac;
5283 }
5284
5285 /* Now check the MAC */
5286 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5287 worklen, ssl->session.version, ct, decoder->seq);
5288 if(ssl->session.version==SSLV3_VERSION0x300){
5289 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5290 if(ignore_mac_failed) {
5291 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5292 }
5293 else{
5294 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5295 return -1;
5296 }
5297 }
5298 else{
5299 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5300 }
5301 }
5302 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5303 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5304 if(ignore_mac_failed) {
5305 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5306 }
5307 else{
5308 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5309 return -1;
5310 }
5311 }
5312 else{
5313 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5314 }
5315 }
5316 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5317 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5318 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5319 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5320 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5321 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5322 }
5323 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5324 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5325 }
5326 else if(ignore_mac_failed) {
5327 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5328 }
5329 else{
5330 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5331 return -1;
5332 }
5333 }
5334skip_mac:
5335
5336 *outl = worklen;
5337
5338 if (decoder->compression > 0) {
5339 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5340 ssl_data_copy(comp_str, out_str);
5341 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5342 if (!decoder->decomp) {
5343 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5344 return -1;
5345 }
5346 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5347 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5348 *outl = uncomplen;
5349 }
5350
5351 return 0;
5352}
5353/* Record decryption glue based on security parameters }}} */
5354
5355
5356
5357#ifdef HAVE_LIBGNUTLS1
5358
5359/* RSA private key file processing {{{ */
5360static void
5361ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5362 const gnutls_datum_t *subjectPublicKeyInfo)
5363{
5364 gnutls_pubkey_t pubkey = NULL((void*)0);
5365 cert_key_id_t key_id;
5366 size_t key_id_len = sizeof(key_id);
5367 int r;
5368
5369 if (!subjectPublicKeyInfo->size) {
5370 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5371 return;
5372 }
5373
5374 r = gnutls_pubkey_init(&pubkey);
5375 if (r < 0) {
5376 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5377 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5378 return;
5379 }
5380
5381 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5382 if (r < 0) {
5383 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5384 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5385 goto end;
5386 }
5387
5388 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5389 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5390 goto end;
5391 }
5392
5393 /* Generate a 20-byte SHA-1 hash. */
5394 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5395 if (r < 0) {
5396 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5397 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5398 goto end;
5399 }
5400
5401 if (key_id_len != sizeof(key_id)) {
5402 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5403 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5404 goto end;
5405 }
5406
5407 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5408 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)));
5409 *ssl->cert_key_id = key_id;
5410
5411end:
5412 gnutls_pubkey_deinit(pubkey);
5413}
5414
5415/* RSA private key file processing }}} */
5416#endif /* HAVE_LIBGNUTLS */
5417
5418/*--- Start of dissector-related code below ---*/
5419
5420/* This is not a "protocol" but ensures that this gets called during
5421 * the handoff stage. */
5422void proto_reg_handoff_tls_utils(void);
5423
5424static dissector_handle_t base_tls_handle;
5425static dissector_handle_t dtls_handle;
5426
5427void
5428proto_reg_handoff_tls_utils(void)
5429{
5430 base_tls_handle = find_dissector("tls");
5431 dtls_handle = find_dissector("dtls");
5432}
5433
5434/* Look up an existing SslDecryptSession without creating one. Returns NULL if
5435 * no session exists. */
5436SslDecryptSession *
5437tls_get_session(conversation_t *conversation, int proto_ssl, uint8_t curr_layer_num)
5438{
5439 void *conv_data;
5440 wmem_map_t *session_map;
5441
5442 if (!conversation)
5443 return NULL((void*)0);
5444
5445 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5446 if (conv_data == NULL((void*)0))
5447 return NULL((void*)0);
5448
5449 session_map = (wmem_map_t *)conv_data;
5450
5451 return (SslDecryptSession *)wmem_map_lookup(session_map,
5452 GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5453
5454}
5455
5456static bool_Bool
5457ssl_session_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
5458{
5459 SslDecryptSession *ssl_session = (SslDecryptSession *) user_data;
5460
5461 tls_transcript_close(&ssl_session->handshake_transcript);
5462 tls_transcript_close(&ssl_session->ech_transcript);
5463
5464 return false0;
5465}
5466
5467/* get ssl data for this session. if no ssl data is found allocate a new one*/
5468SslDecryptSession *
5469ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle, uint8_t curr_layer_num)
5470{
5471 void *conv_data;
5472 SslDecryptSession *ssl_session;
5473 int proto_ssl;
5474 wmem_map_t *session_map;
5475
5476 /* Note proto_ssl is tls for either the main tls_handle or the
5477 * tls13_handshake handle used by QUIC. */
5478 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
5479 conv_data = conversation_get_proto_data(conversation, proto_ssl);
5480
5481 /* For nested TLS support, we store a wmem map of sessions indexed by layer number.
5482 * Using wmem_file_scope ensures the map is freed when the capture file is closed,
5483 * preventing memory leaks on capture reload. */
5484 if (conv_data != NULL((void*)0)) {
5485 session_map = (wmem_map_t *)conv_data;
5486 ssl_session = (SslDecryptSession *)wmem_map_lookup(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)));
5487 if (ssl_session != NULL((void*)0)) {
5488 return ssl_session;
5489 }
5490 } else {
5491 /* Create a new wmem map to store sessions by layer number */
5492 session_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
5493 conversation_add_proto_data(conversation, proto_ssl, session_map);
5494 }
5495
5496 /* no previous SSL conversation info for this layer, initialize it. */
5497 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)));
5498
5499 /* data_len is the part that is meaningful, not the allocated length */
5500 ssl_session->master_secret.data_len = 0;
5501 ssl_session->master_secret.data = ssl_session->_master_secret;
5502 ssl_session->session_id.data_len = 0;
5503 ssl_session->session_id.data = ssl_session->_session_id;
5504 ssl_session->client_random.data_len = 0;
5505 ssl_session->client_random.data = ssl_session->_client_random;
5506 ssl_session->server_random.data_len = 0;
5507 ssl_session->server_random.data = ssl_session->_server_random;
5508 ssl_session->session_ticket.data_len = 0;
5509 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
5510 ssl_session->server_data_for_iv.data_len = 0;
5511 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
5512 ssl_session->client_data_for_iv.data_len = 0;
5513 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
5514 ssl_session->app_data_segment.data = NULL((void*)0);
5515 ssl_session->app_data_segment.data_len = 0;
5516 /* The transcripts were zeroed by wmem_new0. */
5517 wmem_register_callback(wmem_file_scope(), ssl_session_destroy_cb, ssl_session);
5518
5519 /* Initialize parameters which are not necessary specific to decryption. */
5520 ssl_session->session.version = SSL_VER_UNKNOWN0;
5521 clear_address(&ssl_session->session.srv_addr);
5522 ssl_session->session.srv_ptype = PT_NONE;
5523 ssl_session->session.srv_port = 0;
5524 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
5525 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
5526 ssl_session->session.client_random.data_len = 0;
5527 ssl_session->session.client_random.data = ssl_session->session._client_random;
5528 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
5529 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
5530 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
5531 ssl_session->session.ech = false0;
5532 ssl_session->session.hrr_ech_declined = false0;
5533 ssl_session->session.first_ch_ech_frame = 0;
5534
5535 /* We want to increment the stream count for the normal tls handle and
5536 * dtls handle, but presumably not for the tls13_handshake handle used
5537 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
5538 * doesn't get sent to the TLS follow tap.)
5539 */
5540 if (tls_handle == base_tls_handle) {
5541 ssl_session->session.stream = tls_increment_stream_count();
5542 } else if (tls_handle == dtls_handle) {
5543 ssl_session->session.stream = dtls_increment_stream_count();
5544 }
5545
5546 /* Store the session in the wmem map indexed by layer number */
5547 wmem_map_insert(session_map, GUINT_TO_POINTER((unsigned)curr_layer_num)((gpointer) (gulong) ((unsigned)curr_layer_num)), ssl_session);
5548
5549 return ssl_session;
5550}
5551
5552void
5553tls_check_client_hello_random(SslDecryptSession *ssl, tvbuff_t *tvb, uint32_t offset)
5554{
5555 /* RFC 8446 4.1.2: After a HelloRetryRequest, the client sends the same
5556 * ClientHello with only certain changes, which don't include the random.
5557 * A different random means this is a new handshake, e.g. a new connection
5558 * reusing the addresses and ports with the TCP handshake missing. */
5559 if (!ssl || !tvb_bytes_exist(tvb, offset + 2, 32))
5560 return;
5561
5562 if ((ssl->state & SSL_HELLO_RETRY_REQUEST(1<<14)) &&
5563 tvb_memeql(tvb, offset + 2, ssl->last_client_hello_random, 32) != 0) {
5564 ssl_debug_printf("%s ClientHello after a HelloRetryRequest has a new random, assuming a new handshake\n", G_STRFUNC((const char*) (__func__)));
5565 ssl->state &= ~SSL_HELLO_RETRY_REQUEST(1<<14);
5566 }
5567 tvb_memcpy(tvb, ssl->last_client_hello_random, offset + 2, 32);
5568}
5569
5570void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
5571{
5572 /* TLS 1.3 forbids renegotiation (and the version cannot change upon
5573 * renegotiation, in particular TLS 1.3 MUST NOT be [re]negotiated if a
5574 * prior version was negotiated.) However, we can get here in valid TLS
5575 * 1.3 for ClientHello or ServerHello following a HelloRetryRequest.
5576 */
5577 if (ssl) {
5578 /* Ensure that secrets are not restored using stale identifiers. Split
5579 * between client and server in case the packets somehow got out of order. */
5580 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
5581
5582 if (is_client) {
5583 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
5584 ssl->session_id.data_len = 0;
5585 ssl->session_ticket.data_len = 0;
5586 ssl->master_secret.data_len = 0;
5587 ssl->client_random.data_len = 0;
5588 ssl->has_early_data = false0;
5589 if (!(ssl->state & SSL_HELLO_RETRY_REQUEST(1<<14))) {
5590 // The transcript starts with the Client Hello, ensure that
5591 // any messages before it are forgotten. After a Hello Retry
5592 // Request, the transcript continues with ClientHello2 (see
5593 // tls_check_client_hello_random.)
5594 tls_transcript_reset(&ssl->handshake_transcript);
5595 tls_transcript_reset(&ssl->ech_transcript);
5596 }
5597 } else {
5598 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
5599 ssl->server_random.data_len = 0;
5600 ssl->pre_master_secret.data_len = 0;
5601#ifdef HAVE_LIBGNUTLS1
5602 ssl->cert_key_id = NULL((void*)0);
5603#endif
5604 ssl->has_psk = false0;
5605 ssl->has_key_share = false0;
5606 // There is no point in clearing the PSK when resetting the session,
5607 // we only store one global PSK in the prefs.
5608 //ssl->psk.data_len = 0;
5609 }
5610
5611 if (ssl->state & clear_flags) {
5612 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
5613 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
5614 ssl->state &= ~clear_flags;
5615 }
5616 }
5617
5618 /* These flags might be used for non-decryption purposes and may affect the
5619 * dissection, so reset them as well. */
5620 if (is_client) {
5621 session->client_cert_type = 0;
5622 } else {
5623 session->compression = 0;
5624 session->server_cert_type = 0;
5625 /* session->is_session_resumed is already handled in the ServerHello dissection. */
5626 }
5627 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
5628 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
5629}
5630
5631void
5632tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
5633 dissector_handle_t app_handle)
5634{
5635 conversation_t *conversation;
5636 SslSession *session;
5637
5638 /* Ignore if the TLS or other dissector is disabled. */
5639 /* XXX - find_dissector still works if a dissector is disabled,
5640 * this would be if the dissector isn't registered at all or the
5641 * caller is calling this with explicit NULL. */
5642 if (!tls_handle || !app_handle)
5643 return;
5644
5645 int proto = dissector_handle_get_protocol_index(tls_handle);
5646 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5647
5648 conversation = find_or_create_conversation(pinfo);
5649 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5650 session->app_handle = app_handle;
5651}
5652
5653static uint32_t
5654ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
5655 dissector_handle_t app_handle, uint32_t last_nontls_frame)
5656{
5657
5658 conversation_t *conversation;
5659 SslSession *session;
5660
5661 /* Ignore if the TLS dissector is disabled. */
5662 /* XXX - find_dissector still works if a dissector is disabled,
5663 * this would be if the dissector isn't registered at all (or the
5664 * caller has an error.) */
5665 if (!tls_handle)
5666 return 0;
5667
5668 int proto = dissector_handle_get_protocol_index(tls_handle);
5669 uint8_t curr_layer_num = p_get_proto_depth(pinfo, proto);
5670
5671 /* The caller should always pass a valid handle to its own dissector. */
5672 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5672, "app_handle"))));
5673
5674 conversation = find_or_create_conversation(pinfo);
5675 session = &ssl_get_session(conversation, tls_handle, curr_layer_num)->session;
5676
5677 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5678 session->last_nontls_frame,
5679 (void *)session->app_handle,
5680 dissector_handle_get_dissector_name(session->app_handle));
5681 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
5682 pinfo->num, (void *)app_handle,
5683 dissector_handle_get_dissector_name(app_handle));
5684
5685 /* Do not switch again if a dissector did it before. */
5686 if (session->last_nontls_frame) {
5687 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
5688 return session->last_nontls_frame;
5689 }
5690
5691 session->app_handle = app_handle;
5692 /* The TLS dissector should be called first for this conversation. */
5693 conversation_set_dissector(conversation, tls_handle);
5694 /* TLS starts after this frame. */
5695 session->last_nontls_frame = last_nontls_frame;
5696 return 0;
5697}
5698
5699/* ssl_starttls_ack: mark future frames as encrypted. */
5700uint32_t
5701ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5702 dissector_handle_t app_handle)
5703{
5704 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
5705}
5706
5707uint32_t
5708ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
5709 dissector_handle_t app_handle)
5710{
5711 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
5712}
5713
5714dissector_handle_t
5715ssl_find_appdata_dissector(const char *name)
5716{
5717 /* Accept 'http' for backwards compatibility and sanity. */
5718 if (!strcmp(name, "http"))
5719 name = "http-over-tls";
5720 /* XXX - Should this check to see if the dissector is actually added for
5721 * Decode As in the appropriate table?
5722 */
5723 return find_dissector(name);
5724}
5725
5726/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
5727static int
5728ssl_equal (const void *v, const void *v2)
5729{
5730 const StringInfo *val1;
5731 const StringInfo *val2;
5732 val1 = (const StringInfo *)v;
5733 val2 = (const StringInfo *)v2;
5734
5735 if (val1->data_len == val2->data_len &&
5736 !memcmp(val1->data, val2->data, val2->data_len)) {
5737 return 1;
5738 }
5739 return 0;
5740}
5741
5742static unsigned
5743ssl_hash(const void *v)
5744{
5745 const StringInfo* id;
5746 id = (const StringInfo*) v;
5747
5748 return wmem_strong_hash(id->data, id->data_len);
5749}
5750/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
5751
5752/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
5753void
5754ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5755{
5756 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5756, "main_handle"))));
5757 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5757, "subdissector_handle"))));
5758 /* Registration is required for Export PDU feature to work properly. */
5759 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5760, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
5760 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 5760, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))));
5761 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
5762
5763 if (port) {
5764 dissector_add_uint(dissector_table_name, port, subdissector_handle);
5765 if (tcp)
5766 dissector_add_uint("tcp.port", port, main_handle);
5767 else
5768 dissector_add_uint("udp.port", port, main_handle);
5769 dissector_add_uint("sctp.port", port, main_handle);
5770 } else {
5771 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
5772 }
5773}
5774
5775void
5776ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
5777{
5778 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
5779 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
5780 if (main_handle) {
5781 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
5782 dissector_delete_uint("sctp.port", port, main_handle);
5783 }
5784
5785 if (port) {
5786 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
5787 }
5788}
5789
5790void
5791ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
5792{
5793 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
5794 session->srv_ptype = ptype;
5795 session->srv_port = port;
5796}
5797
5798int
5799ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
5800{
5801 int ret;
5802 if (session && session->srv_addr.type != AT_NONE) {
5803 ret = (session->srv_ptype == pinfo->ptype) &&
5804 (session->srv_port == PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) &&
5805 addresses_equal(&session->srv_addr, PINFO_SRC(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr1
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->src
)));
5806 } else {
5807 ret = (dissector_get_uint_handle(table, PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport)) != 0);
5808 }
5809
5810 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
5811 return ret;
5812}
5813/* Handling of association between tls/dtls ports and clear text protocol. }}} */
5814
5815
5816/* Links SSL records with the real packet data. {{{ */
5817SslPacketInfo *
5818tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
5819{
5820 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5821 if (!pi) {
5822 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)));
5823 pi->srcport = PINFO_SRCPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port1
((pinfo)->conv_addr_port_endpoints) : (pinfo)->srcport);
5824 pi->destport = PINFO_DESTPORT(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_port2
((pinfo)->conv_addr_port_endpoints) : (pinfo)->destport
);
5825 conversation_t *conv = find_or_create_conversation_strat(pinfo);
5826 SslDecryptSession *ssl_session = tls_get_session(conv, proto, curr_layer_num_ssl);
5827 if (ssl_session) {
5828 /* This can also be called by the QUIC TLS1.3 handshake only
5829 * dissector. That is not associated with a session, or a stream,
5830 * and doesn't need the information for Follow or Decode As. */
5831 pi->stream = ssl_session->session.stream;
5832 }
5833 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
5834 }
5835
5836 return pi;
5837}
5838
5839/**
5840 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
5841 * avoid the need for a decoder in the second pass. Additionally, it remembers
5842 * sequence numbers (for reassembly and Follow TLS Stream).
5843 *
5844 * @param proto The protocol identifier (proto_ssl or proto_dtls).
5845 * @param pinfo The packet where the record originates from.
5846 * @param plain_data Decrypted plaintext to store in the record.
5847 * @param plain_data_len Total length of the plaintext.
5848 * @param content_len Length of the plaintext section corresponding to the record content.
5849 * @param record_id The identifier for this record within the current packet.
5850 * @param flow Information about sequence numbers, etc.
5851 * @param type TLS Content Type (such as handshake or application_data).
5852 * @param curr_layer_num_ssl The layer identifier for this TLS session.
5853 */
5854void
5855ssl_add_record_info(int proto, packet_info *pinfo,
5856 const unsigned char *plain_data, int plain_data_len, int content_len,
5857 int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl,
5858 uint64_t record_seq)
5859{
5860 SslRecordInfo* rec, **prec;
5861 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
5862
5863 ws_assert(content_len <= plain_data_len)do { if ((1) && !(content_len <= plain_data_len)) ws_log_fatal_full
("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c", 5863
, __func__, "assertion failed: %s", "content_len <= plain_data_len"
); } while (0);
5864
5865 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)));
5866 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len);
5867 rec->plain_data_len = plain_data_len;
5868 rec->content_len = content_len;
5869 rec->id = record_id;
5870 rec->type = type;
5871 rec->next = NULL((void*)0);
5872 rec->record_seq = record_seq;
5873
5874 if (flow && type == SSL_ID_APP_DATA) {
5875 rec->seq = flow->byte_seq;
5876 rec->flow = flow;
5877 flow->byte_seq += content_len;
5878 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
5879 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + content_len, (void*)flow);
5880 }
5881
5882 /* Remember decrypted records. */
5883 prec = &pi->records;
5884 while (*prec) prec = &(*prec)->next;
5885 *prec = rec;
5886}
5887
5888/* search in packet data for the specified id; return a newly created tvb for the associated data */
5889tvbuff_t*
5890ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
5891{
5892 SslRecordInfo* rec;
5893 SslPacketInfo* pi;
5894 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
5895
5896 if (!pi)
5897 return NULL((void*)0);
5898
5899 for (rec = pi->records; rec; rec = rec->next)
5900 if (rec->id == record_id) {
5901 *matched_record = rec;
5902 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
5903 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len);
5904 }
5905
5906 return NULL((void*)0);
5907}
5908/* Links SSL records with the real packet data. }}} */
5909
5910/* initialize/reset per capture state data (ssl sessions cache). {{{ */
5911void
5912ssl_common_init(ssl_master_key_map_t *mk_map,
5913 StringInfo *decrypted_data, StringInfo *compressed_data)
5914{
5915 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
5916 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
5917 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
5918 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
5919 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
5920 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
5921 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5922 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
5923 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5924 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
5925 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5926 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
5927
5928 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
5929 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
5930
5931 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
5932
5933 ssl_data_alloc(decrypted_data, 32);
5934 ssl_data_alloc(compressed_data, 32);
5935}
5936
5937void
5938ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
5939 StringInfo *decrypted_data, StringInfo *compressed_data)
5940{
5941 g_hash_table_destroy(mk_map->session);
5942 g_hash_table_destroy(mk_map->tickets);
5943 g_hash_table_destroy(mk_map->crandom);
5944 g_hash_table_destroy(mk_map->pre_master);
5945 g_hash_table_destroy(mk_map->pms);
5946 g_hash_table_destroy(mk_map->tls13_client_early);
5947 g_hash_table_destroy(mk_map->tls13_client_handshake);
5948 g_hash_table_destroy(mk_map->tls13_server_handshake);
5949 g_hash_table_destroy(mk_map->tls13_client_appdata);
5950 g_hash_table_destroy(mk_map->tls13_server_appdata);
5951 g_hash_table_destroy(mk_map->tls13_early_exporter);
5952 g_hash_table_destroy(mk_map->tls13_exporter);
5953
5954 g_hash_table_destroy(mk_map->ech_secret);
5955 g_hash_table_destroy(mk_map->ech_config);
5956
5957 g_hash_table_destroy(mk_map->used_crandom);
5958
5959 g_free(decrypted_data->data)(__builtin_object_size ((decrypted_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (decrypted_data->data, __builtin_object_size
((decrypted_data->data), 0)) : (g_free) (decrypted_data->
data);
5960 g_free(compressed_data->data)(__builtin_object_size ((compressed_data->data), 0) != ((size_t
) - 1)) ? g_free_sized (compressed_data->data, __builtin_object_size
((compressed_data->data), 0)) : (g_free) (compressed_data
->data);
5961
5962 /* close the previous keylog file now that the cache are cleared, this
5963 * allows the cache to be filled with the full keylog file contents. */
5964 if (*ssl_keylog_file) {
5965 fclose(*ssl_keylog_file);
5966 *ssl_keylog_file = NULL((void*)0);
5967 }
5968}
5969/* }}} */
5970
5971/* parse ssl related preferences (private keys and ports association strings) */
5972#if defined(HAVE_LIBGNUTLS1)
5973/* Load a single RSA key file item from preferences. {{{ */
5974void
5975ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
5976{
5977 gnutls_x509_privkey_t x509_priv_key;
5978 gnutls_privkey_t priv_key = NULL((void*)0);
5979 FILE* fp = NULL((void*)0);
5980 int ret;
5981 size_t key_id_len = 20;
5982 unsigned char *key_id = NULL((void*)0);
5983 char *err = NULL((void*)0);
5984 dissector_handle_t handle;
5985 /* try to load keys file first */
5986 fp = ws_fopenfopen(uats->keyfile, "rb");
5987 if (!fp) {
5988 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
5989 return;
5990 }
5991
5992 if ((int)strlen(uats->password) == 0) {
5993 x509_priv_key = rsa_load_pem_key(fp, &err);
5994 } else {
5995 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
5996 }
5997 fclose(fp);
5998
5999 if (!x509_priv_key) {
6000 if (err) {
6001 report_failure("Can't load private key from %s: %s",
6002 uats->keyfile, err);
6003 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
6004 } else
6005 report_failure("Can't load private key from %s: unknown error",
6006 uats->keyfile);
6007 return;
6008 }
6009 if (err) {
6010 report_failure("Load of private key from %s \"succeeded\" with error %s",
6011 uats->keyfile, err);
6012 g_free(err)(__builtin_object_size ((err), 0) != ((size_t) - 1)) ? g_free_sized
(err, __builtin_object_size ((err), 0)) : (g_free) (err);
6013 }
6014
6015 gnutls_privkey_init(&priv_key);
6016 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6017 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6018 if (ret < 0) {
6019 report_failure("Can't convert private key %s: %s",
6020 uats->keyfile, gnutls_strerror(ret));
6021 goto end;
6022 }
6023
6024 key_id = (unsigned char *) g_malloc0(key_id_len);
6025 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6026 if (ret < 0) {
6027 report_failure("Can't calculate public key ID for %s: %s",
6028 uats->keyfile, gnutls_strerror(ret));
6029 goto end;
6030 }
6031 ssl_print_data("KeyID", key_id, key_id_len);
6032 if (key_id_len != 20) {
6033 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6034 uats->keyfile, key_id_len);
6035 goto end;
6036 }
6037
6038 g_hash_table_replace(key_hash, key_id, priv_key);
6039 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6040 priv_key = NULL((void*)0);
6041 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6042
6043 handle = ssl_find_appdata_dissector(uats->protocol);
6044 if (handle) {
6045 /* Port to subprotocol mapping */
6046 uint16_t port = 0;
6047 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6048 if (port > 0) {
6049 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6050 port, uats->keyfile, uats->password);
6051
6052 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6053 }
6054 } else {
6055 if (strcmp(uats->port, "start_tls"))
6056 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6057 }
6058 }
6059
6060end:
6061 gnutls_x509_privkey_deinit(x509_priv_key);
6062 gnutls_privkey_deinit(priv_key);
6063 g_free(key_id)(__builtin_object_size ((key_id), 0) != ((size_t) - 1)) ? g_free_sized
(key_id, __builtin_object_size ((key_id), 0)) : (g_free) (key_id
);
6064}
6065/* }}} */
6066#endif
6067
6068
6069/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6070/** store a known (pre-)master secret into cache */
6071static void
6072ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6073 StringInfo *mk)
6074{
6075 StringInfo *ht_key, *master_secret;
6076
6077 if (key->data_len == 0) {
6078 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6079 return;
6080 }
6081
6082 if (mk->data_len == 0) {
6083 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6084 G_STRFUNC((const char*) (__func__)), label);
6085 return;
6086 }
6087
6088 ht_key = ssl_data_clone(key);
6089 master_secret = ssl_data_clone(mk);
6090 g_hash_table_insert(ht, ht_key, master_secret);
6091
6092 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6093 ssl_print_string("stored key", ht_key);
6094 ssl_print_string("stored (pre-)master secret", master_secret);
6095}
6096
6097/** restore a (pre-)master secret given some key in the cache */
6098static bool_Bool
6099ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6100 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6101{
6102 StringInfo *ms;
6103
6104 if (key->data_len == 0) {
6105 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6106 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6107 return false0;
6108 }
6109
6110 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6111 if (!ms) {
6112 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6113 is_pre_master ? "pre-" : "", label);
6114 return false0;
6115 }
6116
6117 /* (pre)master secret found, clear knowledge of other keys and set it in the
6118 * current conversation */
6119 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6120 SSL_HAVE_SESSION_KEY(1<<3));
6121 if (is_pre_master) {
6122 /* unlike master secret, pre-master secret has a variable size (48 for
6123 * RSA, varying for PSK) and is therefore not statically allocated */
6124 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6125 ms->data_len);
6126 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6127 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6128 } else {
6129 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6130 ssl->state |= SSL_MASTER_SECRET(1<<5);
6131 }
6132 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6133 is_pre_master ? "pre-" : "", label);
6134 ssl_print_string(label, key);
6135 ssl_print_string("(pre-)master secret", ms);
6136 return true1;
6137}
6138/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6139
6140/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6141 * the decoder should be attempted to be initialized. {{{*/
6142void
6143ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6144{
6145 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
6146 /* TLS 1.3 implementations only provide secrets derived from the master
6147 * secret which are loaded in tls13_change_key. No master secrets can be
6148 * loaded here, so just return. */
6149 return;
6150 }
6151 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6152 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
6153 ssl_debug_printf(" session key already available, nothing to do.\n");
6154 return;
6155 }
6156 if (!(ssl->state & SSL_CIPHER(1<<2))) {
6157 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6158 return;
6159 }
6160
6161 /* for decryption, there needs to be a master secret (which can be derived
6162 * from pre-master secret). If missing, try to pick a master key from cache
6163 * (an earlier packet in the capture or key logfile). */
6164 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6165 !ssl_restore_master_key(ssl, "Session ID", false0,
6166 mk_map->session, &ssl->session_id) &&
6167 (!ssl->session.is_session_resumed ||
6168 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6169 mk_map->tickets, &ssl->session_ticket)) &&
6170 !ssl_restore_master_key(ssl, "Client Random", false0,
6171 mk_map->crandom, &ssl->client_random)) {
6172 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6173 /* how unfortunate, the master secret could not be found */
6174 ssl_debug_printf(" Cannot find master secret\n");
6175 return;
6176 } else {
6177 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6178 "because of a NULL cipher\n");
6179 }
6180 }
6181
6182 if (ssl_generate_keyring_material(ssl) < 0) {
6183 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6184 return;
6185 }
6186 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6187 ssl_save_master_key("Client Random", mk_map->crandom,
6188 &ssl->client_random, &ssl->master_secret);
6189 ssl_save_master_key("Session ID", mk_map->session,
6190 &ssl->session_id, &ssl->master_secret);
6191 /* Only save the new secrets if the server sent the ticket. The client
6192 * ticket might have become stale. */
6193 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6194 ssl_save_master_key("Session Ticket", mk_map->tickets,
6195 &ssl->session_ticket, &ssl->master_secret);
6196 }
6197} /* }}} */
6198
6199static StringInfo*
6200tls13_load_secret_from_psk(SslDecryptSession *tls, bool_Bool is_from_server,
6201 TLSRecordType type)
6202{
6203 /* XXX - In addition to an out-of-bound PSK, we could also save the
6204 * PSK from a NewSessionTicket; we would also need to compute the
6205 * resumption_master_secret. */
6206 if (tls->psk.data_len == 0)
6207 return NULL((void*)0);
6208
6209 /* We SHOULD associate each PSK with a hash algorithm (e.g., use
6210 * a UAT instead of a single global PSK string preference, preferably
6211 * following RFC 9258.) Failing that, RFC 8864 4.2.1 and 9258 say SHA-256
6212 * SHOULD be used. We will try the negotiated hash algorithm regardless
6213 * with the PSK, but fall back to SHA-256 for the Early Secret, since
6214 * that's before the Server Hello completes negotiation.
