Bug Summary

File:epan/dissectors/packet-tls-utils.c
Warning:line 11046, column 13
Null pointer passed to 2nd parameter expecting 'nonnull'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name packet-tls-utils.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-20/lib/clang/20 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan/dissectors -isystem /builds/wireshark/wireshark/build/epan/dissectors -isystem /usr/include/mit-krb5 -isystem /usr/include/libxml2 -isystem /builds/wireshark/wireshark/epan -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-20/lib/clang/20/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2025-08-27-100402-3933-1 -x c /builds/wireshark/wireshark/epan/dissectors/packet-tls-utils.c
1/* packet-tls-utils.c
2 * ssl manipulation functions
3 * By Paolo Abeni <paolo.abeni@email.com>
4 *
5 * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de>
6 * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl>
7 *
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14
15#include "config.h"
16
17#include <stdlib.h>
18#include <errno(*__errno_location ()).h>
19
20#include <epan/packet.h>
21#include <epan/strutil.h>
22#include <epan/addr_resolv.h>
23#include <epan/expert.h>
24#include <epan/asn1.h>
25#include <epan/proto_data.h>
26#include <epan/oids.h>
27#include <epan/secrets.h>
28
29#include <wsutil/inet_cidr.h>
30#include <wsutil/filesystem.h>
31#include <wsutil/file_util.h>
32#include <wsutil/str_util.h>
33#include <wsutil/report_message.h>
34#include <wsutil/pint.h>
35#include <wsutil/strtoi.h>
36#include <wsutil/wsgcrypt.h>
37#include <wsutil/rsa.h>
38#include <wsutil/ws_assert.h>
39#include <wsutil/zlib_compat.h>
40#include "packet-ber.h"
41#include "packet-x509af.h"
42#include "packet-x509if.h"
43#include "packet-tls-utils.h"
44#include "packet-ocsp.h"
45#include "packet-tls.h"
46#include "packet-dtls.h"
47#include "packet-quic.h"
48#if defined(HAVE_LIBGNUTLS1)
49#include <gnutls/abstract.h>
50#endif
51
52/* JA3/JA3S calculations must ignore GREASE values
53 * as described in RFC 8701.
54 */
55#define IS_GREASE_TLS(x)((((x) & 0x0f0f) == 0x0a0a) && (((x) & 0xff) ==
(((x)>>8) & 0xff)))
((((x) & 0x0f0f) == 0x0a0a) && \
56 (((x) & 0xff) == (((x)>>8) & 0xff)))
57
58/* Section 22.3 of RFC 9000 (QUIC) reserves values of this
59 * form for a similar purpose as GREASE.
60 */
61#define IS_GREASE_QUIC(x)((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0)
62
63#define DTLS13_MAX_EPOCH10 10
64
65/* Lookup tables {{{ */
66const value_string ssl_version_short_names[] = {
67 { SSLV2_VERSION0x0002, "SSLv2" },
68 { SSLV3_VERSION0x300, "SSLv3" },
69 { TLSV1_VERSION0x301, "TLSv1" },
70 { TLCPV1_VERSION0x101, "TLCP" },
71 { TLSV1DOT1_VERSION0x302, "TLSv1.1" },
72 { TLSV1DOT2_VERSION0x303, "TLSv1.2" },
73 { TLSV1DOT3_VERSION0x304, "TLSv1.3" },
74 { DTLSV1DOT0_VERSION0xfeff, "DTLSv1.0" },
75 { DTLSV1DOT2_VERSION0xfefd, "DTLSv1.2" },
76 { DTLSV1DOT3_VERSION0xfefc, "DTLSv1.3" },
77 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
78 { 0x00, NULL((void*)0) }
79};
80
81const value_string ssl_versions[] = {
82 { SSLV2_VERSION0x0002, "SSL 2.0" },
83 { SSLV3_VERSION0x300, "SSL 3.0" },
84 { TLSV1_VERSION0x301, "TLS 1.0" },
85 { TLCPV1_VERSION0x101, "TLCP" },
86 { TLSV1DOT1_VERSION0x302, "TLS 1.1" },
87 { TLSV1DOT2_VERSION0x303, "TLS 1.2" },
88 { TLSV1DOT3_VERSION0x304, "TLS 1.3" },
89 { 0x7F0E, "TLS 1.3 (draft 14)" },
90 { 0x7F0F, "TLS 1.3 (draft 15)" },
91 { 0x7F10, "TLS 1.3 (draft 16)" },
92 { 0x7F11, "TLS 1.3 (draft 17)" },
93 { 0x7F12, "TLS 1.3 (draft 18)" },
94 { 0x7F13, "TLS 1.3 (draft 19)" },
95 { 0x7F14, "TLS 1.3 (draft 20)" },
96 { 0x7F15, "TLS 1.3 (draft 21)" },
97 { 0x7F16, "TLS 1.3 (draft 22)" },
98 { 0x7F17, "TLS 1.3 (draft 23)" },
99 { 0x7F18, "TLS 1.3 (draft 24)" },
100 { 0x7F19, "TLS 1.3 (draft 25)" },
101 { 0x7F1A, "TLS 1.3 (draft 26)" },
102 { 0x7F1B, "TLS 1.3 (draft 27)" },
103 { 0x7F1C, "TLS 1.3 (draft 28)" },
104 { 0xFB17, "TLS 1.3 (Facebook draft 23)" },
105 { 0xFB1A, "TLS 1.3 (Facebook draft 26)" },
106 { DTLSV1DOT0_OPENSSL_VERSION0x100, "DTLS 1.0 (OpenSSL pre 0.9.8f)" },
107 { DTLSV1DOT0_VERSION0xfeff, "DTLS 1.0" },
108 { DTLSV1DOT2_VERSION0xfefd, "DTLS 1.2" },
109 { DTLSV1DOT3_VERSION0xfefc, "DTLS 1.3" },
110 { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */
111 { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */
112 { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */
113 { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */
114 { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */
115 { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */
116 { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */
117 { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */
118 { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */
119 { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */
120 { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */
121 { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */
122 { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */
123 { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */
124 { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */
125 { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */
126 { 0x00, NULL((void*)0) }
127};
128
129static const value_string ssl_version_ja4_names[] = {
130 { 0x0100, "s1" },
131 { SSLV2_VERSION0x0002, "s2" },
132 { SSLV3_VERSION0x300, "s3" },
133 { TLSV1_VERSION0x301, "10" },
134 { TLSV1DOT1_VERSION0x302, "11" },
135 { TLSV1DOT2_VERSION0x303, "12" },
136 { TLSV1DOT3_VERSION0x304, "13" },
137 { DTLSV1DOT0_VERSION0xfeff, "d1" },
138 { DTLSV1DOT2_VERSION0xfefd, "d2" },
139 { DTLSV1DOT3_VERSION0xfefc, "d3" },
140 { 0x00, NULL((void*)0) }
141};
142
143const value_string ssl_20_msg_types[] = {
144 { SSL2_HND_ERROR0x00, "Error" },
145 { SSL2_HND_CLIENT_HELLO0x01, "Client Hello" },
146 { SSL2_HND_CLIENT_MASTER_KEY0x02, "Client Master Key" },
147 { SSL2_HND_CLIENT_FINISHED0x03, "Client Finished" },
148 { SSL2_HND_SERVER_HELLO0x04, "Server Hello" },
149 { SSL2_HND_SERVER_VERIFY0x05, "Server Verify" },
150 { SSL2_HND_SERVER_FINISHED0x06, "Server Finished" },
151 { SSL2_HND_REQUEST_CERTIFICATE0x07, "Request Certificate" },
152 { SSL2_HND_CLIENT_CERTIFICATE0x08, "Client Certificate" },
153 { 0x00, NULL((void*)0) }
154};
155/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
156/* Note: sorted by ascending value so value_string-ext can do a binary search */
157static const value_string ssl_20_cipher_suites[] = {
158 { 0x000000, "TLS_NULL_WITH_NULL_NULL" },
159 { 0x000001, "TLS_RSA_WITH_NULL_MD5" },
160 { 0x000002, "TLS_RSA_WITH_NULL_SHA" },
161 { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
162 { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" },
163 { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" },
164 { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
165 { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
166 { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
167 { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" },
168 { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
169 { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
170 { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
171 { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
172 { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
173 { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
174 { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
175 { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
176 { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
177 { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
178 { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
179 { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
180 { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
181 { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
182 { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" },
183 { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
184 { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
185 { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
186 { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
187 { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
188#if 0
189 { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
190#endif
191 /* RFC 2712 */
192 { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
193 { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
194 { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" },
195 { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
196 { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" },
197 { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
198 { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" },
199 { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
200 { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
201 { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
202 { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
203 { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
204 { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
205 { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
206 /* RFC 4785 */
207 { 0x00002C, "TLS_PSK_WITH_NULL_SHA" },
208 { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
209 { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
210 /* RFC 5246 */
211 { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" },
212 { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
213 { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
214 { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
215 { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
216 { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
217 { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
218 { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
219 { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
220 { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
221 { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
222 { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
223 { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" },
224 { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
225 { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
226 { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
227 { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
228 { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
229 { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
230 { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
231 { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
232 { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
233 { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
234 { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
235 { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
236 { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
237 { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" },
238 { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
239 { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
240 { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
241 { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
242 { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
243 { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
244 { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
245 { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
246 { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
247 { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
248 { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
249 { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
250 { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
251 { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
252 { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
253 { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
254 { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
255 /* 0x00,0x6E-83 Unassigned */
256 { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
257 { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
258 { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
259 { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
260 { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
261 { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
262 /* RFC 4279 */
263 { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" },
264 { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
265 { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
266 { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
267 { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
268 { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
269 { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
270 { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
271 { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
272 { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
273 { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
274 { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
275 /* RFC 4162 */
276 { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" },
277 { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
278 { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
279 { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
280 { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
281 { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
282 /* RFC 5288 */
283 { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
284 { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
285 { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
286 { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
287 { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
288 { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
289 { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
290 { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
291 { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
292 { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
293 { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
294 { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
295 /* RFC 5487 */
296 { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
297 { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
298 { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
299 { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
300 { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
301 { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
302 { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
303 { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
304 { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" },
305 { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" },
306 { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
307 { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
308 { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
309 { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
310 { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
311 { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
312 { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
313 { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
314 /* From RFC 5932 */
315 { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
316 { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
317 { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
318 { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
319 { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
320 { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
321 { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
322 { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
323 { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
324 { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
325 { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
326 { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
327 /* 0x00,0xC6-FE Unassigned */
328 { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
329 /* 0x01-BF,* Unassigned */
330 /* From RFC 4492 */
331 { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
332 { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
333 { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
334 { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
335 { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
336 { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
337 { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
338 { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
339 { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
340 { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
341 { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
342 { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
343 { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
344 { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
345 { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
346 { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
347 { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
348 { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
349 { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
350 { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
351 { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" },
352 { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
353 { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
354 { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
355 { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
356 /* RFC 5054 */
357 { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
358 { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
359 { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
360 { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
361 { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
362 { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
363 { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
364 { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
365 { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
366 /* RFC 5589 */
367 { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
368 { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
369 { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
370 { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
371 { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
372 { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
373 { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
374 { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
375 { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
376 { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
377 { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
378 { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
379 { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
380 { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
381 { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
382 { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
383 /* RFC 5489 */
384 { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
385 { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
386 { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
387 { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
388 { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
389 { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
390 { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
391 { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
392 { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
393 /* 0xC0,0x3C-FF Unassigned
394 0xC1-FD,* Unassigned
395 0xFE,0x00-FD Unassigned
396 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
397 0xFF,0x00-FF Reserved for Private Use [RFC5246]
398 */
399
400 /* old numbers used in the beginning
401 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
402 { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
403 { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
404 { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
405
406 /* https://tools.ietf.org/html/rfc7905 */
407 { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
408 { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
409 { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
410 { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
411 { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
412 { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
413 { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
414
415 /* GM/T 0024-2014 */
416 { 0x00e001, "ECDHE_SM1_SM3"},
417 { 0x00e003, "ECC_SM1_SM3"},
418 { 0x00e005, "IBSDH_SM1_SM3"},
419 { 0x00e007, "IBC_SM1_SM3"},
420 { 0x00e009, "RSA_SM1_SM3"},
421 { 0x00e00a, "RSA_SM1_SHA1"},
422 { 0x00e011, "ECDHE_SM4_CBC_SM3"},
423 { 0x00e013, "ECC_SM4_CBC_SM3"},
424 { 0x00e015, "IBSDH_SM4_CBC_SM3"},
425 { 0x00e017, "IBC_SM4_CBC_SM3"},
426 { 0x00e019, "RSA_SM4_CBC_SM3"},
427 { 0x00e01a, "RSA_SM4_CBC_SHA1"},
428 { 0x00e01c, "RSA_SM4_CBC_SHA256"},
429 { 0x00e051, "ECDHE_SM4_GCM_SM3"},
430 { 0x00e053, "ECC_SM4_GCM_SM3"},
431 { 0x00e055, "IBSDH_SM4_GCM_SM3"},
432 { 0x00e057, "IBC_SM4_GCM_SM3"},
433 { 0x00e059, "RSA_SM4_GCM_SM3"},
434 { 0x00e05a, "RSA_SM4_GCM_SHA256"},
435
436 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
437 { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
438 { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" },
439 { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
440 { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
441 { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
442 { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
443 { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
444 { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" },
445 { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
446 { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
447 { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
448 { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
449 { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
450 { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
451 { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
452 { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
453
454 /* these from http://www.mozilla.org/projects/
455 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
456 { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
457 { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
458 { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
459 { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
460 /* note that ciphersuites of {0x00????} are TLS cipher suites in
461 * a sslv2 client hello message; the ???? above is the two-byte
462 * tls cipher suite id
463 */
464
465 { 0x010080, "SSL2_RC4_128_WITH_MD5" },
466 { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" },
467 { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" },
468 { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" },
469 { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" },
470 { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" },
471 { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" },
472 { 0x080080, "SSL2_RC4_64_WITH_MD5" },
473
474 { 0x00, NULL((void*)0) }
475};
476
477value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites){ _try_val_to_str_ext_init, 0, (sizeof (ssl_20_cipher_suites)
/ sizeof ((ssl_20_cipher_suites)[0]))-1, ssl_20_cipher_suites
, "ssl_20_cipher_suites" }
;
478
479
480/*
481 * Supported Groups (formerly named "EC Named Curve").
482 * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
483 */
484const value_string ssl_extension_curves[] = {
485 { 1, "sect163k1" },
486 { 2, "sect163r1" },
487 { 3, "sect163r2" },
488 { 4, "sect193r1" },
489 { 5, "sect193r2" },
490 { 6, "sect233k1" },
491 { 7, "sect233r1" },
492 { 8, "sect239k1" },
493 { 9, "sect283k1" },
494 { 10, "sect283r1" },
495 { 11, "sect409k1" },
496 { 12, "sect409r1" },
497 { 13, "sect571k1" },
498 { 14, "sect571r1" },
499 { 15, "secp160k1" },
500 { 16, "secp160r1" },
501 { 17, "secp160r2" },
502 { 18, "secp192k1" },
503 { 19, "secp192r1" },
504 { 20, "secp224k1" },
505 { 21, "secp224r1" },
506 { 22, "secp256k1" },
507 { 23, "secp256r1" },
508 { 24, "secp384r1" },
509 { 25, "secp521r1" },
510 { 26, "brainpoolP256r1" }, /* RFC 7027 */
511 { 27, "brainpoolP384r1" }, /* RFC 7027 */
512 { 28, "brainpoolP512r1" }, /* RFC 7027 */
513 { 29, "x25519" }, /* RFC 8446 / RFC 8422 */
514 { 30, "x448" }, /* RFC 8446 / RFC 8422 */
515 { 31, "brainpoolP256r1tls13" }, /* RFC8734 */
516 { 32, "brainpoolP384r1tls13" }, /* RFC8734 */
517 { 33, "brainpoolP512r1tls13" }, /* RFC8734 */
518 { 34, "GC256A" }, /* RFC9189 */
519 { 35, "GC256B" }, /* RFC9189 */
520 { 36, "GC256C" }, /* RFC9189 */
521 { 37, "GC256D" }, /* RFC9189 */
522 { 38, "GC512A" }, /* RFC9189 */
523 { 39, "GC512B" }, /* RFC9189 */
524 { 40, "GC512C" }, /* RFC9189 */
525 { 41, "curveSM2" }, /* RFC 8998 */
526 { 256, "ffdhe2048" }, /* RFC 7919 */
527 { 257, "ffdhe3072" }, /* RFC 7919 */
528 { 258, "ffdhe4096" }, /* RFC 7919 */
529 { 259, "ffdhe6144" }, /* RFC 7919 */
530 { 260, "ffdhe8192" }, /* RFC 7919 */
531 { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
532 { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
533 { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */
534 { 2570, "Reserved (GREASE)" }, /* RFC 8701 */
535 { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */
536 { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
537 { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */
538 { 6682, "Reserved (GREASE)" }, /* RFC 8701 */
539 { 10794, "Reserved (GREASE)" }, /* RFC 8701 */
540 { 14906, "Reserved (GREASE)" }, /* RFC 8701 */
541 { 19018, "Reserved (GREASE)" }, /* RFC 8701 */
542 { 23130, "Reserved (GREASE)" }, /* RFC 8701 */
543 { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */
544 { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */
545 { 27242, "Reserved (GREASE)" }, /* RFC 8701 */
546 { 31354, "Reserved (GREASE)" }, /* RFC 8701 */
547 { 35466, "Reserved (GREASE)" }, /* RFC 8701 */
548 { 39578, "Reserved (GREASE)" }, /* RFC 8701 */
549 { 43690, "Reserved (GREASE)" }, /* RFC 8701 */
550 { 47802, "Reserved (GREASE)" }, /* RFC 8701 */
551 { 51914, "Reserved (GREASE)" }, /* RFC 8701 */
552 { 56026, "Reserved (GREASE)" }, /* RFC 8701 */
553 { 60138, "Reserved (GREASE)" }, /* RFC 8701 */
554 { 64250, "Reserved (GREASE)" }, /* RFC 8701 */
555 { 0xFF01, "arbitrary_explicit_prime_curves" },
556 { 0xFF02, "arbitrary_explicit_char2_curves" },
557 /* Below are various unofficial values that have been used for testing. */
558 /* PQC key exchange algorithms from OQS-OpenSSL,
559 see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md
560 These use IANA unassigned values and this list may be incomplete.
561 */
562 { 0x2F00, "p256_frodo640aes" },
563 { 0x2F01, "p256_frodo640shake" },
564 { 0x2F02, "p384_frodo976aes" },
565 { 0x0203, "frodo976shake" },
566 { 0x2F03, "p384_frodo976shake" },
567 { 0x0204, "frodo1344aes" },
568 { 0x2F04, "p521_frodo1344aes" },
569 { 0x0205, "frodo1344shake" },
570 { 0x2F05, "p521_frodo1344shake" },
571 { 0x023A, "kyber512" },
572 { 0x2F3A, "p256_kyber512" },
573 { 0x023C, "kyber768" },
574 { 0x2F3C, "p384_kyber768" },
575 { 0x023D, "kyber1024" },
576 { 0x2F3D, "p521_kyber1024" },
577 { 0x0214, "ntru_hps2048509" },
578 { 0x2F14, "p256_ntru_hps2048509" },
579 { 0x0215, "ntru_hps2048677" },
580 { 0x2F15, "p384_ntru_hps2048677" },
581 { 0x0216, "ntru_hps4096821" },
582 { 0x2F16, "p521_ntru_hps4096821" },
583 { 0x0245, "ntru_hps40961229" },
584 { 0x2F45, "p521_ntru_hps40961229" },
585 { 0x0217, "ntru_hrss701" },
586 { 0x2F17, "p384_ntru_hrss701" },
587 { 0x0246, "ntru_hrss1373" },
588 { 0x2F46, "p521_ntru_hrss1373" },
589 { 0x0218, "lightsaber" },
590 { 0x2F18, "p256_lightsaber" },
591 { 0x0219, "saber" },
592 { 0x2F19, "p384_saber" },
593 { 0x021A, "firesaber" },
594 { 0x2F1A, "p521_firesaber" },
595 { 0x021B, "sidhp434" },
596 { 0x2F1B, "p256_sidhp434" },
597 { 0x021C, "sidhp503" },
598 { 0x2F1C, "p256_sidhp503" },
599 { 0x021D, "sidhp610" },
600 { 0x2F1D, "p384_sidhp610" },
601 { 0x021E, "sidhp751" },
602 { 0x2F1E, "p521_sidhp751" },
603 { 0x021F, "sikep434" },
604 { 0x2F1F, "p256_sikep434" },
605 { 0x0220, "sikep503" },
606 { 0x2F20, "p256_sikep503" },
607 { 0x0221, "sikep610" },
608 { 0x2F21, "p384_sikep610" },
609 { 0x0222, "sikep751" },
610 { 0x2F22, "p521_sikep751" },
611 { 0x0238, "bikel1" },
612 { 0x2F38, "p256_bikel1" },
613 { 0x023B, "bikel3" },
614 { 0x2F3B, "p384_bikel3" },
615 { 0x023E, "kyber90s512" },
616 { 0x2F3E, "p256_kyber90s512" },
617 { 0x023F, "kyber90s768" },
618 { 0x2F3F, "p384_kyber90s768" },
619 { 0x0240, "kyber90s1024" },
620 { 0x2F40, "p521_kyber90s1024" },
621 { 0x022C, "hqc128" },
622 { 0x2F2C, "p256_hqc128" },
623 { 0x022D, "hqc192" },
624 { 0x2F2D, "p384_hqc192" },
625 { 0x022E, "hqc256" },
626 { 0x2F2E, "p521_hqc256" },
627 { 0x022F, "ntrulpr653" },
628 { 0x2F2F, "p256_ntrulpr653" },
629 { 0x0230, "ntrulpr761" },
630 { 0x2F43, "p256_ntrulpr761" },
631 { 0x0231, "ntrulpr857" },
632 { 0x2F31, "p384_ntrulpr857" },
633 { 0x0241, "ntrulpr1277" },
634 { 0x2F41, "p521_ntrulpr1277" },
635 { 0x0232, "sntrup653" },
636 { 0x2F32, "p256_sntrup653" },
637 { 0x0233, "sntrup761" },
638 { 0x2F44, "p256_sntrup761" },
639 { 0x0234, "sntrup857" },
640 { 0x2F34, "p384_sntrup857" },
641 { 0x0242, "sntrup1277" },
642 { 0x2F42, "p521_sntrup1277" },
643 /* Other PQ key exchange algorithms, using Reserved for Private Use values
644 https://blog.cloudflare.com/post-quantum-for-all
645 https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */
646 { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" },
647 { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" },
648 { 0x00, NULL((void*)0) }
649};
650
651const value_string ssl_curve_types[] = {
652 { 1, "explicit_prime" },
653 { 2, "explicit_char2" },
654 { 3, "named_curve" },
655 { 0x00, NULL((void*)0) }
656};
657
658const value_string ssl_extension_ec_point_formats[] = {
659 { 0, "uncompressed" },
660 { 1, "ansiX962_compressed_prime" },
661 { 2, "ansiX962_compressed_char2" },
662 { 0x00, NULL((void*)0) }
663};
664
665const value_string ssl_20_certificate_type[] = {
666 { 0x00, "N/A" },
667 { 0x01, "X.509 Certificate" },
668 { 0x00, NULL((void*)0) }
669};
670
671const value_string ssl_31_content_type[] = {
672 { 20, "Change Cipher Spec" },
673 { 21, "Alert" },
674 { 22, "Handshake" },
675 { 23, "Application Data" },
676 { 24, "Heartbeat" },
677 { 25, "Connection ID" },
678 { 0x00, NULL((void*)0) }
679};
680
681#if 0
682/* XXX - would be used if we dissected the body of a Change Cipher Spec
683 message. */
684const value_string ssl_31_change_cipher_spec[] = {
685 { 1, "Change Cipher Spec" },
686 { 0x00, NULL((void*)0) }
687};
688#endif
689
690const value_string ssl_31_alert_level[] = {
691 { 1, "Warning" },
692 { 2, "Fatal" },
693 { 0x00, NULL((void*)0) }
694};
695
696const value_string ssl_31_alert_description[] = {
697 { 0, "Close Notify" },
698 { 1, "End of Early Data" },
699 { 10, "Unexpected Message" },
700 { 20, "Bad Record MAC" },
701 { 21, "Decryption Failed" },
702 { 22, "Record Overflow" },
703 { 30, "Decompression Failure" },
704 { 40, "Handshake Failure" },
705 { 41, "No Certificate" },
706 { 42, "Bad Certificate" },
707 { 43, "Unsupported Certificate" },
708 { 44, "Certificate Revoked" },
709 { 45, "Certificate Expired" },
710 { 46, "Certificate Unknown" },
711 { 47, "Illegal Parameter" },
712 { 48, "Unknown CA" },
713 { 49, "Access Denied" },
714 { 50, "Decode Error" },
715 { 51, "Decrypt Error" },
716 { 60, "Export Restriction" },
717 { 70, "Protocol Version" },
718 { 71, "Insufficient Security" },
719 { 80, "Internal Error" },
720 { 86, "Inappropriate Fallback" },
721 { 90, "User Canceled" },
722 { 100, "No Renegotiation" },
723 { 109, "Missing Extension" },
724 { 110, "Unsupported Extension" },
725 { 111, "Certificate Unobtainable" },
726 { 112, "Unrecognized Name" },
727 { 113, "Bad Certificate Status Response" },
728 { 114, "Bad Certificate Hash Value" },
729 { 115, "Unknown PSK Identity" },
730 { 116, "Certificate Required" },
731 { 120, "No application Protocol" },
732 { 121, "ECH Required" },
733 { 0x00, NULL((void*)0) }
734};
735
736const value_string ssl_31_handshake_type[] = {
737 { SSL_HND_HELLO_REQUEST, "Hello Request" },
738 { SSL_HND_CLIENT_HELLO, "Client Hello" },
739 { SSL_HND_SERVER_HELLO, "Server Hello" },
740 { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"},
741 { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" },
742 { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" },
743 { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" },
744 { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" },
745 { SSL_HND_CERTIFICATE, "Certificate" },
746 { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" },
747 { SSL_HND_CERT_REQUEST, "Certificate Request" },
748 { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" },
749 { SSL_HND_CERT_VERIFY, "Certificate Verify" },
750 { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" },
751 { SSL_HND_FINISHED, "Finished" },
752 { SSL_HND_CERT_URL, "Client Certificate URL" },
753 { SSL_HND_CERT_STATUS, "Certificate Status" },
754 { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" },
755 { SSL_HND_KEY_UPDATE, "Key Update" },
756 { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" },
757 { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" },
758 { 0x00, NULL((void*)0) }
759};
760
761const value_string tls_heartbeat_type[] = {
762 { 1, "Request" },
763 { 2, "Response" },
764 { 0x00, NULL((void*)0) }
765};
766
767const value_string tls_heartbeat_mode[] = {
768 { 1, "Peer allowed to send requests" },
769 { 2, "Peer not allowed to send requests" },
770 { 0x00, NULL((void*)0) }
771};
772
773const value_string ssl_31_compression_method[] = {
774 { 0, "null" },
775 { 1, "DEFLATE" },
776 { 64, "LZS" },
777 { 0x00, NULL((void*)0) }
778};
779
780#if 0
781/* XXX - would be used if we dissected a Signature, as would be
782 seen in a server key exchange or certificate verify message. */
783const value_string ssl_31_key_exchange_algorithm[] = {
784 { 0, "RSA" },
785 { 1, "Diffie Hellman" },
786 { 0x00, NULL((void*)0) }
787};
788
789const value_string ssl_31_signature_algorithm[] = {
790 { 0, "Anonymous" },
791 { 1, "RSA" },
792 { 2, "DSA" },
793 { 0x00, NULL((void*)0) }
794};
795#endif
796
797const value_string ssl_31_client_certificate_type[] = {
798 { 1, "RSA Sign" },
799 { 2, "DSS Sign" },
800 { 3, "RSA Fixed DH" },
801 { 4, "DSS Fixed DH" },
802 /* GOST certificate types */
803 /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */
804 { 21, "GOST R 34.10-94" },
805 { 22, "GOST R 34.10-2001" },
806 /* END GOST certificate types */
807 { 64, "ECDSA Sign" },
808 { 65, "RSA Fixed ECDH" },
809 { 66, "ECDSA Fixed ECDH" },
810 { 80, "IBC Params" },
811 { 0x00, NULL((void*)0) }
812};
813
814#if 0
815/* XXX - would be used if we dissected exchange keys, as would be
816 seen in a client key exchange message. */
817const value_string ssl_31_public_value_encoding[] = {
818 { 0, "Implicit" },
819 { 1, "Explicit" },
820 { 0x00, NULL((void*)0) }
821};
822#endif
823
824/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
825/* Note: sorted by ascending value so value_string_ext fcns can do a binary search */
826static const value_string ssl_31_ciphersuite[] = {
827 /* RFC 2246, RFC 4346, RFC 5246 */
828 { 0x0000, "TLS_NULL_WITH_NULL_NULL" },
829 { 0x0001, "TLS_RSA_WITH_NULL_MD5" },
830 { 0x0002, "TLS_RSA_WITH_NULL_SHA" },
831 { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" },
832 { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" },
833 { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" },
834 { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" },
835 { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" },
836 { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" },
837 { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" },
838 { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
839 { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" },
840 { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" },
841 { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" },
842 { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" },
843 { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" },
844 { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" },
845 { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" },
846 { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" },
847 { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" },
848 { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" },
849 { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" },
850 { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" },
851 { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" },
852 { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" },
853 { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" },
854 { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" },
855 { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" },
856
857 { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" },
858 { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" },
859#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
860 to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
861 of the ietf-tls list */
862 { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" },
863#endif
864 /* RFC 2712 */
865 { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" },
866 { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" },
867 { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" },
868 { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" },
869 { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" },
870 { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" },
871 { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" },
872 { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" },
873 { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" },
874 { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" },
875 { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" },
876 { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" },
877 { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" },
878 { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" },
879 /* RFC 4785 */
880 { 0x002C, "TLS_PSK_WITH_NULL_SHA" },
881 { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" },
882 { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" },
883 /* RFC 5246 */
884 { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" },
885 { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" },
886 { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" },
887 { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" },
888 { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" },
889 { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" },
890 { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" },
891 { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" },
892 { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" },
893 { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" },
894 { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" },
895 { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" },
896 { 0x003B, "TLS_RSA_WITH_NULL_SHA256" },
897 { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" },
898 { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" },
899 { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" },
900 { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" },
901 { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" },
902 /* RFC 4132 */
903 { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" },
904 { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" },
905 { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" },
906 { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" },
907 { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" },
908 { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" },
909 /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */
910 /* --- ??? --- */
911 { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" },
912 { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" },
913 /* draft-ietf-tls-56-bit-ciphersuites-01.txt */
914 { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" },
915 { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" },
916 { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" },
917 { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" },
918 { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" },
919 /* --- ??? ---*/
920 { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" },
921 { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" },
922 { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" },
923 { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" },
924 { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" },
925 { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" },
926 { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" },
927 /* draft-chudov-cryptopro-cptls-04.txt */
928 { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" },
929 { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" },
930 { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" },
931 { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" },
932 /* RFC 4132 */
933 { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" },
934 { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" },
935 { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" },
936 { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" },
937 { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" },
938 { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" },
939 /* RFC 4279 */
940 { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" },
941 { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" },
942 { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" },
943 { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" },
944 { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" },
945 { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" },
946 { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" },
947 { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" },
948 { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" },
949 { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" },
950 { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" },
951 { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" },
952 /* RFC 4162 */
953 { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" },
954 { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" },
955 { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" },
956 { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" },
957 { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" },
958 { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" },
959 /* RFC 5288 */
960 { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" },
961 { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" },
962 { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" },
963 { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" },
964 { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" },
965 { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" },
966 { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" },
967 { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" },
968 { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" },
969 { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" },
970 { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" },
971 { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" },
972 /* RFC 5487 */
973 { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" },
974 { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" },
975 { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" },
976 { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" },
977 { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" },
978 { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" },
979 { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" },
980 { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" },
981 { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" },
982 { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" },
983 { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" },
984 { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" },
985 { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" },
986 { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" },
987 { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" },
988 { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" },
989 { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" },
990 { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" },
991 /* From RFC 5932 */
992 { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
993 { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
994 { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
995 { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" },
996 { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
997 { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" },
998 { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
999 { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1000 { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1001 { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" },
1002 { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" },
1003 { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" },
1004 /* RFC 8998 */
1005 { 0x00C6, "TLS_SM4_GCM_SM3" },
1006 { 0x00C7, "TLS_SM4_CCM_SM3" },
1007 /* 0x00,0xC8-FE Unassigned */
1008 /* From RFC 5746 */
1009 { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" },
1010 /* RFC 8701 */
1011 { 0x0A0A, "Reserved (GREASE)" },
1012 /* RFC 8446 */
1013 { 0x1301, "TLS_AES_128_GCM_SHA256" },
1014 { 0x1302, "TLS_AES_256_GCM_SHA384" },
1015 { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" },
1016 { 0x1304, "TLS_AES_128_CCM_SHA256" },
1017 { 0x1305, "TLS_AES_128_CCM_8_SHA256" },
1018 /* RFC 8701 */
1019 { 0x1A1A, "Reserved (GREASE)" },
1020 { 0x2A2A, "Reserved (GREASE)" },
1021 { 0x3A3A, "Reserved (GREASE)" },
1022 { 0x4A4A, "Reserved (GREASE)" },
1023 /* From RFC 7507 */
1024 { 0x5600, "TLS_FALLBACK_SCSV" },
1025 /* RFC 8701 */
1026 { 0x5A5A, "Reserved (GREASE)" },
1027 { 0x6A6A, "Reserved (GREASE)" },
1028 { 0x7A7A, "Reserved (GREASE)" },
1029 { 0x8A8A, "Reserved (GREASE)" },
1030 { 0x9A9A, "Reserved (GREASE)" },
1031 { 0xAAAA, "Reserved (GREASE)" },
1032 { 0xBABA, "Reserved (GREASE)" },
1033 /* From RFC 4492 */
1034 { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" },
1035 { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" },
1036 { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1037 { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" },
1038 { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" },
1039 { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" },
1040 { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" },
1041 { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" },
1042 { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" },
1043 { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" },
1044 { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" },
1045 { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" },
1046 { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" },
1047 { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" },
1048 { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" },
1049 { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" },
1050 { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" },
1051 { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" },
1052 { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" },
1053 { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" },
1054 { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" },
1055 { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" },
1056 { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" },
1057 { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" },
1058 { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" },
1059 /* RFC 5054 */
1060 { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" },
1061 { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" },
1062 { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" },
1063 { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" },
1064 { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" },
1065 { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" },
1066 { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" },
1067 { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" },
1068 { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" },
1069 /* RFC 5589 */
1070 { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" },
1071 { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" },
1072 { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" },
1073 { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" },
1074 { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" },
1075 { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" },
1076 { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" },
1077 { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" },
1078 { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" },
1079 { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
1080 { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" },
1081 { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" },
1082 { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
1083 { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" },
1084 { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" },
1085 { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" },
1086 /* RFC 5489 */
1087 { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" },
1088 { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" },
1089 { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" },
1090 { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" },
1091 { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" },
1092 { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" },
1093 { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" },
1094 { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" },
1095 { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" },
1096 /* RFC 6209 */
1097 { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" },
1098 { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" },
1099 { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" },
1100 { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" },
1101 { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" },
1102 { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" },
1103 { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" },
1104 { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" },
1105 { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1106 { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1107 { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" },
1108 { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" },
1109 { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1110 { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1111 { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" },
1112 { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" },
1113 { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" },
1114 { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" },
1115 { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" },
1116 { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" },
1117 { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" },
1118 { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" },
1119 { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1120 { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1121 { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" },
1122 { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" },
1123 { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" },
1124 { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" },
1125 { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" },
1126 { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" },
1127 { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" },
1128 { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" },
1129 { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1130 { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1131 { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" },
1132 { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" },
1133 { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" },
1134 { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" },
1135 { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" },
1136 { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" },
1137 { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" },
1138 { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" },
1139 { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1140 { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1141 { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" },
1142 { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" },
1143 { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" },
1144 { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" },
1145 { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" },
1146 { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" },
1147 { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" },
1148 { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" },
1149 { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" },
1150 { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" },
1151 /* RFC 6367 */
1152 { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1153 { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1154 { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" },
1155 { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" },
1156 { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1157 { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1158 { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" },
1159 { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" },
1160 { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1161 { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1162 { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1163 { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1164 { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1165 { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1166 { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1167 { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1168 { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" },
1169 { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" },
1170 { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" },
1171 { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" },
1172 { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1173 { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1174 { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" },
1175 { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" },
1176 { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1177 { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1178 { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" },
1179 { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" },
1180 { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1181 { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1182 { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1183 { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1184 { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" },
1185 { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" },
1186 { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1187 { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1188 { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1189 { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1190 { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1191 { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1192 { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" },
1193 { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" },
1194 /* RFC 6655 */
1195 { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" },
1196 { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" },
1197 { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" },
1198 { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" },
1199 { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" },
1200 { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" },
1201 { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" },
1202 { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" },
1203 { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" },
1204 { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" },
1205 { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" },
1206 { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" },
1207 { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" },
1208 { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" },
1209 { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" },
1210 { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" },
1211 /* RFC 7251 */
1212 { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" },
1213 { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" },
1214 { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" },
1215 { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" },
1216 /* RFC 8492 */
1217 { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" },
1218 { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" },
1219 { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" },
1220 { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" },
1221 /* draft-camwinget-tls-ts13-macciphersuites */
1222 { 0xC0B4, "TLS_SHA256_SHA256" },
1223 { 0xC0B5, "TLS_SHA384_SHA384" },
1224 /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */
1225 { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" },
1226 /* draft-smyshlyaev-tls12-gost-suites */
1227 { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" },
1228 { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" },
1229 { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" },
1230 /* draft-smyshlyaev-tls13-gost-suites */
1231 { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" },
1232 { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" },
1233 { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" },
1234 { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" },
1235 /* RFC 8701 */
1236 { 0xCACA, "Reserved (GREASE)" },
1237/*
12380xC0,0xAB-FF Unassigned
12390xC1,0x03-FD,* Unassigned
12400xFE,0x00-FD Unassigned
12410xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen]
12420xFF,0x00-FF Reserved for Private Use [RFC5246]
1243*/
1244 /* old numbers used in the beginning
1245 * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */
1246 { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1247 { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1248 { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1249 /* RFC 7905 */
1250 { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1251 { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" },
1252 { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" },
1253 { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1254 { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1255 { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1256 { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" },
1257 /* RFC 8442 */
1258 { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" },
1259 { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" },
1260 { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" },
1261 { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" },
1262 /* RFC 8701 */
1263 { 0xDADA, "Reserved (GREASE)" },
1264 /* GM/T 0024-2014 */
1265 { 0xe001, "ECDHE_SM1_SM3"},
1266 { 0xe003, "ECC_SM1_SM3"},
1267 { 0xe005, "IBSDH_SM1_SM3"},
1268 { 0xe007, "IBC_SM1_SM3"},
1269 { 0xe009, "RSA_SM1_SM3"},
1270 { 0xe00a, "RSA_SM1_SHA1"},
1271 { 0xe011, "ECDHE_SM4_CBC_SM3"},
1272 { 0xe013, "ECC_SM4_CBC_SM3"},
1273 { 0xe015, "IBSDH_SM4_CBC_SM3"},
1274 { 0xe017, "IBC_SM4_CBC_SM3"},
1275 { 0xe019, "RSA_SM4_CBC_SM3"},
1276 { 0xe01a, "RSA_SM4_CBC_SHA1"},
1277 { 0xe01c, "RSA_SM4_CBC_SHA256"},
1278 { 0xe051, "ECDHE_SM4_GCM_SM3"},
1279 { 0xe053, "ECC_SM4_GCM_SM3"},
1280 { 0xe055, "IBSDH_SM4_GCM_SM3"},
1281 { 0xe057, "IBC_SM4_GCM_SM3"},
1282 { 0xe059, "RSA_SM4_GCM_SM3"},
1283 { 0xe05a, "RSA_SM4_GCM_SHA256"},
1284 /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */
1285 { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1286 { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" },
1287 { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1288 { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" },
1289 { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" },
1290 { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" },
1291 { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1292 { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" },
1293 { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1294 { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" },
1295 { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1296 { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" },
1297 { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" },
1298 { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" },
1299 { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" },
1300 { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" },
1301 /* RFC 8701 */
1302 { 0xEAEA, "Reserved (GREASE)" },
1303 { 0xFAFA, "Reserved (GREASE)" },
1304 /* these from http://www.mozilla.org/projects/
1305 security/pki/nss/ssl/fips-ssl-ciphersuites.html */
1306 { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
1307 { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1308 /* https://datatracker.ietf.org/doc/html/rfc9189 */
1309 { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"},
1310 { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" },
1311 { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" },
1312 /* note that ciphersuites 0xff00 - 0xffff are private */
1313 { 0x00, NULL((void*)0) }
1314};
1315
1316value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite){ _try_val_to_str_ext_init, 0, (sizeof (ssl_31_ciphersuite) /
sizeof ((ssl_31_ciphersuite)[0]))-1, ssl_31_ciphersuite, "ssl_31_ciphersuite"
}
;
1317
1318/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */
1319const value_string tls_hello_extension_types[] = {
1320 { SSL_HND_HELLO_EXT_SERVER_NAME0, "server_name" }, /* RFC 6066 */
1321 { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1, "max_fragment_length" },/* RFC 6066 */
1322 { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL2, "client_certificate_url" }, /* RFC 6066 */
1323 { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3, "trusted_ca_keys" }, /* RFC 6066 */
1324 { SSL_HND_HELLO_EXT_TRUNCATED_HMAC4, "truncated_hmac" }, /* RFC 6066 */
1325 { SSL_HND_HELLO_EXT_STATUS_REQUEST5, "status_request" }, /* RFC 6066 */
1326 { SSL_HND_HELLO_EXT_USER_MAPPING6, "user_mapping" }, /* RFC 4681 */
1327 { SSL_HND_HELLO_EXT_CLIENT_AUTHZ7, "client_authz" }, /* RFC 5878 */
1328 { SSL_HND_HELLO_EXT_SERVER_AUTHZ8, "server_authz" }, /* RFC 5878 */
1329 { SSL_HND_HELLO_EXT_CERT_TYPE9, "cert_type" }, /* RFC 6091 */
1330 { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10, "supported_groups" }, /* RFC 4492, RFC 7919 */
1331 { SSL_HND_HELLO_EXT_EC_POINT_FORMATS11, "ec_point_formats" }, /* RFC 4492 */
1332 { SSL_HND_HELLO_EXT_SRP12, "srp" }, /* RFC 5054 */
1333 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13, "signature_algorithms" }, /* RFC 5246 */
1334 { SSL_HND_HELLO_EXT_USE_SRTP14, "use_srtp" }, /* RFC 5764 */
1335 { SSL_HND_HELLO_EXT_HEARTBEAT15, "heartbeat" }, /* RFC 6520 */
1336 { SSL_HND_HELLO_EXT_ALPN16, "application_layer_protocol_negotiation" }, /* RFC 7301 */
1337 { SSL_HND_HELLO_EXT_STATUS_REQUEST_V217, "status_request_v2" }, /* RFC 6961 */
1338 { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18, "signed_certificate_timestamp" }, /* RFC 6962 */
1339 { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19, "client_certificate_type" }, /* RFC 7250 */
1340 { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20, "server_certificate_type" }, /* RFC 7250 */
1341 { SSL_HND_HELLO_EXT_PADDING21, "padding" }, /* RFC 7685 */
1342 { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22, "encrypt_then_mac" }, /* RFC 7366 */
1343 { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23, "extended_master_secret" }, /* RFC 7627 */
1344 { SSL_HND_HELLO_EXT_TOKEN_BINDING24, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */
1345 { SSL_HND_HELLO_EXT_CACHED_INFO25, "cached_info" }, /* RFC 7924 */
1346 { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */
1347 { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28, "record_size_limit" }, /* RFC 8449 */
1348 { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */
1349 { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35, "session_ticket" }, /* RFC 5077 / RFC 8447 */
1350 { SSL_HND_HELLO_EXT_KEY_SHARE_OLD40, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */
1351 { SSL_HND_HELLO_EXT_PRE_SHARED_KEY41, "pre_shared_key" }, /* RFC 8446 */
1352 { SSL_HND_HELLO_EXT_EARLY_DATA42, "early_data" }, /* RFC 8446 */
1353 { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43, "supported_versions" }, /* RFC 8446 */
1354 { SSL_HND_HELLO_EXT_COOKIE44, "cookie" }, /* RFC 8446 */
1355 { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45, "psk_key_exchange_modes" }, /* RFC 8446 */
1356 { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */
1357 { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47, "certificate_authorities" }, /* RFC 8446 */
1358 { SSL_HND_HELLO_EXT_OID_FILTERS48, "oid_filters" }, /* RFC 8446 */
1359 { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49, "post_handshake_auth" }, /* RFC 8446 */
1360 { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50, "signature_algorithms_cert" }, /* RFC 8446 */
1361 { SSL_HND_HELLO_EXT_KEY_SHARE51, "key_share" }, /* RFC 8446 */
1362 { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO52, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */
1363 { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */
1364 { SSL_HND_HELLO_EXT_CONNECTION_ID54, "connection_id" }, /* RFC 9146 */
1365 { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH55, "external_id_hash" }, /* RFC 8844 */
1366 { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID56, "external_session_id" }, /* RFC 8844 */
1367 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */
1368 { SSL_HND_HELLO_EXT_TICKET_REQUEST58, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */
1369 { SSL_HND_HELLO_EXT_DNSSEC_CHAIN59, "dnssec_chain" }, /* RFC 9102 */
1370 { SSL_HND_HELLO_EXT_GREASE_0A0A2570, "Reserved (GREASE)" }, /* RFC 8701 */
1371 { SSL_HND_HELLO_EXT_GREASE_1A1A6682, "Reserved (GREASE)" }, /* RFC 8701 */
1372 { SSL_HND_HELLO_EXT_GREASE_2A2A10794, "Reserved (GREASE)" }, /* RFC 8701 */
1373 { SSL_HND_HELLO_EXT_NPN13172, "next_protocol_negotiation"}, /* https://tools.ietf.org/id/draft-agl-tls-nextprotoneg-03.html */
1374 { SSL_HND_HELLO_EXT_GREASE_3A3A14906, "Reserved (GREASE)" }, /* RFC 8701 */
1375 { SSL_HND_HELLO_EXT_ALPS_OLD17513, "application_settings_old" }, /* draft-vvv-tls-alps-01 */
1376 { SSL_HND_HELLO_EXT_ALPS17613, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */
1377 { SSL_HND_HELLO_EXT_GREASE_4A4A19018, "Reserved (GREASE)" }, /* RFC 8701 */
1378 { SSL_HND_HELLO_EXT_GREASE_5A5A23130, "Reserved (GREASE)" }, /* RFC 8701 */
1379 { SSL_HND_HELLO_EXT_GREASE_6A6A27242, "Reserved (GREASE)" }, /* RFC 8701 */
1380 { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD30031, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
1381 https://twitter.com/ericlaw/status/274237352531083264 */
1382 { SSL_HND_HELLO_EXT_CHANNEL_ID30032, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1383 https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */
1384 { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281, "renegotiation_info" }, /* RFC 5746 */
1385 { SSL_HND_HELLO_EXT_GREASE_7A7A31354, "Reserved (GREASE)" }, /* RFC 8701 */
1386 { SSL_HND_HELLO_EXT_GREASE_8A8A35466, "Reserved (GREASE)" }, /* RFC 8701 */
1387 { SSL_HND_HELLO_EXT_GREASE_9A9A39578, "Reserved (GREASE)" }, /* RFC 8701 */
1388 { SSL_HND_HELLO_EXT_GREASE_AAAA43690, "Reserved (GREASE)" }, /* RFC 8701 */
1389 { SSL_HND_HELLO_EXT_GREASE_BABA47802, "Reserved (GREASE)" }, /* RFC 8701 */
1390 { SSL_HND_HELLO_EXT_GREASE_CACA51914, "Reserved (GREASE)" }, /* RFC 8701 */
1391 { SSL_HND_HELLO_EXT_GREASE_DADA56026, "Reserved (GREASE)" }, /* RFC 8701 */
1392 { SSL_HND_HELLO_EXT_GREASE_EAEA60138, "Reserved (GREASE)" }, /* RFC 8701 */
1393 { SSL_HND_HELLO_EXT_GREASE_FAFA64250, "Reserved (GREASE)" }, /* RFC 8701 */
1394 { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */
1395 { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */
1396 { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1397 { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */
1398 { 0, NULL((void*)0) }
1399};
1400
1401const value_string tls_hello_ext_server_name_type_vs[] = {
1402 { 0, "host_name" },
1403 { 0, NULL((void*)0) }
1404};
1405
1406/* RFC 6066 Section 4 */
1407const value_string tls_hello_ext_max_fragment_length[] = {
1408 { 1, "512" }, // 2^9
1409 { 2, "1024" }, // 2^10
1410 { 3, "2048" }, // 2^11
1411 { 4, "4096" }, // 2^12
1412 { 0, NULL((void*)0) }
1413};
1414
1415/* RFC 8446 Section 4.2.9 */
1416const value_string tls_hello_ext_psk_ke_mode[] = {
1417 { 0, "PSK-only key establishment (psk_ke)" },
1418 { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" },
1419 { 0, NULL((void*)0) }
1420};
1421
1422/* RFC 6066 Section 6 */
1423const value_string tls_hello_ext_trusted_ca_key_type[] = {
1424 {0, "pre_agreed"},
1425 {1, "key_sha1_hash"},
1426 {2, "x509_name"},
1427 {3, "cert_sha1_hash"},
1428 {0, NULL((void*)0)}
1429};
1430
1431const value_string tls13_key_update_request[] = {
1432 { 0, "update_not_requested" },
1433 { 1, "update_requested" },
1434 { 0, NULL((void*)0) }
1435};
1436
1437/* RFC 5246 7.4.1.4.1 */
1438/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */
1439/* Note that the TLS 1.3 SignatureScheme registry reserves all values
1440 * with first octet 0x00-0x06 and all values with second octet 0x00-0x03
1441 * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm.
1442 *
1443 * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms
1444 * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm
1445 * and TLS HashAlgorithm registries, but the new values are not compatible
1446 * with all of the TLS 1.3-only SignatureSchemes. Adding those values could
1447 * cause confusion if used to interpret one of those schemes in a
1448 * signature_algorithms extension offered in a TLS 1.3 ClientHello.
1449 */
1450const value_string tls_hash_algorithm[] = {
1451 { 0, "None" },
1452 { 1, "MD5" },
1453 { 2, "SHA1" },
1454 { 3, "SHA224" },
1455 { 4, "SHA256" },
1456 { 5, "SHA384" },
1457 { 6, "SHA512" },
1458#if 0
1459 /* RFC 8422 adds this to the HashAlgorithm registry, but it really
1460 * only applies to 0x0807 and 0x0808, not for other TLS 1.3
1461 * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2.
1462 * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512.
