/* packet-tls.c

 * Routines for TLS dissection

 * Copyright (c) 2000-2001, Scott Renfro <scott@renfro.org>

 * Copyright 2013-2019, Peter Wu <peter@lekensteyn.nl>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * Supported protocol versions:

 *

 *  TLS 1.3, 1.2, 1.0, and SSL 3.0. SSL 2.0 is no longer supported, except for

 *  the SSL 2.0-compatible Client Hello.

 *

 * Primary protocol specifications:

 *

 *  https://tools.ietf.org/html/draft-hickman-netscape-ssl-00 - SSL 2.0

 *  https://tools.ietf.org/html/rfc6101 - SSL 3.0

 *  https://tools.ietf.org/html/rfc2246 - TLS 1.0

 *  https://tools.ietf.org/html/rfc4346 - TLS 1.1

 *  https://tools.ietf.org/html/rfc5246 - TLS 1.2

 *  https://tools.ietf.org/html/rfc8446 - TLS 1.3

 *

 * Important IANA registries:

 *

 *  https://www.iana.org/assignments/tls-parameters/

 *  https://www.iana.org/assignments/tls-extensiontype-values/

 *

 * Notes:

 *

 *    - Decryption needs to be performed 'sequentially', so it's done

 *      at packet reception time. This may cause a significant packet capture

 *      slow down. This also causes dissection of some ssl info that in previous

 *      dissector versions was dissected only when a proto_tree context was

 *      available

 *

 *     We are at Packet reception if time pinfo->fd->visited == 0

 *

 *    - Many dissection and decryption operations are implemented in

 *      epan/dissectors/packet-tls-utils.c and

 *      epan/dissectors/packet-tls-utils.h due to an overlap of functionality

 *      with DTLS (epan/dissectors/packet-dtls.c).

 *

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/reassemble.h>

#include <epan/asn1.h>

#include <epan/tap.h>

#include <epan/uat.h>

#include <epan/addr_resolv.h>

#include <epan/follow.h>

#include <epan/exported_pdu.h>

#include <epan/proto_data.h>

#include <epan/decode_as.h>

#include <epan/prefs-int.h>

#include <epan/secrets.h>

#include <wiretap/secrets-types.h>

#include <wsutil/utf8_entities.h>

#include <wsutil/str_util.h>

#include <wsutil/strtoi.h>

#include <wsutil/rsa.h>

#include <wsutil/ws_assert.h>

#include <wsutil/filesystem.h>

#include <wsutil/report_message.h>

#include "packet-tcp.h"

#include "packet-x509af.h"

#include "packet-tls.h"

#include "packet-tls-utils.h"

#include "packet-ber.h"

void proto_register_tls(void);

#ifdef HAVE_LIBGNUTLS

static ssldecrypt_assoc_t *tlskeylist_uats;

static unsigned ntlsdecrypt;

#endif

static bool tls_desegment          = true;

static bool tls_desegment_app_data = true;

static bool tls_ignore_mac_failed;

#define PORT_HEUR_DEFAULT "443"

/* Try heuristic dissectors before dissectors assigned to a port.

 * Dissectors assigned via ALPN always take precedence. */

static range_t *tls_try_heuristic_first;

/*********************************************************************

 *

 * Protocol Constants, Variables, Data Structures

 *

 *********************************************************************/

/* Initialize the protocol and registered fields */

static int tls_follow_tap                    = -1;

static int exported_pdu_tap                  = -1;

static int proto_tls;

static int hf_tls_record;

static int hf_tls_record_content_type;

static int hf_tls_record_opaque_type;

static int hf_tls_record_version;

static int hf_tls_record_length;

static int hf_tls_record_appdata;

static int hf_tls_record_appdata_proto;

static int hf_ssl2_record;

static int hf_ssl2_record_is_escape;

static int hf_ssl2_record_padding_length;

static int hf_ssl2_msg_type;

static int hf_tls_alert_message;

static int hf_tls_alert_message_level;