6215 */
6216 const SslDigestAlgo *dig = ssl_cipher_suite_dig(tls->cipher_suite);
6217 if (type == TLS_SECRET_0RTT_APP && dig == &digests[DIG_NA0x45 - DIG_MD50x40]) {
6218 dig = &digests[DIG_SHA2560x42 - DIG_MD50x40];
6219 ssl_debug_printf("%s assuming PSK hash function is %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6220 }
6221
6222 int hash_algo = ssl_get_digest_by_name(dig->name);
6223 if (!hash_algo) {
6224 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), dig->name);
6225 return NULL((void*)0);
6226 }
6227
6228 /* We can re-use this to store the Pseudo Random Key for each epoch. */
6229 uint8_t prk[DIGEST_MAX_SIZE48];
6230 StringInfo prk_string = { prk, dig->len };
6231 uint8_t *derived_secret;
6232
6233 uint8_t zeroes[DIGEST_MAX_SIZE48];
6234 memset(zeroes, 0, dig->len);
6235
6236 StringInfo *secret = NULL((void*)0);
6237 const char *label;
6238
6239 /* PRK = Early Secret */
6240 hkdf_extract(hash_algo, zeroes, dig->len, tls->psk.data, tls->psk.data_len, prk);
6241
6242 if (type == TLS_SECRET_0RTT_APP) {
6243 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6243, "!is_from_server"))));
6244 label = "c e traffic";
6245 } else {
6246 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6247 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6248 return NULL((void*)0);
6249
6250 /* PRK = Handshake Secret [assume no (EC)DHE.] */
6251 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6252 wmem_free(NULL((void*)0), derived_secret);
6253
6254 if (type == TLS_SECRET_HANDSHAKE) {
6255 label = is_from_server ? "s hs traffic" : "c hs traffic";
6256 } else {
6257 if (!tls13_derive_secret(hash_algo, &prk_string, tls13_hkdf_label_prefix(tls),
6258 "derived", NULL((void*)0), 0, dig->len, &derived_secret))
6259 return NULL((void*)0);
6260
6261 /* PRK = Master Secret */
6262 hkdf_extract(hash_algo, derived_secret, dig->len, zeroes, dig->len, prk);
6263 wmem_free(NULL((void*)0), derived_secret);
6264
6265 label = is_from_server ? "s ap traffic" : "c ap traffic";
6266 }
6267 }
6268
6269 /* XXX - If Encrypted Client Hello was accepted (do client/server pairs
6270 * support ECHO with psk_ke?) then we should use ech_transcript instead
6271 * of handshake_transcript. Both are kept until the ServerHello indicates
6272 * whether ECHO was accepted or not, though the ECH transcript doesn't
6273 * currently get the messages after the ServerHello. */
6274 uint8_t transcript_hash[DIGEST_MAX_SIZE48];
6275 unsigned transcript_hash_len;
6276 if (!tls_transcript_hash(&tls->handshake_transcript, hash_algo, transcript_hash, &transcript_hash_len)) {
6277 ssl_debug_printf("%s can't get the transcript hash\n", G_STRFUNC((const char*) (__func__)));
6278 return NULL((void*)0);
6279 }
6280 if (!tls13_hkdf_expand_label_context(hash_algo, &prk_string,
6281 tls13_hkdf_label_prefix(tls), label,
6282 transcript_hash, transcript_hash_len,
6283 dig->len, &derived_secret))
6284 return NULL((void*)0);
6285
6286 secret = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6287 secret->data = wmem_memdup(wmem_file_scope(), derived_secret, dig->len);
6288 secret->data_len = dig->len;
6289 wmem_free(NULL((void*)0), derived_secret);
6290 return secret;
6291}
6292
6293/* Load the traffic key secret from the keylog file. */
6294StringInfo *
6295tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6296 bool_Bool is_from_server, TLSRecordType type)
6297{
6298 GHashTable *key_map;
6299 const char *label;
6300
6301 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6302 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6303 return NULL((void*)0);
6304 }
6305
6306 if (ssl->client_random.data_len == 0) {
6307 /* May happen if Hello message is missing and Finished is found. */
6308 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6309 return NULL((void*)0);
6310 }
6311
6312 switch (type) {
6313 case TLS_SECRET_0RTT_APP:
6314 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6314, "!is_from_server"))));
6315 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6316 key_map = mk_map->tls13_client_early;
6317 break;
6318 case TLS_SECRET_HANDSHAKE:
6319 if (is_from_server) {
6320 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6321 key_map = mk_map->tls13_server_handshake;
6322 } else {
6323 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6324 key_map = mk_map->tls13_client_handshake;
6325 }
6326 break;
6327 case TLS_SECRET_APP:
6328 if (is_from_server) {
6329 label = "SERVER_TRAFFIC_SECRET_0";
6330 key_map = mk_map->tls13_server_appdata;
6331 } else {
6332 label = "CLIENT_TRAFFIC_SECRET_0";
6333 key_map = mk_map->tls13_client_appdata;
6334 }
6335 break;
6336 default:
6337 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6337, __func__, "assertion \"not reached\" failed");
6338 }
6339
6340 /* Transitioning to new keys, mark old ones as unusable. */
6341 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6342 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6343
6344 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6345 if (!secret) {
6346 secret = tls13_load_secret_from_psk(ssl, is_from_server, type);
6347 if (secret) {
6348 ssl_debug_printf("%s Calculated TLS 1.3 traffic secret from PSK.\n", G_STRFUNC((const char*) (__func__)));
6349 /* Doing this allows us to save the secret as a DSB in a pcapng. */
6350 g_hash_table_insert(key_map, ssl_data_clone(&ssl->client_random), secret);
6351 }
6352 }
6353 if (!secret) {
6354 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6355 /* Disable decryption, the keys are invalid. */
6356 if (is_from_server) {
6357 ssl->server = NULL((void*)0);
6358 } else {
6359 ssl->client = NULL((void*)0);
6360 }
6361 return NULL((void*)0);
6362 }
6363
6364 /* TLS 1.3 secret found, set new keys. */
6365 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6366 ssl_print_string("Client Random", &ssl->client_random);
6367 ssl_print_string(label, secret);
6368 return secret;
6369}
6370
6371/* Load the new key. */
6372void
6373tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6374 bool_Bool is_from_server, TLSRecordType type)
6375{
6376 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6377 /*
6378 * QUIC does not use the TLS record layer for message protection.
6379 * The required keys will be extracted later by QUIC.
6380 */
6381 return;
6382 }
6383
6384 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6385 if (!secret) {
6386 if (type != TLS_SECRET_HANDSHAKE) {
6387 return;
6388 }
6389 /*
6390 * Workaround for when for some reason we don't have the handshake
6391 * secret but do have the application traffic secret. (#20240)
6392 * If we can't find the handshake secret, we'll never decrypt the
6393 * Finished message, so we won't know when to change to the app
6394 * traffic key, so we do so now.
6395 */
6396 type = TLS_SECRET_APP;
6397 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6398 if (!secret) {
6399 return;
6400 }
6401 }
6402
6403 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6404 /*
6405 * Remember the application traffic secret to support Key Update. The
6406 * other secrets cannot be used for this purpose, so free them.
6407 */
6408 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6409 StringInfo *app_secret = &decoder->app_traffic_secret;
6410 if (type == TLS_SECRET_APP) {
6411 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6412 app_secret->data,
6413 secret->data_len);
6414 ssl_data_set(app_secret, secret->data, secret->data_len);
6415 } else {
6416 wmem_free(wmem_file_scope(), app_secret->data);
6417 app_secret->data = NULL((void*)0);
6418 app_secret->data_len = 0;
6419 }
6420 }
6421}
6422
6423/**
6424 * Update to next application data traffic secret for TLS 1.3. The previous
6425 * secret should have been set by tls13_change_key.
6426 */
6427void
6428tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6429{
6430 /* RFC 8446 Section 7.2:
6431 * application_traffic_secret_N+1 =
6432 * HKDF-Expand-Label(application_traffic_secret_N,
6433 * "traffic upd", "", Hash.length)
6434 *
6435 * Both application_traffic_secret_N are of the same length (Hash.length).
6436 */
6437 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6438 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6439 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6440 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6441
6442 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6443 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6444 return;
6445 }
6446
6447 /*
6448 * Previous traffic secret is available, so find the hash function,
6449 * expand the new traffic secret and generate new keys.
6450 */
6451 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6452 int hash_algo = ssl_get_digest_by_name(hash_name);
6453 const unsigned hash_len = app_secret->data_len;
6454 unsigned char *new_secret;
6455 const char *label = "traffic upd";
6456 if (tls13_draft_version && tls13_draft_version < 20) {
6457 label = "application traffic secret";
6458 }
6459 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6460 tls13_hkdf_label_prefix(ssl),
6461 label, hash_len, &new_secret)) {
6462 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6463 return;
6464 }
6465 ssl_data_set(app_secret, new_secret, hash_len);
6466 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6467 /*
6468 * Remember the application traffic secret on the new decoder to
6469 * support another Key Update.
6470 */
6471 decoder = is_from_server ? ssl->server : ssl->client;
6472 app_secret = &decoder->app_traffic_secret;
6473 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6474 app_secret->data,
6475 hash_len);
6476 ssl_data_set(app_secret, new_secret, hash_len);
6477 }
6478 wmem_free(NULL((void*)0), new_secret);
6479}
6480
6481void
6482tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6483{
6484 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6485 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6486 }
6487}
6488
6489/** SSL keylog file handling. {{{ */
6490
6491static GRegex *
6492ssl_compile_keyfile_regex(void)
6493{
6494#define OCTET "(?:[[:xdigit:]]{2})"
6495 const char *pattern =
6496 "(?:"
6497 /* Matches Client Hellos having this Client Random */
6498 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6499 /* Matches first part of encrypted RSA pre-master secret */
6500 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6501 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6502 but it can be of any length for DHE */
6503 ")(?<pms>" OCTET "+)"
6504 "|(?:"
6505 /* Matches Server Hellos having a Session ID */
6506 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6507 /* Matches Client Hellos having this Client Random */
6508 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6509 /* Master-Secret is given, its length is fixed */
6510 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6511 "|(?"
6512 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6513 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6514 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6515 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6516 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6517 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6518 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6519 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6520 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6521 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6522 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6523 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6524 ") (?<derived_secret>" OCTET "+)";
6525#undef OCTET
6526 static GRegex *regex = NULL((void*)0);
6527 GError *gerr = NULL((void*)0);
6528
6529 if (!regex) {
6530 regex = g_regex_new(pattern,
6531 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6532 G_REGEX_MATCH_ANCHORED, &gerr);
6533 if (gerr) {
6534 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6535 gerr->message);
6536 g_error_free(gerr);
6537 regex = NULL((void*)0);
6538 }
6539 }
6540
6541 return regex;
6542}
6543
6544typedef struct ssl_master_key_match_group {
6545 const char *re_group_name;
6546 GHashTable *master_key_ht;
6547} ssl_master_key_match_group_t;
6548
6549void
6550tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6551{
6552 ssl_master_key_match_group_t mk_groups[] = {
6553 { "encrypted_pmk", mk_map->pre_master },
6554 { "session_id", mk_map->session },
6555 { "client_random", mk_map->crandom },
6556 { "client_random_pms", mk_map->pms },
6557 /* TLS 1.3 map from Client Random to derived secret. */
6558 { "client_early", mk_map->tls13_client_early },
6559 { "client_handshake", mk_map->tls13_client_handshake },
6560 { "server_handshake", mk_map->tls13_server_handshake },
6561 { "client_appdata", mk_map->tls13_client_appdata },
6562 { "server_appdata", mk_map->tls13_server_appdata },
6563 { "early_exporter", mk_map->tls13_early_exporter },
6564 { "exporter", mk_map->tls13_exporter },
6565 { "ech_secret", mk_map->ech_secret },
6566 { "ech_config", mk_map->ech_config },
6567 };
6568
6569 /* The format of the file is a series of records with one of the following formats:
6570 * - "RSA xxxx yyyy"
6571 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6572 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6573 * (this is the original format introduced with bug 4349)
6574 *
6575 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6576 * Where xxxx is the SSL session ID (hex-encoded)
6577 * Where yyyy is the cleartext master secret (hex-encoded)
6578 * (added to support openssl s_client Master-Key output)
6579 * This is somewhat is a misnomer because there's nothing RSA specific
6580 * about this.
6581 *
6582 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6583 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6584 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6585 * (This format allows SSL connections to be decrypted, if a user can
6586 * capture the PMS but could not recover the MS for a specific session
6587 * with a SSL Server.)
6588 *
6589 * - "CLIENT_RANDOM xxxx yyyy"
6590 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6591 * Where yyyy is the cleartext master secret (hex-encoded)
6592 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6593 * ECDHE-RSA.)
6594 *
6595 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6596 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6597 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6598 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6599 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6600 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6601 * - "EXPORTER_SECRET xxxx yyyy"
6602 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6603 * Where yyyy is the secret (hex-encoded) derived from the early,
6604 * handshake or master secrets. (This format is introduced with TLS 1.3
6605 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6606 */
6607 GRegex *regex = ssl_compile_keyfile_regex();
6608 if (!regex)
6609 return;
6610
6611 const char *next_line = (const char *)data;
6612 const char *line_end = next_line + datalen;
6613 while (next_line && next_line < line_end) {
6614 const char *line = next_line;
6615 next_line = (const char *)memchr(line, '\n', line_end - line);
6616 ssize_t linelen;
6617
6618 if (next_line) {
6619 linelen = next_line - line;
6620 next_line++; /* drop LF */
6621 } else {
6622 linelen = (ssize_t)(line_end - line);
6623 }
6624 if (linelen > 0 && line[linelen - 1] == '\r') {
6625 linelen--; /* drop CR */
6626 }
6627
6628 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
6629 GMatchInfo *mi;
6630 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
6631 char *hex_key, *hex_pre_ms_or_ms;
6632 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6633 StringInfo *pre_ms_or_ms = NULL((void*)0);
6634 GHashTable *ht = NULL((void*)0);
6635
6636 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
6637 * otherwise we will use the Master Secret
6638 */
6639 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
6640 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6641 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6642 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
6643 }
6644 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
6645 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6646 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
6647 }
6648 /* There is always a match, otherwise the regex is wrong. */
6649 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6649, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))));
6650
6651 /* convert from hex to bytes and save to hashtable */
6652 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)));
6653 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
6654 g_free(hex_pre_ms_or_ms)(__builtin_object_size ((hex_pre_ms_or_ms), 0) != ((size_t) -
1)) ? g_free_sized (hex_pre_ms_or_ms, __builtin_object_size (
(hex_pre_ms_or_ms), 0)) : (g_free) (hex_pre_ms_or_ms);
6655
6656 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
6657 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
6658 ssl_master_key_match_group_t *g = &mk_groups[i];
6659 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
6660 if (hex_key && *hex_key) {
6661 ssl_debug_printf(" matched %s\n", g->re_group_name);
6662 ht = g->master_key_ht;
6663 from_hex(key, hex_key, strlen(hex_key));
6664 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6665 break;
6666 }
6667 g_free(hex_key)(__builtin_object_size ((hex_key), 0) != ((size_t) - 1)) ? g_free_sized
(hex_key, __builtin_object_size ((hex_key), 0)) : (g_free) (
hex_key);
6668 }
6669 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 6669, "ht")))); /* Cannot be reached, or regex is wrong. */
6670
6671 g_hash_table_insert(ht, key, pre_ms_or_ms);
6672
6673 } else if (linelen > 0 && line[0] != '#') {
6674 ssl_debug_printf(" unrecognized line\n");
6675 }
6676 /* always free match info even if there is no match. */
6677 g_match_info_free(mi);
6678 }
6679}
6680
6681void
6682ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
6683 const ssl_master_key_map_t *mk_map)
6684{
6685 /* no need to try if no key log file is configured. */
6686 if (!tls_keylog_filename || !*tls_keylog_filename) {
6687 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
6688 G_STRFUNC((const char*) (__func__)));
6689 return;
6690 }
6691
6692 /* Validate regexes before even trying to use it. */
6693 if (!ssl_compile_keyfile_regex()) {
6694 return;
6695 }
6696
6697 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
6698
6699 /* if the keylog file was deleted/overwritten, re-open it */
6700 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
6701 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
6702 fclose(*keylog_file);
6703 *keylog_file = NULL((void*)0);
6704 }
6705
6706 if (*keylog_file == NULL((void*)0)) {
6707 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
6708 if (!*keylog_file) {
6709 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
6710 return;
6711 }
6712 }
6713
6714 for (;;) {
6715 char buf[1110], *line;
6716 line = fgets(buf, sizeof(buf), *keylog_file);
6717 if (!line) {
6718 if (feof(*keylog_file)) {
6719 /* Ensure that newly appended keys can be read in the future. */
6720 clearerr(*keylog_file);
6721 } else if (ferror(*keylog_file)) {
6722 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
6723 fclose(*keylog_file);
6724 *keylog_file = NULL((void*)0);
6725 }
6726 break;
6727 }
6728 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
6729 }
6730}
6731/** SSL keylog file handling. }}} */
6732
6733#ifdef SSL_DECRYPT_DEBUG /* {{{ */
6734
6735static FILE* ssl_debug_file;
6736
6737void
6738ssl_set_debug(const char* name)
6739{
6740 static int debug_file_must_be_closed;
6741 int use_stderr;
6742
6743 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
6744
6745 if (debug_file_must_be_closed)
6746 fclose(ssl_debug_file);
6747
6748 if (use_stderr)
6749 ssl_debug_file = stderrstderr;
6750 else if (!name || (strcmp(name, "") ==0))
6751 ssl_debug_file = NULL((void*)0);
6752 else
6753 ssl_debug_file = ws_fopenfopen(name, "w");
6754
6755 if (!use_stderr && ssl_debug_file)
6756 debug_file_must_be_closed = 1;
6757 else
6758 debug_file_must_be_closed = 0;
6759
6760 ssl_debug_printf("Wireshark SSL debug log \n\n");
6761#ifdef HAVE_LIBGNUTLS1
6762 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
6763#endif
6764 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
6765 ssl_debug_printf("\n");
6766}
6767
6768void
6769ssl_debug_flush(void)
6770{
6771 if (ssl_debug_file)
6772 fflush(ssl_debug_file);
6773}
6774
6775void
6776ssl_debug_printf(const char* fmt, ...)
6777{
6778 va_list ap;
6779
6780 if (!ssl_debug_file)
6781 return;
6782
6783 va_start(ap, fmt)__builtin_va_start(ap, fmt);
6784 vfprintf(ssl_debug_file, fmt, ap);
6785 va_end(ap)__builtin_va_end(ap);
6786}
6787
6788void
6789ssl_print_data(const char* name, const unsigned char* data, size_t len)
6790{
6791 size_t i, j, k;
6792 if (!ssl_debug_file)
6793 return;
6794 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
6795 for (i=0; i<len; i+=16) {
6796 fprintf(ssl_debug_file,"| ");
6797 for (j=i, k=0; k<16 && j<len; ++j, ++k)
6798 fprintf(ssl_debug_file,"%.2x ",data[j]);
6799 for (; k<16; ++k)
6800 fprintf(ssl_debug_file," ");
6801 fputc('|', ssl_debug_file);
6802 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
6803 unsigned char c = data[j];
6804 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
6805 fputc(c, ssl_debug_file);
6806 }
6807 for (; k<16; ++k)
6808 fputc(' ', ssl_debug_file);
6809 fprintf(ssl_debug_file,"|\n");
6810 }
6811}
6812
6813void
6814ssl_print_string(const char* name, const StringInfo* data)
6815{
6816 ssl_print_data(name, data->data, data->data_len);
6817}
6818#endif /* SSL_DECRYPT_DEBUG }}} */
6819
6820/* UAT preferences callbacks. {{{ */
6821/* checks for SSL and DTLS UAT key list fields */
6822
6823bool_Bool
6824ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6825{
6826 // This should be removed in favor of Decode As. Make it optional.
6827 *err = NULL((void*)0);
6828 return true1;
6829}
6830
6831bool_Bool
6832ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6833{
6834 if (!p || strlen(p) == 0u) {
6835 // This should be removed in favor of Decode As. Make it optional.
6836 *err = NULL((void*)0);
6837 return true1;
6838 }
6839
6840 if (strcmp(p, "start_tls") != 0){
6841 uint16_t port;
6842 if (!ws_strtou16(p, NULL((void*)0), &port)) {
6843 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
6844 return false0;
6845 }
6846 }
6847
6848 *err = NULL((void*)0);
6849 return true1;
6850}
6851
6852bool_Bool
6853ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
6854{
6855 ws_statb64struct stat st;
6856
6857 if (!p || strlen(p) == 0u) {
6858 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
6859 return false0;
6860 } else {
6861 if (ws_stat64stat(p, &st) != 0) {
6862 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p);
6863 return false0;
6864 }
6865 }
6866
6867 *err = NULL((void*)0);
6868 return true1;
6869}
6870
6871bool_Bool
6872ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
6873{
6874#if defined(HAVE_LIBGNUTLS1)
6875 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
6876 FILE *fp = NULL((void*)0);
6877
6878 if (p && (strlen(p) > 0u)) {
6879 fp = ws_fopenfopen(f->keyfile, "rb");
6880 if (fp) {
6881 char *msg = NULL((void*)0);
6882 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
6883 if (!priv_key) {
6884 fclose(fp);
6885 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg);
6886 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6887 return false0;
6888 }
6889 g_free(msg)(__builtin_object_size ((msg), 0) != ((size_t) - 1)) ? g_free_sized
(msg, __builtin_object_size ((msg), 0)) : (g_free) (msg);
6890 gnutls_x509_privkey_deinit(priv_key);
6891 fclose(fp);
6892 } else {
6893 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
);
6894 return false0;
6895 }
6896 }
6897
6898 *err = NULL((void*)0);
6899 return true1;
6900#else
6901 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
);
6902 return false0;
6903#endif
6904}
6905/* UAT preferences callbacks. }}} */
6906
6907/** maximum size of ssl_association_info() string */
6908#define SSL_ASSOC_MAX_LEN8192 8192
6909
6910typedef struct ssl_association_info_callback_data
6911{
6912 char *str;
6913 const char *table_protocol;
6914} ssl_association_info_callback_data_t;
6915
6916/**
6917 * callback function used by ssl_association_info() to traverse the SSL associations.
6918 */
6919static void
6920ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
6921{
6922 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
6923 const int l = (const int)strlen(data->str);
6924 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
6925}
6926
6927/**
6928 * @return an information string on the SSL protocol associations. The string must be freed.