1463 */
1464 { 8, "Intrinsic" },
1465#endif
1466 { 0, NULL((void*)0) }
1467};
1468
1469const value_string tls_signature_algorithm[] = {
1470 { 0, "Anonymous" },
1471 { 1, "RSA" },
1472 { 2, "DSA" },
1473 { 3, "ECDSA" },
1474#if 0
1475 /* As above. */
1476 { 7, "ED25519" },
1477 { 8, "ED448" },
1478 { 64, "GOSTR34102012_256" },
1479 { 65, "GOSTR34102012_512" },
1480#endif
1481 { 0, NULL((void*)0) }
1482};
1483
1484/* RFC 8446 Section 4.2.3 */
1485const value_string tls13_signature_algorithm[] = {
1486 { 0x0201, "rsa_pkcs1_sha1" },
1487 { 0x0203, "ecdsa_sha1" },
1488 { 0x0401, "rsa_pkcs1_sha256" },
1489 { 0x0403, "ecdsa_secp256r1_sha256" },
1490 { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1491 { 0x0501, "rsa_pkcs1_sha384" },
1492 { 0x0503, "ecdsa_secp384r1_sha384" },
1493 { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1494 { 0x0601, "rsa_pkcs1_sha512" },
1495 { 0x0603, "ecdsa_secp521r1_sha512" },
1496 { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */
1497 { 0x0708, "sm2sig_sm3" },
1498 { 0x0709, "gostr34102012_256a" }, /* RFC9367 */
1499 { 0x070a, "gostr34102012_256b" }, /* RFC9367 */
1500 { 0x070b, "gostr34102012_256c" }, /* RFC9367 */
1501 { 0x070c, "gostr34102012_256d" }, /* RFC9367 */
1502 { 0x070d, "gostr34102012_512a" }, /* RFC9367 */
1503 { 0x070e, "gostr34102012_512b" }, /* RFC9367 */
1504 { 0x070f, "gostr34102012_512c" }, /* RFC9367 */
1505 { 0x0804, "rsa_pss_rsae_sha256" },
1506 { 0x0805, "rsa_pss_rsae_sha384" },
1507 { 0x0806, "rsa_pss_rsae_sha512" },
1508 { 0x0807, "ed25519" },
1509 { 0x0808, "ed448" },
1510 { 0x0809, "rsa_pss_pss_sha256" },
1511 { 0x080a, "rsa_pss_pss_sha384" },
1512 { 0x080b, "rsa_pss_pss_sha512" },
1513 { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */
1514 { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */
1515 { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */
1516 /* PQC digital signature algorithms from OQS-OpenSSL,
1517 see https://github.com/open-quantum-safe/openssl/blob/OQS-OpenSSL_1_1_1-stable/oqs-template/oqs-sig-info.md */
1518 { 0xfea0, "dilithium2" },
1519 { 0xfea1, "p256_dilithium2" },
1520 { 0xfea2, "rsa3072_dilithium2" },
1521 { 0xfea3, "dilithium3" },
1522 { 0xfea4, "p384_dilithium3" },
1523 { 0xfea5, "dilithium5" },
1524 { 0xfea6, "p521_dilithium5" },
1525 { 0xfea7, "dilithium2_aes" },
1526 { 0xfea8, "p256_dilithium2_aes" },
1527 { 0xfea9, "rsa3072_dilithium2_aes" },
1528 { 0xfeaa, "dilithium3_aes" },
1529 { 0xfeab, "p384_dilithium3_aes" },
1530 { 0xfeac, "dilithium5_aes" },
1531 { 0xfead, "p521_dilithium5_aes" },
1532 { 0xfe0b, "falcon512" },
1533 { 0xfe0c, "p256_falcon512" },
1534 { 0xfe0d, "rsa3072_falcon512" },
1535 { 0xfe0e, "falcon1024" },
1536 { 0xfe0f, "p521_falcon1024" },
1537 { 0xfe96, "picnicl1full" },
1538 { 0xfe97, "p256_picnicl1full" },
1539 { 0xfe98, "rsa3072_picnicl1full" },
1540 { 0xfe1b, "picnic3l1" },
1541 { 0xfe1c, "p256_picnic3l1" },
1542 { 0xfe1d, "rsa3072_picnic3l1" },
1543 { 0xfe27, "rainbowIclassic" },
1544 { 0xfe28, "p256_rainbowIclassic" },
1545 { 0xfe29, "rsa3072_rainbowIclassic" },
1546 { 0xfe3c, "rainbowVclassic" },
1547 { 0xfe3d, "p521_rainbowVclassic" },
1548 { 0xfe42, "sphincsharaka128frobust" },
1549 { 0xfe43, "p256_sphincsharaka128frobust" },
1550 { 0xfe44, "rsa3072_sphincsharaka128frobust" },
1551 { 0xfe5e, "sphincssha256128frobust" },
1552 { 0xfe5f, "p256_sphincssha256128frobust" },
1553 { 0xfe60, "rsa3072_sphincssha256128frobust" },
1554 { 0xfe7a, "sphincsshake256128frobust" },
1555 { 0xfe7b, "p256_sphincsshake256128frobust" },
1556 { 0xfe7c, "rsa3072_sphincsshake256128frobust" },
1557 { 0, NULL((void*)0) }
1558};
1559
1560/* RFC 6091 3.1 */
1561const value_string tls_certificate_type[] = {
1562 { 0, "X.509" },
1563 { 1, "OpenPGP" },
1564 { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2, "Raw Public Key" }, /* RFC 7250 */
1565 { 0, NULL((void*)0) }
1566};
1567
1568const value_string tls_cert_chain_type[] = {
1569 { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT1, "Individual Certificates" },
1570 { SSL_HND_CERT_URL_TYPE_PKIPATH2, "PKI Path" },
1571 { 0, NULL((void*)0) }
1572};
1573
1574const value_string tls_cert_status_type[] = {
1575 { SSL_HND_CERT_STATUS_TYPE_OCSP1, "OCSP" },
1576 { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2, "OCSP Multi" },
1577 { 0, NULL((void*)0) }
1578};
1579
1580/* Generated by tools/make-tls-ct-logids.py
1581 * Last-Modified Sat, 09 Aug 2025 15:17:36 GMT, 181 entries. */
1582static const bytes_string ct_logids[] = {
1583 { (const uint8_t[]){
1584 0xb2, 0x1e, 0x05, 0xcc, 0x8b, 0xa2, 0xcd, 0x8a, 0x20, 0x4e, 0x87,
1585 0x66, 0xf9, 0x2b, 0xb9, 0x8a, 0x25, 0x20, 0x67, 0x6b, 0xda, 0xfa,
1586 0x70, 0xe7, 0xb2, 0x49, 0x53, 0x2d, 0xef, 0x8b, 0x90, 0x5e,
1587 },
1588 32, "Google 'Argon2020' log" },
1589 { (const uint8_t[]){
1590 0xf6, 0x5c, 0x94, 0x2f, 0xd1, 0x77, 0x30, 0x22, 0x14, 0x54, 0x18,
1591 0x08, 0x30, 0x94, 0x56, 0x8e, 0xe3, 0x4d, 0x13, 0x19, 0x33, 0xbf,
1592 0xdf, 0x0c, 0x2f, 0x20, 0x0b, 0xcc, 0x4e, 0xf1, 0x64, 0xe3,
1593 },
1594 32, "Google 'Argon2021' log" },
1595 { (const uint8_t[]){
1596 0x29, 0x79, 0xbe, 0xf0, 0x9e, 0x39, 0x39, 0x21, 0xf0, 0x56, 0x73,
1597 0x9f, 0x63, 0xa5, 0x77, 0xe5, 0xbe, 0x57, 0x7d, 0x9c, 0x60, 0x0a,
1598 0xf8, 0xf9, 0x4d, 0x5d, 0x26, 0x5c, 0x25, 0x5d, 0xc7, 0x84,
1599 },
1600 32, "Google 'Argon2022' log" },
1601 { (const uint8_t[]){
1602 0xe8, 0x3e, 0xd0, 0xda, 0x3e, 0xf5, 0x06, 0x35, 0x32, 0xe7, 0x57,
1603 0x28, 0xbc, 0x89, 0x6b, 0xc9, 0x03, 0xd3, 0xcb, 0xd1, 0x11, 0x6b,
1604 0xec, 0xeb, 0x69, 0xe1, 0x77, 0x7d, 0x6d, 0x06, 0xbd, 0x6e,
1605 },
1606 32, "Google 'Argon2023' log" },
1607 { (const uint8_t[]){
1608 0xee, 0xcd, 0xd0, 0x64, 0xd5, 0xdb, 0x1a, 0xce, 0xc5, 0x5c, 0xb7,
1609 0x9d, 0xb4, 0xcd, 0x13, 0xa2, 0x32, 0x87, 0x46, 0x7c, 0xbc, 0xec,
1610 0xde, 0xc3, 0x51, 0x48, 0x59, 0x46, 0x71, 0x1f, 0xb5, 0x9b,
1611 },
1612 32, "Google 'Argon2024' log" },
1613 { (const uint8_t[]){
1614 0x4e, 0x75, 0xa3, 0x27, 0x5c, 0x9a, 0x10, 0xc3, 0x38, 0x5b, 0x6c,
1615 0xd4, 0xdf, 0x3f, 0x52, 0xeb, 0x1d, 0xf0, 0xe0, 0x8e, 0x1b, 0x8d,
1616 0x69, 0xc0, 0xb1, 0xfa, 0x64, 0xb1, 0x62, 0x9a, 0x39, 0xdf,
1617 },
1618 32, "Google 'Argon2025h1' log" },
1619 { (const uint8_t[]){
1620 0x12, 0xf1, 0x4e, 0x34, 0xbd, 0x53, 0x72, 0x4c, 0x84, 0x06, 0x19,
1621 0xc3, 0x8f, 0x3f, 0x7a, 0x13, 0xf8, 0xe7, 0xb5, 0x62, 0x87, 0x88,
1622 0x9c, 0x6d, 0x30, 0x05, 0x84, 0xeb, 0xe5, 0x86, 0x26, 0x3a,
1623 },
1624 32, "Google 'Argon2025h2' log" },
1625 { (const uint8_t[]){
1626 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c,
1627 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32,
1628 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21,
1629 },
1630 32, "Google 'Argon2026h1' log" },
1631 { (const uint8_t[]){
1632 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9,
1633 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1,
1634 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77,
1635 },
1636 32, "Google 'Argon2026h2' log" },
1637 { (const uint8_t[]){
1638 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0,
1639 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c,
1640 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02,
1641 },
1642 32, "Google 'Argon2027h1'" },
1643 { (const uint8_t[]){
1644 0x07, 0xb7, 0x5c, 0x1b, 0xe5, 0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6,
1645 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6, 0x57, 0x7c, 0x57, 0x94, 0xb7,
1646 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69, 0xd3, 0xa2, 0x1c,
1647 },
1648 32, "Google 'Xenon2020' log" },
1649 { (const uint8_t[]){
1650 0x7d, 0x3e, 0xf2, 0xf8, 0x8f, 0xff, 0x88, 0x55, 0x68, 0x24, 0xc2,
1651 0xc0, 0xca, 0x9e, 0x52, 0x89, 0x79, 0x2b, 0xc5, 0x0e, 0x78, 0x09,
1652 0x7f, 0x2e, 0x6a, 0x97, 0x68, 0x99, 0x7e, 0x22, 0xf0, 0xd7,
1653 },
1654 32, "Google 'Xenon2021' log" },
1655 { (const uint8_t[]){
1656 0x46, 0xa5, 0x55, 0xeb, 0x75, 0xfa, 0x91, 0x20, 0x30, 0xb5, 0xa2,
1657 0x89, 0x69, 0xf4, 0xf3, 0x7d, 0x11, 0x2c, 0x41, 0x74, 0xbe, 0xfd,
1658 0x49, 0xb8, 0x85, 0xab, 0xf2, 0xfc, 0x70, 0xfe, 0x6d, 0x47,
1659 },
1660 32, "Google 'Xenon2022' log" },
1661 { (const uint8_t[]){
1662 0xad, 0xf7, 0xbe, 0xfa, 0x7c, 0xff, 0x10, 0xc8, 0x8b, 0x9d, 0x3d,
1663 0x9c, 0x1e, 0x3e, 0x18, 0x6a, 0xb4, 0x67, 0x29, 0x5d, 0xcf, 0xb1,
1664 0x0c, 0x24, 0xca, 0x85, 0x86, 0x34, 0xeb, 0xdc, 0x82, 0x8a,
1665 },
1666 32, "Google 'Xenon2023' log" },
1667 { (const uint8_t[]){
1668 0x76, 0xff, 0x88, 0x3f, 0x0a, 0xb6, 0xfb, 0x95, 0x51, 0xc2, 0x61,
1669 0xcc, 0xf5, 0x87, 0xba, 0x34, 0xb4, 0xa4, 0xcd, 0xbb, 0x29, 0xdc,
1670 0x68, 0x42, 0x0a, 0x9f, 0xe6, 0x67, 0x4c, 0x5a, 0x3a, 0x74,
1671 },
1672 32, "Google 'Xenon2024' log" },
1673 { (const uint8_t[]){
1674 0xcf, 0x11, 0x56, 0xee, 0xd5, 0x2e, 0x7c, 0xaf, 0xf3, 0x87, 0x5b,
1675 0xd9, 0x69, 0x2e, 0x9b, 0xe9, 0x1a, 0x71, 0x67, 0x4a, 0xb0, 0x17,
1676 0xec, 0xac, 0x01, 0xd2, 0x5b, 0x77, 0xce, 0xcc, 0x3b, 0x08,
1677 },
1678 32, "Google 'Xenon2025h1' log" },
1679 { (const uint8_t[]){
1680 0xdd, 0xdc, 0xca, 0x34, 0x95, 0xd7, 0xe1, 0x16, 0x05, 0xe7, 0x95,
1681 0x32, 0xfa, 0xc7, 0x9f, 0xf8, 0x3d, 0x1c, 0x50, 0xdf, 0xdb, 0x00,
1682 0x3a, 0x14, 0x12, 0x76, 0x0a, 0x2c, 0xac, 0xbb, 0xc8, 0x2a,
1683 },
1684 32, "Google 'Xenon2025h2' log" },
1685 { (const uint8_t[]){
1686 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87,
1687 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4,
1688 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6,
1689 },
1690 32, "Google 'Xenon2026h1' log" },
1691 { (const uint8_t[]){
1692 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19,
1693 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55,
1694 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14,
1695 },
1696 32, "Google 'Xenon2026h2' log" },
1697 { (const uint8_t[]){
1698 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a,
1699 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee,
1700 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66,
1701 },
1702 32, "Google 'Xenon2027h1'" },
1703 { (const uint8_t[]){
1704 0x68, 0xf6, 0x98, 0xf8, 0x1f, 0x64, 0x82, 0xbe, 0x3a, 0x8c, 0xee,
1705 0xb9, 0x28, 0x1d, 0x4c, 0xfc, 0x71, 0x51, 0x5d, 0x67, 0x93, 0xd4,
1706 0x44, 0xd1, 0x0a, 0x67, 0xac, 0xbb, 0x4f, 0x4f, 0xfb, 0xc4,
1707 },
1708 32, "Google 'Aviator' log" },
1709 { (const uint8_t[]){
1710 0x29, 0x3c, 0x51, 0x96, 0x54, 0xc8, 0x39, 0x65, 0xba, 0xaa, 0x50,
1711 0xfc, 0x58, 0x07, 0xd4, 0xb7, 0x6f, 0xbf, 0x58, 0x7a, 0x29, 0x72,
1712 0xdc, 0xa4, 0xc3, 0x0c, 0xf4, 0xe5, 0x45, 0x47, 0xf4, 0x78,
1713 },
1714 32, "Google 'Icarus' log" },
1715 { (const uint8_t[]){
1716 0xa4, 0xb9, 0x09, 0x90, 0xb4, 0x18, 0x58, 0x14, 0x87, 0xbb, 0x13,
1717 0xa2, 0xcc, 0x67, 0x70, 0x0a, 0x3c, 0x35, 0x98, 0x04, 0xf9, 0x1b,
1718 0xdf, 0xb8, 0xe3, 0x77, 0xcd, 0x0e, 0xc8, 0x0d, 0xdc, 0x10,
1719 },
1720 32, "Google 'Pilot' log" },
1721 { (const uint8_t[]){
1722 0xee, 0x4b, 0xbd, 0xb7, 0x75, 0xce, 0x60, 0xba, 0xe1, 0x42, 0x69,
1723 0x1f, 0xab, 0xe1, 0x9e, 0x66, 0xa3, 0x0f, 0x7e, 0x5f, 0xb0, 0x72,
1724 0xd8, 0x83, 0x00, 0xc4, 0x7b, 0x89, 0x7a, 0xa8, 0xfd, 0xcb,
1725 },
1726 32, "Google 'Rocketeer' log" },
1727 { (const uint8_t[]){
1728 0xbb, 0xd9, 0xdf, 0xbc, 0x1f, 0x8a, 0x71, 0xb5, 0x93, 0x94, 0x23,
1729 0x97, 0xaa, 0x92, 0x7b, 0x47, 0x38, 0x57, 0x95, 0x0a, 0xab, 0x52,
1730 0xe8, 0x1a, 0x90, 0x96, 0x64, 0x36, 0x8e, 0x1e, 0xd1, 0x85,
1731 },
1732 32, "Google 'Skydiver' log" },
1733 { (const uint8_t[]){
1734 0xfa, 0xd4, 0xc9, 0x7c, 0xc4, 0x9e, 0xe2, 0xf8, 0xac, 0x85, 0xc5,
1735 0xea, 0x5c, 0xea, 0x09, 0xd0, 0x22, 0x0d, 0xbb, 0xf4, 0xe4, 0x9c,
1736 0x6b, 0x50, 0x66, 0x2f, 0xf8, 0x68, 0xf8, 0x6b, 0x8c, 0x28,
1737 },
1738 32, "Google 'Argon2017' log" },
1739 { (const uint8_t[]){
1740 0xa4, 0x50, 0x12, 0x69, 0x05, 0x5a, 0x15, 0x54, 0x5e, 0x62, 0x11,
1741 0xab, 0x37, 0xbc, 0x10, 0x3f, 0x62, 0xae, 0x55, 0x76, 0xa4, 0x5e,
1742 0x4b, 0x17, 0x14, 0x45, 0x3e, 0x1b, 0x22, 0x10, 0x6a, 0x25,
1743 },
1744 32, "Google 'Argon2018' log" },
1745 { (const uint8_t[]){
1746 0x63, 0xf2, 0xdb, 0xcd, 0xe8, 0x3b, 0xcc, 0x2c, 0xcf, 0x0b, 0x72,
1747 0x84, 0x27, 0x57, 0x6b, 0x33, 0xa4, 0x8d, 0x61, 0x77, 0x8f, 0xbd,
1748 0x75, 0xa6, 0x38, 0xb1, 0xc7, 0x68, 0x54, 0x4b, 0xd8, 0x8d,
1749 },
1750 32, "Google 'Argon2019' log" },
1751 { (const uint8_t[]){
1752 0xb1, 0x0c, 0xd5, 0x59, 0xa6, 0xd6, 0x78, 0x46, 0x81, 0x1f, 0x7d,
1753 0xf9, 0xa5, 0x15, 0x32, 0x73, 0x9a, 0xc4, 0x8d, 0x70, 0x3b, 0xea,
1754 0x03, 0x23, 0xda, 0x5d, 0x38, 0x75, 0x5b, 0xc0, 0xad, 0x4e,
1755 },
1756 32, "Google 'Xenon2018' log" },
1757 { (const uint8_t[]){
1758 0x08, 0x41, 0x14, 0x98, 0x00, 0x71, 0x53, 0x2c, 0x16, 0x19, 0x04,
1759 0x60, 0xbc, 0xfc, 0x47, 0xfd, 0xc2, 0x65, 0x3a, 0xfa, 0x29, 0x2c,
1760 0x72, 0xb3, 0x7f, 0xf8, 0x63, 0xae, 0x29, 0xcc, 0xc9, 0xf0,
1761 },
1762 32, "Google 'Xenon2019' log" },
1763 { (const uint8_t[]){
1764 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3,
1765 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb,
1766 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81,
1767 },
1768 32, "Google 'Submariner' log" },
1769 { (const uint8_t[]){
1770 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87,
1771 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d,
1772 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb,
1773 },
1774 32, "Google 'Daedalus' log" },
1775 { (const uint8_t[]){
1776 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09,
1777 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c,
1778 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77,
1779 },
1780 32, "Google 'Testtube' log" },
1781 { (const uint8_t[]){
1782 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba,
1783 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb,
1784 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6,
1785 },
1786 32, "Google 'Crucible' log" },
1787 { (const uint8_t[]){
1788 0x52, 0xeb, 0x4b, 0x22, 0x5e, 0xc8, 0x96, 0x97, 0x48, 0x50, 0x67,
1789 0x5f, 0x23, 0xe4, 0x3b, 0xc1, 0xd0, 0x21, 0xe3, 0x21, 0x4c, 0xe5,
1790 0x2e, 0xcd, 0x5f, 0xa8, 0x7c, 0x20, 0x3c, 0xdf, 0xca, 0x03,
1791 },
1792 32, "Google 'Solera2018' log" },
1793 { (const uint8_t[]){
1794 0x0b, 0x76, 0x0e, 0x9a, 0x8b, 0x9a, 0x68, 0x2f, 0x88, 0x98, 0x5b,
1795 0x15, 0xe9, 0x47, 0x50, 0x1a, 0x56, 0x44, 0x6b, 0xba, 0x88, 0x30,
1796 0x78, 0x5c, 0x38, 0x42, 0x99, 0x43, 0x86, 0x45, 0x0c, 0x00,
1797 },
1798 32, "Google 'Solera2019' log" },
1799 { (const uint8_t[]){
1800 0x1f, 0xc7, 0x2c, 0xe5, 0xa1, 0xb7, 0x99, 0xf4, 0x00, 0xc3, 0x59,
1801 0xbf, 0xf9, 0x6c, 0xa3, 0x91, 0x35, 0x48, 0xe8, 0x64, 0x42, 0x20,
1802 0x61, 0x09, 0x52, 0xe9, 0xba, 0x17, 0x74, 0xf7, 0xba, 0xc7,
1803 },
1804 32, "Google 'Solera2020' log" },
1805 { (const uint8_t[]){
1806 0xa3, 0xc9, 0x98, 0x45, 0xe8, 0x0a, 0xb7, 0xce, 0x00, 0x15, 0x7b,
1807 0x37, 0x42, 0xdf, 0x02, 0x07, 0xdd, 0x27, 0x2b, 0x2b, 0x60, 0x2e,
1808 0xcf, 0x98, 0xee, 0x2c, 0x12, 0xdb, 0x9c, 0x5a, 0xe7, 0xe7,
1809 },
1810 32, "Google 'Solera2021' log" },
1811 { (const uint8_t[]){
1812 0x69, 0x7a, 0xaf, 0xca, 0x1a, 0x6b, 0x53, 0x6f, 0xae, 0x21, 0x20,
1813 0x50, 0x46, 0xde, 0xba, 0xd7, 0xe0, 0xea, 0xea, 0x13, 0xd2, 0x43,
1814 0x2e, 0x6e, 0x9d, 0x8f, 0xb3, 0x79, 0xf2, 0xb9, 0xaa, 0xf3,
1815 },
1816 32, "Google 'Solera2022' log" },
1817 { (const uint8_t[]){
1818 0xf9, 0x7e, 0x97, 0xb8, 0xd3, 0x3e, 0xf7, 0xa1, 0x59, 0x02, 0xa5,
1819 0x3a, 0x19, 0xe1, 0x79, 0x90, 0xe5, 0xdc, 0x40, 0x6a, 0x03, 0x18,
1820 0x25, 0xba, 0xad, 0x93, 0xe9, 0x8f, 0x9b, 0x9c, 0x69, 0xcb,
1821 },
1822 32, "Google 'Solera2023' log" },
1823 { (const uint8_t[]){
1824 0x30, 0x24, 0xce, 0x7e, 0xeb, 0x16, 0x88, 0x62, 0x72, 0x4b, 0xea,
1825 0x70, 0x2e, 0xff, 0xf9, 0x92, 0xcf, 0xe4, 0x56, 0x43, 0x41, 0x91,
1826 0xaa, 0x59, 0x5b, 0x25, 0xf8, 0x02, 0x26, 0xc8, 0x00, 0x17,
1827 },
1828 32, "Google 'Solera2024' log" },
1829 { (const uint8_t[]){
1830 0x3f, 0xe1, 0xcb, 0x46, 0xed, 0x47, 0x35, 0x79, 0xaf, 0x01, 0x41,
1831 0xf9, 0x72, 0x4d, 0x9d, 0xc4, 0x43, 0x47, 0x2d, 0x75, 0x6e, 0x85,
1832 0xe7, 0x71, 0x9c, 0x55, 0x82, 0x48, 0x5d, 0xd4, 0xe1, 0xe4,
1833 },
1834 32, "Google 'Solera2025h1' log" },
1835 { (const uint8_t[]){
1836 0x26, 0x02, 0x39, 0x48, 0x87, 0x4c, 0xf7, 0xfc, 0xd0, 0xfb, 0x64,
1837 0x71, 0xa4, 0x3e, 0x84, 0x7e, 0xbb, 0x20, 0x0a, 0xe6, 0xe2, 0xfa,
1838 0x24, 0x23, 0x6d, 0xf6, 0xd1, 0xa6, 0x06, 0x63, 0x0f, 0xb1,
1839 },
1840 32, "Google 'Solera2025h2' log" },
1841 { (const uint8_t[]){
1842 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2,
1843 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25,
1844 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9,
1845 },
1846 32, "Google 'Solera2026h1' log" },
1847 { (const uint8_t[]){
1848 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44,
1849 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85,
1850 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb,
1851 },
1852 32, "Google 'Solera2026h2' log" },
1853 { (const uint8_t[]){
1854 0x5e, 0xa7, 0x73, 0xf9, 0xdf, 0x56, 0xc0, 0xe7, 0xb5, 0x36, 0x48,
1855 0x7d, 0xd0, 0x49, 0xe0, 0x32, 0x7a, 0x91, 0x9a, 0x0c, 0x84, 0xa1,
1856 0x12, 0x12, 0x84, 0x18, 0x75, 0x96, 0x81, 0x71, 0x45, 0x58,
1857 },
1858 32, "Cloudflare 'Nimbus2020' Log" },
1859 { (const uint8_t[]){
1860 0x44, 0x94, 0x65, 0x2e, 0xb0, 0xee, 0xce, 0xaf, 0xc4, 0x40, 0x07,
1861 0xd8, 0xa8, 0xfe, 0x28, 0xc0, 0xda, 0xe6, 0x82, 0xbe, 0xd8, 0xcb,
1862 0x31, 0xb5, 0x3f, 0xd3, 0x33, 0x96, 0xb5, 0xb6, 0x81, 0xa8,
1863 },
1864 32, "Cloudflare 'Nimbus2021' Log" },
1865 { (const uint8_t[]){
1866 0x41, 0xc8, 0xca, 0xb1, 0xdf, 0x22, 0x46, 0x4a, 0x10, 0xc6, 0xa1,
1867 0x3a, 0x09, 0x42, 0x87, 0x5e, 0x4e, 0x31, 0x8b, 0x1b, 0x03, 0xeb,
1868 0xeb, 0x4b, 0xc7, 0x68, 0xf0, 0x90, 0x62, 0x96, 0x06, 0xf6,
1869 },
1870 32, "Cloudflare 'Nimbus2022' Log" },
1871 { (const uint8_t[]){
1872 0x7a, 0x32, 0x8c, 0x54, 0xd8, 0xb7, 0x2d, 0xb6, 0x20, 0xea, 0x38,
1873 0xe0, 0x52, 0x1e, 0xe9, 0x84, 0x16, 0x70, 0x32, 0x13, 0x85, 0x4d,
1874 0x3b, 0xd2, 0x2b, 0xc1, 0x3a, 0x57, 0xa3, 0x52, 0xeb, 0x52,
1875 },
1876 32, "Cloudflare 'Nimbus2023' Log" },
1877 { (const uint8_t[]){
1878 0xda, 0xb6, 0xbf, 0x6b, 0x3f, 0xb5, 0xb6, 0x22, 0x9f, 0x9b, 0xc2,
1879 0xbb, 0x5c, 0x6b, 0xe8, 0x70, 0x91, 0x71, 0x6c, 0xbb, 0x51, 0x84,
1880 0x85, 0x34, 0xbd, 0xa4, 0x3d, 0x30, 0x48, 0xd7, 0xfb, 0xab,
1881 },
1882 32, "Cloudflare 'Nimbus2024' Log" },
1883 { (const uint8_t[]){
1884 0xcc, 0xfb, 0x0f, 0x6a, 0x85, 0x71, 0x09, 0x65, 0xfe, 0x95, 0x9b,
1885 0x53, 0xce, 0xe9, 0xb2, 0x7c, 0x22, 0xe9, 0x85, 0x5c, 0x0d, 0x97,
1886 0x8d, 0xb6, 0xa9, 0x7e, 0x54, 0xc0, 0xfe, 0x4c, 0x0d, 0xb0,
1887 },
1888 32, "Cloudflare 'Nimbus2025'" },
1889 { (const uint8_t[]){
1890 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b,
1891 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a,
1892 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7,
1893 },
1894 32, "Cloudflare 'Nimbus2026'" },
1895 { (const uint8_t[]){
1896 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e,
1897 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f,
1898 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26,
1899 },
1900 32, "Cloudflare 'Nimbus2027'" },
1901 { (const uint8_t[]){
1902 0x1f, 0xbc, 0x36, 0xe0, 0x02, 0xed, 0xe9, 0x7f, 0x40, 0x19, 0x9e,
1903 0x86, 0xb3, 0x57, 0x3b, 0x8a, 0x42, 0x17, 0xd8, 0x01, 0x87, 0x74,
1904 0x6a, 0xd0, 0xda, 0x03, 0xa0, 0x60, 0x54, 0xd2, 0x0d, 0xf4,
1905 },
1906 32, "Cloudflare 'Nimbus2017' Log" },
1907 { (const uint8_t[]){
1908 0xdb, 0x74, 0xaf, 0xee, 0xcb, 0x29, 0xec, 0xb1, 0xfe, 0xca, 0x3e,
1909 0x71, 0x6d, 0x2c, 0xe5, 0xb9, 0xaa, 0xbb, 0x36, 0xf7, 0x84, 0x71,
1910 0x83, 0xc7, 0x5d, 0x9d, 0x4f, 0x37, 0xb6, 0x1f, 0xbf, 0x64,
1911 },
1912 32, "Cloudflare 'Nimbus2018' Log" },
1913 { (const uint8_t[]){
1914 0x74, 0x7e, 0xda, 0x83, 0x31, 0xad, 0x33, 0x10, 0x91, 0x21, 0x9c,
1915 0xce, 0x25, 0x4f, 0x42, 0x70, 0xc2, 0xbf, 0xfd, 0x5e, 0x42, 0x20,
1916 0x08, 0xc6, 0x37, 0x35, 0x79, 0xe6, 0x10, 0x7b, 0xcc, 0x56,
1917 },
1918 32, "Cloudflare 'Nimbus2019' Log" },
1919 { (const uint8_t[]){
1920 0x56, 0x14, 0x06, 0x9a, 0x2f, 0xd7, 0xc2, 0xec, 0xd3, 0xf5, 0xe1,
1921 0xbd, 0x44, 0xb2, 0x3e, 0xc7, 0x46, 0x76, 0xb9, 0xbc, 0x99, 0x11,
1922 0x5c, 0xc0, 0xef, 0x94, 0x98, 0x55, 0xd6, 0x89, 0xd0, 0xdd,
1923 },
1924 32, "DigiCert Log Server" },
1925 { (const uint8_t[]){
1926 0x87, 0x75, 0xbf, 0xe7, 0x59, 0x7c, 0xf8, 0x8c, 0x43, 0x99, 0x5f,
1927 0xbd, 0xf3, 0x6e, 0xff, 0x56, 0x8d, 0x47, 0x56, 0x36, 0xff, 0x4a,
1928 0xb5, 0x60, 0xc1, 0xb4, 0xea, 0xff, 0x5e, 0xa0, 0x83, 0x0f,
1929 },
1930 32, "DigiCert Log Server 2" },
1931 { (const uint8_t[]){
1932 0xf0, 0x95, 0xa4, 0x59, 0xf2, 0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d,
1933 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b, 0xfe, 0x1d, 0x47, 0xe3, 0x99,
1934 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa, 0x8e, 0xb2, 0x73,
1935 },
1936 32, "DigiCert Yeti2020 Log" },
1937 { (const uint8_t[]){
1938 0x5c, 0xdc, 0x43, 0x92, 0xfe, 0xe6, 0xab, 0x45, 0x44, 0xb1, 0x5e,
1939 0x9a, 0xd4, 0x56, 0xe6, 0x10, 0x37, 0xfb, 0xd5, 0xfa, 0x47, 0xdc,
1940 0xa1, 0x73, 0x94, 0xb2, 0x5e, 0xe6, 0xf6, 0xc7, 0x0e, 0xca,
1941 },
1942 32, "DigiCert Yeti2021 Log" },
1943 { (const uint8_t[]){
1944 0x22, 0x45, 0x45, 0x07, 0x59, 0x55, 0x24, 0x56, 0x96, 0x3f, 0xa1,
1945 0x2f, 0xf1, 0xf7, 0x6d, 0x86, 0xe0, 0x23, 0x26, 0x63, 0xad, 0xc0,
1946 0x4b, 0x7f, 0x5d, 0xc6, 0x83, 0x5c, 0x6e, 0xe2, 0x0f, 0x02,
1947 },
1948 32, "DigiCert Yeti2022 Log" },
1949 { (const uint8_t[]){
1950 0x35, 0xcf, 0x19, 0x1b, 0xbf, 0xb1, 0x6c, 0x57, 0xbf, 0x0f, 0xad,
1951 0x4c, 0x6d, 0x42, 0xcb, 0xbb, 0xb6, 0x27, 0x20, 0x26, 0x51, 0xea,
1952 0x3f, 0xe1, 0x2a, 0xef, 0xa8, 0x03, 0xc3, 0x3b, 0xd6, 0x4c,
1953 },
1954 32, "DigiCert Yeti2023 Log" },
1955 { (const uint8_t[]){
1956 0x48, 0xb0, 0xe3, 0x6b, 0xda, 0xa6, 0x47, 0x34, 0x0f, 0xe5, 0x6a,
1957 0x02, 0xfa, 0x9d, 0x30, 0xeb, 0x1c, 0x52, 0x01, 0xcb, 0x56, 0xdd,
1958 0x2c, 0x81, 0xd9, 0xbb, 0xbf, 0xab, 0x39, 0xd8, 0x84, 0x73,
1959 },
1960 32, "DigiCert Yeti2024 Log" },
1961 { (const uint8_t[]){
1962 0x7d, 0x59, 0x1e, 0x12, 0xe1, 0x78, 0x2a, 0x7b, 0x1c, 0x61, 0x67,
1963 0x7c, 0x5e, 0xfd, 0xf8, 0xd0, 0x87, 0x5c, 0x14, 0xa0, 0x4e, 0x95,
1964 0x9e, 0xb9, 0x03, 0x2f, 0xd9, 0x0e, 0x8c, 0x2e, 0x79, 0xb8,
1965 },
1966 32, "DigiCert Yeti2025 Log" },
1967 { (const uint8_t[]){
1968 0xc6, 0x52, 0xa0, 0xec, 0x48, 0xce, 0xb3, 0xfc, 0xab, 0x17, 0x09,
1969 0x92, 0xc4, 0x3a, 0x87, 0x41, 0x33, 0x09, 0xe8, 0x00, 0x65, 0xa2,
1970 0x62, 0x52, 0x40, 0x1b, 0xa3, 0x36, 0x2a, 0x17, 0xc5, 0x65,
1971 },
1972 32, "DigiCert Nessie2020 Log" },
1973 { (const uint8_t[]){
1974 0xee, 0xc0, 0x95, 0xee, 0x8d, 0x72, 0x64, 0x0f, 0x92, 0xe3, 0xc3,
1975 0xb9, 0x1b, 0xc7, 0x12, 0xa3, 0x69, 0x6a, 0x09, 0x7b, 0x4b, 0x6a,
1976 0x1a, 0x14, 0x38, 0xe6, 0x47, 0xb2, 0xcb, 0xed, 0xc5, 0xf9,
1977 },
1978 32, "DigiCert Nessie2021 Log" },
1979 { (const uint8_t[]){
1980 0x51, 0xa3, 0xb0, 0xf5, 0xfd, 0x01, 0x79, 0x9c, 0x56, 0x6d, 0xb8,
1981 0x37, 0x78, 0x8f, 0x0c, 0xa4, 0x7a, 0xcc, 0x1b, 0x27, 0xcb, 0xf7,
1982 0x9e, 0x88, 0x42, 0x9a, 0x0d, 0xfe, 0xd4, 0x8b, 0x05, 0xe5,
1983 },
1984 32, "DigiCert Nessie2022 Log" },
1985 { (const uint8_t[]){
1986 0xb3, 0x73, 0x77, 0x07, 0xe1, 0x84, 0x50, 0xf8, 0x63, 0x86, 0xd6,
1987 0x05, 0xa9, 0xdc, 0x11, 0x09, 0x4a, 0x79, 0x2d, 0xb1, 0x67, 0x0c,
1988 0x0b, 0x87, 0xdc, 0xf0, 0x03, 0x0e, 0x79, 0x36, 0xa5, 0x9a,
1989 },
1990 32, "DigiCert Nessie2023 Log" },
1991 { (const uint8_t[]){
1992 0x73, 0xd9, 0x9e, 0x89, 0x1b, 0x4c, 0x96, 0x78, 0xa0, 0x20, 0x7d,
1993 0x47, 0x9d, 0xe6, 0xb2, 0xc6, 0x1c, 0xd0, 0x51, 0x5e, 0x71, 0x19,
1994 0x2a, 0x8c, 0x6b, 0x80, 0x10, 0x7a, 0xc1, 0x77, 0x72, 0xb5,
1995 },
1996 32, "DigiCert Nessie2024 Log" },
1997 { (const uint8_t[]){
1998 0xe6, 0xd2, 0x31, 0x63, 0x40, 0x77, 0x8c, 0xc1, 0x10, 0x41, 0x06,
1999 0xd7, 0x71, 0xb9, 0xce, 0xc1, 0xd2, 0x40, 0xf6, 0x96, 0x84, 0x86,
2000 0xfb, 0xba, 0x87, 0x32, 0x1d, 0xfd, 0x1e, 0x37, 0x8e, 0x50,
2001 },
2002 32, "DigiCert Nessie2025 Log" },
2003 { (const uint8_t[]){
2004 0xb6, 0x9d, 0xdc, 0xbc, 0x3c, 0x1a, 0xbd, 0xef, 0x6f, 0x9f, 0xd6,
2005 0x0c, 0x88, 0xb1, 0x06, 0x7b, 0x77, 0xf0, 0x82, 0x68, 0x8b, 0x2d,
2006 0x78, 0x65, 0xd0, 0x4b, 0x39, 0xab, 0xe9, 0x27, 0xa5, 0x75,
2007 },
2008 32, "DigiCert 'Wyvern2024h1' Log" },
2009 { (const uint8_t[]){
2010 0x0c, 0x2a, 0xef, 0x2c, 0x4a, 0x5b, 0x98, 0x83, 0xd4, 0xdd, 0xa3,
2011 0x82, 0xfe, 0x50, 0xfb, 0x51, 0x88, 0xb3, 0xe9, 0x73, 0x33, 0xa1,
2012 0xec, 0x53, 0xa0, 0x9d, 0xc9, 0xa7, 0x9d, 0x0d, 0x08, 0x20,
2013 },
2014 32, "DigiCert 'Wyvern2024h2' Log" },
2015 { (const uint8_t[]){
2016 0x73, 0x20, 0x22, 0x0f, 0x08, 0x16, 0x8a, 0xf9, 0xf3, 0xc4, 0xa6,
2017 0x8b, 0x0a, 0xb2, 0x6a, 0x9a, 0x4a, 0x00, 0xee, 0xf5, 0x77, 0x85,
2018 0x8a, 0x08, 0x4d, 0x05, 0x00, 0xd4, 0xa5, 0x42, 0x44, 0x59,
2019 },
2020 32, "DigiCert 'Wyvern2025h1' Log" },
2021 { (const uint8_t[]){
2022 0xed, 0x3c, 0x4b, 0xd6, 0xe8, 0x06, 0xc2, 0xa4, 0xa2, 0x00, 0x57,
2023 0xdb, 0xcb, 0x24, 0xe2, 0x38, 0x01, 0xdf, 0x51, 0x2f, 0xed, 0xc4,
2024 0x86, 0xc5, 0x70, 0x0f, 0x20, 0xdd, 0xb7, 0x3e, 0x3f, 0xe0,
2025 },
2026 32, "DigiCert 'Wyvern2025h2' Log" },
2027 { (const uint8_t[]){
2028 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2,
2029 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35,
2030 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0,
2031 },
2032 32, "DigiCert 'Wyvern2026h1'" },
2033 { (const uint8_t[]){
2034 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38,
2035 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf,
2036 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd,
2037 },
2038 32, "DigiCert 'Wyvern2026h2'" },
2039 { (const uint8_t[]){
2040 0xdb, 0x07, 0x6c, 0xde, 0x6a, 0x8b, 0x78, 0xec, 0x58, 0xd6, 0x05,
2041 0x64, 0x96, 0xeb, 0x6a, 0x26, 0xa8, 0xc5, 0x9e, 0x72, 0x12, 0x93,
2042 0xe8, 0xac, 0x03, 0x27, 0xdd, 0xde, 0x89, 0xdb, 0x5a, 0x2a,
2043 },
2044 32, "DigiCert 'Sphinx2024h1' Log" },
2045 { (const uint8_t[]){
2046 0xdc, 0xc9, 0x5e, 0x6f, 0xa2, 0x99, 0xb9, 0xb0, 0xfd, 0xbd, 0x6c,
2047 0xa6, 0xa3, 0x6e, 0x1d, 0x72, 0xc4, 0x21, 0x2f, 0xdd, 0x1e, 0x0f,
2048 0x47, 0x55, 0x3a, 0x36, 0xd6, 0xcf, 0x1a, 0xd1, 0x1d, 0x8d,
2049 },
2050 32, "DigiCert 'Sphinx2024h2' Log" },
2051 { (const uint8_t[]){
2052 0xde, 0x85, 0x81, 0xd7, 0x50, 0x24, 0x7c, 0x6b, 0xcd, 0xcb, 0xaf,
2053 0x56, 0x37, 0xc5, 0xe7, 0x81, 0xc6, 0x4c, 0xe4, 0x6e, 0xd6, 0x17,
2054 0x63, 0x9f, 0x8f, 0x34, 0xa7, 0x26, 0xc9, 0xe2, 0xbd, 0x37,
2055 },
2056 32, "DigiCert 'Sphinx2025h1' Log" },
2057 { (const uint8_t[]){
2058 0xa4, 0x42, 0xc5, 0x06, 0x49, 0x60, 0x61, 0x54, 0x8f, 0x0f, 0xd4,
2059 0xea, 0x9c, 0xfb, 0x7a, 0x2d, 0x26, 0x45, 0x4d, 0x87, 0xa9, 0x7f,
2060 0x2f, 0xdf, 0x45, 0x59, 0xf6, 0x27, 0x4f, 0x3a, 0x84, 0x54,
2061 },
2062 32, "DigiCert 'Sphinx2025h2' Log" },
2063 { (const uint8_t[]){
2064 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde,
2065 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19,
2066 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3,
2067 },
2068 32, "DigiCert 'Sphinx2026h1'" },
2069 { (const uint8_t[]){
2070 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19,
2071 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02,
2072 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8,
2073 },
2074 32, "DigiCert 'Sphinx2026h2'" },
2075 { (const uint8_t[]){
2076 0xdd, 0xeb, 0x1d, 0x2b, 0x7a, 0x0d, 0x4f, 0xa6, 0x20, 0x8b, 0x81,
2077 0xad, 0x81, 0x68, 0x70, 0x7e, 0x2e, 0x8e, 0x9d, 0x01, 0xd5, 0x5c,
2078 0x88, 0x8d, 0x3d, 0x11, 0xc4, 0xcd, 0xb6, 0xec, 0xbe, 0xcc,
2079 },
2080 32, "Symantec log" },
2081 { (const uint8_t[]){
2082 0xbc, 0x78, 0xe1, 0xdf, 0xc5, 0xf6, 0x3c, 0x68, 0x46, 0x49, 0x33,
2083 0x4d, 0xa1, 0x0f, 0xa1, 0x5f, 0x09, 0x79, 0x69, 0x20, 0x09, 0xc0,
2084 0x81, 0xb4, 0xf3, 0xf6, 0x91, 0x7f, 0x3e, 0xd9, 0xb8, 0xa5,
2085 },
2086 32, "Symantec 'Vega' log" },
2087 { (const uint8_t[]){
2088 0x15, 0x97, 0x04, 0x88, 0xd7, 0xb9, 0x97, 0xa0, 0x5b, 0xeb, 0x52,
2089 0x51, 0x2a, 0xde, 0xe8, 0xd2, 0xe8, 0xb4, 0xa3, 0x16, 0x52, 0x64,
2090 0x12, 0x1a, 0x9f, 0xab, 0xfb, 0xd5, 0xf8, 0x5a, 0xd9, 0x3f,
2091 },
2092 32, "Symantec 'Sirius' log" },
2093 { (const uint8_t[]){
2094 0x05, 0x9c, 0x01, 0xd3, 0x20, 0xe0, 0x07, 0x84, 0x13, 0x95, 0x80,
2095 0x49, 0x8d, 0x11, 0x7c, 0x90, 0x32, 0x66, 0xaf, 0xaf, 0x72, 0x50,
2096 0xb5, 0xaf, 0x3b, 0x46, 0xa4, 0x3e, 0x11, 0x84, 0x0d, 0x4a,
2097 },
2098 32, "DigiCert Yeti2022-2 Log" },
2099 { (const uint8_t[]){
2100 0xc1, 0x16, 0x4a, 0xe0, 0xa7, 0x72, 0xd2, 0xd4, 0x39, 0x2d, 0xc8,
2101 0x0a, 0xc1, 0x07, 0x70, 0xd4, 0xf0, 0xc4, 0x9b, 0xde, 0x99, 0x1a,
2102 0x48, 0x40, 0xc1, 0xfa, 0x07, 0x51, 0x64, 0xf6, 0x33, 0x60,
2103 },
2104 32, "DigiCert Yeti2018 Log" },
2105 { (const uint8_t[]){
2106 0xe2, 0x69, 0x4b, 0xae, 0x26, 0xe8, 0xe9, 0x40, 0x09, 0xe8, 0x86,
2107 0x1b, 0xb6, 0x3b, 0x83, 0xd4, 0x3e, 0xe7, 0xfe, 0x74, 0x88, 0xfb,
2108 0xa4, 0x8f, 0x28, 0x93, 0x01, 0x9d, 0xdd, 0xf1, 0xdb, 0xfe,
2109 },
2110 32, "DigiCert Yeti2019 Log" },
2111 { (const uint8_t[]){
2112 0x6f, 0xf1, 0x41, 0xb5, 0x64, 0x7e, 0x42, 0x22, 0xf7, 0xef, 0x05,
2113 0x2c, 0xef, 0xae, 0x7c, 0x21, 0xfd, 0x60, 0x8e, 0x27, 0xd2, 0xaf,
2114 0x5a, 0x6e, 0x9f, 0x4b, 0x8a, 0x37, 0xd6, 0x63, 0x3e, 0xe5,
2115 },
2116 32, "DigiCert Nessie2018 Log" },
2117 { (const uint8_t[]){
2118 0xfe, 0x44, 0x61, 0x08, 0xb1, 0xd0, 0x1a, 0xb7, 0x8a, 0x62, 0xcc,
2119 0xfe, 0xab, 0x6a, 0xb2, 0xb2, 0xba, 0xbf, 0xf3, 0xab, 0xda, 0xd8,
2120 0x0a, 0x4d, 0x8b, 0x30, 0xdf, 0x2d, 0x00, 0x08, 0x83, 0x0c,
2121 },
2122 32, "DigiCert Nessie2019 Log" },
2123 { (const uint8_t[]){
2124 0xa7, 0xce, 0x4a, 0x4e, 0x62, 0x07, 0xe0, 0xad, 0xde, 0xe5, 0xfd,
2125 0xaa, 0x4b, 0x1f, 0x86, 0x76, 0x87, 0x67, 0xb5, 0xd0, 0x02, 0xa5,
2126 0x5d, 0x47, 0x31, 0x0e, 0x7e, 0x67, 0x0a, 0x95, 0xea, 0xb2,
2127 },
2128 32, "Symantec Deneb" },
2129 { (const uint8_t[]){
2130 0xcd, 0xb5, 0x17, 0x9b, 0x7f, 0xc1, 0xc0, 0x46, 0xfe, 0xea, 0x31,
2131 0x13, 0x6a, 0x3f, 0x8f, 0x00, 0x2e, 0x61, 0x82, 0xfa, 0xf8, 0x89,
2132 0x6f, 0xec, 0xc8, 0xb2, 0xf5, 0xb5, 0xab, 0x60, 0x49, 0x00,
2133 },
2134 32, "Certly.IO log" },
2135 { (const uint8_t[]){
2136 0x74, 0x61, 0xb4, 0xa0, 0x9c, 0xfb, 0x3d, 0x41, 0xd7, 0x51, 0x59,
2137 0x57, 0x5b, 0x2e, 0x76, 0x49, 0xa4, 0x45, 0xa8, 0xd2, 0x77, 0x09,
2138 0xb0, 0xcc, 0x56, 0x4a, 0x64, 0x82, 0xb7, 0xeb, 0x41, 0xa3,
2139 },
2140 32, "Izenpe log" },
2141 { (const uint8_t[]){
2142 0x89, 0x41, 0x44, 0x9c, 0x70, 0x74, 0x2e, 0x06, 0xb9, 0xfc, 0x9c,
2143 0xe7, 0xb1, 0x16, 0xba, 0x00, 0x24, 0xaa, 0x36, 0xd5, 0x9a, 0xf4,
2144 0x4f, 0x02, 0x04, 0x40, 0x4f, 0x00, 0xf7, 0xea, 0x85, 0x66,
2145 },
2146 32, "Izenpe 'Argi' log" },
2147 { (const uint8_t[]){
2148 0x41, 0xb2, 0xdc, 0x2e, 0x89, 0xe6, 0x3c, 0xe4, 0xaf, 0x1b, 0xa7,
2149 0xbb, 0x29, 0xbf, 0x68, 0xc6, 0xde, 0xe6, 0xf9, 0xf1, 0xcc, 0x04,
2150 0x7e, 0x30, 0xdf, 0xfa, 0xe3, 0xb3, 0xba, 0x25, 0x92, 0x63,
2151 },
2152 32, "WoSign log" },
2153 { (const uint8_t[]){
2154 0x9e, 0x4f, 0xf7, 0x3d, 0xc3, 0xce, 0x22, 0x0b, 0x69, 0x21, 0x7c,
2155 0x89, 0x9e, 0x46, 0x80, 0x76, 0xab, 0xf8, 0xd7, 0x86, 0x36, 0xd5,
2156 0xcc, 0xfc, 0x85, 0xa3, 0x1a, 0x75, 0x62, 0x8b, 0xa8, 0x8b,
2157 },
2158 32, "WoSign CT log #1" },
2159 { (const uint8_t[]){
2160 0x63, 0xd0, 0x00, 0x60, 0x26, 0xdd, 0xe1, 0x0b, 0xb0, 0x60, 0x1f,
2161 0x45, 0x24, 0x46, 0x96, 0x5e, 0xe2, 0xb6, 0xea, 0x2c, 0xd4, 0xfb,
2162 0xc9, 0x5a, 0xc8, 0x66, 0xa5, 0x50, 0xaf, 0x90, 0x75, 0xb7,
2163 },
2164 32, "WoSign log 2" },
2165 { (const uint8_t[]){
2166 0xac, 0x3b, 0x9a, 0xed, 0x7f, 0xa9, 0x67, 0x47, 0x57, 0x15, 0x9e,
2167 0x6d, 0x7d, 0x57, 0x56, 0x72, 0xf9, 0xd9, 0x81, 0x00, 0x94, 0x1e,
2168 0x9b, 0xde, 0xff, 0xec, 0xa1, 0x31, 0x3b, 0x75, 0x78, 0x2d,
2169 },
2170 32, "Venafi log" },
2171 { (const uint8_t[]){
2172 0x03, 0x01, 0x9d, 0xf3, 0xfd, 0x85, 0xa6, 0x9a, 0x8e, 0xbd, 0x1f,
2173 0xac, 0xc6, 0xda, 0x9b, 0xa7, 0x3e, 0x46, 0x97, 0x74, 0xfe, 0x77,
2174 0xf5, 0x79, 0xfc, 0x5a, 0x08, 0xb8, 0x32, 0x8c, 0x1d, 0x6b,
2175 },
2176 32, "Venafi Gen2 CT log" },
2177 { (const uint8_t[]){
2178 0xa5, 0x77, 0xac, 0x9c, 0xed, 0x75, 0x48, 0xdd, 0x8f, 0x02, 0x5b,
2179 0x67, 0xa2, 0x41, 0x08, 0x9d, 0xf8, 0x6e, 0x0f, 0x47, 0x6e, 0xc2,
2180 0x03, 0xc2, 0xec, 0xbe, 0xdb, 0x18, 0x5f, 0x28, 0x26, 0x38,
2181 },
2182 32, "CNNIC CT log" },
2183 { (const uint8_t[]){
2184 0x34, 0xbb, 0x6a, 0xd6, 0xc3, 0xdf, 0x9c, 0x03, 0xee, 0xa8, 0xa4,
2185 0x99, 0xff, 0x78, 0x91, 0x48, 0x6c, 0x9d, 0x5e, 0x5c, 0xac, 0x92,
2186 0xd0, 0x1f, 0x7b, 0xfd, 0x1b, 0xce, 0x19, 0xdb, 0x48, 0xef,
2187 },
2188 32, "StartCom log" },
2189 { (const uint8_t[]){
2190 0x55, 0x81, 0xd4, 0xc2, 0x16, 0x90, 0x36, 0x01, 0x4a, 0xea, 0x0b,
2191 0x9b, 0x57, 0x3c, 0x53, 0xf0, 0xc0, 0xe4, 0x38, 0x78, 0x70, 0x25,
2192 0x08, 0x17, 0x2f, 0xa3, 0xaa, 0x1d, 0x07, 0x13, 0xd3, 0x0c,
2193 },
2194 32, "Sectigo 'Sabre' CT log" },
2195 { (const uint8_t[]){
2196 0xa2, 0xe2, 0xbf, 0xd6, 0x1e, 0xde, 0x2f, 0x2f, 0x07, 0xa0, 0xd6,
2197 0x4e, 0x6d, 0x37, 0xa7, 0xdc, 0x65, 0x43, 0xb0, 0xc6, 0xb5, 0x2e,
2198 0xa2, 0xda, 0xb7, 0x8a, 0xf8, 0x9a, 0x6d, 0xf5, 0x17, 0xd8,
2199 },
2200 32, "Sectigo 'Sabre2024h1'" },
2201 { (const uint8_t[]){
2202 0x19, 0x98, 0x10, 0x71, 0x09, 0xf0, 0xd6, 0x52, 0x2e, 0x30, 0x80,
2203 0xd2, 0x9e, 0x3f, 0x64, 0xbb, 0x83, 0x6e, 0x28, 0xcc, 0xf9, 0x0f,
2204 0x52, 0x8e, 0xee, 0xdf, 0xce, 0x4a, 0x3f, 0x16, 0xb4, 0xca,
2205 },
2206 32, "Sectigo 'Sabre2024h2'" },
2207 { (const uint8_t[]){
2208 0xe0, 0x92, 0xb3, 0xfc, 0x0c, 0x1d, 0xc8, 0xe7, 0x68, 0x36, 0x1f,
2209 0xde, 0x61, 0xb9, 0x96, 0x4d, 0x0a, 0x52, 0x78, 0x19, 0x8a, 0x72,
2210 0xd6, 0x72, 0xc4, 0xb0, 0x4d, 0xa5, 0x6d, 0x6f, 0x54, 0x04,
2211 },
2212 32, "Sectigo 'Sabre2025h1'" },
2213 { (const uint8_t[]){
2214 0x1a, 0x04, 0xff, 0x49, 0xd0, 0x54, 0x1d, 0x40, 0xaf, 0xf6, 0xa0,
2215 0xc3, 0xbf, 0xf1, 0xd8, 0xc4, 0x67, 0x2f, 0x4e, 0xec, 0xee, 0x23,
2216 0x40, 0x68, 0x98, 0x6b, 0x17, 0x40, 0x2e, 0xdc, 0x89, 0x7d,
2217 },
2218 32, "Sectigo 'Sabre2025h2'" },
2219 { (const uint8_t[]){
2220 0x6f, 0x53, 0x76, 0xac, 0x31, 0xf0, 0x31, 0x19, 0xd8, 0x99, 0x00,
2221 0xa4, 0x51, 0x15, 0xff, 0x77, 0x15, 0x1c, 0x11, 0xd9, 0x02, 0xc1,
2222 0x00, 0x29, 0x06, 0x8d, 0xb2, 0x08, 0x9a, 0x37, 0xd9, 0x13,
2223 },
2224 32, "Sectigo 'Mammoth' CT log" },
2225 { (const uint8_t[]){
2226 0x29, 0xd0, 0x3a, 0x1b, 0xb6, 0x74, 0xaa, 0x71, 0x1c, 0xd3, 0x03,
2227 0x5b, 0x65, 0x57, 0xc1, 0x4f, 0x8a, 0xa7, 0x8b, 0x4f, 0xe8, 0x38,
2228 0x94, 0x49, 0xec, 0xa4, 0x53, 0xf9, 0x44, 0xbd, 0x24, 0x68,
2229 },
2230 32, "Sectigo 'Mammoth2024h1'" },
2231 { (const uint8_t[]){
2232 0x50, 0x85, 0x01, 0x58, 0xdc, 0xb6, 0x05, 0x95, 0xc0, 0x0e, 0x92,
2233 0xa8, 0x11, 0x02, 0xec, 0xcd, 0xfe, 0x3f, 0x6b, 0x78, 0x58, 0x42,
2234 0x9f, 0x57, 0x98, 0x35, 0x38, 0xc9, 0xda, 0x52, 0x50, 0x63,
2235 },
2236 32, "Sectigo 'Mammoth2024h1b'" },
2237 { (const uint8_t[]){
2238 0xdf, 0xe1, 0x56, 0xeb, 0xaa, 0x05, 0xaf, 0xb5, 0x9c, 0x0f, 0x86,
2239 0x71, 0x8d, 0xa8, 0xc0, 0x32, 0x4e, 0xae, 0x56, 0xd9, 0x6e, 0xa7,
2240 0xf5, 0xa5, 0x6a, 0x01, 0xd1, 0xc1, 0x3b, 0xbe, 0x52, 0x5c,
2241 },
2242 32, "Sectigo 'Mammoth2024h2'" },
2243 { (const uint8_t[]){
2244 0x13, 0x4a, 0xdf, 0x1a, 0xb5, 0x98, 0x42, 0x09, 0x78, 0x0c, 0x6f,
2245 0xef, 0x4c, 0x7a, 0x91, 0xa4, 0x16, 0xb7, 0x23, 0x49, 0xce, 0x58,
2246 0x57, 0x6a, 0xdf, 0xae, 0xda, 0xa7, 0xc2, 0xab, 0xe0, 0x22,
2247 },
2248 32, "Sectigo 'Mammoth2025h1'" },
2249 { (const uint8_t[]){
2250 0xaf, 0x18, 0x1a, 0x28, 0xd6, 0x8c, 0xa3, 0xe0, 0xa9, 0x8a, 0x4c,
2251 0x9c, 0x67, 0xab, 0x09, 0xf8, 0xbb, 0xbc, 0x22, 0xba, 0xae, 0xbc,
2252 0xb1, 0x38, 0xa3, 0xa1, 0x9d, 0xd3, 0xf9, 0xb6, 0x03, 0x0d,
2253 },
2254 32, "Sectigo 'Mammoth2025h2'" },
2255 { (const uint8_t[]){
2256 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a,
2257 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d,
2258 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b,
2259 },
2260 32, "Sectigo 'Mammoth2026h1'" },
2261 { (const uint8_t[]){
2262 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac,
2263 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9,
2264 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c,
2265 },
2266 32, "Sectigo 'Mammoth2026h2'" },
2267 { (const uint8_t[]){
2268 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6,
2269 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82,
2270 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01,
2271 },
2272 32, "Sectigo 'Sabre2026h1'" },
2273 { (const uint8_t[]){
2274 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea,
2275 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6,
2276 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f,
2277 },
2278 32, "Sectigo 'Sabre2026h2'" },
2279 { (const uint8_t[]){
2280 0x0d, 0x1d, 0xbc, 0x89, 0x44, 0xe9, 0xf5, 0x00, 0x55, 0x42, 0xd7,
2281 0x2d, 0x3e, 0x14, 0x4c, 0xcc, 0x43, 0x08, 0x2a, 0xb6, 0xea, 0x1e,
2282 0x94, 0xdf, 0xd7, 0x06, 0x65, 0x7d, 0x2e, 0x86, 0xf3, 0x01,
2283 },
2284 32, "Sectigo 'Elephant2025h2'" },
2285 { (const uint8_t[]){
2286 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f,
2287 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4,
2288 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04,
2289 },
2290 32, "Sectigo 'Elephant2026h1'" },
2291 { (const uint8_t[]){
2292 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9,
2293 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0,
2294 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a,
2295 },
2296 32, "Sectigo 'Elephant2026h2'" },
2297 { (const uint8_t[]){
2298 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06,
2299 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9,
2300 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9,
2301 },
2302 32, "Sectigo 'Elephant2027h1'" },
2303 { (const uint8_t[]){
2304 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17,
2305 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d,
2306 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7,
2307 },
2308 32, "Sectigo 'Elephant2027h2'" },
2309 { (const uint8_t[]){
2310 0x5c, 0xa5, 0x77, 0xd2, 0x9b, 0x7f, 0x8b, 0xaf, 0x41, 0x9e, 0xd8,
2311 0xec, 0xab, 0xfb, 0x6d, 0xcb, 0xae, 0xc3, 0x85, 0x37, 0x02, 0xd5,
2312 0x74, 0x6f, 0x17, 0x4d, 0xad, 0x3c, 0x93, 0x4a, 0xa9, 0x6a,
2313 },
2314 32, "Sectigo 'Tiger2025h2'" },
2315 { (const uint8_t[]){
2316 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a,
2317 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6,
2318 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa,
2319 },
2320 32, "Sectigo 'Tiger2026h1'" },
2321 { (const uint8_t[]){
2322 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01,
2323 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6,
2324 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a,
2325 },
2326 32, "Sectigo 'Tiger2026h2'" },
2327 { (const uint8_t[]){
2328 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8,
2329 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6,
2330 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f,
2331 },
2332 32, "Sectigo 'Tiger2027h1'" },
2333 { (const uint8_t[]){
2334 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc,
2335 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7,
2336 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6,
2337 },
2338 32, "Sectigo 'Tiger2027h2'" },
2339 { (const uint8_t[]){
2340 0xdb, 0x76, 0xfd, 0xad, 0xac, 0x65, 0xe7, 0xd0, 0x95, 0x08, 0x88,
2341 0x6e, 0x21, 0x59, 0xbd, 0x8b, 0x90, 0x35, 0x2f, 0x5f, 0xea, 0xd3,
2342 0xe3, 0xdc, 0x5e, 0x22, 0xeb, 0x35, 0x0a, 0xcc, 0x7b, 0x98,
2343 },
2344 32, "Sectigo 'Dodo' CT log" },
2345 { (const uint8_t[]){
2346 0xe7, 0x12, 0xf2, 0xb0, 0x37, 0x7e, 0x1a, 0x62, 0xfb, 0x8e, 0xc9,
2347 0x0c, 0x61, 0x84, 0xf1, 0xea, 0x7b, 0x37, 0xcb, 0x56, 0x1d, 0x11,
2348 0x26, 0x5b, 0xf3, 0xe0, 0xf3, 0x4b, 0xf2, 0x41, 0x54, 0x6e,
2349 },
2350 32, "Let's Encrypt 'Oak2020' log" },
2351 { (const uint8_t[]){
2352 0x94, 0x20, 0xbc, 0x1e, 0x8e, 0xd5, 0x8d, 0x6c, 0x88, 0x73, 0x1f,
2353 0x82, 0x8b, 0x22, 0x2c, 0x0d, 0xd1, 0xda, 0x4d, 0x5e, 0x6c, 0x4f,
2354 0x94, 0x3d, 0x61, 0xdb, 0x4e, 0x2f, 0x58, 0x4d, 0xa2, 0xc2,
2355 },
2356 32, "Let's Encrypt 'Oak2021' log" },
2357 { (const uint8_t[]){
2358 0xdf, 0xa5, 0x5e, 0xab, 0x68, 0x82, 0x4f, 0x1f, 0x6c, 0xad, 0xee,
2359 0xb8, 0x5f, 0x4e, 0x3e, 0x5a, 0xea, 0xcd, 0xa2, 0x12, 0xa4, 0x6a,
2360 0x5e, 0x8e, 0x3b, 0x12, 0xc0, 0x20, 0x44, 0x5c, 0x2a, 0x73,
2361 },
2362 32, "Let's Encrypt 'Oak2022' log" },
2363 { (const uint8_t[]){
2364 0xb7, 0x3e, 0xfb, 0x24, 0xdf, 0x9c, 0x4d, 0xba, 0x75, 0xf2, 0x39,
2365 0xc5, 0xba, 0x58, 0xf4, 0x6c, 0x5d, 0xfc, 0x42, 0xcf, 0x7a, 0x9f,
2366 0x35, 0xc4, 0x9e, 0x1d, 0x09, 0x81, 0x25, 0xed, 0xb4, 0x99,
2367 },
2368 32, "Let's Encrypt 'Oak2023' log" },
2369 { (const uint8_t[]){
2370 0x3b, 0x53, 0x77, 0x75, 0x3e, 0x2d, 0xb9, 0x80, 0x4e, 0x8b, 0x30,
2371 0x5b, 0x06, 0xfe, 0x40, 0x3b, 0x67, 0xd8, 0x4f, 0xc3, 0xf4, 0xc7,
2372 0xbd, 0x00, 0x0d, 0x2d, 0x72, 0x6f, 0xe1, 0xfa, 0xd4, 0x17,
2373 },
2374 32, "Let's Encrypt 'Oak2024H1' log" },
2375 { (const uint8_t[]){
2376 0x3f, 0x17, 0x4b, 0x4f, 0xd7, 0x22, 0x47, 0x58, 0x94, 0x1d, 0x65,
2377 0x1c, 0x84, 0xbe, 0x0d, 0x12, 0xed, 0x90, 0x37, 0x7f, 0x1f, 0x85,
2378 0x6a, 0xeb, 0xc1, 0xbf, 0x28, 0x85, 0xec, 0xf8, 0x64, 0x6e,
2379 },
2380 32, "Let's Encrypt 'Oak2024H2' log" },
2381 { (const uint8_t[]){
2382 0xa2, 0xe3, 0x0a, 0xe4, 0x45, 0xef, 0xbd, 0xad, 0x9b, 0x7e, 0x38,
2383 0xed, 0x47, 0x67, 0x77, 0x53, 0xd7, 0x82, 0x5b, 0x84, 0x94, 0xd7,
2384 0x2b, 0x5e, 0x1b, 0x2c, 0xc4, 0xb9, 0x50, 0xa4, 0x47, 0xe7,
2385 },
2386 32, "Let's Encrypt 'Oak2025h1'" },
2387 { (const uint8_t[]){
2388 0x0d, 0xe1, 0xf2, 0x30, 0x2b, 0xd3, 0x0d, 0xc1, 0x40, 0x62, 0x12,
2389 0x09, 0xea, 0x55, 0x2e, 0xfc, 0x47, 0x74, 0x7c, 0xb1, 0xd7, 0xe9,
2390 0x30, 0xef, 0x0e, 0x42, 0x1e, 0xb4, 0x7e, 0x4e, 0xaa, 0x34,
2391 },
2392 32, "Let's Encrypt 'Oak2025h2'" },
2393 { (const uint8_t[]){
2394 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f,
2395 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f,
2396 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4,
2397 },
2398 32, "Let's Encrypt 'Oak2026h1'" },
2399 { (const uint8_t[]){
2400 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13,
2401 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2,
2402 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3,
2403 },
2404 32, "Let's Encrypt 'Oak2026h2'" },
2405 { (const uint8_t[]){
2406 0x65, 0x9b, 0x33, 0x50, 0xf4, 0x3b, 0x12, 0xcc, 0x5e, 0xa5, 0xab,
2407 0x4e, 0xc7, 0x65, 0xd3, 0xfd, 0xe6, 0xc8, 0x82, 0x43, 0x77, 0x77,
2408 0x78, 0xe7, 0x20, 0x03, 0xf9, 0xeb, 0x2b, 0x8c, 0x31, 0x29,
2409 },
2410 32, "Let's Encrypt 'Oak2019' log" },
2411 { (const uint8_t[]){
2412 0x84, 0x9f, 0x5f, 0x7f, 0x58, 0xd2, 0xbf, 0x7b, 0x54, 0xec, 0xbd,
2413 0x74, 0x61, 0x1c, 0xea, 0x45, 0xc4, 0x9c, 0x98, 0xf1, 0xd6, 0x48,
2414 0x1b, 0xc6, 0xf6, 0x9e, 0x8c, 0x17, 0x4f, 0x24, 0xf3, 0xcf,
2415 },
2416 32, "Let's Encrypt 'Testflume2019' log" },
2417 { (const uint8_t[]){
2418 0x23, 0x2d, 0x41, 0xa4, 0xcd, 0xac, 0x87, 0xce, 0xd9, 0xf9, 0x43,
2419 0xf4, 0x68, 0xc2, 0x82, 0x09, 0x5a, 0xe0, 0x9d, 0x30, 0xd6, 0x2e,
2420 0x2f, 0xa6, 0x5d, 0xdc, 0x3b, 0x91, 0x9c, 0x2e, 0x46, 0x8f,
2421 },
2422 32, "Let's Encrypt 'Sapling 2022h2' log" },
2423 { (const uint8_t[]){
2424 0xc1, 0x83, 0x24, 0x0b, 0xf1, 0xa4, 0x50, 0xc7, 0x6f, 0xbb, 0x00,
2425 0x72, 0x69, 0xdc, 0xac, 0x3b, 0xe2, 0x2a, 0x48, 0x05, 0xd4, 0xdb,
2426 0xe0, 0x49, 0x66, 0xc3, 0xc8, 0xab, 0xc4, 0x47, 0xb0, 0x0c,
2427 },
2428 32, "Let's Encrypt 'Sapling 2023h1' log" },
2429 { (const uint8_t[]){
2430 0xc6, 0x3f, 0x22, 0x18, 0xc3, 0x7d, 0x56, 0xa6, 0xaa, 0x06, 0xb5,
2431 0x96, 0xda, 0x8e, 0x53, 0xd4, 0xd7, 0x15, 0x6d, 0x1e, 0x9b, 0xac,
2432 0x8e, 0x44, 0xd2, 0x20, 0x2d, 0xe6, 0x4d, 0x69, 0xd9, 0xdc,
2433 },
2434 32, "Let's Encrypt 'Testflume2020' log" },
2435 { (const uint8_t[]){
2436 0x03, 0xed, 0xf1, 0xda, 0x97, 0x76, 0xb6, 0xf3, 0x8c, 0x34, 0x1e,
2437 0x39, 0xed, 0x9d, 0x70, 0x7a, 0x75, 0x70, 0x36, 0x9c, 0xf9, 0x84,
2438 0x4f, 0x32, 0x7f, 0xe9, 0xe1, 0x41, 0x38, 0x36, 0x1b, 0x60,
2439 },
2440 32, "Let's Encrypt 'Testflume2021' log" },
2441 { (const uint8_t[]){
2442 0x23, 0x27, 0xef, 0xda, 0x35, 0x25, 0x10, 0xdb, 0xc0, 0x19, 0xef,
2443 0x49, 0x1a, 0xe3, 0xff, 0x1c, 0xc5, 0xa4, 0x79, 0xbc, 0xe3, 0x78,
2444 0x78, 0x36, 0x0e, 0xe3, 0x18, 0xcf, 0xfb, 0x64, 0xf8, 0xc8,
2445 },
2446 32, "Let's Encrypt 'Testflume2022' log" },
2447 { (const uint8_t[]){
2448 0x55, 0x34, 0xb7, 0xab, 0x5a, 0x6a, 0xc3, 0xa7, 0xcb, 0xeb, 0xa6,
2449 0x54, 0x87, 0xb2, 0xa2, 0xd7, 0x1b, 0x48, 0xf6, 0x50, 0xfa, 0x17,
2450 0xc5, 0x19, 0x7c, 0x97, 0xa0, 0xcb, 0x20, 0x76, 0xf3, 0xc6,
2451 },
2452 32, "Let's Encrypt 'Testflume2023' log" },
2453 { (const uint8_t[]){
2454 0x29, 0x6a, 0xfa, 0x2d, 0x56, 0x8b, 0xca, 0x0d, 0x2e, 0xa8, 0x44,
2455 0x95, 0x6a, 0xe9, 0x72, 0x1f, 0xc3, 0x5f, 0xa3, 0x55, 0xec, 0xda,
2456 0x99, 0x69, 0x3a, 0xaf, 0xd4, 0x58, 0xa7, 0x1a, 0xef, 0xdd,
2457 },
2458 32, "Let's Encrypt 'Clicky' log" },
2459 { (const uint8_t[]){
2460 0xa5, 0x95, 0x94, 0x3b, 0x53, 0x70, 0xbe, 0xe9, 0x06, 0xe0, 0x05,
2461 0x0d, 0x1f, 0xb5, 0xbb, 0xc6, 0xa4, 0x0e, 0x65, 0xf2, 0x65, 0xae,
2462 0x85, 0x2c, 0x76, 0x36, 0x3f, 0xad, 0xb2, 0x33, 0x36, 0xed,
2463 },
2464 32, "Trust Asia Log2020" },
2465 { (const uint8_t[]){
2466 0xa8, 0xdc, 0x52, 0xf6, 0x3d, 0x6b, 0x24, 0x25, 0xe5, 0x31, 0xe3,
2467 0x7c, 0xf4, 0xe4, 0x4a, 0x71, 0x4f, 0x14, 0x2a, 0x20, 0x80, 0x3b,
2468 0x0d, 0x04, 0xd2, 0xe2, 0xee, 0x06, 0x64, 0x79, 0x4a, 0x23,
2469 },
2470 32, "Trust Asia CT2021" },
2471 { (const uint8_t[]){
2472 0x67, 0x8d, 0xb6, 0x5b, 0x3e, 0x74, 0x43, 0xb6, 0xf3, 0xa3, 0x70,
2473 0xd5, 0xe1, 0x3a, 0xb1, 0xb4, 0x3b, 0xe0, 0xa0, 0xd3, 0x51, 0xf7,
2474 0xca, 0x74, 0x22, 0x50, 0xc7, 0xc6, 0xfa, 0x51, 0xa8, 0x8a,
2475 },
2476 32, "Trust Asia Log2021" },
2477 { (const uint8_t[]){
2478 0xc3, 0x65, 0xf9, 0xb3, 0x65, 0x4f, 0x32, 0x83, 0xc7, 0x9d, 0xa9,
2479 0x8e, 0x93, 0xd7, 0x41, 0x8f, 0x5b, 0xab, 0x7b, 0xe3, 0x25, 0x2c,
2480 0x98, 0xe1, 0xd2, 0xf0, 0x4b, 0xb9, 0xeb, 0x42, 0x7d, 0x23,
2481 },
2482 32, "Trust Asia Log2022" },
2483 { (const uint8_t[]){
2484 0xe8, 0x7e, 0xa7, 0x66, 0x0b, 0xc2, 0x6c, 0xf6, 0x00, 0x2e, 0xf5,
2485 0x72, 0x5d, 0x3f, 0xe0, 0xe3, 0x31, 0xb9, 0x39, 0x3b, 0xb9, 0x2f,
2486 0xbf, 0x58, 0xeb, 0x3b, 0x90, 0x49, 0xda, 0xf5, 0x43, 0x5a,
2487 },
2488 32, "Trust Asia Log2023" },
2489 { (const uint8_t[]){
2490 0x30, 0x6d, 0x29, 0x57, 0x6a, 0xd2, 0x1a, 0x9d, 0x4a, 0xe1, 0x2a,
2491 0xca, 0xd8, 0xaa, 0x8a, 0x78, 0x3a, 0xa6, 0x5a, 0x32, 0x11, 0x60,
2492 0xac, 0xff, 0x5b, 0x0e, 0xee, 0x4c, 0xa3, 0x20, 0x1d, 0x05,
2493 },
2494 32, "Trust Asia Log2024" },
2495 { (const uint8_t[]){
2496 0x87, 0x4f, 0xb5, 0x0d, 0xc0, 0x29, 0xd9, 0x93, 0x1d, 0xe5, 0x73,
2497 0xe9, 0xf2, 0x89, 0x9e, 0x8e, 0x45, 0x33, 0xb3, 0x92, 0xd3, 0x8b,
2498 0x0a, 0x46, 0x25, 0x74, 0xbf, 0x0f, 0xee, 0xb2, 0xfc, 0x1e,
2499 },
2500 32, "Trust Asia Log2024-2" },
2501 { (const uint8_t[]){
2502 0x28, 0xe2, 0x81, 0x38, 0xfd, 0x83, 0x21, 0x45, 0xe9, 0xa9, 0xd6,
2503 0xaa, 0x75, 0x37, 0x6d, 0x83, 0x77, 0xa8, 0x85, 0x12, 0xb3, 0xc0,
2504 0x7f, 0x72, 0x41, 0x48, 0x21, 0xdc, 0xbd, 0xe9, 0x8c, 0x66,
2505 },
2506 32, "TrustAsia Log2025a" },
2507 { (const uint8_t[]){
2508 0x28, 0x2c, 0x8b, 0xdd, 0x81, 0x0f, 0xf9, 0x09, 0x12, 0x0a, 0xce,
2509 0x16, 0xd6, 0xe0, 0xec, 0x20, 0x1b, 0xea, 0x82, 0xa3, 0xa4, 0xaf,
2510 0x19, 0xd9, 0xef, 0xfb, 0x59, 0xe8, 0x3f, 0xdc, 0x42, 0x68,
2511 },
2512 32, "TrustAsia Log2025b" },
2513 { (const uint8_t[]){
2514 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a,
2515 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29,
2516 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc,
2517 },
2518 32, "TrustAsia 'log2026a'" },
2519 { (const uint8_t[]){
2520 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07,
2521 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8,
2522 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65,
2523 },
2524 32, "TrustAsia 'log2026b'" },
2525 { (const uint8_t[]){
2526 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b,
2527 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a,
2528 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7,
2529 },
2530 32, "TrustAsia 'HETU2027'" },
2531 { (const uint8_t[]){
2532 0x45, 0x35, 0x94, 0x98, 0xd9, 0x3a, 0x89, 0xe0, 0x28, 0x03, 0x08,
2533 0xd3, 0x7d, 0x62, 0x6d, 0xc4, 0x23, 0x75, 0x47, 0x58, 0xdc, 0xe0,
2534 0x37, 0x00, 0x36, 0xfb, 0xab, 0x0e, 0xdf, 0x8a, 0x6b, 0xcf,
2535 },
2536 32, "Trust Asia Log1" },
2537 { (const uint8_t[]){
2538 0xc9, 0xcf, 0x89, 0x0a, 0x21, 0x10, 0x9c, 0x66, 0x6c, 0xc1, 0x7a,
2539 0x3e, 0xd0, 0x65, 0xc9, 0x30, 0xd0, 0xe0, 0x13, 0x5a, 0x9f, 0xeb,
2540 0xa8, 0x5a, 0xf1, 0x42, 0x10, 0xb8, 0x07, 0x24, 0x21, 0xaa,
2541 },
2542 32, "GDCA CT log #1" },
2543 { (const uint8_t[]){
2544 0x92, 0x4a, 0x30, 0xf9, 0x09, 0x33, 0x6f, 0xf4, 0x35, 0xd6, 0x99,
2545 0x3a, 0x10, 0xac, 0x75, 0xa2, 0xc6, 0x41, 0x72, 0x8e, 0x7f, 0xc2,
2546 0xd6, 0x59, 0xae, 0x61, 0x88, 0xff, 0xad, 0x40, 0xce, 0x01,
2547 },
2548 32, "GDCA CT log #2" },
2549 { (const uint8_t[]){
2550 0x71, 0x7e, 0xa7, 0x42, 0x09, 0x75, 0xbe, 0x84, 0xa2, 0x72, 0x35,
2551 0x53, 0xf1, 0x77, 0x7c, 0x26, 0xdd, 0x51, 0xaf, 0x4e, 0x10, 0x21,
2552 0x44, 0x09, 0x4d, 0x90, 0x19, 0xb4, 0x62, 0xfb, 0x66, 0x68,
2553 },
2554 32, "GDCA Log 1" },
2555 { (const uint8_t[]){
2556 0x14, 0x30, 0x8d, 0x90, 0xcc, 0xd0, 0x30, 0x13, 0x50, 0x05, 0xc0,
2557 0x1c, 0xa5, 0x26, 0xd8, 0x1e, 0x84, 0xe8, 0x76, 0x24, 0xe3, 0x9b,
2558 0x62, 0x48, 0xe0, 0x8f, 0x72, 0x4a, 0xea, 0x3b, 0xb4, 0x2a,
2559 },
2560 32, "GDCA Log 2" },
2561 { (const uint8_t[]){
2562 0xe0, 0x12, 0x76, 0x29, 0xe9, 0x04, 0x96, 0x56, 0x4e, 0x3d, 0x01,
2563 0x47, 0x98, 0x44, 0x98, 0xaa, 0x48, 0xf8, 0xad, 0xb1, 0x66, 0x00,
2564 0xeb, 0x79, 0x02, 0xa1, 0xef, 0x99, 0x09, 0x90, 0x62, 0x73,
2565 },
2566 32, "PuChuangSiDa CT log" },
2567 { (const uint8_t[]){
2568 0x53, 0x7b, 0x69, 0xa3, 0x56, 0x43, 0x35, 0xa9, 0xc0, 0x49, 0x04,
2569 0xe3, 0x95, 0x93, 0xb2, 0xc2, 0x98, 0xeb, 0x8d, 0x7a, 0x6e, 0x83,
2570 0x02, 0x36, 0x35, 0xc6, 0x27, 0x24, 0x8c, 0xd6, 0xb4, 0x40,
2571 },
2572 32, "Nordu 'flimsy' log" },
2573 { (const uint8_t[]){
2574 0xaa, 0xe7, 0x0b, 0x7f, 0x3c, 0xb8, 0xd5, 0x66, 0xc8, 0x6c, 0x2f,
2575 0x16, 0x97, 0x9c, 0x9f, 0x44, 0x5f, 0x69, 0xab, 0x0e, 0xb4, 0x53,
2576 0x55, 0x89, 0xb2, 0xf7, 0x7a, 0x03, 0x01, 0x04, 0xf3, 0xcd,
2577 },
2578 32, "Nordu 'plausible' log" },
2579 { (const uint8_t[]){
2580 0xcf, 0x55, 0xe2, 0x89, 0x23, 0x49, 0x7c, 0x34, 0x0d, 0x52, 0x06,
2581 0xd0, 0x53, 0x53, 0xae, 0xb2, 0x58, 0x34, 0xb5, 0x2f, 0x1f, 0x8d,
2582 0xc9, 0x52, 0x68, 0x09, 0xf2, 0x12, 0xef, 0xdd, 0x7c, 0xa6,
2583 },
2584 32, "SHECA CT log 1" },
2585 { (const uint8_t[]){
2586 0x32, 0xdc, 0x59, 0xc2, 0xd4, 0xc4, 0x19, 0x68, 0xd5, 0x6e, 0x14,
2587 0xbc, 0x61, 0xac, 0x8f, 0x0e, 0x45, 0xdb, 0x39, 0xfa, 0xf3, 0xc1,
2588 0x55, 0xaa, 0x42, 0x52, 0xf5, 0x00, 0x1f, 0xa0, 0xc6, 0x23,
2589 },
2590 32, "SHECA CT log 2" },
2591 { (const uint8_t[]){
2592 0x96, 0x06, 0xc0, 0x2c, 0x69, 0x00, 0x33, 0xaa, 0x1d, 0x14, 0x5f,
2593 0x59, 0xc6, 0xe2, 0x64, 0x8d, 0x05, 0x49, 0xf0, 0xdf, 0x96, 0xaa,
2594 0xb8, 0xdb, 0x91, 0x5a, 0x70, 0xd8, 0xec, 0xf3, 0x90, 0xa5,
2595 },
2596 32, "Akamai CT Log" },
2597 { (const uint8_t[]){
2598 0x39, 0x37, 0x6f, 0x54, 0x5f, 0x7b, 0x46, 0x07, 0xf5, 0x97, 0x42,
2599 0xd7, 0x68, 0xcd, 0x5d, 0x24, 0x37, 0xbf, 0x34, 0x73, 0xb6, 0x53,
2600 0x4a, 0x48, 0x34, 0xbc, 0xf7, 0x2e, 0x68, 0x1c, 0x83, 0xc9,
2601 },
2602 32, "Alpha CT Log" },
2603 { (const uint8_t[]){
2604 0xb0, 0xb7, 0x84, 0xbc, 0x81, 0xc0, 0xdd, 0xc4, 0x75, 0x44, 0xe8,
2605 0x83, 0xf0, 0x59, 0x85, 0xbb, 0x90, 0x77, 0xd1, 0x34, 0xd8, 0xab,
2606 0x88, 0xb2, 0xb2, 0xe5, 0x33, 0x98, 0x0b, 0x8e, 0x50, 0x8b,
2607 },
2608 32, "Up In The Air 'Behind the Sofa' log" },
2609 { (const uint8_t[]){
2610 0x47, 0x44, 0x47, 0x7c, 0x75, 0xde, 0x42, 0x6d, 0x5c, 0x44, 0xef,
2611 0xd4, 0xa9, 0x2c, 0x96, 0x77, 0x59, 0x7f, 0x65, 0x7a, 0x8f, 0xe0,
2612 0xca, 0xdb, 0xc6, 0xd6, 0x16, 0xed, 0xa4, 0x97, 0xc4, 0x25,
2613 },
2614 32, "Qihoo 360 2020" },
2615 { (const uint8_t[]){
2616 0xc6, 0xd7, 0xed, 0x9e, 0xdb, 0x8e, 0x74, 0xf0, 0xa7, 0x1b, 0x4d,
2617 0x4a, 0x98, 0x4b, 0xcb, 0xeb, 0xab, 0xbd, 0x28, 0xcc, 0x1f, 0xd7,
2618 0x63, 0x29, 0xe8, 0x87, 0x26, 0xcd, 0x4c, 0x25, 0x46, 0x63,
2619 },
2620 32, "Qihoo 360 2021" },
2621 { (const uint8_t[]){
2622 0x66, 0x3c, 0xb0, 0x9c, 0x1f, 0xcd, 0x9b, 0xaa, 0x62, 0x76, 0x3c,
2623 0xcb, 0x53, 0x4e, 0xec, 0x80, 0x58, 0x12, 0x28, 0x05, 0x07, 0xac,
2624 0x69, 0xa4, 0x5f, 0xcd, 0x38, 0xcf, 0x4c, 0xc7, 0x4c, 0xf1,
2625 },
2626 32, "Qihoo 360 2022" },
2627 { (const uint8_t[]){
2628 0xe2, 0x64, 0x7f, 0x6e, 0xda, 0x34, 0x05, 0x03, 0xc6, 0x4d, 0x4e,
2629 0x10, 0xa8, 0x69, 0x68, 0x1f, 0xde, 0x9c, 0x5a, 0x2c, 0xf3, 0xb3,
2630 0x2d, 0x5f, 0x20, 0x0b, 0x96, 0x36, 0x05, 0x90, 0x88, 0x23,
2631 },
2632 32, "Qihoo 360 2023" },
2633 { (const uint8_t[]){
2634 0xc5, 0xcf, 0xe5, 0x4b, 0x61, 0x51, 0xb4, 0x9b, 0x14, 0x2e, 0xd2,
2635 0x63, 0xbd, 0xe7, 0x32, 0x93, 0x36, 0x37, 0x99, 0x79, 0x95, 0x50,
2636 0xae, 0x44, 0x35, 0xcd, 0x1a, 0x69, 0x97, 0xc9, 0xc3, 0xc3,
2637 },
2638 32, "Qihoo 360 v1 2020" },
2639 { (const uint8_t[]){
2640 0x48, 0x14, 0x58, 0x7c, 0xf2, 0x8b, 0x08, 0xfe, 0x68, 0x3f, 0xd2,
2641 0xbc, 0xd9, 0x45, 0x99, 0x4c, 0x2e, 0xb7, 0x4c, 0x8a, 0xe8, 0xc8,
2642 0x7f, 0xce, 0x42, 0x9b, 0x7c, 0xd3, 0x1d, 0x51, 0xbd, 0xc4,
2643 },
2644 32, "Qihoo 360 v1 2021" },
2645 { (const uint8_t[]){
2646 0x49, 0x11, 0xb8, 0xd6, 0x14, 0xcf, 0xd3, 0xd9, 0x9f, 0x16, 0xd3,
2647 0x76, 0x54, 0x5e, 0xe1, 0xb8, 0xcc, 0xfc, 0x51, 0x1f, 0x50, 0x9f,
2648 0x08, 0x0b, 0xa0, 0xa0, 0x87, 0xd9, 0x1d, 0xfa, 0xee, 0xa9,
2649 },
2650 32, "Qihoo 360 v1 2022" },
2651 { (const uint8_t[]){
2652 0xb6, 0x74, 0x0b, 0x12, 0x00, 0x2e, 0x03, 0x3f, 0xd0, 0xe7, 0xe9,
2653 0x41, 0xf4, 0xba, 0x3e, 0xe1, 0xbf, 0xc1, 0x49, 0xb5, 0x24, 0xb4,
2654 0xcf, 0x62, 0x8d, 0x53, 0xef, 0xea, 0x1f, 0x40, 0x3a, 0x8d,
2655 },
2656 32, "Qihoo 360 v1 2023" },