static int hf_tls_alert_message_description;

static int hf_tls_handshake_protocol;

static int hf_tls_handshake_type;

static int hf_tls_handshake_length;

static int hf_tls_handshake_npn_selected_protocol_len;

static int hf_tls_handshake_npn_selected_protocol;

static int hf_tls_handshake_npn_padding_len;

static int hf_tls_handshake_npn_padding;

static int hf_ssl2_handshake_cipher_spec_len;

static int hf_ssl2_handshake_session_id_len;

static int hf_ssl2_handshake_challenge_len;

static int hf_ssl2_handshake_cipher_spec;

static int hf_ssl2_handshake_challenge;

static int hf_ssl2_handshake_clear_key_len;

static int hf_ssl2_handshake_enc_key_len;

static int hf_ssl2_handshake_key_arg_len;

static int hf_ssl2_handshake_clear_key;

static int hf_ssl2_handshake_enc_key;

static int hf_ssl2_handshake_key_arg;

static int hf_ssl2_handshake_session_id_hit;

static int hf_ssl2_handshake_cert_type;

static int hf_ssl2_handshake_connection_id_len;

static int hf_ssl2_handshake_connection_id;

static int hf_tls_reassembled_in;

static int hf_tls_reassembled_length;

static int hf_tls_reassembled_data;

static int hf_tls_segments;

static int hf_tls_segment;

static int hf_tls_segment_overlap;

static int hf_tls_segment_overlap_conflict;

static int hf_tls_segment_multiple_tails;

static int hf_tls_segment_too_long_fragment;

static int hf_tls_segment_error;

static int hf_tls_segment_count;

static int hf_tls_segment_data;

static int hf_tls_handshake_reassembled_in;

static int hf_tls_handshake_fragments;

static int hf_tls_handshake_fragment;

static int hf_tls_handshake_fragment_count;

static int hf_tls_heartbeat_message;

static int hf_tls_heartbeat_message_type;

static int hf_tls_heartbeat_message_payload_length;

static int hf_tls_heartbeat_message_payload;

static int hf_tls_heartbeat_message_padding;

static ssl_hfs_t ssl_hfs;

/* Initialize the subtree pointers */

static int ett_tls;

static int ett_tls_record;

static int ett_tls_alert;

static int ett_tls_handshake;

static int ett_tls_heartbeat;

static int ett_tls_certs;

static int ett_tls_segments;

static int ett_tls_segment;

static int ett_tls_hs_fragments;

static int ett_tls_hs_fragment;

static expert_field ei_ssl2_handshake_session_id_len_error;

static expert_field ei_ssl3_heartbeat_payload_length;

static expert_field ei_tls_unexpected_message;

/* Generated from convert_proto_tree_add_text.pl */

static expert_field ei_tls_ignored_unknown_record;

/* not all of the hf_fields below make sense for TLS but we have to provide

   them anyways to comply with the api (which was aimed for ip fragment

   reassembly) */

static const fragment_items ssl_segment_items = {

    &ett_tls_segment,

    &ett_tls_segments,

    &hf_tls_segments,

    &hf_tls_segment,

    &hf_tls_segment_overlap,

    &hf_tls_segment_overlap_conflict,

    &hf_tls_segment_multiple_tails,

    &hf_tls_segment_too_long_fragment,

    &hf_tls_segment_error,

    &hf_tls_segment_count,

    &hf_tls_reassembled_in,

    &hf_tls_reassembled_length,

    &hf_tls_reassembled_data,

    "Segments"

};

/* Fragmented handshake messages. */

static const fragment_items tls_hs_fragment_items = {

    &ett_tls_hs_fragment,

    &ett_tls_hs_fragments,

    &hf_tls_handshake_fragments,

    &hf_tls_handshake_fragment,

    &hf_tls_segment_overlap,    // Do not care about the errors, should not happen.