6929 */
6930char*
6931ssl_association_info(const char* dissector_table_name, const char* table_protocol)
6932{
6933 ssl_association_info_callback_data_t data;
6934
6935 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
6936 data.table_protocol = table_protocol;
6937 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
6938 return data.str;
6939}
6940
6941
6942/** Begin of code related to dissection of wire data. */
6943
6944/* Helpers for dissecting Variable-Length Vectors. {{{ */
6945bool_Bool
6946ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
6947 unsigned offset, unsigned offset_end, uint32_t *ret_length,
6948 int hf_length, uint32_t min_value, uint32_t max_value)
6949{
6950 unsigned veclen_size;
6951 uint32_t veclen_value;
6952 proto_item *pi;
6953
6954 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 6954, (uint64_t)min_value, (uint64_t)max_value))));
6955 if (offset > offset_end) {
6956 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
6957 "Vector offset is past buffer end offset (%u > %u)",
6958 offset, offset_end);
6959 *ret_length = 0;
6960 return false0; /* Cannot read length. */
6961 }
6962
6963 if (max_value > 0xffffff) {
6964 veclen_size = 4;
6965 } else if (max_value > 0xffff) {
6966 veclen_size = 3;
6967 } else if (max_value > 0xff) {
6968 veclen_size = 2;
6969 } else {
6970 veclen_size = 1;
6971 }
6972
6973 if (offset_end - offset < veclen_size) {
6974 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
6975 tvb, offset, offset_end - offset,
6976 "No more room for vector of length %u",
6977 veclen_size);
6978 *ret_length = 0;
6979 return false0; /* Cannot read length. */
6980 }
6981
6982 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
6983 offset += veclen_size;
6984
6985 if (veclen_value < min_value) {
6986 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6987 "Vector length %u is smaller than minimum %u",
6988 veclen_value, min_value);
6989 } else if (veclen_value > max_value) {
6990 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
6991 "Vector length %u is larger than maximum %u",
6992 veclen_value, max_value);
6993 }
6994
6995 if (offset_end - offset < veclen_value) {
6996 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
6997 "Vector length %u is too large, truncating it to %u",
6998 veclen_value, offset_end - offset);
6999 *ret_length = offset_end - offset;
7000 return false0; /* Length is truncated to avoid overflow. */
7001 }
7002
7003 *ret_length = veclen_value;
7004 return true1; /* Length is OK. */
7005}
7006
7007bool_Bool
7008ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7009 unsigned offset, unsigned offset_end)
7010{
7011 if (offset < offset_end) {
7012 unsigned trailing = offset_end - offset;
7013 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7014 tvb, offset, trailing,
7015 "%u trailing byte%s unprocessed",
7016 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7017 return false0; /* unprocessed data warning */
7018 } else if (offset > offset_end) {
7019 /*
7020 * Returned offset runs past the end. This should not happen and is
7021 * possibly a dissector bug.
7022 */
7023 unsigned excess = offset - offset_end;
7024 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7025 tvb, offset_end, excess,
7026 "Dissector processed too much data (%u byte%s)",
7027 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7028 return false0; /* overflow error */
7029 }
7030
7031 return true1; /* OK, offset matches. */
7032}
7033/** }}} */
7034
7035
7036static uint32_t
7037ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7038 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7039 uint16_t version, int hf_sig_len, int hf_sig);
7040
7041/* change_cipher_spec(20) dissection */
7042void
7043ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7044 packet_info *pinfo, proto_tree *tree,
7045 uint32_t offset, SslSession *session,
7046 bool_Bool is_from_server,
7047 const SslDecryptSession *ssl)
7048{
7049 /*
7050 * struct {
7051 * enum { change_cipher_spec(1), (255) } type;
7052 * } ChangeCipherSpec;
7053 */
7054 proto_item *ti;
7055 proto_item_set_text(tree,
7056 "%s Record Layer: %s Protocol: Change Cipher Spec",
7057 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7058 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7059 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7060
7061 if (session->version == TLSV1DOT3_VERSION0x304) {
7062 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7063 return;
7064 }
7065
7066 /* Remember frame number of first CCS */
7067 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7068 if (*ccs_frame == 0)
7069 *ccs_frame = pinfo->num;
7070
7071 /* Use heuristics to detect an abbreviated handshake, assume that missing
7072 * ServerHelloDone implies reusing previously negotiating keys. Then when
7073 * a Session ID or ticket is present, it must be a resumed session.
7074 * Normally this should be done at the Finished message, but that may be
7075 * encrypted so we do it here, at the last cleartext message. */
7076 if (is_from_server && ssl) {
7077 if (session->is_session_resumed) {
7078 const char *resumed = NULL((void*)0);
7079 if (ssl->session_ticket.data_len) {
7080 resumed = "Session Ticket";
7081 } else if (ssl->session_id.data_len) {
7082 resumed = "Session ID";
7083 }
7084 if (resumed) {
7085 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7086 } else {
7087 /* Can happen if the capture somehow starts in the middle */
7088 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7089 }
7090 } else {
7091 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7092 }
7093 }
7094 if (is_from_server && session->is_session_resumed)
7095 expert_add_info(pinfo, ti, &hf->ei.resumed);
7096}
7097
7098/** Begin of handshake(22) record dissections */
7099
7100/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7101 * {{{ */
7102static void
7103tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7104{
7105 uint32_t sighash, hashalg, sigalg;
7106 proto_item *ti_sigalg;
7107 proto_tree *sigalg_tree;
7108
7109 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7110 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7111 if (ja4_data && !IS_GREASE_TLS(sighash)((((sighash) & 0x0f0f) == 0x0a0a) && (((sighash) &
0xff) == (((sighash)>>8) & 0xff)))) {
7112 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7113 }
7114
7115 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7116
7117 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7118 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7119 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7120 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7121 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7122
7123 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7124 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7125 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7126 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7127 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7128 sighash);
7129 }
7130} /* }}} */
7131
7132/* dissect a list of hash algorithms, return the number of bytes dissected
7133 this is used for the signature algorithms extension and for the
7134 TLS1.2 certificate request. {{{ */
7135static int
7136ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7137 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7138{
7139 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7140 * struct {
7141 * HashAlgorithm hash;
7142 * SignatureAlgorithm signature;
7143 * } SignatureAndHashAlgorithm;
7144 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7145 */
7146 proto_tree *subtree;
7147 proto_item *ti;
7148 unsigned sh_alg_length;
7149 uint32_t next_offset;
7150
7151 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7152 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7153 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7154 return offset_end;
7155 }
7156 offset += 2;
7157 next_offset = offset + sh_alg_length;
7158
7159 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7160 "Signature Hash Algorithms (%u algorithm%s)",
7161 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7162 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7163
7164 while (offset + 2 <= next_offset) {
7165 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7166 offset += 2;
7167 }
7168
7169 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7170 offset = next_offset;
7171 }
7172
7173 return offset;
7174} /* }}} */
7175
7176/* Dissection of DistinguishedName (for CertificateRequest and
7177 * certificate_authorities extension). {{{ */
7178static uint32_t
7179tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7180 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7181{
7182 proto_item *ti;
7183 proto_tree *subtree;
7184 uint32_t dnames_length, next_offset;
7185 asn1_ctx_t asn1_ctx;
7186 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7187
7188 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7189 /* DistinguishedName certificate_authorities<0..2^16-1> */
7190 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7191 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7192 return offset_end;
7193 }
7194 offset += 2;
7195 next_offset = offset + dnames_length;
7196
7197 if (dnames_length > 0) {
7198 ti = proto_tree_add_none_format(tree,
7199 hf->hf.hs_dnames,
7200 tvb, offset, dnames_length,
7201 "Distinguished Names (%d byte%s)",
7202 dnames_length,
7203 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7204 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7205
7206 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7207
7208 while (offset < next_offset) {
7209 /* get the length of the current certificate */
7210 uint32_t name_length;
7211
7212 if (dnames_count-- == 0) {
7213 /* stop adding to tree when the list is considered too large
7214 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7215 Note: dnames_count must be set low enough not to hit the
7216 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7217 */
7218 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7219 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7220 proto_item_set_generated(ti);
7221 return next_offset;
7222 }
7223
7224 /* opaque DistinguishedName<1..2^16-1> */
7225 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7226 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7227 return next_offset;
7228 }
7229 offset += 2;
7230
7231 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7232 subtree, hf->hf.hs_dname);
7233 offset += name_length;
7234 }
7235 }
7236 return offset;
7237} /* }}} */
7238
7239
7240/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7241static int
7242ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7243 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7244{
7245 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7246}
7247
7248static int
7249ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7250 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7251{
7252 if (hnd_type == SSL_HND_CLIENT_HELLO ||
7253 hnd_type == SSL_HND_CERT_REQUEST) {
7254 /*
7255 * struct {
7256 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7257 * } SignatureSchemeList;
7258 */
7259
7260 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7261 } else {
7262 asn1_ctx_t asn1_ctx;
7263 unsigned pubkey_length, sign_length;
7264
7265 /*
7266 * struct {
7267 * uint32 valid_time;
7268 * SignatureScheme expected_cert_verify_algorithm;
7269 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7270 * } Credential;
7271 *
7272 * struct {
7273 * Credential cred;
7274 * SignatureScheme algorithm;
7275 * opaque signature<0..2^16-1>;
7276 * } DelegatedCredential;
7277 */
7278
7279 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7280
7281 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7282 offset += 4;
7283
7284 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7285 offset += 2;
7286
7287 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7288 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7289 return offset_end;
7290 }
7291 offset += 3;
7292 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7293 offset += pubkey_length;
7294
7295 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7296 offset += 2;
7297
7298 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7299 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7300 return offset_end;
7301 }
7302 offset += 2;
7303 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7304 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7305 offset += sign_length;
7306
7307 return offset;
7308 }
7309}
7310
7311static int
7312ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7313 packet_info *pinfo, proto_tree *tree,
7314 uint32_t offset, uint32_t offset_end,
7315 uint8_t hnd_type)
7316{
7317
7318 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7319
7320 switch (hnd_type) {
7321 case SSL_HND_CLIENT_HELLO: {
7322 proto_tree *alps_tree;
7323 proto_item *ti;
7324 uint32_t next_offset, alps_length, name_length;
7325
7326 /*
7327 * opaque ProtocolName<1..2^8-1>;
7328 * struct {
7329 * ProtocolName supported_protocols<2..2^16-1>
7330 * } ApplicationSettingsSupport;
7331 */
7332
7333 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7334 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7335 return offset_end;
7336 }
7337 offset += 2;
7338 next_offset = offset + alps_length;
7339
7340 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7341 tvb, offset, alps_length, ENC_NA0x00000000);
7342 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7343
7344 /* Parse list (note missing check for end of vector, ssl_add_vector below
7345 * ensures that data is always available.) */
7346 while (offset < next_offset) {
7347 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7348 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7349 return next_offset;
7350 }
7351 offset++;
7352
7353 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7354 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7355 offset += name_length;
7356 }
7357
7358 return offset;
7359 }
7360 case SSL_HND_ENCRYPTED_EXTS:
7361 /* Opaque blob */
7362 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7363 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7364 break;
7365 }
7366
7367 return offset_end;
7368}
7369
7370static int
7371ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7372 packet_info *pinfo, proto_tree *tree,
7373 uint32_t offset, uint32_t offset_end,
7374 uint8_t hnd_type, SslSession *session,
7375 bool_Bool is_dtls, ja4_data_t *ja4_data)
7376{
7377
7378 /* https://tools.ietf.org/html/rfc7301#section-3.1
7379 * opaque ProtocolName<1..2^8-1>;
7380 * struct {
7381 * ProtocolName protocol_name_list<2..2^16-1>
7382 * } ProtocolNameList;
7383 */
7384 proto_tree *alpn_tree;
7385 proto_item *ti;
7386 uint32_t next_offset, alpn_length, name_length;
7387 const char *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7388
7389 /* ProtocolName protocol_name_list<2..2^16-1> */
7390 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7391 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7392 return offset_end;
7393 }
7394 offset += 2;
7395 next_offset = offset + alpn_length;
7396
7397 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7398 tvb, offset, alpn_length, ENC_NA0x00000000);
7399 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7400
7401 /* Parse list (note missing check for end of vector, ssl_add_vector below
7402 * ensures that data is always available.) */
7403 while (offset < next_offset) {
7404 /* opaque ProtocolName<1..2^8-1> */
7405 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7406 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7407 return next_offset;
7408 }
7409 offset++;
7410
7411 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7412 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7413 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7414 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7415 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7416 if ((g_ascii_isalnum(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_ALNUM
) != 0)) && g_ascii_isalnum(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_ALNUM
) != 0)) {
7417 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7418 }
7419 else {
7420 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7421 alpn_last_char & 0x0F);
7422 }
7423 }
7424 /* Remember first ALPN ProtocolName entry for server. */
7425 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7426 /* '\0'-terminated string for dissector table match and prefix
7427 * comparison purposes. */
7428 proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7429 name_length, ENC_ASCII0x00000000);
7430 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7431 client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset,
7432 name_length, ENC_ASCII0x00000000);
7433 }
7434 offset += name_length;
7435 }
7436
7437 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7438 * exactly one "ProtocolName". */
7439 if (proto_name) {
7440 dissector_handle_t handle;
7441
7442 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7443
7444 if (is_dtls) {
7445 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7446 proto_name);
7447 } else {
7448 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7449 proto_name);
7450 if (handle == NULL((void*)0)) {
7451 /* Try prefix matching */
7452 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0])); i++) {
7453 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7454
7455 /* string_string is inappropriate as it compares strings
7456 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7457 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )) {
7458 handle = find_dissector(alpn_proto->dissector_name);
7459 break;
7460 }
7461 }
7462 }
7463 }
7464 if (handle != NULL((void*)0)) {
7465 /* ProtocolName match, so set the App data dissector handle.
7466 * This may override protocols given via the UAT dialog, but
7467 * since the ALPN hint is precise, do it anyway. */
7468 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7469 (void *)session->app_handle,
7470 (void *)handle,
7471 dissector_handle_get_dissector_name(handle));
7472 session->app_handle = handle;
7473 }
7474 } else if (client_proto_name) {
7475 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7476 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7477 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7478 }
7479
7480 return offset;
7481}
7482
7483static int
7484ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7485 packet_info *pinfo, proto_tree *tree,
7486 uint32_t offset, uint32_t offset_end)
7487{
7488 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7489 * The "extension_data" field of a "next_protocol_negotiation" extension
7490 * in a "ServerHello" contains an optional list of protocols advertised
7491 * by the server. Protocols are named by opaque, non-empty byte strings
7492 * and the list of protocols is serialized as a concatenation of 8-bit,
7493 * length prefixed byte strings. Implementations MUST ensure that the
7494 * empty string is not included and that no byte strings are truncated.
7495 */
7496 uint32_t npn_length;
7497 proto_tree *npn_tree;
7498
7499 /* List is optional, do not add tree if there are no entries. */
7500 if (offset == offset_end) {
7501 return offset;
7502 }
7503
7504 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7505
7506 while (offset < offset_end) {
7507 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7508 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7509 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7510 return offset_end;
7511 }
7512 offset++;
7513
7514 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7515 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7516 offset += npn_length;
7517 }
7518
7519 return offset;
7520}
7521
7522static int
7523ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7524 packet_info *pinfo, proto_tree *tree,
7525 uint32_t offset, uint32_t offset_end)
7526{
7527 /* https://tools.ietf.org/html/rfc5746#section-3.2
7528 * struct {
7529 * opaque renegotiated_connection<0..255>;
7530 * } RenegotiationInfo;
7531 *
7532 */
7533 proto_tree *reneg_info_tree;
7534 uint32_t reneg_info_length;
7535
7536 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7537
7538 /* opaque renegotiated_connection<0..255> */
7539 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7540 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7541 return offset_end;
7542 }
7543 offset++;
7544
7545 if (reneg_info_length > 0) {
7546 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7547 offset += reneg_info_length;
7548 }
7549
7550 return offset;
7551}
7552
7553static int
7554ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7555 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7556 const char **group_name_out)
7557{
7558 /* RFC 8446 Section 4.2.8
7559 * struct {
7560 * NamedGroup group;
7561 * opaque key_exchange<1..2^16-1>;
7562 * } KeyShareEntry;
7563 */
7564 uint32_t key_exchange_length, group;
7565 proto_tree *ks_tree;
7566
7567 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7568
7569 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7570 offset += 2;
7571 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7572 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7573 if (group_name_out) {
7574 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff))) ? group_name : NULL((void*)0);
7575 }
7576
7577 /* opaque key_exchange<1..2^16-1> */
7578 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7579 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7580 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7581 }
7582 offset += 2;
7583 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7584 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7585
7586 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7587 offset += key_exchange_length;
7588
7589 return offset;
7590}
7591
7592static int
7593ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7594 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7595 uint8_t hnd_type, SslDecryptSession *ssl)
7596{
7597 proto_tree *key_share_tree;
7598 uint32_t next_offset;
7599 uint32_t client_shares_length;
7600 uint32_t group;
7601 const char *group_name = NULL((void*)0);
7602
7603 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7604 return offset;
7605 }
7606
7607 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7608
7609 switch(hnd_type){
7610 case SSL_HND_CLIENT_HELLO:
7611 /* KeyShareEntry client_shares<0..2^16-1> */
7612 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7613 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7614 return offset_end;
7615 }
7616 offset += 2;
7617 next_offset = offset + client_shares_length;
7618 const char *sep = " ";
7619 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7620 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7621 if (group_name) {
7622 proto_item_append_text(tree, "%s%s", sep, group_name);
7623 sep = ", ";
7624 }
7625 }
7626 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
7627 return next_offset;
7628 }
7629 break;
7630 case SSL_HND_SERVER_HELLO:
7631 if (ssl) {
7632 ssl->has_key_share = true1;
7633 }
7634 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
7635 if (group_name) {
7636 proto_item_append_text(tree, " %s", group_name);
7637 }
7638 break;
7639 case SSL_HND_HELLO_RETRY_REQUEST:
7640 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7641 offset += 2;
7642 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7643 proto_item_append_text(tree, " %s", group_name);
7644 break;
7645 default: /* no default */
7646 break;
7647 }
7648
7649 return offset;
7650}
7651
7652static int
7653ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7654 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7655 uint8_t hnd_type, SslDecryptSession *ssl)
7656{
7657 /* RFC 8446 Section 4.2.11
7658 * struct {
7659 * opaque identity<1..2^16-1>;
7660 * uint32 obfuscated_ticket_age;
7661 * } PskIdentity;
7662 * opaque PskBinderEntry<32..255>;
7663 * struct {
7664 * select (Handshake.msg_type) {
7665 * case client_hello:
7666 * PskIdentity identities<7..2^16-1>;
7667 * PskBinderEntry binders<33..2^16-1>;
7668 * case server_hello:
7669 * uint16 selected_identity;
7670 * };
7671 * } PreSharedKeyExtension;
7672 */
7673
7674 proto_tree *psk_tree;
7675
7676 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
7677
7678 switch (hnd_type){
7679 case SSL_HND_CLIENT_HELLO: {
7680 uint32_t identities_length, identities_end, binders_length;
7681
7682 /* PskIdentity identities<7..2^16-1> */
7683 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
7684 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
7685 return offset_end;
7686 }
7687 offset += 2;
7688 identities_end = offset + identities_length;
7689
7690 while (offset < identities_end) {
7691 uint32_t identity_length;
7692 proto_tree *identity_tree;
7693
7694 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
7695
7696 /* opaque identity<1..2^16-1> */
7697 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
7698 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
7699 return identities_end;
7700 }
7701 offset += 2;
7702 proto_item_append_text(identity_tree, "length: %u)", identity_length);
7703
7704 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
7705 offset += identity_length;
7706
7707 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7708 offset += 4;
7709
7710 proto_item_set_len(identity_tree, 2 + identity_length + 4);
7711 }
7712 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
7713 offset = identities_end;
7714 }
7715
7716 /* PskBinderEntry binders<33..2^16-1> */
7717 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
7718 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
7719 return offset_end;
7720 }
7721 offset += 2;
7722
7723 proto_item *binders_item;
7724 proto_tree *binders_tree;
7725 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
7726 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
7727 uint32_t binders_end = offset + binders_length;
7728 while (offset < binders_end) {
7729 uint32_t binder_length;
7730 proto_item *binder_item;
7731 proto_tree *binder_tree;
7732
7733 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
7734 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
7735
7736 /* opaque PskBinderEntry<32..255>; */
7737 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
7738 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
7739 return binders_end;
7740 }
7741 offset += 1;
7742 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
7743
7744 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
7745 offset += binder_length;
7746
7747 proto_item_set_end(binder_item, tvb, offset);
7748 }
7749 }
7750 break;
7751 case SSL_HND_SERVER_HELLO: {
7752 if (ssl) {
7753 ssl_debug_printf("%s found pre_shared_key extension\n", G_STRFUNC((const char*) (__func__)));
7754 ssl->has_psk = true1;
7755 }
7756 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
7757 offset += 2;
7758 }
7759 break;
7760 default:
7761 break;
7762 }
7763
7764 return offset;
7765}
7766
7767static uint32_t
7768ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
7769 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
7770 uint8_t hnd_type, SslDecryptSession *ssl)
7771{
7772 /* RFC 8446 Section 4.2.10
7773 * struct {} Empty;
7774 * struct {
7775 * select (Handshake.msg_type) {
7776 * case new_session_ticket: uint32 max_early_data_size;
7777 * case client_hello: Empty;
7778 * case encrypted_extensions: Empty;
7779 * };
7780 * } EarlyDataIndication;
7781 */
7782 switch (hnd_type) {
7783 case SSL_HND_CLIENT_HELLO:
7784 /* Remember that early_data will follow the handshake. */
7785 if (ssl) {
7786 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
7787 ssl->has_early_data = true1;
7788 }
7789 break;
7790 case SSL_HND_NEWSESSION_TICKET:
7791 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7792 offset += 4;
7793 break;
7794 default:
7795 break;
7796 }
7797 return offset;
7798}
7799
7800static uint16_t
7801tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
7802{
7803 if (draft_version) {
7804 *draft_version = 0;
7805 }
7806 if (!is_dtls) {
7807 uint8_t tls13_draft = extract_tls13_draft_version(version);
7808 if (tls13_draft != 0) {
7809 /* This is TLS 1.3 (a draft version). */
7810 if (draft_version) {
7811 *draft_version = tls13_draft;
7812 }
7813 version = TLSV1DOT3_VERSION0x304;
7814 }
7815 if (version == 0xfb17 || version == 0xfb1a) {
7816 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
7817 tls13_draft = (uint8_t)version;
7818 if (draft_version) {
7819 *draft_version = tls13_draft;
7820 }
7821 version = TLSV1DOT3_VERSION0x304;
7822 }
7823 }
7824
7825 switch (version) {
7826 case SSLV3_VERSION0x300:
7827 case TLSV1_VERSION0x301:
7828 case TLSV1DOT1_VERSION0x302:
7829 case TLSV1DOT2_VERSION0x303:
7830 case TLSV1DOT3_VERSION0x304:
7831 case TLCPV1_VERSION0x101:
7832 if (is_dtls)
7833 return SSL_VER_UNKNOWN0;
7834 break;
7835
7836 case DTLSV1DOT0_VERSION0xfeff:
7837 case DTLSV1DOT0_OPENSSL_VERSION0x100:
7838 case DTLSV1DOT2_VERSION0xfefd:
7839 case DTLSV1DOT3_VERSION0xfefc:
7840 if (!is_dtls)
7841 return SSL_VER_UNKNOWN0;
7842 break;
7843
7844 default: /* invalid version number */
7845 return SSL_VER_UNKNOWN0;
7846 }
7847
7848 return version;
7849}
7850
7851static int
7852ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7853 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7854 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
7855{
7856
7857 /* RFC 8446 Section 4.2.1
7858 * struct {
7859 * ProtocolVersion versions<2..254>; // ClientHello
7860 * } SupportedVersions;
7861 * Note that ServerHello and HelloRetryRequest are handled by the caller.
7862 */
7863 uint32_t versions_length, next_offset;
7864 /* ProtocolVersion versions<2..254> */
7865 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
7866 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
7867 return offset_end;
7868 }
7869 offset++;
7870 next_offset = offset + versions_length;
7871
7872 unsigned version;
7873 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
7874 uint8_t draft_version, max_draft_version = 0;
7875 const char *sep = " ";
7876 while (offset + 2 <= next_offset) {
7877 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
7878 offset += 2;
7879
7880 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7881 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
7882 sep = ", ";
7883 }
7884
7885 current_version = tls_try_get_version(is_dtls, version, &draft_version);
7886 if (session->version == SSL_VER_UNKNOWN0) {
7887 if (lowest_version == SSL_VER_UNKNOWN0) {
7888 lowest_version = current_version;
7889 } else if (current_version != SSL_VER_UNKNOWN0) {
7890 if (!is_dtls) {
7891 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version));
7892 } else {
7893 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version));
7894 }
7895 }
7896 }
7897 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version));
7898 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))) {
7899 /* The DTLS version numbers get mapped to "00" for unknown per
7900 * JA4 spec, but if JA4 ever does support DTLS we'll probably
7901 * need to take the MIN instead of MAX here for DTLS.