2657 { (const uint8_t[]){
2658 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76,
2659 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a,
2660 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70,
2661 },
2662 32, "Bogus placeholder log to unbreak misbehaving CT libraries" },
2663 { (const uint8_t[]){
2664 0x39, 0xb9, 0x87, 0x88, 0x28, 0x19, 0x5f, 0x3b, 0x2d, 0x0d, 0x1b,
2665 0x48, 0x14, 0xa3, 0xae, 0x8c, 0x0d, 0x01, 0xfe, 0x48, 0x62, 0x21,
2666 0xdd, 0x69, 0x39, 0x7d, 0x76, 0xf7, 0x85, 0x74, 0x11, 0xc3,
2667 },
2668 32, "Merklemap 'CompactLog' log" },
2669 { NULL((void*)0), 0, NULL((void*)0) }
2670};
2671
2672/*
2673 * Application-Layer Protocol Negotiation (ALPN) dissector tables.
2674 */
2675static dissector_table_t ssl_alpn_dissector_table;
2676static dissector_table_t dtls_alpn_dissector_table;
2677
2678/*
2679 * Special cases for prefix matching of the ALPN, if the ALPN includes
2680 * a version number for a draft or protocol revision.
2681 */
2682typedef struct ssl_alpn_prefix_match_protocol {
2683 const char *proto_prefix;
2684 const char *dissector_name;
2685} ssl_alpn_prefix_match_protocol_t;
2686
2687static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = {
2688 /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there
2689 * already exists 3.1 as of this writing... match the prefix. */
2690 { "spdy/", "spdy" },
2691 /* draft-ietf-httpbis-http2-16 */
2692 { "h2-", "http2" }, /* draft versions */
2693};
2694
2695const value_string compress_certificate_algorithm_vals[] = {
2696 { 1, "zlib" },
2697 { 2, "brotli" },
2698 { 3, "zstd" },
2699 { 0, NULL((void*)0) }
2700};
2701
2702
2703const val64_string quic_transport_parameter_id[] = {
2704 { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00, "original_destination_connection_id" },
2705 { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01, "max_idle_timeout" },
2706 { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02, "stateless_reset_token" },
2707 { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03, "max_udp_payload_size" },
2708 { SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04, "initial_max_data" },
2709 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05, "initial_max_stream_data_bidi_local" },
2710 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06, "initial_max_stream_data_bidi_remote" },
2711 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07, "initial_max_stream_data_uni" },
2712 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09, "initial_max_streams_uni" },
2713 { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08, "initial_max_streams_bidi" },
2714 { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a, "ack_delay_exponent" },
2715 { SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b, "max_ack_delay" },
2716 { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c, "disable_active_migration" },
2717 { SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d, "preferred_address" },
2718 { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e, "active_connection_id_limit" },
2719 { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f, "initial_source_connection_id" },
2720 { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10, "retry_source_connection_id" },
2721 { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20, "max_datagram_frame_size" },
2722 { SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000, "cibir_encoding" },
2723 { SSL_HND_QUIC_TP_LOSS_BITS0x1057, "loss_bits" },
2724 { SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2, "grease_quic_bit" },
2725 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157, "enable_time_stamp" },
2726 { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158, "enable_time_stamp_v2" },
2727 { SSL_HND_QUIC_TP_VERSION_INFORMATION0x11, "version_information" },
2728 { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db, "version_information_draft" },
2729 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a, "min_ack_delay" },
2730 { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129, "google_user_agent" },
2731 { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B, "google_key_update_not_yet_supported" },
2732 { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752, "google_quic_version" },
2733 { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127, "google_initial_rtt" },
2734 { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A, "google_support_handshake_done" },
2735 { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751, "google_quic_params" },
2736 { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128, "google_connection_options" },
2737 { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00, "facebook_partial_reliability" },
2738 { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176, "address_discovery" },
2739 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A, "min_ack_delay (draft-01)" },
2740 { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a, "min_ack_delay (draft-05)" },
2741 { SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b, "min_ack_delay" },
2742 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04, "enable_multipath (draft-04)" },
2743 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05, "enable_multipath (draft-05)" },
2744 { SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06, "enable_multipath (draft-06)" },
2745 { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07, "initial_max_paths (draft-07/08)" },
2746 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09, "initial_max_path_id (draft-09/10)" },
2747 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11, "initial_max_path_id (draft-11)" },
2748 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c, "initial_max_path_id (draft-12)" },
2749 { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d, "initial_max_path_id" },
2750 { 0, NULL((void*)0) }
2751};
2752
2753/* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */
2754const val64_string quic_address_discovery_vals[] = {
2755 { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" },
2756 { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" },
2757 { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" },
2758 { 0, NULL((void*)0) }
2759};
2760
2761/* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
2762const val64_string quic_enable_time_stamp_v2_vals[] = {
2763 { 1, "I would like to receive TIME_STAMP frames" },
2764 { 2, "I am able to generate TIME_STAMP frames" },
2765 { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" },
2766 { 0, NULL((void*)0) }
2767};
2768
2769/* https://tools.ietf.org/html/draft-multipath-04 */
2770const val64_string quic_enable_multipath_vals[] = {
2771 { 0, "don't support multipath" },
2772 { 1, "support multipath as defined in this document" },
2773 { 0, NULL((void*)0) }
2774};
2775
2776/* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */
2777const value_string tls_hello_ext_ech_clienthello_types[] = {
2778 { 0, "Outer Client Hello" },
2779 { 1, "Inner Client Hello" },
2780 { 0, NULL((void*)0) }
2781};
2782
2783/* RFC 9180 */
2784const value_string kem_id_type_vals[] = {
2785 { 0x0000, "Reserved" },
2786 { 0x0010, "DHKEM(P-256, HKDF-SHA256)" },
2787 { 0x0011, "DHKEM(P-384, HKDF-SHA384)" },
2788 { 0x0012, "DHKEM(P-521, HKDF-SHA512)" },
2789 { 0x0020, "DHKEM(X25519, HKDF-SHA256)" },
2790 { 0x0021, "DHKEM(X448, HKDF-SHA512)" },
2791 { 0, NULL((void*)0) }
2792};
2793const value_string kdf_id_type_vals[] = {
2794 { 0x0000, "Reserved" },
2795 { 0x0001, "HKDF-SHA256" },
2796 { 0x0002, "HKDF-SHA384" },
2797 { 0x0003, "HKDF-SHA512" },
2798 { 0, NULL((void*)0) }
2799};
2800const value_string aead_id_type_vals[] = {
2801 { 0x0000, "Reserved" },
2802 { 0x0001, "AES-128-GCM" },
2803 { 0x0002, "AES-256-GCM" },
2804 { 0x0003, "ChaCha20Poly1305" },
2805 { 0xFFFF, "Export-only" },
2806 { 0, NULL((void*)0) }
2807};
2808
2809const value_string token_binding_key_parameter_vals[] = {
2810 { 0, "rsa2048_pkcs1.5" },
2811 { 1, "rsa2048_pss" },
2812 { 2, "ecdsap256" },
2813 { 0, NULL((void*)0) }
2814};
2815
2816/* Lookup tables }}} */
2817
2818void
2819quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id)
2820{
2821 const char *label;
2822 if (IS_GREASE_QUIC(parameter_id)((parameter_id) > 27 ? ((((parameter_id) - 27) % 31) == 0)
: 0)
) {
2823 label = "GREASE";
2824 } else {
2825 label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown");
2826 }
2827 snprintf(result, ITEM_LABEL_LENGTH240, "%s (0x%02" PRIx64"l" "x" ")", label, parameter_id);
2828}
2829
2830/* we keep this internal to packet-tls-utils, as there should be
2831 no need to access it any other way.
2832
2833 This also allows us to hide the dependency on zlib.
2834*/
2835struct _SslDecompress {
2836 int compression;
2837#ifdef USE_ZLIB_OR_ZLIBNG
2838 zlib_stream istream;
2839#endif
2840};
2841
2842/* To assist in parsing client/server key exchange messages
2843 0 indicates unknown */
2844int ssl_get_keyex_alg(int cipher)
2845{
2846 /* Map Cipher suite number to Key Exchange algorithm {{{ */
2847 switch(cipher) {
2848 case 0x0017:
2849 case 0x0018:
2850 case 0x0019:
2851 case 0x001a:
2852 case 0x001b:
2853 case 0x0034:
2854 case 0x003a:
2855 case 0x0046:
2856 case 0x006c:
2857 case 0x006d:
2858 case 0x0089:
2859 case 0x009b:
2860 case 0x00a6:
2861 case 0x00a7:
2862 case 0x00bf:
2863 case 0x00c5:
2864 case 0xc084:
2865 case 0xc085:
2866 return KEX_DH_ANON0x13;
2867 case 0x000b:
2868 case 0x000c:
2869 case 0x000d:
2870 case 0x0030:
2871 case 0x0036:
2872 case 0x003e:
2873 case 0x0042:
2874 case 0x0068:
2875 case 0x0085:
2876 case 0x0097:
2877 case 0x00a4:
2878 case 0x00a5:
2879 case 0x00bb:
2880 case 0x00c1:
2881 case 0xc082:
2882 case 0xc083:
2883 return KEX_DH_DSS0x14;
2884 case 0x000e:
2885 case 0x000f:
2886 case 0x0010:
2887 case 0x0031:
2888 case 0x0037:
2889 case 0x003f:
2890 case 0x0043:
2891 case 0x0069:
2892 case 0x0086:
2893 case 0x0098:
2894 case 0x00a0:
2895 case 0x00a1:
2896 case 0x00bc:
2897 case 0x00c2:
2898 case 0xc07e:
2899 case 0xc07f:
2900 return KEX_DH_RSA0x15;
2901 case 0x0011:
2902 case 0x0012:
2903 case 0x0013:
2904 case 0x0032:
2905 case 0x0038:
2906 case 0x0040:
2907 case 0x0044:
2908 case 0x0063:
2909 case 0x0065:
2910 case 0x0066:
2911 case 0x006a:
2912 case 0x0087:
2913 case 0x0099:
2914 case 0x00a2:
2915 case 0x00a3:
2916 case 0x00bd:
2917 case 0x00c3:
2918 case 0xc080:
2919 case 0xc081:
2920 return KEX_DHE_DSS0x10;
2921 case 0x002d:
2922 case 0x008e:
2923 case 0x008f:
2924 case 0x0090:
2925 case 0x0091:
2926 case 0x00aa:
2927 case 0x00ab:
2928 case 0x00b2:
2929 case 0x00b3:
2930 case 0x00b4:
2931 case 0x00b5:
2932 case 0xc090:
2933 case 0xc091:
2934 case 0xc096:
2935 case 0xc097:
2936 case 0xc0a6:
2937 case 0xc0a7:
2938 case 0xc0aa:
2939 case 0xc0ab:
2940 case 0xccad:
2941 case 0xe41c:
2942 case 0xe41d:
2943 return KEX_DHE_PSK0x11;
2944 case 0x0014:
2945 case 0x0015:
2946 case 0x0016:
2947 case 0x0033:
2948 case 0x0039:
2949 case 0x0045:
2950 case 0x0067:
2951 case 0x006b:
2952 case 0x0088:
2953 case 0x009a:
2954 case 0x009e:
2955 case 0x009f:
2956 case 0x00be:
2957 case 0x00c4:
2958 case 0xc07c:
2959 case 0xc07d:
2960 case 0xc09e:
2961 case 0xc09f:
2962 case 0xc0a2:
2963 case 0xc0a3:
2964 case 0xccaa:
2965 case 0xe41e:
2966 case 0xe41f:
2967 return KEX_DHE_RSA0x12;
2968 case 0xc015:
2969 case 0xc016:
2970 case 0xc017:
2971 case 0xc018:
2972 case 0xc019:
2973 return KEX_ECDH_ANON0x19;
2974 case 0xc001:
2975 case 0xc002:
2976 case 0xc003:
2977 case 0xc004:
2978 case 0xc005:
2979 case 0xc025:
2980 case 0xc026:
2981 case 0xc02d:
2982 case 0xc02e:
2983 case 0xc074:
2984 case 0xc075:
2985 case 0xc088:
2986 case 0xc089:
2987 return KEX_ECDH_ECDSA0x1a;
2988 case 0xc00b:
2989 case 0xc00c:
2990 case 0xc00d:
2991 case 0xc00e:
2992 case 0xc00f:
2993 case 0xc029:
2994 case 0xc02a:
2995 case 0xc031:
2996 case 0xc032:
2997 case 0xc078:
2998 case 0xc079:
2999 case 0xc08c:
3000 case 0xc08d:
3001 return KEX_ECDH_RSA0x1b;
3002 case 0xc006:
3003 case 0xc007:
3004 case 0xc008:
3005 case 0xc009:
3006 case 0xc00a:
3007 case 0xc023:
3008 case 0xc024:
3009 case 0xc02b:
3010 case 0xc02c:
3011 case 0xc072:
3012 case 0xc073:
3013 case 0xc086:
3014 case 0xc087:
3015 case 0xc0ac:
3016 case 0xc0ad:
3017 case 0xc0ae:
3018 case 0xc0af:
3019 case 0xcca9:
3020 case 0xe414:
3021 case 0xe415:
3022 return KEX_ECDHE_ECDSA0x16;
3023 case 0xc033:
3024 case 0xc034:
3025 case 0xc035:
3026 case 0xc036:
3027 case 0xc037:
3028 case 0xc038:
3029 case 0xc039:
3030 case 0xc03a:
3031 case 0xc03b:
3032 case 0xc09a:
3033 case 0xc09b:
3034 case 0xccac:
3035 case 0xe418:
3036 case 0xe419:
3037 case 0xd001:
3038 case 0xd002:
3039 case 0xd003:
3040 case 0xd005:
3041 return KEX_ECDHE_PSK0x17;
3042 case 0xc010:
3043 case 0xc011:
3044 case 0xc012:
3045 case 0xc013:
3046 case 0xc014:
3047 case 0xc027:
3048 case 0xc028:
3049 case 0xc02f:
3050 case 0xc030:
3051 case 0xc076:
3052 case 0xc077:
3053 case 0xc08a:
3054 case 0xc08b:
3055 case 0xcca8:
3056 case 0xe412:
3057 case 0xe413:
3058 return KEX_ECDHE_RSA0x18;
3059 case 0x001e:
3060 case 0x001f:
3061 case 0x0020:
3062 case 0x0021:
3063 case 0x0022:
3064 case 0x0023:
3065 case 0x0024:
3066 case 0x0025:
3067 case 0x0026:
3068 case 0x0027:
3069 case 0x0028:
3070 case 0x0029:
3071 case 0x002a:
3072 case 0x002b:
3073 return KEX_KRB50x1c;
3074 case 0x002c:
3075 case 0x008a:
3076 case 0x008b:
3077 case 0x008c:
3078 case 0x008d:
3079 case 0x00a8:
3080 case 0x00a9:
3081 case 0x00ae:
3082 case 0x00af:
3083 case 0x00b0:
3084 case 0x00b1:
3085 case 0xc064:
3086 case 0xc065:
3087 case 0xc08e:
3088 case 0xc08f:
3089 case 0xc094:
3090 case 0xc095:
3091 case 0xc0a4:
3092 case 0xc0a5:
3093 case 0xc0a8:
3094 case 0xc0a9:
3095 case 0xccab:
3096 case 0xe416:
3097 case 0xe417:
3098 return KEX_PSK0x1d;
3099 case 0x0001:
3100 case 0x0002:
3101 case 0x0003:
3102 case 0x0004:
3103 case 0x0005:
3104 case 0x0006:
3105 case 0x0007:
3106 case 0x0008:
3107 case 0x0009:
3108 case 0x000a:
3109 case 0x002f:
3110 case 0x0035:
3111 case 0x003b:
3112 case 0x003c:
3113 case 0x003d:
3114 case 0x0041:
3115 case 0x0060:
3116 case 0x0061:
3117 case 0x0062:
3118 case 0x0064:
3119 case 0x0084:
3120 case 0x0096:
3121 case 0x009c:
3122 case 0x009d:
3123 case 0x00ba:
3124 case 0x00c0:
3125 case 0xc07a:
3126 case 0xc07b:
3127 case 0xc09c:
3128 case 0xc09d:
3129 case 0xc0a0:
3130 case 0xc0a1:
3131 case 0xe410:
3132 case 0xe411:
3133 case 0xfefe:
3134 case 0xfeff:
3135 case 0xffe0:
3136 case 0xffe1:
3137 return KEX_RSA0x1e;
3138 case 0x002e:
3139 case 0x0092:
3140 case 0x0093:
3141 case 0x0094:
3142 case 0x0095:
3143 case 0x00ac:
3144 case 0x00ad:
3145 case 0x00b6:
3146 case 0x00b7:
3147 case 0x00b8:
3148 case 0x00b9:
3149 case 0xc092:
3150 case 0xc093:
3151 case 0xc098:
3152 case 0xc099:
3153 case 0xccae:
3154 case 0xe41a:
3155 case 0xe41b:
3156 return KEX_RSA_PSK0x1f;
3157 case 0xc01a:
3158 case 0xc01d:
3159 case 0xc020:
3160 return KEX_SRP_SHA0x20;
3161 case 0xc01c:
3162 case 0xc01f:
3163 case 0xc022:
3164 return KEX_SRP_SHA_DSS0x21;
3165 case 0xc01b:
3166 case 0xc01e:
3167 case 0xc021:
3168 return KEX_SRP_SHA_RSA0x22;
3169 case 0xc0ff:
3170 return KEX_ECJPAKE0x24;
3171 case 0xe003:
3172 case 0xe013:
3173 case 0xe053:
3174 return KEX_ECC_SM20x26;
3175 default:
3176 break;
3177 }
3178
3179 return 0;
3180 /* }}} */
3181}
3182
3183static wmem_list_t *connection_id_session_list;
3184
3185void
3186ssl_init_cid_list(void) {
3187 connection_id_session_list = wmem_list_new(wmem_file_scope());
3188}
3189
3190void
3191ssl_cleanup_cid_list(void) {
3192 wmem_destroy_list(connection_id_session_list);
3193}
3194
3195void
3196ssl_add_session_by_cid(SslDecryptSession *session)
3197{
3198 wmem_list_append(connection_id_session_list, session);
3199}
3200
3201SslDecryptSession *
3202ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset)
3203{
3204 SslDecryptSession * ssl_cid = NULL((void*)0);
3205 wmem_list_frame_t *it = wmem_list_head(connection_id_session_list);
3206
3207 while (it != NULL((void*)0) && ssl_cid == NULL((void*)0)) {
3208 SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it);
3209 DISSECTOR_ASSERT(ssl != NULL)((void) ((ssl != ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3209, "ssl != ((void*)0)"))))
;
3210 SslSession *session = &ssl->session;
3211
3212 if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) {
3213 if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) {
3214 ssl_cid = ssl;
3215 }
3216 }
3217
3218 if (session->server_cid_len > 0) {
3219 if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) {
3220 ssl_cid = ssl;
3221 }
3222 }
3223
3224 it = wmem_list_frame_next(it);
3225 }
3226
3227 return ssl_cid;
3228}
3229
3230/* StringInfo structure (len + data) functions {{{ */
3231
3232int
3233ssl_data_alloc(StringInfo* str, size_t len)
3234{
3235 str->data = (unsigned char *)g_malloc(len);
3236 /* the allocator can return a null pointer for a size equal to 0,
3237 * and that must be allowed */
3238 if (len > 0 && !str->data)
3239 return -1;
3240 str->data_len = (unsigned) len;
3241 return 0;
3242}
3243
3244void
3245ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len)
3246{
3247 DISSECTOR_ASSERT(data)((void) ((data) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 3247, "data"))))
;
3248 memcpy(str->data, data, len);
3249 str->data_len = len;
3250}
3251
3252static int
3253ssl_data_realloc(StringInfo* str, unsigned len)
3254{
3255 str->data = (unsigned char *)g_realloc(str->data, len);
3256 if (!str->data)
3257 return -1;
3258 str->data_len = len;
3259 return 0;
3260}
3261
3262static StringInfo *
3263ssl_data_clone(StringInfo *str)
3264{
3265 StringInfo *cloned_str;
3266 cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(),
3267 sizeof(StringInfo) + str->data_len);
3268 cloned_str->data = (unsigned char *) (cloned_str + 1);
3269 ssl_data_set(cloned_str, str->data, str->data_len);
3270 return cloned_str;
3271}
3272
3273static int
3274ssl_data_copy(StringInfo* dst, StringInfo* src)
3275{
3276 if (dst->data_len < src->data_len) {
3277 if (ssl_data_realloc(dst, src->data_len))
3278 return -1;
3279 }
3280 memcpy(dst->data, src->data, src->data_len);
3281 dst->data_len = src->data_len;
3282 return 0;
3283}
3284
3285/* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to
3286 * the result. |out->data| will be allocated using wmem_file_scope. Returns true on
3287 * success. */
3288static bool_Bool from_hex(StringInfo* out, const char* in, size_t hex_len) {
3289 size_t i;
3290
3291 if (hex_len & 1)
3292 return false0;
3293
3294 out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2);
3295 for (i = 0; i < hex_len / 2; i++) {
3296 int a = ws_xton(in[i*2]);
3297 int b = ws_xton(in[i*2 + 1]);
3298 if (a == -1 || b == -1)
3299 return false0;
3300 out->data[i] = a << 4 | b;
3301 }
3302 out->data_len = (unsigned)hex_len / 2;
3303 return true1;
3304}
3305/* StringInfo structure (len + data) functions }}} */
3306
3307
3308/* libgcrypt wrappers for HMAC/message digest operations {{{ */
3309/* hmac abstraction layer */
3310#define SSL_HMACgcry_md_hd_t gcry_md_hd_t
3311
3312static inline int
3313ssl_hmac_init(SSL_HMACgcry_md_hd_t* md, int algo)
3314{
3315 gcry_error_t err;
3316 const char *err_str, *err_src;
3317
3318 err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC);
3319 if (err != 0) {
3320 err_str = gcry_strerror(err);
3321 err_src = gcry_strsource(err);
3322 ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src);
3323 return -1;
3324 }
3325 return 0;
3326}
3327
3328static inline int
3329ssl_hmac_setkey(SSL_HMACgcry_md_hd_t* md, const void * key, int len)
3330{
3331 gcry_error_t err;
3332 const char *err_str, *err_src;
3333
3334 err = gcry_md_setkey (*(md), key, len);
3335 if (err != 0) {
3336 err_str = gcry_strerror(err);
3337 err_src = gcry_strsource(err);
3338 ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src);
3339 return -1;
3340 }
3341 return 0;
3342}
3343
3344static inline int
3345ssl_hmac_reset(SSL_HMACgcry_md_hd_t* md)
3346{
3347 gcry_md_reset(*md);
3348 return 0;
3349}
3350
3351static inline void
3352ssl_hmac_update(SSL_HMACgcry_md_hd_t* md, const void* data, int len)
3353{
3354 gcry_md_write(*(md), data, len);
3355}
3356static inline void
3357ssl_hmac_final(SSL_HMACgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3358{
3359 int algo;
3360 unsigned len;
3361
3362 algo = gcry_md_get_algo (*(md));
3363 len = gcry_md_get_algo_dlen(algo);
3364 DISSECTOR_ASSERT(len <= *datalen)((void) ((len <= *datalen) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 3364, "len <= *datalen"))))
;
3365 memcpy(data, gcry_md_read(*(md), algo), len);
3366 *datalen = len;
3367}
3368static inline void
3369ssl_hmac_cleanup(SSL_HMACgcry_md_hd_t* md)
3370{
3371 gcry_md_close(*(md));
3372}
3373
3374/* message digest abstraction layer*/
3375#define SSL_MDgcry_md_hd_t gcry_md_hd_t
3376
3377static inline int
3378ssl_md_init(SSL_MDgcry_md_hd_t* md, int algo)
3379{
3380 gcry_error_t err;
3381 const char *err_str, *err_src;
3382 err = gcry_md_open(md,algo, 0);
3383 if (err != 0) {
3384 err_str = gcry_strerror(err);
3385 err_src = gcry_strsource(err);
3386 ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src);
3387 return -1;
3388 }
3389 return 0;
3390}
3391static inline void
3392ssl_md_update(SSL_MDgcry_md_hd_t* md, unsigned char* data, int len)
3393{
3394 gcry_md_write(*(md), data, len);
3395}
3396static inline void
3397ssl_md_final(SSL_MDgcry_md_hd_t* md, unsigned char* data, unsigned* datalen)
3398{
3399 int algo;
3400 int len;
3401 algo = gcry_md_get_algo (*(md));
3402 len = gcry_md_get_algo_dlen (algo);
3403 memcpy(data, gcry_md_read(*(md), algo), len);
3404 *datalen = len;
3405}
3406static inline void
3407ssl_md_cleanup(SSL_MDgcry_md_hd_t* md)
3408{
3409 gcry_md_close(*(md));
3410}
3411
3412static inline void
3413ssl_md_reset(SSL_MDgcry_md_hd_t* md)
3414{
3415 gcry_md_reset(*md);
3416}
3417
3418/* md5 /sha abstraction layer */
3419#define SSL_SHA_CTXgcry_md_hd_t gcry_md_hd_t
3420#define SSL_MD5_CTXgcry_md_hd_t gcry_md_hd_t
3421
3422static inline int
3423ssl_sha_init(SSL_SHA_CTXgcry_md_hd_t* md)
3424{
3425 gcry_error_t err;
3426 const char *err_str, *err_src;
3427 err = gcry_md_open(md, GCRY_MD_SHA1, 0);
3428 if (err != 0) {
3429 err_str = gcry_strerror(err);
3430 err_src = gcry_strsource(err);
3431 ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src);
3432 return -1;
3433 }
3434 return 0;
3435}
3436static inline void
3437ssl_sha_update(SSL_SHA_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3438{
3439 gcry_md_write(*(md), data, len);
3440}
3441static inline void
3442ssl_sha_final(unsigned char* buf, SSL_SHA_CTXgcry_md_hd_t* md)
3443{
3444 memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1),
3445 gcry_md_get_algo_dlen(GCRY_MD_SHA1));
3446}
3447
3448static inline void
3449ssl_sha_reset(SSL_SHA_CTXgcry_md_hd_t* md)
3450{
3451 gcry_md_reset(*md);
3452}
3453
3454static inline void
3455ssl_sha_cleanup(SSL_SHA_CTXgcry_md_hd_t* md)
3456{
3457 gcry_md_close(*(md));
3458}
3459
3460static inline int
3461ssl_md5_init(SSL_MD5_CTXgcry_md_hd_t* md)
3462{
3463 gcry_error_t err;
3464 const char *err_str, *err_src;
3465 err = gcry_md_open(md,GCRY_MD_MD5, 0);
3466 if (err != 0) {
3467 err_str = gcry_strerror(err);
3468 err_src = gcry_strsource(err);
3469 ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src);
3470 return -1;
3471 }
3472 return 0;
3473}
3474static inline void
3475ssl_md5_update(SSL_MD5_CTXgcry_md_hd_t* md, unsigned char* data, int len)
3476{
3477 gcry_md_write(*(md), data, len);
3478}
3479static inline void
3480ssl_md5_final(unsigned char* buf, SSL_MD5_CTXgcry_md_hd_t* md)
3481{
3482 memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5),
3483 gcry_md_get_algo_dlen(GCRY_MD_MD5));
3484}
3485
3486static inline void
3487ssl_md5_reset(SSL_MD5_CTXgcry_md_hd_t* md)
3488{
3489 gcry_md_reset(*md);
3490}
3491
3492static inline void
3493ssl_md5_cleanup(SSL_MD5_CTXgcry_md_hd_t* md)
3494{
3495 gcry_md_close(*(md));
3496}
3497/* libgcrypt wrappers for HMAC/message digest operations }}} */
3498
3499/* libgcrypt wrappers for Cipher state manipulation {{{ */
3500int
3501ssl_cipher_setiv(SSL_CIPHER_CTXgcry_cipher_hd_t *cipher, unsigned char* iv, int iv_len)
3502{
3503 int ret;
3504#if 0
3505 unsigned char *ivp;
3506 int i;
3507 gcry_cipher_hd_t c;
3508 c=(gcry_cipher_hd_t)*cipher;
3509#endif
3510 ssl_debug_printf("--------------------------------------------------------------------");
3511#if 0
3512 for(ivp=c->iv,i=0; i < iv_len; i++ )
3513 {
3514 ssl_debug_printf("%d ",ivp[i]);
3515 i++;
3516 }
3517#endif
3518 ssl_debug_printf("--------------------------------------------------------------------");
3519 ret = gcry_cipher_setiv(*(cipher), iv, iv_len);
3520#if 0
3521 for(ivp=c->iv,i=0; i < iv_len; i++ )
3522 {
3523 ssl_debug_printf("%d ",ivp[i]);
3524 i++;
3525 }
3526#endif
3527 ssl_debug_printf("--------------------------------------------------------------------");
3528 return ret;
3529}
3530/* stream cipher abstraction layer*/
3531static int
3532ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk,
3533 unsigned char* iv, int mode)
3534{
3535 int gcry_modes[] = {
3536 GCRY_CIPHER_MODE_STREAM,
3537 GCRY_CIPHER_MODE_CBC,
3538 GCRY_CIPHER_MODE_GCM,
3539 GCRY_CIPHER_MODE_CCM,
3540 GCRY_CIPHER_MODE_CCM,
3541 GCRY_CIPHER_MODE_POLY1305,
3542 GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */
3543 };
3544 int err;
3545 if (algo == -1) {
3546 /* NULL mode */
3547 *(cipher) = (gcry_cipher_hd_t)-1;
3548 return 0;
3549 }
3550 err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0);
3551 if (err !=0)
3552 return -1;
3553 err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo));
3554 if (err != 0)
3555 return -1;
3556 /* AEAD cipher suites will set the nonce later. */
3557 if (mode == MODE_CBC) {
3558 err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo));
3559 if (err != 0)
3560 return -1;
3561 }
3562 return 0;
3563}
3564static inline int
3565ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl,
3566 const unsigned char * in, int inl)
3567{
3568 if ((*cipher) == (gcry_cipher_hd_t)-1)
3569 {
3570 if (in && inl)
3571 memcpy(out, in, outl < inl ? outl : inl);
3572 return 0;
3573 }
3574 return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl);
3575}
3576static inline int
3577ssl_get_digest_by_name(const char*name)
3578{
3579 return gcry_md_map_name(name);
3580}
3581static inline int
3582ssl_get_cipher_by_name(const char* name)
3583{
3584 return gcry_cipher_map_name(name);
3585}
3586
3587static inline void
3588ssl_cipher_cleanup(gcry_cipher_hd_t *cipher)
3589{
3590 if ((*cipher) != (gcry_cipher_hd_t)-1)
3591 gcry_cipher_close(*cipher);
3592 *cipher = NULL((void*)0);
3593}
3594/* }}} */
3595
3596/* Digests, Ciphers and Cipher Suites registry {{{ */
3597static const SslDigestAlgo digests[]={
3598 {"MD5", 16},
3599 {"SHA1", 20},
3600 {"SHA256", 32},
3601 {"SHA384", 48},
3602 {"SM3", 32},
3603 {"Not Applicable", 0},
3604};
3605
3606#define DIGEST_MAX_SIZE48 48
3607
3608/* get index digest index */
3609static const SslDigestAlgo *
3610ssl_cipher_suite_dig(const SslCipherSuite *cs) {
3611 if (!cs || cs->dig < DIG_MD50x40 || cs->dig > DIG_NA0x45) {
3612 return &digests[DIG_NA0x45 - DIG_MD50x40];
3613 }
3614 return &digests[cs->dig - DIG_MD50x40];
3615}
3616
3617static const char *ciphers[]={
3618 "DES",
3619 "3DES",
3620 "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/
3621 "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */
3622 "IDEA",
3623 "AES",
3624 "AES256",
3625 "CAMELLIA128",
3626 "CAMELLIA256",
3627 "SEED",
3628 "CHACHA20", /* since Libgcrypt 1.7.0 */
3629 "SM1",
3630 "SM4",
3631 "*UNKNOWN*"
3632};
3633
3634static const SslCipherSuite cipher_suites[]={
3635 {0x0001,KEX_RSA0x1e, ENC_NULL0x3D, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */
3636 {0x0002,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */
3637 {0x0003,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3638 {0x0004,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */
3639 {0x0005,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */
3640 {0x0006,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3641 {0x0007,KEX_RSA0x1e, ENC_IDEA0x34, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */
3642 {0x0008,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3643 {0x0009,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */
3644 {0x000A,KEX_RSA0x1e, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */
3645 {0x000B,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3646 {0x000C,KEX_DH_DSS0x14, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */
3647 {0x000D,KEX_DH_DSS0x14, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */
3648 {0x000E,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3649 {0x000F,KEX_DH_RSA0x15, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */
3650 {0x0010,KEX_DH_RSA0x15, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */
3651 {0x0011,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3652 {0x0012,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */
3653 {0x0013,KEX_DHE_DSS0x10, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */
3654 {0x0014,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3655 {0x0015,KEX_DHE_RSA0x12, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */
3656 {0x0016,KEX_DHE_RSA0x12, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */
3657 {0x0017,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3658 {0x0018,KEX_DH_ANON0x13, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */
3659 {0x0019,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3660 {0x001A,KEX_DH_ANON0x13, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */
3661 {0x001B,KEX_DH_ANON0x13, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */
3662 {0x002C,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */
3663 {0x002D,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */
3664 {0x002E,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */
3665 {0x002F,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */
3666 {0x0030,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */
3667 {0x0031,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */
3668 {0x0032,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */
3669 {0x0033,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
3670 {0x0034,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */
3671 {0x0035,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */
3672 {0x0036,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */
3673 {0x0037,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */
3674 {0x0038,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */
3675 {0x0039,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */
3676 {0x003A,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */
3677 {0x003B,KEX_RSA0x1e, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */
3678 {0x003C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */
3679 {0x003D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */
3680 {0x003E,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */
3681 {0x003F,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */
3682 {0x0040,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */
3683 {0x0041,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */
3684 {0x0042,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */
3685 {0x0043,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */
3686 {0x0044,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */
3687 {0x0045,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */
3688 {0x0046,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */
3689 {0x0060,KEX_RSA0x1e, ENC_RC40x32, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3690 {0x0061,KEX_RSA0x1e, ENC_RC20x33, DIG_MD50x40, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3691 {0x0062,KEX_RSA0x1e, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3692 {0x0063,KEX_DHE_DSS0x10, ENC_DES0x30, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3693 {0x0064,KEX_RSA0x1e, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3694 {0x0065,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3695 {0x0066,KEX_DHE_DSS0x10, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */
3696 {0x0067,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
3697 {0x0068,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */
3698 {0x0069,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */
3699 {0x006A,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */
3700 {0x006B,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */
3701 {0x006C,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
3702 {0x006D,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
3703 {0x0084,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */
3704 {0x0085,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */
3705 {0x0086,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */
3706 {0x0087,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */
3707 {0x0088,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */
3708 {0x0089,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */
3709 {0x008A,KEX_PSK0x1d, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */
3710 {0x008B,KEX_PSK0x1d, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */
3711 {0x008C,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */
3712 {0x008D,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */
3713 {0x008E,KEX_DHE_PSK0x11, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */
3714 {0x008F,KEX_DHE_PSK0x11, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */
3715 {0x0090,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */
3716 {0x0091,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */
3717 {0x0092,KEX_RSA_PSK0x1f, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */
3718 {0x0093,KEX_RSA_PSK0x1f, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */
3719 {0x0094,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */
3720 {0x0095,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */
3721 {0x0096,KEX_RSA0x1e, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */
3722 {0x0097,KEX_DH_DSS0x14, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */
3723 {0x0098,KEX_DH_RSA0x15, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */
3724 {0x0099,KEX_DHE_DSS0x10, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */
3725 {0x009A,KEX_DHE_RSA0x12, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */
3726 {0x009B,KEX_DH_ANON0x13, ENC_SEED0x39, DIG_SHA0x41, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */
3727 {0x009C,KEX_RSA0x1e, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
3728 {0x009D,KEX_RSA0x1e, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */
3729 {0x009E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
3730 {0x009F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */
3731 {0x00A0,KEX_DH_RSA0x15, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */
3732 {0x00A1,KEX_DH_RSA0x15, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */
3733 {0x00A2,KEX_DHE_DSS0x10, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */
3734 {0x00A3,KEX_DHE_DSS0x10, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */
3735 {0x00A4,KEX_DH_DSS0x14, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */
3736 {0x00A5,KEX_DH_DSS0x14, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */
3737 {0x00A6,KEX_DH_ANON0x13, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
3738 {0x00A7,KEX_DH_ANON0x13, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
3739 {0x00A8,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */
3740 {0x00A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */
3741 {0x00AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */
3742 {0x00AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */
3743 {0x00AC,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */
3744 {0x00AD,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */
3745 {0x00AE,KEX_PSK0x1d, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */
3746 {0x00AF,KEX_PSK0x1d, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */
3747 {0x00B0,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */
3748 {0x00B1,KEX_PSK0x1d, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */
3749 {0x00B2,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */
3750 {0x00B3,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */
3751 {0x00B4,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */
3752 {0x00B5,KEX_DHE_PSK0x11, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */
3753 {0x00B6,KEX_RSA_PSK0x1f, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */
3754 {0x00B7,KEX_RSA_PSK0x1f, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */
3755 {0x00B8,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */
3756 {0x00B9,KEX_RSA_PSK0x1f, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */
3757 {0x00BA,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3758 {0x00BB,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3759 {0x00BC,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3760 {0x00BD,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */
3761 {0x00BE,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3762 {0x00BF,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */
3763 {0x00C0,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3764 {0x00C1,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3765 {0x00C2,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3766 {0x00C3,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */
3767 {0x00C4,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */
3768 {0x00C5,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA2560x42, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */
3769
3770 /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */
3771 {0x1301,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */
3772 {0x1302,KEX_TLS130x23, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */
3773 {0x1303,KEX_TLS130x23, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */
3774 {0x1304,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */
3775 {0x1305,KEX_TLS130x23, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */
3776 {0x00C6,KEX_TLS130x23, ENC_SM40x3C, DIG_SM30x44, MODE_GCM }, /* TLS_SM4_GCM_SM3 */
3777
3778 {0xC001,KEX_ECDH_ECDSA0x1a, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
3779 {0xC002,KEX_ECDH_ECDSA0x1a, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
3780 {0xC003,KEX_ECDH_ECDSA0x1a, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */
3781 {0xC004,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
3782 {0xC005,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
3783 {0xC006,KEX_ECDHE_ECDSA0x16, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
3784 {0xC007,KEX_ECDHE_ECDSA0x16, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */
3785 {0xC008,KEX_ECDHE_ECDSA0x16, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */
3786 {0xC009,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
3787 {0xC00A,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
3788 {0xC00B,KEX_ECDH_RSA0x1b, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */
3789 {0xC00C,KEX_ECDH_RSA0x1b, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
3790 {0xC00D,KEX_ECDH_RSA0x1b, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */
3791 {0xC00E,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */
3792 {0xC00F,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */
3793 {0xC0FF,KEX_ECJPAKE0x24, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */
3794 {0xC010,KEX_ECDHE_RSA0x18, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */
3795 {0xC011,KEX_ECDHE_RSA0x18, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
3796 {0xC012,KEX_ECDHE_RSA0x18, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */
3797 {0xC013,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */
3798 {0xC014,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
3799 {0xC015,KEX_ECDH_ANON0x19, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */
3800 {0xC016,KEX_ECDH_ANON0x19, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */
3801 {0xC017,KEX_ECDH_ANON0x19, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
3802 {0xC018,KEX_ECDH_ANON0x19, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
3803 {0xC019,KEX_ECDH_ANON0x19, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
3804 {0xC01A,KEX_SRP_SHA0x20, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */
3805 {0xC01B,KEX_SRP_SHA_RSA0x22, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */
3806 {0xC01C,KEX_SRP_SHA_DSS0x21, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */
3807 {0xC01D,KEX_SRP_SHA0x20, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */
3808 {0xC01E,KEX_SRP_SHA_RSA0x22, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */
3809 {0xC01F,KEX_SRP_SHA_DSS0x21, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */
3810 {0xC020,KEX_SRP_SHA0x20, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */
3811 {0xC021,KEX_SRP_SHA_RSA0x22, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */
3812 {0xC022,KEX_SRP_SHA_DSS0x21, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */
3813 {0xC023,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
3814 {0xC024,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
3815 {0xC025,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */
3816 {0xC026,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */
3817 {0xC027,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */
3818 {0xC028,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */
3819 {0xC029,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */
3820 {0xC02A,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */
3821 {0xC02B,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
3822 {0xC02C,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
3823 {0xC02D,KEX_ECDH_ECDSA0x1a, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */
3824 {0xC02E,KEX_ECDH_ECDSA0x1a, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */
3825 {0xC02F,KEX_ECDHE_RSA0x18, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
3826 {0xC030,KEX_ECDHE_RSA0x18, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */
3827 {0xC031,KEX_ECDH_RSA0x1b, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */
3828 {0xC032,KEX_ECDH_RSA0x1b, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */
3829 {0xC033,KEX_ECDHE_PSK0x17, ENC_RC40x32, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */
3830 {0xC034,KEX_ECDHE_PSK0x17, ENC_3DES0x31, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */
3831 {0xC035,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */
3832 {0xC036,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA0x41, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */
3833 {0xC037,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */
3834 {0xC038,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */
3835 {0xC039,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA0x41, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */
3836 {0xC03A,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA2560x42, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */
3837 {0xC03B,KEX_ECDHE_PSK0x17, ENC_NULL0x3D, DIG_SHA3840x43, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */
3838 {0xC072,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3839 {0xC073,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3840 {0xC074,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */
3841 {0xC075,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */
3842 {0xC076,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3843 {0xC077,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3844 {0xC078,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */
3845 {0xC079,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */
3846 {0xC07A,KEX_RSA0x1e, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3847 {0xC07B,KEX_RSA0x1e, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3848 {0xC07C,KEX_DHE_RSA0x12, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3849 {0xC07D,KEX_DHE_RSA0x12, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3850 {0xC07E,KEX_DH_RSA0x15, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3851 {0xC07F,KEX_DH_RSA0x15, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3852 {0xC080,KEX_DHE_DSS0x10, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3853 {0xC081,KEX_DHE_DSS0x10, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3854 {0xC082,KEX_DH_DSS0x14, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */
3855 {0xC083,KEX_DH_DSS0x14, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */
3856 {0xC084,KEX_DH_ANON0x13, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */
3857 {0xC085,KEX_DH_ANON0x13, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */
3858 {0xC086,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3859 {0xC087,KEX_ECDHE_ECDSA0x16, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3860 {0xC088,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */
3861 {0xC089,KEX_ECDH_ECDSA0x1a, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */
3862 {0xC08A,KEX_ECDHE_RSA0x18, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3863 {0xC08B,KEX_ECDHE_RSA0x18, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3864 {0xC08C,KEX_ECDH_RSA0x1b, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */
3865 {0xC08D,KEX_ECDH_RSA0x1b, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */
3866 {0xC08E,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3867 {0xC08F,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3868 {0xC090,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3869 {0xC091,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3870 {0xC092,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */
3871 {0xC093,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */
3872 {0xC094,KEX_PSK0x1d, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3873 {0xC095,KEX_PSK0x1d, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3874 {0xC096,KEX_DHE_PSK0x11, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3875 {0xC097,KEX_DHE_PSK0x11, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3876 {0xC098,KEX_RSA_PSK0x1f, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3877 {0xC099,KEX_RSA_PSK0x1f, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3878 {0xC09A,KEX_ECDHE_PSK0x17, ENC_CAMELLIA1280x37,DIG_SHA2560x42, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */
3879 {0xC09B,KEX_ECDHE_PSK0x17, ENC_CAMELLIA2560x38,DIG_SHA3840x43, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */
3880 {0xC09C,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */
3881 {0xC09D,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */
3882 {0xC09E,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */
3883 {0xC09F,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */
3884 {0xC0A0,KEX_RSA0x1e, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */
3885 {0xC0A1,KEX_RSA0x1e, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */
3886 {0xC0A2,KEX_DHE_RSA0x12, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */
3887 {0xC0A3,KEX_DHE_RSA0x12, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */
3888 {0xC0A4,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */
3889 {0xC0A5,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */
3890 {0xC0A6,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */
3891 {0xC0A7,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */
3892 {0xC0A8,KEX_PSK0x1d, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */
3893 {0xC0A9,KEX_PSK0x1d, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */
3894 {0xC0AA,KEX_DHE_PSK0x11, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */
3895 {0xC0AB,KEX_DHE_PSK0x11, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */
3896 {0xC0AC,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */
3897 {0xC0AD,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */
3898 {0xC0AE,KEX_ECDHE_ECDSA0x16, ENC_AES0x35, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */
3899 {0xC0AF,KEX_ECDHE_ECDSA0x16, ENC_AES2560x36, DIG_NA0x45, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */
3900 {0xCCA8,KEX_ECDHE_RSA0x18, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3901 {0xCCA9,KEX_ECDHE_ECDSA0x16, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */
3902 {0xCCAA,KEX_DHE_RSA0x12, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */
3903 {0xCCAB,KEX_PSK0x1d, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3904 {0xCCAC,KEX_ECDHE_PSK0x17, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3905 {0xCCAD,KEX_DHE_PSK0x11, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3906 {0xCCAE,KEX_RSA_PSK0x1f, ENC_CHACHA200x3A, DIG_SHA2560x42, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */
3907 {0xD001,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */
3908 {0xD002,KEX_ECDHE_PSK0x17, ENC_AES2560x36, DIG_SHA3840x43, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */
3909 {0xD003,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */
3910 {0xD005,KEX_ECDHE_PSK0x17, ENC_AES0x35, DIG_SHA2560x42, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */
3911 /* GM */
3912 {0xe001,KEX_ECDHE_SM20x25, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM1_SM3 */
3913 {0xe003,KEX_ECC_SM20x26, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* ECC_SM1_SM3 */
3914 {0xe005,KEX_IBSDH_SM90x27, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM1_SM3 */
3915 {0xe007,KEX_IBC_SM90x28, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* IBC_SM1_SM3 */
3916 {0xe009,KEX_RSA0x1e, ENC_SM10x3B, DIG_SM30x44, MODE_CBC}, /* RSA_SM1_SM3 */
3917 {0xe00a,KEX_RSA0x1e, ENC_SM10x3B, DIG_SHA0x41, MODE_CBC}, /* RSA_SM1_SHA1 */
3918 {0xe011,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */
3919 {0xe013,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* ECC_SM4_CBC_SM3 */
3920 {0xe015,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */
3921 {0xe017,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* IBC_SM4_CBC_SM3 */
3922 {0xe019,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_CBC}, /* RSA_SM4_CBC_SM3 */
3923 {0xe01a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA0x41, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */
3924 {0xe01c,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */
3925 {0xe051,KEX_ECDHE_SM20x25, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */
3926 {0xe053,KEX_ECC_SM20x26, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* ECC_SM4_GCM_SM3 */
3927 {0xe055,KEX_IBSDH_SM90x27, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */
3928 {0xe057,KEX_IBC_SM90x28, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* IBC_SM4_GCM_SM3 */
3929 {0xe059,KEX_RSA0x1e, ENC_SM40x3C, DIG_SM30x44, MODE_GCM}, /* RSA_SM4_GCM_SM3 */
3930 {0xe05a,KEX_RSA0x1e, ENC_SM40x3C, DIG_SHA2560x42, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */
3931 {-1, 0, 0, 0, MODE_STREAM}
3932};
3933
3934#define MAX_BLOCK_SIZE16 16
3935#define MAX_KEY_SIZE32 32
3936
3937const SslCipherSuite *
3938ssl_find_cipher(int num)
3939{
3940 const SslCipherSuite *c;
3941 for(c=cipher_suites;c->number!=-1;c++){
3942 if(c->number==num){
3943 return c;
3944 }
3945 }
3946
3947 return NULL((void*)0);
3948}
3949
3950int
3951ssl_get_cipher_algo(const SslCipherSuite *cipher_suite)
3952{
3953 return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3954}
3955
3956unsigned
3957ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite)
3958{
3959 int cipher_algo;
3960 if (cipher_suite->mode != MODE_CBC) return 0;
3961 cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START0x30]);
3962 return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
3963}
3964
3965static unsigned
3966ssl_get_cipher_export_keymat_size(int cipher_suite_num)
3967{
3968 switch (cipher_suite_num) {
3969 /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */
3970 case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */
3971 case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */
3972 case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */
3973 case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */
3974 case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */
3975 case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */
3976 case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */
3977 case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */
3978 case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */
3979 return 5;
3980
3981 /* not defined in below draft, but "implemented by several vendors",
3982 * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */
3983 case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */
3984 case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */
3985 return 7;
3986
3987 /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always
3988 * used 7. Until a pcap proves 8, let's use the old value. Link:
3989 * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */
3990 case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */
3991 case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */
3992 case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */
3993 case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */
3994 return 7;
3995
3996 default:
3997 return 0;
3998 }
3999}
4000
4001/* Digests, Ciphers and Cipher Suites registry }}} */
4002
4003
4004/* HMAC and the Pseudorandom function {{{ */
4005static int
4006tls_hash(StringInfo *secret, StringInfo *seed, int md,
4007 StringInfo *out, unsigned out_len)
4008{
4009 /* RFC 2246 5. HMAC and the pseudorandom function
4010 * '+' denotes concatenation.