    &hf_tls_segment_overlap_conflict,

    &hf_tls_segment_multiple_tails,

    &hf_tls_segment_too_long_fragment,

    &hf_tls_segment_error,

    &hf_tls_handshake_fragment_count,

    NULL,                           /* unused - &hf_tls_handshake_reassembled_in, */

    NULL,                           /* do not display redundant length */

    NULL,                           /* do not display redundant data */

    "Fragments"

};

static SSL_COMMON_LIST_T(dissect_ssl3_hf);

static void

ssl_proto_tree_add_segment_data(

    proto_tree  *tree,

    tvbuff_t    *tvb,

    int          offset,

    int          length,

    const char *prefix)

{

    proto_tree_add_bytes_format(

        tree,

        hf_tls_segment_data,

        tvb,

        offset,

        length,

        NULL,

        "%sTLS segment data (%u %s)",

        prefix != NULL ? prefix : "",

        length == -1 ? tvb_reported_length_remaining(tvb, offset) : length,

        plurality(length, "byte", "bytes"));

}

static ssl_master_key_map_t       ssl_master_key_map;

#ifdef HAVE_LIBGNUTLS

static GHashTable         *ssl_key_hash;

static wmem_stack_t       *key_list_stack;

static uat_t              *ssldecrypt_uat;

static const char         *ssl_keys_list;

#endif

static dissector_table_t   ssl_associations;

static dissector_handle_t  tls_handle;

static StringInfo          ssl_compressed_data;

static StringInfo          ssl_decrypted_data;

static int                 ssl_decrypted_data_avail;

static FILE               *ssl_keylog_file;

static ssl_common_options_t ssl_options;

/* List of dissectors to call for TLS data */

static heur_dissector_list_t ssl_heur_subdissector_list;

static const char *ssl_debug_file_name;

/* Forward declaration we need below */

void proto_reg_handoff_ssl(void);

/* Desegmentation of TLS streams */

/* table to hold defragmented TLS streams */

static reassembly_table ssl_reassembly_table;

/* Table to hold fragmented TLS handshake records. */

static reassembly_table tls_hs_reassembly_table;

static uint32_t hs_reassembly_id_count;

/* Fragment TLS handshake reassembly functions. The records are

 * organized by session and direction; this allows reassembly across

 * QUIC connection migration when addresses and ports change.

 */

typedef struct _tls_hs_fragment_key {

        const SslSession *session;

        uint32_t id;

        bool from_server;

} tls_hs_fragment_key;

static unsigned

tls_hs_fragment_hash(const void *k)

{

        const tls_hs_fragment_key* key = (const tls_hs_fragment_key*) k;

        return key->id;

}

static int

tls_hs_fragment_equal(const void *k1, const void *k2)

{

        const tls_hs_fragment_key* key1 = (const tls_hs_fragment_key*) k1;

        const tls_hs_fragment_key* key2 = (const tls_hs_fragment_key*) k2;

        return (key1->id == key2->id &&

                key1->session == key2->session &&

                key1->from_server == key2->from_server);

}

static void *

tls_hs_fragment_temporary_key(const packet_info *pinfo, const uint32_t id,

                     const void *data)

{

        tls_hs_fragment_key *key = g_slice_new0(tls_hs_fragment_key);

        SslSession *session = (SslSession *)data;

        key->id = id;

        key->session = session;

        key->from_server = ssl_packet_from_server(session, ssl_associations, pinfo);

        return key;

}

static void

tls_hs_fragment_free_temporary_key(void *ptr)

{

        tls_hs_fragment_key *key = (tls_hs_fragment_key *)ptr;

        g_slice_free(tls_hs_fragment_key, key);

}

static const reassembly_table_functions

tls_hs_reassembly_table_functions = {

        tls_hs_fragment_hash,

        tls_hs_fragment_equal,

        tls_hs_fragment_temporary_key,

        tls_hs_fragment_temporary_key,

        tls_hs_fragment_free_temporary_key,

        tls_hs_fragment_free_temporary_key,

};

/* initialize/reset per capture state data (ssl sessions cache) */

static void

ssl_init(void)