7902 */
7903 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version));
7904 }
7905 }
7906 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
7907 col_set_str(pinfo->cinfo, COL_PROTOCOL,
7908 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
7909 }
7910 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
7911 offset = next_offset;
7912 }
7913
7914 /* XXX remove this when draft 19 support is dropped,
7915 * this is only required for early data decryption. */
7916 if (max_draft_version) {
7917 session->tls13_draft_version = max_draft_version;
7918 }
7919
7920 return offset;
7921}
7922
7923static int
7924ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7925 packet_info *pinfo, proto_tree *tree,
7926 uint32_t offset, uint32_t offset_end)
7927{
7928 /* RFC 8446 Section 4.2.2
7929 * struct {
7930 * opaque cookie<1..2^16-1>;
7931 * } Cookie;
7932 */
7933 uint32_t cookie_length;
7934 /* opaque cookie<1..2^16-1> */
7935 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
7936 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
7937 return offset_end;
7938 }
7939 offset += 2;
7940
7941 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
7942 offset += cookie_length;
7943
7944 return offset;
7945}
7946
7947static int
7948ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7949 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7950{
7951 /* RFC 8446 Section 4.2.9
7952 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
7953 *
7954 * struct {
7955 * PskKeyExchangeMode ke_modes<1..255>;
7956 * } PskKeyExchangeModes;
7957 */
7958 uint32_t ke_modes_length, next_offset;
7959
7960 /* PskKeyExchangeMode ke_modes<1..255> */
7961 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
7962 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
7963 return offset_end;
7964 }
7965 offset++;
7966 next_offset = offset + ke_modes_length;
7967
7968 while (offset < next_offset) {
7969 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
7970 offset++;
7971 }
7972
7973 return offset;
7974}
7975
7976static uint32_t
7977ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7978 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7979{
7980 /* RFC 8446 Section 4.2.4
7981 * opaque DistinguishedName<1..2^16-1>;
7982 * struct {
7983 * DistinguishedName authorities<3..2^16-1>;
7984 * } CertificateAuthoritiesExtension;
7985 */
7986 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
7987}
7988
7989static int
7990ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7991 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7992{
7993 /* RFC 8446 Section 4.2.5
7994 * struct {
7995 * opaque certificate_extension_oid<1..2^8-1>;
7996 * opaque certificate_extension_values<0..2^16-1>;
7997 * } OIDFilter;
7998 * struct {
7999 * OIDFilter filters<0..2^16-1>;
8000 * } OIDFilterExtension;
8001 */
8002 proto_tree *subtree;
8003 uint32_t filters_length, oid_length, values_length, value_offset;
8004 asn1_ctx_t asn1_ctx;
8005 const char *oid, *name;
8006
8007 /* OIDFilter filters<0..2^16-1> */
8008 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8009 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8010 return offset_end;
8011 }
8012 offset += 2;
8013 offset_end = offset + filters_length;
8014
8015 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8016
8017 while (offset < offset_end) {
8018 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8019 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8020
8021 /* opaque certificate_extension_oid<1..2^8-1> */
8022 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8023 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8024 return offset_end;
8025 }
8026 offset++;
8027 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8028 hf->hf.hs_ext_oid_filters_oid, &oid);
8029 offset += oid_length;
8030
8031 /* Append OID to tree label */
8032 name = oid_resolved_from_string(pinfo->pool, oid);
8033 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8034
8035 /* opaque certificate_extension_values<0..2^16-1> */
8036 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8037 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8038 return offset_end;
8039 }
8040 offset += 2;
8041 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8042 if (values_length > 0) {
8043 value_offset = offset;
8044 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8045 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8046 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8047 }
8048 offset += values_length;
8049 }
8050
8051 return offset;
8052}
8053
8054static int
8055ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8056 packet_info *pinfo, proto_tree *tree,
8057 uint32_t offset, uint32_t offset_end)
8058{
8059 /* https://tools.ietf.org/html/rfc6066#section-3
8060 *
8061 * struct {
8062 * NameType name_type;
8063 * select (name_type) {
8064 * case host_name: HostName;
8065 * } name;
8066 * } ServerName;
8067 *
8068 * enum {
8069 * host_name(0), (255)
8070 * } NameType;
8071 *
8072 * opaque HostName<1..2^16-1>;
8073 *
8074 * struct {
8075 * ServerName server_name_list<1..2^16-1>
8076 * } ServerNameList;
8077 */
8078 proto_tree *server_name_tree;
8079 uint32_t list_length, server_name_length, next_offset;
8080
8081 /* The server SHALL include "server_name" extension with empty data. */
8082 if (offset == offset_end) {
8083 return offset;
8084 }
8085
8086 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8087
8088 /* ServerName server_name_list<1..2^16-1> */
8089 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8090 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8091 return offset_end;
8092 }
8093 offset += 2;
8094 next_offset = offset + list_length;
8095
8096 while (offset < next_offset) {
8097 uint32_t name_type;
8098 const char *server_name = NULL((void*)0);
8099 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8100 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8101 offset++;
8102
8103 /* opaque HostName<1..2^16-1> */
8104 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8105 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8106 return next_offset;
8107 }
8108 offset += 2;
8109
8110 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8111 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8112 pinfo->pool, (const uint8_t**)&server_name);
8113 offset += server_name_length;
8114 // Each type must only occur once, so we don't check for duplicates.
8115 if (name_type == 0) {
8116 proto_item_append_text(tree, " name=%s", server_name);
8117 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8118
8119 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8120 // Client Hello: Client (Src) -> Server (Dst)
8121 switch (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->type) {
8122 case AT_IPv4:
8123 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(uint32_t)) {
8124 add_ipv4_name(*(uint32_t *)PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
8125 }
8126 break;
8127 case AT_IPv6:
8128 if (PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->len == sizeof(ws_in6_addr)) {
8129 add_ipv6_name(PINFO_DST(pinfo)((pinfo)->use_conv_addr_port_endpoints ? conversation_addr_port_endpoints_addr2
((pinfo)->conv_addr_port_endpoints) : &((pinfo)->dst
))->data, server_name, false0);
8130 }
8131 break;
8132 }
8133 }
8134 }
8135 }
8136 return offset;
8137}
8138
8139static int
8140ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8141 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8142{
8143 unsigned ext_len = offset_end - offset;
8144 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8145 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8146 /* Save the Session Ticket such that it can be used as identifier for
8147 * restoring a previous Master Secret (in ChangeCipherSpec) */
8148 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8149 ssl->session_ticket.data, ext_len);
8150 ssl->session_ticket.data_len = ext_len;
8151 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8152 }
8153 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8154 tvb, offset, ext_len, ENC_NA0x00000000);
8155 return offset + ext_len;
8156}
8157
8158static int
8159ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8160 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8161 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8162{
8163 uint8_t cert_list_length;
8164 uint8_t cert_type;
8165 proto_tree *cert_list_tree;
8166 proto_item *ti;
8167
8168 switch(hnd_type){
8169 case SSL_HND_CLIENT_HELLO:
8170 cert_list_length = tvb_get_uint8(tvb, offset);
8171 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8172 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8173 offset += 1;
8174 if (offset_end - offset != (uint32_t)cert_list_length)
8175 return offset;
8176
8177 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8178 cert_list_length, cert_list_length);
8179 proto_item_append_text(ti, " (%d)", cert_list_length);
8180
8181 /* make this a subtree */
8182 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8183
8184 /* loop over all point formats */
8185 while (cert_list_length > 0)
8186 {
8187 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8188 offset++;
8189 cert_list_length--;
8190 }
8191 break;
8192 case SSL_HND_SERVER_HELLO:
8193 case SSL_HND_ENCRYPTED_EXTENSIONS:
8194 case SSL_HND_CERTIFICATE:
8195 cert_type = tvb_get_uint8(tvb, offset);
8196 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8197 offset += 1;
8198 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8199 session->client_cert_type = cert_type;
8200 }
8201 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8202 session->server_cert_type = cert_type;
8203 }
8204 break;
8205 default: /* no default */
8206 break;
8207 }
8208
8209 return offset;
8210}
8211
8212static uint32_t
8213ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8214 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8215 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8216{
8217 uint32_t compress_certificate_algorithms_length, next_offset;
8218
8219 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8220 * enum {
8221 * zlib(1),
8222 * brotli(2),
8223 * (65535)
8224 * } CertificateCompressionAlgorithm;
8225 *
8226 * struct {
8227 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8228 * } CertificateCompressionAlgorithms;
8229 */
8230 switch (hnd_type) {
8231 case SSL_HND_CLIENT_HELLO:
8232 case SSL_HND_CERT_REQUEST:
8233 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8234 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8235 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8236 return offset_end;
8237 }
8238 offset += 1;
8239 next_offset = offset + compress_certificate_algorithms_length;
8240
8241 while (offset < next_offset) {
8242 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8243 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8244 offset += 2;
8245 }
8246 break;
8247 default:
8248 break;
8249 }
8250
8251 return offset;
8252}
8253
8254static uint32_t
8255ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8256 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8257 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8258{
8259 uint32_t key_parameters_length, next_offset;
8260 proto_item *p_ti;
8261 proto_tree *p_tree;
8262
8263 /* RFC 8472
8264 *
8265 * struct {
8266 * uint8 major;
8267 * uint8 minor;
8268 * } TB_ProtocolVersion;
8269 *
8270 * enum {
8271 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8272 * } TokenBindingKeyParameters;
8273 *
8274 * struct {
8275 * TB_ProtocolVersion token_binding_version;
8276 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8277 * } TokenBindingParameters;
8278 */
8279
8280 switch (hnd_type) {
8281 case SSL_HND_CLIENT_HELLO:
8282 case SSL_HND_SERVER_HELLO:
8283 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8284 offset += 1;
8285 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8286 offset += 1;
8287
8288 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8289 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8290 return offset_end;
8291 }
8292 offset += 1;
8293 next_offset = offset + key_parameters_length;
8294
8295 p_ti = proto_tree_add_none_format(tree,
8296 hf->hf.hs_ext_token_binding_key_parameters,
8297 tvb, offset, key_parameters_length,
8298 "Key parameters identifiers (%d identifier%s)",
8299 key_parameters_length,
8300 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8301 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8302
8303 while (offset < next_offset) {
8304 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8305 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8306 offset += 1;
8307 }
8308
8309 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8310 offset = next_offset;
8311 }
8312
8313 break;
8314 default:
8315 break;
8316 }
8317
8318 return offset;
8319}
8320
8321static uint32_t
8322ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8323 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8324 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8325{
8326 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8327 uint32_t next_offset;
8328
8329 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8330 *
8331 * Note: the following structures are not literally defined in the spec,
8332 * they instead use an ASCII diagram.
8333 *
8334 * struct {
8335 * uint16 id;
8336 * opaque value<0..2^16-1>;
8337 * } TransportParameter; // before draft -27
8338 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8339 *
8340 * struct {
8341 * opaque ipv4Address[4];
8342 * uint16 ipv4Port;
8343 * opaque ipv6Address[16];
8344 * uint16 ipv6Port;
8345 * opaque connectionId<0..18>;
8346 * opaque statelessResetToken[16];
8347 * } PreferredAddress;
8348 */
8349
8350 if (offset_end - offset >= 6 &&
8351 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8352 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8353 // Assume encoding of Transport Parameters draft -26 or older with at
8354 // least one transport parameter that has a valid length.
8355 use_varint_encoding = false0;
8356 }
8357
8358 if (use_varint_encoding) {
8359 next_offset = offset_end;
8360 } else {
8361 uint32_t quic_length;
8362 // Assume draft -26 or earlier.
8363 /* TransportParameter TransportParameters<0..2^16-1>; */
8364 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8365 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8366 return offset_end;
8367 }
8368 offset += 2;
8369 next_offset = offset + quic_length;
8370 }
8371
8372 while (offset < next_offset) {
8373 uint64_t parameter_type; /* 62-bit space */
8374 uint32_t parameter_length;
8375 proto_tree *parameter_tree;
8376 uint32_t parameter_end_offset;
8377 uint64_t value;
8378 uint32_t i;
8379 unsigned len = 0;
8380
8381 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8382 NULL((void*)0), "Parameter");
8383 /* TransportParameter ID and Length. */
8384 if (use_varint_encoding) {
8385 uint64_t parameter_length64;
8386 unsigned type_len = 0;
8387
8388 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8389 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8390 offset += type_len;
8391
8392 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8393 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8394 parameter_length = (uint32_t)parameter_length64;
8395 offset += len;
8396
8397 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8398 } else {
8399 parameter_type = tvb_get_ntohs(tvb, offset);
8400 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8401 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8402 offset += 2;
8403
8404 /* opaque value<0..2^16-1> */
8405 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8406 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8407 return next_offset;
8408 }
8409 offset += 2;
8410
8411 proto_item_set_len(parameter_tree, 4 + parameter_length);
8412 }
8413
8414 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)) {
8415 proto_item_append_text(parameter_tree, ": GREASE");
8416 } else {
8417 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8418 }
8419
8420 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8421 parameter_end_offset = offset + parameter_length;
8422
8423 /* Omit the value field if the parameter's length is 0. */
8424 if (parameter_length != 0) {
8425 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8426 tvb, offset, parameter_length, ENC_NA0x00000000);
8427 }
8428
8429 switch (parameter_type) {
8430 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8431 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8432 tvb, offset, parameter_length, ENC_NA0x00000000);
8433 offset += parameter_length;
8434 break;
8435 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8436 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8437 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8438 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8439 offset += len;
8440 break;
8441 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8442 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8443 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8444 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8445 offset += 16;
8446 break;
8447 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8448 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8449 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8450 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8451 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8452 offset += len;
8453 break;
8454 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8455 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8456 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8457 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8458 offset += len;
8459 break;
8460 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8461 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8462 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8463 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8464 offset += len;
8465 break;
8466 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8467 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8468 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8469 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8470 offset += len;
8471 break;
8472 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8473 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8474 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8475 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8476 offset += len;
8477 break;
8478 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8479 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8480 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8481 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8482 offset += len;
8483 break;
8484 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8485 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8486 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8487 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8488 offset += len;
8489 break;
8490 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8491 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8492 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8493 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8494 offset += len;
8495 break;
8496 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8497 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8498 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8499 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8500 offset += len;
8501 break;
8502 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8503 /* No Payload */
8504 break;
8505 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8506 uint32_t connectionid_length;
8507 quic_cid_t cid;
8508
8509 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8510 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8511 offset += 4;
8512 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8513 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8514 offset += 2;
8515 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8516 tvb, offset, 16, ENC_NA0x00000000);
8517 offset += 16;
8518 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8519 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8520 offset += 2;
8521 /* XXX - Should we add these addresses and ports as addresses that the client
8522 * is allowed / expected to migrate the server address to? Right now we don't
8523 * enforce that (see RFC 9000 Section 9, which implies that while the client
8524 * can migrate to whatever address it wants, it can only migrate the server
8525 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8526 */
8527
8528 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8529 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8530 break;
8531 }
8532 offset += 1;
8533
8534 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8535 tvb, offset, connectionid_length, ENC_NA0x00000000);
8536 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8537 cid.len = connectionid_length;
8538 // RFC 9000 5.1.1 "If the preferred_address transport
8539 // parameter is sent, the sequence number of the supplied
8540 // connection ID is 1."
8541 cid.seq_num = 1;
8542 // Multipath draft-07 "Also, the Path Identifier for the
8543 // connection ID specified in the "preferred address"
8544 // transport parameter is 0."
8545 cid.path_id = 0;
8546 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8547 quic_add_connection(pinfo, &cid);
8548 }
8549 offset += connectionid_length;
8550
8551 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8552 tvb, offset, 16, ENC_NA0x00000000);
8553 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8554 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8555 }
8556 offset += 16;
8557 }
8558 break;
8559 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8560 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8561 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8562 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8563 offset += len;
8564 break;
8565 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8566 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8567 tvb, offset, parameter_length, ENC_NA0x00000000);
8568 offset += parameter_length;
8569 break;
8570 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8571 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8572 tvb, offset, parameter_length, ENC_NA0x00000000);
8573 offset += parameter_length;
8574 break;
8575 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8576 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8577 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8578 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8579 offset += len;
8580 break;
8581 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8582 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8583 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8584 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8585 offset += len;
8586 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8587 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8588 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8589 offset += len;
8590 break;
8591 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8592 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8593 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8594 if (len > 0) {
8595 quic_add_loss_bits(pinfo, value);
8596 }
8597 offset += 1;
8598 break;
8599 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8600 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8601 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8602 offset += len;
8603 break;
8604 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8605 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8606 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8607 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8608 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8609 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8610 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8611 offset += len;
8612 break;
8613 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8614 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8615 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8616 offset += parameter_length;
8617 break;
8618 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8619 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8620 tvb, offset, parameter_length, ENC_NA0x00000000);
8621 offset += parameter_length;
8622 break;
8623 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8624 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8625 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8626 offset += 4;
8627 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8628 uint32_t versions_length;
8629
8630 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8631 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8632 offset += 1;
8633 for (i = 0; i < versions_length / 4; i++) {
8634 quic_proto_tree_add_version(tvb, parameter_tree,
8635 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
8636 offset += 4;
8637 }
8638 }
8639 break;
8640 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
8641 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
8642 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8643 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
8644 offset += len;
8645 break;
8646 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
8647 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
8648 tvb, offset, parameter_length, ENC_NA0x00000000);
8649 offset += parameter_length;
8650 break;
8651 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
8652 /* This field was used for non-standard Google-specific parameters encoded as a
8653 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
8654 * parameters. Report it as a bytes blob... */
8655 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
8656 tvb, offset, parameter_length, ENC_NA0x00000000);
8657 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
8658 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
8659 tvb, offset, 4, ENC_NA0x00000000);
8660 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
8661 offset += parameter_length;
8662 break;
8663 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
8664 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
8665 tvb, offset, parameter_length, ENC_NA0x00000000);
8666 offset += parameter_length;
8667 break;
8668 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
8669 /* No Payload */
8670 break;
8671 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
8672 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
8673 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8674 offset += parameter_length;
8675 break;
8676 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
8677 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
8678 quic_proto_tree_add_version(tvb, parameter_tree,
8679 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
8680 offset += 4;
8681 for (i = 4; i < parameter_length; i += 4) {
8682 quic_proto_tree_add_version(tvb, parameter_tree,
8683 hf->hf.hs_ext_quictp_parameter_other_version, offset);
8684 offset += 4;
8685 }
8686 break;
8687 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
8688 /* No Payload */
8689 quic_add_grease_quic_bit(pinfo);
8690 break;
8691 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
8692 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
8693 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8694 offset += parameter_length;
8695 break;
8696 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
8697 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
8698 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8699 if (value == 1) {
8700 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8701 }
8702 offset += parameter_length;
8703 break;
8704 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
8705 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
8706 /* No Payload */
8707 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
8708 break;
8709 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
8710 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
8711 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8712 if (value > 1) {
8713 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8714 }
8715 /* multipath draft-07: "The value of the initial_max_paths
8716 * parameter MUST be at least 2." TODO: Expert Info? */
8717 offset += parameter_length;
8718 break;
8719 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
8720 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
8721 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
8722 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT130x0f739bbc1b666d0d:
8723 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x3e:
8724 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
8725 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8726 /* multipath draft-09 and later: "If an endpoint receives an
8727 * initial_max_path_id transport parameter with value 0, the
8728 * peer aims to enable the multipath extension without allowing
8729 * extra paths immediately."
8730 */
8731 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
8732 offset += parameter_length;
8733 break;
8734 default:
8735 offset += parameter_length;
8736 /*TODO display expert info about unknown ? */
8737 break;
8738 }
8739
8740 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
8741 /* Dissection did not end at expected location, fix it. */
8742 offset = parameter_end_offset;
8743 }
8744 }
8745
8746 return offset;
8747}
8748
8749typedef struct tls_ech_confirm {
8750 tvbuff_t *confirm_tvb;
8751 proto_item *parent_item;
8752} tls_ech_confirm_t;
8753
8754static int
8755ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8756 proto_tree *tree, uint32_t offset,
8757 SslSession *session, SslDecryptSession *ssl,
8758 bool_Bool from_server, bool_Bool is_hrr)
8759{
8760 uint8_t sessid_length;
8761 proto_tree *rnd_tree;
8762 proto_tree *ti_rnd;
8763 uint8_t draft_version = session->tls13_draft_version;
8764
8765 if (ssl) {
8766 StringInfo *rnd;
8767 if (from_server)
8768 rnd = &ssl->server_random;
8769 else
8770 rnd = &ssl->client_random;
8771
8772 /* save provided random for later keyring generation */
8773 tvb_memcpy(tvb, rnd->data, offset, 32);
8774 rnd->data_len = 32;
8775 if (from_server)
8776 ssl->state |= SSL_SERVER_RANDOM(1<<1);
8777 else
8778 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
8779 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
8780 from_server ? "SERVER" : "CLIENT", ssl->state);
8781
8782 if (is_hrr) {
8783 ssl->state |= SSL_HELLO_RETRY_REQUEST(1<<14);
8784 }
8785 }
8786
8787 if (!from_server && session->client_random.data_len == 0) {
8788 session->client_random.data_len = 32;
8789 tvb_memcpy(tvb, session->client_random.data, offset, 32);
8790 }
8791
8792 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
8793
8794 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
8795
8796 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
8797 /* show the time */
8798 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
8799 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
8800 offset += 4;
8801
8802 /* show the random bytes */
8803 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
8804 tvb, offset, 28, ENC_NA0x00000000);
8805 offset += 28;
8806 } else {
8807 if (is_hrr) {
8808 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
8809 } else if (from_server && (session->ech || (ssl && !tls_transcript_is_empty(&ssl->ech_transcript)))) {
8810 /* We can't calculate the transcript hash until we have the Cipher
8811 * Suite, which comes later, so save this so we can show it in the
8812 * tree on the first pass. */
8813 tls_ech_confirm_t *ech_confirm = wmem_new(pinfo->pool, tls_ech_confirm_t)((tls_ech_confirm_t*)wmem_alloc((pinfo->pool), sizeof(tls_ech_confirm_t
)));
8814 ech_confirm->parent_item = ti_rnd;
8815 ech_confirm->confirm_tvb = tvb_new_subset_length(tvb, offset + 24, 8);
8816 /* We can use a hf id instead of a proto id (they're allocated from
8817 * the same pool and the latter are just a subset of the former),
8818 * which is convenient as we don't seem to store the proto id (TLS v
8819 * DTLS) in ssl_common_dissect_t or anywhere else. Arguably it
8820 * relies on undocumented behavior, though using it as the key too
8821 * means that the chance of collision is ~zero even if behavior
8822 * changes.
8823 */
8824 p_add_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm, ech_confirm);
8825 }
8826
8827 offset += 32;
8828 }
8829
8830 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
8831 if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
8832 /* show the session id (length followed by actual Session ID) */
8833 sessid_length = tvb_get_uint8(tvb, offset);
8834 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
8835 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8836 offset++;
8837
8838 if (ssl) {
8839 /* save the authoritative SID for later use in ChangeCipherSpec.
8840 * (D)TLS restricts the SID to 32 chars, it does not make sense to
8841 * save more, so ignore larger ones. To support ECH, also save
8842 * the SID from the ClientHelloOuter. */
8843 if (sessid_length <= 32 && (from_server || sessid_length > 0)) {
8844 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
8845 ssl->session_id.data_len = sessid_length;
8846 }
8847 }
8848 if (sessid_length > 0) {
8849 proto_tree_add_item(tree, hf->hf.hs_session_id,
8850 tvb, offset, sessid_length, ENC_NA0x00000000);
8851 offset += sessid_length;
8852 }
8853 }
8854
8855 return offset;
8856}
8857
8858static int
8859ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8860 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8861 bool_Bool has_length)
8862{
8863 /* TLS 1.2/1.3 status_request Client Hello Extension.
8864 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
8865 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
8866 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
8867 * struct {
8868 * CertificateStatusType status_type;
8869 * uint16 request_length; // for status_request_v2
8870 * select (status_type) {
8871 * case ocsp: OCSPStatusRequest;
8872 * case ocsp_multi: OCSPStatusRequest;
8873 * } request;
8874 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
8875 *
8876 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
8877 * struct {
8878 * ResponderID responder_id_list<0..2^16-1>;
8879 * Extensions request_extensions;
8880 * } OCSPStatusRequest;
8881 * opaque ResponderID<1..2^16-1>;
8882 * opaque Extensions<0..2^16-1>;
8883 */
8884 unsigned cert_status_type;
8885
8886 cert_status_type = tvb_get_uint8(tvb, offset);
8887 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
8888 tvb, offset, 1, ENC_NA0x00000000);
8889 offset++;
8890
8891 if (has_length) {
8892 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
8893 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8894 offset += 2;
8895 }
8896
8897 switch (cert_status_type) {
8898 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
8899 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
8900 {
8901 uint32_t responder_id_list_len;
8902 uint32_t request_extensions_len;
8903
8904 /* ResponderID responder_id_list<0..2^16-1> */
8905 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
8906 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
8907 return offset_end;
8908 }
8909 offset += 2;
8910 if (responder_id_list_len != 0) {
8911 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8912 tvb, offset, responder_id_list_len,
8913 "Responder ID list is not implemented, contact Wireshark"
8914 " developers if you want this to be supported");
8915 }
8916 offset += responder_id_list_len;
8917
8918 /* opaque Extensions<0..2^16-1> */
8919 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
8920 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
8921 return offset_end;
8922 }
8923 offset += 2;
8924 if (request_extensions_len != 0) {
8925 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
8926 tvb, offset, request_extensions_len,
8927 "Request Extensions are not implemented, contact"
8928 " Wireshark developers if you want this to be supported");
8929 }
8930 offset += request_extensions_len;
8931 break;
8932 }
8933 }
8934
8935 return offset;
8936}
8937
8938static unsigned
8939ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8940 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8941{
8942 /* https://tools.ietf.org/html/rfc6961#section-2.2
8943 * struct {
8944 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
8945 * } CertificateStatusRequestListV2;
8946 */
8947 uint32_t req_list_length, next_offset;
8948
8949 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
8950 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
8951 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
8952 return offset_end;
8953 }
8954 offset += 2;
8955 next_offset = offset + req_list_length;
8956
8957 while (offset < next_offset) {
8958 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
8959 }
8960
8961 return offset;
8962}
8963
8964static uint32_t
8965tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
8966 uint32_t offset, uint32_t offset_end)
8967{
8968 uint32_t response_length;
8969 proto_item *ocsp_resp;
8970 proto_tree *ocsp_resp_tree;
8971 asn1_ctx_t asn1_ctx;
8972
8973 /* opaque OCSPResponse<1..2^24-1>; */
8974 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
8975 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
8976 return offset_end;
8977 }
8978 offset += 3;
8979
8980 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
8981 response_length, ENC_BIG_ENDIAN0x00000000);
8982 proto_item_set_text(ocsp_resp, "OCSP Response");
8983 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
8984 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
8985 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8986 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
8987 }
8988 offset += response_length;
8989
8990 return offset;
8991}
8992
8993uint32_t
8994tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8995 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8996{
8997 /* TLS 1.2 "CertificateStatus" handshake message.
8998 * TLS 1.3 "status_request" Certificate extension.
8999 * struct {
9000 * CertificateStatusType status_type;
9001 * select (status_type) {
9002 * case ocsp: OCSPResponse;
9003 * case ocsp_multi: OCSPResponseList; // status_request_v2
9004 * } response;
9005 * } CertificateStatus;
9006 * opaque OCSPResponse<1..2^24-1>;
9007 * struct {
9008 * OCSPResponse ocsp_response_list<1..2^24-1>;
9009 * } OCSPResponseList; // status_request_v2
9010 */
9011 uint32_t status_type, resp_list_length, next_offset;
9012
9013 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9014 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9015 offset += 1;
9016
9017 switch (status_type) {
9018 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9019 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9020 break;
9021
9022 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9023 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9024 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9025 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9026 return offset_end;
9027 }
9028 offset += 3;
9029 next_offset = offset + resp_list_length;
9030
9031 while (offset < next_offset) {
9032 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9033 }
9034 break;
9035 }
9036
9037 return offset;
9038}
9039
9040static unsigned
9041ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9042 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9043 wmem_strbuf_t *ja3)
9044{
9045 /* RFC 8446 Section 4.2.7
9046 * enum { ..., (0xFFFF) } NamedGroup;
9047 * struct {
9048 * NamedGroup named_group_list<2..2^16-1>
9049 * } NamedGroupList;
9050 *
9051 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9052 * the extension itself from "elliptic_curves" to "supported_groups".