4011 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
4012 * HMAC_hash(secret, A(2) + seed) + ...
4013 * A(0) = seed
4014 * A(i) = HMAC_hash(secret, A(i - 1))
4015 */
4016 uint8_t *ptr;
4017 unsigned left, tocpy;
4018 uint8_t *A;
4019 uint8_t _A[DIGEST_MAX_SIZE48], tmp[DIGEST_MAX_SIZE48];
4020 unsigned A_l, tmp_l;
4021 SSL_HMACgcry_md_hd_t hm;
4022
4023 ptr = out->data;
4024 left = out_len;
4025
4026 ssl_print_string("tls_hash: hash secret", secret);
4027 ssl_print_string("tls_hash: hash seed", seed);
4028 /* A(0) = seed */
4029 A = seed->data;
4030 A_l = seed->data_len;
4031
4032 if (ssl_hmac_init(&hm, md) != 0) {
4033 return -1;
4034 }
4035 while (left) {
4036 /* A(i) = HMAC_hash(secret, A(i-1)) */
4037 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
4038 ssl_hmac_update(&hm, A, A_l);
4039 A_l = sizeof(_A); /* upper bound len for hash output */
4040 ssl_hmac_final(&hm, _A, &A_l);
4041 A = _A;
4042
4043 /* HMAC_hash(secret, A(i) + seed) */
4044 ssl_hmac_reset(&hm);
4045 ssl_hmac_setkey(&hm, secret->data, secret->data_len);
4046 ssl_hmac_update(&hm, A, A_l);
4047 ssl_hmac_update(&hm, seed->data, seed->data_len);
4048 tmp_l = sizeof(tmp); /* upper bound len for hash output */
4049 ssl_hmac_final(&hm, tmp, &tmp_l);
4050 ssl_hmac_reset(&hm);
4051
4052 /* ssl_hmac_final puts the actual digest output size in tmp_l */
4053 tocpy = MIN(left, tmp_l)(((left) < (tmp_l)) ? (left) : (tmp_l));
4054 memcpy(ptr, tmp, tocpy);
4055 ptr += tocpy;
4056 left -= tocpy;
4057 }
4058 ssl_hmac_cleanup(&hm);
4059 out->data_len = out_len;
4060
4061 ssl_print_string("hash out", out);
4062 return 0;
4063}
4064
4065static bool_Bool
4066tls_prf(StringInfo* secret, const char *usage,
4067 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4068{
4069 StringInfo seed, sha_out, md5_out;
4070 uint8_t *ptr;
4071 StringInfo s1, s2;
4072 unsigned i,s_l;
4073 size_t usage_len, rnd2_len;
4074 bool_Bool success = false0;
4075 usage_len = strlen(usage);
4076 rnd2_len = rnd2 ? rnd2->data_len : 0;
4077
4078 /* initialize buffer for sha, md5 random seed*/
4079 if (ssl_data_alloc(&sha_out, MAX(out_len, 20)(((out_len) > (20)) ? (out_len) : (20))) < 0) {
4080 ssl_debug_printf("tls_prf: can't allocate sha out\n");
4081 return false0;
4082 }
4083 if (ssl_data_alloc(&md5_out, MAX(out_len, 16)(((out_len) > (16)) ? (out_len) : (16))) < 0) {
4084 ssl_debug_printf("tls_prf: can't allocate md5 out\n");
4085 goto free_sha;
4086 }
4087 if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4088 ssl_debug_printf("tls_prf: can't allocate rnd %d\n",
4089 (int) (usage_len+rnd1->data_len+rnd2_len));
4090 goto free_md5;
4091 }
4092
4093 ptr=seed.data;
4094 memcpy(ptr,usage,usage_len);
4095 ptr+=usage_len;
4096 memcpy(ptr,rnd1->data,rnd1->data_len);
4097 if (rnd2_len > 0) {
4098 ptr+=rnd1->data_len;
4099 memcpy(ptr,rnd2->data,rnd2->data_len);
4100 /*ptr+=rnd2->data_len;*/
4101 }
4102
4103 /* initialize buffer for client/server seeds*/
4104 s_l=secret->data_len/2 + secret->data_len%2;
4105 if (ssl_data_alloc(&s1, s_l) < 0) {
4106 ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l);
4107 goto free_seed;
4108 }
4109 if (ssl_data_alloc(&s2, s_l) < 0) {
4110 ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l);
4111 goto free_s1;
4112 }
4113
4114 memcpy(s1.data,secret->data,s_l);
4115 memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l);
4116
4117 ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len);
4118 if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0)
4119 goto free_s2;
4120 ssl_debug_printf("tls_prf: tls_hash(sha)\n");
4121 if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0)
4122 goto free_s2;
4123
4124 for (i = 0; i < out_len; i++)
4125 out->data[i] = md5_out.data[i] ^ sha_out.data[i];
4126 /* success, now store the new meaningful data length */
4127 out->data_len = out_len;
4128 success = true1;
4129
4130 ssl_print_string("PRF out",out);
4131free_s2:
4132 g_free(s2.data);
4133free_s1:
4134 g_free(s1.data);
4135free_seed:
4136 g_free(seed.data);
4137free_md5:
4138 g_free(md5_out.data);
4139free_sha:
4140 g_free(sha_out.data);
4141 return success;
4142}
4143
4144static bool_Bool
4145tls12_prf(int md, StringInfo* secret, const char* usage,
4146 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4147{
4148 StringInfo label_seed;
4149 int success;
4150 size_t usage_len, rnd2_len;
4151 rnd2_len = rnd2 ? rnd2->data_len : 0;
4152
4153 usage_len = strlen(usage);
4154 if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) {
4155 ssl_debug_printf("tls12_prf: can't allocate label_seed\n");
4156 return false0;
4157 }
4158 memcpy(label_seed.data, usage, usage_len);
4159 memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len);
4160 if (rnd2_len > 0)
4161 memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len);
4162
4163 ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len);
4164 success = tls_hash(secret, &label_seed, md, out, out_len);
4165 g_free(label_seed.data);
4166 if(success != -1){
4167 ssl_print_string("PRF out", out);
4168 return true1;
4169 }
4170 return false0;
4171}
4172
4173static bool_Bool
4174ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2,
4175 StringInfo *out, unsigned out_len)
4176{
4177 SSL_MD5_CTXgcry_md_hd_t md5;
4178 uint8_t tmp[16];
4179
4180 if (ssl_md5_init(&md5) != 0) {
4181 return false0;
4182 }
4183 ssl_md5_update(&md5,r1->data,r1->data_len);
4184 ssl_md5_update(&md5,r2->data,r2->data_len);
4185 ssl_md5_final(tmp,&md5);
4186 ssl_md5_cleanup(&md5);
4187
4188 DISSECTOR_ASSERT(out_len <= sizeof(tmp))((void) ((out_len <= sizeof(tmp)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4188, "out_len <= sizeof(tmp)"))))
;
4189 ssl_data_set(out, tmp, out_len);
4190 ssl_print_string("export iv", out);
4191 return true1;
4192}
4193
4194static bool_Bool
4195ssl3_prf(StringInfo* secret, const char* usage,
4196 StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len)
4197{
4198 SSL_MD5_CTXgcry_md_hd_t md5;
4199 SSL_SHA_CTXgcry_md_hd_t sha;
4200 unsigned off;
4201 int i = 0,j;
4202 uint8_t buf[20];
4203
4204 if (ssl_sha_init(&sha) != 0) {
4205 return false0;
4206 }
4207 if (ssl_md5_init(&md5) != 0) {
4208 ssl_sha_cleanup(&sha);
4209 return false0;
4210 }
4211 for (off = 0; off < out_len; off += 16) {
4212 unsigned char outbuf[16];
4213 i++;
4214
4215 ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i);
4216 /* A, BB, CCC, ... */
4217 for(j=0;j<i;j++){
4218 buf[j]=64+i;
4219 }
4220
4221 ssl_sha_update(&sha,buf,i);
4222 ssl_sha_update(&sha,secret->data,secret->data_len);
4223
4224 if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){
4225 if (rnd2)
4226 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4227 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4228 }
4229 else{
4230 ssl_sha_update(&sha,rnd1->data,rnd1->data_len);
4231 if (rnd2)
4232 ssl_sha_update(&sha,rnd2->data,rnd2->data_len);
4233 }
4234
4235 ssl_sha_final(buf,&sha);
4236 ssl_sha_reset(&sha);
4237
4238 ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i,
4239 secret->data_len);
4240 ssl_md5_update(&md5,secret->data,secret->data_len);
4241 ssl_md5_update(&md5,buf,20);
4242 ssl_md5_final(outbuf,&md5);
4243 ssl_md5_reset(&md5);
4244
4245 memcpy(out->data + off, outbuf, MIN(out_len - off, 16)(((out_len - off) < (16)) ? (out_len - off) : (16)));
4246 }
4247 ssl_sha_cleanup(&sha);
4248 ssl_md5_cleanup(&md5);
4249 out->data_len = out_len;
4250
4251 return true1;
4252}
4253
4254/* out_len is the wanted output length for the pseudorandom function.
4255 * Ensure that ssl->cipher_suite is set. */
4256static bool_Bool
4257prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage,
4258 StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len)
4259{
4260 switch (ssl->session.version) {
4261 case SSLV3_VERSION0x300:
4262 return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len);
4263
4264 case TLSV1_VERSION0x301:
4265 case TLSV1DOT1_VERSION0x302:
4266 case DTLSV1DOT0_VERSION0xfeff:
4267 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4268 return tls_prf(secret, usage, rnd1, rnd2, out, out_len);
4269
4270 default: /* TLSv1.2 */
4271 switch (ssl->cipher_suite->dig) {
4272 case DIG_SM30x44:
4273#if GCRYPT_VERSION_NUMBER0x010a03 >= 0x010900
4274 return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2,
4275 out, out_len);
4276#else
4277 return false0;
4278#endif
4279 case DIG_SHA3840x43:
4280 return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2,
4281 out, out_len);
4282 default:
4283 return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2,
4284 out, out_len);
4285 }
4286 }
4287}
4288
4289static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out)
4290{
4291 SSL_MD5_CTXgcry_md_hd_t md5;
4292 SSL_SHA_CTXgcry_md_hd_t sha;
4293
4294 if (ssl_data_alloc(out, 36) < 0)
4295 return -1;
4296
4297 if (ssl_md5_init(&md5) != 0)
4298 return -1;
4299 ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len);
4300 ssl_md5_final(out->data,&md5);
4301 ssl_md5_cleanup(&md5);
4302
4303 if (ssl_sha_init(&sha) != 0)
4304 return -1;
4305 ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len);
4306 ssl_sha_final(out->data+16,&sha);
4307 ssl_sha_cleanup(&sha);
4308 return 0;
4309}
4310
4311static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out)
4312{
4313 SSL_MDgcry_md_hd_t mc;
4314 uint8_t tmp[48];
4315 unsigned len;
4316
4317 if (ssl_md_init(&mc, md) != 0)
4318 return -1;
4319 ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len);
4320 ssl_md_final(&mc, tmp, &len);
4321 ssl_md_cleanup(&mc);
4322
4323 if (ssl_data_alloc(out, len) < 0)
4324 return -1;
4325 memcpy(out->data, tmp, len);
4326 return 0;
4327}
4328
4329/**
4330 * Obtains the label prefix used in HKDF-Expand-Label. This function can be
4331 * inlined and removed once support for draft 19 and before is dropped.
4332 */
4333static inline const char *
4334tls13_hkdf_label_prefix(SslDecryptSession *ssl_session)
4335{
4336 if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) {
4337 return "TLS 1.3, ";
4338 } else if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4339 return "dtls13";
4340 } else {
4341 return "tls13 ";
4342 }
4343}
4344
4345/*
4346 * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a
4347 * custom label prefix. If "context_hash" is NULL, then an empty context is
4348 * used. Otherwise it must have the same length as the hash algorithm output.
4349 */
4350bool_Bool
4351tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
4352 const char *label_prefix, const char *label,
4353 const uint8_t *context_hash, uint8_t context_length,
4354 uint16_t out_len, unsigned char **out)
4355{
4356 /* RFC 8446 Section 7.1:
4357 * HKDF-Expand-Label(Secret, Label, Context, Length) =
4358 * HKDF-Expand(Secret, HkdfLabel, Length)
4359 * struct {
4360 * uint16 length = Length;
4361 * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix.
4362 * opaque context<0..255> = Context;
4363 * } HkdfLabel;
4364 *
4365 * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF):
4366 * HKDF-Expand(PRK, info, L) -> OKM
4367 */
4368 gcry_error_t err;
4369 const unsigned label_prefix_length = (unsigned) strlen(label_prefix);
4370 const unsigned label_length = (unsigned) strlen(label);
4371
4372 /* Some sanity checks */
4373 DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255)((void) ((label_length > 0 && label_prefix_length +
label_length <= 255) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 4373, "label_length > 0 && label_prefix_length + label_length <= 255"
))))
;
38
'?' condition is true
4374
4375 /* info = HkdfLabel { length, label, context } */
4376 GByteArray *info = g_byte_array_new();
4377 const uint16_t length = g_htons(out_len)(((((guint16) ( (guint16) ((guint16) (out_len) >> 8) | (
guint16) ((guint16) (out_len) << 8))))))
;
4378 g_byte_array_append(info, (const uint8_t *)&length, sizeof(length));
4379
4380 const uint8_t label_vector_length = label_prefix_length + label_length;
4381 g_byte_array_append(info, &label_vector_length, 1);
4382 g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length);
4383 g_byte_array_append(info, (const uint8_t*)label, label_length);
4384
4385 g_byte_array_append(info, &context_length, 1);
4386 if (context_length
38.1
'context_length' is not equal to 0
) {
39
Taking true branch
4387 g_byte_array_append(info, context_hash, context_length);
4388 }
4389
4390 *out = (unsigned char *)wmem_alloc(NULL((void*)0), out_len);
4391 err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len);
4392 g_byte_array_free(info, true1);
4393
4394 if (err) {
40
Assuming 'err' is not equal to 0
41
Taking true branch
4395 ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC((const char*) (__func__)), md, gcry_strerror(err));
4396 wmem_free(NULL((void*)0), *out);
4397 *out = NULL((void*)0);
42
Null pointer value stored to 'ech_verify_out'
4398 return false0;
4399 }
4400
4401 return true1;
4402}
4403
4404bool_Bool
4405tls13_hkdf_expand_label(int md, const StringInfo *secret,
4406 const char *label_prefix, const char *label,
4407 uint16_t out_len, unsigned char **out)
4408{
4409 return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL((void*)0), 0, out_len, out);
4410}
4411/* HMAC and the Pseudorandom function }}} */
4412
4413/* Record Decompression (after decryption) {{{ */
4414#ifdef USE_ZLIB_OR_ZLIBNG
4415/* memory allocation functions for zlib initialization */
4416static void* ssl_zalloc(void* opaque _U___attribute__((unused)), unsigned int no, unsigned int size)
4417{
4418 return g_malloc0(no*size);
4419}
4420static void ssl_zfree(void* opaque _U___attribute__((unused)), void* addr)
4421{
4422 g_free(addr);
4423}
4424#endif /* USE_ZLIB_OR_ZLIBNG */
4425
4426static SslDecompress*
4427ssl_create_decompressor(int compression)
4428{
4429 SslDecompress *decomp;
4430#ifdef USE_ZLIB_OR_ZLIBNG
4431 int err;
4432#endif
4433
4434 if (compression == 0) return NULL((void*)0);
4435 ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression);
4436 decomp = wmem_new(wmem_file_scope(), SslDecompress)((SslDecompress*)wmem_alloc((wmem_file_scope()), sizeof(SslDecompress
)))
;
4437 decomp->compression = compression;
4438 switch (decomp->compression) {
4439#ifdef USE_ZLIB_OR_ZLIBNG
4440 case 1: /* DEFLATE */
4441 decomp->istream.zalloc = ssl_zalloc;
4442 decomp->istream.zfree = ssl_zfree;
4443 decomp->istream.opaque = Z_NULL0;
4444 decomp->istream.next_in = Z_NULL0;
4445 decomp->istream.next_out = Z_NULL0;
4446 decomp->istream.avail_in = 0;
4447 decomp->istream.avail_out = 0;
4448 err = ZLIB_PREFIX(inflateInit)(&decomp->istream)inflateInit_((&decomp->istream), "1.3", (int)sizeof(z_stream
))
;
4449 if (err != Z_OK0) {
4450 ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err);
4451 return NULL((void*)0);
4452 }
4453 break;
4454#endif /* USE_ZLIB_OR_ZLIBNG */
4455 default:
4456 ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression);
4457 return NULL((void*)0);
4458 }
4459 return decomp;
4460}
4461
4462#ifdef USE_ZLIB_OR_ZLIBNG
4463static int
4464ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl)
4465{
4466 int err;
4467
4468 switch (decomp->compression) {
4469 case 1: /* DEFLATE */
4470 err = Z_OK0;
4471 if (out_str->data_len < 16384) { /* maximal plain length */
4472 ssl_data_realloc(out_str, 16384);
4473 }
4474#ifdef z_constconst
4475 decomp->istream.next_in = in;
4476#else
4477DIAG_OFF(cast-qual)clang diagnostic push clang diagnostic ignored "-Wcast-qual"
4478 decomp->istream.next_in = (Bytef *)in;
4479DIAG_ON(cast-qual)clang diagnostic pop
4480#endif
4481 decomp->istream.avail_in = inl;
4482 decomp->istream.next_out = out_str->data;
4483 decomp->istream.avail_out = out_str->data_len;
4484 if (inl > 0)
4485 err = ZLIB_PREFIX(inflate)inflate(&decomp->istream, Z_SYNC_FLUSH2);
4486 if (err != Z_OK0) {
4487 ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err);
4488 return -1;
4489 }
4490 *outl = out_str->data_len - decomp->istream.avail_out;
4491 break;
4492 default:
4493 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4494 return -1;
4495 }
4496 return 0;
4497}
4498#else /* USE_ZLIB_OR_ZLIBNG */
4499int
4500ssl_decompress_record(SslDecompress* decomp _U___attribute__((unused)), const unsigned char* in _U___attribute__((unused)), unsigned inl _U___attribute__((unused)), StringInfo* out_str _U___attribute__((unused)), unsigned* outl _U___attribute__((unused)))
4501{
4502 ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression);
4503 return -1;
4504}
4505#endif /* USE_ZLIB_OR_ZLIBNG */
4506/* Record Decompression (after decryption) }}} */
4507
4508/* Create a new structure to store decrypted chunks. {{{ */
4509static SslFlow*
4510ssl_create_flow(void)
4511{
4512 SslFlow *flow;
4513
4514 flow = wmem_new(wmem_file_scope(), SslFlow)((SslFlow*)wmem_alloc((wmem_file_scope()), sizeof(SslFlow)));
4515 flow->byte_seq = 0;
4516 flow->flags = 0;
4517 flow->multisegment_pdus = wmem_tree_new(wmem_file_scope());
4518 return flow;
4519}
4520/* }}} */
4521
4522/* Use the negotiated security parameters for decryption. {{{ */
4523void
4524ssl_change_cipher(SslDecryptSession *ssl_session, bool_Bool server)
4525{
4526 SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new;
4527 SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client;
4528 ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT",
4529 *new_decoder ? "" : " (No decoder found - retransmission?)");
4530 if (*new_decoder) {
4531 *dest = *new_decoder;
4532 *new_decoder = NULL((void*)0);
4533 }
4534}
4535/* }}} */
4536
4537/* Init cipher state given some security parameters. {{{ */
4538static bool_Bool
4539ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *);
4540
4541static SslDecoder*
4542ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo,
4543 int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length)
4544{
4545 SslDecoder *dec;
4546 ssl_cipher_mode_t mode = cipher_suite->mode;
4547
4548 dec = wmem_new0(wmem_file_scope(), SslDecoder)((SslDecoder*)wmem_alloc0((wmem_file_scope()), sizeof(SslDecoder
)))
;
4549 /* init mac buffer: mac storage is embedded into decoder struct to save a
4550 memory allocation and waste samo more memory*/
4551 dec->cipher_suite=cipher_suite;
4552 dec->compression = compression;
4553 if ((mode == MODE_STREAM && mk != NULL((void*)0)) || mode == MODE_CBC) {
4554 // AEAD ciphers use no MAC key, but stream and block ciphers do. Note
4555 // the special case for NULL ciphers, even if there is insufficiency
4556 // keying material (including MAC key), we will can still create
4557 // decoders since "decryption" is easy for such ciphers.
4558 dec->mac_key.data = dec->_mac_key_or_write_iv;
4559 ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len);
4560 } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) {
4561 // Input for the nonce, to be used with AEAD ciphers.
4562 DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv))((void) ((iv_length <= sizeof(dec->_mac_key_or_write_iv
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4562, "iv_length <= sizeof(dec->_mac_key_or_write_iv)"
))))
;
4563 dec->write_iv.data = dec->_mac_key_or_write_iv;
4564 ssl_data_set(&dec->write_iv, iv, iv_length);
4565 }
4566 dec->seq = 0;
4567 dec->decomp = ssl_create_decompressor(compression);
4568 wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec);
4569
4570 if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) {
4571 ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC((const char*) (__func__)),
4572 cipher_algo, cipher_suite->mode);
4573 return NULL((void*)0);
4574 }
4575
4576 if (cipher_suite->enc != ENC_NULL0x3D && sn_key != NULL((void*)0)) {
4577 if (cipher_suite->enc == ENC_AES0x35 || cipher_suite->enc == ENC_AES2560x36) {
4578 mode = MODE_ECB;
4579 } else if (cipher_suite->enc == ENC_CHACHA200x3A) {
4580 mode = MODE_STREAM;
4581 } else {
4582 ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n");
4583 return NULL((void*)0);
4584 }
4585
4586 if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL((void*)0), mode) < 0) {
4587 ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC((const char*) (__func__)),
4588 cipher_algo, MODE_ECB);
4589 ssl_cipher_cleanup(&dec->evp);
4590 dec->evp = NULL((void*)0);
4591 return NULL((void*)0);
4592 }
4593 } else {
4594 dec->sn_evp = NULL((void*)0);
4595 }
4596
4597 dec->dtls13_aad.data = NULL((void*)0);
4598 dec->dtls13_aad.data_len = 0;
4599 ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len);
4600 return dec;
4601}
4602
4603static bool_Bool
4604ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U___attribute__((unused)), wmem_cb_event_t event _U___attribute__((unused)), void *user_data)
4605{
4606 SslDecoder *dec = (SslDecoder *) user_data;
4607
4608 if (dec->evp)
4609 ssl_cipher_cleanup(&dec->evp);
4610 if (dec->sn_evp)
4611 ssl_cipher_cleanup(&dec->sn_evp);
4612
4613#ifdef USE_ZLIB_OR_ZLIBNG
4614 if (dec->decomp != NULL((void*)0) && dec->decomp->compression == 1 /* DEFLATE */)
4615 ZLIB_PREFIX(inflateEnd)inflateEnd(&dec->decomp->istream);
4616#endif
4617
4618 return false0;
4619}
4620/* }}} */
4621
4622/* (Pre-)master secrets calculations {{{ */
4623#ifdef HAVE_LIBGNUTLS1
4624static bool_Bool
4625ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
4626 StringInfo *encrypted_pre_master,
4627 GHashTable *key_hash);
4628#endif /* HAVE_LIBGNUTLS */
4629
4630static bool_Bool
4631ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
4632 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key);
4633
4634bool_Bool
4635ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
4636 uint32_t length, tvbuff_t *tvb, uint32_t offset,
4637 const char *ssl_psk, packet_info *pinfo,
4638#ifdef HAVE_LIBGNUTLS1
4639 GHashTable *key_hash,
4640#endif
4641 const ssl_master_key_map_t *mk_map)
4642{
4643 /* check for required session data */
4644 ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n",
4645 G_STRFUNC((const char*) (__func__)), ssl_session->state);
4646 if ((ssl_session->state & (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) !=
4647 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4))) {
4648 ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC((const char*) (__func__)),
4649 (SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4)));
4650 return false0;
4651 }
4652
4653 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304) {
4654 ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC((const char*) (__func__)));
4655 return false0;
4656 }
4657
4658 /* check to see if the PMS was provided to us*/
4659 if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true1,
4660 mk_map->pms, &ssl_session->client_random)) {
4661 return true1;
4662 }
4663
4664 if (ssl_session->cipher_suite->kex == KEX_PSK0x1d)
4665 {
4666 /* calculate pre master secret*/
4667 StringInfo pre_master_secret;
4668 unsigned psk_len, pre_master_len;
4669
4670 if (!ssl_psk || (ssl_psk[0] == 0)) {
4671 ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC((const char*) (__func__)));
4672 return false0;
4673 }
4674
4675 /* convert hex string into char*/
4676 if (!from_hex(&ssl_session->psk, ssl_psk, strlen(ssl_psk))) {
4677 ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n",
4678 G_STRFUNC((const char*) (__func__)));
4679 return false0;
4680 }
4681
4682 psk_len = ssl_session->psk.data_len;
4683 if (psk_len >= (2 << 15)) {
4684 ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n",
4685 G_STRFUNC((const char*) (__func__)));
4686 return false0;
4687 }
4688
4689
4690 pre_master_len = psk_len * 2 + 4;
4691
4692 pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len);
4693 pre_master_secret.data_len = pre_master_len;
4694 /* 2 bytes psk_len*/
4695 pre_master_secret.data[0] = psk_len >> 8;
4696 pre_master_secret.data[1] = psk_len & 0xFF;
4697 /* psk_len bytes times 0*/
4698 memset(&pre_master_secret.data[2], 0, psk_len);
4699 /* 2 bytes psk_len*/
4700 pre_master_secret.data[psk_len + 2] = psk_len >> 8;
4701 pre_master_secret.data[psk_len + 3] = psk_len & 0xFF;
4702 /* psk*/
4703 memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len);
4704
4705 ssl_session->pre_master_secret.data = pre_master_secret.data;
4706 ssl_session->pre_master_secret.data_len = pre_master_len;
4707 /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/
4708
4709 /* Remove the master secret if it was there.
4710 This forces keying material regeneration in
4711 case we're renegotiating */
4712 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
4713 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
4714 return true1;
4715 }
4716 else
4717 {
4718 unsigned encrlen, skip;
4719 encrlen = length;
4720 skip = 0;
4721
4722 /* get encrypted data, on tls1 we have to skip two bytes
4723 * (it's the encrypted len and should be equal to record len - 2)
4724 * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary
4725 */
4726 if (ssl_session->cipher_suite->kex == KEX_RSA0x1e &&
4727 (ssl_session->session.version == TLSV1_VERSION0x301 ||
4728 ssl_session->session.version == TLSV1DOT1_VERSION0x302 ||
4729 ssl_session->session.version == TLSV1DOT2_VERSION0x303 ||
4730 ssl_session->session.version == DTLSV1DOT0_VERSION0xfeff ||
4731 ssl_session->session.version == DTLSV1DOT2_VERSION0xfefd ||
4732 ssl_session->session.version == TLCPV1_VERSION0x101 ))
4733 {
4734 encrlen = tvb_get_ntohs(tvb, offset);
4735 skip = 2;
4736 if (encrlen > length - 2)
4737 {
4738 ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n",
4739 G_STRFUNC((const char*) (__func__)), encrlen, length);
4740 return false0;
4741 }
4742 }
4743 /* the valid lower bound is higher than 8, but it is sufficient for the
4744 * ssl keylog file below */
4745 if (encrlen < 8) {
4746 ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n",
4747 G_STRFUNC((const char*) (__func__)), encrlen);
4748 return false0;
4749 }
4750
4751 StringInfo encrypted_pre_master = {
4752 .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen),
4753 .data_len = encrlen,
4754 };
4755
4756#ifdef HAVE_LIBGNUTLS1
4757 /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */
4758 if (ssl_session->cert_key_id) {
4759 if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash))
4760 return true1;
4761
4762 ssl_debug_printf("%s: can't decrypt pre-master secret\n",
4763 G_STRFUNC((const char*) (__func__)));
4764 }
4765#endif /* HAVE_LIBGNUTLS */
4766
4767 /* try to find the pre-master secret from the encrypted one. The
4768 * ssl key logfile stores only the first 8 bytes, so truncate it */
4769 encrypted_pre_master.data_len = 8;
4770 if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret",
4771 true1, mk_map->pre_master, &encrypted_pre_master))
4772 return true1;
4773 }
4774 return false0;
4775}
4776
4777/* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */
4778int
4779ssl_generate_keyring_material(SslDecryptSession*ssl_session)
4780{
4781 StringInfo key_block = { NULL((void*)0), 0 };
4782 uint8_t _iv_c[MAX_BLOCK_SIZE16],_iv_s[MAX_BLOCK_SIZE16];
4783 uint8_t _key_c[MAX_KEY_SIZE32],_key_s[MAX_KEY_SIZE32];
4784 int needed;
4785 int cipher_algo = -1; /* special value (-1) for NULL encryption */
4786 unsigned encr_key_len, write_iv_len = 0;
4787 bool_Bool is_export_cipher;
4788 uint8_t *ptr, *c_iv = NULL((void*)0), *s_iv = NULL((void*)0);
4789 uint8_t *c_wk = NULL((void*)0), *s_wk = NULL((void*)0), *c_mk = NULL((void*)0), *s_mk = NULL((void*)0);
4790 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
4791
4792 /* (D)TLS 1.3 is handled directly in tls13_change_key. */
4793 if (ssl_session->session.version == TLSV1DOT3_VERSION0x304 || ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
4794 ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC((const char*) (__func__)));
4795 return -1;
4796 }
4797
4798 /* check for enough info to proceed */
4799 unsigned need_all = SSL_CIPHER(1<<2)|SSL_CLIENT_RANDOM(1<<0)|SSL_SERVER_RANDOM(1<<1)|SSL_VERSION(1<<4);
4800 unsigned need_any = SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
4801 if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) {
4802 ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key "
4803 "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state,
4804 need_all|SSL_MASTER_SECRET(1<<5), need_all|SSL_PRE_MASTER_SECRET(1<<6));
4805 /* Special case: for NULL encryption, allow dissection of data even if
4806 * the Client Hello is missing (MAC keys are now skipped though). */
4807 need_all = SSL_CIPHER(1<<2)|SSL_VERSION(1<<4);
4808 if ((ssl_session->state & need_all) == need_all &&
4809 cipher_suite->enc == ENC_NULL0x3D) {
4810 ssl_debug_printf("%s NULL cipher found, will create a decoder but "
4811 "skip MAC validation as keys are missing.\n", G_STRFUNC((const char*) (__func__)));
4812 goto create_decoders;
4813 }
4814
4815 return -1;
4816 }
4817
4818 /* if master key is not available, generate is from the pre-master secret */
4819 if (!(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
4820 if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) == SSL_EXTENDED_MASTER_SECRET_MASK((1<<7)|(1<<8))) {
4821 StringInfo handshake_hashed_data;
4822 int ret;
4823
4824 handshake_hashed_data.data = NULL((void*)0);
4825 handshake_hashed_data.data_len = 0;
4826
4827 ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC((const char*) (__func__)));
4828 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4829 DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0)((void) ((ssl_session->handshake_data.data_len > 0) ? (
void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 4829, "ssl_session->handshake_data.data_len > 0"
))))
;
4830
4831 switch(ssl_session->session.version) {
4832 case TLSV1_VERSION0x301:
4833 case TLSV1DOT1_VERSION0x302:
4834 case DTLSV1DOT0_VERSION0xfeff:
4835 case DTLSV1DOT0_OPENSSL_VERSION0x100:
4836 case TLCPV1_VERSION0x101:
4837 ret = tls_handshake_hash(ssl_session, &handshake_hashed_data);
4838 break;
4839 default:
4840 switch (cipher_suite->dig) {
4841 case DIG_SHA3840x43:
4842 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data);
4843 break;
4844 default:
4845 ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data);
4846 break;
4847 }
4848 break;
4849 }
4850 if (ret) {
4851 ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC((const char*) (__func__)));
4852 return -1;
4853 }
4854
4855 wmem_free(wmem_file_scope(), ssl_session->handshake_data.data);
4856 ssl_session->handshake_data.data = NULL((void*)0);
4857 ssl_session->handshake_data.data_len = 0;
4858
4859 if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret",
4860 &handshake_hashed_data,
4861 NULL((void*)0), &ssl_session->master_secret,
4862 SSL_MASTER_SECRET_LENGTH48)) {
4863 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4864 g_free(handshake_hashed_data.data);
4865 return -1;
4866 }
4867 g_free(handshake_hashed_data.data);
4868 } else {
4869 ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC((const char*) (__func__)));
4870 ssl_print_string("pre master secret",&ssl_session->pre_master_secret);
4871 ssl_print_string("client random",&ssl_session->client_random);
4872 ssl_print_string("server random",&ssl_session->server_random);
4873 if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret",
4874 &ssl_session->client_random,
4875 &ssl_session->server_random, &ssl_session->master_secret,
4876 SSL_MASTER_SECRET_LENGTH48)) {
4877 ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC((const char*) (__func__)));
4878 return -1;
4879 }
4880 }
4881 ssl_print_string("master secret",&ssl_session->master_secret);
4882
4883 /* the pre-master secret has been 'consumed' so we must clear it now */
4884 ssl_session->state &= ~SSL_PRE_MASTER_SECRET(1<<6);
4885 ssl_session->state |= SSL_MASTER_SECRET(1<<5);
4886 }
4887
4888 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
4889 if (cipher_suite->enc != ENC_NULL0x3D) {
4890 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
4891 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4892 cipher_algo = ssl_get_cipher_by_name(cipher_name);
4893 if (cipher_algo == 0) {
4894 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
4895 return -1;
4896 }
4897 }
4898
4899 /* Export ciphers consume less material from the key block. */
4900 encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number);
4901 is_export_cipher = encr_key_len > 0;
4902 if (!is_export_cipher && cipher_suite->enc != ENC_NULL0x3D) {
4903 encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo);
4904 }
4905
4906 if (cipher_suite->mode == MODE_CBC) {
4907 write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo);
4908 } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) {
4909 /* account for a four-byte salt for client and server side (from
4910 * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */
4911 write_iv_len = 4;
4912 } else if (cipher_suite->mode == MODE_POLY1305) {
4913 /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */
4914 write_iv_len = 12;
4915 }
4916
4917 /* Compute the key block. First figure out how much data we need */
4918 needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */
4919 needed += 2 * encr_key_len; /* encryption key */
4920 needed += 2 * write_iv_len; /* write IV */
4921
4922 key_block.data = (unsigned char *)g_malloc(needed);
4923 ssl_debug_printf("%s sess key generation\n", G_STRFUNC((const char*) (__func__)));
4924 if (!prf(ssl_session, &ssl_session->master_secret, "key expansion",
4925 &ssl_session->server_random,&ssl_session->client_random,
4926 &key_block, needed)) {
4927 ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC((const char*) (__func__)));
4928 goto fail;
4929 }
4930 ssl_print_string("key expansion", &key_block);
4931
4932 ptr=key_block.data;
4933 /* client/server write MAC key (for non-AEAD ciphers) */
4934 if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) {
4935 c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4936 s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len;
4937 }
4938 /* client/server write encryption key */
4939 c_wk=ptr; ptr += encr_key_len;
4940 s_wk=ptr; ptr += encr_key_len;
4941 /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */
4942 if (write_iv_len > 0) {
4943 c_iv=ptr; ptr += write_iv_len;
4944 s_iv=ptr; /* ptr += write_iv_len; */
4945 }
4946
4947 /* export ciphers work with a smaller key length */
4948 if (is_export_cipher) {
4949 if (cipher_suite->mode == MODE_CBC) {
4950
4951 /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's
4952 all we should need. This is a sanity check */
4953 if (write_iv_len > MAX_BLOCK_SIZE16) {
4954 ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n",
4955 G_STRFUNC((const char*) (__func__)), MAX_BLOCK_SIZE16, write_iv_len);
4956 goto fail;
4957 }
4958
4959 if(ssl_session->session.version==SSLV3_VERSION0x300){
4960 /* The length of these fields are ignored by this caller */
4961 StringInfo iv_c, iv_s;
4962 iv_c.data = _iv_c;
4963 iv_s.data = _iv_s;
4964
4965 ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC((const char*) (__func__)));
4966 if (!ssl3_generate_export_iv(&ssl_session->client_random,
4967 &ssl_session->server_random, &iv_c, write_iv_len)) {
4968 goto fail;
4969 }
4970 ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC((const char*) (__func__)));
4971 if (!ssl3_generate_export_iv(&ssl_session->server_random,
4972 &ssl_session->client_random, &iv_s, write_iv_len)) {
4973 goto fail;
4974 }
4975 }
4976 else{
4977 uint8_t _iv_block[MAX_BLOCK_SIZE16 * 2];
4978 StringInfo iv_block;
4979 StringInfo key_null;
4980 uint8_t _key_null;
4981
4982 key_null.data = &_key_null;
4983 key_null.data_len = 0;
4984
4985 iv_block.data = _iv_block;
4986
4987 ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC((const char*) (__func__)));
4988 if (!prf(ssl_session, &key_null, "IV block",
4989 &ssl_session->client_random,
4990 &ssl_session->server_random, &iv_block,
4991 write_iv_len * 2)) {
4992 ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC((const char*) (__func__)));
4993 goto fail;
4994 }
4995
4996 memcpy(_iv_c, iv_block.data, write_iv_len);
4997 memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len);
4998 }
4999
5000 c_iv=_iv_c;
5001 s_iv=_iv_s;
5002 }
5003
5004 if (ssl_session->session.version==SSLV3_VERSION0x300){
5005
5006 SSL_MD5_CTXgcry_md_hd_t md5;
5007 ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC((const char*) (__func__)));
5008
5009 if (ssl_md5_init(&md5) != 0)
5010 goto fail;
5011 ssl_md5_update(&md5,c_wk,encr_key_len);
5012 ssl_md5_update(&md5,ssl_session->client_random.data,
5013 ssl_session->client_random.data_len);
5014 ssl_md5_update(&md5,ssl_session->server_random.data,
5015 ssl_session->server_random.data_len);
5016 ssl_md5_final(_key_c,&md5);
5017 ssl_md5_cleanup(&md5);
5018 c_wk=_key_c;
5019
5020 if (ssl_md5_init(&md5) != 0)
5021 goto fail;
5022 ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC((const char*) (__func__)));
5023 ssl_md5_update(&md5,s_wk,encr_key_len);
5024 ssl_md5_update(&md5,ssl_session->server_random.data,
5025 ssl_session->server_random.data_len);
5026 ssl_md5_update(&md5,ssl_session->client_random.data,
5027 ssl_session->client_random.data_len);
5028 ssl_md5_final(_key_s,&md5);
5029 ssl_md5_cleanup(&md5);
5030 s_wk=_key_s;
5031 }
5032 else{
5033 StringInfo key_c, key_s, k;
5034 key_c.data = _key_c;
5035 key_s.data = _key_s;
5036
5037 k.data = c_wk;
5038 k.data_len = encr_key_len;
5039 ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC((const char*) (__func__)));
5040 if (!prf(ssl_session, &k, "client write key",
5041 &ssl_session->client_random,
5042 &ssl_session->server_random, &key_c, sizeof(_key_c))) {
5043 ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC((const char*) (__func__)));
5044 goto fail;
5045 }
5046 c_wk=_key_c;
5047
5048 k.data = s_wk;
5049 k.data_len = encr_key_len;
5050 ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC((const char*) (__func__)));
5051 if (!prf(ssl_session, &k, "server write key",
5052 &ssl_session->client_random,
5053 &ssl_session->server_random, &key_s, sizeof(_key_s))) {
5054 ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC((const char*) (__func__)));
5055 goto fail;
5056 }
5057 s_wk=_key_s;
5058 }
5059 }
5060
5061 /* show key material info */
5062 if (c_mk != NULL((void*)0)) {
5063 ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5064 ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len);
5065 }
5066 ssl_print_data("Client Write key", c_wk, encr_key_len);
5067 ssl_print_data("Server Write key", s_wk, encr_key_len);
5068 /* used as IV for CBC mode and the AEAD implicit nonce (salt) */
5069 if (write_iv_len > 0) {
5070 ssl_print_data("Client Write IV", c_iv, write_iv_len);
5071 ssl_print_data("Server Write IV", s_iv, write_iv_len);
5072 }
5073
5074create_decoders:
5075 /* create both client and server ciphers*/
5076 ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC((const char*) (__func__)));
5077 ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL((void*)0), c_iv, write_iv_len);
5078 if (!ssl_session->client_new) {
5079 ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC((const char*) (__func__)));
5080 goto fail;
5081 }
5082 ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC((const char*) (__func__)));
5083 ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL((void*)0), s_iv, write_iv_len);
5084 if (!ssl_session->server_new) {
5085 ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC((const char*) (__func__)));
5086 goto fail;
5087 }
5088
5089 /* Continue the SSL stream after renegotiation with new keys. */
5090 ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5091 ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5092
5093 ssl_debug_printf("%s: client seq %" PRIu64"l" "u" ", server seq %" PRIu64"l" "u" "\n",
5094 G_STRFUNC((const char*) (__func__)), ssl_session->client_new->seq, ssl_session->server_new->seq);
5095 g_free(key_block.data);
5096 ssl_session->state |= SSL_HAVE_SESSION_KEY(1<<3);
5097 return 0;
5098
5099fail:
5100 g_free(key_block.data);
5101 return -1;
5102}
5103
5104/* Generated the key material based on the given secret. */
5105bool_Bool
5106tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool_Bool is_from_server)
5107{
5108 bool_Bool success = false0;
5109 unsigned char *write_key = NULL((void*)0), *write_iv = NULL((void*)0);
5110 unsigned char *sn_key = NULL((void*)0);
5111 SslDecoder *decoder;
5112 unsigned key_length, iv_length;
5113 int hash_algo;
5114 const SslCipherSuite *cipher_suite = ssl_session->cipher_suite;
5115 int cipher_algo;
5116
5117 if ((ssl_session->session.version != TLSV1DOT3_VERSION0x304) && (ssl_session->session.version != DTLSV1DOT3_VERSION0xfefc)) {
5118 ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC((const char*) (__func__)),
5119 ssl_session->session.version);
5120 return false0;
5121 }
5122
5123 if (cipher_suite == NULL((void*)0)) {
5124 ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC((const char*) (__func__)));
5125 return false0;
5126 }
5127
5128 if (cipher_suite->kex != KEX_TLS130x23) {
5129 ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC((const char*) (__func__)), cipher_suite->number);
5130 return false0;
5131 }
5132
5133 /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */
5134 const char *cipher_name = ciphers[cipher_suite->enc-ENC_START0x30];
5135 ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5136 cipher_algo = ssl_get_cipher_by_name(cipher_name);
5137 if (cipher_algo == 0) {
5138 ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC((const char*) (__func__)), cipher_name);
5139 return false0;
5140 }
5141
5142 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
5143 hash_algo = ssl_get_digest_by_name(hash_name);
5144 if (!hash_algo) {
5145 ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC((const char*) (__func__)), hash_name);
5146 return false0;
5147 }
5148
5149 key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo);
5150 /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */
5151 iv_length = 12;
5152 ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC((const char*) (__func__)), key_length, iv_length);
5153
5154 const char *label_prefix = tls13_hkdf_label_prefix(ssl_session);
5155 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) {
5156 ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5157 return false0;
5158 }
5159 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) {
5160 ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC((const char*) (__func__)));
5161 goto end;
5162 }
5163
5164 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5165 if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) {
5166 ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC((const char*) (__func__)));
5167 goto end;
5168 }
5169 }
5170
5171 ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length);
5172 ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length);
5173 if (ssl_session->session.version == DTLSV1DOT3_VERSION0xfefc) {
5174 ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length);
5175 }
5176
5177 ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5178 decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL((void*)0), write_key, sn_key, write_iv, iv_length);
5179 if (!decoder) {
5180 ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC((const char*) (__func__)), is_from_server ? "server" : "client");
5181 goto end;
5182 }
5183
5184 /* Continue the TLS session with new keys, but reuse old flow to keep things
5185 * like "Follow TLS" working (by linking application data records). */
5186 if (is_from_server) {
5187 decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow();
5188 ssl_session->server = decoder;
5189 } else {
5190 decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow();
5191 ssl_session->client = decoder;
5192 }
5193 ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC((const char*) (__func__)),
5194 is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name);
5195 success = true1;
5196
5197end:
5198 wmem_free(NULL((void*)0), write_key);
5199 wmem_free(NULL((void*)0), write_iv);
5200 if (sn_key)
5201 wmem_free(NULL((void*)0), sn_key);
5202 return success;
5203}
5204/* (Pre-)master secrets calculations }}} */
5205
5206#ifdef HAVE_LIBGNUTLS1
5207/* Decrypt RSA pre-master secret using RSA private key. {{{ */
5208static bool_Bool
5209ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session,
5210 StringInfo *encrypted_pre_master, GHashTable *key_hash)
5211{
5212 int ret;
5213
5214 if (!encrypted_pre_master)
5215 return false0;
5216
5217 if (KEX_IS_DH(ssl_session->cipher_suite->kex)((ssl_session->cipher_suite->kex) >= 0x10 &&
(ssl_session->cipher_suite->kex) <= 0x1b)
) {
5218 ssl_debug_printf("%s: session uses Diffie-Hellman key exchange "
5219 "(cipher suite 0x%04X %s) and cannot be decrypted "
5220 "using a RSA private key file.\n",
5221 G_STRFUNC((const char*) (__func__)), ssl_session->session.cipher,
5222 val_to_str_ext_const(ssl_session->session.cipher,
5223 &ssl_31_ciphersuite_ext, "unknown"));
5224 return false0;
5225 } else if (ssl_session->cipher_suite->kex != KEX_RSA0x1e) {
5226 ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n",
5227 G_STRFUNC((const char*) (__func__)), ssl_session->cipher_suite->kex, KEX_RSA0x1e);
5228 return false0;
5229 }
5230
5231 gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id);
5232
5233 ssl_print_string("pre master encrypted", encrypted_pre_master);
5234 ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC((const char*) (__func__)));
5235 const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len };
5236 gnutls_datum_t pms = { 0 };
5237 if (pk) {
5238 // Try to decrypt using the RSA keys table from (D)TLS preferences.
5239 ret = gnutls_privkey_decrypt_data(pk, 0, &epms, &pms);
5240 } else {
5241 // Try to decrypt using a hardware token.
5242 ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size);
5243 }
5244 if (ret < 0) {
5245 ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC((const char*) (__func__)), ret, gnutls_strerror(ret));
5246 return false0;
5247 }
5248
5249 if (pms.size != 48) {
5250 ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n",
5251 G_STRFUNC((const char*) (__func__)), pms.size, 48);
5252 if (pk) {
5253 gnutls_free(pms.data);
5254 } else {
5255 g_free(pms.data);
5256 }
5257 return false0;
5258 }
5259
5260 ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48);
5261 ssl_session->pre_master_secret.data_len = 48;
5262 if (pk) {
5263 gnutls_free(pms.data);
5264 } else {
5265 g_free(pms.data);
5266 }
5267 ssl_print_string("pre master secret", &ssl_session->pre_master_secret);
5268
5269 /* Remove the master secret if it was there.
5270 This forces keying material regeneration in
5271 case we're renegotiating */
5272 ssl_session->state &= ~(SSL_MASTER_SECRET(1<<5)|SSL_HAVE_SESSION_KEY(1<<3));
5273 ssl_session->state |= SSL_PRE_MASTER_SECRET(1<<6);
5274 return true1;
5275} /* }}} */
5276#endif /* HAVE_LIBGNUTLS */
5277
5278/* Decryption integrity check {{{ */
5279
5280static int
5281tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data,
5282 uint32_t datalen, uint8_t* mac)
5283{
5284 SSL_HMACgcry_md_hd_t hm;
5285 int md;
5286 uint32_t len;
5287 uint8_t buf[DIGEST_MAX_SIZE48];
5288 int16_t temp;
5289
5290 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5291 ssl_debug_printf("tls_check_mac mac type:%s md %d\n",
5292 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5293
5294 if (ssl_hmac_init(&hm,md) != 0)
5295 return -1;
5296 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5297 return -1;
5298
5299 /* hash sequence number */
5300 phtonu64(buf, decoder->seq);
5301
5302 decoder->seq++;
5303
5304 ssl_hmac_update(&hm,buf,8);
5305
5306 /* hash content type */
5307 buf[0]=ct;
5308 ssl_hmac_update(&hm,buf,1);
5309
5310 /* hash version,data length and data*/
5311 /* *((int16_t*)buf) = g_htons(ver); */
5312 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5313 memcpy(buf, &temp, 2);
5314 ssl_hmac_update(&hm,buf,2);
5315
5316 /* *((int16_t*)buf) = g_htons(datalen); */
5317 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5318 memcpy(buf, &temp, 2);
5319 ssl_hmac_update(&hm,buf,2);
5320 ssl_hmac_update(&hm,data,datalen);
5321
5322 /* get digest and digest len*/
5323 len = sizeof(buf);
5324 ssl_hmac_final(&hm,buf,&len);
5325 ssl_hmac_cleanup(&hm);
5326 ssl_print_data("Mac", buf, len);
5327 if(memcmp(mac,buf,len))
5328 return -1;
5329
5330 return 0;
5331}
5332
5333static int
5334ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data,
5335 uint32_t datalen, uint8_t* mac)
5336{
5337 SSL_MDgcry_md_hd_t mc;
5338 int md;
5339 uint32_t len;
5340 uint8_t buf[64],dgst[20];
5341 int pad_ct;
5342 int16_t temp;
5343
5344 pad_ct=(decoder->cipher_suite->dig==DIG_SHA0x41)?40:48;
5345
5346 /* get cipher used for digest computation */
5347 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5348 if (ssl_md_init(&mc,md) !=0)
5349 return -1;
5350
5351 /* do hash computation on data && padding */
5352 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5353
5354 /* hash padding*/
5355 memset(buf,0x36,pad_ct);
5356 ssl_md_update(&mc,buf,pad_ct);
5357
5358 /* hash sequence number */
5359 phtonu64(buf, decoder->seq);
5360 decoder->seq++;
5361 ssl_md_update(&mc,buf,8);
5362
5363 /* hash content type */
5364 buf[0]=ct;
5365 ssl_md_update(&mc,buf,1);
5366
5367 /* hash data length in network byte order and data*/
5368 /* *((int16_t* )buf) = g_htons(datalen); */
5369 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5370 memcpy(buf, &temp, 2);
5371 ssl_md_update(&mc,buf,2);
5372 ssl_md_update(&mc,data,datalen);
5373
5374 /* get partial digest */
5375 ssl_md_final(&mc,dgst,&len);
5376 ssl_md_reset(&mc);
5377
5378 /* hash mac key */
5379 ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len);
5380
5381 /* hash padding and partial digest*/
5382 memset(buf,0x5c,pad_ct);
5383 ssl_md_update(&mc,buf,pad_ct);
5384 ssl_md_update(&mc,dgst,len);
5385
5386 ssl_md_final(&mc,dgst,&len);
5387 ssl_md_cleanup(&mc);
5388
5389 if(memcmp(mac,dgst,len))
5390 return -1;
5391
5392 return 0;
5393}
5394
5395static int
5396dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data,
5397 uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl)
5398{
5399 SSL_HMACgcry_md_hd_t hm;
5400 int md;
5401 uint32_t len;
5402 uint8_t buf[DIGEST_MAX_SIZE48];
5403 int16_t temp;
5404
5405 int ver = ssl->session.version;
5406 bool_Bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION0xfefd));
5407
5408 md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name);
5409 ssl_debug_printf("dtls_check_mac mac type:%s md %d\n",
5410 ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
5411
5412 if (ssl_hmac_init(&hm,md) != 0)
5413 return -1;
5414 if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0)
5415 return -1;
5416
5417 ssl_debug_printf("dtls_check_mac seq: %" PRIu64"l" "u" " epoch: %d\n",decoder->seq,decoder->epoch);
5418
5419 if (is_cid && !ssl->session.deprecated_cid) {
5420 /* hash seq num placeholder */
5421 memset(buf,0xFF,8);
5422 ssl_hmac_update(&hm,buf,8);
5423
5424 /* hash content type + cid length + content type */
5425 buf[0]=ct;
5426 buf[1]=cidl;
5427 buf[2]=ct;
5428 ssl_hmac_update(&hm,buf,3);
5429
5430 /* hash version */
5431 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5432 memcpy(buf, &temp, 2);
5433 ssl_hmac_update(&hm,buf,2);
5434
5435 /* hash sequence number */
5436 phtonu64(buf, decoder->seq);
5437 buf[0]=decoder->epoch>>8;
5438 buf[1]=(uint8_t)decoder->epoch;
5439 ssl_hmac_update(&hm,buf,8);
5440
5441 /* hash cid */
5442 ssl_hmac_update(&hm,cid,cidl);
5443 } else {
5444 /* hash sequence number */
5445 phtonu64(buf, decoder->seq);
5446 buf[0]=decoder->epoch>>8;
5447 buf[1]=(uint8_t)decoder->epoch;
5448 ssl_hmac_update(&hm,buf,8);
5449
5450 /* hash content type */
5451 buf[0]=ct;
5452 ssl_hmac_update(&hm,buf,1);
5453
5454 /* hash version */
5455 temp = g_htons(ver)(((((guint16) ( (guint16) ((guint16) (ver) >> 8) | (guint16
) ((guint16) (ver) << 8))))))
;
5456 memcpy(buf, &temp, 2);
5457 ssl_hmac_update(&hm,buf,2);
5458
5459 if (is_cid && ssl->session.deprecated_cid) {
5460 /* hash cid */
5461 ssl_hmac_update(&hm,cid,cidl);
5462
5463 /* hash cid length */
5464 buf[0] = cidl;
5465 ssl_hmac_update(&hm,buf,1);
5466 }
5467 }
5468
5469 /* data length and data */
5470 temp = g_htons(datalen)(((((guint16) ( (guint16) ((guint16) (datalen) >> 8) | (
guint16) ((guint16) (datalen) << 8))))))
;
5471 memcpy(buf, &temp, 2);
5472 ssl_hmac_update(&hm,buf,2);
5473 ssl_hmac_update(&hm,data,datalen);
5474
5475 /* get digest and digest len */
5476 len = sizeof(buf);
5477 ssl_hmac_final(&hm,buf,&len);
5478 ssl_hmac_cleanup(&hm);
5479 ssl_print_data("Mac", buf, len);
5480 if(memcmp(mac,buf,len))
5481 return -1;
5482
5483 return 0;
5484}
5485/* Decryption integrity check }}} */
5486
5487
5488static bool_Bool
5489tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder,
5490 uint8_t ct, uint16_t record_version,
5491 bool_Bool ignore_mac_failed,
5492 const unsigned char *in, uint16_t inl,
5493 const unsigned char *cid, uint8_t cidl,
5494 StringInfo *out_str, unsigned *outl)
5495{
5496 /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as:
5497 * GenericAEADCipher: { nonce_explicit, [content] }
5498 * In TLS 1.3 this explicit nonce is gone.
5499 * With AES GCM/CCM, "[content]" is actually the concatenation of the
5500 * ciphertext and authentication tag.