9053 */
9054 uint32_t groups_length, next_offset;
9055 proto_tree *groups_tree;
9056 proto_item *ti;
9057 char *ja3_dash = "";
9058
9059 /* NamedGroup named_group_list<2..2^16-1> */
9060 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9061 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9062 return offset_end;
9063 }
9064 offset += 2;
9065 next_offset = offset + groups_length;
9066
9067 ti = proto_tree_add_none_format(tree,
9068 hf->hf.hs_ext_supported_groups,
9069 tvb, offset, groups_length,
9070 "Supported Groups (%d group%s)",
9071 groups_length / 2,
9072 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9073
9074 /* make this a subtree */
9075 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9076
9077 if (ja3) {
9078 wmem_strbuf_append_c(ja3, ',');
9079 }
9080 /* loop over all groups */
9081 while (offset + 2 <= offset_end) {
9082 uint32_t ext_supported_group;
9083
9084 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9085 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9086 offset += 2;
9087 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))) {
9088 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9089 ja3_dash = "-";
9090 }
9091 }
9092 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9093 offset = next_offset;
9094 }
9095
9096 return offset;
9097}
9098
9099static int
9100ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9101 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9102{
9103 uint8_t ecpf_length;
9104 proto_tree *ecpf_tree;
9105 proto_item *ti;
9106
9107 ecpf_length = tvb_get_uint8(tvb, offset);
9108 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9109 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9110
9111 offset += 1;
9112 ti = proto_tree_add_none_format(tree,
9113 hf->hf.hs_ext_ec_point_formats,
9114 tvb, offset, ecpf_length,
9115 "Elliptic curves point formats (%d)",
9116 ecpf_length);
9117
9118 /* make this a subtree */
9119 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9120
9121 if (ja3) {
9122 wmem_strbuf_append_c(ja3, ',');
9123 }
9124
9125 /* loop over all point formats */
9126 while (ecpf_length > 0)
9127 {
9128 uint32_t ext_ec_point_format;
9129
9130 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9131 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9132 offset++;
9133 ecpf_length--;
9134 if (ja3) {
9135 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9136 if (ecpf_length > 0) {
9137 wmem_strbuf_append_c(ja3, '-');
9138 }
9139 }
9140 }
9141
9142 return offset;
9143}
9144
9145static int
9146ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9147 packet_info *pinfo, proto_tree *tree,
9148 uint32_t offset, uint32_t next_offset)
9149{
9150 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9151 * opaque srp_I<1..2^8-1>;
9152 */
9153 uint32_t username_len;
9154
9155 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9156 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9157 return next_offset;
9158 }
9159 offset++;
9160
9161 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9162 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9163 offset += username_len;
9164
9165 return offset;
9166}
9167
9168static uint32_t
9169tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9170 uint32_t offset, uint32_t offset_end, uint16_t version)
9171{
9172 /* https://tools.ietf.org/html/rfc6962#section-3.2
9173 * enum { v1(0), (255) } Version;
9174 * struct {
9175 * opaque key_id[32];
9176 * } LogID;
9177 * opaque CtExtensions<0..2^16-1>;
9178 * struct {
9179 * Version sct_version;
9180 * LogID id;
9181 * uint64 timestamp;
9182 * CtExtensions extensions;
9183 * digitally-signed struct { ... };
9184 * } SignedCertificateTimestamp;
9185 */
9186 uint32_t sct_version;
9187 uint64_t sct_timestamp_ms;
9188 nstime_t sct_timestamp;
9189 uint32_t exts_len;
9190 const char *log_name;
9191
9192 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9193 offset++;
9194 if (sct_version != 0) {
9195 // TODO expert info about unknown SCT version?
9196 return offset;
9197 }
9198 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9199 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9200 proto_item_append_text(tree, " (%s)", log_name);
9201 offset += 32;
9202 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9203 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9204 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9205 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9206 offset += 8;
9207 /* opaque CtExtensions<0..2^16-1> */
9208 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9209 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9210 return offset_end;
9211 }
9212 offset += 2;
9213 if (exts_len > 0) {
9214 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9215 offset += exts_len;
9216 }
9217 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9218 hf->hf.sct_sct_signature_length,
9219 hf->hf.sct_sct_signature);
9220 return offset;
9221}
9222
9223uint32_t
9224tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9225 uint32_t offset, uint32_t offset_end, uint16_t version)
9226{
9227 /* https://tools.ietf.org/html/rfc6962#section-3.3
9228 * opaque SerializedSCT<1..2^16-1>;
9229 * struct {
9230 * SerializedSCT sct_list <1..2^16-1>;
9231 * } SignedCertificateTimestampList;
9232 */
9233 uint32_t list_length, sct_length, next_offset;
9234 proto_tree *subtree;
9235
9236 /* SerializedSCT sct_list <1..2^16-1> */
9237 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9238 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9239 return offset_end;
9240 }
9241 offset += 2;
9242
9243 while (offset < offset_end) {
9244 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9245
9246 /* opaque SerializedSCT<1..2^16-1> */
9247 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9248 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9249 return offset_end;
9250 }
9251 offset += 2;
9252 next_offset = offset + sct_length;
9253 proto_item_set_len(subtree, 2 + sct_length);
9254 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9255 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9256 offset = next_offset;
9257 }
9258 }
9259
9260 return offset;
9261}
9262
9263static int
9264dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9265 proto_tree *tree, uint32_t offset)
9266{
9267 uint32_t kdf_id, aead_id;
9268 proto_item *cs_ti;
9269 proto_tree *cs_tree;
9270
9271 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9272 tvb, offset, 4, ENC_NA0x00000000);
9273 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9274
9275 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9276 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9277 offset += 2;
9278 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9279 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9280 offset += 2;
9281
9282 proto_item_append_text(cs_ti, ": %s/%s",
9283 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9284 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9285 return offset;
9286}
9287
9288static int
9289dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9290 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9291 uint32_t *config_id)
9292{
9293 uint32_t length, cipher_suite_length;
9294 proto_item *kc_ti, *css_ti;
9295 proto_tree *kc_tree, *css_tree;
9296 uint32_t original_offset = offset, next_offset;
9297
9298 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9299 tvb, offset, -1, ENC_NA0x00000000);
9300 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9301
9302 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9303 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9304 offset += 1;
9305 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9306 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9307 offset += 2;
9308 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9309 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9310 offset += 2;
9311 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9312 tvb, offset, length, ENC_NA0x00000000);
9313 offset += length;
9314
9315 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9316 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9317 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9318 return offset_end;
9319 }
9320 offset += 2;
9321 next_offset = offset + cipher_suite_length;
9322
9323 css_ti = proto_tree_add_none_format(kc_tree,
9324 hf->hf.ech_hpke_keyconfig_cipher_suites,
9325 tvb, offset, cipher_suite_length,
9326 "Cipher Suites (%d suite%s)",
9327 cipher_suite_length / 4,
9328 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9329 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9330
9331
9332 while (offset + 4 <= next_offset) {
9333 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9334 }
9335
9336 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9337 offset = next_offset;
9338 }
9339
9340 proto_item_set_len(kc_ti, offset - original_offset);
9341
9342 return offset;
9343}
9344
9345static int
9346dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9347 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9348 const uint8_t **public_name, uint32_t *config_id)
9349{
9350 uint32_t public_name_length, extensions_length, next_offset;
9351
9352 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9353 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9354 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9355 offset += 1;
9356 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9357 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9358 offset += 1;
9359 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9360 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9361 offset += public_name_length;
9362
9363 /* Extension extensions<0..2^16-1>; */
9364 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9365 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9366 return offset_end;
9367 }
9368 offset += 2;
9369 next_offset = offset + extensions_length;
9370
9371 if (extensions_length > 0) {
9372 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9373 tvb, offset, extensions_length, ENC_NA0x00000000);
9374 }
9375 offset += extensions_length;
9376
9377 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9378 offset = next_offset;
9379 }
9380
9381 return offset;
9382}
9383
9384static int
9385dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9386 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9387{
9388 uint32_t version, length;
9389 proto_item *ech_ti;
9390 proto_tree *ech_tree;
9391 const uint8_t *public_name = NULL((void*)0);
9392 uint32_t config_id = 0;
9393
9394 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9395 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9396
9397 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9398 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9399 offset += 2;
9400 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9401 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9402 offset += 2;
9403
9404 proto_item_set_len(ech_ti, 4 + length);
9405
9406 switch(version) {
9407 case 0xfe0d:
9408 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9409 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9410 break;
9411
9412 default:
9413 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9414 }
9415
9416 return 4 + length;
9417}
9418
9419uint32_t
9420ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9421 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9422{
9423 uint32_t echconfiglist_length, next_offset;
9424
9425 /* ECHConfig ECHConfigList<1..2^16-1>; */
9426 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9427 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9428 return offset_end;
9429 }
9430 offset += 2;
9431 next_offset = offset + echconfiglist_length;
9432
9433 while (offset < next_offset) {
9434 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9435 }
9436
9437 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9438 offset = next_offset;
9439 }
9440
9441 return offset;
9442}
9443
9444static uint32_t
9445ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9446 uint32_t offset, uint32_t offset_end)
9447{
9448 uint32_t ext_length, next_offset;
9449 proto_tree *ext_tree;
9450 proto_item *ti;
9451
9452 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9453 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9454 return offset_end;
9455 }
9456 offset += 1;
9457 next_offset = offset + ext_length;
9458
9459 ti = proto_tree_add_none_format(tree,
9460 hf->hf.hs_ext_ech_outer_ext,
9461 tvb, offset, ext_length,
9462 "Outer Extensions (%d extension%s)",
9463 ext_length / 2,
9464 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9465
9466 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9467
9468 while (offset + 2 <= offset_end) {
9469 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9470 offset += 2;
9471 }
9472
9473 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9474 offset = next_offset;
9475 }
9476
9477 return offset;
9478}
9479
9480static uint32_t
9481// NOLINTNEXTLINE(misc-no-recursion)
9482ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9483 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9484 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
9485{
9486 uint32_t ch_type, length;
9487 proto_item *ti, *payload_ti;
9488 proto_tree *retry_tree, *payload_tree;
9489 uint32_t hello_length = tvb_reported_length(tvb);
9490
9491 switch (hnd_type) {
9492 case SSL_HND_CLIENT_HELLO:
9493 /*
9494 * enum { outer(0), inner(1) } ECHClientHelloType;
9495 *
9496 * struct {
9497 * ECHClientHelloType type;
9498 * select (ECHClientHello.type) {
9499 * case outer:
9500 * HpkeSymmetricCipherSuite cipher_suite;
9501 * uint8 config_id;
9502 * opaque enc<0..2^16-1>;
9503 * opaque payload<1..2^16-1>;
9504 * case inner:
9505 * Empty;
9506 * };
9507 * } ECHClientHello;
9508 */
9509
9510 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9511 offset += 1;
9512 switch (ch_type) {
9513 case 0: /* outer */
9514 if (ssl && session->first_ch_ech_frame == 0) {
9515 session->first_ch_ech_frame = pinfo->num;
9516 }
9517 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9518 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9519 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9520
9521 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9522 uint8_t config_id = tvb_get_uint8(tvb, offset);
9523 offset += 1;
9524 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9525 offset += 2;
9526 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9527 offset += length;
9528 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9529 offset += 2;
9530 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9531 offset += length;
9532
9533 /* XXX - We could save the decrypted Client Hello instead of
9534 * recalculating it every pass, similar to what is done with
9535 * normal encrypted records. Normally there shouldn't be many
9536 * ECH so it doesn't make much difference either way. */
9537 if (!mk_map) {
9538 break;
9539 }
9540 if (session->client_random.data_len == 0) {
9541 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9542 break;
9543 }
9544 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9545 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9546 if (!ech_secret || !ech_config) {
9547 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9548 G_STRFUNC((const char*) (__func__)));
9549 break;
9550 }
9551
9552 if (hpke_hkdf_len(kdf_id) == 0) {
9553 ssl_debug_printf("Unsupported KDF\n");
9554 break;
9555 }
9556
9557 if (hpke_aead_key_len(aead_id) == 0) {
9558 ssl_debug_printf("Unsupported AEAD\n");
9559 break;
9560 }
9561
9562 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9563
9564 unsigned aead_auth_tag_len = hpke_aead_auth_tag_len(aead_id);
9565 if (length < aead_auth_tag_len) {
9566 ssl_debug_printf("Encrypted payload length %u < Cipher suite authentication tag length %u.\n", length, aead_auth_tag_len);
9567 break;
9568 }
9569 unsigned decrypted_len = length - aead_auth_tag_len;
9570
9571 uint16_t version = pntohu16(ech_config->data);
9572 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9573 ssl_debug_printf("Unexpected version in ECH Config\n");
9574 break;
9575 }
9576 uint32_t ech_config_offset = 2;
9577 if (pntohu16(&ech_config->data[ech_config_offset]) != ech_config->data_len - 4) {
9578 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9579 break;
9580 }
9581 ech_config_offset += 2;
9582 if (*(ech_config->data + ech_config_offset) != config_id) {
9583 ssl_debug_printf("ECH Config version mismatch\n");
9584 break;
9585 }
9586 ech_config_offset += 1;
9587 uint16_t kem_id = pntohu16(&ech_config->data[ech_config_offset]);
9588 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9589 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9590 GByteArray *info = g_byte_array_new();
9591 g_byte_array_append(info, (const uint8_t*)"tls ech", 8);
9592 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9593 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9594 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9595 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9596 key, base_nonce)) {
9597 g_byte_array_free(info, TRUE(!(0)));
9598 break;
9599 }
9600 g_byte_array_free(info, TRUE(!(0)));
9601 gcry_cipher_hd_t cipher;
9602 if (hpke_setup_aead(&cipher, aead_id, key) ||
9603 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9604 gcry_cipher_close(cipher);
9605 break;
9606 }
9607 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9608 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9609 tvb_memcpy(tvb, ech_aad, 0, hello_length);
9610 memset(ech_aad + offset - length, 0, length);
9611 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9612 gcry_cipher_close(cipher);
9613 wmem_free(NULL((void*)0), ech_aad);
9614 break;
9615 }
9616 wmem_free(NULL((void*)0), ech_aad);
9617 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, decrypted_len);
9618 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, decrypted_len, payload, decrypted_len)) {
9619 gcry_cipher_close(cipher);
9620 break;
9621 }
9622 unsigned char *ech_auth_tag_calc = wmem_alloc0(pinfo->pool, aead_auth_tag_len);
9623 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, aead_auth_tag_len)) {
9624 gcry_cipher_close(cipher);
9625 break;
9626 }
9627 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9628 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, aead_auth_tag_len);
9629 gcry_cipher_close(cipher);
9630 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9631 payload + decrypted_len, aead_auth_tag_len)) {
9632 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9633 } else {
9634 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9635 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, decrypted_len, decrypted_len);
9636 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9637 if (ssl) {
9638 /* Note the Outer Client Random for Inject TLS Secrets */
9639 tls_save_crandom(ssl, mk_map);
9640
9641 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9642 /* Build ClientHelloInner here and then add it to the
9643 * transcript, which might only keep the digest state. */
9644 unsigned char *inner = (unsigned char*)wmem_alloc(pinfo->pool, hello_length + 4);
9645 uint32_t inner_len;
9646 inner[0] = SSL_HND_CLIENT_HELLO;
9647 inner[1] = 0;
9648 /* Copy ClientHelloInner up to the legacy_session_id field. */
9649 tvb_memcpy(ech_tvb, inner + 4, 0, 34);
9650 inner_len = 38;
9651 /* Now copy the legacy_session_id field from ClientHelloOuter. */
9652 inner[inner_len] = ssl->session_id.data_len;
9653 inner_len++;
9654 memcpy(&inner[inner_len], ssl->session_id.data, ssl->session_id.data_len);
9655 inner_len += ssl->session_id.data_len;
9656 /* Skip past the legacy_session_id field in ClientHelloInner
9657 * (which should be the empty string, i.e. just a 0 size.) */
9658 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9659 /* Copy the Cipher Suites from ClientHelloInner. */
9660 tvb_memcpy(ech_tvb, inner + inner_len, ech_offset,
9661 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9662 inner_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9663 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9664 /* Copy the Compression Methods */
9665 tvb_memcpy(ech_tvb, inner + inner_len, ech_offset,
9666 1 + tvb_get_uint8(ech_tvb, ech_offset));
9667 inner_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9668 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
9669 /* Now replace extensions in ech_outer_extensions with the
9670 * data from ClientHelloOuter. */
9671 uint32_t ech_extensions_len_offset = inner_len;
9672 inner_len += 2;
9673 uint32_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
9674 ech_offset += 2;
9675 bool_Bool ech_outer_extensions_found = false0;
9676 while (extensions_end - ech_offset >= 4) {
9677 uint16_t ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9678 ech_offset += 2;
9679 uint16_t ext_len = tvb_get_ntohs(ech_tvb, ech_offset);
9680 ech_offset += 2;
9681 if (ext_type != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
9682 /* Copy this extension directly */
9683 tvb_memcpy(ech_tvb, inner + inner_len,
9684 ech_offset - 4, 4 + ext_len);
9685 inner_len += 4 + ext_len;
9686 ech_offset += ext_len;
9687 } else if (ext_len > 0) {
9688 if (ech_outer_extensions_found) {
9689 ssl_debug_printf("Illegal parameter; only a single \"ech_outer_extensions\" extension is allowed\n");
9690 /* This could lead to a buffer overflow by
9691 * making the post-copying ClientHelloInner
9692 * longer than ClientHelloOuter and is
9693 * illegal, so skip this and don't copy. */
9694 ech_offset += ext_len;
9695 continue;
9696 }
9697 ech_outer_extensions_found = true1;
9698 unsigned num_ech_outer_extensions = tvb_get_uint8(ech_tvb, ech_offset);
9699 ech_offset += 1;
9700 uint32_t ech_outer_extensions_end = ech_offset + num_ech_outer_extensions;
9701 /* In ClientHelloOuter, skip past the legacy_session_id */
9702 uint32_t outer_offset = 35 + tvb_get_uint8(tvb, 34);
9703 /* Skip past Cipher Suites */
9704 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
9705 /* Skip past Compression Methods */
9706 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
9707 /* Now at the start of ClientHelloOuter's extensions */
9708 while (ech_outer_extensions_end - ech_offset >= 2) {
9709 ext_type = tvb_get_ntohs(ech_tvb, ech_offset);
9710 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9711 ssl_debug_printf("Illegal parameter; encrypted_client_hello cannot appear within ech_outer_extensions\n");
9712 /* This could lead to a buffer overflow by
9713 * making the post-copying ClientHelloInner
9714 * longer than ClientHelloOuter and is
9715 * illegal, so don't copy. */
9716 break;
9717 }
9718 bool_Bool found = false0;
9719 while (tvb_reported_length_remaining(tvb, outer_offset) >= 4) {
9720 uint16_t outer_ext_type = tvb_get_ntohs(tvb, outer_offset);
9721 uint16_t outer_ext_len = tvb_get_ntohs(tvb, outer_offset + 2);
9722 if (ext_type == outer_ext_type) {
9723 tvb_memcpy(tvb, inner + inner_len, outer_offset,
9724 4 + outer_ext_len);
9725 inner_len += 4 + outer_ext_len;
9726 outer_offset += 4 + outer_ext_len;
9727 found = true1;
9728 break;
9729 } else {
9730 outer_offset += 4 + outer_ext_len;
9731 }
9732 }
9733 if (!found) {
9734 ssl_debug_printf("Extension %s was not found in ClientHelloOuter (possibly out of order or referenced more than once)\n", val_to_str(pinfo->pool, ext_type, tls_hello_extension_types, "unknown (0x%02x)"));
9735 }
9736 ech_offset += 2;
9737 }
9738 }
9739 }
9740 uint16_t ech_extensions_len = inner_len - ech_extensions_len_offset - 2;
9741 phtonu16(&inner[ech_extensions_len_offset], ech_extensions_len);
9742 phtonu16(&inner[2], inner_len - 4);
9743 tls_transcript_add(&ssl->ech_transcript, inner, inner_len);
9744 }
9745 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, decrypted_len, session,
9746 ssl, NULL((void*)0), mk_map);
9747 if (ech_padding_begin < decrypted_len) {
9748 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, decrypted_len - ech_padding_begin,
9749 ENC_NA0x00000000);
9750 }
9751 }
9752
9753 break;
9754 case 1: /* inner */
9755 break;
9756 }
9757 break;
9758
9759 case SSL_HND_ENCRYPTED_EXTENSIONS:
9760 /*
9761 * struct {
9762 * ECHConfigList retry_configs;
9763 * } ECHEncryptedExtensions;
9764 */
9765
9766 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
9767 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
9768 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
9769 break;
9770
9771 case SSL_HND_HELLO_RETRY_REQUEST:
9772 /*
9773 * struct {
9774 * opaque confirmation[8];
9775 * } ECHHelloRetryRequest;
9776 */
9777
9778 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
9779 if (session->ech) {
9780 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
9781 proto_item_set_generated(ti);
9782 if (tvb_memeql(tvb, offset, session->hrr_ech_confirmation, 8) != 0) {
9783 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9784 } else {
9785 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9786 }
9787 }
9788 offset += 8;
9789 break;
9790 }
9791
9792 return offset;
9793}
9794
9795static uint32_t
9796ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9797 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9798 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
9799{
9800 uint32_t record_digest_length, encrypted_sni_length;
9801
9802 switch (hnd_type) {
9803 case SSL_HND_CLIENT_HELLO:
9804 /*
9805 * struct {
9806 * CipherSuite suite;
9807 * KeyShareEntry key_share;
9808 * opaque record_digest<0..2^16-1>;
9809 * opaque encrypted_sni<0..2^16-1>;
9810 * } ClientEncryptedSNI;
9811 */
9812 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9813 offset += 2;
9814 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
9815
9816 /* opaque record_digest<0..2^16-1> */
9817 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
9818 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
9819 return offset_end;
9820 }
9821 offset += 2;
9822 if (record_digest_length > 0) {
9823 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
9824 offset += record_digest_length;
9825 }
9826
9827 /* opaque encrypted_sni<0..2^16-1> */
9828 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
9829 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
9830 return offset_end;
9831 }
9832 offset += 2;
9833 if (encrypted_sni_length > 0) {
9834 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
9835 offset += encrypted_sni_length;
9836 }
9837 break;
9838
9839 case SSL_HND_ENCRYPTED_EXTENSIONS:
9840 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
9841 offset += 16;
9842 break;
9843 }
9844
9845 return offset;
9846}
9847/** TLS Extensions (in Client Hello and Server Hello). }}} */
9848
9849/* Connection ID dissection. {{{ */
9850static uint32_t
9851ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9852 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
9853 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
9854{
9855 /* keep track of the decrypt session only for the first pass */
9856 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
9857 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
9858 *session_cidl = cidl;
9859 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
9860 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
9861 if (ssl) {
9862 ssl_add_session_by_cid(ssl);
9863 }
9864 }
9865
9866 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
9867 tvb, offset, 1, ENC_NA0x00000000);
9868 offset++;
9869
9870 if (cidl > 0) {
9871 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
9872 tvb, offset, cidl, ENC_NA0x00000000);
9873 offset += cidl;
9874 }
9875
9876 return offset;
9877}
9878
9879static uint32_t
9880ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9881 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
9882 SslSession *session, SslDecryptSession *ssl)
9883{
9884 uint8_t cidl = tvb_get_uint8(tvb, offset);
9885
9886 switch (hnd_type) {
9887 case SSL_HND_CLIENT_HELLO:
9888 session->client_cid_len_present = true1;
9889 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9890 cidl, &session->client_cid, &session->client_cid_len);
9891 case SSL_HND_SERVER_HELLO:
9892 session->server_cid_len_present = true1;
9893 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
9894 cidl, &session->server_cid, &session->server_cid_len);
9895 default:
9896 return offset;
9897 }
9898} /* }}} */
9899
9900/* Trusted CA dissection. {{{ */
9901static uint32_t
9902ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9903 uint32_t offset, uint32_t offset_end)
9904{
9905 proto_item *ti;
9906 proto_tree *subtree;
9907 uint32_t keys_length, next_offset;
9908
9909 /*
9910 * struct {
9911 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
9912 * } TrustedAuthorities;
9913 *
9914 * struct {
9915 * IdentifierType identifier_type;
9916 * select (identifier_type) {
9917 * case pre_agreed: struct {};
9918 * case key_sha1_hash: SHA1Hash;
9919 * case x509_name: DistinguishedName;
9920 * case cert_sha1_hash: SHA1Hash;
9921 * } identifier;
9922 * } TrustedAuthority;
9923 *
9924 * enum {
9925 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9926 * cert_sha1_hash(3), (255)
9927 * } IdentifierType;
9928 *
9929 * opaque DistinguishedName<1..2^16-1>;
9930 *
9931 */
9932
9933
9934 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
9935 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
9936 0, UINT16_MAX(65535)))
9937 {
9938 return offset_end;
9939 }
9940 offset += 2;
9941 next_offset = offset + keys_length;
9942
9943 if (keys_length > 0)
9944 {
9945 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
9946 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
9947 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
9948
9949 while (offset < next_offset)
9950 {
9951 uint32_t identifier_type;
9952 proto_tree *trusted_key_tree;
9953 proto_item *trusted_key_item;
9954 asn1_ctx_t asn1_ctx;
9955 uint32_t key_len = 0;
9956
9957 identifier_type = tvb_get_uint8(tvb, offset);
9958
9959 // Use 0 as length for now as we'll only know the size when we decode the identifier
9960 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
9961 offset, 0, "Trusted CA Key");
9962 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
9963
9964 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
9965 offset, 1, identifier_type);
9966 offset++;
9967
9968 /*
9969 * enum {
9970 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
9971 * cert_sha1_hash(3), (255)
9972 * } IdentifierType;
9973 */
9974 switch (identifier_type)
9975 {
9976 case 0:
9977 key_len = 0;
9978 break;
9979 case 2:
9980 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9981
9982 uint32_t name_length;
9983 /* opaque DistinguishedName<1..2^16-1> */
9984 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
9985 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
9986 return next_offset;
9987 }
9988 offset += 2;
9989
9990 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
9991 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
9992 offset += name_length;
9993 break;
9994 case 1:
9995 case 3:
9996 key_len = 20;
9997 /* opaque SHA1Hash[20]; */
9998 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
9999 offset, 20, ENC_NA0x00000000);
10000 break;
10001
10002 default:
10003 key_len = 0;
10004 /*TODO display expert info about unknown ? */
10005 break;
10006 }
10007 proto_item_set_len(trusted_key_item, 1 + key_len);
10008 offset += key_len;
10009 }
10010 }
10011
10012 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10013 {
10014 offset = next_offset;
10015 }
10016
10017 return offset;
10018} /* }}} */
10019
10020
10021/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10022bool_Bool
10023ssl_is_valid_content_type(uint8_t type)
10024{
10025 switch ((ContentType) type) {
10026 case SSL_ID_CHG_CIPHER_SPEC:
10027 case SSL_ID_ALERT:
10028 case SSL_ID_HANDSHAKE:
10029 case SSL_ID_APP_DATA:
10030 case SSL_ID_HEARTBEAT:
10031 case SSL_ID_TLS12_CID:
10032 case SSL_ID_DTLS13_ACK:
10033 return true1;
10034 }
10035 return false0;
10036}
10037
10038bool_Bool
10039ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10040{
10041 switch ((HandshakeType) hs_type) {
10042 case SSL_HND_HELLO_VERIFY_REQUEST:
10043 /* hello_verify_request is DTLS-only */
10044 return is_dtls;
10045
10046 case SSL_HND_HELLO_REQUEST:
10047 case SSL_HND_CLIENT_HELLO:
10048 case SSL_HND_SERVER_HELLO:
10049 case SSL_HND_NEWSESSION_TICKET:
10050 case SSL_HND_END_OF_EARLY_DATA:
10051 case SSL_HND_HELLO_RETRY_REQUEST:
10052 case SSL_HND_ENCRYPTED_EXTENSIONS:
10053 case SSL_HND_CERTIFICATE:
10054 case SSL_HND_SERVER_KEY_EXCHG:
10055 case SSL_HND_CERT_REQUEST:
10056 case SSL_HND_SVR_HELLO_DONE:
10057 case SSL_HND_CERT_VERIFY:
10058 case SSL_HND_CLIENT_KEY_EXCHG:
10059 case SSL_HND_FINISHED:
10060 case SSL_HND_CERT_URL:
10061 case SSL_HND_CERT_STATUS:
10062 case SSL_HND_SUPPLEMENTAL_DATA:
10063 case SSL_HND_KEY_UPDATE:
10064 case SSL_HND_COMPRESSED_CERTIFICATE:
10065 case SSL_HND_ENCRYPTED_EXTS:
10066 return true1;
10067 case SSL_HND_MESSAGE_HASH:
10068 return false0;
10069 }
10070 return false0;
10071}
10072
10073static bool_Bool
10074ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10075 bool_Bool is_dtls)
10076{
10077 /* Consider all valid Handshake messages (except for Client Hello) and
10078 * all other valid record types (other than Handshake) */
10079 return (content_type == SSL_ID_HANDSHAKE &&
10080 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10081 handshake_type != SSL_HND_CLIENT_HELLO) ||
10082 (content_type != SSL_ID_HANDSHAKE &&
10083 ssl_is_valid_content_type(content_type));
10084}
10085
10086/**
10087 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10088 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10089 * Returns true if the supported_versions extension was found, false if not.
10090 */
10091bool_Bool
10092tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10093 uint16_t *server_version, bool_Bool *is_hrr)
10094{
10095 /* SHA256("HelloRetryRequest") */
10096 static const uint8_t tls13_hrr_random_magic[] = {
10097 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10098 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10099 };
10100 uint8_t session_id_length;
10101
10102 *server_version = tvb_get_ntohs(tvb, offset);
10103
10104 /*
10105 * Try to look for supported_versions extension. Minimum length:
10106 * 2 + 32 + 1 = 35 (version, random, session id length)
10107 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10108 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10109 *
10110 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10111 * there's a separate expert info warning for that.
10112 */
10113 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10114 offset += 2;
10115 if (is_hrr) {
10116 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10117 }
10118 offset += 32;
10119 session_id_length = tvb_get_uint8(tvb, offset);
10120 offset++;
10121 if (offset_end - offset < session_id_length + 5u) {
10122 return false0;
10123 }
10124 offset += session_id_length + 5;
10125
10126 while (offset_end - offset >= 6) {
10127 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10128 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10129 if (offset_end - offset < 4u + ext_len) {
10130 break; /* not enough data for type, length and data */
10131 }
10132 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10133 if (ext_len == 2) {
10134 *server_version = tvb_get_ntohs(tvb, offset + 4);
10135 }
10136 return true1;
10137 }
10138 offset += 4 + ext_len;
10139 }
10140 } else {
10141 if (is_hrr) {
10142 *is_hrr = false0;
10143 }
10144 }
10145 return false0;
10146}
10147
10148/**
10149 * Scan a Client Hello handshake message to see if the supported_versions
10150 * extension is found, in which case the version field is legacy_version.
10151 */
10152static bool_Bool
10153tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10154{
10155 uint8_t session_id_length;
10156
10157 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10158
10159 /*
10160 * Try to look for supported_versions extension. Minimum length:
10161 * 2 + 32 + 1 = 35 (version, random, session id length)
10162 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10163 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10164 *
10165 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10166 * there's a separate expert info warning for that.
10167 */
10168 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10169 offset += 2;
10170 offset += 32;
10171 session_id_length = tvb_get_uint8(tvb, offset);
10172 offset++;
10173 if (offset_end - offset < session_id_length + 2u) {
10174 return false0;
10175 }
10176 offset += session_id_length;
10177 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10178 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10179 offset++;
10180 if (offset_end - offset < cookie_length + 2u) {
10181 return false0;
10182 }
10183 }
10184 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10185 offset += 2;
10186 if (offset_end - offset < cipher_suites_length + 1u) {
10187 return false0;
10188 }
10189 offset += cipher_suites_length;
10190 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10191 offset++;
10192 if (offset_end - offset < compression_methods_length + 2u) {
10193 return false0;
10194 }
10195 offset += compression_methods_length + 2;
10196
10197 while (offset_end - offset >= 6) {
10198 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10199 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10200 if (offset_end - offset < 4u + ext_len) {
10201 break; /* not enough data for type, length and data */
10202 }
10203 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10204 return true1;
10205 }
10206 offset += 4 + ext_len;
10207 }
10208 }
10209 return false0;
10210}
10211void
10212ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10213 uint8_t content_type, uint8_t handshake_type,
10214 bool_Bool is_dtls, uint16_t version)
10215{
10216 uint8_t tls13_draft = 0;
10217
10218 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10219 is_dtls))
10220 return;
10221
10222 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10223 if (version == SSL_VER_UNKNOWN0) {
10224 return;
10225 }
10226
10227 session->tls13_draft_version = tls13_draft;
10228 session->version = version;
10229 if (ssl) {
10230 ssl->state |= SSL_VERSION(1<<4);
10231 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10232 }
10233}
10234
10235void
10236ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10237 ContentType content_type,
10238 unsigned record_length, proto_item *length_pi,
10239 uint16_t version, tvbuff_t *decrypted_tvb)
10240{
10241 unsigned max_expansion;
10242 if (version == TLSV1DOT3_VERSION0x304) {
10243 /* TLS 1.3: Max length is 2^14 + 256 */
10244 max_expansion = 256;
10245 } else {
10246 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10247 max_expansion = 2048;
10248 }
10249 /*
10250 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10251 * and ChangeCipherSpec.
10252 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10253 * so assume it is permitted.
10254 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10255 * assume TLS 1.2 requirements.
10256 */
10257 if (record_length == 0 &&
10258 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10259 content_type == SSL_ID_ALERT ||
10260 content_type == SSL_ID_HANDSHAKE)) {
10261 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10262 "Zero-length %s fragments are not allowed",
10263 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10264 }
10265 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10266 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10267 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10268 }
10269 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10270 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10271 "TLSPlaintext length MUST NOT exceed 2^14");
10272 }
10273}
10274
10275static void
10276ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10277{
10278 /* store selected cipher suite for decryption */
10279 ssl->session.cipher = cipher;
10280
10281 const SslCipherSuite *cs = ssl_find_cipher(cipher);
8
←
Calling 'ssl_find_cipher'
→
12
←
Returning from 'ssl_find_cipher'
→
10282 if (!cs
12.1
'cs' is null
) {
13
←
Taking true branch
→
10283 ssl->cipher_suite = NULL((void*)0);
14
←
Null pointer value stored to field 'cipher_suite'
→
10284 ssl->state &= ~SSL_CIPHER(1<<2);
10285 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10286 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10287 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10288 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10289 * to avoid a potential buffer overflow in ssl3_check_mac. */
10290 ssl->cipher_suite = NULL((void*)0);
10291 ssl->state &= ~SSL_CIPHER(1<<2);
10292 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10293 } else {
10294 /* Cipher found, save this for the delayed decoder init */
10295 ssl->cipher_suite = cs;
10296 ssl->state |= SSL_CIPHER(1<<2);
10297 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10298 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10299 ssl->state);
10300 }
10301}
10302/* }}} */
10303
10304
10305/* Client Hello and Server Hello dissections. {{{ */
10306static int
10307ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10308 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10309 SslSession *session, SslDecryptSession *ssl,
10310 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10311 ssl_master_key_map_t *mk_map);
10312int
10313// NOLINTNEXTLINE(misc-no-recursion)
10314ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10315 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10316 uint32_t offset_end, SslSession *session,
10317 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10318{
10319 /* struct {
10320 * ProtocolVersion client_version;
10321 * Random random;
10322 * SessionID session_id;
10323 * opaque cookie<0..32>; //new field for DTLS
10324 * CipherSuite cipher_suites<2..2^16-1>;
10325 * CompressionMethod compression_methods<1..2^8-1>;
10326 * Extension client_hello_extension_list<0..2^16-1>;
10327 * } ClientHello;
10328 */
10329 proto_item *ti;
10330 proto_tree *cs_tree;
10331 uint32_t client_version;
10332 uint32_t cipher_suite_length;
10333 uint32_t compression_methods_length;
10334 uint8_t compression_method;
10335 uint32_t next_offset;
10336 uint32_t initial_offset = offset;
10337 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10338 char *ja3_hash;
10339 char *ja3_dash = "";
10340 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10341 ja4_data_t ja4_data;
10342 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10343 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10344 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10345 wmem_list_frame_t *curr_entry;
10346
10347 DISSECTOR_ASSERT_CMPINT(initial_offset, <=, offset_end)((void) ((initial_offset <= offset_end) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "initial_offset" " " "<=" " " "offset_end"
" (" "%" "l" "d" " " "<=" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 10347, (int64_t)initial_offset, (int64_t)offset_end))));
10348 tvbuff_t *hello_tvb = tvb_new_subset_length(tvb, initial_offset, offset_end - initial_offset);
10349 offset = 0;
10350 offset_end = tvb_reported_length(hello_tvb);
10351
10352 ja4_data.max_version = 0;
10353 ja4_data.server_name_present = false0;
10354 ja4_data.num_cipher_suites = 0;
10355 ja4_data.num_extensions = 0;
10356 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10357 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10358 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10359 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10360
10361 /* show the client version */
10362 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, hello_tvb,
10363 offset, 2, ENC_BIG_ENDIAN0x00000000,
10364 &client_version);
10365 if (tls_scan_client_hello(hello_tvb, offset, offset_end)) {
10366 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10367 }
10368 offset += 2;
10369 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10370
10371 /*
10372 * Is it version 1.3?
10373 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10374 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10375 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10376 * Hello".
10377 */
10378 if (dtls_hfs != NULL((void*)0)) {
10379 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10380 /* Don't do that. */
10381 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10382 }
10383 } else {
10384 if (client_version == TLSV1DOT3_VERSION0x304) {
10385 /* Don't do that. */
10386 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10387 }
10388 }
10389
10390 /* dissect fields that are present in both ClientHello and ServerHello */
10391 offset = ssl_dissect_hnd_hello_common(hf, hello_tvb, pinfo, tree, offset, session, ssl, false0, false0);
10392
10393 /* fields specific for DTLS (cookie_len, cookie) */
10394 if (dtls_hfs != NULL((void*)0)) {
10395 uint32_t cookie_length;
10396 /* opaque cookie<0..32> (for DTLS only) */
10397 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cookie_length,
10398 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10399 return offset;
10400 }
10401 offset++;
10402 if (cookie_length > 0) {
10403 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10404 hello_tvb, offset, cookie_length, ENC_NA0x00000000);
10405 offset += cookie_length;
10406 }
10407 }
10408
10409 /* CipherSuite cipher_suites<2..2^16-1> */
10410 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10411 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10412 return offset;
10413 }
10414 offset += 2;
10415 next_offset = offset + cipher_suite_length;
10416 ti = proto_tree_add_none_format(tree,
10417 hf->hf.hs_cipher_suites,
10418 hello_tvb, offset, cipher_suite_length,
10419 "Cipher Suites (%d suite%s)",
10420 cipher_suite_length / 2,
10421 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10422 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10423 while (offset + 2 <= next_offset) {
10424 uint32_t cipher_suite;
10425
10426 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, hello_tvb, offset, 2,
10427 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10428 offset += 2;
10429 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))) {
10430 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10431 ja3_dash = "-";
10432 ja4_data.num_cipher_suites += 1;
10433 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10434 }
10435 }
10436 wmem_strbuf_append_c(ja3, ',');
10437 if (!ssl_end_vector(hf, hello_tvb, pinfo, cs_tree, offset, next_offset)) {
10438 offset = next_offset;
10439 }
10440
10441 /* CompressionMethod compression_methods<1..2^8-1> */
10442 if (!ssl_add_vector(hf, hello_tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10443 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10444 return offset;
10445 }
10446 offset++;
10447 next_offset = offset + compression_methods_length;
10448 ti = proto_tree_add_none_format(tree,
10449 hf->hf.hs_comp_methods,
10450 hello_tvb, offset, compression_methods_length,
10451 "Compression Methods (%u method%s)",
10452 compression_methods_length,
10453 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10454 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10455 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10456 while (offset < next_offset) {
10457 compression_method = tvb_get_uint8(hello_tvb, offset);
10458 /* TODO: make reserved/private comp meth. fields selectable */
10459 if (compression_method < 64)
10460 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10461 hello_tvb, offset, 1, compression_method);
10462 else if (compression_method < 193)
10463 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10464 compression_method, "Reserved - to be assigned by IANA (%u)",
10465 compression_method);
10466 else
10467 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, hello_tvb, offset, 1,
10468 compression_method, "Private use range (%u)",
10469 compression_method);
10470 offset++;
10471 }
10472
10473 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10474 if (offset < offset_end) {
10475 offset = ssl_dissect_hnd_extension(hf, hello_tvb, tree, pinfo, offset,
10476 offset_end, SSL_HND_CLIENT_HELLO,
10477 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map);
10478 if (ja4_data.max_version > 0) {
10479 client_version = ja4_data.max_version;
10480 }
10481 } else {
10482 wmem_strbuf_append_printf(ja3, ",,");
10483 }
10484
10485 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10486 wmem_strbuf_append(ja4_a, "t");
10487 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10488 wmem_strbuf_append(ja4_a, "q");
10489 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10490 wmem_strbuf_append(ja4_a, "d");
10491 }
10492 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10493 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10494 if (ja4_data.num_cipher_suites > 99) {
10495 wmem_strbuf_append(ja4_a, "99");
10496 } else {
10497 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10498 }
10499 if (ja4_data.num_extensions > 99) {
10500 wmem_strbuf_append(ja4_a, "99");
10501 } else {
10502 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10503 }
10504 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10505 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10506 } else {
10507 wmem_strbuf_append(ja4_a, "00");
10508 }
10509
10510 curr_entry = wmem_list_head(ja4_data.cipher_list);
10511 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10512 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10513 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10514 wmem_strbuf_append(ja4_br, ",");
10515 }
10516 curr_entry = wmem_list_frame_next(curr_entry);
10517 }
10518
10519 curr_entry = wmem_list_head(ja4_data.extension_list);
10520 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10521 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10522 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10523 wmem_strbuf_append(ja4_cr, ",");
10524 }
10525 curr_entry = wmem_list_frame_next(curr_entry);
10526 }
10527
10528 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10529 wmem_strbuf_append(ja4_cr, "_");
10530 curr_entry = wmem_list_head(ja4_data.sighash_list);
10531 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10532 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10533 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10534 wmem_strbuf_append(ja4_cr, ",");
10535 }
10536 curr_entry = wmem_list_frame_next(curr_entry);
10537 }
10538 }
10539 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10540 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10541 } else {
10542 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10543 }
10544 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10545
10546 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10547 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10548 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10549 } else {
10550 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10551 }
10552 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10553 g_free(ja4_hash)(__builtin_object_size ((ja4_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja4_hash, __builtin_object_size ((ja4_hash), 0)) : (g_free)
(ja4_hash);
10554
10555 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10556 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10557
10558 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, hello_tvb, offset, 0, ja4);
10559 proto_item_set_generated(ti);
10560 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, hello_tvb, offset, 0, ja4_r);
10561 proto_item_set_generated(ti);
10562
10563 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10564 wmem_strbuf_get_len(ja3));
10565 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, hello_tvb, offset, 0, wmem_strbuf_get_str(ja3));
10566 proto_item_set_generated(ti);
10567 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, hello_tvb, offset, 0, ja3_hash);
10568 proto_item_set_generated(ti);
10569 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10570 return initial_offset + offset;
10571}
10572
10573/* The hash function(s) for the handshake transcript, matching what
10574 * ssl_generate_keyring_material and tls13_load_secret_from_psk use. */
10575static bool_Bool
10576tls_transcript_hash_algos(SslDecryptSession *ssl, int *algo, int *algo2)
10577{
10578 *algo2 = 0;
10579 switch (ssl->session.version) {
30
←
Control jumps to the 'default' case at line 10588
→
10580 case TLSV1_VERSION0x301:
10581 case TLSV1DOT1_VERSION0x302:
10582 case DTLSV1DOT0_VERSION0xfeff:
10583 case DTLSV1DOT0_OPENSSL_VERSION0x100:
10584 case TLCPV1_VERSION0x101:
10585 *algo = GCRY_MD_MD5;
10586 *algo2 = GCRY_MD_SHA1;
10587 return true1;
10588 default:
10589 break;
10590 }
10591
10592 if (!(ssl->state & SSL_CIPHER(1<<2)))
31
←
 Execution continues on line 10592
→
32
←
Taking false branch
→
10593 return false0;
10594
10595 switch (ssl->session.version) {
33
←
Control jumps to the 'default' case at line 10600
→
10596 case TLSV1DOT3_VERSION0x304:
10597 case DTLSV1DOT3_VERSION0xfefc:
10598 *algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10599 return *algo != 0;
10600 default:
10601 *algo = ssl->cipher_suite->dig == DIG_SHA3840x43 ? GCRY_MD_SHA384 : GCRY_MD_SHA256;
34
←
Access to field 'dig' results in a dereference of a null pointer (loaded from field 'cipher_suite')
10602 return true1;
10603 }
10604}
10605
10606static void
10607tls_calculate_ech_handshake_hash(packet_info *pinfo, SslDecryptSession *ssl, tvbuff_t *tvb, uint32_t offset, uint32_t length, bool_Bool is_hrr)
10608{
10609 /* Note length here, unlike ssl_calculate_handshake_hash, does *not* include
10610 * the 4 bytes for the handshake type and length fields themselves. */
10611 if (!ssl
16.1
'ssl' is non-null
 || tls_transcript_is_empty(&ssl->ech_transcript) || !(ssl->state & SSL_CIPHER(1<<2)) || ssl->client_random.data_len == 0)
17
←
Assuming the condition is false
→
18
←
Assuming field 'data_len' is not equal to 0
→
19
←
Taking false branch
→
10612 return;
10613
10614 /* RFC 9849 7.2 Backend Server */
10615 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10616 if (!hash_algo)
20
←
Assuming 'hash_algo' is 0
→
21
←
Taking true branch
→
10617 return;
10618
10619 /* Check that the entire message is present and find the confirmation
10620 * before using the transcript, so that a truncated or malformed message
10621 * doesn't throw an exception here (preventing the extensions from being
10622 * dissected, or leaving the transcript partially updated.) */
10623 if (length < 34 || !tvb_bytes_exist(tvb, offset, length))
10624 return;
10625 /* The ServerHello confirmation is the last 8 bytes of the random. */
10626 uint32_t confirmation_offset = offset + 26;
10627 bool_Bool zero_confirmation = !is_hrr;
10628 if (is_hrr) {
10629 /* The HelloRetryRequest confirmation is in the extension. */
10630 uint32_t hrr_offset = offset + 34;
10631 uint32_t message_end = offset + length;
10632 uint32_t extensions_end = hrr_offset;
10633 if (message_end - hrr_offset >= 1) {
10634 /* legacy_session_id_echo, cipher_suite, legacy_compression_method */
10635 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1 + 3;
10636 if (hrr_offset <= message_end && message_end - hrr_offset >= 2) {
10637 extensions_end = hrr_offset + 2 + tvb_get_ntohs(tvb, hrr_offset);
10638 hrr_offset += 2;
10639 if (extensions_end > message_end) {
10640 extensions_end = message_end;
10641 }
10642 }
10643 }
10644 while (hrr_offset <= extensions_end && extensions_end - hrr_offset >= 4) {
10645 uint16_t ext_type = tvb_get_ntohs(tvb, hrr_offset);
10646 uint16_t ext_len = tvb_get_ntohs(tvb, hrr_offset + 2);
10647 if (ext_type == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 && ext_len == 8 &&
10648 extensions_end - hrr_offset >= 12) {
10649 confirmation_offset = hrr_offset + 4;
10650 zero_confirmation = true1;
10651 break;
10652 }
10653 hrr_offset += 4 + ext_len;
10654 }
10655 }
10656 uint8_t *message = (uint8_t *)wmem_alloc(pinfo->pool, 4 + length);
10657 message[0] = SSL_HND_SERVER_HELLO;
10658 phtonu24(&message[1], length);
10659 tvb_memcpy(tvb, message + 4, offset, length);
10660 uint8_t *zeroed = (uint8_t *)wmem_memdup(pinfo->pool, message, 4 + length);
10661 if (zero_confirmation) {
10662 memset(zeroed + 4 + confirmation_offset - offset, 0, 8);
10663 }
10664
10665 if (is_hrr) {
10666 /* RFC 8446 4.4.1 The Transcript Hash
10667 * Special synthetic handshake following a HelloRetryRequest */
10668 if (!tls_transcript_hello_retry(&ssl->ech_transcript, hash_algo, 0))
10669 return;
10670 }
10671
10672 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10673 unsigned char prk[DIGEST_MAX_SIZE48];
10674 unsigned char *ech_verify_out = NULL((void*)0);
10675 unsigned int len;
10676 gcry_md_hd_t md = tls_transcript_copy(&ssl->ech_transcript, hash_algo, 0);
10677 if (!md)
10678 return;
10679 gcry_md_write(md, zeroed, 4 + length);
10680 len = gcry_md_get_algo_dlen(hash_algo);
10681 memcpy(transcript_hash, gcry_md_read(md, hash_algo), len);
10682 gcry_md_close(md);
10683
10684 /* The transcript continues with the actual message. */
10685 if (tls_transcript_set_hash(&ssl->ech_transcript, hash_algo, 0))
10686 tls_transcript_add(&ssl->ech_transcript, message, 4 + length);
10687
10688 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
10689 StringInfo prk_string = {prk, len};
10690 if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
10691 is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
10692 transcript_hash, len, 8, &ech_verify_out)) {
10693 memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
10694 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
10695 if (is_hrr) {
10696 ssl->session.hrr_ech_declined = true1;
10697 ssl->session.first_ch_ech_frame = 0;
10698 }
10699 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
10700 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
10701 }
10702 wmem_free(NULL((void*)0), ech_verify_out);
10703 }
10704 /* XXX - If ECH is accepted, then the ECH transcript should be used
10705 * instead of the handshake_transcript for various purposes, like PSK KE.
10706 * If declined, then we don't need the ECH transcript anymore.
10707 */
10708 ssl->session.ech = true1;
10709}
10710
10711void
10712ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10713 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10714 SslSession *session, SslDecryptSession *ssl,
10715 bool_Bool is_dtls, bool_Bool is_hrr)
10716{
10717 /* struct {
10718 * ProtocolVersion server_version;
10719 * Random random;
10720 * SessionID session_id; // TLS 1.2 and before
10721 * CipherSuite cipher_suite;
10722 * CompressionMethod compression_method; // TLS 1.2 and before
10723 * Extension server_hello_extension_list<0..2^16-1>;
10724 * } ServerHello;
10725 */
10726 uint8_t draft_version = session->tls13_draft_version;
10727 proto_item *ti;
10728 uint32_t server_version;
10729 uint32_t cipher_suite;
10730 uint32_t initial_offset = offset;
10731 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10732 char *ja3_hash;
10733
10734 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10735 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10736
10737 /* Initially assume that the session is resumed. If this is not the case, a
10738 * ServerHelloDone will be observed before the ChangeCipherSpec message
10739 * which will reset this flag. */
10740 session->is_session_resumed = true1;
10741
10742 /* show the server version */
10743 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10744 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10745
10746 uint16_t supported_server_version;
10747 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
1
Taking false branch
→
10748 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10749 }
10750 /*
10751 * Is it version 1.3?
10752 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10753 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10754 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10755 * Hello".
10756 */
10757 if (is_dtls) {
2
←
Assuming 'is_dtls' is false
→
3
←
Taking false branch
→
10758 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10759 /* Don't do that. */
10760 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10761 }
10762 } else {
10763 if (server_version == TLSV1DOT3_VERSION0x304) {
4
←
Assuming 'server_version' is not equal to TLSV1DOT3_VERSION
→
5
←
Taking false branch
→
10764 /* Don't do that. */
10765 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10766 }
10767 }
10768
10769 offset += 2;
10770 wmem_strbuf_append_printf(ja3, "%i", server_version);
10771
10772 /* dissect fields that are present in both ClientHello and ServerHello */
10773 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
10774
10775 if (ssl
5.1
'ssl' is non-null
) {
6
←
Taking true branch
→
10776 /* store selected cipher suite for decryption */
10777 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
7
←
Calling 'ssl_set_cipher'
→
15
←
Returning from 'ssl_set_cipher'
→
10778
10779 /* XXX - If we previously had a HRR, we should check to make sure the
10780 * Cipher Suite did not change (similar with the supported_versions ext.
10781 * https://www.rfc-editor.org/rfc/rfc9846.html#name-hello-retry-request
10782 */
10783 }
10784
10785 /* now the server-selected cipher suite */
10786 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10787 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10788 offset += 2;
10789 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10790
10791 /* With the Cipher Suite, we can now calculate the ECH handshake hash.