5501 */
5502 const uint16_t version = ssl->session.version;
5503 const bool_Bool is_v12 = version == TLSV1DOT2_VERSION0x303 || version == DTLSV1DOT2_VERSION0xfefd || version == TLCPV1_VERSION0x101;
5504 gcry_error_t err;
5505 const unsigned char *explicit_nonce = NULL((void*)0), *ciphertext;
5506 unsigned ciphertext_len, auth_tag_len;
5507 unsigned char nonce[12];
5508 const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode;
5509 const bool_Bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION0xfefd;
5510 const uint8_t draft_version = ssl->session.tls13_draft_version;
5511 const unsigned char *auth_tag_wire;
5512 unsigned char auth_tag_calc[16];
5513 unsigned char *aad = NULL((void*)0);
5514 unsigned aad_len = 0;
5515
5516 switch (cipher_mode) {
5517 case MODE_GCM:
5518 case MODE_CCM:
5519 case MODE_POLY1305:
5520 auth_tag_len = 16;
5521 break;
5522 case MODE_CCM_8:
5523 auth_tag_len = 8;
5524 break;
5525 default:
5526 ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC((const char*) (__func__)));
5527 return false0;
5528 }
5529
5530 /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */
5531 if (is_v12 && cipher_mode != MODE_POLY1305) {
5532 if (inl < EXPLICIT_NONCE_LEN8 + auth_tag_len) {
5533 ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n",
5534 G_STRFUNC((const char*) (__func__)), inl, EXPLICIT_NONCE_LEN8, auth_tag_len);
5535 return false0;
5536 }
5537 explicit_nonce = in;
5538 ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN8;
5539 ciphertext_len = inl - EXPLICIT_NONCE_LEN8 - auth_tag_len;
5540 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5541 if (inl < auth_tag_len) {
5542 ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC((const char*) (__func__)), inl, auth_tag_len);
5543 return false0;
5544 }
5545 ciphertext = in;
5546 ciphertext_len = inl - auth_tag_len;
5547 } else {
5548 ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC((const char*) (__func__)), version);
5549 return false0;
5550 }
5551 auth_tag_wire = ciphertext + ciphertext_len;
5552
5553 /*
5554 * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305
5555 * (RFC 7905) uses a nonce construction similar to TLS 1.3.
5556 */
5557 if (is_v12 && cipher_mode != MODE_POLY1305) {
5558 DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN)((void) ((decoder->write_iv.data_len == 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 5558, "decoder->write_iv.data_len == 4"))))
;
5559 /* Implicit (4) and explicit (8) part of nonce. */
5560 memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN4);
5561 memcpy(nonce + IMPLICIT_NONCE_LEN4, explicit_nonce, EXPLICIT_NONCE_LEN8);
5562
5563 } else if (version == TLSV1DOT3_VERSION0x304 || version == DTLSV1DOT3_VERSION0xfefc || cipher_mode == MODE_POLY1305) {
5564 /*
5565 * Technically the nonce length must be at least 8 bytes, but for
5566 * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12.
5567 */
5568 const unsigned nonce_len = 12;
5569 DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len)((void) ((decoder->write_iv.data_len == nonce_len) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 5569, "decoder->write_iv.data_len == nonce_len"
))))
;
5570 memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len);
5571 /* Sequence number is left-padded with zeroes and XORed with write_iv */
5572 phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq);
5573 ssl_debug_printf("%s seq %" PRIu64"l" "u" "\n", G_STRFUNC((const char*) (__func__)), decoder->seq);
5574 }
5575
5576 /* Set nonce and additional authentication data */
5577 gcry_cipher_reset(decoder->evp)gcry_cipher_ctl ((decoder->evp), GCRYCTL_RESET, ((void*)0)
, 0)
;
5578 ssl_print_data("nonce", nonce, 12);
5579 err = gcry_cipher_setiv(decoder->evp, nonce, 12);
5580 if (err) {
5581 ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5582 return false0;
5583 }
5584
5585 /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */
5586 if (is_cid) { /* if connection ID */
5587 if (ssl->session.deprecated_cid) {
5588 aad_len = 14 + cidl;
5589 aad = wmem_alloc(allocator, aad_len);
5590 phtonu64(aad, decoder->seq); /* record sequence number */
5591 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5592 aad[8] = ct; /* TLSCompressed.type */
5593 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5594 memcpy(aad + 11, cid, cidl); /* cid */
5595 aad[11 + cidl] = cidl; /* cid_length */
5596 phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */
5597 } else {
5598 aad_len = 23 + cidl;
5599 aad = wmem_alloc(allocator, aad_len);
5600 memset(aad, 0xFF, 8); /* seq_num_placeholder */
5601 aad[8] = ct; /* TLSCompressed.type */
5602 aad[9] = cidl; /* cid_length */
5603 aad[10] = ct; /* TLSCompressed.type */
5604 phtonu16(aad + 11, record_version); /* TLSCompressed.version */
5605 phtonu64(aad + 13, decoder->seq); /* record sequence number */
5606 phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */
5607 memcpy(aad + 21, cid, cidl); /* cid */
5608 phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */
5609 }
5610 } else if (is_v12) {
5611 aad_len = 13;
5612 aad = wmem_alloc(allocator, aad_len);
5613 phtonu64(aad, decoder->seq); /* record sequence number */
5614 if (version == DTLSV1DOT2_VERSION0xfefd) {
5615 phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */
5616 }
5617 aad[8] = ct; /* TLSCompressed.type */
5618 phtonu16(aad + 9, record_version); /* TLSCompressed.version */
5619 phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */
5620 } else if (version == DTLSV1DOT3_VERSION0xfefc) {
5621 aad_len = decoder->dtls13_aad.data_len;
5622 aad = decoder->dtls13_aad.data;
5623 } else if (draft_version >= 25 || draft_version == 0) {
5624 aad_len = 5;
5625 aad = wmem_alloc(allocator, aad_len);
5626 aad[0] = ct; /* TLSCiphertext.opaque_type (23) */
5627 phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */
5628 phtonu16(aad + 3, inl); /* TLSCiphertext.length */
5629 }
5630
5631 if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) {
5632 /* size of plaintext, additional authenticated data and auth tag. */
5633 uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len };
5634
5635 gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths));
5636 }
5637
5638 if (aad && aad_len > 0) {
5639 ssl_print_data("AAD", aad, aad_len);
5640 err = gcry_cipher_authenticate(decoder->evp, aad, aad_len);
5641 if (err) {
5642 ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5643 return false0;
5644 }
5645 }
5646
5647 /* Decrypt now that nonce and AAD are set. */
5648 err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len);
5649 if (err) {
5650 ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5651 return false0;
5652 }
5653
5654 /* Check authentication tag for authenticity (replaces MAC) */
5655 err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len);
5656 if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) {
5657 ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len);
5658 } else {
5659 if (err) {
5660 ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC((const char*) (__func__)), gcry_strerror(err));
5661 } else {
5662 ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
5663 ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len);
5664 ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len);
5665 }
5666 if (ignore_mac_failed) {
5667 ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC((const char*) (__func__)));
5668 } else {
5669 return false0;
5670 }
5671 }
5672
5673 /*
5674 * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done
5675 * after successful authentication to ensure that early data is skipped when
5676 * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable.
5677 */
5678 if (version == TLSV1DOT2_VERSION0x303 || version == TLSV1DOT3_VERSION0x304 || version == TLCPV1_VERSION0x101) {
5679 decoder->seq++;
5680 }
5681
5682 ssl_print_data("Plaintext", out_str->data, ciphertext_len);
5683 *outl = ciphertext_len;
5684 return true1;
5685}
5686
5687/* Record decryption glue based on security parameters {{{ */
5688/* Assume that we are called only for a non-NULL decoder which also means that
5689 * we have a non-NULL decoder->cipher_suite. */
5690int
5691ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version,
5692 bool_Bool ignore_mac_failed,
5693 const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl,
5694 StringInfo *comp_str, StringInfo *out_str, unsigned *outl)
5695{
5696 unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0;
5697 uint8_t *mac = NULL((void*)0), *mac_frag = NULL((void*)0);
5698
5699 ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl);
5700 ssl_print_data("Ciphertext",in, inl);
5701
5702 if (((ssl->session.version == TLSV1DOT3_VERSION0x304 || ssl->session.version == DTLSV1DOT3_VERSION0xfefc))
5703 != (decoder->cipher_suite->kex == KEX_TLS130x23)) {
5704 ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC((const char*) (__func__)));
5705 return -1;
5706 }
5707
5708 /* ensure we have enough storage space for decrypted data */
5709 if (inl > out_str->data_len)
5710 {
5711 ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n",
5712 inl + 32, out_str->data_len);
5713 ssl_data_realloc(out_str, inl + 32);
5714 }
5715
5716 /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor
5717 * a separate MAC, so use a different routine for simplicity. */
5718 if (decoder->cipher_suite->mode == MODE_GCM ||
5719 decoder->cipher_suite->mode == MODE_CCM ||
5720 decoder->cipher_suite->mode == MODE_CCM_8 ||
5721 decoder->cipher_suite->mode == MODE_POLY1305 ||
5722 ssl->session.version == TLSV1DOT3_VERSION0x304 ||
5723 ssl->session.version == DTLSV1DOT3_VERSION0xfefc) {
5724
5725 if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) {
5726 /* decryption failed */
5727 return -1;
5728 }
5729
5730 goto skip_mac;
5731 }
5732
5733 /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types:
5734 * (notation: { unencrypted, [ encrypted ] })
5735 * GenericStreamCipher: { [content, mac] }
5736 * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] }
5737 * RFC 5426 (TLS 1.2): TLSCipherText has additionally:
5738 * GenericAEADCipher: { nonce_explicit, [content] }
5739 * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported.
5740 * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too.
5741 */
5742
5743 maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len;
5744
5745 /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */
5746 if (decoder->cipher_suite->mode == MODE_CBC) {
5747 unsigned blocksize = 0;
5748
5749 switch (ssl->session.version) {
5750 case TLSV1DOT1_VERSION0x302:
5751 case TLSV1DOT2_VERSION0x303:
5752 case DTLSV1DOT0_VERSION0xfeff:
5753 case DTLSV1DOT2_VERSION0xfefd:
5754 case DTLSV1DOT3_VERSION0xfefc:
5755 case DTLSV1DOT0_OPENSSL_VERSION0x100:
5756 case TLCPV1_VERSION0x101:
5757 blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite);
5758 if (inl < blocksize) {
5759 ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n",
5760 inl, blocksize);
5761 return -1;
5762 }
5763 pad = gcry_cipher_setiv(decoder->evp, in, blocksize);
5764 if (pad != 0) {
5765 ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n",
5766 gcry_strsource (pad), gcry_strerror (pad));
5767 }
5768
5769 inl -= blocksize;
5770 in += blocksize;
5771 break;
5772 }
5773
5774 /* Encrypt-then-MAC for (D)TLS (RFC 7366) */
5775 if (ssl->state & SSL_ENCRYPT_THEN_MAC(1<<11)) {
5776 /*
5777 * MAC is calculated over (IV + ) ENCRYPTED contents:
5778 *
5779 * MAC(MAC_write_key, ... +
5780 * IV + // for TLS 1.1 or greater
5781 * TLSCiphertext.enc_content);
5782 */
5783 if (inl < maclen) {
5784 ssl_debug_printf("%s failed: input %d has no space for MAC %d\n",
5785 G_STRFUNC((const char*) (__func__)), inl, maclen);
5786 return -1;
5787 }
5788 inl -= maclen;
5789 mac = (uint8_t *)in + inl;
5790 mac_frag = (uint8_t *)in - blocksize;
5791 mac_fraglen = blocksize + inl;
5792 }
5793 }
5794
5795 /* First decrypt*/
5796 if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) {
5797 ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad),
5798 gcry_strerror (pad));
5799 return -1;
5800 }
5801
5802 ssl_print_data("Plaintext", out_str->data, inl);
5803 worklen=inl;
5804
5805
5806 /* strip padding for GenericBlockCipher */
5807 if (decoder->cipher_suite->mode == MODE_CBC) {
5808 if (inl < 1) { /* Should this check happen earlier? */
5809 ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl);
5810 return -1;
5811 }
5812 pad=out_str->data[inl-1];
5813 if (worklen <= pad) {
5814 ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n",
5815 pad, worklen);
5816 return -1;
5817 }
5818 worklen-=(pad+1);
5819 ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
5820 pad, worklen);
5821 }
5822
5823 /* MAC for GenericStreamCipher and GenericBlockCipher.
5824 * (normal case without Encrypt-then-MAC (RFC 7366) extension. */
5825 if (!mac) {
5826 /*
5827 * MAC is calculated over the DECRYPTED contents:
5828 *
5829 * MAC(MAC_write_key, ... + TLSCompressed.fragment);
5830 */
5831 if (worklen < maclen) {
5832 ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC((const char*) (__func__)), *outl, worklen);
5833 return -1;
5834 }
5835 worklen -= maclen;
5836 mac = out_str->data + worklen;
5837 mac_frag = out_str->data;
5838 mac_fraglen = worklen;
5839 }
5840
5841 /* If NULL encryption active and no keys are available, do not bother
5842 * checking the MAC. We do not have keys for that. */
5843 if (decoder->cipher_suite->mode == MODE_STREAM &&
5844 decoder->cipher_suite->enc == ENC_NULL0x3D &&
5845 !(ssl->state & SSL_MASTER_SECRET(1<<5))) {
5846 ssl_debug_printf("MAC check skipped due to missing keys\n");
5847 decoder->seq++; // Increment this for display
5848 goto skip_mac;
5849 }
5850
5851 /* Now check the MAC */
5852 ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64"l" "u" ")\n",
5853 worklen, ssl->session.version, ct, decoder->seq);
5854 if(ssl->session.version==SSLV3_VERSION0x300){
5855 if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) {
5856 if(ignore_mac_failed) {
5857 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5858 }
5859 else{
5860 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5861 return -1;
5862 }
5863 }
5864 else{
5865 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5866 }
5867 }
5868 else if(ssl->session.version==TLSV1_VERSION0x301 || ssl->session.version==TLSV1DOT1_VERSION0x302 || ssl->session.version==TLSV1DOT2_VERSION0x303 || ssl->session.version==TLCPV1_VERSION0x101){
5869 if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) {
5870 if(ignore_mac_failed) {
5871 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5872 }
5873 else{
5874 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5875 return -1;
5876 }
5877 }
5878 else{
5879 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5880 }
5881 }
5882 else if(ssl->session.version==DTLSV1DOT0_VERSION0xfeff ||
5883 ssl->session.version==DTLSV1DOT2_VERSION0xfefd ||
5884 ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION0x100){
5885 /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */
5886 if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) {
5887 ssl_debug_printf("ssl_decrypt_record: mac ok\n");
5888 }
5889 else if(tls_check_mac(decoder,ct,TLSV1_VERSION0x301,mac_frag,mac_fraglen,mac)>= 0) {
5890 ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n");
5891 }
5892 else if(ignore_mac_failed) {
5893 ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n");
5894 }
5895 else{
5896 ssl_debug_printf("ssl_decrypt_record: mac failed\n");
5897 return -1;
5898 }
5899 }
5900skip_mac:
5901
5902 *outl = worklen;
5903
5904 if (decoder->compression > 0) {
5905 ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression);
5906 ssl_data_copy(comp_str, out_str);
5907 ssl_print_data("Plaintext compressed", comp_str->data, worklen);
5908 if (!decoder->decomp) {
5909 ssl_debug_printf("decrypt_ssl3_record: no decoder available\n");
5910 return -1;
5911 }
5912 if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1;
5913 ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen);
5914 *outl = uncomplen;
5915 }
5916
5917 return 0;
5918}
5919/* Record decryption glue based on security parameters }}} */
5920
5921
5922
5923#ifdef HAVE_LIBGNUTLS1
5924
5925/* RSA private key file processing {{{ */
5926static void
5927ssl_find_private_key_by_pubkey(SslDecryptSession *ssl,
5928 gnutls_datum_t *subjectPublicKeyInfo)
5929{
5930 gnutls_pubkey_t pubkey = NULL((void*)0);
5931 cert_key_id_t key_id;
5932 size_t key_id_len = sizeof(key_id);
5933 int r;
5934
5935 if (!subjectPublicKeyInfo->size) {
5936 ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC((const char*) (__func__)));
5937 return;
5938 }
5939
5940 r = gnutls_pubkey_init(&pubkey);
5941 if (r < 0) {
5942 ssl_debug_printf("%s: failed to init pubkey: %s\n",
5943 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5944 return;
5945 }
5946
5947 r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER);
5948 if (r < 0) {
5949 ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n",
5950 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5951 goto end;
5952 }
5953
5954 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL((void*)0)) != GNUTLS_PK_RSA) {
5955 ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC((const char*) (__func__)));
5956 goto end;
5957 }
5958
5959 /* Generate a 20-byte SHA-1 hash. */
5960 r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len);
5961 if (r < 0) {
5962 ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n",
5963 G_STRFUNC((const char*) (__func__)), gnutls_strerror(r));
5964 goto end;
5965 }
5966
5967 if (key_id_len != sizeof(key_id)) {
5968 ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n",
5969 G_STRFUNC((const char*) (__func__)), sizeof(key_id), key_id_len);
5970 goto end;
5971 }
5972
5973 ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len);
5974 ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t)((cert_key_id_t*)wmem_alloc((wmem_file_scope()), sizeof(cert_key_id_t
)))
;
5975 *ssl->cert_key_id = key_id;
5976
5977end:
5978 gnutls_pubkey_deinit(pubkey);
5979}
5980
5981/* RSA private key file processing }}} */
5982#endif /* HAVE_LIBGNUTLS */
5983
5984/*--- Start of dissector-related code below ---*/
5985
5986/* This is not a "protocol" but ensures that this gets called during
5987 * the handoff stage. */
5988void proto_reg_handoff_tls_utils(void);
5989
5990static dissector_handle_t base_tls_handle;
5991static dissector_handle_t dtls_handle;
5992
5993void
5994proto_reg_handoff_tls_utils(void)
5995{
5996 base_tls_handle = find_dissector("tls");
5997 dtls_handle = find_dissector("dtls");
5998}
5999
6000/* get ssl data for this session. if no ssl data is found allocate a new one*/
6001SslDecryptSession *
6002ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle)
6003{
6004 void *conv_data;
6005 SslDecryptSession *ssl_session;
6006 int proto_ssl;
6007
6008 /* Note proto_ssl is tls for either the main tls_handle or the
6009 * tls13_handshake handle used by QUIC. */
6010 proto_ssl = dissector_handle_get_protocol_index(tls_handle);
6011 conv_data = conversation_get_proto_data(conversation, proto_ssl);
6012 if (conv_data != NULL((void*)0))
6013 return (SslDecryptSession *)conv_data;
6014
6015 /* no previous SSL conversation info, initialize it. */
6016 ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession)((SslDecryptSession*)wmem_alloc0((wmem_file_scope()), sizeof(
SslDecryptSession)))
;
6017
6018 /* data_len is the part that is meaningful, not the allocated length */
6019 ssl_session->master_secret.data_len = 0;
6020 ssl_session->master_secret.data = ssl_session->_master_secret;
6021 ssl_session->session_id.data_len = 0;
6022 ssl_session->session_id.data = ssl_session->_session_id;
6023 ssl_session->client_random.data_len = 0;
6024 ssl_session->client_random.data = ssl_session->_client_random;
6025 ssl_session->server_random.data_len = 0;
6026 ssl_session->server_random.data = ssl_session->_server_random;
6027 ssl_session->session_ticket.data_len = 0;
6028 ssl_session->session_ticket.data = NULL((void*)0); /* will be re-alloced as needed */
6029 ssl_session->server_data_for_iv.data_len = 0;
6030 ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv;
6031 ssl_session->client_data_for_iv.data_len = 0;
6032 ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv;
6033 ssl_session->app_data_segment.data = NULL((void*)0);
6034 ssl_session->app_data_segment.data_len = 0;
6035 ssl_session->handshake_data.data=NULL((void*)0);
6036 ssl_session->handshake_data.data_len=0;
6037 ssl_session->ech_transcript.data=NULL((void*)0);
6038 ssl_session->ech_transcript.data_len=0;
6039
6040 /* Initialize parameters which are not necessary specific to decryption. */
6041 ssl_session->session.version = SSL_VER_UNKNOWN0;
6042 clear_address(&ssl_session->session.srv_addr);
6043 ssl_session->session.srv_ptype = PT_NONE;
6044 ssl_session->session.srv_port = 0;
6045 ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0;
6046 ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0;
6047 ssl_session->session.client_random.data_len = 0;
6048 ssl_session->session.client_random.data = ssl_session->session._client_random;
6049 memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation));
6050 memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation));
6051 memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag));
6052 ssl_session->session.ech = false0;
6053 ssl_session->session.hrr_ech_declined = false0;
6054 ssl_session->session.first_ch_ech_frame = 0;
6055
6056 /* We want to increment the stream count for the normal tls handle and
6057 * dtls handle, but presumably not for the tls13_handshake handle used
6058 * by QUIC (it has its own Follow Stream handling, and the QUIC stream
6059 * doesn't get sent to the TLS follow tap.)
6060 */
6061 if (tls_handle == base_tls_handle) {
6062 ssl_session->session.stream = tls_increment_stream_count();
6063 } else if (tls_handle == dtls_handle) {
6064 ssl_session->session.stream = dtls_increment_stream_count();
6065 }
6066
6067 conversation_add_proto_data(conversation, proto_ssl, ssl_session);
6068 return ssl_session;
6069}
6070
6071void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool_Bool is_client)
6072{
6073 if (ssl) {
6074 /* Ensure that secrets are not restored using stale identifiers. Split
6075 * between client and server in case the packets somehow got out of order. */
6076 int clear_flags = SSL_HAVE_SESSION_KEY(1<<3) | SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6);
6077
6078 if (is_client) {
6079 clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
6080 ssl->session_id.data_len = 0;
6081 ssl->session_ticket.data_len = 0;
6082 ssl->master_secret.data_len = 0;
6083 ssl->client_random.data_len = 0;
6084 ssl->has_early_data = false0;
6085 if (ssl->handshake_data.data_len > 0) {
6086 // The EMS handshake hash starts with at the Client Hello,
6087 // ensure that any messages before it are forgotten.
6088 wmem_free(wmem_file_scope(), ssl->handshake_data.data);
6089 ssl->handshake_data.data = NULL((void*)0);
6090 ssl->handshake_data.data_len = 0;
6091 }
6092 } else {
6093 clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8) | SSL_NEW_SESSION_TICKET(1<<10);
6094 ssl->server_random.data_len = 0;
6095 ssl->pre_master_secret.data_len = 0;
6096#ifdef HAVE_LIBGNUTLS1
6097 ssl->cert_key_id = NULL((void*)0);
6098#endif
6099 ssl->psk.data_len = 0;
6100 }
6101
6102 if (ssl->state & clear_flags) {
6103 ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n",
6104 G_STRFUNC((const char*) (__func__)), ssl->state & clear_flags, is_client ? "client" : "server");
6105 ssl->state &= ~clear_flags;
6106 }
6107 }
6108
6109 /* These flags might be used for non-decryption purposes and may affect the
6110 * dissection, so reset them as well. */
6111 if (is_client) {
6112 session->client_cert_type = 0;
6113 } else {
6114 session->compression = 0;
6115 session->server_cert_type = 0;
6116 /* session->is_session_resumed is already handled in the ServerHello dissection. */
6117 }
6118 session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0;
6119 session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0;
6120}
6121
6122void
6123tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
6124 dissector_handle_t app_handle)
6125{
6126 conversation_t *conversation;
6127 SslSession *session;
6128
6129 /* Ignore if the TLS or other dissector is disabled. */
6130 if (!tls_handle || !app_handle)
6131 return;
6132
6133 conversation = find_or_create_conversation(pinfo);
6134 session = &ssl_get_session(conversation, tls_handle)->session;
6135 session->app_handle = app_handle;
6136}
6137
6138static uint32_t
6139ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo,
6140 dissector_handle_t app_handle, uint32_t last_nontls_frame)
6141{
6142 conversation_t *conversation;
6143 SslSession *session;
6144
6145 /* Ignore if the TLS dissector is disabled. */
6146 if (!tls_handle)
6147 return 0;
6148 /* The caller should always pass a valid handle to its own dissector. */
6149 DISSECTOR_ASSERT(app_handle)((void) ((app_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6149, "app_handle"))))
;
6150
6151 conversation = find_or_create_conversation(pinfo);
6152 session = &ssl_get_session(conversation, tls_handle)->session;
6153
6154 ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6155 session->last_nontls_frame,
6156 (void *)session->app_handle,
6157 dissector_handle_get_dissector_name(session->app_handle));
6158 ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC((const char*) (__func__)),
6159 pinfo->num, (void *)app_handle,
6160 dissector_handle_get_dissector_name(app_handle));
6161
6162 /* Do not switch again if a dissector did it before. */
6163 if (session->last_nontls_frame) {
6164 ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC((const char*) (__func__)));
6165 return session->last_nontls_frame;
6166 }
6167
6168 session->app_handle = app_handle;
6169 /* The TLS dissector should be called first for this conversation. */
6170 conversation_set_dissector(conversation, tls_handle);
6171 /* TLS starts after this frame. */
6172 session->last_nontls_frame = last_nontls_frame;
6173 return 0;
6174}
6175
6176/* ssl_starttls_ack: mark future frames as encrypted. */
6177uint32_t
6178ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6179 dissector_handle_t app_handle)
6180{
6181 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num);
6182}
6183
6184uint32_t
6185ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
6186 dissector_handle_t app_handle)
6187{
6188 return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1);
6189}
6190
6191dissector_handle_t
6192ssl_find_appdata_dissector(const char *name)
6193{
6194 /* Accept 'http' for backwards compatibility and sanity. */
6195 if (!strcmp(name, "http"))
6196 name = "http-over-tls";
6197 /* XXX - Should this check to see if the dissector is actually added for
6198 * Decode As in the appropriate table?
6199 */
6200 return find_dissector(name);
6201}
6202
6203/* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */
6204static int
6205ssl_equal (const void *v, const void *v2)
6206{
6207 const StringInfo *val1;
6208 const StringInfo *val2;
6209 val1 = (const StringInfo *)v;
6210 val2 = (const StringInfo *)v2;
6211
6212 if (val1->data_len == val2->data_len &&
6213 !memcmp(val1->data, val2->data, val2->data_len)) {
6214 return 1;
6215 }
6216 return 0;
6217}
6218
6219static unsigned
6220ssl_hash (const void *v)
6221{
6222 unsigned l,hash;
6223 const StringInfo* id;
6224 const unsigned* cur;
6225 hash = 0;
6226 id = (const StringInfo*) v;
6227
6228 /* id and id->data are mallocated in ssl_save_master_key(). As such 'data'
6229 * should be aligned for any kind of access (for example as a unsigned as
6230 * is done below). The intermediate void* cast is to prevent "cast
6231 * increases required alignment of target type" warnings on CPUs (such
6232 * as SPARCs) that do not allow misaligned memory accesses.
6233 */
6234 cur = (const unsigned*)(void*) id->data;
6235
6236 for (l=4; (l < id->data_len); l+=4, cur++)
6237 hash = hash ^ (*cur);
6238
6239 return hash;
6240}
6241/* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */
6242
6243/* Handling of association between tls/dtls ports and clear text protocol. {{{ */
6244void
6245ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6246{
6247 DISSECTOR_ASSERT(main_handle)((void) ((main_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6247, "main_handle"))))
;
6248 DISSECTOR_ASSERT(subdissector_handle)((void) ((subdissector_handle) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6248, "subdissector_handle"))))
;
6249 /* Registration is required for Export PDU feature to work properly. */
6250 DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle),((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6251, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
6251 "SSL appdata dissectors must register with register_dissector()!")((void) ((dissector_handle_get_dissector_name(subdissector_handle
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/dissectors/packet-tls-utils.c", 6251, "dissector_handle_get_dissector_name(subdissector_handle)"
, "SSL appdata dissectors must register with register_dissector()!"
))))
;
6252 ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle);
6253
6254 if (port) {
6255 dissector_add_uint(dissector_table_name, port, subdissector_handle);
6256 if (tcp)
6257 dissector_add_uint("tcp.port", port, main_handle);
6258 else
6259 dissector_add_uint("udp.port", port, main_handle);
6260 dissector_add_uint("sctp.port", port, main_handle);
6261 } else {
6262 dissector_add_for_decode_as(dissector_table_name, subdissector_handle);
6263 }
6264}
6265
6266void
6267ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool_Bool tcp)
6268{
6269 ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n",
6270 tcp?"TCP":"UDP", port, (void *)subdissector_handle);
6271 if (main_handle) {
6272 dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle);
6273 dissector_delete_uint("sctp.port", port, main_handle);
6274 }
6275
6276 if (port) {
6277 dissector_delete_uint(dissector_table_name, port, subdissector_handle);
6278 }
6279}
6280
6281void
6282ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port)
6283{
6284 copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr);
6285 session->srv_ptype = ptype;
6286 session->srv_port = port;
6287}
6288
6289int
6290ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo)
6291{
6292 int ret;
6293 if (session && session->srv_addr.type != AT_NONE) {
6294 ret = (session->srv_ptype == pinfo->ptype) &&
6295 (session->srv_port == pinfo->srcport) &&
6296 addresses_equal(&session->srv_addr, &pinfo->src);
6297 } else {
6298 ret = (dissector_get_uint_handle(table, pinfo->srcport) != 0);
6299 }
6300
6301 ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE");
6302 return ret;
6303}
6304/* Handling of association between tls/dtls ports and clear text protocol. }}} */
6305
6306
6307/* Links SSL records with the real packet data. {{{ */
6308SslPacketInfo *
6309tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl)
6310{
6311 SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6312 if (!pi) {
6313 pi = wmem_new0(wmem_file_scope(), SslPacketInfo)((SslPacketInfo*)wmem_alloc0((wmem_file_scope()), sizeof(SslPacketInfo
)))
;
6314 pi->srcport = pinfo->srcport;
6315 pi->destport = pinfo->destport;
6316 p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi);
6317 }
6318
6319 return pi;
6320}
6321
6322/**
6323 * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to
6324 * avoid the need for a decoder in the second pass. Additionally, it remembers
6325 * sequence numbers (for reassembly and Follow TLS Stream).
6326 *
6327 * @param proto The protocol identifier (proto_ssl or proto_dtls).
6328 * @param pinfo The packet where the record originates from.
6329 * @param data Decrypted data to store in the record.
6330 * @param data_len Length of decrypted record data.
6331 * @param record_id The identifier for this record within the current packet.
6332 * @param flow Information about sequence numbers, etc.
6333 * @param type TLS Content Type (such as handshake or application_data).
6334 * @param curr_layer_num_ssl The layer identifier for this TLS session.
6335 */
6336void
6337ssl_add_record_info(int proto, packet_info *pinfo, const unsigned char *data, int data_len, int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl, uint64_t record_seq)
6338{
6339 SslRecordInfo* rec, **prec;
6340 SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl);
6341
6342 rec = wmem_new(wmem_file_scope(), SslRecordInfo)((SslRecordInfo*)wmem_alloc((wmem_file_scope()), sizeof(SslRecordInfo
)))
;
6343 rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), data, data_len);
6344 rec->data_len = data_len;
6345 rec->id = record_id;
6346 rec->type = type;
6347 rec->next = NULL((void*)0);
6348 rec->record_seq = record_seq;
6349
6350 if (flow && type == SSL_ID_APP_DATA) {
6351 rec->seq = flow->byte_seq;
6352 rec->flow = flow;
6353 flow->byte_seq += data_len;
6354 ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n",
6355 G_STRFUNC((const char*) (__func__)), rec->seq, rec->seq + data_len, (void*)flow);
6356 }
6357
6358 /* Remember decrypted records. */
6359 prec = &pi->records;
6360 while (*prec) prec = &(*prec)->next;
6361 *prec = rec;
6362}
6363
6364/* search in packet data for the specified id; return a newly created tvb for the associated data */
6365tvbuff_t*
6366ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record)
6367{
6368 SslRecordInfo* rec;
6369 SslPacketInfo* pi;
6370 pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl);
6371
6372 if (!pi)
6373 return NULL((void*)0);
6374
6375 for (rec = pi->records; rec; rec = rec->next)
6376 if (rec->id == record_id) {
6377 *matched_record = rec;
6378 /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */
6379 return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->data_len, rec->data_len);
6380 }
6381
6382 return NULL((void*)0);
6383}
6384/* Links SSL records with the real packet data. }}} */
6385
6386/* initialize/reset per capture state data (ssl sessions cache). {{{ */
6387void
6388ssl_common_init(ssl_master_key_map_t *mk_map,
6389 StringInfo *decrypted_data, StringInfo *compressed_data)
6390{
6391 mk_map->session = g_hash_table_new(ssl_hash, ssl_equal);
6392 mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal);
6393 mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal);
6394 mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal);
6395 mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal);
6396 mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal);
6397 mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6398 mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal);
6399 mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6400 mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal);
6401 mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6402 mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal);
6403
6404 mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal);
6405 mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal);
6406
6407 mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal);
6408
6409 ssl_data_alloc(decrypted_data, 32);
6410 ssl_data_alloc(compressed_data, 32);
6411}
6412
6413void
6414ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file,
6415 StringInfo *decrypted_data, StringInfo *compressed_data)
6416{
6417 g_hash_table_destroy(mk_map->session);
6418 g_hash_table_destroy(mk_map->tickets);
6419 g_hash_table_destroy(mk_map->crandom);
6420 g_hash_table_destroy(mk_map->pre_master);
6421 g_hash_table_destroy(mk_map->pms);
6422 g_hash_table_destroy(mk_map->tls13_client_early);
6423 g_hash_table_destroy(mk_map->tls13_client_handshake);
6424 g_hash_table_destroy(mk_map->tls13_server_handshake);
6425 g_hash_table_destroy(mk_map->tls13_client_appdata);
6426 g_hash_table_destroy(mk_map->tls13_server_appdata);
6427 g_hash_table_destroy(mk_map->tls13_early_exporter);
6428 g_hash_table_destroy(mk_map->tls13_exporter);
6429
6430 g_hash_table_destroy(mk_map->ech_secret);
6431 g_hash_table_destroy(mk_map->ech_config);
6432
6433 g_hash_table_destroy(mk_map->used_crandom);
6434
6435 g_free(decrypted_data->data);
6436 g_free(compressed_data->data);
6437
6438 /* close the previous keylog file now that the cache are cleared, this
6439 * allows the cache to be filled with the full keylog file contents. */
6440 if (*ssl_keylog_file) {
6441 fclose(*ssl_keylog_file);
6442 *ssl_keylog_file = NULL((void*)0);
6443 }
6444}
6445/* }}} */
6446
6447/* parse ssl related preferences (private keys and ports association strings) */
6448#if defined(HAVE_LIBGNUTLS1)
6449/* Load a single RSA key file item from preferences. {{{ */
6450void
6451ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool_Bool tcp)
6452{
6453 gnutls_x509_privkey_t x509_priv_key;
6454 gnutls_privkey_t priv_key = NULL((void*)0);
6455 FILE* fp = NULL((void*)0);
6456 int ret;
6457 size_t key_id_len = 20;
6458 unsigned char *key_id = NULL((void*)0);
6459 char *err = NULL((void*)0);
6460 dissector_handle_t handle;
6461 /* try to load keys file first */
6462 fp = ws_fopenfopen(uats->keyfile, "rb");
6463 if (!fp) {
6464 report_open_failure(uats->keyfile, errno(*__errno_location ()), false0);
6465 return;
6466 }
6467
6468 if ((int)strlen(uats->password) == 0) {
6469 x509_priv_key = rsa_load_pem_key(fp, &err);
6470 } else {
6471 x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err);
6472 }
6473 fclose(fp);
6474
6475 if (!x509_priv_key) {
6476 if (err) {
6477 report_failure("Can't load private key from %s: %s",
6478 uats->keyfile, err);
6479 g_free(err);
6480 } else
6481 report_failure("Can't load private key from %s: unknown error",
6482 uats->keyfile);
6483 return;
6484 }
6485 if (err) {
6486 report_failure("Load of private key from %s \"succeeded\" with error %s",
6487 uats->keyfile, err);
6488 g_free(err);
6489 }
6490
6491 gnutls_privkey_init(&priv_key);
6492 ret = gnutls_privkey_import_x509(priv_key, x509_priv_key,
6493 GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY);
6494 if (ret < 0) {
6495 report_failure("Can't convert private key %s: %s",
6496 uats->keyfile, gnutls_strerror(ret));
6497 goto end;
6498 }
6499
6500 key_id = (unsigned char *) g_malloc0(key_id_len);
6501 ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len);
6502 if (ret < 0) {
6503 report_failure("Can't calculate public key ID for %s: %s",
6504 uats->keyfile, gnutls_strerror(ret));
6505 goto end;
6506 }
6507 ssl_print_data("KeyID", key_id, key_id_len);
6508 if (key_id_len != 20) {
6509 report_failure("Expected Key ID size %u for %s, got %zu", 20,
6510 uats->keyfile, key_id_len);
6511 goto end;
6512 }
6513
6514 g_hash_table_replace(key_hash, key_id, priv_key);
6515 key_id = NULL((void*)0); /* used in key_hash, do not free. */
6516 priv_key = NULL((void*)0);
6517 ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
6518
6519 handle = ssl_find_appdata_dissector(uats->protocol);
6520 if (handle) {
6521 /* Port to subprotocol mapping */
6522 uint16_t port = 0;
6523 if (ws_strtou16(uats->port, NULL((void*)0), &port)) {
6524 if (port > 0) {
6525 ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n",
6526 port, uats->keyfile, uats->password);
6527
6528 ssl_association_add(dissector_table_name, main_handle, handle, port, tcp);
6529 }
6530 } else {
6531 if (strcmp(uats->port, "start_tls"))
6532 ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port);
6533 }
6534 }
6535
6536end:
6537 gnutls_x509_privkey_deinit(x509_priv_key);
6538 gnutls_privkey_deinit(priv_key);
6539 g_free(key_id);
6540}
6541/* }}} */
6542#endif
6543
6544
6545/* Store/load a known (pre-)master secret from/for this SSL session. {{{ */
6546/** store a known (pre-)master secret into cache */
6547static void
6548ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key,
6549 StringInfo *mk)
6550{
6551 StringInfo *ht_key, *master_secret;
6552
6553 if (key->data_len == 0) {
6554 ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC((const char*) (__func__)), label);
6555 return;
6556 }
6557
6558 if (mk->data_len == 0) {
6559 ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n",
6560 G_STRFUNC((const char*) (__func__)), label);
6561 return;
6562 }
6563
6564 /* ssl_hash() depends on session_ticket->data being aligned for unsigned access
6565 * so be careful in changing how it is allocated. */
6566 ht_key = ssl_data_clone(key);
6567 master_secret = ssl_data_clone(mk);
6568 g_hash_table_insert(ht, ht_key, master_secret);
6569
6570 ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC((const char*) (__func__)), label);
6571 ssl_print_string("stored key", ht_key);
6572 ssl_print_string("stored (pre-)master secret", master_secret);
6573}
6574
6575/** restore a (pre-)master secret given some key in the cache */
6576static bool_Bool
6577ssl_restore_master_key(SslDecryptSession *ssl, const char *label,
6578 bool_Bool is_pre_master, GHashTable *ht, StringInfo *key)
6579{
6580 StringInfo *ms;
6581
6582 if (key->data_len == 0) {
6583 ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n",
6584 G_STRFUNC((const char*) (__func__)), is_pre_master ? "pre-" : "", label);
6585 return false0;
6586 }
6587
6588 ms = (StringInfo *)g_hash_table_lookup(ht, key);
6589 if (!ms) {
6590 ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC((const char*) (__func__)),
6591 is_pre_master ? "pre-" : "", label);
6592 return false0;
6593 }
6594
6595 /* (pre)master secret found, clear knowledge of other keys and set it in the
6596 * current conversation */
6597 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) |
6598 SSL_HAVE_SESSION_KEY(1<<3));
6599 if (is_pre_master) {
6600 /* unlike master secret, pre-master secret has a variable size (48 for
6601 * RSA, varying for PSK) and is therefore not statically allocated */
6602 ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(),
6603 ms->data_len);
6604 ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len);
6605 ssl->state |= SSL_PRE_MASTER_SECRET(1<<6);
6606 } else {
6607 ssl_data_set(&ssl->master_secret, ms->data, ms->data_len);
6608 ssl->state |= SSL_MASTER_SECRET(1<<5);
6609 }
6610 ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC((const char*) (__func__)),
6611 is_pre_master ? "pre-" : "", label);
6612 ssl_print_string(label, key);
6613 ssl_print_string("(pre-)master secret", ms);
6614 return true1;
6615}
6616/* Store/load a known (pre-)master secret from/for this SSL session. }}} */
6617
6618/* Should be called when all parameters are ready (after ChangeCipherSpec), and
6619 * the decoder should be attempted to be initialized. {{{*/
6620void
6621ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6622{
6623 if (ssl->session.version == TLSV1DOT3_VERSION0x304) {
6624 /* TLS 1.3 implementations only provide secrets derived from the master
6625 * secret which are loaded in tls13_change_key. No master secrets can be
6626 * loaded here, so just return. */
6627 return;
6628 }
6629 ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6630 if (ssl->state & SSL_HAVE_SESSION_KEY(1<<3)) {
6631 ssl_debug_printf(" session key already available, nothing to do.\n");
6632 return;
6633 }
6634 if (!(ssl->state & SSL_CIPHER(1<<2))) {
6635 ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n");
6636 return;
6637 }
6638
6639 /* for decryption, there needs to be a master secret (which can be derived
6640 * from pre-master secret). If missing, try to pick a master key from cache
6641 * (an earlier packet in the capture or key logfile). */
6642 if (!(ssl->state & (SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6))) &&
6643 !ssl_restore_master_key(ssl, "Session ID", false0,
6644 mk_map->session, &ssl->session_id) &&
6645 (!ssl->session.is_session_resumed ||
6646 !ssl_restore_master_key(ssl, "Session Ticket", false0,
6647 mk_map->tickets, &ssl->session_ticket)) &&
6648 !ssl_restore_master_key(ssl, "Client Random", false0,
6649 mk_map->crandom, &ssl->client_random)) {
6650 if (ssl->cipher_suite->enc != ENC_NULL0x3D) {
6651 /* how unfortunate, the master secret could not be found */
6652 ssl_debug_printf(" Cannot find master secret\n");
6653 return;
6654 } else {
6655 ssl_debug_printf(" Cannot find master secret, continuing anyway "
6656 "because of a NULL cipher\n");
6657 }
6658 }
6659
6660 if (ssl_generate_keyring_material(ssl) < 0) {
6661 ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC((const char*) (__func__)));
6662 return;
6663 }
6664 /* Save Client Random/ Session ID for "SSL Export Session keys" */
6665 ssl_save_master_key("Client Random", mk_map->crandom,
6666 &ssl->client_random, &ssl->master_secret);
6667 ssl_save_master_key("Session ID", mk_map->session,
6668 &ssl->session_id, &ssl->master_secret);
6669 /* Only save the new secrets if the server sent the ticket. The client
6670 * ticket might have become stale. */
6671 if (ssl->state & SSL_NEW_SESSION_TICKET(1<<10)) {
6672 ssl_save_master_key("Session Ticket", mk_map->tickets,
6673 &ssl->session_ticket, &ssl->master_secret);
6674 }
6675} /* }}} */
6676
6677/* Load the traffic key secret from the keylog file. */
6678StringInfo *
6679tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6680 bool_Bool is_from_server, TLSRecordType type)
6681{
6682 GHashTable *key_map;
6683 const char *label;
6684
6685 if (ssl->session.version != TLSV1DOT3_VERSION0x304 && ssl->session.version != DTLSV1DOT3_VERSION0xfefc) {
6686 ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC((const char*) (__func__)), ssl->session.version);
6687 return NULL((void*)0);
6688 }
6689
6690 if (ssl->client_random.data_len == 0) {
6691 /* May happen if Hello message is missing and Finished is found. */
6692 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
6693 return NULL((void*)0);
6694 }
6695
6696 switch (type) {
6697 case TLS_SECRET_0RTT_APP:
6698 DISSECTOR_ASSERT(!is_from_server)((void) ((!is_from_server) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/dissectors/packet-tls-utils.c"
, 6698, "!is_from_server"))))
;
6699 label = "CLIENT_EARLY_TRAFFIC_SECRET";
6700 key_map = mk_map->tls13_client_early;
6701 break;
6702 case TLS_SECRET_HANDSHAKE:
6703 if (is_from_server) {
6704 label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
6705 key_map = mk_map->tls13_server_handshake;
6706 } else {
6707 label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
6708 key_map = mk_map->tls13_client_handshake;
6709 }
6710 break;
6711 case TLS_SECRET_APP:
6712 if (is_from_server) {
6713 label = "SERVER_TRAFFIC_SECRET_0";
6714 key_map = mk_map->tls13_server_appdata;
6715 } else {
6716 label = "CLIENT_TRAFFIC_SECRET_0";
6717 key_map = mk_map->tls13_client_appdata;
6718 }
6719 break;
6720 default:
6721 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/dissectors/packet-tls-utils.c"
, 6721, __func__, "assertion \"not reached\" failed")
;
6722 }
6723
6724 /* Transitioning to new keys, mark old ones as unusable. */
6725 ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC((const char*) (__func__)), ssl->state);
6726 ssl->state &= ~(SSL_MASTER_SECRET(1<<5) | SSL_PRE_MASTER_SECRET(1<<6) | SSL_HAVE_SESSION_KEY(1<<3));
6727
6728 StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random);
6729 if (!secret) {
6730 ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC((const char*) (__func__)), label);
6731 /* Disable decryption, the keys are invalid. */
6732 if (is_from_server) {
6733 ssl->server = NULL((void*)0);
6734 } else {
6735 ssl->client = NULL((void*)0);
6736 }
6737 return NULL((void*)0);
6738 }
6739
6740 /* TLS 1.3 secret found, set new keys. */
6741 ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC((const char*) (__func__)));
6742 ssl_print_string("Client Random", &ssl->client_random);
6743 ssl_print_string(label, secret);
6744 return secret;
6745}
6746
6747/* Load the new key. */
6748void
6749tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
6750 bool_Bool is_from_server, TLSRecordType type)
6751{
6752 if (ssl->state & SSL_QUIC_RECORD_LAYER(1<<13)) {
6753 /*
6754 * QUIC does not use the TLS record layer for message protection.
6755 * The required keys will be extracted later by QUIC.
6756 */
6757 return;
6758 }
6759
6760 StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6761 if (!secret) {
6762 if (type != TLS_SECRET_HANDSHAKE) {
6763 return;
6764 }
6765 /*
6766 * Workaround for when for some reason we don't have the handshake
6767 * secret but do have the application traffic secret. (#20240)
6768 * If we can't find the handshake secret, we'll never decrypt the
6769 * Finished message, so we won't know when to change to the app
6770 * traffic key, so we do so now.
6771 */
6772 type = TLS_SECRET_APP;
6773 secret = tls13_load_secret(ssl, mk_map, is_from_server, type);
6774 if (!secret) {
6775 return;
6776 }
6777 }
6778
6779 if (tls13_generate_keys(ssl, secret, is_from_server)) {
6780 /*
6781 * Remember the application traffic secret to support Key Update. The
6782 * other secrets cannot be used for this purpose, so free them.
6783 */
6784 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6785 StringInfo *app_secret = &decoder->app_traffic_secret;
6786 if (type == TLS_SECRET_APP) {
6787 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6788 app_secret->data,
6789 secret->data_len);
6790 ssl_data_set(app_secret, secret->data, secret->data_len);
6791 } else {
6792 wmem_free(wmem_file_scope(), app_secret->data);
6793 app_secret->data = NULL((void*)0);
6794 app_secret->data_len = 0;
6795 }
6796 }
6797}
6798
6799/**
6800 * Update to next application data traffic secret for TLS 1.3. The previous
6801 * secret should have been set by tls13_change_key.
6802 */
6803void
6804tls13_key_update(SslDecryptSession *ssl, bool_Bool is_from_server)
6805{
6806 /* RFC 8446 Section 7.2:
6807 * application_traffic_secret_N+1 =
6808 * HKDF-Expand-Label(application_traffic_secret_N,
6809 * "traffic upd", "", Hash.length)
6810 *
6811 * Both application_traffic_secret_N are of the same length (Hash.length).
6812 */
6813 const SslCipherSuite *cipher_suite = ssl->cipher_suite;
6814 SslDecoder *decoder = is_from_server ? ssl->server : ssl->client;
6815 StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL((void*)0);
6816 uint8_t tls13_draft_version = ssl->session.tls13_draft_version;
6817
6818 if (!cipher_suite || !app_secret || app_secret->data_len == 0) {
6819 ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC((const char*) (__func__)));
6820 return;
6821 }
6822
6823 /*
6824 * Previous traffic secret is available, so find the hash function,
6825 * expand the new traffic secret and generate new keys.
6826 */
6827 const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name;
6828 int hash_algo = ssl_get_digest_by_name(hash_name);
6829 const unsigned hash_len = app_secret->data_len;
6830 unsigned char *new_secret;
6831 const char *label = "traffic upd";
6832 if (tls13_draft_version && tls13_draft_version < 20) {
6833 label = "application traffic secret";
6834 }
6835 if (!tls13_hkdf_expand_label(hash_algo, app_secret,
6836 tls13_hkdf_label_prefix(ssl),
6837 label, hash_len, &new_secret)) {
6838 ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC((const char*) (__func__)));
6839 return;
6840 }
6841 ssl_data_set(app_secret, new_secret, hash_len);
6842 if (tls13_generate_keys(ssl, app_secret, is_from_server)) {
6843 /*
6844 * Remember the application traffic secret on the new decoder to
6845 * support another Key Update.
6846 */
6847 decoder = is_from_server ? ssl->server : ssl->client;
6848 app_secret = &decoder->app_traffic_secret;
6849 app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(),
6850 app_secret->data,
6851 hash_len);
6852 ssl_data_set(app_secret, new_secret, hash_len);
6853 }
6854 wmem_free(NULL((void*)0), new_secret);
6855}
6856
6857void
6858tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map)
6859{
6860 if (ssl && (ssl->state & SSL_CLIENT_RANDOM(1<<0))) {
6861 g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random));
6862 }
6863}
6864
6865/** SSL keylog file handling. {{{ */
6866
6867static GRegex *
6868ssl_compile_keyfile_regex(void)
6869{
6870#define OCTET "(?:[[:xdigit:]]{2})"
6871 const char *pattern =
6872 "(?:"
6873 /* Matches Client Hellos having this Client Random */
6874 "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) "
6875 /* Matches first part of encrypted RSA pre-master secret */
6876 "|RSA (?<encrypted_pmk>" OCTET "{8}) "
6877 /* Pre-Master-Secret is given, it is 48 bytes for RSA,
6878 but it can be of any length for DHE */
6879 ")(?<pms>" OCTET "+)"
6880 "|(?:"
6881 /* Matches Server Hellos having a Session ID */
6882 "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:"
6883 /* Matches Client Hellos having this Client Random */
6884 "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) "
6885 /* Master-Secret is given, its length is fixed */
6886 ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH)"48" "})"
6887 "|(?"
6888 /* TLS 1.3 Client Random to Derived Secrets mapping. */
6889 ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})"
6890 "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})"
6891 "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})"
6892 "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})"
6893 "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})"
6894 "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})"
6895 "|EXPORTER_SECRET (?<exporter>" OCTET "{32})"
6896 /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */
6897 /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */
6898 "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})"
6899 "|ECH_CONFIG (?<ech_config>" OCTET "{22,})"
6900 ") (?<derived_secret>" OCTET "+)";
6901#undef OCTET
6902 static GRegex *regex = NULL((void*)0);
6903 GError *gerr = NULL((void*)0);
6904
6905 if (!regex) {
6906 regex = g_regex_new(pattern,
6907 (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW),
6908 G_REGEX_MATCH_ANCHORED, &gerr);
6909 if (gerr) {
6910 ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC((const char*) (__func__)),
6911 gerr->message);
6912 g_error_free(gerr);
6913 regex = NULL((void*)0);
6914 }
6915 }
6916
6917 return regex;
6918}
6919
6920typedef struct ssl_master_key_match_group {
6921 const char *re_group_name;
6922 GHashTable *master_key_ht;
6923} ssl_master_key_match_group_t;
6924
6925void
6926tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen)
6927{
6928 ssl_master_key_match_group_t mk_groups[] = {
6929 { "encrypted_pmk", mk_map->pre_master },
6930 { "session_id", mk_map->session },
6931 { "client_random", mk_map->crandom },
6932 { "client_random_pms", mk_map->pms },
6933 /* TLS 1.3 map from Client Random to derived secret. */
6934 { "client_early", mk_map->tls13_client_early },
6935 { "client_handshake", mk_map->tls13_client_handshake },
6936 { "server_handshake", mk_map->tls13_server_handshake },
6937 { "client_appdata", mk_map->tls13_client_appdata },
6938 { "server_appdata", mk_map->tls13_server_appdata },
6939 { "early_exporter", mk_map->tls13_early_exporter },
6940 { "exporter", mk_map->tls13_exporter },
6941 { "ech_secret", mk_map->ech_secret },
6942 { "ech_config", mk_map->ech_config },
6943 };
6944
6945 /* The format of the file is a series of records with one of the following formats:
6946 * - "RSA xxxx yyyy"
6947 * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded)
6948 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6949 * (this is the original format introduced with bug 4349)
6950 *
6951 * - "RSA Session-ID:xxxx Master-Key:yyyy"
6952 * Where xxxx is the SSL session ID (hex-encoded)
6953 * Where yyyy is the cleartext master secret (hex-encoded)
6954 * (added to support openssl s_client Master-Key output)
6955 * This is somewhat is a misnomer because there's nothing RSA specific
6956 * about this.
6957 *
6958 * - "PMS_CLIENT_RANDOM xxxx yyyy"
6959 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6960 * Where yyyy is the cleartext pre-master secret (hex-encoded)
6961 * (This format allows SSL connections to be decrypted, if a user can
6962 * capture the PMS but could not recover the MS for a specific session
6963 * with a SSL Server.)
6964 *
6965 * - "CLIENT_RANDOM xxxx yyyy"
6966 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6967 * Where yyyy is the cleartext master secret (hex-encoded)
6968 * (This format allows non-RSA SSL connections to be decrypted, i.e.
6969 * ECDHE-RSA.)
6970 *
6971 * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy"
6972 * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6973 * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy"
6974 * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy"
6975 * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy"
6976 * - "EARLY_EXPORTER_SECRET xxxx yyyy"
6977 * - "EXPORTER_SECRET xxxx yyyy"
6978 * Where xxxx is the client_random from the ClientHello (hex-encoded)
6979 * Where yyyy is the secret (hex-encoded) derived from the early,
6980 * handshake or master secrets. (This format is introduced with TLS 1.3
6981 * and supported by BoringSSL, OpenSSL, etc. See bug 12779.)
6982 */
6983 GRegex *regex = ssl_compile_keyfile_regex();
6984 if (!regex)
6985 return;
6986
6987 const char *next_line = (const char *)data;
6988 const char *line_end = next_line + datalen;
6989 while (next_line && next_line < line_end) {
6990 const char *line = next_line;
6991 next_line = (const char *)memchr(line, '\n', line_end - line);
6992 ssize_t linelen;
6993
6994 if (next_line) {
6995 linelen = next_line - line;
6996 next_line++; /* drop LF */
6997 } else {
6998 linelen = (ssize_t)(line_end - line);
6999 }
7000 if (linelen > 0 && line[linelen - 1] == '\r') {
7001 linelen--; /* drop CR */
7002 }
7003
7004 ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line);
7005 GMatchInfo *mi;
7006 if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL((void*)0))) {
7007 char *hex_key, *hex_pre_ms_or_ms;
7008 StringInfo *key = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
7009 StringInfo *pre_ms_or_ms = NULL((void*)0);
7010 GHashTable *ht = NULL((void*)0);
7011
7012 /* Is the PMS being supplied with the PMS_CLIENT_RANDOM
7013 * otherwise we will use the Master Secret
7014 */
7015 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret");
7016 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
7017 g_free(hex_pre_ms_or_ms);
7018 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms");
7019 }
7020 if (hex_pre_ms_or_ms == NULL((void*)0) || !*hex_pre_ms_or_ms) {
7021 g_free(hex_pre_ms_or_ms);
7022 hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret");
7023 }
7024 /* There is always a match, otherwise the regex is wrong. */
7025 DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms))((void) ((hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms
)) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 7025, "hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)"
))))
;
7026
7027 /* convert from hex to bytes and save to hashtable */
7028 pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo)((StringInfo*)wmem_alloc((wmem_file_scope()), sizeof(StringInfo
)))
;
7029 from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms));
7030 g_free(hex_pre_ms_or_ms);
7031
7032 /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */
7033 for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups)(sizeof (mk_groups) / sizeof ((mk_groups)[0])); i++) {
7034 ssl_master_key_match_group_t *g = &mk_groups[i];
7035 hex_key = g_match_info_fetch_named(mi, g->re_group_name);
7036 if (hex_key && *hex_key) {
7037 ssl_debug_printf(" matched %s\n", g->re_group_name);
7038 ht = g->master_key_ht;
7039 from_hex(key, hex_key, strlen(hex_key));
7040 g_free(hex_key);
7041 break;
7042 }
7043 g_free(hex_key);
7044 }
7045 DISSECTOR_ASSERT(ht)((void) ((ht) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/dissectors/packet-tls-utils.c", 7045, "ht"))))
; /* Cannot be reached, or regex is wrong. */
7046
7047 g_hash_table_insert(ht, key, pre_ms_or_ms);
7048
7049 } else if (linelen > 0 && line[0] != '#') {
7050 ssl_debug_printf(" unrecognized line\n");
7051 }
7052 /* always free match info even if there is no match. */
7053 g_match_info_free(mi);
7054 }
7055}
7056
7057void
7058ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file,
7059 const ssl_master_key_map_t *mk_map)
7060{
7061 /* no need to try if no key log file is configured. */
7062 if (!tls_keylog_filename || !*tls_keylog_filename) {
7063 ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n",
7064 G_STRFUNC((const char*) (__func__)));
7065 return;
7066 }
7067
7068 /* Validate regexes before even trying to use it. */
7069 if (!ssl_compile_keyfile_regex()) {
7070 return;
7071 }
7072
7073 ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename);
7074
7075 /* if the keylog file was deleted/overwritten, re-open it */
7076 if (*keylog_file && file_needs_reopen(ws_filenofileno(*keylog_file), tls_keylog_filename)) {
7077 ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC((const char*) (__func__)));
7078 fclose(*keylog_file);
7079 *keylog_file = NULL((void*)0);
7080 }
7081
7082 if (*keylog_file == NULL((void*)0)) {
7083 *keylog_file = ws_fopenfopen(tls_keylog_filename, "r");
7084 if (!*keylog_file) {
7085 ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC((const char*) (__func__)));
7086 return;
7087 }
7088 }
7089
7090 for (;;) {
7091 char buf[1110], *line;
7092 line = fgets(buf, sizeof(buf), *keylog_file);
7093 if (!line) {
7094 if (feof(*keylog_file)) {
7095 /* Ensure that newly appended keys can be read in the future. */
7096 clearerr(*keylog_file);
7097 } else if (ferror(*keylog_file)) {
7098 ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC((const char*) (__func__)));
7099 fclose(*keylog_file);
7100 *keylog_file = NULL((void*)0);
7101 }
7102 break;
7103 }
7104 tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line));
7105 }
7106}
7107/** SSL keylog file handling. }}} */
7108
7109#ifdef SSL_DECRYPT_DEBUG /* {{{ */
7110
7111static FILE* ssl_debug_file;
7112
7113void
7114ssl_set_debug(const char* name)
7115{
7116 static int debug_file_must_be_closed;
7117 int use_stderr;
7118
7119 use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR"-") == 0):0;
7120
7121 if (debug_file_must_be_closed)
7122 fclose(ssl_debug_file);
7123
7124 if (use_stderr)
7125 ssl_debug_file = stderrstderr;
7126 else if (!name || (strcmp(name, "") ==0))
7127 ssl_debug_file = NULL((void*)0);
7128 else
7129 ssl_debug_file = ws_fopenfopen(name, "w");
7130
7131 if (!use_stderr && ssl_debug_file)
7132 debug_file_must_be_closed = 1;
7133 else
7134 debug_file_must_be_closed = 0;
7135
7136 ssl_debug_printf("Wireshark SSL debug log \n\n");
7137#ifdef HAVE_LIBGNUTLS1
7138 ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL((void*)0)));
7139#endif
7140 ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL((void*)0)));
7141 ssl_debug_printf("\n");
7142}
7143
7144void
7145ssl_debug_flush(void)
7146{
7147 if (ssl_debug_file)
7148 fflush(ssl_debug_file);
7149}
7150
7151void
7152ssl_debug_printf(const char* fmt, ...)
7153{
7154 va_list ap;
7155
7156 if (!ssl_debug_file)
7157 return;
7158
7159 va_start(ap, fmt)__builtin_va_start(ap, fmt);
7160 vfprintf(ssl_debug_file, fmt, ap);
7161 va_end(ap)__builtin_va_end(ap);
7162}
7163
7164void
7165ssl_print_data(const char* name, const unsigned char* data, size_t len)
7166{
7167 size_t i, j, k;
7168 if (!ssl_debug_file)
7169 return;
7170 fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len);
7171 for (i=0; i<len; i+=16) {
7172 fprintf(ssl_debug_file,"| ");
7173 for (j=i, k=0; k<16 && j<len; ++j, ++k)
7174 fprintf(ssl_debug_file,"%.2x ",data[j]);
7175 for (; k<16; ++k)
7176 fprintf(ssl_debug_file," ");
7177 fputc('|', ssl_debug_file);
7178 for (j=i, k=0; k<16 && j<len; ++j, ++k) {
7179 unsigned char c = data[j];
7180 if (!g_ascii_isprint(c)((g_ascii_table[(guchar) (c)] & G_ASCII_PRINT) != 0) || (c=='\t')) c = '.';
7181 fputc(c, ssl_debug_file);
7182 }
7183 for (; k<16; ++k)
7184 fputc(' ', ssl_debug_file);
7185 fprintf(ssl_debug_file,"|\n");
7186 }
7187}
7188
7189void
7190ssl_print_string(const char* name, const StringInfo* data)
7191{
7192 ssl_print_data(name, data->data, data->data_len);
7193}
7194#endif /* SSL_DECRYPT_DEBUG }}} */
7195
7196/* UAT preferences callbacks. {{{ */
7197/* checks for SSL and DTLS UAT key list fields */
7198
7199bool_Bool
7200ssldecrypt_uat_fld_ip_chk_cb(void* r _U___attribute__((unused)), const char* p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7201{
7202 // This should be removed in favor of Decode As. Make it optional.