10792 * Do it now so we have it before the encrypted_client_hello extension
10793 * in a HRR. */
10794 tls_calculate_ech_handshake_hash(pinfo, ssl, tvb, initial_offset, offset_end - initial_offset, is_hrr);
16
←
Calling 'tls_calculate_ech_handshake_hash'
→
22
←
Returning from 'tls_calculate_ech_handshake_hash'
→
10795
10796 if (session->ech) {
23
←
Assuming field 'ech' is false
→
10797 tls_ech_confirm_t *ech_confirm = p_get_proto_data(pinfo->pool, pinfo, hf->hf.hs_ech_confirm, hf->hf.hs_ech_confirm);
10798 if (ech_confirm) {
10799 proto_tree *ech_confirm_tree = proto_item_add_subtree(ech_confirm->parent_item, hf->ett.hs_random);
10800 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, ech_confirm->confirm_tvb, 0, 8, ENC_NA0x00000000);
10801 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute,
10802 ech_confirm->confirm_tvb, 0, 0,
10803 session->ech_confirmation, 8);
10804 proto_item_set_generated(ti);
10805 if (tvb_memeql(ech_confirm->confirm_tvb, 0, session->ech_confirmation, 8)) {
10806 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10807 } else {
10808 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10809 }
10810 }
10811 }
10812
10813 /* No compression with TLS 1.3 before draft -22 */
10814 if (!(session->version
23.1
Field 'version' is not equal to TLSV1DOT3_VERSION
 == TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
24
←
Taking true branch
→
10815 if (ssl
24.1
'ssl' is non-null
) {
25
←
Taking true branch
→
10816 /* store selected compression method for decryption */
10817 ssl->session.compression = tvb_get_uint8(tvb, offset);
10818 }
10819 /* and the server-selected compression method */
10820 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10821 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10822 offset++;
10823 }
10824
10825 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10826 if (offset < offset_end) {
26
←
Assuming 'offset' is >= 'offset_end'
→
27
←
Taking false branch
→
10827 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10828 offset_end,
10829 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10830 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0));
10831 }
10832
10833 if (ssl
27.1
'ssl' is non-null
) {
28
←
Taking true branch
→
10834 /* The version and cipher suite are known now, so we know the hash
10835 * function and can keep only the digest state of the transcript. */
10836 int algo, algo2;
10837 if (!tls_transcript_hash_algos(ssl, &algo, &algo2)) {
29
←
Calling 'tls_transcript_hash_algos'
→
10838 ssl_debug_printf("%s can't determine the transcript hash\n", G_STRFUNC((const char*) (__func__)));
10839 tls_transcript_fail(&ssl->handshake_transcript);
10840 } else if (is_hrr) {
10841 /* The HelloRetryRequest itself is already in the transcript. */
10842 tls_transcript_hello_retry(&ssl->handshake_transcript, algo,
10843 (is_dtls ? 12 : 4) + offset_end - initial_offset);
10844 } else {
10845 tls_transcript_set_hash(&ssl->handshake_transcript, algo, algo2);
10846 }
10847 if (!is_hrr) {
10848 ssl->state &= ~SSL_HELLO_RETRY_REQUEST(1<<14);
10849 }
10850 }
10851
10852 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10853 wmem_strbuf_get_len(ja3));
10854 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10855 proto_item_set_generated(ti);
10856 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
10857 proto_item_set_generated(ti);
10858 g_free(ja3_hash)(__builtin_object_size ((ja3_hash), 0) != ((size_t) - 1)) ? g_free_sized
(ja3_hash, __builtin_object_size ((ja3_hash), 0)) : (g_free)
(ja3_hash);
10859}
10860/* Client Hello and Server Hello dissections. }}} */
10861
10862/* New Session Ticket dissection. {{{ */
10863void
10864ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10865 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10866 SslSession *session, SslDecryptSession *ssl,
10867 bool_Bool is_dtls, GHashTable *session_hash)
10868{
10869 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
10870 * struct {
10871 * uint32 ticket_lifetime_hint;
10872 * opaque ticket<0..2^16-1>;
10873 * } NewSessionTicket;
10874 *
10875 * RFC 8446 Section 4.6.1 (TLS 1.3):
10876 * struct {
10877 * uint32 ticket_lifetime;
10878 * uint32 ticket_age_add;
10879 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
10880 * opaque ticket<1..2^16-1>;
10881 * Extension extensions<0..2^16-2>;
10882 * } NewSessionTicket;
10883 */
10884 proto_tree *subtree;
10885 proto_item *subitem;
10886 uint32_t ticket_len;
10887 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
10888 unsigned char draft_version = session->tls13_draft_version;
10889 uint32_t lifetime_hint;
10890
10891 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
10892 hf->ett.session_ticket, NULL((void*)0),
10893 "TLS Session Ticket");
10894
10895 /* ticket lifetime hint */
10896 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
10897 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
10898 offset += 4;
10899
10900 if (lifetime_hint >= 60) {
10901 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
10902 proto_item_append_text(subitem, " (%s)", time_str);
10903 }
10904
10905 if (is_tls13) {
10906
10907 /* for TLS 1.3: ticket_age_add */
10908 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
10909 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
10910 offset += 4;
10911
10912 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
10913 if (draft_version == 0 || draft_version >= 21) {
10914 uint32_t ticket_nonce_len;
10915
10916 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
10917 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
10918 return;
10919 }
10920 offset++;
10921
10922 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
10923 offset += ticket_nonce_len;
10924 }
10925
10926 }
10927
10928 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
10929 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
10930 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
10931 return;
10932 }
10933 offset += 2;
10934
10935 /* Content depends on implementation, so just show data! */
10936 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
10937 tvb, offset, ticket_len, ENC_NA0x00000000);
10938 /* save the session ticket to cache for ssl_finalize_decryption */
10939 if (ssl && !is_tls13) {
10940 if (ssl->session.is_session_resumed) {
10941 /* NewSessionTicket is received in ServerHello before ChangeCipherSpec
10942 * (Abbreviated Handshake Using New Session Ticket).
10943 * Restore the master key for this session ticket before saving
10944 * it to the new session ticket. */
10945 ssl_restore_master_key(ssl, "Session Ticket", false0,
10946 session_hash, &ssl->session_ticket);
10947 }
10948 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
10949 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
10950 ssl->session_ticket.data, ticket_len);
10951 ssl->session_ticket.data_len = ticket_len;
10952 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
10953 /* NewSessionTicket is received after the first (client)
10954 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
10955 * Since the second CCS has already the session key available it will
10956 * just return. To ensure that the session ticket is mapped to a
10957 * master key (from the first CCS), save the ticket here too. */
10958 ssl_save_master_key("Session Ticket", session_hash,
10959 &ssl->session_ticket, &ssl->master_secret);
10960 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
10961 }
10962 offset += ticket_len;
10963
10964 if (is_tls13) {
10965 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
10966 offset_end, SSL_HND_NEWSESSION_TICKET,
10967 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
10968 }
10969} /* }}} */
10970
10971void
10972ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10973 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10974 SslSession *session, SslDecryptSession *ssl,
10975 bool_Bool is_dtls)
10976{
10977 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
10978 * struct {
10979 * ProtocolVersion server_version;
10980 * CipherSuite cipher_suite; // not before draft -19
10981 * Extension extensions<2..2^16-1>;
10982 * } HelloRetryRequest;
10983 * Note: no longer used since draft -22
10984 */
10985 uint32_t version;
10986 uint8_t draft_version;
10987
10988 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10989 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
10990 draft_version = extract_tls13_draft_version(version);
10991 offset += 2;
10992
10993 if (draft_version == 0 || draft_version >= 19) {
10994 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
10995 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10996 offset += 2;
10997 }
10998
10999 /* We assume that there's nothing out there that supports only TLS 1.3
11000 * draft-22 but also Encrypted Client Hello, or else we should set the
11001 * cipher suite and call tls_calculate_ech_handshake_hash here. */
11002 if (ssl) {
11003 ssl->state |= SSL_HELLO_RETRY_REQUEST(1<<14);
11004 }
11005
11006 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11007 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11008 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11009}
11010
11011void
11012ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11013 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11014 SslSession *session, SslDecryptSession *ssl,
11015 bool_Bool is_dtls)
11016{
11017 /* RFC 8446 Section 4.3.1
11018 * struct {
11019 * Extension extensions<0..2^16-1>;
11020 * } EncryptedExtensions;
11021 */
11022 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11023 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11024 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11025}
11026
11027/* Certificate and Certificate Request dissections. {{{ */
11028void
11029ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11030 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11031 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11032 bool_Bool is_from_server, bool_Bool is_dtls)
11033{
11034 /* opaque ASN.1Cert<1..2^24-1>;
11035 *
11036 * Before RFC 8446 (TLS <= 1.2):
11037 * struct {
11038 * select(certificate_type) {
11039 *
11040 * // certificate type defined in RFC 7250
11041 * case RawPublicKey:
11042 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11043 *
11044 * // X.509 certificate defined in RFC 5246
11045 * case X.509:
11046 * ASN.1Cert certificate_list<0..2^24-1>;
11047 * };
11048 * } Certificate;
11049 *
11050 * RFC 8446 (since draft -20):
11051 * struct {
11052 * select(certificate_type){
11053 * case RawPublicKey:
11054 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11055 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11056 *
11057 * case X.509:
11058 * opaque cert_data<1..2^24-1>;
11059 * }
11060 * Extension extensions<0..2^16-1>;
11061 * } CertificateEntry;
11062 * struct {
11063 * opaque certificate_request_context<0..2^8-1>;
11064 * CertificateEntry certificate_list<0..2^24-1>;
11065 * } Certificate;
11066 */
11067 enum { CERT_X509, CERT_RPK } cert_type;
11068 asn1_ctx_t asn1_ctx;
11069#if defined(HAVE_LIBGNUTLS1)
11070 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11071 unsigned certificate_index = 0;
11072#endif
11073 uint32_t next_offset, certificate_list_length, cert_length;
11074 proto_tree *subtree = tree;
11075
11076 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11077
11078 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11079 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11080 cert_type = CERT_RPK;
11081 } else {
11082 cert_type = CERT_X509;
11083 }
11084
11085#if defined(HAVE_LIBGNUTLS1)
11086 /* Ask the pkcs1 dissector to return the public key details */
11087 if (ssl)
11088 asn1_ctx.private_data = &subjectPublicKeyInfo;
11089#endif
11090
11091 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11092 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11093 uint32_t context_length;
11094 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11095 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11096 return;
11097 }
11098 offset++;
11099 if (context_length > 0) {
11100 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11101 tvb, offset, context_length, ENC_NA0x00000000);
11102 offset += context_length;
11103 }
11104 }
11105
11106 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11107 /* For RPK before TLS 1.3, the single RPK is stored directly without
11108 * another "certificate_list" field. */
11109 certificate_list_length = offset_end - offset;
11110 next_offset = offset_end;
11111 } else {
11112 /* CertificateEntry certificate_list<0..2^24-1> */
11113 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11114 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11115 return;
11116 }
11117 offset += 3; /* 24-bit length value */
11118 next_offset = offset + certificate_list_length;
11119 }
11120
11121 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11122 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11123 proto_item *ti;
11124
11125 ti = proto_tree_add_none_format(tree,
11126 hf->hf.hs_certificates,
11127 tvb, offset, certificate_list_length,
11128 "Certificates (%u bytes)",
11129 certificate_list_length);
11130
11131 /* make it a subtree */
11132 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11133 }
11134
11135 while (offset < next_offset) {
11136 switch (cert_type) {
11137 case CERT_RPK:
11138 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11139 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11140 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11141 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11142 return;
11143 }
11144 offset += 3;
11145
11146 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11147 offset += cert_length;
11148 break;
11149 case CERT_X509:
11150 /* opaque ASN1Cert<1..2^24-1> */
11151 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11152 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11153 return;
11154 }
11155 offset += 3;
11156
11157 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11158#if defined(HAVE_LIBGNUTLS1)
11159 if (is_from_server && ssl && certificate_index == 0) {
11160 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11161 /* Only attempt to get the RSA modulus for the first cert. */
11162 asn1_ctx.private_data = NULL((void*)0);
11163 }
11164#endif
11165 offset += cert_length;
11166 break;
11167 }
11168
11169 /* TLS 1.3: Extension extensions<0..2^16-1> */
11170 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11171 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11172 next_offset, SSL_HND_CERTIFICATE,
11173 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11174 }
11175
11176#if defined(HAVE_LIBGNUTLS1)
11177 certificate_index++;
11178#endif
11179 }
11180}
11181
11182void
11183ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11184 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11185 SslSession *session, bool_Bool is_dtls)
11186{
11187 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11188 * enum {
11189 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11190 * (255)
11191 * } ClientCertificateType;
11192 *
11193 * opaque DistinguishedName<1..2^16-1>;
11194 *
11195 * struct {
11196 * ClientCertificateType certificate_types<1..2^8-1>;
11197 * DistinguishedName certificate_authorities<3..2^16-1>;
11198 * } CertificateRequest;
11199 *
11200 *
11201 * As per TLSv1.2 (RFC 5246) the format has changed to:
11202 *
11203 * enum {
11204 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11205 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11206 * fortezza_dms_RESERVED(20), (255)
11207 * } ClientCertificateType;
11208 *
11209 * enum {
11210 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11211 * sha512(6), (255)
11212 * } HashAlgorithm;
11213 *
11214 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11215 * SignatureAlgorithm;
11216 *
11217 * struct {
11218 * HashAlgorithm hash;
11219 * SignatureAlgorithm signature;
11220 * } SignatureAndHashAlgorithm;
11221 *
11222 * SignatureAndHashAlgorithm
11223 * supported_signature_algorithms<2..2^16-2>;
11224 *
11225 * opaque DistinguishedName<1..2^16-1>;
11226 *
11227 * struct {
11228 * ClientCertificateType certificate_types<1..2^8-1>;
11229 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11230 * DistinguishedName certificate_authorities<0..2^16-1>;
11231 * } CertificateRequest;
11232 *
11233 * draft-ietf-tls-tls13-18:
11234 * struct {
11235 * opaque certificate_request_context<0..2^8-1>;
11236 * SignatureScheme
11237 * supported_signature_algorithms<2..2^16-2>;
11238 * DistinguishedName certificate_authorities<0..2^16-1>;
11239 * CertificateExtension certificate_extensions<0..2^16-1>;
11240 * } CertificateRequest;
11241 *
11242 * RFC 8446 (since draft-ietf-tls-tls13-19):
11243 *
11244 * struct {
11245 * opaque certificate_request_context<0..2^8-1>;
11246 * Extension extensions<2..2^16-1>;
11247 * } CertificateRequest;
11248 */
11249 proto_item *ti;
11250 proto_tree *subtree;
11251 uint32_t next_offset;
11252 asn1_ctx_t asn1_ctx;
11253 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11254 unsigned char draft_version = session->tls13_draft_version;
11255
11256 if (!tree)
11257 return;
11258
11259 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11260
11261 if (is_tls13) {
11262 uint32_t context_length;
11263 /* opaque certificate_request_context<0..2^8-1> */
11264 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11265 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11266 return;
11267 }
11268 offset++;
11269 if (context_length > 0) {
11270 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11271 tvb, offset, context_length, ENC_NA0x00000000);
11272 offset += context_length;
11273 }
11274 } else {
11275 uint32_t cert_types_count;
11276 /* ClientCertificateType certificate_types<1..2^8-1> */
11277 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11278 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11279 return;
11280 }
11281 offset++;
11282 next_offset = offset + cert_types_count;
11283
11284 ti = proto_tree_add_none_format(tree,
11285 hf->hf.hs_cert_types,
11286 tvb, offset, cert_types_count,
11287 "Certificate types (%u type%s)",
11288 cert_types_count,
11289 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11290 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11291
11292 while (offset < next_offset) {
11293 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11294 offset++;
11295 }
11296 }
11297
11298 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11299 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11300 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11301 }
11302
11303 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11304 /*
11305 * TLS 1.3 draft 19 and newer: Extensions.
11306 * SslDecryptSession pointer is NULL because Certificate Extensions
11307 * should not influence decryption state.
11308 */
11309 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11310 offset_end, SSL_HND_CERT_REQUEST,
11311 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0));
11312 } else if (is_tls13 && draft_version <= 18) {
11313 /*
11314 * TLS 1.3 draft 18 and older: certificate_authorities and
11315 * certificate_extensions (a vector of OID mappings).
11316 */
11317 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11318 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11319 } else {
11320 /* for TLS 1.2 and older, the certificate_authorities field. */
11321 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11322 }
11323}
11324/* Certificate and Certificate Request dissections. }}} */
11325
11326void
11327ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11328 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11329{
11330 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11331 hf->hf.hs_client_cert_vrfy_sig_len,
11332 hf->hf.hs_client_cert_vrfy_sig);
11333}
11334
11335/* Finished dissection. {{{ */
11336void
11337ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11338 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11339 const SslSession *session, ssl_hfs_t *ssl_hfs)
11340{
11341 /* For SSLv3:
11342 * struct {
11343 * opaque md5_hash[16];
11344 * opaque sha_hash[20];
11345 * } Finished;
11346 *
11347 * For (D)TLS:
11348 * struct {
11349 * opaque verify_data[12];
11350 * } Finished;
11351 *
11352 * For TLS 1.3:
11353 * struct {
11354 * opaque verify_data[Hash.length];
11355 * }
11356 */
11357 if (!tree)
11358 return;
11359
11360 if (session->version == SSLV3_VERSION0x300) {
11361 if (ssl_hfs != NULL((void*)0)) {
11362 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11363 tvb, offset, 16, ENC_NA0x00000000);
11364 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11365 tvb, offset + 16, 20, ENC_NA0x00000000);
11366 }
11367 } else {
11368 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11369 proto_tree_add_item(tree, hf->hf.hs_finished,
11370 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11371 }
11372} /* }}} */
11373
11374/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11375void
11376ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11377{
11378 uint16_t url_hash_len;
11379
11380 /* enum {
11381 * individual_certs(0), pkipath(1), (255)
11382 * } CertChainType;
11383 *
11384 * struct {
11385 * CertChainType type;
11386 * URLAndHash url_and_hash_list<1..2^16-1>;
11387 * } CertificateURL;
11388 *
11389 * struct {
11390 * opaque url<1..2^16-1>;
11391 * uint8 padding;
11392 * opaque SHA1Hash[20];
11393 * } URLAndHash;
11394 */
11395
11396 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11397 tvb, offset, 1, ENC_NA0x00000000);
11398 offset++;
11399
11400 url_hash_len = tvb_get_ntohs(tvb, offset);
11401 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11402 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11403 offset += 2;
11404 while (url_hash_len-- > 0) {
11405 proto_item *urlhash_item;
11406 proto_tree *urlhash_tree;
11407 uint16_t url_len;
11408
11409 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11410 tvb, offset, -1, ENC_NA0x00000000);
11411 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11412
11413 url_len = tvb_get_ntohs(tvb, offset);
11414 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11415 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11416 offset += 2;
11417
11418 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11419 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11420 offset += url_len;
11421
11422 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11423 tvb, offset, 1, ENC_NA0x00000000);
11424 offset++;
11425 /* Note: RFC 6066 says that padding must be 0x01 */
11426
11427 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11428 tvb, offset, 20, ENC_NA0x00000000);
11429 offset += 20;
11430 }
11431} /* }}} */
11432
11433void
11434ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11435 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11436 SslSession *session, SslDecryptSession *ssl,
11437 bool_Bool is_from_server, bool_Bool is_dtls)
11438{
11439 uint32_t algorithm, uncompressed_length;
11440 uint32_t compressed_certificate_message_length;
11441 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11442 proto_item *ti;
11443 /*
11444 * enum {
11445 * zlib(1),
11446 * brotli(2),
11447 * zstd(3),
11448 * (65535)
11449 * } CertificateCompressionAlgorithm;
11450 *
11451 * struct {
11452 * CertificateCompressionAlgorithm algorithm;
11453 * uint24 uncompressed_length;
11454 * opaque compressed_certificate_message<1..2^24-1>;
11455 * } CompressedCertificate;
11456 */
11457
11458 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11459 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11460 offset += 2;
11461
11462 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11463 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11464 offset += 3;
11465
11466 /* opaque compressed_certificate_message<1..2^24-1>; */
11467 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11468 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11469 return;
11470 }
11471 offset += 3;
11472
11473 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11474 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11475
11476 /* Certificate decompression following algorithm */
11477 switch (algorithm) {
11478 case 1: /* zlib */
11479 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11480 break;
11481 case 2: /* brotli */
11482 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11483 break;
11484 case 3: /* zstd */
11485 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11486 break;
11487 }
11488
11489 if (uncompressed_tvb) {
11490 proto_tree *uncompressed_tree;
11491
11492 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11493 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11494 tvb, offset, offset_end - offset,
11495 "Invalid uncompressed length %u (expected %u)",
11496 tvb_captured_length(uncompressed_tvb),
11497 uncompressed_length);
11498 } else {
11499 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11500 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11501 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11502 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11503 }
11504 }
11505}
11506
11507/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11508static int
11509// NOLINTNEXTLINE(misc-no-recursion)
11510ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11511 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11512 SslSession *session, SslDecryptSession *ssl,
11513 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11514 ssl_master_key_map_t *mk_map)
11515{
11516 uint32_t exts_len;
11517 uint16_t ext_type;
11518 uint32_t ext_len;
11519 uint32_t next_offset;
11520 proto_item *ext_item;
11521 proto_tree *ext_tree;
11522 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11523 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11524 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11525 char *ja3_dash = "";
11526 unsigned supported_version;
11527
11528 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11529 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11530 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11531 return offset_end;
11532 }
11533 offset += 2;
11534 offset_end = offset + exts_len;
11535
11536 if (ja4_data) {
11537 ja4_data->num_extensions = 0;
11538 }
11539 while (offset_end - offset >= 4)
11540 {
11541 ext_type = tvb_get_ntohs(tvb, offset);
11542 ext_len = tvb_get_ntohs(tvb, offset + 2);
11543
11544 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11545 ja4_data->num_extensions += 1;
11546 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11547 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11548 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11549 }
11550 }
11551
11552 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11553 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11554 tls_hello_extension_types,
11555 "Unknown type %u"), ext_len);
11556 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11557
11558 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11559 tvb, offset, 2, ext_type);
11560 offset += 2;
11561 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))) {
11562 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11563 ja3_dash = "-";
11564 }
11565
11566 /* opaque extension_data<0..2^16-1> */
11567 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11568 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11569 return offset_end;
11570 }
11571 offset += 2;
11572 next_offset = offset + ext_len;
11573
11574 switch (ext_type) {
11575 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11576 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11577 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11578 if (ja4_data) {
11579 ja4_data->server_name_present = true1;
11580 }
11581 }
11582 break;
11583 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11584 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11585 offset += 1;
11586 break;
11587 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11588 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11589 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11590 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11591 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11592 }
11593 break;
11594 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11595 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11596 offset, next_offset,
11597 hnd_type, ext_type,
11598 session);
11599 break;
11600 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11601 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11602 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11603 next_offset, ja3_sg);
11604 } else {
11605 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11606 next_offset, NULL((void*)0));
11607 }
11608 break;
11609 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11610 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11611 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11612 } else {
11613 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11614 }
11615 break;
11616 case SSL_HND_HELLO_EXT_SRP12:
11617 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11618 break;
11619 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11620 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11621 break;
11622 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11623 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11624 break;
11625 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11626 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11627 break;
11628 case SSL_HND_HELLO_EXT_USE_SRTP14:
11629 if (is_dtls) {
11630 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11631 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11632 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11633 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11634 }
11635 } else {
11636 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11637 }
11638 break;
11639 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11640 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11641 break;
11642 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11643 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map);
11644 break;
11645 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11646 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11647 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11648 offset++;
11649 break;
11650 case SSL_HND_HELLO_EXT_ALPN16:
11651 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11652 break;
11653 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11654 if (hnd_type == SSL_HND_CLIENT_HELLO)
11655 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11656 break;
11657 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11658 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11659 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11660 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11661 break;
11662 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11663 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11664 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11665 offset, next_offset,
11666 hnd_type, ext_type,
11667 session);
11668 break;
11669 case SSL_HND_HELLO_EXT_PADDING21:
11670 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11671 offset += ext_len;
11672 break;
11673 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11674 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11675 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11676 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11677 }
11678 break;
11679 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11680 if (ssl) {
11681 switch (hnd_type) {
11682 case SSL_HND_CLIENT_HELLO:
11683 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11684 break;
11685 case SSL_HND_SERVER_HELLO:
11686 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11687 break;
11688 default: /* no default */
11689 break;
11690 }
11691 }
11692 break;
11693 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11694 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11695 break;
11696 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11697 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11698 break;
11699 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11700 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11701 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11702 offset += 2;
11703 break;
11704 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11705 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11706 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11707 break;
11708 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11709 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11710 break;
11711 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11712 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11713 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11714 break;
11715 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11716 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11717 break;
11718 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11719 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11720 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11721 break;
11722 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11723 switch (hnd_type) {
11724 case SSL_HND_CLIENT_HELLO:
11725 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11726 break;
11727 case SSL_HND_SERVER_HELLO:
11728 case SSL_HND_HELLO_RETRY_REQUEST:
11729 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11730 offset += 2;
11731 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11732 break;
11733 }
11734 break;
11735 case SSL_HND_HELLO_EXT_COOKIE44:
11736 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11737 break;
11738 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11739 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11740 break;
11741 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11742 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11743 break;
11744 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11745 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11746 break;
11747 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11748 break;
11749 case SSL_HND_HELLO_EXT_NPN13172:
11750 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11751 break;
11752 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11753 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11754 break;
11755 case SSL_HND_HELLO_EXT_ALPS17613:
11756 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11757 break;
11758 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11759 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11760 break;
11761 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11762 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11763 break;
11764 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11765 session->deprecated_cid = true1;
11766 /* FALLTHRU */
11767 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11768 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11769 break;
11770 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11771 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11772 break;
11773 default:
11774 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11775 tvb, offset, ext_len, ENC_NA0x00000000);
11776 offset += ext_len;
11777 break;
11778 }
11779
11780 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11781 /* Dissection did not end at expected location, fix it. */
11782 offset = next_offset;
11783 }
11784 }
11785
11786 if (ja3) {
11787 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11788 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11789 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11790 } else {
11791 wmem_strbuf_append_c(ja3, ',');
11792 }
11793 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11794 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11795 } else {
11796 wmem_strbuf_append_c(ja3, ',');
11797 }
11798 }
11799 }
11800
11801 /* Check if Extensions vector is correctly terminated. */
11802 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11803 offset = offset_end;
11804 }
11805
11806 return offset;
11807} /* }}} */
11808
11809
11810/* ClientKeyExchange algo-specific dissectors. {{{ */
11811
11812static void
11813dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11814 proto_tree *tree, uint32_t offset,
11815 uint32_t length)
11816{
11817 int point_len;
11818 proto_tree *ssl_ecdh_tree;
11819
11820 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11821 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
11822
11823 /* point */
11824 point_len = tvb_get_uint8(tvb, offset);
11825 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
11826 offset, 1, ENC_BIG_ENDIAN0x00000000);
11827 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
11828 offset + 1, point_len, ENC_NA0x00000000);
11829}
11830
11831static void
11832dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11833 proto_tree *tree, uint32_t offset, uint32_t length)
11834{
11835 int yc_len;
11836 proto_tree *ssl_dh_tree;
11837
11838 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11839 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
11840
11841 /* ClientDiffieHellmanPublic.dh_public (explicit) */
11842 yc_len = tvb_get_ntohs(tvb, offset);
11843 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
11844 offset, 2, ENC_BIG_ENDIAN0x00000000);
11845 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
11846 offset + 2, yc_len, ENC_NA0x00000000);
11847}
11848
11849static void
11850dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11851 proto_tree *tree, uint32_t offset,
11852 uint32_t length, const SslSession *session)
11853{
11854 int epms_len;
11855 proto_tree *ssl_rsa_tree;
11856
11857 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11858 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
11859
11860 /* EncryptedPreMasterSecret.pre_master_secret */
11861 switch (session->version) {
11862 case SSLV2_VERSION0x0002:
11863 case SSLV3_VERSION0x300:
11864 case DTLSV1DOT0_OPENSSL_VERSION0x100:
11865 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
11866 * not present. The handshake contents represents the EPMS, see:
11867 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
11868 epms_len = length;
11869 break;
11870
11871 default:
11872 /* TLS and DTLS include vector length before EPMS */
11873 epms_len = tvb_get_ntohs(tvb, offset);
11874 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11875 offset, 2, ENC_BIG_ENDIAN0x00000000);
11876 offset += 2;
11877 break;
11878 }
11879 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
11880 offset, epms_len, ENC_NA0x00000000);
11881}
11882
11883/* Used in PSK cipher suites */
11884static uint32_t
11885dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11886 proto_tree *tree, uint32_t offset)
11887{
11888 unsigned identity_len;
11889 proto_tree *ssl_psk_tree;
11890
11891 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
11892 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
11893 /* identity */
11894 identity_len = tvb_get_ntohs(tvb, offset);
11895 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
11896 offset, 2, ENC_BIG_ENDIAN0x00000000);
11897 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
11898 offset + 2, identity_len, ENC_NA0x00000000);
11899
11900 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
11901 return 2 + identity_len;
11902}
11903
11904/* Used in RSA PSK cipher suites */
11905static void
11906dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11907 proto_tree *tree, uint32_t offset,
11908 uint32_t length)
11909{
11910 int identity_len, epms_len;
11911 proto_tree *ssl_psk_tree;
11912
11913 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
11914 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
11915
11916 /* identity */
11917 identity_len = tvb_get_ntohs(tvb, offset);
11918 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
11919 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11920 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
11921 tvb, offset + 2, identity_len, ENC_NA0x00000000);
11922 offset += 2 + identity_len;
11923
11924 /* Yc */
11925 epms_len = tvb_get_ntohs(tvb, offset);
11926 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
11927 offset, 2, ENC_BIG_ENDIAN0x00000000);
11928 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
11929 offset + 2, epms_len, ENC_NA0x00000000);
11930}
11931
11932/* Used in Diffie-Hellman PSK cipher suites */
11933static void
11934dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11935 proto_tree *tree, uint32_t offset, uint32_t length)
11936{
11937 /*
11938 * struct {
11939 * select (KeyExchangeAlgorithm) {
11940 * case diffie_hellman_psk:
11941 * opaque psk_identity<0..2^16-1>;
11942 * ClientDiffieHellmanPublic public;
11943 * } exchange_keys;
11944 * } ClientKeyExchange;
11945 */
11946
11947 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11948 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
11949}
11950
11951/* Used in EC Diffie-Hellman PSK cipher suites */
11952static void
11953dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11954 proto_tree *tree, uint32_t offset, uint32_t length)
11955{
11956 /*
11957 * struct {
11958 * select (KeyExchangeAlgorithm) {
11959 * case ec_diffie_hellman_psk:
11960 * opaque psk_identity<0..2^16-1>;
11961 * ClientECDiffieHellmanPublic public;
11962 * } exchange_keys;
11963 * } ClientKeyExchange;
11964 */
11965
11966 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
11967 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
11968}
11969
11970/* Used in EC J-PAKE cipher suites */
11971static void
11972dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11973 proto_tree *tree, uint32_t offset,
11974 uint32_t length)
11975{
11976 /*
11977 * struct {
11978 * ECPoint V;
11979 * opaque r<1..2^8-1>;
11980 * } ECSchnorrZKP;
11981 *
11982 * struct {
11983 * ECPoint X;
11984 * ECSchnorrZKP zkp;
11985 * } ECJPAKEKeyKP;
11986 *
11987 * struct {
11988 * ECJPAKEKeyKP ecjpake_key_kp;
11989 * } ClientECJPAKEParams;
11990 *
11991 * select (KeyExchangeAlgorithm) {
11992 * case ecjpake:
11993 * ClientECJPAKEParams params;
11994 * } ClientKeyExchange;
11995 */
11996
11997 int point_len;
11998 proto_tree *ssl_ecjpake_tree;
11999
12000 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12001 hf->ett.keyex_params, NULL((void*)0),
12002 "EC J-PAKE Client Params");
12003
12004 /* ECJPAKEKeyKP.X */
12005 point_len = tvb_get_uint8(tvb, offset);
12006 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12007 offset, 1, ENC_BIG_ENDIAN0x00000000);
12008 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12009 offset + 1, point_len, ENC_NA0x00000000);
12010 offset += 1 + point_len;
12011
12012 /* ECJPAKEKeyKP.zkp.V */
12013 point_len = tvb_get_uint8(tvb, offset);
12014 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12015 offset, 1, ENC_BIG_ENDIAN0x00000000);
12016 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12017 offset + 1, point_len, ENC_NA0x00000000);
12018 offset += 1 + point_len;
12019
12020 /* ECJPAKEKeyKP.zkp.r */
12021 point_len = tvb_get_uint8(tvb, offset);
12022 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12023 offset, 1, ENC_BIG_ENDIAN0x00000000);
12024 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12025 offset + 1, point_len, ENC_NA0x00000000);
12026}
12027
12028static void
12029dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12030 proto_tree *tree, uint32_t offset,
12031 uint32_t length)
12032{
12033 int epms_len;
12034 proto_tree *ssl_ecc_sm2_tree;
12035
12036 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12037 hf->ett.keyex_params, NULL((void*)0),
12038 "ECC-SM2 Encrypted PreMaster Secret");
12039
12040 epms_len = tvb_get_ntohs(tvb, offset);
12041 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12042 offset, 2, ENC_BIG_ENDIAN0x00000000);
12043 offset += 2;
12044 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12045 offset, epms_len, ENC_NA0x00000000);
12046}
12047/* ClientKeyExchange algo-specific dissectors. }}} */
12048
12049
12050/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12051static uint32_t
12052ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12053 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12054 uint16_t version, int hf_sig_len, int hf_sig)
12055{
12056 uint32_t sig_len;
12057
12058 switch (version) {
12059 case TLSV1DOT2_VERSION0x303:
12060 case DTLSV1DOT2_VERSION0xfefd:
12061 case TLSV1DOT3_VERSION0x304:
12062 case DTLSV1DOT3_VERSION0xfefc:
12063 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12064 offset += 2;
12065 break;
12066
12067 default:
12068 break;
12069 }
12070
12071 /* Sig */
12072 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12073 hf_sig_len, 0, UINT16_MAX(65535))) {
12074 return offset_end;
12075 }
12076 offset += 2;
12077 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12078 offset += sig_len;
12079 return offset;
12080} /* }}} */
12081
12082/* ServerKeyExchange algo-specific dissectors. {{{ */
12083
12084/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12085static void
12086dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12087 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12088 uint16_t version)
12089{
12090 /*
12091 * TLSv1.2 (RFC 5246 sec 7.4.8)
12092 * struct {
12093 * digitally-signed struct {
12094 * opaque handshake_messages[handshake_messages_length];
12095 * }
12096 * } CertificateVerify;
12097 *
12098 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12099 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12100 *
12101 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12102 * does more hashing including the master secret and padding.
12103 */
12104 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12105 hf->hf.hs_server_keyex_sig_len,
12106 hf->hf.hs_server_keyex_sig);
12107}
12108
12109static uint32_t
12110dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12111{
12112 /*
12113 * RFC 4492 ECC cipher suites for TLS
12114 *
12115 * struct {
12116 * ECCurveType curve_type;
12117 * select (curve_type) {
12118 * case explicit_prime:
12119 * ...
12120 * case explicit_char2:
12121 * ...
12122 * case named_curve:
12123 * NamedCurve namedcurve;
12124 * };
12125 * } ECParameters;
12126 */
12127
12128 int curve_type;
12129
12130 /* ECParameters.curve_type */
12131 curve_type = tvb_get_uint8(tvb, offset);
12132 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12133 offset, 1, ENC_BIG_ENDIAN0x00000000);
12134 offset++;
12135
12136 if (curve_type != 3)
12137 return offset_end; /* only named_curves are supported */
12138
12139 /* case curve_type == named_curve; ECParameters.namedcurve */
12140 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12141 offset, 2, ENC_BIG_ENDIAN0x00000000);
12142 offset += 2;
12143
12144 return offset;
12145}
12146
12147static void
12148dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12149 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12150 uint16_t version, bool_Bool anon)
12151{
12152 /*
12153 * RFC 4492 ECC cipher suites for TLS
12154 *
12155 * struct {
12156 * opaque point <1..2^8-1>;
12157 * } ECPoint;
12158 *
12159 * struct {
12160 * ECParameters curve_params;
12161 * ECPoint public;
12162 * } ServerECDHParams;
12163 *
12164 * select (KeyExchangeAlgorithm) {
12165 * case ec_diffie_hellman:
12166 * ServerECDHParams params;
12167 * Signature signed_params;
12168 * } ServerKeyExchange;
12169 */
12170
12171 int point_len;
12172 proto_tree *ssl_ecdh_tree;
12173
12174 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12175 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12176
12177 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12178 if (offset >= offset_end)
12179 return; /* only named_curves are supported */
12180
12181 /* ECPoint.point */
12182 point_len = tvb_get_uint8(tvb, offset);
12183 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12184 offset, 1, ENC_BIG_ENDIAN0x00000000);
12185 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12186 offset + 1, point_len, ENC_NA0x00000000);
12187 offset += 1 + point_len;
12188
12189 /* Signature (if non-anonymous KEX) */
12190 if (!anon) {
12191 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12192 }
12193}
12194
12195static void
12196dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12197 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12198 uint16_t version, bool_Bool anon)
12199{
12200 int p_len, g_len, ys_len;
12201 proto_tree *ssl_dh_tree;
12202
12203 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12204 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12205
12206 /* p */
12207 p_len = tvb_get_ntohs(tvb, offset);
12208 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12209 offset, 2, ENC_BIG_ENDIAN0x00000000);
12210 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12211 offset + 2, p_len, ENC_NA0x00000000);
12212 offset += 2 + p_len;
12213
12214 /* g */
12215 g_len = tvb_get_ntohs(tvb, offset);
12216 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12217 offset, 2, ENC_BIG_ENDIAN0x00000000);
12218 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12219 offset + 2, g_len, ENC_NA0x00000000);
12220 offset += 2 + g_len;
12221
12222 /* Ys */
12223 ys_len = tvb_get_ntohs(tvb, offset);
12224 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12225 offset, 2, ys_len);
12226 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12227 offset + 2, ys_len, ENC_NA0x00000000);
12228 offset += 2 + ys_len;
12229
12230 /* Signature (if non-anonymous KEX) */
12231 if (!anon) {
12232 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12233 }
12234}
12235
12236/* Only used in RSA-EXPORT cipher suites */
12237static void
12238dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12239 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12240 uint16_t version)
12241{
12242 int modulus_len, exponent_len;
12243 proto_tree *ssl_rsa_tree;
12244
12245 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12246 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12247
12248 /* modulus */
12249 modulus_len = tvb_get_ntohs(tvb, offset);
12250 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12251 offset, 2, ENC_BIG_ENDIAN0x00000000);
12252 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12253 offset + 2, modulus_len, ENC_NA0x00000000);
12254 offset += 2 + modulus_len;
12255
12256 /* exponent */
12257 exponent_len = tvb_get_ntohs(tvb, offset);
12258 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12259 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12260 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12261 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12262 offset += 2 + exponent_len;
12263
12264 /* Signature */
12265 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12266}
12267
12268/* Used in RSA PSK and PSK cipher suites */
12269static uint32_t
12270dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12271 proto_tree *tree, uint32_t offset)
12272{
12273 unsigned hint_len;
12274 proto_tree *ssl_psk_tree;
12275
12276 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12277 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12278
12279 /* hint */
12280 hint_len = tvb_get_ntohs(tvb, offset);
12281 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12282 offset, 2, ENC_BIG_ENDIAN0x00000000);
12283 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12284 offset + 2, hint_len, ENC_NA0x00000000);
12285
12286 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12287 return 2 + hint_len;
12288}
12289
12290/* Used in Diffie-Hellman PSK cipher suites */
12291static void
12292dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12293 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12294{
12295 /*
12296 * struct {
12297 * select (KeyExchangeAlgorithm) {
12298 * case diffie_hellman_psk:
12299 * opaque psk_identity_hint<0..2^16-1>;
12300 * ServerDHParams params;
12301 * };
12302 * } ServerKeyExchange;
12303 */
12304
12305 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12306 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12307}
12308
12309/* Used in EC Diffie-Hellman PSK cipher suites */
12310static void
12311dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12312 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12313{
12314 /*
12315 * struct {
12316 * select (KeyExchangeAlgorithm) {
12317 * case ec_diffie_hellman_psk:
12318 * opaque psk_identity_hint<0..2^16-1>;
12319 * ServerECDHParams params;
12320 * };
12321 * } ServerKeyExchange;
12322 */
12323
12324 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12325 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12326}
12327
12328/* Used in EC J-PAKE cipher suites */
12329static void
12330dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12331 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12332{
12333 /*
12334 * struct {
12335 * ECPoint V;
12336 * opaque r<1..2^8-1>;
12337 * } ECSchnorrZKP;
12338 *
12339 * struct {
12340 * ECPoint X;
12341 * ECSchnorrZKP zkp;
12342 * } ECJPAKEKeyKP;
12343 *
12344 * struct {
12345 * ECParameters curve_params;
12346 * ECJPAKEKeyKP ecjpake_key_kp;
12347 * } ServerECJPAKEParams;
12348 *
12349 * select (KeyExchangeAlgorithm) {
12350 * case ecjpake:
12351 * ServerECJPAKEParams params;
12352 * } ServerKeyExchange;
12353 */
12354
12355 int point_len;
12356 proto_tree *ssl_ecjpake_tree;
12357
12358 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12359 hf->ett.keyex_params, NULL((void*)0),
12360 "EC J-PAKE Server Params");
12361
12362 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12363 if (offset >= offset_end)
12364 return; /* only named_curves are supported */
12365
12366 /* ECJPAKEKeyKP.X */
12367 point_len = tvb_get_uint8(tvb, offset);
12368 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12369 offset, 1, ENC_BIG_ENDIAN0x00000000);
12370 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12371 offset + 1, point_len, ENC_NA0x00000000);
12372 offset += 1 + point_len;
12373
12374 /* ECJPAKEKeyKP.zkp.V */
12375 point_len = tvb_get_uint8(tvb, offset);
12376 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12377 offset, 1, ENC_BIG_ENDIAN0x00000000);
12378 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12379 offset + 1, point_len, ENC_NA0x00000000);
12380 offset += 1 + point_len;
12381
12382 /* ECJPAKEKeyKP.zkp.r */
12383 point_len = tvb_get_uint8(tvb, offset);
12384 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12385 offset, 1, ENC_BIG_ENDIAN0x00000000);
12386 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12387 offset + 1, point_len, ENC_NA0x00000000);
12388}
12389
12390/* Only used in ECC-SM2-EXPORT cipher suites */
12391static void
12392dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12393 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12394 uint16_t version)
12395{
12396 proto_tree *ssl_ecc_sm2_tree;
12397
12398 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12399 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12400
12401 /* Signature */
12402 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12403}
12404/* ServerKeyExchange algo-specific dissectors. }}} */
12405
12406/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12407void
12408ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12409 proto_tree *tree, uint32_t offset, uint32_t length,
12410 const SslSession *session)
12411{
12412 switch (ssl_get_keyex_alg(session->cipher)) {
12413 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12414 case KEX_DH_DSS0x14:
12415 case KEX_DH_RSA0x15:
12416 case KEX_DHE_DSS0x10:
12417 case KEX_DHE_RSA0x12:
12418 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12419 break;
12420 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12421 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12422 break;
12423 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12424 case KEX_ECDH_ECDSA0x1a:
12425 case KEX_ECDH_RSA0x1b:
12426 case KEX_ECDHE_ECDSA0x16:
12427 case KEX_ECDHE_RSA0x18:
12428 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12429 break;
12430 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12431 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12432 break;
12433 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12434 /* XXX: implement support for KRB5 */
12435 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12436 tvb, offset, length,
12437 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12438 " developers if you want them to be supported");
12439 break;
12440 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12441 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12442 break;
12443 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12444 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12445 break;
12446 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12447 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12448 break;
12449 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12450 case KEX_SRP_SHA_DSS0x21:
12451 case KEX_SRP_SHA_RSA0x22:
12452 /* XXX: implement support for SRP_SHA* */
12453 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12454 tvb, offset, length,
12455 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12456 " developers if you want them to be supported");
12457 break;
12458 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12459 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12460 break;
12461 case KEX_ECC_SM20x26: /* GB/T 38636 */
12462 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12463 break;
12464 default:
12465 if (session->cipher == 0) {
12466 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12467 tvb, offset, length,
12468 "Cipher Suite not found");
12469 } else {
12470 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12471 tvb, offset, length,
12472 "Cipher Suite 0x%04x is not implemented, "
12473 "contact Wireshark developers if you want this to be supported",
12474 session->cipher);
12475 }
12476 break;
12477 }
12478}
12479
12480void
12481ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12482 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12483 const SslSession *session)
12484{
12485 switch (ssl_get_keyex_alg(session->cipher)) {
12486 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12487 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12488 break;
12489 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12490 case KEX_DH_RSA0x15:
12491 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12492 tvb, offset, offset_end - offset);
12493 break;
12494 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12495 case KEX_DHE_RSA0x12:
12496 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12497 break;
12498 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12499 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12500 break;
12501 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12502 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12503 break;
12504 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12505 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12506 break;
12507 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12508 case KEX_ECDH_RSA0x1b:
12509 case KEX_ECDHE_ECDSA0x16:
12510 case KEX_ECDHE_RSA0x18:
12511 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12512 break;
12513 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12514 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12515 tvb, offset, offset_end - offset);
12516 break;
12517 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12518 case KEX_RSA_PSK0x1f:
12519 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12520 break;
12521 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12522 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12523 break;
12524 case KEX_ECC_SM20x26: /* GB/T 38636 */
12525 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12526 break;
12527 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12528 case KEX_SRP_SHA_DSS0x21:
12529 case KEX_SRP_SHA_RSA0x22:
12530 /* XXX: implement support for SRP_SHA* */
12531 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12532 tvb, offset, offset_end - offset,
12533 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12534 " developers if you want them to be supported");
12535 break;
12536 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12537 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12538 break;
12539 default:
12540 if (session->cipher == 0) {
12541 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12542 tvb, offset, offset_end - offset,
12543 "Cipher Suite not found");
12544 } else {
12545 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12546 tvb, offset, offset_end - offset,
12547 "Cipher Suite 0x%04x is not implemented, "
12548 "contact Wireshark developers if you want this to be supported",
12549 session->cipher);
12550 }
12551 break;
12552 }
12553}
12554/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12555
12556void
12557tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12558 proto_tree *tree, uint32_t offset)
12559{
12560 /* RFC 8446 Section 4.6.3
12561 * enum {
12562 * update_not_requested(0), update_requested(1), (255)
12563 * } KeyUpdateRequest;
12564 *
12565 * struct {
12566 * KeyUpdateRequest request_update;
12567 * } KeyUpdate;
12568 */
12569 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12570}
12571
12572void
12573ssl_common_register_ssl_alpn_dissector_table(const char *name,
12574 const char *ui_name, const int proto)
12575{
12576 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12577 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12578 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12579}
12580
12581void
12582ssl_common_register_dtls_alpn_dissector_table(const char *name,
12583 const char *ui_name, const int proto)
12584{
12585 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12586 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12587 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12588}
12589
12590void
12591ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12592{
12593 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12594 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12595 &(options->psk));
12596
12597 if (is_dtls) {
12598 prefs_register_obsolete_preference(module, "keylog_file");
12599 prefs_register_static_text_preference(module, "keylog_file_removed",
12600 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12601 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12602 return;
12603 }
12604
12605 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12606 "The name of a file which contains a list of \n"
12607 "(pre-)master secrets in one of the following formats:\n"
12608 "\n"
12609 "RSA <EPMS> <PMS>\n"
12610 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12611 "CLIENT_RANDOM <CRAND> <MS>\n"
12612 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12613 "\n"
12614 "Where:\n"
12615 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12616 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12617 "<SSLID> = The SSL Session ID\n"
12618 "<MS> = The Master-Secret (MS)\n"
12619 "<CRAND> = The Client's random number from the ClientHello message\n"
12620 "\n"
12621 "(All fields are in hex notation)",
12622 &(options->keylog_filename), false0);
12623}
12624
12625void
12626ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length, uint8_t msg_type, bool_Bool is_from_server)
12627{
12628 /* The handshake transcript can be used in [D]TLS 1.2 for the extended
12629 * master secret of RFC 7627, and in [D]TLS 1.3 for computing the secrets,
12630 * though the latter is only useful when pke_ke (PSK-only key exchange) is
12631 * negotiated. */
12632 if (!ssl_session)
12633 return;
12634
12635 switch (ssl_session->session.version) {
12636 /* The handshake message types used in the handshake hash are different
12637 * in different versions. [D]TLS 1.3 tracks the messages up to the
12638 * Finished, whereas 1.2 stops at the ClientKeyExchange. However, all start
12639 * at the ClientHello and include the messages up to the ServerHello, at
12640 * which point we know the version.
12641 *
12642 * XXX - However, DTLS 1.2 includes the DTLS-specific fragment info fields
12643 * in its handshake transcript, whereas DTLS 1.3 does not (using the same
12644 * format as TLS 1.3). We don't know at the point of the ClientHello which
12645 * version will be used, so PSK only likely doesn't work for DTLS 1.3 yet.
12646 *
12647 * When the server responds with a HelloRetryRequest, for subsequent
12648 * hashes (other than the first PSK Binder, see 4.2.11.2) ClientHello1 is
12649 * replaced with a synthetic handshake message of type "message_hash",
12650 * per RFC 8446 4.4.1. That is done in ssl_dissect_hnd_srv_hello, once
12651 * the cipher suite (and thus the hash function) is known; after that,
12652 * only the digest state of the transcript is kept.
12653 */
12654 case TLSV1DOT3_VERSION0x304:
12655 case DTLSV1DOT3_VERSION0xfefc:
12656 /* In [D]TLS 1.3 only the following handshake messages are used in the
12657 * handshake transcript. EndOfEarlyData and the Client Certificate,
12658 * Certificate Verify, and Finished are used in deriving the
12659 * resumption_master_secret but not the other secrets derived from
12660 * the master secret (client or server app traffic secret, exporter
12661 * secret). We don't yet support calculating a PSK to resume via
12662 * the resumption_master_secret, so we simply stop the transcript
12663 * with the server Finished. See RFC 8446 4.4.1 & 7.1 */
12664 switch (msg_type) {
12665 case SSL_HND_CLIENT_HELLO:
12666 case SSL_HND_SERVER_HELLO:
12667 case SSL_HND_HELLO_RETRY_REQUEST:
12668 case SSL_HND_ENCRYPTED_EXTENSIONS:
12669 case SSL_HND_CERT_REQUEST:
12670 break;
12671 case SSL_HND_CERTIFICATE:
12672 case SSL_HND_CERT_VERIFY:
12673 case SSL_HND_FINISHED:
12674 if (!is_from_server)
12675 return;
12676 break;
12677 case SSL_HND_END_OF_EARLY_DATA:
12678 default:
12679 return;
12680 }
12681 break;
12682 default:
12683 /* In [D]TLS 1.2, the handshake hash for the Extended Master Secret
12684 * (RFC 7627) is calculated up to and including ClientKeyExchange,
12685 * but the keys are not retrieved until ChangeCipherSpec later. If
12686 * mutual authentication is requested by the server, an intervening
12687 * CertificateVerify message can be sent but is not to be included
12688 * in the hash. */
12689 if (msg_type == SSL_HND_CERT_VERIFY)
12690 return;
12691 if (ssl_session->state & SSL_MASTER_SECRET(1<<5))
12692 return;
12693 break;
12694 }
12695
12696 /* Until the ServerHello gives the hash function, the transcript should
12697 * only have the ClientHello (in DTLS, possibly a HelloVerifyRequest,
12698 * which resets the transcript) and the ServerHello or HelloRetryRequest
12699 * itself; there's no point in buffering anything else. */
12700 if (ssl_session->handshake_transcript.md == NULL((void*)0)) {
12701 switch (msg_type) {
12702 case SSL_HND_CLIENT_HELLO:
12703 case SSL_HND_SERVER_HELLO:
12704 case SSL_HND_HELLO_RETRY_REQUEST:
12705 case SSL_HND_HELLO_VERIFY_REQUEST:
12706 break;
12707 default:
12708 if (!ssl_session->handshake_transcript.failed) {
12709 ssl_debug_printf("%s handshake message %u before the ServerHello\n", G_STRFUNC((const char*) (__func__)), msg_type);
12710 tls_transcript_fail(&ssl_session->handshake_transcript);
12711 }
12712 return;
12713 }
12714 }
12715
12716 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12717 if (tvb) {
12718 if (tvb_bytes_exist(tvb, offset, length)) {
12719 tls_transcript_add(&ssl_session->handshake_transcript, tvb_get_ptr(tvb, offset, length), length);
12720 }
12721 } else {
12722 /* DTLS calculates the hash as if each handshake message had been
12723 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12724 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12725 */
12726 static const uint8_t zeros[3];
12727 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12727, (int64_t)length, (int64_t)4))));
12728 tls_transcript_add(&ssl_session->handshake_transcript, zeros, length);
12729 }
12730}
12731
12732
12733/*
12734 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12735 *
12736 * Local variables:
12737 * c-basic-offset: 4
12738 * tab-width: 8
12739 * indent-tabs-mode: nil
12740 * End:
12741 *
12742 * vi: set shiftwidth=4 tabstop=8 expandtab:
12743 * :indentSize=4:tabSize=8:noTabs=true:
12744 */