7203 *err = NULL((void*)0);
7204 return true1;
7205}
7206
7207bool_Bool
7208ssldecrypt_uat_fld_port_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7209{
7210 if (!p || strlen(p) == 0u) {
7211 // This should be removed in favor of Decode As. Make it optional.
7212 *err = NULL((void*)0);
7213 return true1;
7214 }
7215
7216 if (strcmp(p, "start_tls") != 0){
7217 uint16_t port;
7218 if (!ws_strtou16(p, NULL((void*)0), &port)) {
7219 *err = g_strdup("Invalid port given.")g_strdup_inline ("Invalid port given.");
7220 return false0;
7221 }
7222 }
7223
7224 *err = NULL((void*)0);
7225 return true1;
7226}
7227
7228bool_Bool
7229ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U___attribute__((unused)), const char* p, unsigned len _U___attribute__((unused)), const void* u1 _U___attribute__((unused)), const void* u2 _U___attribute__((unused)), char** err)
7230{
7231 ws_statb64struct stat st;
7232
7233 if (!p || strlen(p) == 0u) {
7234 *err = g_strdup("No filename given.")g_strdup_inline ("No filename given.");
7235 return false0;
7236 } else {
7237 if (ws_stat64stat(p, &st) != 0) {
7238 *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p)wmem_strdup_printf(((void*)0), "File '%s' does not exist or access is denied."
, p)
;
7239 return false0;
7240 }
7241 }
7242
7243 *err = NULL((void*)0);
7244 return true1;
7245}
7246
7247bool_Bool
7248ssldecrypt_uat_fld_password_chk_cb(void *r _U___attribute__((unused)), const char *p _U___attribute__((unused)), unsigned len _U___attribute__((unused)), const void *u1 _U___attribute__((unused)), const void *u2 _U___attribute__((unused)), char **err)
7249{
7250#if defined(HAVE_LIBGNUTLS1)
7251 ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r;
7252 FILE *fp = NULL((void*)0);
7253
7254 if (p && (strlen(p) > 0u)) {
7255 fp = ws_fopenfopen(f->keyfile, "rb");
7256 if (fp) {
7257 char *msg = NULL((void*)0);
7258 gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg);
7259 if (!priv_key) {
7260 fclose(fp);
7261 *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg)wmem_strdup_printf(((void*)0), "Could not load PKCS#12 key file: %s"
, msg)
;
7262 g_free(msg);
7263 return false0;
7264 }
7265 g_free(msg);
7266 gnutls_x509_privkey_deinit(priv_key);
7267 fclose(fp);
7268 } else {
7269 *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12.")wmem_strdup_printf(((void*)0), "Leave this field blank if the keyfile is not PKCS#12."
)
;
7270 return false0;
7271 }
7272 }
7273
7274 *err = NULL((void*)0);
7275 return true1;
7276#else
7277 *err = g_strdup("Cannot load key files, support is not compiled in.")g_strdup_inline ("Cannot load key files, support is not compiled in."
)
;
7278 return false0;
7279#endif
7280}
7281/* UAT preferences callbacks. }}} */
7282
7283/** maximum size of ssl_association_info() string */
7284#define SSL_ASSOC_MAX_LEN8192 8192
7285
7286typedef struct ssl_association_info_callback_data
7287{
7288 char *str;
7289 const char *table_protocol;
7290} ssl_association_info_callback_data_t;
7291
7292/**
7293 * callback function used by ssl_association_info() to traverse the SSL associations.
7294 */
7295static void
7296ssl_association_info_(const char *table _U___attribute__((unused)), void *handle, void *user_data)
7297{
7298 ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data;
7299 const int l = (const int)strlen(data->str);
7300 snprintf(data->str+l, SSL_ASSOC_MAX_LEN8192-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle));
7301}
7302
7303/**
7304 * @return an information string on the SSL protocol associations. The string must be freed.
7305 */
7306char*
7307ssl_association_info(const char* dissector_table_name, const char* table_protocol)
7308{
7309 ssl_association_info_callback_data_t data;
7310
7311 data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN8192);
7312 data.table_protocol = table_protocol;
7313 dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data);
7314 return data.str;
7315}
7316
7317
7318/** Begin of code related to dissection of wire data. */
7319
7320/* Helpers for dissecting Variable-Length Vectors. {{{ */
7321bool_Bool
7322ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7323 unsigned offset, unsigned offset_end, uint32_t *ret_length,
7324 int hf_length, uint32_t min_value, uint32_t max_value)
7325{
7326 unsigned veclen_size;
7327 uint32_t veclen_value;
7328 proto_item *pi;
7329
7330 DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value)((void) ((min_value <= max_value) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "min_value" " " "<=" " " "max_value"
" (" "%" "l" "u" " " "<=" " " "%" "l" "u" ")", "epan/dissectors/packet-tls-utils.c"
, 7330, (uint64_t)min_value, (uint64_t)max_value))))
;
7331 if (offset > offset_end) {
7332 expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small,
7333 "Vector offset is past buffer end offset (%u > %u)",
7334 offset, offset_end);
7335 *ret_length = 0;
7336 return false0; /* Cannot read length. */
7337 }
7338
7339 if (max_value > 0xffffff) {
7340 veclen_size = 4;
7341 } else if (max_value > 0xffff) {
7342 veclen_size = 3;
7343 } else if (max_value > 0xff) {
7344 veclen_size = 2;
7345 } else {
7346 veclen_size = 1;
7347 }
7348
7349 if (offset_end - offset < veclen_size) {
7350 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7351 tvb, offset, offset_end - offset,
7352 "No more room for vector of length %u",
7353 veclen_size);
7354 *ret_length = 0;
7355 return false0; /* Cannot read length. */
7356 }
7357
7358 pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN0x00000000, &veclen_value);
7359 offset += veclen_size;
7360
7361 if (veclen_value < min_value) {
7362 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7363 "Vector length %u is smaller than minimum %u",
7364 veclen_value, min_value);
7365 } else if (veclen_value > max_value) {
7366 expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length,
7367 "Vector length %u is larger than maximum %u",
7368 veclen_value, max_value);
7369 }
7370
7371 if (offset_end - offset < veclen_value) {
7372 expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small,
7373 "Vector length %u is too large, truncating it to %u",
7374 veclen_value, offset_end - offset);
7375 *ret_length = offset_end - offset;
7376 return false0; /* Length is truncated to avoid overflow. */
7377 }
7378
7379 *ret_length = veclen_value;
7380 return true1; /* Length is OK. */
7381}
7382
7383bool_Bool
7384ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
7385 unsigned offset, unsigned offset_end)
7386{
7387 if (offset < offset_end) {
7388 unsigned trailing = offset_end - offset;
7389 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data,
7390 tvb, offset, trailing,
7391 "%u trailing byte%s unprocessed",
7392 trailing, plurality(trailing, " was", "s were")((trailing) == 1 ? (" was") : ("s were")));
7393 return false0; /* unprocessed data warning */
7394 } else if (offset > offset_end) {
7395 /*
7396 * Returned offset runs past the end. This should not happen and is
7397 * possibly a dissector bug.
7398 */
7399 unsigned excess = offset - offset_end;
7400 proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small,
7401 tvb, offset_end, excess,
7402 "Dissector processed too much data (%u byte%s)",
7403 excess, plurality(excess, "", "s")((excess) == 1 ? ("") : ("s")));
7404 return false0; /* overflow error */
7405 }
7406
7407 return true1; /* OK, offset matches. */
7408}
7409/** }}} */
7410
7411
7412static uint32_t
7413ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7414 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7415 uint16_t version, int hf_sig_len, int hf_sig);
7416
7417/* change_cipher_spec(20) dissection */
7418void
7419ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7420 packet_info *pinfo, proto_tree *tree,
7421 uint32_t offset, SslSession *session,
7422 bool_Bool is_from_server,
7423 const SslDecryptSession *ssl)
7424{
7425 /*
7426 * struct {
7427 * enum { change_cipher_spec(1), (255) } type;
7428 * } ChangeCipherSpec;
7429 */
7430 proto_item *ti;
7431 proto_item_set_text(tree,
7432 "%s Record Layer: %s Protocol: Change Cipher Spec",
7433 val_to_str_const(session->version, ssl_version_short_names, "SSL"),
7434 val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown"));
7435 ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA0x00000000);
7436
7437 if (session->version == TLSV1DOT3_VERSION0x304) {
7438 /* CCS is a dummy message in TLS 1.3, do not parse it further. */
7439 return;
7440 }
7441
7442 /* Remember frame number of first CCS */
7443 uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame;
7444 if (*ccs_frame == 0)
7445 *ccs_frame = pinfo->num;
7446
7447 /* Use heuristics to detect an abbreviated handshake, assume that missing
7448 * ServerHelloDone implies reusing previously negotiating keys. Then when
7449 * a Session ID or ticket is present, it must be a resumed session.
7450 * Normally this should be done at the Finished message, but that may be
7451 * encrypted so we do it here, at the last cleartext message. */
7452 if (is_from_server && ssl) {
7453 if (session->is_session_resumed) {
7454 const char *resumed = NULL((void*)0);
7455 if (ssl->session_ticket.data_len) {
7456 resumed = "Session Ticket";
7457 } else if (ssl->session_id.data_len) {
7458 resumed = "Session ID";
7459 }
7460 if (resumed) {
7461 ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC((const char*) (__func__)), resumed);
7462 } else {
7463 /* Can happen if the capture somehow starts in the middle */
7464 ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC((const char*) (__func__)));
7465 }
7466 } else {
7467 ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC((const char*) (__func__)));
7468 }
7469 }
7470 if (is_from_server && session->is_session_resumed)
7471 expert_add_info(pinfo, ti, &hf->ei.resumed);
7472}
7473
7474/** Begin of handshake(22) record dissections */
7475
7476/* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2).
7477 * {{{ */
7478static void
7479tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data)
7480{
7481 uint32_t sighash, hashalg, sigalg;
7482 proto_item *ti_sigalg;
7483 proto_tree *sigalg_tree;
7484
7485 ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb,
7486 offset, 2, ENC_BIG_ENDIAN0x00000000, &sighash);
7487 if (ja4_data) {
7488 wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)((gpointer) (gulong) (sighash)));
7489 }
7490
7491 sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg);
7492
7493 /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */
7494 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb,
7495 offset, 1, ENC_BIG_ENDIAN0x00000000, &hashalg);
7496 proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb,
7497 offset + 1, 1, ENC_BIG_ENDIAN0x00000000, &sigalg);
7498
7499 /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */
7500 if (!try_val_to_str(sighash, tls13_signature_algorithm)) {
7501 proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)",
7502 val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"),
7503 val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"),
7504 sighash);
7505 }
7506} /* }}} */
7507
7508/* dissect a list of hash algorithms, return the number of bytes dissected
7509 this is used for the signature algorithms extension and for the
7510 TLS1.2 certificate request. {{{ */
7511static int
7512ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
7513 packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7514{
7515 /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
7516 * struct {
7517 * HashAlgorithm hash;
7518 * SignatureAlgorithm signature;
7519 * } SignatureAndHashAlgorithm;
7520 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
7521 */
7522 proto_tree *subtree;
7523 proto_item *ti;
7524 unsigned sh_alg_length;
7525 uint32_t next_offset;
7526
7527 /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */
7528 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length,
7529 hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX(65535) - 1)) {
7530 return offset_end;
7531 }
7532 offset += 2;
7533 next_offset = offset + sh_alg_length;
7534
7535 ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length,
7536 "Signature Hash Algorithms (%u algorithm%s)",
7537 sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")((sh_alg_length / 2) == 1 ? ("") : ("s")));
7538 subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs);
7539
7540 while (offset + 2 <= next_offset) {
7541 tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data);
7542 offset += 2;
7543 }
7544
7545 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
7546 offset = next_offset;
7547 }
7548
7549 return offset;
7550} /* }}} */
7551
7552/* Dissection of DistinguishedName (for CertificateRequest and
7553 * certificate_authorities extension). {{{ */
7554static uint32_t
7555tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7556 proto_tree *tree, uint32_t offset, uint32_t offset_end)
7557{
7558 proto_item *ti;
7559 proto_tree *subtree;
7560 uint32_t dnames_length, next_offset;
7561 asn1_ctx_t asn1_ctx;
7562 int dnames_count = 100; /* the maximum number of DNs to add to the tree */
7563
7564 /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */
7565 /* DistinguishedName certificate_authorities<0..2^16-1> */
7566 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length,
7567 hf->hf.hs_dnames_len, 0, UINT16_MAX(65535))) {
7568 return offset_end;
7569 }
7570 offset += 2;
7571 next_offset = offset + dnames_length;
7572
7573 if (dnames_length > 0) {
7574 ti = proto_tree_add_none_format(tree,
7575 hf->hf.hs_dnames,
7576 tvb, offset, dnames_length,
7577 "Distinguished Names (%d byte%s)",
7578 dnames_length,
7579 plurality(dnames_length, "", "s")((dnames_length) == 1 ? ("") : ("s")));
7580 subtree = proto_item_add_subtree(ti, hf->ett.dnames);
7581
7582 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7583
7584 while (offset < next_offset) {
7585 /* get the length of the current certificate */
7586 uint32_t name_length;
7587
7588 if (dnames_count-- == 0) {
7589 /* stop adding to tree when the list is considered too large
7590 * https://gitlab.com/wireshark/wireshark/-/issues/16202
7591 Note: dnames_count must be set low enough not to hit the
7592 limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c
7593 */
7594 ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated,
7595 tvb, offset, next_offset - offset, ENC_NA0x00000000);
7596 proto_item_set_generated(ti);
7597 return next_offset;
7598 }
7599
7600 /* opaque DistinguishedName<1..2^16-1> */
7601 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length,
7602 hf->hf.hs_dname_len, 1, UINT16_MAX(65535))) {
7603 return next_offset;
7604 }
7605 offset += 2;
7606
7607 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
7608 subtree, hf->hf.hs_dname);
7609 offset += name_length;
7610 }
7611 }
7612 return offset;
7613} /* }}} */
7614
7615
7616/** TLS Extensions (in Client Hello and Server Hello). {{{ */
7617static int
7618ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7619 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data)
7620{
7621 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data);
7622}
7623
7624static int
7625ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7626 proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type)
7627{
7628 if (hnd_type == SSL_HND_CLIENT_HELLO) {
7629 /*
7630 * struct {
7631 * SignatureScheme supported_signature_algorithm<2..2^16-2>;
7632 * } SignatureSchemeList;
7633 */
7634
7635 return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
7636 } else {
7637 asn1_ctx_t asn1_ctx;
7638 unsigned pubkey_length, sign_length;
7639
7640 /*
7641 * struct {
7642 * uint32 valid_time;
7643 * SignatureScheme expected_cert_verify_algorithm;
7644 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
7645 * } Credential;
7646 *
7647 * struct {
7648 * Credential cred;
7649 * SignatureScheme algorithm;
7650 * opaque signature<0..2^16-1>;
7651 * } DelegatedCredential;
7652 */
7653
7654 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
7655
7656 proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
7657 offset += 4;
7658
7659 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7660 offset += 2;
7661
7662 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length,
7663 hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24((1U << 24) - 1))) {
7664 return offset_end;
7665 }
7666 offset += 3;
7667 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey);
7668 offset += pubkey_length;
7669
7670 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
7671 offset += 2;
7672
7673 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length,
7674 hf->hf.hs_cred_signature_len, 1, UINT16_MAX(65535))) {
7675 return offset_end;
7676 }
7677 offset += 2;
7678 proto_tree_add_item(tree, hf->hf.hs_cred_signature,
7679 tvb, offset, sign_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7680 offset += sign_length;
7681
7682 return offset;
7683 }
7684}
7685
7686static int
7687ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7688 packet_info *pinfo, proto_tree *tree,
7689 uint32_t offset, uint32_t offset_end,
7690 uint8_t hnd_type)
7691{
7692
7693 /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */
7694
7695 switch (hnd_type) {
7696 case SSL_HND_CLIENT_HELLO: {
7697 proto_tree *alps_tree;
7698 proto_item *ti;
7699 uint32_t next_offset, alps_length, name_length;
7700
7701 /*
7702 * opaque ProtocolName<1..2^8-1>;
7703 * struct {
7704 * ProtocolName supported_protocols<2..2^16-1>
7705 * } ApplicationSettingsSupport;
7706 */
7707
7708 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length,
7709 hf->hf.hs_ext_alps_len, 2, UINT16_MAX(65535))) {
7710 return offset_end;
7711 }
7712 offset += 2;
7713 next_offset = offset + alps_length;
7714
7715 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list,
7716 tvb, offset, alps_length, ENC_NA0x00000000);
7717 alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps);
7718
7719 /* Parse list (note missing check for end of vector, ssl_add_vector below
7720 * ensures that data is always available.) */
7721 while (offset < next_offset) {
7722 if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length,
7723 hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX(255))) {
7724 return next_offset;
7725 }
7726 offset++;
7727
7728 proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str,
7729 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7730 offset += name_length;
7731 }
7732
7733 return offset;
7734 }
7735 case SSL_HND_ENCRYPTED_EXTS:
7736 /* Opaque blob */
7737 proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings,
7738 tvb, offset, offset_end - offset, ENC_ASCII0x00000000|ENC_NA0x00000000);
7739 break;
7740 }
7741
7742 return offset_end;
7743}
7744
7745static int
7746ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7747 packet_info *pinfo, proto_tree *tree,
7748 uint32_t offset, uint32_t offset_end,
7749 uint8_t hnd_type, SslSession *session,
7750 bool_Bool is_dtls, ja4_data_t *ja4_data)
7751{
7752
7753 /* https://tools.ietf.org/html/rfc7301#section-3.1
7754 * opaque ProtocolName<1..2^8-1>;
7755 * struct {
7756 * ProtocolName protocol_name_list<2..2^16-1>
7757 * } ProtocolNameList;
7758 */
7759 proto_tree *alpn_tree;
7760 proto_item *ti;
7761 uint32_t next_offset, alpn_length, name_length;
7762 uint8_t *proto_name = NULL((void*)0), *client_proto_name = NULL((void*)0);
7763
7764 /* ProtocolName protocol_name_list<2..2^16-1> */
7765 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length,
7766 hf->hf.hs_ext_alpn_len, 2, UINT16_MAX(65535))) {
7767 return offset_end;
7768 }
7769 offset += 2;
7770 next_offset = offset + alpn_length;
7771
7772 ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list,
7773 tvb, offset, alpn_length, ENC_NA0x00000000);
7774 alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn);
7775
7776 /* Parse list (note missing check for end of vector, ssl_add_vector below
7777 * ensures that data is always available.) */
7778 while (offset < next_offset) {
7779 /* opaque ProtocolName<1..2^8-1> */
7780 if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length,
7781 hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX(255))) {
7782 return next_offset;
7783 }
7784 offset++;
7785
7786 proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str,
7787 tvb, offset, name_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7788 if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) {
7789 const char alpn_first_char = (char)tvb_get_uint8(tvb,offset);
7790 const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1);
7791 if ((g_ascii_isprint(alpn_first_char)((g_ascii_table[(guchar) (alpn_first_char)] & G_ASCII_PRINT
) != 0)
) && g_ascii_isprint(alpn_last_char)((g_ascii_table[(guchar) (alpn_last_char)] & G_ASCII_PRINT
) != 0)
) {
7792 wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char);
7793 }
7794 else {
7795 wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F,
7796 alpn_last_char & 0x0F);
7797 }
7798 }
7799 /* Remember first ALPN ProtocolName entry for server. */
7800 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) {
7801 /* '\0'-terminated string for dissector table match and prefix
7802 * comparison purposes. */
7803 proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7804 name_length, ENC_ASCII0x00000000);
7805 } else if (hnd_type == SSL_HND_CLIENT_HELLO) {
7806 client_proto_name = tvb_get_string_enc(pinfo->pool, tvb, offset,
7807 name_length, ENC_ASCII0x00000000);
7808 }
7809 offset += name_length;
7810 }
7811
7812 /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain
7813 * exactly one "ProtocolName". */
7814 if (proto_name) {
7815 dissector_handle_t handle;
7816
7817 session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name);
7818
7819 if (is_dtls) {
7820 handle = dissector_get_string_handle(dtls_alpn_dissector_table,
7821 proto_name);
7822 } else {
7823 handle = dissector_get_string_handle(ssl_alpn_dissector_table,
7824 proto_name);
7825 if (handle == NULL((void*)0)) {
7826 /* Try prefix matching */
7827 for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols)(sizeof (ssl_alpn_prefix_match_protocols) / sizeof ((ssl_alpn_prefix_match_protocols
)[0]))
; i++) {
7828 const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i];
7829
7830 /* string_string is inappropriate as it compares strings
7831 * while "byte strings MUST NOT be truncated" (RFC 7301) */
7832 if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)(__builtin_constant_p (alpn_proto->proto_prefix)? __extension__
({ const char * const __str = (proto_name); const char * const
__prefix = (alpn_proto->proto_prefix); gboolean __result =
(0); if (__str == ((void*)0) || __prefix == ((void*)0)) __result
= (g_str_has_prefix) (__str, __prefix); else { const size_t __str_len
= strlen (((__str) + !(__str))); const size_t __prefix_len =
strlen (((__prefix) + !(__prefix))); if (__str_len >= __prefix_len
) __result = memcmp (((__str) + !(__str)), ((__prefix) + !(__prefix
)), __prefix_len) == 0; } __result; }) : (g_str_has_prefix) (
proto_name, alpn_proto->proto_prefix) )
) {
7833 handle = find_dissector(alpn_proto->dissector_name);
7834 break;
7835 }
7836 }
7837 }
7838 }
7839 if (handle != NULL((void*)0)) {
7840 /* ProtocolName match, so set the App data dissector handle.
7841 * This may override protocols given via the UAT dialog, but
7842 * since the ALPN hint is precise, do it anyway. */
7843 ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC((const char*) (__func__)),
7844 (void *)session->app_handle,
7845 (void *)handle,
7846 dissector_handle_get_dissector_name(handle));
7847 session->app_handle = handle;
7848 }
7849 } else if (client_proto_name) {
7850 // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector
7851 // and it just needs the string since there are/were various HTTP/3 ALPNs to check for.
7852 session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name);
7853 }
7854
7855 return offset;
7856}
7857
7858static int
7859ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7860 packet_info *pinfo, proto_tree *tree,
7861 uint32_t offset, uint32_t offset_end)
7862{
7863 /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3
7864 * The "extension_data" field of a "next_protocol_negotiation" extension
7865 * in a "ServerHello" contains an optional list of protocols advertised
7866 * by the server. Protocols are named by opaque, non-empty byte strings
7867 * and the list of protocols is serialized as a concatenation of 8-bit,
7868 * length prefixed byte strings. Implementations MUST ensure that the
7869 * empty string is not included and that no byte strings are truncated.
7870 */
7871 uint32_t npn_length;
7872 proto_tree *npn_tree;
7873
7874 /* List is optional, do not add tree if there are no entries. */
7875 if (offset == offset_end) {
7876 return offset;
7877 }
7878
7879 npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL((void*)0), "Next Protocol Negotiation");
7880
7881 while (offset < offset_end) {
7882 /* non-empty, 8-bit length prefixed strings means range 1..255 */
7883 if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length,
7884 hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX(255))) {
7885 return offset_end;
7886 }
7887 offset++;
7888
7889 proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str,
7890 tvb, offset, npn_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
7891 offset += npn_length;
7892 }
7893
7894 return offset;
7895}
7896
7897static int
7898ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb,
7899 packet_info *pinfo, proto_tree *tree,
7900 uint32_t offset, uint32_t offset_end)
7901{
7902 /* https://tools.ietf.org/html/rfc5746#section-3.2
7903 * struct {
7904 * opaque renegotiated_connection<0..255>;
7905 * } RenegotiationInfo;
7906 *
7907 */
7908 proto_tree *reneg_info_tree;
7909 uint32_t reneg_info_length;
7910
7911 reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL((void*)0), "Renegotiation Info extension");
7912
7913 /* opaque renegotiated_connection<0..255> */
7914 if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length,
7915 hf->hf.hs_ext_reneg_info_len, 0, 255)) {
7916 return offset_end;
7917 }
7918 offset++;
7919
7920 if (reneg_info_length > 0) {
7921 proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA0x00000000);
7922 offset += reneg_info_length;
7923 }
7924
7925 return offset;
7926}
7927
7928static int
7929ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7930 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7931 const char **group_name_out)
7932{
7933 /* RFC 8446 Section 4.2.8
7934 * struct {
7935 * NamedGroup group;
7936 * opaque key_exchange<1..2^16-1>;
7937 * } KeyShareEntry;
7938 */
7939 uint32_t key_exchange_length, group;
7940 proto_tree *ks_tree;
7941
7942 ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL((void*)0), "Key Share Entry");
7943
7944 proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
7945 offset += 2;
7946 const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
7947 proto_item_append_text(ks_tree, ": Group: %s", group_name);
7948 if (group_name_out) {
7949 *group_name_out = !IS_GREASE_TLS(group)((((group) & 0x0f0f) == 0x0a0a) && (((group) &
0xff) == (((group)>>8) & 0xff)))
? group_name : NULL((void*)0);
7950 }
7951
7952 /* opaque key_exchange<1..2^16-1> */
7953 if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length,
7954 hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX(65535))) {
7955 return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */
7956 }
7957 offset += 2;
7958 proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length);
7959 proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length);
7960
7961 proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA0x00000000);
7962 offset += key_exchange_length;
7963
7964 return offset;
7965}
7966
7967static int
7968ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
7969 proto_tree *tree, uint32_t offset, uint32_t offset_end,
7970 uint8_t hnd_type)
7971{
7972 proto_tree *key_share_tree;
7973 uint32_t next_offset;
7974 uint32_t client_shares_length;
7975 uint32_t group;
7976 const char *group_name = NULL((void*)0);
7977
7978 if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */
7979 return offset;
7980 }
7981
7982 key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL((void*)0), "Key Share extension");
7983
7984 switch(hnd_type){
7985 case SSL_HND_CLIENT_HELLO:
7986 /* KeyShareEntry client_shares<0..2^16-1> */
7987 if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length,
7988 hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX(65535))) {
7989 return offset_end;
7990 }
7991 offset += 2;
7992 next_offset = offset + client_shares_length;
7993 const char *sep = " ";
7994 while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */
7995 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name);
7996 if (group_name) {
7997 proto_item_append_text(tree, "%s%s", sep, group_name);
7998 sep = ", ";
7999 }
8000 }
8001 if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) {
8002 return next_offset;
8003 }
8004 break;
8005 case SSL_HND_SERVER_HELLO:
8006 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name);
8007 if (group_name) {
8008 proto_item_append_text(tree, " %s", group_name);
8009 }
8010 break;
8011 case SSL_HND_HELLO_RETRY_REQUEST:
8012 proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &group);
8013 offset += 2;
8014 group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)");
8015 proto_item_append_text(tree, " %s", group_name);
8016 break;
8017 default: /* no default */
8018 break;
8019 }
8020
8021 return offset;
8022}
8023
8024static int
8025ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8026 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8027 uint8_t hnd_type)
8028{
8029 /* RFC 8446 Section 4.2.11
8030 * struct {
8031 * opaque identity<1..2^16-1>;
8032 * uint32 obfuscated_ticket_age;
8033 * } PskIdentity;
8034 * opaque PskBinderEntry<32..255>;
8035 * struct {
8036 * select (Handshake.msg_type) {
8037 * case client_hello:
8038 * PskIdentity identities<7..2^16-1>;
8039 * PskBinderEntry binders<33..2^16-1>;
8040 * case server_hello:
8041 * uint16 selected_identity;
8042 * };
8043 * } PreSharedKeyExtension;
8044 */
8045
8046 proto_tree *psk_tree;
8047
8048 psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL((void*)0), "Pre-Shared Key extension");
8049
8050 switch (hnd_type){
8051 case SSL_HND_CLIENT_HELLO: {
8052 uint32_t identities_length, identities_end, binders_length;
8053
8054 /* PskIdentity identities<7..2^16-1> */
8055 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length,
8056 hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX(65535))) {
8057 return offset_end;
8058 }
8059 offset += 2;
8060 identities_end = offset + identities_length;
8061
8062 while (offset < identities_end) {
8063 uint32_t identity_length;
8064 proto_tree *identity_tree;
8065
8066 identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL((void*)0), "PSK Identity (");
8067
8068 /* opaque identity<1..2^16-1> */
8069 if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length,
8070 hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX(65535))) {
8071 return identities_end;
8072 }
8073 offset += 2;
8074 proto_item_append_text(identity_tree, "length: %u)", identity_length);
8075
8076 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN0x00000000);
8077 offset += identity_length;
8078
8079 proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8080 offset += 4;
8081
8082 proto_item_set_len(identity_tree, 2 + identity_length + 4);
8083 }
8084 if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) {
8085 offset = identities_end;
8086 }
8087
8088 /* PskBinderEntry binders<33..2^16-1> */
8089 if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length,
8090 hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX(65535))) {
8091 return offset_end;
8092 }
8093 offset += 2;
8094
8095 proto_item *binders_item;
8096 proto_tree *binders_tree;
8097 binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA0x00000000);
8098 binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders);
8099 uint32_t binders_end = offset + binders_length;
8100 while (offset < binders_end) {
8101 uint32_t binder_length;
8102 proto_item *binder_item;
8103 proto_tree *binder_tree;
8104
8105 binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA0x00000000);
8106 binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder);
8107
8108 /* opaque PskBinderEntry<32..255>; */
8109 if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length,
8110 hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) {
8111 return binders_end;
8112 }
8113 offset += 1;
8114 proto_item_append_text(binder_tree, " (length: %u)", binder_length);
8115
8116 proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN0x00000000);
8117 offset += binder_length;
8118
8119 proto_item_set_end(binder_item, tvb, offset);
8120 }
8121 }
8122 break;
8123 case SSL_HND_SERVER_HELLO: {
8124 proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8125 offset += 2;
8126 }
8127 break;
8128 default:
8129 break;
8130 }
8131
8132 return offset;
8133}
8134
8135static uint32_t
8136ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
8137 proto_tree *tree, uint32_t offset, uint32_t offset_end _U___attribute__((unused)),
8138 uint8_t hnd_type, SslDecryptSession *ssl)
8139{
8140 /* RFC 8446 Section 4.2.10
8141 * struct {} Empty;
8142 * struct {
8143 * select (Handshake.msg_type) {
8144 * case new_session_ticket: uint32 max_early_data_size;
8145 * case client_hello: Empty;
8146 * case encrypted_extensions: Empty;
8147 * };
8148 * } EarlyDataIndication;
8149 */
8150 switch (hnd_type) {
8151 case SSL_HND_CLIENT_HELLO:
8152 /* Remember that early_data will follow the handshake. */
8153 if (ssl) {
8154 ssl_debug_printf("%s found early_data extension\n", G_STRFUNC((const char*) (__func__)));
8155 ssl->has_early_data = true1;
8156 }
8157 break;
8158 case SSL_HND_NEWSESSION_TICKET:
8159 proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8160 offset += 4;
8161 break;
8162 default:
8163 break;
8164 }
8165 return offset;
8166}
8167
8168static uint16_t
8169tls_try_get_version(bool_Bool is_dtls, uint16_t version, uint8_t *draft_version)
8170{
8171 if (draft_version) {
8172 *draft_version = 0;
8173 }
8174 if (!is_dtls) {
8175 uint8_t tls13_draft = extract_tls13_draft_version(version);
8176 if (tls13_draft != 0) {
8177 /* This is TLS 1.3 (a draft version). */
8178 if (draft_version) {
8179 *draft_version = tls13_draft;
8180 }
8181 version = TLSV1DOT3_VERSION0x304;
8182 }
8183 if (version == 0xfb17 || version == 0xfb1a) {
8184 /* Unofficial TLS 1.3 draft version for Facebook fizz. */
8185 tls13_draft = (uint8_t)version;
8186 if (draft_version) {
8187 *draft_version = tls13_draft;
8188 }
8189 version = TLSV1DOT3_VERSION0x304;
8190 }
8191 }
8192
8193 switch (version) {
8194 case SSLV3_VERSION0x300:
8195 case TLSV1_VERSION0x301:
8196 case TLSV1DOT1_VERSION0x302:
8197 case TLSV1DOT2_VERSION0x303:
8198 case TLSV1DOT3_VERSION0x304:
8199 case TLCPV1_VERSION0x101:
8200 if (is_dtls)
8201 return SSL_VER_UNKNOWN0;
8202 break;
8203
8204 case DTLSV1DOT0_VERSION0xfeff:
8205 case DTLSV1DOT0_OPENSSL_VERSION0x100:
8206 case DTLSV1DOT2_VERSION0xfefd:
8207 case DTLSV1DOT3_VERSION0xfefc:
8208 if (!is_dtls)
8209 return SSL_VER_UNKNOWN0;
8210 break;
8211
8212 default: /* invalid version number */
8213 return SSL_VER_UNKNOWN0;
8214 }
8215
8216 return version;
8217}
8218
8219static int
8220ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8221 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8222 SslSession *session, bool_Bool is_dtls, ja4_data_t *ja4_data)
8223{
8224
8225 /* RFC 8446 Section 4.2.1
8226 * struct {
8227 * ProtocolVersion versions<2..254>; // ClientHello
8228 * } SupportedVersions;
8229 * Note that ServerHello and HelloRetryRequest are handled by the caller.
8230 */
8231 uint32_t versions_length, next_offset;
8232 /* ProtocolVersion versions<2..254> */
8233 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length,
8234 hf->hf.hs_ext_supported_versions_len, 2, 254)) {
8235 return offset_end;
8236 }
8237 offset++;
8238 next_offset = offset + versions_length;
8239
8240 unsigned version;
8241 unsigned current_version, lowest_version = SSL_VER_UNKNOWN0;
8242 uint8_t draft_version, max_draft_version = 0;
8243 const char *sep = " ";
8244 while (offset + 2 <= next_offset) {
8245 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
8246 offset += 2;
8247
8248 if (!IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8249 proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)"));
8250 sep = ", ";
8251 }
8252
8253 current_version = tls_try_get_version(is_dtls, version, &draft_version);
8254 if (session->version == SSL_VER_UNKNOWN0) {
8255 if (lowest_version == SSL_VER_UNKNOWN0) {
8256 lowest_version = current_version;
8257 } else if (current_version != SSL_VER_UNKNOWN0) {
8258 if (!is_dtls) {
8259 lowest_version = MIN(lowest_version, current_version)(((lowest_version) < (current_version)) ? (lowest_version)
: (current_version))
;
8260 } else {
8261 lowest_version = MAX(lowest_version, current_version)(((lowest_version) > (current_version)) ? (lowest_version)
: (current_version))
;
8262 }
8263 }
8264 }
8265 max_draft_version = MAX(draft_version, max_draft_version)(((draft_version) > (max_draft_version)) ? (draft_version)
: (max_draft_version))
;
8266 if (ja4_data && !IS_GREASE_TLS(version)((((version) & 0x0f0f) == 0x0a0a) && (((version) &
0xff) == (((version)>>8) & 0xff)))
) {
8267 /* The DTLS version numbers get mapped to "00" for unknown per
8268 * JA4 spec, but if JA4 ever does support DTLS we'll probably
8269 * need to take the MIN instead of MAX here for DTLS.
8270 */
8271 ja4_data->max_version = MAX(version, ja4_data->max_version)(((version) > (ja4_data->max_version)) ? (version) : (ja4_data
->max_version))
;
8272 }
8273 }
8274 if (session->version == SSL_VER_UNKNOWN0 && lowest_version != SSL_VER_UNKNOWN0) {
8275 col_set_str(pinfo->cinfo, COL_PROTOCOL,
8276 val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS"));
8277 }
8278 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
8279 offset = next_offset;
8280 }
8281
8282 /* XXX remove this when draft 19 support is dropped,
8283 * this is only required for early data decryption. */
8284 if (max_draft_version) {
8285 session->tls13_draft_version = max_draft_version;
8286 }
8287
8288 return offset;
8289}
8290
8291static int
8292ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8293 packet_info *pinfo, proto_tree *tree,
8294 uint32_t offset, uint32_t offset_end)
8295{
8296 /* RFC 8446 Section 4.2.2
8297 * struct {
8298 * opaque cookie<1..2^16-1>;
8299 * } Cookie;
8300 */
8301 uint32_t cookie_length;
8302 /* opaque cookie<1..2^16-1> */
8303 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
8304 hf->hf.hs_ext_cookie_len, 1, UINT16_MAX(65535))) {
8305 return offset_end;
8306 }
8307 offset += 2;
8308
8309 proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA0x00000000);
8310 offset += cookie_length;
8311
8312 return offset;
8313}
8314
8315static int
8316ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8317 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8318{
8319 /* RFC 8446 Section 4.2.9
8320 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
8321 *
8322 * struct {
8323 * PskKeyExchangeMode ke_modes<1..255>;
8324 * } PskKeyExchangeModes;
8325 */
8326 uint32_t ke_modes_length, next_offset;
8327
8328 /* PskKeyExchangeMode ke_modes<1..255> */
8329 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length,
8330 hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) {
8331 return offset_end;
8332 }
8333 offset++;
8334 next_offset = offset + ke_modes_length;
8335
8336 while (offset < next_offset) {
8337 proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA0x00000000);
8338 offset++;
8339 }
8340
8341 return offset;
8342}
8343
8344static uint32_t
8345ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8346 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8347{
8348 /* RFC 8446 Section 4.2.4
8349 * opaque DistinguishedName<1..2^16-1>;
8350 * struct {
8351 * DistinguishedName authorities<3..2^16-1>;
8352 * } CertificateAuthoritiesExtension;
8353 */
8354 return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
8355}
8356
8357static int
8358ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8359 proto_tree *tree, uint32_t offset, uint32_t offset_end)
8360{
8361 /* RFC 8446 Section 4.2.5
8362 * struct {
8363 * opaque certificate_extension_oid<1..2^8-1>;
8364 * opaque certificate_extension_values<0..2^16-1>;
8365 * } OIDFilter;
8366 * struct {
8367 * OIDFilter filters<0..2^16-1>;
8368 * } OIDFilterExtension;
8369 */
8370 proto_tree *subtree;
8371 uint32_t filters_length, oid_length, values_length, value_offset;
8372 asn1_ctx_t asn1_ctx;
8373 const char *oid, *name;
8374
8375 /* OIDFilter filters<0..2^16-1> */
8376 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length,
8377 hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX(65535))) {
8378 return offset_end;
8379 }
8380 offset += 2;
8381 offset_end = offset + filters_length;
8382
8383 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
8384
8385 while (offset < offset_end) {
8386 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
8387 hf->ett.hs_ext_oid_filter, NULL((void*)0), "OID Filter");
8388
8389 /* opaque certificate_extension_oid<1..2^8-1> */
8390 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length,
8391 hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX(255))) {
8392 return offset_end;
8393 }
8394 offset++;
8395 dissect_ber_object_identifier_str(false0, &asn1_ctx, subtree, tvb, offset,
8396 hf->hf.hs_ext_oid_filters_oid, &oid);
8397 offset += oid_length;
8398
8399 /* Append OID to tree label */
8400 name = oid_resolved_from_string(pinfo->pool, oid);
8401 proto_item_append_text(subtree, " (%s)", name ? name : oid);
8402
8403 /* opaque certificate_extension_values<0..2^16-1> */
8404 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length,
8405 hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX(65535))) {
8406 return offset_end;
8407 }
8408 offset += 2;
8409 proto_item_set_len(subtree, 1 + oid_length + 2 + values_length);
8410 if (values_length > 0) {
8411 value_offset = offset;
8412 value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0), NULL((void*)0));
8413 value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL((void*)0), NULL((void*)0));
8414 call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL((void*)0));
8415 }
8416 offset += values_length;
8417 }
8418
8419 return offset;
8420}
8421
8422static int
8423ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8424 packet_info *pinfo, proto_tree *tree,
8425 uint32_t offset, uint32_t offset_end)
8426{
8427 /* https://tools.ietf.org/html/rfc6066#section-3
8428 *
8429 * struct {
8430 * NameType name_type;
8431 * select (name_type) {
8432 * case host_name: HostName;
8433 * } name;
8434 * } ServerName;
8435 *
8436 * enum {
8437 * host_name(0), (255)
8438 * } NameType;
8439 *
8440 * opaque HostName<1..2^16-1>;
8441 *
8442 * struct {
8443 * ServerName server_name_list<1..2^16-1>
8444 * } ServerNameList;
8445 */
8446 proto_tree *server_name_tree;
8447 uint32_t list_length, server_name_length, next_offset;
8448
8449 /* The server SHALL include "server_name" extension with empty data. */
8450 if (offset == offset_end) {
8451 return offset;
8452 }
8453
8454 server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL((void*)0), "Server Name Indication extension");
8455
8456 /* ServerName server_name_list<1..2^16-1> */
8457 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length,
8458 hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX(65535))) {
8459 return offset_end;
8460 }
8461 offset += 2;
8462 next_offset = offset + list_length;
8463
8464 while (offset < next_offset) {
8465 uint32_t name_type;
8466 const uint8_t *server_name = NULL((void*)0);
8467 proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type,
8468 tvb, offset, 1, ENC_NA0x00000000, &name_type);
8469 offset++;
8470
8471 /* opaque HostName<1..2^16-1> */
8472 if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length,
8473 hf->hf.hs_ext_server_name_len, 1, UINT16_MAX(65535))) {
8474 return next_offset;
8475 }
8476 offset += 2;
8477
8478 proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name,
8479 tvb, offset, server_name_length, ENC_ASCII0x00000000|ENC_NA0x00000000,
8480 pinfo->pool, &server_name);
8481 offset += server_name_length;
8482 // Each type must only occur once, so we don't check for duplicates.
8483 if (name_type == 0) {
8484 proto_item_append_text(tree, " name=%s", server_name);
8485 col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name);
8486
8487 if (gbl_resolv_flags.handshake_sni_addr_resolution) {
8488 // Client Hello: Client (Src) -> Server (Dst)
8489 switch (pinfo->dst.type) {
8490 case AT_IPv4:
8491 if (pinfo->dst.len == sizeof(uint32_t)) {
8492 add_ipv4_name(*(uint32_t *)pinfo->dst.data, server_name, false0);
8493 }
8494 break;
8495 case AT_IPv6:
8496 if (pinfo->dst.len == sizeof(ws_in6_addr)) {
8497 add_ipv6_name(pinfo->dst.data, server_name, false0);
8498 }
8499 break;
8500 }
8501 }
8502 }
8503 }
8504 return offset;
8505}
8506
8507static int
8508ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8509 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl)
8510{
8511 unsigned ext_len = offset_end - offset;
8512 if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) {
8513 tvb_ensure_bytes_exist(tvb, offset, ext_len);
8514 /* Save the Session Ticket such that it can be used as identifier for
8515 * restoring a previous Master Secret (in ChangeCipherSpec) */
8516 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
8517 ssl->session_ticket.data, ext_len);
8518 ssl->session_ticket.data_len = ext_len;
8519 tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len);
8520 }
8521 proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket,
8522 tvb, offset, ext_len, ENC_NA0x00000000);
8523 return offset + ext_len;
8524}
8525
8526static int
8527ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb,
8528 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8529 uint8_t hnd_type, uint16_t ext_type, SslSession *session)
8530{
8531 uint8_t cert_list_length;
8532 uint8_t cert_type;
8533 proto_tree *cert_list_tree;
8534 proto_item *ti;
8535
8536 switch(hnd_type){
8537 case SSL_HND_CLIENT_HELLO:
8538 cert_list_length = tvb_get_uint8(tvb, offset);
8539 proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len,
8540 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8541 offset += 1;
8542 if (offset_end - offset != (uint32_t)cert_list_length)
8543 return offset;
8544
8545 ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset,
8546 cert_list_length, cert_list_length);
8547 proto_item_append_text(ti, " (%d)", cert_list_length);
8548
8549 /* make this a subtree */
8550 cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types);
8551
8552 /* loop over all point formats */
8553 while (cert_list_length > 0)
8554 {
8555 proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8556 offset++;
8557 cert_list_length--;
8558 }
8559 break;
8560 case SSL_HND_SERVER_HELLO:
8561 case SSL_HND_ENCRYPTED_EXTENSIONS:
8562 case SSL_HND_CERTIFICATE:
8563 cert_type = tvb_get_uint8(tvb, offset);
8564 proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8565 offset += 1;
8566 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19) {
8567 session->client_cert_type = cert_type;
8568 }
8569 if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE9 || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20) {
8570 session->server_cert_type = cert_type;
8571 }
8572 break;
8573 default: /* no default */
8574 break;
8575 }
8576
8577 return offset;
8578}
8579
8580static uint32_t
8581ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8582 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8583 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8584{
8585 uint32_t compress_certificate_algorithms_length, next_offset;
8586
8587 /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0
8588 * enum {
8589 * zlib(1),
8590 * brotli(2),
8591 * (65535)
8592 * } CertificateCompressionAlgorithm;
8593 *
8594 * struct {
8595 * CertificateCompressionAlgorithm algorithms<1..2^8-1>;
8596 * } CertificateCompressionAlgorithms;
8597 */
8598 switch (hnd_type) {
8599 case SSL_HND_CLIENT_HELLO:
8600 case SSL_HND_CERT_REQUEST:
8601 /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/
8602 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length,
8603 hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX(255)-1)) {
8604 return offset_end;
8605 }
8606 offset += 1;
8607 next_offset = offset + compress_certificate_algorithms_length;
8608
8609 while (offset < next_offset) {
8610 proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm,
8611 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8612 offset += 2;
8613 }
8614 break;
8615 default:
8616 break;
8617 }
8618
8619 return offset;
8620}
8621
8622static uint32_t
8623ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8624 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8625 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8626{
8627 uint32_t key_parameters_length, next_offset;
8628 proto_item *p_ti;
8629 proto_tree *p_tree;
8630
8631 /* RFC 8472
8632 *
8633 * struct {
8634 * uint8 major;
8635 * uint8 minor;
8636 * } TB_ProtocolVersion;
8637 *
8638 * enum {
8639 * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255)
8640 * } TokenBindingKeyParameters;
8641 *
8642 * struct {
8643 * TB_ProtocolVersion token_binding_version;
8644 * TokenBindingKeyParameters key_parameters_list<1..2^8-1>
8645 * } TokenBindingParameters;
8646 */
8647
8648 switch (hnd_type) {
8649 case SSL_HND_CLIENT_HELLO:
8650 case SSL_HND_SERVER_HELLO:
8651 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8652 offset += 1;
8653 proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8654 offset += 1;
8655
8656 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length,
8657 hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX(255))) {
8658 return offset_end;
8659 }
8660 offset += 1;
8661 next_offset = offset + key_parameters_length;
8662
8663 p_ti = proto_tree_add_none_format(tree,
8664 hf->hf.hs_ext_token_binding_key_parameters,
8665 tvb, offset, key_parameters_length,
8666 "Key parameters identifiers (%d identifier%s)",
8667 key_parameters_length,
8668 plurality(key_parameters_length, "", "s")((key_parameters_length) == 1 ? ("") : ("s")));
8669 p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters);
8670
8671 while (offset < next_offset) {
8672 proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter,
8673 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
8674 offset += 1;
8675 }
8676
8677 if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) {
8678 offset = next_offset;
8679 }
8680
8681 break;
8682 default:
8683 break;
8684 }
8685
8686 return offset;
8687}
8688
8689static uint32_t
8690ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
8691 proto_tree *tree, uint32_t offset, uint32_t offset_end,
8692 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
8693{
8694 bool_Bool use_varint_encoding = true1; // Whether this is draft -27 or newer.
8695 uint32_t next_offset;
8696
8697 /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18
8698 *
8699 * Note: the following structures are not literally defined in the spec,
8700 * they instead use an ASCII diagram.
8701 *
8702 * struct {
8703 * uint16 id;
8704 * opaque value<0..2^16-1>;
8705 * } TransportParameter; // before draft -27
8706 * TransportParameter TransportParameters<0..2^16-1>; // before draft -27
8707 *
8708 * struct {
8709 * opaque ipv4Address[4];
8710 * uint16 ipv4Port;
8711 * opaque ipv6Address[16];
8712 * uint16 ipv6Port;
8713 * opaque connectionId<0..18>;
8714 * opaque statelessResetToken[16];
8715 * } PreferredAddress;
8716 */
8717
8718 if (offset_end - offset >= 6 &&
8719 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset &&
8720 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) {
8721 // Assume encoding of Transport Parameters draft -26 or older with at
8722 // least one transport parameter that has a valid length.
8723 use_varint_encoding = false0;
8724 }
8725
8726 if (use_varint_encoding) {
8727 next_offset = offset_end;
8728 } else {
8729 uint32_t quic_length;
8730 // Assume draft -26 or earlier.
8731 /* TransportParameter TransportParameters<0..2^16-1>; */
8732 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length,
8733 hf->hf.hs_ext_quictp_len, 0, UINT16_MAX(65535))) {
8734 return offset_end;
8735 }
8736 offset += 2;
8737 next_offset = offset + quic_length;
8738 }
8739
8740 while (offset < next_offset) {
8741 uint64_t parameter_type; /* 62-bit space */
8742 uint32_t parameter_length;
8743 proto_tree *parameter_tree;
8744 uint32_t parameter_end_offset;
8745 uint64_t value;
8746 uint32_t len = 0, i;
8747
8748 parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter,
8749 NULL((void*)0), "Parameter");
8750 /* TransportParameter ID and Length. */
8751 if (use_varint_encoding) {
8752 uint64_t parameter_length64;
8753 uint32_t type_len = 0;
8754
8755 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8756 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_type, &type_len);
8757 offset += type_len;
8758
8759 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len,
8760 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &parameter_length64, &len);
8761 parameter_length = (uint32_t)parameter_length64;
8762 offset += len;
8763
8764 proto_item_set_len(parameter_tree, type_len + len + parameter_length);
8765 } else {
8766 parameter_type = tvb_get_ntohs(tvb, offset);
8767 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type,
8768 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8769 offset += 2;
8770
8771 /* opaque value<0..2^16-1> */
8772 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, &parameter_length,
8773 hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX(65535))) {
8774 return next_offset;
8775 }
8776 offset += 2;
8777
8778 proto_item_set_len(parameter_tree, 4 + parameter_length);
8779 }
8780
8781 if (IS_GREASE_QUIC(parameter_type)((parameter_type) > 27 ? ((((parameter_type) - 27) % 31) ==
0) : 0)
) {
8782 proto_item_append_text(parameter_tree, ": GREASE");
8783 } else {
8784 proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x"));
8785 }
8786
8787 proto_item_append_text(parameter_tree, " (len=%u)", parameter_length);
8788 parameter_end_offset = offset + parameter_length;
8789
8790 /* Omit the value field if the parameter's length is 0. */
8791 if (parameter_length != 0) {
8792 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value,
8793 tvb, offset, parameter_length, ENC_NA0x00000000);
8794 }
8795
8796 switch (parameter_type) {
8797 case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID0x00:
8798 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id,
8799 tvb, offset, parameter_length, ENC_NA0x00000000);
8800 offset += parameter_length;
8801 break;
8802 case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT0x01:
8803 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout,
8804 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8805 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " ms", value);
8806 offset += len;
8807 break;
8808 case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN0x02:
8809 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token,
8810 tvb, offset, 16, ENC_BIG_ENDIAN0x00000000);
8811 quic_add_stateless_reset_token(pinfo, tvb, offset, NULL((void*)0));
8812 offset += 16;
8813 break;
8814 case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE0x03:
8815 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size,
8816 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8817 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8818 /*TODO display expert info about invalid value (< 1252 or >65527) ? */
8819 offset += len;
8820 break;
8821 case SSL_HND_QUIC_TP_INITIAL_MAX_DATA0x04:
8822 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data,
8823 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8824 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8825 offset += len;
8826 break;
8827 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL0x05:
8828 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local,
8829 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8830 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8831 offset += len;
8832 break;
8833 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE0x06:
8834 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote,
8835 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8836 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8837 offset += len;
8838 break;
8839 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI0x07:
8840 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni,
8841 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8842 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8843 offset += len;
8844 break;
8845 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI0x09:
8846 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni,
8847 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8848 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8849 offset += len;
8850 break;
8851 case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI0x08:
8852 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi,
8853 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8854 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8855 offset += len;
8856 break;
8857 case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT0x0a:
8858 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent,
8859 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8860 /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */
8861 offset += len;
8862 break;
8863 case SSL_HND_QUIC_TP_MAX_ACK_DELAY0x0b:
8864 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay,
8865 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8866 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8867 offset += len;
8868 break;
8869 case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION0x0c:
8870 /* No Payload */
8871 break;
8872 case SSL_HND_QUIC_TP_PREFERRED_ADDRESS0x0d: {
8873 uint32_t connectionid_length;
8874 quic_cid_t cid;
8875
8876 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address,
8877 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8878 offset += 4;
8879 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port,
8880 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8881 offset += 2;
8882 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address,
8883 tvb, offset, 16, ENC_NA0x00000000);
8884 offset += 16;
8885 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port,
8886 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
8887 offset += 2;
8888 /* XXX - Should we add these addresses and ports as addresses that the client
8889 * is allowed / expected to migrate the server address to? Right now we don't
8890 * enforce that (see RFC 9000 Section 9, which implies that while the client
8891 * can migrate to whatever address it wants, it can only migrate the server
8892 * address to the Server's Preferred Address as in 9.6. Also Issue #20165.)
8893 */
8894
8895 if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length,
8896 hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) {
8897 break;
8898 }
8899 offset += 1;
8900
8901 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid,
8902 tvb, offset, connectionid_length, ENC_NA0x00000000);
8903 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8904 cid.len = connectionid_length;
8905 // RFC 9000 5.1.1 "If the preferred_address transport
8906 // parameter is sent, the sequence number of the supplied
8907 // connection ID is 1."
8908 cid.seq_num = 1;
8909 // Multipath draft-07 "Also, the Path Identifier for the
8910 // connection ID specified in the "preferred address"
8911 // transport parameter is 0."
8912 cid.path_id = 0;
8913 tvb_memcpy(tvb, cid.cid, offset, connectionid_length);
8914 quic_add_connection(pinfo, &cid);
8915 }
8916 offset += connectionid_length;
8917
8918 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken,
8919 tvb, offset, 16, ENC_NA0x00000000);
8920 if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH20) {
8921 quic_add_stateless_reset_token(pinfo, tvb, offset, &cid);
8922 }
8923 offset += 16;
8924 }
8925 break;
8926 case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT0x0e:
8927 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit,
8928 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8929 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8930 offset += len;
8931 break;
8932 case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID0x0f:
8933 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id,
8934 tvb, offset, parameter_length, ENC_NA0x00000000);
8935 offset += parameter_length;
8936 break;
8937 case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID0x10:
8938 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id,
8939 tvb, offset, parameter_length, ENC_NA0x00000000);
8940 offset += parameter_length;
8941 break;
8942 case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE0x20:
8943 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size,
8944 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8945 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8946 offset += len;
8947 break;
8948 case SSL_HND_QUIC_TP_CIBIR_ENCODING0x1000:
8949 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length,
8950 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8951 proto_item_append_text(parameter_tree, " Length: %" PRIu64"l" "u", value);
8952 offset += len;
8953 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset,
8954 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8955 proto_item_append_text(parameter_tree, ", Offset: %" PRIu64"l" "u", value);
8956 offset += len;
8957 break;
8958 case SSL_HND_QUIC_TP_LOSS_BITS0x1057:
8959 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits,
8960 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8961 if (len > 0) {
8962 quic_add_loss_bits(pinfo, value);
8963 }
8964 offset += 1;
8965 break;
8966 case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY0x9f81a176:
8967 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery,
8968 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, NULL((void*)0), &len);
8969 offset += len;
8970 break;
8971 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD0xde1a:
8972 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V10xFF03DE1A:
8973 case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT050xff04de1a:
8974 case SSL_HND_QUIC_TP_MIN_ACK_DELAY0xff04de1b:
8975 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay,
8976 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
8977 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u", value);
8978 offset += len;
8979 break;
8980 case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT0x3129:
8981 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id,
8982 tvb, offset, parameter_length, ENC_ASCII0x00000000|ENC_NA0x00000000);
8983 offset += parameter_length;
8984 break;
8985 case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED0x312B:
8986 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported,
8987 tvb, offset, parameter_length, ENC_NA0x00000000);
8988 offset += parameter_length;
8989 break;
8990 case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION0x4752:
8991 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version,
8992 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
8993 offset += 4;
8994 if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */
8995 uint32_t versions_length;
8996
8997 proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length,
8998 tvb, offset, 1, ENC_NA0x00000000, &versions_length);
8999 offset += 1;
9000 for (i = 0; i < versions_length / 4; i++) {
9001 quic_proto_tree_add_version(tvb, parameter_tree,
9002 hf->hf.hs_ext_quictp_parameter_google_supported_version, offset);
9003 offset += 4;
9004 }
9005 }
9006 break;
9007 case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT0x3127:
9008 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt,
9009 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9010 proto_item_append_text(parameter_tree, " %" PRIu64"l" "u" " us", value);
9011 offset += len;
9012 break;
9013 case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE0x312A:
9014 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done,
9015 tvb, offset, parameter_length, ENC_NA0x00000000);
9016 offset += parameter_length;
9017 break;
9018 case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS0x4751:
9019 /* This field was used for non-standard Google-specific parameters encoded as a
9020 * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual
9021 * parameters. Report it as a bytes blob... */
9022 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params,
9023 tvb, offset, parameter_length, ENC_NA0x00000000);
9024 /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */
9025 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field,
9026 tvb, offset, 4, ENC_NA0x00000000);
9027 dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4);
9028 offset += parameter_length;
9029 break;
9030 case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS0x3128:
9031 proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options,
9032 tvb, offset, parameter_length, ENC_NA0x00000000);
9033 offset += parameter_length;
9034 break;
9035 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP0x7157:
9036 /* No Payload */
9037 break;
9038 case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V20x7158:
9039 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2,
9040 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9041 offset += parameter_length;
9042 break;
9043 case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT0xff73db:
9044 case SSL_HND_QUIC_TP_VERSION_INFORMATION0x11:
9045 quic_proto_tree_add_version(tvb, parameter_tree,
9046 hf->hf.hs_ext_quictp_parameter_chosen_version, offset);
9047 offset += 4;
9048 for (i = 4; i < parameter_length; i += 4) {
9049 quic_proto_tree_add_version(tvb, parameter_tree,
9050 hf->hf.hs_ext_quictp_parameter_other_version, offset);
9051 offset += 4;
9052 }
9053 break;
9054 case SSL_HND_QUIC_TP_GREASE_QUIC_BIT0x2ab2:
9055 /* No Payload */
9056 quic_add_grease_quic_bit(pinfo);
9057 break;
9058 case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY0xFF00:
9059 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability,
9060 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9061 offset += parameter_length;
9062 break;
9063 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT040x0f739bbc1b666d04:
9064 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath,
9065 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9066 if (value == 1) {
9067 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
9068 }
9069 offset += parameter_length;
9070 break;
9071 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT050x0f739bbc1b666d05:
9072 case SSL_HND_QUIC_TP_ENABLE_MULTIPATH0x0f739bbc1b666d06:
9073 /* No Payload */
9074 quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID1);
9075 break;
9076 case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS0x0f739bbc1b666d07:
9077 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths,
9078 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9079 if (value > 1) {
9080 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9081 }
9082 /* multipath draft-07: "The value of the initial_max_paths
9083 * parameter MUST be at least 2." TODO: Expert Info? */
9084 offset += parameter_length;
9085 break;
9086 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT090x0f739bbc1b666d09:
9087 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT110x0f739bbc1b666d11:
9088 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT120x0f739bbc1b666d0c:
9089 case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID0x0f739bbc1b666d0d:
9090 proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id,
9091 tvb, offset, -1, ENC_VARINT_QUIC0x00000004, &value, &len);
9092 /* multipath draft-09 and later: "If an endpoint receives an
9093 * initial_max_path_id transport parameter with value 0, the
9094 * peer aims to enable the multipath extension without allowing
9095 * extra paths immediately."
9096 */
9097 quic_add_multipath(pinfo, QUIC_MP_PATH_ID2);
9098 offset += parameter_length;
9099 break;
9100 default:
9101 offset += parameter_length;
9102 /*TODO display expert info about unknown ? */
9103 break;
9104 }
9105
9106 if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) {
9107 /* Dissection did not end at expected location, fix it. */
9108 offset = parameter_end_offset;
9109 }
9110 }
9111
9112 return offset;
9113}
9114
9115static int
9116ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9117 proto_tree *tree, uint32_t offset,
9118 SslSession *session, SslDecryptSession *ssl,
9119 bool_Bool from_server, bool_Bool is_hrr)
9120{
9121 uint8_t sessid_length;
9122 proto_item *ti;
9123 proto_tree *rnd_tree;
9124 proto_tree *ti_rnd;
9125 proto_tree *ech_confirm_tree;
9126 uint8_t draft_version = session->tls13_draft_version;
9127
9128 if (ssl) {
7
Assuming 'ssl' is non-null, which participates in a condition later
8
Taking true branch
9129 StringInfo *rnd;
9130 if (from_server
8.1
'from_server' is true
)
9
Taking true branch
9131 rnd = &ssl->server_random;
9132 else
9133 rnd = &ssl->client_random;
9134
9135 /* save provided random for later keyring generation */
9136 tvb_memcpy(tvb, rnd->data, offset, 32);
9137 rnd->data_len = 32;
9138 if (from_server
9.1
'from_server' is true
)
10
Taking true branch
9139 ssl->state |= SSL_SERVER_RANDOM(1<<1);
9140 else
9141 ssl->state |= SSL_CLIENT_RANDOM(1<<0);
9142 ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)),
9143 from_server
10.1
'from_server' is true
? "SERVER" : "CLIENT", ssl->state);
11
'?' condition is true
9144 }
9145
9146 if (!from_server
11.1
'from_server' is true
&& session->client_random.data_len == 0) {
9147 session->client_random.data_len = 32;
9148 tvb_memcpy(tvb, session->client_random.data, offset, 32);
9149 }
9150
9151 ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA0x00000000);
9152
9153 if ((session->version != TLSV1DOT3_VERSION0x304) && (session->version != DTLSV1DOT3_VERSION0xfefc)) { /* No time on first bytes random with TLS 1.3 */
12
Assuming field 'version' is not equal to TLSV1DOT3_VERSION
13
Assuming field 'version' is not equal to DTLSV1DOT3_VERSION
14
Taking true branch
9154
9155 rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9156 /* show the time */
9157 proto_tree_add_item(rnd_tree, hf->hf.hs_random_time,
9158 tvb, offset, 4, ENC_TIME_SECS0x00000012|ENC_BIG_ENDIAN0x00000000);
9159 offset += 4;
9160
9161 /* show the random bytes */
9162 proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes,
9163 tvb, offset, 28, ENC_NA0x00000000);
9164 offset += 28;
9165 } else {
9166 if (is_hrr) {
9167 proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)");
9168 } else if (from_server && session->ech) {
9169 ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random);
9170 proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA0x00000000);
9171 ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0,
9172 session->ech_confirmation, 8);
9173 proto_item_set_generated(ti);
9174 if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) {
9175 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
9176 } else {
9177 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
9178 }
9179 }
9180
9181 offset += 32;
9182 }
9183
9184 /* No Session ID with TLS 1.3 on Server Hello before draft -22 */
9185 if (from_server
14.1
'from_server' is not equal to 0
== 0 || !(session->version
14.2
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
15
Taking true branch
9186 /* show the session id (length followed by actual Session ID) */
9187 sessid_length = tvb_get_uint8(tvb, offset);
9188 proto_tree_add_item(tree, hf->hf.hs_session_id_len,
9189 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9190 offset++;
9191
9192 if (ssl
15.1
'ssl' is non-null, which participates in a condition later
) {
9193 /* save the authoritative SID for later use in ChangeCipherSpec.
9194 * (D)TLS restricts the SID to 32 chars, it does not make sense to
9195 * save more, so ignore larger ones. */
9196 if (from_server
15.2
'from_server' is true
&& sessid_length <= 32) {
16
Assuming 'sessid_length' is > 32
17
Taking false branch
9197 tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length);
9198 ssl->session_id.data_len = sessid_length;
9199 }
9200 }
9201 if (sessid_length
17.1
'sessid_length' is > 0
> 0) {
18
Taking true branch
9202 proto_tree_add_item(tree, hf->hf.hs_session_id,
9203 tvb, offset, sessid_length, ENC_NA0x00000000);
9204 offset += sessid_length;
9205 }
9206 }
9207
9208 return offset;
9209}
9210
9211static int
9212ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9213 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9214 bool_Bool has_length)
9215{
9216 /* TLS 1.2/1.3 status_request Client Hello Extension.
9217 * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type.
9218 * https://tools.ietf.org/html/rfc6066#section-8 (status_request)
9219 * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2)
9220 * struct {
9221 * CertificateStatusType status_type;
9222 * uint16 request_length; // for status_request_v2
9223 * select (status_type) {
9224 * case ocsp: OCSPStatusRequest;
9225 * case ocsp_multi: OCSPStatusRequest;
9226 * } request;
9227 * } CertificateStatusRequest; // CertificateStatusRequestItemV2
9228 *
9229 * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
9230 * struct {
9231 * ResponderID responder_id_list<0..2^16-1>;
9232 * Extensions request_extensions;
9233 * } OCSPStatusRequest;
9234 * opaque ResponderID<1..2^16-1>;
9235 * opaque Extensions<0..2^16-1>;
9236 */
9237 unsigned cert_status_type;
9238
9239 cert_status_type = tvb_get_uint8(tvb, offset);
9240 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type,
9241 tvb, offset, 1, ENC_NA0x00000000);
9242 offset++;
9243
9244 if (has_length) {
9245 proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len,
9246 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9247 offset += 2;
9248 }
9249
9250 switch (cert_status_type) {
9251 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9252 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9253 {
9254 uint32_t responder_id_list_len;
9255 uint32_t request_extensions_len;
9256
9257 /* ResponderID responder_id_list<0..2^16-1> */
9258 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len,
9259 hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX(65535))) {
9260 return offset_end;
9261 }
9262 offset += 2;
9263 if (responder_id_list_len != 0) {
9264 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9265 tvb, offset, responder_id_list_len,
9266 "Responder ID list is not implemented, contact Wireshark"
9267 " developers if you want this to be supported");
9268 }
9269 offset += responder_id_list_len;
9270
9271 /* opaque Extensions<0..2^16-1> */
9272 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len,
9273 hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX(65535))) {
9274 return offset_end;
9275 }
9276 offset += 2;
9277 if (request_extensions_len != 0) {
9278 proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded,
9279 tvb, offset, request_extensions_len,
9280 "Request Extensions are not implemented, contact"
9281 " Wireshark developers if you want this to be supported");
9282 }
9283 offset += request_extensions_len;
9284 break;
9285 }
9286 }
9287
9288 return offset;
9289}
9290
9291static unsigned
9292ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9293 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9294{
9295 /* https://tools.ietf.org/html/rfc6961#section-2.2
9296 * struct {
9297 * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>;
9298 * } CertificateStatusRequestListV2;
9299 */
9300 uint32_t req_list_length, next_offset;
9301
9302 /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */
9303 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length,
9304 hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX(65535))) {
9305 return offset_end;
9306 }
9307 offset += 2;
9308 next_offset = offset + req_list_length;
9309
9310 while (offset < next_offset) {
9311 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true1);
9312 }
9313
9314 return offset;
9315}
9316
9317static uint32_t
9318tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9319 uint32_t offset, uint32_t offset_end)
9320{
9321 uint32_t response_length;
9322 proto_item *ocsp_resp;
9323 proto_tree *ocsp_resp_tree;
9324 asn1_ctx_t asn1_ctx;
9325
9326 /* opaque OCSPResponse<1..2^24-1>; */
9327 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length,
9328 hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9329 return offset_end;
9330 }
9331 offset += 3;
9332
9333 ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset,
9334 response_length, ENC_BIG_ENDIAN0x00000000);
9335 proto_item_set_text(ocsp_resp, "OCSP Response");
9336 ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response);
9337 if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) {
9338 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
9339 dissect_ocsp_OCSPResponse(false0, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1);
9340 }
9341 offset += response_length;
9342
9343 return offset;
9344}
9345
9346uint32_t
9347tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9348 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9349{
9350 /* TLS 1.2 "CertificateStatus" handshake message.
9351 * TLS 1.3 "status_request" Certificate extension.
9352 * struct {
9353 * CertificateStatusType status_type;
9354 * select (status_type) {
9355 * case ocsp: OCSPResponse;
9356 * case ocsp_multi: OCSPResponseList; // status_request_v2
9357 * } response;
9358 * } CertificateStatus;
9359 * opaque OCSPResponse<1..2^24-1>;
9360 * struct {
9361 * OCSPResponse ocsp_response_list<1..2^24-1>;
9362 * } OCSPResponseList; // status_request_v2
9363 */
9364 uint32_t status_type, resp_list_length, next_offset;
9365
9366 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type,
9367 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &status_type);
9368 offset += 1;
9369
9370 switch (status_type) {
9371 case SSL_HND_CERT_STATUS_TYPE_OCSP1:
9372 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end);
9373 break;
9374
9375 case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI2:
9376 /* OCSPResponse ocsp_response_list<1..2^24-1> */
9377 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length,
9378 hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24((1U << 24) - 1))) {
9379 return offset_end;
9380 }
9381 offset += 3;
9382 next_offset = offset + resp_list_length;
9383
9384 while (offset < next_offset) {
9385 offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset);
9386 }
9387 break;
9388 }
9389
9390 return offset;
9391}
9392
9393static unsigned
9394ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9395 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9396 wmem_strbuf_t *ja3)
9397{
9398 /* RFC 8446 Section 4.2.7
9399 * enum { ..., (0xFFFF) } NamedGroup;
9400 * struct {
9401 * NamedGroup named_group_list<2..2^16-1>
9402 * } NamedGroupList;
9403 *
9404 * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and
9405 * the extension itself from "elliptic_curves" to "supported_groups".
9406 */
9407 uint32_t groups_length, next_offset;
9408 proto_tree *groups_tree;
9409 proto_item *ti;
9410 char *ja3_dash = "";
9411
9412 /* NamedGroup named_group_list<2..2^16-1> */
9413 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length,
9414 hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX(65535))) {
9415 return offset_end;
9416 }
9417 offset += 2;
9418 next_offset = offset + groups_length;
9419
9420 ti = proto_tree_add_none_format(tree,
9421 hf->hf.hs_ext_supported_groups,
9422 tvb, offset, groups_length,
9423 "Supported Groups (%d group%s)",
9424 groups_length / 2,
9425 plurality(groups_length/2, "", "s")((groups_length/2) == 1 ? ("") : ("s")));
9426
9427 /* make this a subtree */
9428 groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups);
9429
9430 if (ja3) {
9431 wmem_strbuf_append_c(ja3, ',');
9432 }
9433 /* loop over all groups */
9434 while (offset + 2 <= offset_end) {
9435 uint32_t ext_supported_group;
9436
9437 proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2,
9438 ENC_BIG_ENDIAN0x00000000, &ext_supported_group);
9439 offset += 2;
9440 if (ja3 && !IS_GREASE_TLS(ext_supported_group)((((ext_supported_group) & 0x0f0f) == 0x0a0a) && (
((ext_supported_group) & 0xff) == (((ext_supported_group)
>>8) & 0xff)))
) {
9441 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group);
9442 ja3_dash = "-";
9443 }
9444 }
9445 if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) {
9446 offset = next_offset;
9447 }
9448
9449 return offset;
9450}
9451
9452static int
9453ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9454 proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3)
9455{
9456 uint8_t ecpf_length;
9457 proto_tree *ecpf_tree;
9458 proto_item *ti;
9459
9460 ecpf_length = tvb_get_uint8(tvb, offset);
9461 proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len,
9462 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9463
9464 offset += 1;
9465 ti = proto_tree_add_none_format(tree,
9466 hf->hf.hs_ext_ec_point_formats,
9467 tvb, offset, ecpf_length,
9468 "Elliptic curves point formats (%d)",
9469 ecpf_length);
9470
9471 /* make this a subtree */
9472 ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats);
9473
9474 if (ja3) {
9475 wmem_strbuf_append_c(ja3, ',');
9476 }
9477
9478 /* loop over all point formats */
9479 while (ecpf_length > 0)
9480 {
9481 uint32_t ext_ec_point_format;
9482
9483 proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1,
9484 ENC_BIG_ENDIAN0x00000000, &ext_ec_point_format);
9485 offset++;
9486 ecpf_length--;
9487 if (ja3) {
9488 wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format);
9489 if (ecpf_length > 0) {
9490 wmem_strbuf_append_c(ja3, '-');
9491 }
9492 }
9493 }
9494
9495 return offset;
9496}
9497
9498static int
9499ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb,
9500 packet_info *pinfo, proto_tree *tree,
9501 uint32_t offset, uint32_t next_offset)
9502{
9503 /* https://tools.ietf.org/html/rfc5054#section-2.8.1
9504 * opaque srp_I<1..2^8-1>;
9505 */
9506 uint32_t username_len;
9507
9508 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len,
9509 hf->hf.hs_ext_srp_len, 1, UINT8_MAX(255))) {
9510 return next_offset;
9511 }
9512 offset++;
9513
9514 proto_tree_add_item(tree, hf->hf.hs_ext_srp_username,
9515 tvb, offset, username_len, ENC_UTF_80x00000002|ENC_NA0x00000000);
9516 offset += username_len;
9517
9518 return offset;
9519}
9520
9521static uint32_t
9522tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9523 uint32_t offset, uint32_t offset_end, uint16_t version)
9524{
9525 /* https://tools.ietf.org/html/rfc6962#section-3.2
9526 * enum { v1(0), (255) } Version;
9527 * struct {
9528 * opaque key_id[32];
9529 * } LogID;
9530 * opaque CtExtensions<0..2^16-1>;
9531 * struct {
9532 * Version sct_version;
9533 * LogID id;
9534 * uint64 timestamp;
9535 * CtExtensions extensions;
9536 * digitally-signed struct { ... };
9537 * } SignedCertificateTimestamp;
9538 */
9539 uint32_t sct_version;
9540 uint64_t sct_timestamp_ms;
9541 nstime_t sct_timestamp;
9542 uint32_t exts_len;
9543 const char *log_name;
9544
9545 proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA0x00000000, &sct_version);
9546 offset++;
9547 if (sct_version != 0) {
9548 // TODO expert info about unknown SCT version?
9549 return offset;
9550 }
9551 proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN0x00000000);
9552 log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log");
9553 proto_item_append_text(tree, " (%s)", log_name);
9554 offset += 32;
9555 sct_timestamp_ms = tvb_get_ntoh64(tvb, offset);
9556 sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000);
9557 sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000);
9558 proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp);
9559 offset += 8;
9560 /* opaque CtExtensions<0..2^16-1> */
9561 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
9562 hf->hf.sct_sct_extensions_length, 0, UINT16_MAX(65535))) {
9563 return offset_end;
9564 }
9565 offset += 2;
9566 if (exts_len > 0) {
9567 proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN0x00000000);
9568 offset += exts_len;
9569 }
9570 offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
9571 hf->hf.sct_sct_signature_length,
9572 hf->hf.sct_sct_signature);
9573 return offset;
9574}
9575
9576uint32_t
9577tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9578 uint32_t offset, uint32_t offset_end, uint16_t version)
9579{
9580 /* https://tools.ietf.org/html/rfc6962#section-3.3
9581 * opaque SerializedSCT<1..2^16-1>;
9582 * struct {
9583 * SerializedSCT sct_list <1..2^16-1>;
9584 * } SignedCertificateTimestampList;
9585 */
9586 uint32_t list_length, sct_length, next_offset;
9587 proto_tree *subtree;
9588
9589 /* SerializedSCT sct_list <1..2^16-1> */
9590 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length,
9591 hf->hf.sct_scts_length, 1, UINT16_MAX(65535))) {
9592 return offset_end;
9593 }
9594 offset += 2;
9595
9596 while (offset < offset_end) {
9597 subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL((void*)0), "Signed Certificate Timestamp");
9598
9599 /* opaque SerializedSCT<1..2^16-1> */
9600 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length,
9601 hf->hf.sct_sct_length, 1, UINT16_MAX(65535))) {
9602 return offset_end;
9603 }
9604 offset += 2;
9605 next_offset = offset + sct_length;
9606 proto_item_set_len(subtree, 2 + sct_length);
9607 offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version);
9608 if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) {
9609 offset = next_offset;
9610 }
9611 }
9612
9613 return offset;
9614}
9615
9616static int
9617dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U___attribute__((unused)),
9618 proto_tree *tree, uint32_t offset)
9619{
9620 uint32_t kdf_id, aead_id;
9621 proto_item *cs_ti;
9622 proto_tree *cs_tree;
9623
9624 cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite,
9625 tvb, offset, 4, ENC_NA0x00000000);
9626 cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite);
9627
9628 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id,
9629 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &kdf_id);
9630 offset += 2;
9631 proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id,
9632 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &aead_id);
9633 offset += 2;
9634
9635 proto_item_append_text(cs_ti, ": %s/%s",
9636 val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"),
9637 val_to_str_const(aead_id, aead_id_type_vals, "Unknown"));
9638 return offset;
9639}
9640
9641static int
9642dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9643 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9644 uint32_t *config_id)
9645{
9646 uint32_t length, cipher_suite_length;
9647 proto_item *kc_ti, *css_ti;
9648 proto_tree *kc_tree, *css_tree;
9649 uint32_t original_offset = offset, next_offset;
9650
9651 kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig,
9652 tvb, offset, -1, ENC_NA0x00000000);
9653 kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig);
9654
9655 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id,
9656 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, config_id);
9657 offset += 1;
9658 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id,
9659 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9660 offset += 2;
9661 proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length,
9662 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9663 offset += 2;
9664 proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key,
9665 tvb, offset, length, ENC_NA0x00000000);
9666 offset += length;
9667
9668 /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */
9669 if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length,
9670 hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX(65535) - 3)) {
9671 return offset_end;
9672 }
9673 offset += 2;
9674 next_offset = offset + cipher_suite_length;
9675
9676 css_ti = proto_tree_add_none_format(kc_tree,
9677 hf->hf.ech_hpke_keyconfig_cipher_suites,
9678 tvb, offset, cipher_suite_length,
9679 "Cipher Suites (%d suite%s)",
9680 cipher_suite_length / 4,
9681 plurality(cipher_suite_length / 4, "", "s")((cipher_suite_length / 4) == 1 ? ("") : ("s")));
9682 css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites);
9683
9684
9685 while (offset + 4 <= next_offset) {
9686 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset);
9687 }
9688
9689 if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) {
9690 offset = next_offset;
9691 }
9692
9693 proto_item_set_len(kc_ti, offset - original_offset);
9694
9695 return offset;
9696}
9697
9698static int
9699dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9700 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9701 const uint8_t **public_name, uint32_t *config_id)
9702{
9703 uint32_t public_name_length, extensions_length, next_offset;
9704
9705 offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id);
9706 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length,
9707 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9708 offset += 1;
9709 proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length,
9710 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &public_name_length);
9711 offset += 1;
9712 proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name,
9713 tvb, offset, public_name_length, ENC_ASCII0x00000000, pinfo->pool, public_name);
9714 offset += public_name_length;
9715
9716 /* Extension extensions<0..2^16-1>; */
9717 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length,
9718 hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX(65535))) {
9719 return offset_end;
9720 }
9721 offset += 2;
9722 next_offset = offset + extensions_length;
9723
9724 if (extensions_length > 0) {
9725 proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions,
9726 tvb, offset, extensions_length, ENC_NA0x00000000);
9727 }
9728 offset += extensions_length;
9729
9730 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9731 offset = next_offset;
9732 }
9733
9734 return offset;
9735}
9736
9737static int
9738dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9739 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9740{
9741 uint32_t version, length;
9742 proto_item *ech_ti;
9743 proto_tree *ech_tree;
9744 const uint8_t *public_name = NULL((void*)0);
9745 uint32_t config_id = 0;
9746
9747 ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA0x00000000);
9748 ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig);
9749
9750 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version,
9751 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
9752 offset += 2;
9753 proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length,
9754 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9755 offset += 2;
9756
9757 proto_item_set_len(ech_ti, 4 + length);
9758
9759 switch(version) {
9760 case 0xfe0d:
9761 dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id);
9762 proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name);
9763 break;
9764
9765 default:
9766 expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version);
9767 }
9768
9769 return 4 + length;
9770}
9771
9772uint32_t
9773ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9774 proto_tree *tree, uint32_t offset, uint32_t offset_end)
9775{
9776 uint32_t echconfiglist_length, next_offset;
9777
9778 /* ECHConfig ECHConfigList<1..2^16-1>; */
9779 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length,
9780 hf->hf.ech_echconfiglist_length, 1, UINT16_MAX(65535))) {
9781 return offset_end;
9782 }
9783 offset += 2;
9784 next_offset = offset + echconfiglist_length;
9785
9786 while (offset < next_offset) {
9787 offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end);
9788 }
9789
9790 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) {
9791 offset = next_offset;
9792 }
9793
9794 return offset;
9795}
9796
9797static uint32_t
9798ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
9799 uint32_t offset, uint32_t offset_end)
9800{
9801 uint32_t ext_length, next_offset;
9802 proto_tree *ext_tree;
9803 proto_item *ti;
9804
9805 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length,
9806 hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX(255))) {
9807 return offset_end;
9808 }
9809 offset += 1;
9810 next_offset = offset + ext_length;
9811
9812 ti = proto_tree_add_none_format(tree,
9813 hf->hf.hs_ext_ech_outer_ext,
9814 tvb, offset, ext_length,
9815 "Outer Extensions (%d extension%s)",
9816 ext_length / 2,
9817 plurality(ext_length/2, "", "s")((ext_length/2) == 1 ? ("") : ("s")));
9818
9819 ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext);
9820
9821 while (offset + 2 <= offset_end) {
9822 proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
9823 offset += 2;
9824 }
9825
9826 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
9827 offset = next_offset;
9828 }
9829
9830 return offset;
9831}
9832
9833static uint32_t
9834// NOLINTNEXTLINE(misc-no-recursion)
9835ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
9836 proto_tree *tree, uint32_t offset, uint32_t offset_end,
9837 uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
9838 uint32_t initial_offset, uint32_t hello_length)
9839{
9840 uint32_t ch_type, length;
9841 proto_item *ti, *payload_ti;
9842 proto_tree *retry_tree, *payload_tree;
9843
9844 switch (hnd_type) {
9845 case SSL_HND_CLIENT_HELLO:
9846 /*
9847 * enum { outer(0), inner(1) } ECHClientHelloType;
9848 *
9849 * struct {
9850 * ECHClientHelloType type;
9851 * select (ECHClientHello.type) {
9852 * case outer:
9853 * HpkeSymmetricCipherSuite cipher_suite;
9854 * uint8 config_id;
9855 * opaque enc<0..2^16-1>;
9856 * opaque payload<1..2^16-1>;
9857 * case inner:
9858 * Empty;
9859 * };
9860 * } ECHClientHello;
9861 */
9862
9863 proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000, &ch_type);
9864 offset += 1;
9865 switch (ch_type) {
9866 case 0: /* outer */
9867 if (ssl && session->first_ch_ech_frame == 0) {
9868 session->first_ch_ech_frame = pinfo->num;
9869 }
9870 offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset);
9871 uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4);
9872 uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2);
9873
9874 proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
9875 uint8_t config_id = tvb_get_uint8(tvb, offset);
9876 offset += 1;
9877 proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9878 offset += 2;
9879 proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA0x00000000);
9880 offset += length;
9881 proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &length);
9882 offset += 2;
9883 payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA0x00000000);
9884 offset += length;
9885
9886 if (!mk_map) {
9887 break;
9888 }
9889 if (session->client_random.data_len == 0) {
9890 ssl_debug_printf("%s missing Client Random\n", G_STRFUNC((const char*) (__func__)));
9891 break;
9892 }
9893 StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random);
9894 StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random);
9895 if (!ech_secret || !ech_config) {
9896 ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n",
9897 G_STRFUNC((const char*) (__func__)));
9898 break;
9899 }
9900
9901 if (hpke_hkdf_len(kdf_id) == 0) {
9902 ssl_debug_printf("Unsupported KDF\n");
9903 break;
9904 }
9905
9906 if (hpke_aead_key_len(aead_id) == 0) {
9907 ssl_debug_printf("Unsupported AEAD\n");
9908 break;
9909 }
9910
9911 size_t aead_nonce_len = hpke_aead_nonce_len(aead_id);
9912
9913 uint16_t version = GUINT16_FROM_BE(*(uint16_t *)ech_config->data)(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)ech_config
->data) >> 8) | (guint16) ((guint16) (*(uint16_t *)ech_config
->data) << 8))))))
;
9914 if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037) {
9915 ssl_debug_printf("Unexpected version in ECH Config\n");
9916 break;
9917 }
9918 uint32_t ech_config_offset = 2;
9919 if (GUINT16_FROM_BE(*(uint16_t *)(ech_config->data + ech_config_offset))(((((guint16) ( (guint16) ((guint16) (*(uint16_t *)(ech_config
->data + ech_config_offset)) >> 8) | (guint16) ((guint16
) (*(uint16_t *)(ech_config->data + ech_config_offset)) <<
8))))))
!= ech_config->data_len - 4) {
9920 ssl_debug_printf("Malformed ECH Config, invalid length\n");
9921 break;
9922 }
9923 ech_config_offset += 2;
9924 if (*(ech_config->data + ech_config_offset) != config_id) {
9925 ssl_debug_printf("ECH Config version mismatch\n");
9926 break;
9927 }
9928 ech_config_offset += 1;
9929 uint16_t kem_id_be = *(uint16_t *)(ech_config->data + ech_config_offset);
9930 uint16_t kem_id = GUINT16_FROM_BE(kem_id_be)(((((guint16) ( (guint16) ((guint16) (kem_id_be) >> 8) |
(guint16) ((guint16) (kem_id_be) << 8))))))
;
9931 uint8_t suite_id[HPKE_SUIT_ID_LEN10];
9932 hpke_suite_id(kem_id, kdf_id, aead_id, suite_id);
9933 GByteArray *info = g_byte_array_new();
9934 g_byte_array_append(info, "tls ech", 8);
9935 g_byte_array_append(info, ech_config->data, ech_config->data_len);
9936 uint8_t key[AEAD_MAX_KEY_LENGTH32];
9937 uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH12];
9938 if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE0,
9939 key, base_nonce)) {
9940 g_byte_array_free(info, TRUE(!(0)));
9941 break;
9942 }
9943 g_byte_array_free(info, TRUE(!(0)));
9944 gcry_cipher_hd_t cipher;
9945 if (hpke_setup_aead(&cipher, aead_id, key) ||
9946 hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) {
9947 gcry_cipher_close(cipher);
9948 break;
9949 }
9950 const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length);
9951 uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL((void*)0), hello_length);
9952 tvb_memcpy(tvb, ech_aad, initial_offset, hello_length);
9953 memset(ech_aad + offset - length - initial_offset, 0, length);
9954 if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) {
9955 gcry_cipher_close(cipher);
9956 wmem_free(NULL((void*)0), ech_aad);
9957 break;
9958 }
9959 wmem_free(NULL((void*)0), ech_aad);
9960 uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, length - 16);
9961 if (gcry_cipher_decrypt(cipher, ech_decrypted_data, length - 16, payload, length - 16)) {
9962 gcry_cipher_close(cipher);
9963 break;
9964 }
9965 unsigned char ech_auth_tag_calc[16];
9966 if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, 16)) {
9967 gcry_cipher_close(cipher);
9968 break;
9969 }
9970 if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num)
9971 memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, 16);
9972 gcry_cipher_close(cipher);
9973 if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag,
9974 payload + length - 16, 16)) {
9975 ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC((const char*) (__func__)));
9976 } else {
9977 payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt);
9978 tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, length - 16, length - 16);
9979 add_new_data_source(pinfo, ech_tvb, "Client Hello Inner");
9980 if (ssl) {
9981 tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32);
9982 uint32_t len_offset = ssl->ech_transcript.data_len;
9983 if (ssl->ech_transcript.data_len > 0)
9984 ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
9985 ssl->ech_transcript.data_len + hello_length + 4);
9986 else
9987 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4);
9988 ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO;
9989 ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0;
9990 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34);
9991 ssl->ech_transcript.data_len += 38;
9992 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset + 34,
9993 tvb_get_uint8(tvb, initial_offset + 34) + 1);
9994 ssl->ech_transcript.data_len += tvb_get_uint8(tvb, initial_offset + 34) + 1;
9995 uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34);
9996 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
9997 2 + tvb_get_ntohs(ech_tvb, ech_offset));
9998 ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
9999 ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset);
10000 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
10001 1 + tvb_get_uint8(ech_tvb, ech_offset));
10002 ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset);
10003 ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset);
10004 uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len;
10005 ssl->ech_transcript.data_len += 2;
10006 uint16_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2;
10007 ech_offset += 2;
10008 while (extensions_end - ech_offset >= 4) {
10009 if (tvb_get_ntohs(ech_tvb, ech_offset) != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768) {
10010 tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset,
10011 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2));
10012 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
10013 ech_offset += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2);
10014 } else if (tvb_get_ntohs(ech_tvb, ech_offset + 2) > 0) {
10015 uint8_t outer_extensions_end = tvb_get_uint8(ech_tvb, ech_offset + 4) + ech_offset + 5;
10016 ech_offset += 5;
10017 uint16_t outer_offset = initial_offset + 35 + tvb_get_uint8(tvb, initial_offset + 34);
10018 outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2;
10019 outer_offset += tvb_get_uint8(tvb, outer_offset) + 3;
10020 while (outer_extensions_end - ech_offset >= 2) {
10021 while (hello_length - outer_offset >= 4) {
10022 if (tvb_get_ntohs(tvb, outer_offset) == tvb_get_ntohs(ech_tvb, ech_offset)) {
10023 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset,
10024 4 + tvb_get_ntohs(tvb, outer_offset + 2));
10025 ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
10026 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
10027 break;
10028 } else {
10029 outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2);
10030 }
10031 }
10032 ech_offset += 2;
10033 }
10034 }
10035 }
10036 uint16_t ech_extensions_len_be = GUINT16_TO_BE(ssl->ech_transcript.data_len - ech_extensions_len_offset - 2)((((guint16) ( (guint16) ((guint16) (ssl->ech_transcript.data_len
- ech_extensions_len_offset - 2) >> 8) | (guint16) ((guint16
) (ssl->ech_transcript.data_len - ech_extensions_len_offset
- 2) << 8)))))
;
10037 *(ssl->ech_transcript.data + ech_extensions_len_offset) = ech_extensions_len_be & 0xff;
10038 *(ssl->ech_transcript.data + ech_extensions_len_offset + 1) = (ech_extensions_len_be >> 8);
10039 *(ssl->ech_transcript.data + len_offset + 2) = ((ssl->ech_transcript.data_len - len_offset - 4) >> 8);
10040 *(ssl->ech_transcript.data + len_offset + 3) = (ssl->ech_transcript.data_len - len_offset - 4) & 0xff;
10041 }
10042 uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, length - 16, session,
10043 ssl, NULL((void*)0), mk_map);
10044 if (ech_padding_begin < length - 16) {
10045 proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, length - 16 - ech_padding_begin,
10046 ENC_NA0x00000000);
10047 }
10048 }
10049
10050 break;
10051 case 1: /* inner */
10052 break;
10053 }
10054 break;
10055
10056 case SSL_HND_ENCRYPTED_EXTENSIONS:
10057 /*
10058 * struct {
10059 * ECHConfigList retry_configs;
10060 * } ECHEncryptedExtensions;
10061 */
10062
10063 ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA0x00000000);
10064 retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs);
10065 offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end);
10066 break;
10067
10068 case SSL_HND_HELLO_RETRY_REQUEST:
10069 /*
10070 * struct {
10071 * opaque confirmation[8];
10072 * } ECHHelloRetryRequest;
10073 */
10074
10075 proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA0x00000000);
10076 if (session->ech) {
10077 ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8);
10078 proto_item_set_generated(ti);
10079 if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) {
10080 expert_add_info(pinfo, ti, &hf->ei.ech_rejected);
10081 } else {
10082 expert_add_info(pinfo, ti, &hf->ei.ech_accepted);
10083 }
10084 }
10085 offset += 8;
10086 break;
10087 }
10088
10089 return offset;
10090}
10091
10092static uint32_t
10093ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10094 proto_tree *tree, uint32_t offset, uint32_t offset_end,
10095 uint8_t hnd_type, SslDecryptSession *ssl _U___attribute__((unused)))
10096{
10097 uint32_t record_digest_length, encrypted_sni_length;
10098
10099 switch (hnd_type) {
10100 case SSL_HND_CLIENT_HELLO:
10101 /*
10102 * struct {
10103 * CipherSuite suite;
10104 * KeyShareEntry key_share;
10105 * opaque record_digest<0..2^16-1>;
10106 * opaque encrypted_sni<0..2^16-1>;
10107 * } ClientEncryptedSNI;
10108 */
10109 proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
10110 offset += 2;
10111 offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL((void*)0));
10112
10113 /* opaque record_digest<0..2^16-1> */
10114 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length,
10115 hf->hf.esni_record_digest_length, 0, UINT16_MAX(65535))) {
10116 return offset_end;
10117 }
10118 offset += 2;
10119 if (record_digest_length > 0) {
10120 proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA0x00000000);
10121 offset += record_digest_length;
10122 }
10123
10124 /* opaque encrypted_sni<0..2^16-1> */
10125 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length,
10126 hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX(65535))) {
10127 return offset_end;
10128 }
10129 offset += 2;
10130 if (encrypted_sni_length > 0) {
10131 proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA0x00000000);
10132 offset += encrypted_sni_length;
10133 }
10134 break;
10135
10136 case SSL_HND_ENCRYPTED_EXTENSIONS:
10137 proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA0x00000000);
10138 offset += 16;
10139 break;
10140 }
10141
10142 return offset;
10143}
10144/** TLS Extensions (in Client Hello and Server Hello). }}} */
10145
10146/* Connection ID dissection. {{{ */
10147static uint32_t
10148ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10149 proto_tree *tree, uint32_t offset, SslDecryptSession *ssl,
10150 uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl)
10151{
10152 /* keep track of the decrypt session only for the first pass */
10153 if (cidl > 0 && !PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
10154 tvb_ensure_bytes_exist(tvb, offset + 1, cidl);
10155 *session_cidl = cidl;
10156 *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl);
10157 tvb_memcpy(tvb, *session_cid, offset + 1, cidl);
10158 if (ssl) {
10159 ssl_add_session_by_cid(ssl);
10160 }
10161 }
10162
10163 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length,
10164 tvb, offset, 1, ENC_NA0x00000000);
10165 offset++;
10166
10167 if (cidl > 0) {
10168 proto_tree_add_item(tree, hf->hf.hs_ext_connection_id,
10169 tvb, offset, cidl, ENC_NA0x00000000);
10170 offset += cidl;
10171 }
10172
10173 return offset;
10174}
10175
10176static uint32_t
10177ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
10178 proto_tree *tree, uint32_t offset, uint8_t hnd_type,
10179 SslSession *session, SslDecryptSession *ssl)
10180{
10181 uint8_t cidl = tvb_get_uint8(tvb, offset);
10182
10183 switch (hnd_type) {
10184 case SSL_HND_CLIENT_HELLO:
10185 session->client_cid_len_present = true1;
10186 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10187 cidl, &session->client_cid, &session->client_cid_len);
10188 case SSL_HND_SERVER_HELLO:
10189 session->server_cid_len_present = true1;
10190 return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl,
10191 cidl, &session->server_cid, &session->server_cid_len);
10192 default:
10193 return offset;
10194 }
10195} /* }}} */
10196
10197/* Trusted CA dissection. {{{ */
10198static uint32_t
10199ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
10200 uint32_t offset, uint32_t offset_end)
10201{
10202 proto_item *ti;
10203 proto_tree *subtree;
10204 uint32_t keys_length, next_offset;
10205
10206 /*
10207 * struct {
10208 * TrustedAuthority trusted_authorities_list<0..2^16-1>;
10209 * } TrustedAuthorities;
10210 *
10211 * struct {
10212 * IdentifierType identifier_type;
10213 * select (identifier_type) {
10214 * case pre_agreed: struct {};
10215 * case key_sha1_hash: SHA1Hash;
10216 * case x509_name: DistinguishedName;
10217 * case cert_sha1_hash: SHA1Hash;
10218 * } identifier;
10219 * } TrustedAuthority;
10220 *
10221 * enum {
10222 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10223 * cert_sha1_hash(3), (255)
10224 * } IdentifierType;
10225 *
10226 * opaque DistinguishedName<1..2^16-1>;
10227 *
10228 */
10229
10230
10231 /* TrustedAuthority trusted_authorities_list<0..2^16-1> */
10232 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len,
10233 0, UINT16_MAX(65535)))
10234 {
10235 return offset_end;
10236 }
10237 offset += 2;
10238 next_offset = offset + keys_length;
10239
10240 if (keys_length > 0)
10241 {
10242 ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length,
10243 "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")((keys_length) == 1 ? ("") : ("s")));
10244 subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys);
10245
10246 while (offset < next_offset)
10247 {
10248 uint32_t identifier_type;
10249 proto_tree *trusted_key_tree;
10250 proto_item *trusted_key_item;
10251 asn1_ctx_t asn1_ctx;
10252 uint32_t key_len = 0;
10253
10254 identifier_type = tvb_get_uint8(tvb, offset);
10255
10256 // Use 0 as length for now as we'll only know the size when we decode the identifier
10257 trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb,
10258 offset, 0, "Trusted CA Key");
10259 trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key);
10260
10261 proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb,
10262 offset, 1, identifier_type);
10263 offset++;
10264
10265 /*
10266 * enum {
10267 * pre_agreed(0), key_sha1_hash(1), x509_name(2),
10268 * cert_sha1_hash(3), (255)
10269 * } IdentifierType;
10270 */
10271 switch (identifier_type)
10272 {
10273 case 0:
10274 key_len = 0;
10275 break;
10276 case 2:
10277 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
10278
10279 uint32_t name_length;
10280 /* opaque DistinguishedName<1..2^16-1> */
10281 if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length,
10282 hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX(65535))) {
10283 return next_offset;
10284 }
10285 offset += 2;
10286
10287 dissect_x509if_DistinguishedName(false0, tvb, offset, &asn1_ctx,
10288 trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname);
10289 offset += name_length;
10290 break;
10291 case 1:
10292 case 3:
10293 key_len = 20;
10294 /* opaque SHA1Hash[20]; */
10295 proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb,
10296 offset, 20, ENC_NA0x00000000);
10297 break;
10298
10299 default:
10300 key_len = 0;
10301 /*TODO display expert info about unknown ? */
10302 break;
10303 }
10304 proto_item_set_len(trusted_key_item, 1 + key_len);
10305 offset += key_len;
10306 }
10307 }
10308
10309 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset))
10310 {
10311 offset = next_offset;
10312 }
10313
10314 return offset;
10315} /* }}} */
10316
10317
10318/* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */
10319bool_Bool
10320ssl_is_valid_content_type(uint8_t type)
10321{
10322 switch ((ContentType) type) {
10323 case SSL_ID_CHG_CIPHER_SPEC:
10324 case SSL_ID_ALERT:
10325 case SSL_ID_HANDSHAKE:
10326 case SSL_ID_APP_DATA:
10327 case SSL_ID_HEARTBEAT:
10328 case SSL_ID_TLS12_CID:
10329 case SSL_ID_DTLS13_ACK:
10330 return true1;
10331 }
10332 return false0;
10333}
10334
10335bool_Bool
10336ssl_is_valid_handshake_type(uint8_t hs_type, bool_Bool is_dtls)
10337{
10338 switch ((HandshakeType) hs_type) {
10339 case SSL_HND_HELLO_VERIFY_REQUEST:
10340 /* hello_verify_request is DTLS-only */
10341 return is_dtls;
10342
10343 case SSL_HND_HELLO_REQUEST:
10344 case SSL_HND_CLIENT_HELLO:
10345 case SSL_HND_SERVER_HELLO:
10346 case SSL_HND_NEWSESSION_TICKET:
10347 case SSL_HND_END_OF_EARLY_DATA:
10348 case SSL_HND_HELLO_RETRY_REQUEST:
10349 case SSL_HND_ENCRYPTED_EXTENSIONS:
10350 case SSL_HND_CERTIFICATE:
10351 case SSL_HND_SERVER_KEY_EXCHG:
10352 case SSL_HND_CERT_REQUEST:
10353 case SSL_HND_SVR_HELLO_DONE:
10354 case SSL_HND_CERT_VERIFY:
10355 case SSL_HND_CLIENT_KEY_EXCHG:
10356 case SSL_HND_FINISHED:
10357 case SSL_HND_CERT_URL:
10358 case SSL_HND_CERT_STATUS:
10359 case SSL_HND_SUPPLEMENTAL_DATA:
10360 case SSL_HND_KEY_UPDATE:
10361 case SSL_HND_COMPRESSED_CERTIFICATE:
10362 case SSL_HND_ENCRYPTED_EXTS:
10363 return true1;
10364 case SSL_HND_MESSAGE_HASH:
10365 return false0;
10366 }
10367 return false0;
10368}
10369
10370static bool_Bool
10371ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type,
10372 bool_Bool is_dtls)
10373{
10374 /* Consider all valid Handshake messages (except for Client Hello) and
10375 * all other valid record types (other than Handshake) */
10376 return (content_type == SSL_ID_HANDSHAKE &&
10377 ssl_is_valid_handshake_type(handshake_type, is_dtls) &&
10378 handshake_type != SSL_HND_CLIENT_HELLO) ||
10379 (content_type != SSL_ID_HANDSHAKE &&
10380 ssl_is_valid_content_type(content_type));
10381}
10382
10383/**
10384 * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3
10385 * draft 22 and newer, it also checks whether it is a HelloRetryRequest.
10386 * Returns true if the supported_versions extension was found, false if not.
10387 */
10388bool_Bool
10389tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
10390 uint16_t *server_version, bool_Bool *is_hrr)
10391{
10392 /* SHA256("HelloRetryRequest") */
10393 static const uint8_t tls13_hrr_random_magic[] = {
10394 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
10395 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
10396 };
10397 uint8_t session_id_length;
10398
10399 *server_version = tvb_get_ntohs(tvb, offset);
10400
10401 /*
10402 * Try to look for supported_versions extension. Minimum length:
10403 * 2 + 32 + 1 = 35 (version, random, session id length)
10404 * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10405 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10406 *
10407 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10408 * there's a separate expert info warning for that.
10409 */
10410 if ((*server_version == TLSV1DOT2_VERSION0x303 || *server_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10411 offset += 2;
10412 if (is_hrr) {
10413 *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0;
10414 }
10415 offset += 32;
10416 session_id_length = tvb_get_uint8(tvb, offset);
10417 offset++;
10418 if (offset_end - offset < session_id_length + 5u) {
10419 return false0;
10420 }
10421 offset += session_id_length + 5;
10422
10423 while (offset_end - offset >= 6) {
10424 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10425 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10426 if (offset_end - offset < 4u + ext_len) {
10427 break; /* not enough data for type, length and data */
10428 }
10429 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10430 if (ext_len == 2) {
10431 *server_version = tvb_get_ntohs(tvb, offset + 4);
10432 }
10433 return true1;
10434 }
10435 offset += 4 + ext_len;
10436 }
10437 } else {
10438 if (is_hrr) {
10439 *is_hrr = false0;
10440 }
10441 }
10442 return false0;
10443}
10444
10445/**
10446 * Scan a Client Hello handshake message to see if the supported_versions
10447 * extension is found, in which case the version field is legacy_version.
10448 */
10449static bool_Bool
10450tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end)
10451{
10452 uint8_t session_id_length;
10453
10454 uint16_t client_version = tvb_get_ntohs(tvb, offset);
10455
10456 /*
10457 * Try to look for supported_versions extension. Minimum length:
10458 * 2 + 32 + 1 = 35 (version, random, session id length)
10459 * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length)
10460 * 2 + 2 + 2 = 6 (ext type, ext len, version)
10461 *
10462 * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3,
10463 * there's a separate expert info warning for that.
10464 */
10465 if ((client_version == TLSV1DOT2_VERSION0x303 || client_version == DTLSV1DOT2_VERSION0xfefd) && offset_end - offset >= 46) {
10466 offset += 2;
10467 offset += 32;
10468 session_id_length = tvb_get_uint8(tvb, offset);
10469 offset++;
10470 if (offset_end - offset < session_id_length + 2u) {
10471 return false0;
10472 }
10473 offset += session_id_length;
10474 if (client_version == DTLSV1DOT2_VERSION0xfefd) {
10475 uint8_t cookie_length = tvb_get_uint8(tvb, offset);
10476 offset++;
10477 if (offset_end - offset < cookie_length + 2u) {
10478 return false0;
10479 }
10480 }
10481 uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset);
10482 offset += 2;
10483 if (offset_end - offset < cipher_suites_length + 1u) {
10484 return false0;
10485 }
10486 offset += cipher_suites_length;
10487 uint8_t compression_methods_length = tvb_get_uint8(tvb, offset);
10488 offset++;
10489 if (offset_end - offset < compression_methods_length + 2u) {
10490 return false0;
10491 }
10492 offset += compression_methods_length + 2;
10493
10494 while (offset_end - offset >= 6) {
10495 uint16_t ext_type = tvb_get_ntohs(tvb, offset);
10496 uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2);
10497 if (offset_end - offset < 4u + ext_len) {
10498 break; /* not enough data for type, length and data */
10499 }
10500 if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43) {
10501 return true1;
10502 }
10503 offset += 4 + ext_len;
10504 }
10505 }
10506 return false0;
10507}
10508void
10509ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
10510 uint8_t content_type, uint8_t handshake_type,
10511 bool_Bool is_dtls, uint16_t version)
10512{
10513 uint8_t tls13_draft = 0;
10514
10515 if (!ssl_is_authoritative_version_message(content_type, handshake_type,
10516 is_dtls))
10517 return;
10518
10519 version = tls_try_get_version(is_dtls, version, &tls13_draft);
10520 if (version == SSL_VER_UNKNOWN0) {
10521 return;
10522 }
10523
10524 session->tls13_draft_version = tls13_draft;
10525 session->version = version;
10526 if (ssl) {
10527 ssl->state |= SSL_VERSION(1<<4);
10528 ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), version, ssl->state);
10529 }
10530}
10531
10532void
10533ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
10534 ContentType content_type,
10535 unsigned record_length, proto_item *length_pi,
10536 uint16_t version, tvbuff_t *decrypted_tvb)
10537{
10538 unsigned max_expansion;
10539 if (version == TLSV1DOT3_VERSION0x304) {
10540 /* TLS 1.3: Max length is 2^14 + 256 */
10541 max_expansion = 256;
10542 } else {
10543 /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */
10544 max_expansion = 2048;
10545 }
10546 /*
10547 * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert
10548 * and ChangeCipherSpec.
10549 * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments,
10550 * so assume it is permitted.
10551 * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so
10552 * assume TLS 1.2 requirements.
10553 */
10554 if (record_length == 0 &&
10555 (content_type == SSL_ID_CHG_CIPHER_SPEC ||
10556 content_type == SSL_ID_ALERT ||
10557 content_type == SSL_ID_HANDSHAKE)) {
10558 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10559 "Zero-length %s fragments are not allowed",
10560 val_to_str_const(content_type, ssl_31_content_type, "unknown"));
10561 }
10562 if (record_length > TLS_MAX_RECORD_LENGTH0x4000 + max_expansion) {
10563 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10564 "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion);
10565 }
10566 if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH0x4000) {
10567 expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid,
10568 "TLSPlaintext length MUST NOT exceed 2^14");
10569 }
10570}
10571
10572static void
10573ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher)
10574{
10575 /* store selected cipher suite for decryption */
10576 ssl->session.cipher = cipher;
10577
10578 const SslCipherSuite *cs = ssl_find_cipher(cipher);
10579 if (!cs) {
10580 ssl->cipher_suite = NULL((void*)0);
10581 ssl->state &= ~SSL_CIPHER(1<<2);
10582 ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10583 } else if (ssl->session.version == SSLV3_VERSION0x300 && !(cs->dig == DIG_MD50x40 || cs->dig == DIG_SHA0x41)) {
10584 /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2
10585 * cipher suite that uses for example MACAlgorithm SHA256. Reject that
10586 * to avoid a potential buffer overflow in ssl3_check_mac. */
10587 ssl->cipher_suite = NULL((void*)0);
10588 ssl->state &= ~SSL_CIPHER(1<<2);
10589 ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC((const char*) (__func__)), cipher);
10590 } else {
10591 /* Cipher found, save this for the delayed decoder init */
10592 ssl->cipher_suite = cs;
10593 ssl->state |= SSL_CIPHER(1<<2);
10594 ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC((const char*) (__func__)), cipher,
10595 val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"),
10596 ssl->state);
10597 }
10598}
10599/* }}} */
10600
10601
10602/* Client Hello and Server Hello dissections. {{{ */
10603static int
10604ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
10605 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
10606 SslSession *session, SslDecryptSession *ssl,
10607 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
10608 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length);
10609int
10610// NOLINTNEXTLINE(misc-no-recursion)
10611ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10612 packet_info *pinfo, proto_tree *tree, uint32_t offset,
10613 uint32_t offset_end, SslSession *session,
10614 SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map)
10615{
10616 /* struct {
10617 * ProtocolVersion client_version;
10618 * Random random;
10619 * SessionID session_id;
10620 * opaque cookie<0..32>; //new field for DTLS
10621 * CipherSuite cipher_suites<2..2^16-1>;
10622 * CompressionMethod compression_methods<1..2^8-1>;
10623 * Extension client_hello_extension_list<0..2^16-1>;
10624 * } ClientHello;
10625 */
10626 proto_item *ti;
10627 proto_tree *cs_tree;
10628 uint32_t client_version;
10629 uint32_t cipher_suite_length;
10630 uint32_t compression_methods_length;
10631 uint8_t compression_method;
10632 uint32_t next_offset;
10633 uint32_t initial_offset = offset;
10634 uint32_t hello_length = offset_end - initial_offset;
10635 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10636 char *ja3_hash;
10637 char *ja3_dash = "";
10638 char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c;
10639 ja4_data_t ja4_data;
10640 wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, "");
10641 wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, "");
10642 wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, "");
10643 wmem_list_frame_t *curr_entry;
10644
10645 ja4_data.max_version = 0;
10646 ja4_data.server_name_present = false0;
10647 ja4_data.num_cipher_suites = 0;
10648 ja4_data.num_extensions = 0;
10649 ja4_data.alpn = wmem_strbuf_new(pinfo->pool, "");
10650 ja4_data.cipher_list = wmem_list_new(pinfo->pool);
10651 ja4_data.extension_list = wmem_list_new(pinfo->pool);
10652 ja4_data.sighash_list = wmem_list_new(pinfo->pool);
10653
10654 /* show the client version */
10655 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, tvb,
10656 offset, 2, ENC_BIG_ENDIAN0x00000000,
10657 &client_version);
10658 if (tls_scan_client_hello(tvb, offset, offset_end)) {
10659 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10660 }
10661 offset += 2;
10662 wmem_strbuf_append_printf(ja3, "%i,", client_version);
10663
10664 /*
10665 * Is it version 1.3?
10666 * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim
10667 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10668 * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client
10669 * Hello".
10670 */
10671 if (dtls_hfs != NULL((void*)0)) {
10672 if (client_version == DTLSV1DOT3_VERSION0xfefc) {
10673 /* Don't do that. */
10674 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10675 }
10676 } else {
10677 if (client_version == TLSV1DOT3_VERSION0x304) {
10678 /* Don't do that. */
10679 expert_add_info(pinfo, ti, &hf->ei.client_version_error);
10680 }
10681 }
10682
10683 /* dissect fields that are present in both ClientHello and ServerHello */
10684 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, false0, false0);
10685
10686 /* fields specific for DTLS (cookie_len, cookie) */
10687 if (dtls_hfs != NULL((void*)0)) {
10688 uint32_t cookie_length;
10689 /* opaque cookie<0..32> (for DTLS only) */
10690 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length,
10691 dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) {
10692 return offset;
10693 }
10694 offset++;
10695 if (cookie_length > 0) {
10696 proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie,
10697 tvb, offset, cookie_length, ENC_NA0x00000000);
10698 offset += cookie_length;
10699 }
10700 }
10701
10702 /* CipherSuite cipher_suites<2..2^16-1> */
10703 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cipher_suite_length,
10704 hf->hf.hs_cipher_suites_len, 2, UINT16_MAX(65535))) {
10705 return offset;
10706 }
10707 offset += 2;
10708 next_offset = offset + cipher_suite_length;
10709 ti = proto_tree_add_none_format(tree,
10710 hf->hf.hs_cipher_suites,
10711 tvb, offset, cipher_suite_length,
10712 "Cipher Suites (%d suite%s)",
10713 cipher_suite_length / 2,
10714 plurality(cipher_suite_length/2, "", "s")((cipher_suite_length/2) == 1 ? ("") : ("s")));
10715 cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites);
10716 while (offset + 2 <= next_offset) {
10717 uint32_t cipher_suite;
10718
10719 proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, tvb, offset, 2,
10720 ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10721 offset += 2;
10722 if (!IS_GREASE_TLS(cipher_suite)((((cipher_suite) & 0x0f0f) == 0x0a0a) && (((cipher_suite
) & 0xff) == (((cipher_suite)>>8) & 0xff)))
) {
10723 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite);
10724 ja3_dash = "-";
10725 ja4_data.num_cipher_suites += 1;
10726 wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite)((gpointer) (gulong) (cipher_suite)), wmem_compare_uint);
10727 }
10728 }
10729 wmem_strbuf_append_c(ja3, ',');
10730 if (!ssl_end_vector(hf, tvb, pinfo, cs_tree, offset, next_offset)) {
10731 offset = next_offset;
10732 }
10733
10734 /* CompressionMethod compression_methods<1..2^8-1> */
10735 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compression_methods_length,
10736 hf->hf.hs_comp_methods_len, 1, UINT8_MAX(255))) {
10737 return offset;
10738 }
10739 offset++;
10740 next_offset = offset + compression_methods_length;
10741 ti = proto_tree_add_none_format(tree,
10742 hf->hf.hs_comp_methods,
10743 tvb, offset, compression_methods_length,
10744 "Compression Methods (%u method%s)",
10745 compression_methods_length,
10746 plurality(compression_methods_length,((compression_methods_length) == 1 ? ("") : ("s"))
10747 "", "s")((compression_methods_length) == 1 ? ("") : ("s")));
10748 cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods);
10749 while (offset < next_offset) {
10750 compression_method = tvb_get_uint8(tvb, offset);
10751 /* TODO: make reserved/private comp meth. fields selectable */
10752 if (compression_method < 64)
10753 proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method,
10754 tvb, offset, 1, compression_method);
10755 else if (compression_method > 63 && compression_method < 193)
10756 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10757 compression_method, "Reserved - to be assigned by IANA (%u)",
10758 compression_method);
10759 else
10760 proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1,
10761 compression_method, "Private use range (%u)",
10762 compression_method);
10763 offset++;
10764 }
10765
10766 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10767 if (offset < offset_end) {
10768 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10769 offset_end, SSL_HND_CLIENT_HELLO,
10770 session, ssl, dtls_hfs != NULL((void*)0), ja3, &ja4_data, mk_map, initial_offset, hello_length);
10771 if (ja4_data.max_version > 0) {
10772 client_version = ja4_data.max_version;
10773 }
10774 } else {
10775 wmem_strbuf_append_printf(ja3, ",,");
10776 }
10777
10778 if (proto_is_frame_protocol(pinfo->layers,"tcp")) {
10779 wmem_strbuf_append(ja4_a, "t");
10780 } else if (proto_is_frame_protocol(pinfo->layers,"quic")) {
10781 wmem_strbuf_append(ja4_a, "q");
10782 } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) {
10783 wmem_strbuf_append(ja4_a, "d");
10784 }
10785 wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00"));
10786 wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i");
10787 if (ja4_data.num_cipher_suites > 99) {
10788 wmem_strbuf_append(ja4_a, "99");
10789 } else {
10790 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites);
10791 }
10792 if (ja4_data.num_extensions > 99) {
10793 wmem_strbuf_append(ja4_a, "99");
10794 } else {
10795 wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions);
10796 }
10797 if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) {
10798 wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn));
10799 } else {
10800 wmem_strbuf_append(ja4_a, "00");
10801 }
10802
10803 curr_entry = wmem_list_head(ja4_data.cipher_list);
10804 for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) {
10805 wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10806 if (i < wmem_list_count(ja4_data.cipher_list) - 1) {
10807 wmem_strbuf_append(ja4_br, ",");
10808 }
10809 curr_entry = wmem_list_frame_next(curr_entry);
10810 }
10811
10812 curr_entry = wmem_list_head(ja4_data.extension_list);
10813 for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) {
10814 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10815 if (i < wmem_list_count(ja4_data.extension_list) - 1) {
10816 wmem_strbuf_append(ja4_cr, ",");
10817 }
10818 curr_entry = wmem_list_frame_next(curr_entry);
10819 }
10820
10821 if (wmem_list_count(ja4_data.sighash_list) > 0) {
10822 wmem_strbuf_append(ja4_cr, "_");
10823 curr_entry = wmem_list_head(ja4_data.sighash_list);
10824 for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) {
10825 wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))((guint) (gulong) (wmem_list_frame_data(curr_entry))));
10826 if (i < wmem_list_count(ja4_data.sighash_list) - 1) {
10827 wmem_strbuf_append(ja4_cr, ",");
10828 }
10829 curr_entry = wmem_list_frame_next(curr_entry);
10830 }
10831 }
10832 if ( wmem_strbuf_get_len(ja4_br) == 0 ) {
10833 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10834 } else {
10835 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1);
10836 }
10837 ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12);
10838
10839 g_free(ja4_hash);
10840 if ( wmem_strbuf_get_len(ja4_cr) == 0 ) {
10841 ja4_hash = g_strdup("000000000000")g_strdup_inline ("000000000000");
10842 } else {
10843 ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1);
10844 }
10845 ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12);
10846 g_free(ja4_hash);
10847
10848 ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c);
10849 ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr));
10850
10851 ti = proto_tree_add_string(tree, hf->hf.hs_ja4, tvb, offset, 0, ja4);
10852 proto_item_set_generated(ti);
10853 ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, tvb, offset, 0, ja4_r);
10854 proto_item_set_generated(ti);
10855
10856 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
10857 wmem_strbuf_get_len(ja3));
10858 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
10859 proto_item_set_generated(ti);
10860 ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, tvb, offset, 0, ja3_hash);
10861 proto_item_set_generated(ti);
10862 g_free(ja3_hash);
10863 return offset;
10864}
10865
10866void
10867ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
10868 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
10869 SslSession *session, SslDecryptSession *ssl,
10870 bool_Bool is_dtls, bool_Bool is_hrr)
10871{
10872 /* struct {
10873 * ProtocolVersion server_version;
10874 * Random random;
10875 * SessionID session_id; // TLS 1.2 and before
10876 * CipherSuite cipher_suite;
10877 * CompressionMethod compression_method; // TLS 1.2 and before
10878 * Extension server_hello_extension_list<0..2^16-1>;
10879 * } ServerHello;
10880 */
10881 uint8_t draft_version = session->tls13_draft_version;
10882 proto_item *ti;
10883 uint32_t server_version;
10884 uint32_t cipher_suite;
10885 uint32_t initial_offset = offset;
10886 wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, "");
10887 char *ja3_hash;
10888
10889 col_set_str(pinfo->cinfo, COL_PROTOCOL,
10890 val_to_str_const(session->version, ssl_version_short_names, "SSL"));
10891
10892 /* Initially assume that the session is resumed. If this is not the case, a
10893 * ServerHelloDone will be observed before the ChangeCipherSpec message
10894 * which will reset this flag. */
10895 session->is_session_resumed = true1;
10896
10897 /* show the server version */
10898 ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
10899 offset, 2, ENC_BIG_ENDIAN0x00000000, &server_version);
10900
10901 uint16_t supported_server_version;
10902 if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL((void*)0))) {
1
Taking false branch
10903 expert_add_info(pinfo, ti, &hf->ei.legacy_version);
10904 }
10905 /*
10906 * Is it version 1.3?
10907 * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim
10908 * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446
10909 * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server
10910 * Hello".
10911 */
10912 if (is_dtls) {
2
Assuming 'is_dtls' is false
3
Taking false branch
10913 if (server_version == DTLSV1DOT3_VERSION0xfefc) {
10914 /* Don't do that. */
10915 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10916 }
10917 } else {
10918 if (server_version == TLSV1DOT3_VERSION0x304) {
4
Assuming 'server_version' is not equal to TLSV1DOT3_VERSION
5
Taking false branch
10919 /* Don't do that. */
10920 expert_add_info(pinfo, ti, &hf->ei.server_version_error);
10921 }
10922 }
10923
10924 offset += 2;
10925 wmem_strbuf_append_printf(ja3, "%i", server_version);
10926
10927 /* dissect fields that are present in both ClientHello and ServerHello */
10928 offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true1, is_hrr);
6
Calling 'ssl_dissect_hnd_hello_common'
19
Returning from 'ssl_dissect_hnd_hello_common'
10929
10930 if (ssl
19.1
'ssl' is non-null
) {
20
Taking true branch
10931 /* store selected cipher suite for decryption */
10932 ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset));
10933 }
10934
10935 /* now the server-selected cipher suite */
10936 proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite,
10937 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &cipher_suite);
10938 offset += 2;
10939 wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite);
10940
10941 /* No compression with TLS 1.3 before draft -22 */
10942 if (!(session->version
20.1
Field 'version' is not equal to TLSV1DOT3_VERSION
== TLSV1DOT3_VERSION0x304 && draft_version > 0 && draft_version < 22)) {
21
Taking true branch
10943 if (ssl
21.1
'ssl' is non-null
) {
22
Taking true branch
10944 /* store selected compression method for decryption */
10945 ssl->session.compression = tvb_get_uint8(tvb, offset);
10946 }
10947 /* and the server-selected compression method */
10948 proto_tree_add_item(tree, hf->hf.hs_comp_method,
10949 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
10950 offset++;
10951 }
10952
10953 /* SSL v3.0 has no extensions, so length field can indeed be missing. */
10954 if (offset < offset_end) {
23
Assuming 'offset' is >= 'offset_end'
10955 offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
10956 offset_end,
10957 is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO,
10958 session, ssl, is_dtls, ja3, NULL((void*)0), NULL((void*)0), 0, 0);
10959 }
10960
10961 if (ssl
23.1
'ssl' is non-null
&& ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER(1<<2)) && ssl->client_random.data_len > 0) {
24
Assuming field 'data_len' is > 0
25
Assuming the condition is true
26
Assuming field 'data_len' is > 0
27
Taking true branch
10962 int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name);
10963 if (hash_algo) {
28
Assuming 'hash_algo' is not equal to 0
29
Taking true branch
10964 SSL_MDgcry_md_hd_t mc;
10965 unsigned char transcript_hash[DIGEST_MAX_SIZE48];
10966 unsigned char prk[DIGEST_MAX_SIZE48];
10967 unsigned char *ech_verify_out = NULL((void*)0);
10968 unsigned int len;
10969 ssl_md_init(&mc, hash_algo);
10970 ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len);
10971 if (is_hrr) {
30
Assuming 'is_hrr' is false
31
Taking false branch
10972 ssl_md_final(&mc, transcript_hash, &len);
10973 ssl_md_cleanup(&mc);
10974 wmem_free(wmem_file_scope(), ssl->ech_transcript.data);
10975 ssl->ech_transcript.data_len = 4 + len;
10976 ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset);
10977 ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH;
10978 ssl->ech_transcript.data[1] = 0;
10979 ssl->ech_transcript.data[2] = 0;
10980 ssl->ech_transcript.data[3] = len;
10981 memcpy(ssl->ech_transcript.data + 4, transcript_hash, len);
10982 ssl_md_init(&mc, hash_algo);
10983 ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len);
10984 } else {
10985 ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data,
10986 ssl->ech_transcript.data_len + 4 + offset_end - initial_offset);
10987 }
10988 if (initial_offset > 4) {
32
Assuming 'initial_offset' is > 4
33
Taking true branch
10989 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4,
10990 4 + offset_end - initial_offset);
10991 if (is_hrr
33.1
'is_hrr' is false
)
34
Taking false branch
10992 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset-4, 38), 38);
10993 else
10994 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset-4, 30), 30);
10995 } else {
10996 uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00};
10997 prefix[2] = ((offset - initial_offset) >> 8);
10998 prefix[3] = (offset - initial_offset) & 0xff;
10999 memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4);
11000 tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset,
11001 offset_end - initial_offset);
11002 ssl_md_update(&mc, prefix, 4);
11003 if (is_hrr)
11004 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset, 34), 34);
11005 else
11006 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset, 26), 26);
11007 }
11008 ssl->ech_transcript.data_len += 4 + offset_end - initial_offset;
11009 uint8_t zeros[8] = { 0 };
11010 uint32_t confirmation_offset = initial_offset + 26;
11011 if (is_hrr
34.1
'is_hrr' is false
) {
35
Taking false branch
11012 uint32_t hrr_offset = initial_offset + 34;
11013 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset,
11014 tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1);
11015 hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1;
11016 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 3), 3);
11017 hrr_offset += 3;
11018 uint16_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2;
11019 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 2), 2);
11020 hrr_offset += 2;
11021 while (extensions_end - hrr_offset >= 4) {
11022 if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037 &&
11023 tvb_get_ntohs(tvb, hrr_offset + 2) == 8) {
11024 confirmation_offset = hrr_offset + 4;
11025 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, 4), 4);
11026 ssl_md_update(&mc, zeros, 8);
11027 hrr_offset += 12;
11028 } else {
11029 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4),
11030 tvb_get_ntohs(tvb, hrr_offset + 2) + 4);
11031 hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4;
11032 }
11033 }
11034 } else {
11035 ssl_md_update(&mc, zeros, 8);
11036 ssl_md_update(&mc, (unsigned char *)tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34),
11037 offset - initial_offset - 34);
11038 }
11039 ssl_md_final(&mc, transcript_hash, &len);
11040 ssl_md_cleanup(&mc);
11041 hkdf_extract(hash_algo, NULL((void*)0), 0, ssl->client_random.data, 32, prk);
11042 StringInfo prk_string = {prk, len};
11043 tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl),
37
Calling 'tls13_hkdf_expand_label_context'
43
Returning from 'tls13_hkdf_expand_label_context'
11044 is_hrr
35.1
'is_hrr' is false
? "hrr ech accept confirmation" : "ech accept confirmation",
36
'?' condition is false
11045 transcript_hash, len, 8, &ech_verify_out);
11046 memcpy(is_hrr
43.1
'is_hrr' is false
? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8);
44
'?' condition is false
45
Null pointer passed to 2nd parameter expecting 'nonnull'
11047 if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) {
11048 if (is_hrr) {
11049 ssl->session.hrr_ech_declined = true1;
11050 ssl->session.first_ch_ech_frame = 0;
11051 }
11052 memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len);
11053 ssl_print_data("Updated Client Random", ssl->client_random.data, 32);
11054 }
11055 wmem_free(NULL((void*)0), ech_verify_out);
11056 ssl->session.ech = true1;
11057 }
11058 }
11059
11060 ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3),
11061 wmem_strbuf_get_len(ja3));
11062 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3));
11063 proto_item_set_generated(ti);
11064 ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash);
11065 proto_item_set_generated(ti);
11066 g_free(ja3_hash);
11067}
11068/* Client Hello and Server Hello dissections. }}} */
11069
11070/* New Session Ticket dissection. {{{ */
11071void
11072ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11073 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11074 SslSession *session, SslDecryptSession *ssl,
11075 bool_Bool is_dtls, GHashTable *session_hash)
11076{
11077 /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0):
11078 * struct {
11079 * uint32 ticket_lifetime_hint;
11080 * opaque ticket<0..2^16-1>;
11081 * } NewSessionTicket;
11082 *
11083 * RFC 8446 Section 4.6.1 (TLS 1.3):
11084 * struct {
11085 * uint32 ticket_lifetime;
11086 * uint32 ticket_age_add;
11087 * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22
11088 * opaque ticket<1..2^16-1>;
11089 * Extension extensions<0..2^16-2>;
11090 * } NewSessionTicket;
11091 */
11092 proto_tree *subtree;
11093 proto_item *subitem;
11094 uint32_t ticket_len;
11095 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc;
11096 unsigned char draft_version = session->tls13_draft_version;
11097 uint32_t lifetime_hint;
11098
11099 subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
11100 hf->ett.session_ticket, NULL((void*)0),
11101 "TLS Session Ticket");
11102
11103 /* ticket lifetime hint */
11104 subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint,
11105 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000, &lifetime_hint);
11106 offset += 4;
11107
11108 if (lifetime_hint >= 60) {
11109 char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint);
11110 proto_item_append_text(subitem, " (%s)", time_str);
11111 }
11112
11113 if (is_tls13) {
11114
11115 /* for TLS 1.3: ticket_age_add */
11116 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add,
11117 tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);
11118 offset += 4;
11119
11120 /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/
11121 if (draft_version == 0 || draft_version >= 21) {
11122 uint32_t ticket_nonce_len;
11123
11124 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len,
11125 hf->hf.hs_session_ticket_nonce_len, 0, 255)) {
11126 return;
11127 }
11128 offset++;
11129
11130 proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA0x00000000);
11131 offset += ticket_nonce_len;
11132 }
11133
11134 }
11135
11136 /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */
11137 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len,
11138 hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX(65535))) {
11139 return;
11140 }
11141 offset += 2;
11142
11143 /* Content depends on implementation, so just show data! */
11144 proto_tree_add_item(subtree, hf->hf.hs_session_ticket,
11145 tvb, offset, ticket_len, ENC_NA0x00000000);
11146 /* save the session ticket to cache for ssl_finalize_decryption */
11147 if (ssl && !is_tls13) {
11148 tvb_ensure_bytes_exist(tvb, offset, ticket_len);
11149 ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(),
11150 ssl->session_ticket.data, ticket_len);
11151 ssl->session_ticket.data_len = ticket_len;
11152 tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len);
11153 /* NewSessionTicket is received after the first (client)
11154 * ChangeCipherSpec, and before the second (server) ChangeCipherSpec.
11155 * Since the second CCS has already the session key available it will
11156 * just return. To ensure that the session ticket is mapped to a
11157 * master key (from the first CCS), save the ticket here too. */
11158 ssl_save_master_key("Session Ticket", session_hash,
11159 &ssl->session_ticket, &ssl->master_secret);
11160 ssl->state |= SSL_NEW_SESSION_TICKET(1<<10);
11161 }
11162 offset += ticket_len;
11163
11164 if (is_tls13) {
11165 ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11166 offset_end, SSL_HND_NEWSESSION_TICKET,
11167 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11168 }
11169} /* }}} */
11170
11171void
11172ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11173 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11174 SslSession *session, SslDecryptSession *ssl,
11175 bool_Bool is_dtls)
11176{
11177 /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4
11178 * struct {
11179 * ProtocolVersion server_version;
11180 * CipherSuite cipher_suite; // not before draft -19
11181 * Extension extensions<2..2^16-1>;
11182 * } HelloRetryRequest;
11183 * Note: no longer used since draft -22
11184 */
11185 uint32_t version;
11186 uint8_t draft_version;
11187
11188 proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb,
11189 offset, 2, ENC_BIG_ENDIAN0x00000000, &version);
11190 draft_version = extract_tls13_draft_version(version);
11191 offset += 2;
11192
11193 if (draft_version == 0 || draft_version >= 19) {
11194 proto_tree_add_item(tree, hf->hf.hs_cipher_suite,
11195 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11196 offset += 2;
11197 }
11198
11199 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11200 offset_end, SSL_HND_HELLO_RETRY_REQUEST,
11201 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11202}
11203
11204void
11205ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11206 packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end,
11207 SslSession *session, SslDecryptSession *ssl,
11208 bool_Bool is_dtls)
11209{
11210 /* RFC 8446 Section 4.3.1
11211 * struct {
11212 * Extension extensions<0..2^16-1>;
11213 * } EncryptedExtensions;
11214 */
11215 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11216 offset_end, SSL_HND_ENCRYPTED_EXTENSIONS,
11217 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11218}
11219
11220/* Certificate and Certificate Request dissections. {{{ */
11221void
11222ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11223 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11224 SslSession *session, SslDecryptSession *ssl _U___attribute__((unused)),
11225 bool_Bool is_from_server, bool_Bool is_dtls)
11226{
11227 /* opaque ASN.1Cert<1..2^24-1>;
11228 *
11229 * Before RFC 8446 (TLS <= 1.2):
11230 * struct {
11231 * select(certificate_type) {
11232 *
11233 * // certificate type defined in RFC 7250
11234 * case RawPublicKey:
11235 * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
11236 *
11237 * // X.509 certificate defined in RFC 5246
11238 * case X.509:
11239 * ASN.1Cert certificate_list<0..2^24-1>;
11240 * };
11241 * } Certificate;
11242 *
11243 * RFC 8446 (since draft -20):
11244 * struct {
11245 * select(certificate_type){
11246 * case RawPublicKey:
11247 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
11248 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
11249 *
11250 * case X.509:
11251 * opaque cert_data<1..2^24-1>;
11252 * }
11253 * Extension extensions<0..2^16-1>;
11254 * } CertificateEntry;
11255 * struct {
11256 * opaque certificate_request_context<0..2^8-1>;
11257 * CertificateEntry certificate_list<0..2^24-1>;
11258 * } Certificate;
11259 */
11260 enum { CERT_X509, CERT_RPK } cert_type;
11261 asn1_ctx_t asn1_ctx;
11262#if defined(HAVE_LIBGNUTLS1)
11263 gnutls_datum_t subjectPublicKeyInfo = { NULL((void*)0), 0 };
11264 unsigned certificate_index = 0;
11265#endif
11266 uint32_t next_offset, certificate_list_length, cert_length;
11267 proto_tree *subtree = tree;
11268
11269 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11270
11271 if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2) ||
11272 (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY2)) {
11273 cert_type = CERT_RPK;
11274 } else {
11275 cert_type = CERT_X509;
11276 }
11277
11278#if defined(HAVE_LIBGNUTLS1)
11279 /* Ask the pkcs1 dissector to return the public key details */
11280 if (ssl)
11281 asn1_ctx.private_data = &subjectPublicKeyInfo;
11282#endif
11283
11284 /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */
11285 if (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc) {
11286 uint32_t context_length;
11287 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11288 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11289 return;
11290 }
11291 offset++;
11292 if (context_length > 0) {
11293 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11294 tvb, offset, context_length, ENC_NA0x00000000);
11295 offset += context_length;
11296 }
11297 }
11298
11299 if ((session->version != TLSV1DOT3_VERSION0x304 && session->version != DTLSV1DOT3_VERSION0xfefc) && cert_type == CERT_RPK) {
11300 /* For RPK before TLS 1.3, the single RPK is stored directly without
11301 * another "certificate_list" field. */
11302 certificate_list_length = offset_end - offset;
11303 next_offset = offset_end;
11304 } else {
11305 /* CertificateEntry certificate_list<0..2^24-1> */
11306 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length,
11307 hf->hf.hs_certificates_len, 0, G_MAXUINT24((1U << 24) - 1))) {
11308 return;
11309 }
11310 offset += 3; /* 24-bit length value */
11311 next_offset = offset + certificate_list_length;
11312 }
11313
11314 /* RawPublicKey must have one cert, but X.509 can have multiple. */
11315 if (certificate_list_length > 0 && cert_type == CERT_X509) {
11316 proto_item *ti;
11317
11318 ti = proto_tree_add_none_format(tree,
11319 hf->hf.hs_certificates,
11320 tvb, offset, certificate_list_length,
11321 "Certificates (%u bytes)",
11322 certificate_list_length);
11323
11324 /* make it a subtree */
11325 subtree = proto_item_add_subtree(ti, hf->ett.certificates);
11326 }
11327
11328 while (offset < next_offset) {
11329 switch (cert_type) {
11330 case CERT_RPK:
11331 /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */
11332 /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */
11333 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11334 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11335 return;
11336 }
11337 offset += 3;
11338
11339 dissect_x509af_SubjectPublicKeyInfo(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11340 offset += cert_length;
11341 break;
11342 case CERT_X509:
11343 /* opaque ASN1Cert<1..2^24-1> */
11344 if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length,
11345 hf->hf.hs_certificate_len, 1, G_MAXUINT24((1U << 24) - 1))) {
11346 return;
11347 }
11348 offset += 3;
11349
11350 dissect_x509af_Certificate(false0, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate);
11351#if defined(HAVE_LIBGNUTLS1)
11352 if (is_from_server && ssl && certificate_index == 0) {
11353 ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo);
11354 /* Only attempt to get the RSA modulus for the first cert. */
11355 asn1_ctx.private_data = NULL((void*)0);
11356 }
11357#endif
11358 offset += cert_length;
11359 break;
11360 }
11361
11362 /* TLS 1.3: Extension extensions<0..2^16-1> */
11363 if ((session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc)) {
11364 offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset,
11365 next_offset, SSL_HND_CERTIFICATE,
11366 session, ssl, is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11367 }
11368
11369#if defined(HAVE_LIBGNUTLS1)
11370 certificate_index++;
11371#endif
11372 }
11373}
11374
11375void
11376ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11377 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11378 SslSession *session, bool_Bool is_dtls)
11379{
11380 /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty):
11381 * enum {
11382 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11383 * (255)
11384 * } ClientCertificateType;
11385 *
11386 * opaque DistinguishedName<1..2^16-1>;
11387 *
11388 * struct {
11389 * ClientCertificateType certificate_types<1..2^8-1>;
11390 * DistinguishedName certificate_authorities<3..2^16-1>;
11391 * } CertificateRequest;
11392 *
11393 *
11394 * As per TLSv1.2 (RFC 5246) the format has changed to:
11395 *
11396 * enum {
11397 * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
11398 * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
11399 * fortezza_dms_RESERVED(20), (255)
11400 * } ClientCertificateType;
11401 *
11402 * enum {
11403 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
11404 * sha512(6), (255)
11405 * } HashAlgorithm;
11406 *
11407 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
11408 * SignatureAlgorithm;
11409 *
11410 * struct {
11411 * HashAlgorithm hash;
11412 * SignatureAlgorithm signature;
11413 * } SignatureAndHashAlgorithm;
11414 *
11415 * SignatureAndHashAlgorithm
11416 * supported_signature_algorithms<2..2^16-2>;
11417 *
11418 * opaque DistinguishedName<1..2^16-1>;
11419 *
11420 * struct {
11421 * ClientCertificateType certificate_types<1..2^8-1>;
11422 * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>;
11423 * DistinguishedName certificate_authorities<0..2^16-1>;
11424 * } CertificateRequest;
11425 *
11426 * draft-ietf-tls-tls13-18:
11427 * struct {
11428 * opaque certificate_request_context<0..2^8-1>;
11429 * SignatureScheme
11430 * supported_signature_algorithms<2..2^16-2>;
11431 * DistinguishedName certificate_authorities<0..2^16-1>;
11432 * CertificateExtension certificate_extensions<0..2^16-1>;
11433 * } CertificateRequest;
11434 *
11435 * RFC 8446 (since draft-ietf-tls-tls13-19):
11436 *
11437 * struct {
11438 * opaque certificate_request_context<0..2^8-1>;
11439 * Extension extensions<2..2^16-1>;
11440 * } CertificateRequest;
11441 */
11442 proto_item *ti;
11443 proto_tree *subtree;
11444 uint32_t next_offset;
11445 asn1_ctx_t asn1_ctx;
11446 bool_Bool is_tls13 = (session->version == TLSV1DOT3_VERSION0x304 || session->version == DTLSV1DOT3_VERSION0xfefc);
11447 unsigned char draft_version = session->tls13_draft_version;
11448
11449 if (!tree)
11450 return;
11451
11452 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true1, pinfo);
11453
11454 if (is_tls13) {
11455 uint32_t context_length;
11456 /* opaque certificate_request_context<0..2^8-1> */
11457 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length,
11458 hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX(255))) {
11459 return;
11460 }
11461 offset++;
11462 if (context_length > 0) {
11463 proto_tree_add_item(tree, hf->hf.hs_certificate_request_context,
11464 tvb, offset, context_length, ENC_NA0x00000000);
11465 offset += context_length;
11466 }
11467 } else {
11468 uint32_t cert_types_count;
11469 /* ClientCertificateType certificate_types<1..2^8-1> */
11470 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count,
11471 hf->hf.hs_cert_types_count, 1, UINT8_MAX(255))) {
11472 return;
11473 }
11474 offset++;
11475 next_offset = offset + cert_types_count;
11476
11477 ti = proto_tree_add_none_format(tree,
11478 hf->hf.hs_cert_types,
11479 tvb, offset, cert_types_count,
11480 "Certificate types (%u type%s)",
11481 cert_types_count,
11482 plurality(cert_types_count, "", "s")((cert_types_count) == 1 ? ("") : ("s")));
11483 subtree = proto_item_add_subtree(ti, hf->ett.cert_types);
11484
11485 while (offset < next_offset) {
11486 proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11487 offset++;
11488 }
11489 }
11490
11491 if (session->version == TLSV1DOT2_VERSION0x303 || session->version == DTLSV1DOT2_VERSION0xfefd ||
11492 (is_tls13 && (draft_version > 0 && draft_version < 19))) {
11493 offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL((void*)0));
11494 }
11495
11496 if (is_tls13 && (draft_version == 0 || draft_version >= 19)) {
11497 /*
11498 * TLS 1.3 draft 19 and newer: Extensions.
11499 * SslDecryptSession pointer is NULL because Certificate Extensions
11500 * should not influence decryption state.
11501 */
11502 ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset,
11503 offset_end, SSL_HND_CERT_REQUEST,
11504 session, NULL((void*)0), is_dtls, NULL((void*)0), NULL((void*)0), NULL((void*)0), 0, 0);
11505 } else if (is_tls13 && draft_version <= 18) {
11506 /*
11507 * TLS 1.3 draft 18 and older: certificate_authorities and
11508 * certificate_extensions (a vector of OID mappings).
11509 */
11510 offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11511 ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end);
11512 } else {
11513 /* for TLS 1.2 and older, the certificate_authorities field. */
11514 tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end);
11515 }
11516}
11517/* Certificate and Certificate Request dissections. }}} */
11518
11519void
11520ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
11521 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version)
11522{
11523 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
11524 hf->hf.hs_client_cert_vrfy_sig_len,
11525 hf->hf.hs_client_cert_vrfy_sig);
11526}
11527
11528/* Finished dissection. {{{ */
11529void
11530ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
11531 proto_tree *tree, uint32_t offset, uint32_t offset_end,
11532 const SslSession *session, ssl_hfs_t *ssl_hfs)
11533{
11534 /* For SSLv3:
11535 * struct {
11536 * opaque md5_hash[16];
11537 * opaque sha_hash[20];
11538 * } Finished;
11539 *
11540 * For (D)TLS:
11541 * struct {
11542 * opaque verify_data[12];
11543 * } Finished;
11544 *
11545 * For TLS 1.3:
11546 * struct {
11547 * opaque verify_data[Hash.length];
11548 * }
11549 */
11550 if (!tree)
11551 return;
11552
11553 if (session->version == SSLV3_VERSION0x300) {
11554 if (ssl_hfs != NULL((void*)0)) {
11555 proto_tree_add_item(tree, ssl_hfs->hs_md5_hash,
11556 tvb, offset, 16, ENC_NA0x00000000);
11557 proto_tree_add_item(tree, ssl_hfs->hs_sha_hash,
11558 tvb, offset + 16, 20, ENC_NA0x00000000);
11559 }
11560 } else {
11561 /* Length should be 12 for TLS before 1.3, assume this is the case. */
11562 proto_tree_add_item(tree, hf->hf.hs_finished,
11563 tvb, offset, offset_end - offset, ENC_NA0x00000000);
11564 }
11565} /* }}} */
11566
11567/* RFC 6066 Certificate URL handshake message dissection. {{{ */
11568void
11569ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset)
11570{
11571 uint16_t url_hash_len;
11572
11573 /* enum {
11574 * individual_certs(0), pkipath(1), (255)
11575 * } CertChainType;
11576 *
11577 * struct {
11578 * CertChainType type;
11579 * URLAndHash url_and_hash_list<1..2^16-1>;
11580 * } CertificateURL;
11581 *
11582 * struct {
11583 * opaque url<1..2^16-1>;
11584 * unint8 padding;
11585 * opaque SHA1Hash[20];
11586 * } URLAndHash;
11587 */
11588
11589 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type,
11590 tvb, offset, 1, ENC_NA0x00000000);
11591 offset++;
11592
11593 url_hash_len = tvb_get_ntohs(tvb, offset);
11594 proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len,
11595 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11596 offset += 2;
11597 while (url_hash_len-- > 0) {
11598 proto_item *urlhash_item;
11599 proto_tree *urlhash_tree;
11600 uint16_t url_len;
11601
11602 urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item,
11603 tvb, offset, -1, ENC_NA0x00000000);
11604 urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash);
11605
11606 url_len = tvb_get_ntohs(tvb, offset);
11607 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len,
11608 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11609 offset += 2;
11610
11611 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url,
11612 tvb, offset, url_len, ENC_ASCII0x00000000|ENC_NA0x00000000);
11613 offset += url_len;
11614
11615 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding,
11616 tvb, offset, 1, ENC_NA0x00000000);
11617 offset++;
11618 /* Note: RFC 6066 says that padding must be 0x01 */
11619
11620 proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1,
11621 tvb, offset, 20, ENC_NA0x00000000);
11622 offset += 20;
11623 }
11624} /* }}} */
11625
11626void
11627ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11628 uint32_t offset, uint32_t offset_end, packet_info *pinfo,
11629 SslSession *session, SslDecryptSession *ssl,
11630 bool_Bool is_from_server, bool_Bool is_dtls)
11631{
11632 uint32_t algorithm, uncompressed_length;
11633 uint32_t compressed_certificate_message_length;
11634 tvbuff_t *uncompressed_tvb = NULL((void*)0);
11635 proto_item *ti;
11636 /*
11637 * enum {
11638 * zlib(1),
11639 * brotli(2),
11640 * zstd(3),
11641 * (65535)
11642 * } CertificateCompressionAlgorithm;
11643 *
11644 * struct {
11645 * CertificateCompressionAlgorithm algorithm;
11646 * uint24 uncompressed_length;
11647 * opaque compressed_certificate_message<1..2^24-1>;
11648 * } CompressedCertificate;
11649 */
11650
11651 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm,
11652 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &algorithm);
11653 offset += 2;
11654
11655 proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length,
11656 tvb, offset, 3, ENC_BIG_ENDIAN0x00000000, &uncompressed_length);
11657 offset += 3;
11658
11659 /* opaque compressed_certificate_message<1..2^24-1>; */
11660 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length,
11661 hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24((1U << 24) - 1))) {
11662 return;
11663 }
11664 offset += 3;
11665
11666 ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message,
11667 tvb, offset, compressed_certificate_message_length, ENC_NA0x00000000);
11668
11669 /* Certificate decompression following algorithm */
11670 switch (algorithm) {
11671 case 1: /* zlib */
11672 uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length);
11673 break;
11674 case 2: /* brotli */
11675 uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length);
11676 break;
11677 case 3: /* zstd */
11678 uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length);
11679 break;
11680 }
11681
11682 if (uncompressed_tvb) {
11683 proto_tree *uncompressed_tree;
11684
11685 if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) {
11686 proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error,
11687 tvb, offset, offset_end - offset,
11688 "Invalid uncompressed length %u (expected %u)",
11689 tvb_captured_length(uncompressed_tvb),
11690 uncompressed_length);
11691 } else {
11692 uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates);
11693 ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree,
11694 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls);
11695 add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)");
11696 }
11697 }
11698}
11699
11700/* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */
11701static int
11702// NOLINTNEXTLINE(misc-no-recursion)
11703ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
11704 packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type,
11705 SslSession *session, SslDecryptSession *ssl,
11706 bool_Bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data,
11707 ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length)
11708{
11709 uint32_t exts_len;
11710 uint16_t ext_type;
11711 uint32_t ext_len;
11712 uint32_t next_offset;
11713 proto_item *ext_item;
11714 proto_tree *ext_tree;
11715 bool_Bool is_tls13 = session->version == TLSV1DOT3_VERSION0x304;
11716 wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, "");
11717 wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, "");
11718 char *ja3_dash = "";
11719 unsigned supported_version;
11720
11721 /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */
11722 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len,
11723 hf->hf.hs_exts_len, 0, UINT16_MAX(65535))) {
11724 return offset_end;
11725 }
11726 offset += 2;
11727 offset_end = offset + exts_len;
11728
11729 if (ja4_data) {
11730 ja4_data->num_extensions = 0;
11731 }
11732 while (offset_end - offset >= 4)
11733 {
11734 ext_type = tvb_get_ntohs(tvb, offset);
11735 ext_len = tvb_get_ntohs(tvb, offset + 2);
11736
11737 if (ja4_data && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11738 ja4_data->num_extensions += 1;
11739 if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME0 &&
11740 ext_type != SSL_HND_HELLO_EXT_ALPN16) {
11741 wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type)((gpointer) (gulong) (ext_type)), wmem_compare_uint);
11742 }
11743 }
11744
11745 ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len,
11746 "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type,
11747 tls_hello_extension_types,
11748 "Unknown type %u"), ext_len);
11749 ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext);
11750
11751 proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type,
11752 tvb, offset, 2, ext_type);
11753 offset += 2;
11754 if (ja3 && !IS_GREASE_TLS(ext_type)((((ext_type) & 0x0f0f) == 0x0a0a) && (((ext_type
) & 0xff) == (((ext_type)>>8) & 0xff)))
) {
11755 wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type);
11756 ja3_dash = "-";
11757 }
11758
11759 /* opaque extension_data<0..2^16-1> */
11760 if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len,
11761 hf->hf.hs_ext_len, 0, UINT16_MAX(65535))) {
11762 return offset_end;
11763 }
11764 offset += 2;
11765 next_offset = offset + ext_len;
11766
11767 switch (ext_type) {
11768 case SSL_HND_HELLO_EXT_SERVER_NAME0:
11769 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11770 offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset);
11771 if (ja4_data) {
11772 ja4_data->server_name_present = true1;
11773 }
11774 }
11775 break;
11776 case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH1:
11777 proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA0x00000000);
11778 offset += 1;
11779 break;
11780 case SSL_HND_HELLO_EXT_STATUS_REQUEST5:
11781 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11782 offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false0);
11783 } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) {
11784 offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset);
11785 }
11786 break;
11787 case SSL_HND_HELLO_EXT_CERT_TYPE9:
11788 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11789 offset, next_offset,
11790 hnd_type, ext_type,
11791 session);
11792 break;
11793 case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS10:
11794 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11795 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11796 next_offset, ja3_sg);
11797 } else {
11798 offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset,
11799 next_offset, NULL((void*)0));
11800 }
11801 break;
11802 case SSL_HND_HELLO_EXT_EC_POINT_FORMATS11:
11803 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11804 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf);
11805 } else {
11806 offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL((void*)0));
11807 }
11808 break;
11809 break;
11810 case SSL_HND_HELLO_EXT_SRP12:
11811 offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset);
11812 break;
11813 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS13:
11814 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data);
11815 break;
11816 case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT50: /* since TLS 1.3 draft -23 */
11817 offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL((void*)0));
11818 break;
11819 case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS34:
11820 offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type);
11821 break;
11822 case SSL_HND_HELLO_EXT_USE_SRTP14:
11823 if (is_dtls) {
11824 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11825 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false0);
11826 } else if (hnd_type == SSL_HND_SERVER_HELLO) {
11827 offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true1);
11828 }
11829 } else {
11830 // XXX expert info: This extension MUST only be used with DTLS, and not with TLS.
11831 }
11832 break;
11833 case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS64768:
11834 offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset);
11835 break;
11836 case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO65037:
11837 offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map, initial_offset, hello_length);
11838 break;
11839 case SSL_HND_HELLO_EXT_HEARTBEAT15:
11840 proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode,
11841 tvb, offset, 1, ENC_BIG_ENDIAN0x00000000);
11842 offset++;
11843 break;
11844 case SSL_HND_HELLO_EXT_ALPN16:
11845 offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data);
11846 break;
11847 case SSL_HND_HELLO_EXT_STATUS_REQUEST_V217:
11848 if (hnd_type == SSL_HND_CLIENT_HELLO)
11849 offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset);
11850 break;
11851 case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP18:
11852 // TLS 1.3 note: SCT only appears in EE in draft -16 and before.
11853 if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE)
11854 offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version);
11855 break;
11856 case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE19:
11857 case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE20:
11858 offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree,
11859 offset, next_offset,
11860 hnd_type, ext_type,
11861 session);
11862 break;
11863 case SSL_HND_HELLO_EXT_PADDING21:
11864 proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA0x00000000);
11865 offset += ext_len;
11866 break;
11867 case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC22:
11868 if (ssl && hnd_type == SSL_HND_SERVER_HELLO) {
11869 ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC((const char*) (__func__)));
11870 ssl->state |= SSL_ENCRYPT_THEN_MAC(1<<11);
11871 }
11872 break;
11873 case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET23:
11874 if (ssl) {
11875 switch (hnd_type) {
11876 case SSL_HND_CLIENT_HELLO:
11877 ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET(1<<7);
11878 break;
11879 case SSL_HND_SERVER_HELLO:
11880 ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET(1<<8);
11881 break;
11882 default: /* no default */
11883 break;
11884 }
11885 }
11886 break;
11887 case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE27:
11888 offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11889 break;
11890 case SSL_HND_HELLO_EXT_TOKEN_BINDING24:
11891 offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11892 break;
11893 case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT28:
11894 proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit,
11895 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
11896 offset += 2;
11897 break;
11898 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS65445:
11899 case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V157:
11900 offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11901 break;
11902 case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS35:
11903 offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl);
11904 break;
11905 case SSL_HND_HELLO_EXT_KEY_SHARE_OLD40: /* used before TLS 1.3 draft -23 */
11906 case SSL_HND_HELLO_EXT_KEY_SHARE51:
11907 offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11908 break;
11909 case SSL_HND_HELLO_EXT_PRE_SHARED_KEY41:
11910 offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11911 break;
11912 case SSL_HND_HELLO_EXT_EARLY_DATA42:
11913 case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO46:
11914 offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11915 break;
11916 case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS43:
11917 switch (hnd_type) {
11918 case SSL_HND_CLIENT_HELLO:
11919 offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data);
11920 break;
11921 case SSL_HND_SERVER_HELLO:
11922 case SSL_HND_HELLO_RETRY_REQUEST:
11923 proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN0x00000000, &supported_version);
11924 offset += 2;
11925 proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)"));
11926 break;
11927 }
11928 break;
11929 case SSL_HND_HELLO_EXT_COOKIE44:
11930 offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset);
11931 break;
11932 case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES45:
11933 offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset);
11934 break;
11935 case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES47:
11936 offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset);
11937 break;
11938 case SSL_HND_HELLO_EXT_OID_FILTERS48:
11939 offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset);
11940 break;
11941 case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH49:
11942 break;
11943 case SSL_HND_HELLO_EXT_NPN13172:
11944 offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset);
11945 break;
11946 case SSL_HND_HELLO_EXT_ALPS_OLD17513:
11947 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11948 break;
11949 case SSL_HND_HELLO_EXT_ALPS17613:
11950 offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type);
11951 break;
11952 case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO65281:
11953 offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset);
11954 break;
11955 case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME65486:
11956 offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl);
11957 break;
11958 case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED53:
11959 session->deprecated_cid = true1;
11960 /* FALLTHRU */
11961 case SSL_HND_HELLO_EXT_CONNECTION_ID54:
11962 offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl);
11963 break;
11964 case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS3:
11965 offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset);
11966 break;
11967 default:
11968 proto_tree_add_item(ext_tree, hf->hf.hs_ext_data,
11969 tvb, offset, ext_len, ENC_NA0x00000000);
11970 offset += ext_len;
11971 break;
11972 }
11973
11974 if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) {
11975 /* Dissection did not end at expected location, fix it. */
11976 offset = next_offset;
11977 }
11978 }
11979
11980 if (ja3) {
11981 if (hnd_type == SSL_HND_CLIENT_HELLO) {
11982 if(wmem_strbuf_get_len(ja3_sg) > 0) {
11983 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg));
11984 } else {
11985 wmem_strbuf_append_c(ja3, ',');
11986 }
11987 if(wmem_strbuf_get_len(ja3_ecpf) > 0) {
11988 wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf));
11989 } else {
11990 wmem_strbuf_append_c(ja3, ',');
11991 }
11992 }
11993 }
11994
11995 /* Check if Extensions vector is correctly terminated. */
11996 if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) {
11997 offset = offset_end;
11998 }
11999
12000 return offset;
12001} /* }}} */
12002
12003
12004/* ClientKeyExchange algo-specific dissectors. {{{ */
12005
12006static void
12007dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12008 proto_tree *tree, uint32_t offset,
12009 uint32_t length)
12010{
12011 int point_len;
12012 proto_tree *ssl_ecdh_tree;
12013
12014 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12015 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Client Params");
12016
12017 /* point */
12018 point_len = tvb_get_uint8(tvb, offset);
12019 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb,
12020 offset, 1, ENC_BIG_ENDIAN0x00000000);
12021 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb,
12022 offset + 1, point_len, ENC_NA0x00000000);
12023}
12024
12025static void
12026dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12027 proto_tree *tree, uint32_t offset, uint32_t length)
12028{
12029 int yc_len;
12030 proto_tree *ssl_dh_tree;
12031
12032 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12033 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Client Params");
12034
12035 /* ClientDiffieHellmanPublic.dh_public (explicit) */
12036 yc_len = tvb_get_ntohs(tvb, offset);
12037 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb,
12038 offset, 2, ENC_BIG_ENDIAN0x00000000);
12039 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb,
12040 offset + 2, yc_len, ENC_NA0x00000000);
12041}
12042
12043static void
12044dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12045 proto_tree *tree, uint32_t offset,
12046 uint32_t length, const SslSession *session)
12047{
12048 int epms_len;
12049 proto_tree *ssl_rsa_tree;
12050
12051 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12052 hf->ett.keyex_params, NULL((void*)0), "RSA Encrypted PreMaster Secret");
12053
12054 /* EncryptedPreMasterSecret.pre_master_secret */
12055 switch (session->version) {
12056 case SSLV2_VERSION0x0002:
12057 case SSLV3_VERSION0x300:
12058 case DTLSV1DOT0_OPENSSL_VERSION0x100:
12059 /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is
12060 * not present. The handshake contents represents the EPMS, see:
12061 * https://gitlab.com/wireshark/wireshark/-/issues/10222 */
12062 epms_len = length;
12063 break;
12064
12065 default:
12066 /* TLS and DTLS include vector length before EPMS */
12067 epms_len = tvb_get_ntohs(tvb, offset);
12068 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12069 offset, 2, ENC_BIG_ENDIAN0x00000000);
12070 offset += 2;
12071 break;
12072 }
12073 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb,
12074 offset, epms_len, ENC_NA0x00000000);
12075}
12076
12077/* Used in PSK cipher suites */
12078static uint32_t
12079dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12080 proto_tree *tree, uint32_t offset)
12081{
12082 unsigned identity_len;
12083 proto_tree *ssl_psk_tree;
12084
12085 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12086 hf->ett.keyex_params, NULL((void*)0), "PSK Client Params");
12087 /* identity */
12088 identity_len = tvb_get_ntohs(tvb, offset);
12089 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb,
12090 offset, 2, ENC_BIG_ENDIAN0x00000000);
12091 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb,
12092 offset + 2, identity_len, ENC_NA0x00000000);
12093
12094 proto_item_set_len(ssl_psk_tree, 2 + identity_len);
12095 return 2 + identity_len;
12096}
12097
12098/* Used in RSA PSK cipher suites */
12099static void
12100dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12101 proto_tree *tree, uint32_t offset,
12102 uint32_t length)
12103{
12104 int identity_len, epms_len;
12105 proto_tree *ssl_psk_tree;
12106
12107 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12108 hf->ett.keyex_params, NULL((void*)0), "RSA PSK Client Params");
12109
12110 /* identity */
12111 identity_len = tvb_get_ntohs(tvb, offset);
12112 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len,
12113 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12114 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity,
12115 tvb, offset + 2, identity_len, ENC_NA0x00000000);
12116 offset += 2 + identity_len;
12117
12118 /* Yc */
12119 epms_len = tvb_get_ntohs(tvb, offset);
12120 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12121 offset, 2, ENC_BIG_ENDIAN0x00000000);
12122 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb,
12123 offset + 2, epms_len, ENC_NA0x00000000);
12124}
12125
12126/* Used in Diffie-Hellman PSK cipher suites */
12127static void
12128dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12129 proto_tree *tree, uint32_t offset, uint32_t length)
12130{
12131 /*
12132 * struct {
12133 * select (KeyExchangeAlgorithm) {
12134 * case diffie_hellman_psk:
12135 * opaque psk_identity<0..2^16-1>;
12136 * ClientDiffieHellmanPublic public;
12137 * } exchange_keys;
12138 * } ClientKeyExchange;
12139 */
12140
12141 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12142 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len);
12143}
12144
12145/* Used in EC Diffie-Hellman PSK cipher suites */
12146static void
12147dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12148 proto_tree *tree, uint32_t offset, uint32_t length)
12149{
12150 /*
12151 * struct {
12152 * select (KeyExchangeAlgorithm) {
12153 * case ec_diffie_hellman_psk:
12154 * opaque psk_identity<0..2^16-1>;
12155 * ClientECDiffieHellmanPublic public;
12156 * } exchange_keys;
12157 * } ClientKeyExchange;
12158 */
12159
12160 uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12161 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len);
12162}
12163
12164/* Used in EC J-PAKE cipher suites */
12165static void
12166dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12167 proto_tree *tree, uint32_t offset,
12168 uint32_t length)
12169{
12170 /*
12171 * struct {
12172 * ECPoint V;
12173 * opaque r<1..2^8-1>;
12174 * } ECSchnorrZKP;
12175 *
12176 * struct {
12177 * ECPoint X;
12178 * ECSchnorrZKP zkp;
12179 * } ECJPAKEKeyKP;
12180 *
12181 * struct {
12182 * ECJPAKEKeyKP ecjpake_key_kp;
12183 * } ClientECJPAKEParams;
12184 *
12185 * select (KeyExchangeAlgorithm) {
12186 * case ecjpake:
12187 * ClientECJPAKEParams params;
12188 * } ClientKeyExchange;
12189 */
12190
12191 int point_len;
12192 proto_tree *ssl_ecjpake_tree;
12193
12194 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12195 hf->ett.keyex_params, NULL((void*)0),
12196 "EC J-PAKE Client Params");
12197
12198 /* ECJPAKEKeyKP.X */
12199 point_len = tvb_get_uint8(tvb, offset);
12200 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb,
12201 offset, 1, ENC_BIG_ENDIAN0x00000000);
12202 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb,
12203 offset + 1, point_len, ENC_NA0x00000000);
12204 offset += 1 + point_len;
12205
12206 /* ECJPAKEKeyKP.zkp.V */
12207 point_len = tvb_get_uint8(tvb, offset);
12208 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb,
12209 offset, 1, ENC_BIG_ENDIAN0x00000000);
12210 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb,
12211 offset + 1, point_len, ENC_NA0x00000000);
12212 offset += 1 + point_len;
12213
12214 /* ECJPAKEKeyKP.zkp.r */
12215 point_len = tvb_get_uint8(tvb, offset);
12216 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb,
12217 offset, 1, ENC_BIG_ENDIAN0x00000000);
12218 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb,
12219 offset + 1, point_len, ENC_NA0x00000000);
12220}
12221
12222static void
12223dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12224 proto_tree *tree, uint32_t offset,
12225 uint32_t length)
12226{
12227 int epms_len;
12228 proto_tree *ssl_ecc_sm2_tree;
12229
12230 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length,
12231 hf->ett.keyex_params, NULL((void*)0),
12232 "ECC-SM2 Encrypted PreMaster Secret");
12233
12234 epms_len = tvb_get_ntohs(tvb, offset);
12235 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb,
12236 offset, 2, ENC_BIG_ENDIAN0x00000000);
12237 offset += 2;
12238 proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb,
12239 offset, epms_len, ENC_NA0x00000000);
12240}
12241/* ClientKeyExchange algo-specific dissectors. }}} */
12242
12243
12244/* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */
12245static uint32_t
12246ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12247 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12248 uint16_t version, int hf_sig_len, int hf_sig)
12249{
12250 uint32_t sig_len;
12251
12252 switch (version) {
12253 case TLSV1DOT2_VERSION0x303:
12254 case DTLSV1DOT2_VERSION0xfefd:
12255 case TLSV1DOT3_VERSION0x304:
12256 case DTLSV1DOT3_VERSION0xfefc:
12257 tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL((void*)0));
12258 offset += 2;
12259 break;
12260
12261 default:
12262 break;
12263 }
12264
12265 /* Sig */
12266 if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len,
12267 hf_sig_len, 0, UINT16_MAX(65535))) {
12268 return offset_end;
12269 }
12270 offset += 2;
12271 proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA0x00000000);
12272 offset += sig_len;
12273 return offset;
12274} /* }}} */
12275
12276/* ServerKeyExchange algo-specific dissectors. {{{ */
12277
12278/* dissects signed_params inside a ServerKeyExchange for some keyex algos */
12279static void
12280dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12281 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12282 uint16_t version)
12283{
12284 /*
12285 * TLSv1.2 (RFC 5246 sec 7.4.8)
12286 * struct {
12287 * digitally-signed struct {
12288 * opaque handshake_messages[handshake_messages_length];
12289 * }
12290 * } CertificateVerify;
12291 *
12292 * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same
12293 * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed.
12294 *
12295 * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it
12296 * does more hashing including the master secret and padding.
12297 */
12298 ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version,
12299 hf->hf.hs_server_keyex_sig_len,
12300 hf->hf.hs_server_keyex_sig);
12301}
12302
12303static uint32_t
12304dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end)
12305{
12306 /*
12307 * RFC 4492 ECC cipher suites for TLS
12308 *
12309 * struct {
12310 * ECCurveType curve_type;
12311 * select (curve_type) {
12312 * case explicit_prime:
12313 * ...
12314 * case explicit_char2:
12315 * ...
12316 * case named_curve:
12317 * NamedCurve namedcurve;
12318 * };
12319 * } ECParameters;
12320 */
12321
12322 int curve_type;
12323
12324 /* ECParameters.curve_type */
12325 curve_type = tvb_get_uint8(tvb, offset);
12326 proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb,
12327 offset, 1, ENC_BIG_ENDIAN0x00000000);
12328 offset++;
12329
12330 if (curve_type != 3)
12331 return offset_end; /* only named_curves are supported */
12332
12333 /* case curve_type == named_curve; ECParameters.namedcurve */
12334 proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb,
12335 offset, 2, ENC_BIG_ENDIAN0x00000000);
12336 offset += 2;
12337
12338 return offset;
12339}
12340
12341static void
12342dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12343 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12344 uint16_t version, bool_Bool anon)
12345{
12346 /*
12347 * RFC 4492 ECC cipher suites for TLS
12348 *
12349 * struct {
12350 * opaque point <1..2^8-1>;
12351 * } ECPoint;
12352 *
12353 * struct {
12354 * ECParameters curve_params;
12355 * ECPoint public;
12356 * } ServerECDHParams;
12357 *
12358 * select (KeyExchangeAlgorithm) {
12359 * case ec_diffie_hellman:
12360 * ServerECDHParams params;
12361 * Signature signed_params;
12362 * } ServerKeyExchange;
12363 */
12364
12365 int point_len;
12366 proto_tree *ssl_ecdh_tree;
12367
12368 ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12369 hf->ett.keyex_params, NULL((void*)0), "EC Diffie-Hellman Server Params");
12370
12371 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end);
12372 if (offset >= offset_end)
12373 return; /* only named_curves are supported */
12374
12375 /* ECPoint.point */
12376 point_len = tvb_get_uint8(tvb, offset);
12377 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb,
12378 offset, 1, ENC_BIG_ENDIAN0x00000000);
12379 proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb,
12380 offset + 1, point_len, ENC_NA0x00000000);
12381 offset += 1 + point_len;
12382
12383 /* Signature (if non-anonymous KEX) */
12384 if (!anon) {
12385 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version);
12386 }
12387}
12388
12389static void
12390dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12391 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12392 uint16_t version, bool_Bool anon)
12393{
12394 int p_len, g_len, ys_len;
12395 proto_tree *ssl_dh_tree;
12396
12397 ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12398 hf->ett.keyex_params, NULL((void*)0), "Diffie-Hellman Server Params");
12399
12400 /* p */
12401 p_len = tvb_get_ntohs(tvb, offset);
12402 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb,
12403 offset, 2, ENC_BIG_ENDIAN0x00000000);
12404 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb,
12405 offset + 2, p_len, ENC_NA0x00000000);
12406 offset += 2 + p_len;
12407
12408 /* g */
12409 g_len = tvb_get_ntohs(tvb, offset);
12410 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb,
12411 offset, 2, ENC_BIG_ENDIAN0x00000000);
12412 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb,
12413 offset + 2, g_len, ENC_NA0x00000000);
12414 offset += 2 + g_len;
12415
12416 /* Ys */
12417 ys_len = tvb_get_ntohs(tvb, offset);
12418 proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb,
12419 offset, 2, ys_len);
12420 proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb,
12421 offset + 2, ys_len, ENC_NA0x00000000);
12422 offset += 2 + ys_len;
12423
12424 /* Signature (if non-anonymous KEX) */
12425 if (!anon) {
12426 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version);
12427 }
12428}
12429
12430/* Only used in RSA-EXPORT cipher suites */
12431static void
12432dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12433 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12434 uint16_t version)
12435{
12436 int modulus_len, exponent_len;
12437 proto_tree *ssl_rsa_tree;
12438
12439 ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12440 hf->ett.keyex_params, NULL((void*)0), "RSA-EXPORT Server Params");
12441
12442 /* modulus */
12443 modulus_len = tvb_get_ntohs(tvb, offset);
12444 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb,
12445 offset, 2, ENC_BIG_ENDIAN0x00000000);
12446 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb,
12447 offset + 2, modulus_len, ENC_NA0x00000000);
12448 offset += 2 + modulus_len;
12449
12450 /* exponent */
12451 exponent_len = tvb_get_ntohs(tvb, offset);
12452 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len,
12453 tvb, offset, 2, ENC_BIG_ENDIAN0x00000000);
12454 proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent,
12455 tvb, offset + 2, exponent_len, ENC_NA0x00000000);
12456 offset += 2 + exponent_len;
12457
12458 /* Signature */
12459 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version);
12460}
12461
12462/* Used in RSA PSK and PSK cipher suites */
12463static uint32_t
12464dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12465 proto_tree *tree, uint32_t offset)
12466{
12467 unsigned hint_len;
12468 proto_tree *ssl_psk_tree;
12469
12470 ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1,
12471 hf->ett.keyex_params, NULL((void*)0), "PSK Server Params");
12472
12473 /* hint */
12474 hint_len = tvb_get_ntohs(tvb, offset);
12475 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb,
12476 offset, 2, ENC_BIG_ENDIAN0x00000000);
12477 proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb,
12478 offset + 2, hint_len, ENC_NA0x00000000);
12479
12480 proto_item_set_len(ssl_psk_tree, 2 + hint_len);
12481 return 2 + hint_len;
12482}
12483
12484/* Used in Diffie-Hellman PSK cipher suites */
12485static void
12486dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12487 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12488{
12489 /*
12490 * struct {
12491 * select (KeyExchangeAlgorithm) {
12492 * case diffie_hellman_psk:
12493 * opaque psk_identity_hint<0..2^16-1>;
12494 * ServerDHParams params;
12495 * };
12496 * } ServerKeyExchange;
12497 */
12498
12499 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12500 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12501}
12502
12503/* Used in EC Diffie-Hellman PSK cipher suites */
12504static void
12505dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12506 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12507{
12508 /*
12509 * struct {
12510 * select (KeyExchangeAlgorithm) {
12511 * case ec_diffie_hellman_psk:
12512 * opaque psk_identity_hint<0..2^16-1>;
12513 * ServerECDHParams params;
12514 * };
12515 * } ServerKeyExchange;
12516 */
12517
12518 uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12519 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true1);
12520}
12521
12522/* Used in EC J-PAKE cipher suites */
12523static void
12524dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12525 proto_tree *tree, uint32_t offset, uint32_t offset_end)
12526{
12527 /*
12528 * struct {
12529 * ECPoint V;
12530 * opaque r<1..2^8-1>;
12531 * } ECSchnorrZKP;
12532 *
12533 * struct {
12534 * ECPoint X;
12535 * ECSchnorrZKP zkp;
12536 * } ECJPAKEKeyKP;
12537 *
12538 * struct {
12539 * ECParameters curve_params;
12540 * ECJPAKEKeyKP ecjpake_key_kp;
12541 * } ServerECJPAKEParams;
12542 *
12543 * select (KeyExchangeAlgorithm) {
12544 * case ecjpake:
12545 * ServerECJPAKEParams params;
12546 * } ServerKeyExchange;
12547 */
12548
12549 int point_len;
12550 proto_tree *ssl_ecjpake_tree;
12551
12552 ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12553 hf->ett.keyex_params, NULL((void*)0),
12554 "EC J-PAKE Server Params");
12555
12556 offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end);
12557 if (offset >= offset_end)
12558 return; /* only named_curves are supported */
12559
12560 /* ECJPAKEKeyKP.X */
12561 point_len = tvb_get_uint8(tvb, offset);
12562 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb,
12563 offset, 1, ENC_BIG_ENDIAN0x00000000);
12564 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb,
12565 offset + 1, point_len, ENC_NA0x00000000);
12566 offset += 1 + point_len;
12567
12568 /* ECJPAKEKeyKP.zkp.V */
12569 point_len = tvb_get_uint8(tvb, offset);
12570 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb,
12571 offset, 1, ENC_BIG_ENDIAN0x00000000);
12572 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb,
12573 offset + 1, point_len, ENC_NA0x00000000);
12574 offset += 1 + point_len;
12575
12576 /* ECJPAKEKeyKP.zkp.r */
12577 point_len = tvb_get_uint8(tvb, offset);
12578 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb,
12579 offset, 1, ENC_BIG_ENDIAN0x00000000);
12580 proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb,
12581 offset + 1, point_len, ENC_NA0x00000000);
12582}
12583
12584/* Only used in ECC-SM2-EXPORT cipher suites */
12585static void
12586dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12587 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12588 uint16_t version)
12589{
12590 proto_tree *ssl_ecc_sm2_tree;
12591
12592 ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset,
12593 hf->ett.keyex_params, NULL((void*)0), "ECC-SM2-EXPORT Server Params");
12594
12595 /* Signature */
12596 dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version);
12597}
12598/* ServerKeyExchange algo-specific dissectors. }}} */
12599
12600/* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */
12601void
12602ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12603 proto_tree *tree, uint32_t offset, uint32_t length,
12604 const SslSession *session)
12605{
12606 switch (ssl_get_keyex_alg(session->cipher)) {
12607 case KEX_DH_ANON0x13: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */
12608 case KEX_DH_DSS0x14:
12609 case KEX_DH_RSA0x15:
12610 case KEX_DHE_DSS0x10:
12611 case KEX_DHE_RSA0x12:
12612 dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length);
12613 break;
12614 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */
12615 dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length);
12616 break;
12617 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */
12618 case KEX_ECDH_ECDSA0x1a:
12619 case KEX_ECDH_RSA0x1b:
12620 case KEX_ECDHE_ECDSA0x16:
12621 case KEX_ECDHE_RSA0x18:
12622 dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length);
12623 break;
12624 case KEX_ECDHE_PSK0x17: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */
12625 dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length);
12626 break;
12627 case KEX_KRB50x1c: /* RFC 2712; krb5: KerberosWrapper */
12628 /* XXX: implement support for KRB5 */
12629 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12630 tvb, offset, length,
12631 "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark"
12632 " developers if you want them to be supported");
12633 break;
12634 case KEX_PSK0x1d: /* RFC 4279; psk: psk_identity */
12635 dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset);
12636 break;
12637 case KEX_RSA0x1e: /* RFC 5246; rsa: EncryptedPreMasterSecret */
12638 dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session);
12639 break;
12640 case KEX_RSA_PSK0x1f: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */
12641 dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length);
12642 break;
12643 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ClientSRPPublic */
12644 case KEX_SRP_SHA_DSS0x21:
12645 case KEX_SRP_SHA_RSA0x22:
12646 /* XXX: implement support for SRP_SHA* */
12647 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12648 tvb, offset, length,
12649 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12650 " developers if you want them to be supported");
12651 break;
12652 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12653 dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length);
12654 break;
12655 case KEX_ECC_SM20x26: /* GB/T 38636 */
12656 dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length);
12657 break;
12658 default:
12659 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12660 tvb, offset, length);
12661 break;
12662 }
12663}
12664
12665void
12666ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
12667 proto_tree *tree, uint32_t offset, uint32_t offset_end,
12668 const SslSession *session)
12669{
12670 switch (ssl_get_keyex_alg(session->cipher)) {
12671 case KEX_DH_ANON0x13: /* RFC 5246; ServerDHParams */
12672 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12673 break;
12674 case KEX_DH_DSS0x14: /* RFC 5246; not allowed */
12675 case KEX_DH_RSA0x15:
12676 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12677 tvb, offset, offset_end - offset);
12678 break;
12679 case KEX_DHE_DSS0x10: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */
12680 case KEX_DHE_RSA0x12:
12681 dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12682 break;
12683 case KEX_DHE_PSK0x11: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */
12684 dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end);
12685 break;
12686 case KEX_ECDH_ANON0x19: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */
12687 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true1);
12688 break;
12689 case KEX_ECDHE_PSK0x17: /* RFC 5489; psk_identity_hint, ServerECDHParams */
12690 dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end);
12691 break;
12692 case KEX_ECDH_ECDSA0x1a: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */
12693 case KEX_ECDH_RSA0x1b:
12694 case KEX_ECDHE_ECDSA0x16:
12695 case KEX_ECDHE_RSA0x18:
12696 dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false0);
12697 break;
12698 case KEX_KRB50x1c: /* RFC 2712; not allowed */
12699 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_srv_keyex_illegal,
12700 tvb, offset, offset_end - offset);
12701 break;
12702 case KEX_PSK0x1d: /* RFC 4279; psk, rsa: psk_identity */
12703 case KEX_RSA_PSK0x1f:
12704 dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset);
12705 break;
12706 case KEX_RSA0x1e: /* only allowed if the public key in the server certificate is longer than 512 bits */
12707 dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12708 break;
12709 case KEX_ECC_SM20x26: /* GB/T 38636 */
12710 dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version);
12711 break;
12712 case KEX_SRP_SHA0x20: /* RFC 5054; srp: ServerSRPParams, Signature */
12713 case KEX_SRP_SHA_DSS0x21:
12714 case KEX_SRP_SHA_RSA0x22:
12715 /* XXX: implement support for SRP_SHA* */
12716 proto_tree_add_expert_format(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12717 tvb, offset, offset_end - offset,
12718 "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark"
12719 " developers if you want them to be supported");
12720 break;
12721 case KEX_ECJPAKE0x24: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */
12722 dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end);
12723 break;
12724 default:
12725 proto_tree_add_expert(tree, NULL((void*)0), &hf->ei.hs_ciphersuite_undecoded,
12726 tvb, offset, offset_end - offset);
12727 break;
12728 }
12729}
12730/* Client Key Exchange and Server Key Exchange handshake dissections. }}} */
12731
12732void
12733tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
12734 proto_tree *tree, uint32_t offset)
12735{
12736 /* RFC 8446 Section 4.6.3
12737 * enum {
12738 * update_not_requested(0), update_requested(1), (255)
12739 * } KeyUpdateRequest;
12740 *
12741 * struct {
12742 * KeyUpdateRequest request_update;
12743 * } KeyUpdate;
12744 */
12745 proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA0x00000000);
12746}
12747
12748void
12749ssl_common_register_ssl_alpn_dissector_table(const char *name,
12750 const char *ui_name, const int proto)
12751{
12752 ssl_alpn_dissector_table = register_dissector_table(name, ui_name,
12753 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12754 register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str");
12755}
12756
12757void
12758ssl_common_register_dtls_alpn_dissector_table(const char *name,
12759 const char *ui_name, const int proto)
12760{
12761 dtls_alpn_dissector_table = register_dissector_table(name, ui_name,
12762 proto, FT_STRING, STRING_CASE_SENSITIVE0);
12763 register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str");
12764}
12765
12766void
12767ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool_Bool is_dtls)
12768{
12769 prefs_register_string_preference(module, "psk", "Pre-Shared Key",
12770 "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.",
12771 &(options->psk));
12772
12773 if (is_dtls) {
12774 prefs_register_obsolete_preference(module, "keylog_file");
12775 prefs_register_static_text_preference(module, "keylog_file_removed",
12776 "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.",
12777 "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS.");
12778 return;
12779 }
12780
12781 prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename",
12782 "The name of a file which contains a list of \n"
12783 "(pre-)master secrets in one of the following formats:\n"
12784 "\n"
12785 "RSA <EPMS> <PMS>\n"
12786 "RSA Session-ID:<SSLID> Master-Key:<MS>\n"
12787 "CLIENT_RANDOM <CRAND> <MS>\n"
12788 "PMS_CLIENT_RANDOM <CRAND> <PMS>\n"
12789 "\n"
12790 "Where:\n"
12791 "<EPMS> = First 8 bytes of the Encrypted PMS\n"
12792 "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n"
12793 "<SSLID> = The SSL Session ID\n"
12794 "<MS> = The Master-Secret (MS)\n"
12795 "<CRAND> = The Client's random number from the ClientHello message\n"
12796 "\n"
12797 "(All fields are in hex notation)",
12798 &(options->keylog_filename), false0);
12799}
12800
12801void
12802ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length)
12803{
12804 if (ssl_session && ssl_session->session.version != TLSV1DOT3_VERSION0x304 && !(ssl_session->state & SSL_MASTER_SECRET(1<<5))) {
12805 uint32_t old_length = ssl_session->handshake_data.data_len;
12806 ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length);
12807 if (tvb) {
12808 if (tvb_bytes_exist(tvb, offset, length)) {
12809 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12810 tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length);
12811 ssl_session->handshake_data.data_len += length;
12812 }
12813 } else {
12814 /* DTLS calculates the hash as if each handshake message had been
12815 * sent as a single fragment (RFC 6347, section 4.2.6) and passes
12816 * in a null tvbuff to add 3 bytes for a zero fragment offset.
12817 */
12818 DISSECTOR_ASSERT_CMPINT(length, <, 4)((void) ((length < 4) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion " "length" " " "<" " " "4" " (" "%"
"l" "d" " " "<" " " "%" "l" "d" ")", "epan/dissectors/packet-tls-utils.c"
, 12818, (int64_t)length, (int64_t)4))))
;
12819 ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length);
12820 memset(ssl_session->handshake_data.data + old_length, 0, length);
12821 ssl_session->handshake_data.data_len += length;
12822 }
12823 }
12824}
12825
12826
12827/*
12828 * Editor modelines - https://www.wireshark.org/tools/modelines.html
12829 *
12830 * Local variables:
12831 * c-basic-offset: 4
12832 * tab-width: 8
12833 * indent-tabs-mode: nil
12834 * End:
12835 *
12836 * vi: set shiftwidth=4 tabstop=8 expandtab:
12837 * :indentSize=4:tabSize=8:noTabs=true:
12838 */