{

    module_t *ssl_module = prefs_find_module("tls");

    pref_t   *keys_list_pref;

    ssl_common_init(&ssl_master_key_map,

                    &ssl_decrypted_data, &ssl_compressed_data);

    ssl_debug_flush();

    /* We should have loaded "keys_list" by now. Mark it obsolete */

    if (ssl_module) {

        keys_list_pref = prefs_find_preference(ssl_module, "keys_list");

        if (! prefs_get_preference_obsolete(keys_list_pref)) {

            prefs_set_preference_obsolete(keys_list_pref);

        }

    }

    /* Reset the identifier for a group of handshake fragments. */

    hs_reassembly_id_count = 0;

}

static void

ssl_cleanup(void)

{

#ifdef HAVE_LIBGNUTLS

    if (key_list_stack != NULL) {

        wmem_destroy_stack(key_list_stack);

        key_list_stack = NULL;

    }

#endif

    ssl_common_cleanup(&ssl_master_key_map, &ssl_keylog_file,

                       &ssl_decrypted_data, &ssl_compressed_data);

}

ssl_master_key_map_t *

tls_get_master_key_map(bool load_secrets)

{

    // Try to load new keys.

    if (load_secrets) {

        ssl_load_keyfile(ssl_options.keylog_filename, &ssl_keylog_file, &ssl_master_key_map);

    }

    return &ssl_master_key_map;

}

#ifdef HAVE_LIBGNUTLS

/* parse ssl related preferences (private keys and ports association strings) */

static void

ssl_parse_uat(void)

{

    unsigned           i;

    uint16_t           port;

    dissector_handle_t handle;

    ssl_set_debug(ssl_debug_file_name);

    if (ssl_key_hash)

    {

        g_hash_table_destroy(ssl_key_hash);

    }

    /* remove only associations created from key list */

    if (key_list_stack != NULL) {

        while (wmem_stack_count(key_list_stack) > 0) {

          port = GPOINTER_TO_UINT(wmem_stack_pop(key_list_stack));

          handle = dissector_get_uint_handle(ssl_associations, port);

          if (handle != NULL)

              ssl_association_remove("tls.port", tls_handle, handle, port, false);

        }

    }

    /* parse private keys string, load available keys and put them in key hash*/

    ssl_key_hash = privkey_hash_table_new();

    if (ntlsdecrypt > 0) {

        if (key_list_stack == NULL)

            key_list_stack = wmem_stack_new(NULL);

        for (i = 0; i < ntlsdecrypt; i++) {

            ssldecrypt_assoc_t *ssl_uat = &(tlskeylist_uats[i]);

            ssl_parse_key_list(ssl_uat, ssl_key_hash, "tls.port", tls_handle, true);

            if (key_list_stack && ws_strtou16(ssl_uat->port, NULL, &port) && port > 0)

                wmem_stack_push(key_list_stack, GUINT_TO_POINTER(port));

        }

    }

    ssl_debug_flush();

}

static void

ssl_reset_uat(void)

{

    g_hash_table_destroy(ssl_key_hash);

    ssl_key_hash = NULL;

}

static void

ssl_parse_old_keys(void)

{

    char **old_keys, **parts, *err;

    char   *uat_entry;

    unsigned   i;

    /* Import old-style keys */

    if (ssldecrypt_uat && ssl_keys_list && ssl_keys_list[0]) {

        old_keys = g_strsplit(ssl_keys_list, ";", 0);

        for (i = 0; old_keys[i] != NULL; i++) {

            parts = g_strsplit(old_keys[i], ",", 5);

            if (parts[0] && parts[1] && parts[2] && parts[3]) {

                char *path = uat_esc(parts[3], (unsigned)strlen(parts[3]));

                const char *password = parts[4] ? parts[4] : "";

                uat_entry = wmem_strdup_printf(NULL, "\"%s\",\"%s\",\"%s\",\"%s\",\"%s\"",

                                parts[0], parts[1], parts[2], path, password);

                g_free(path);

                if (!uat_load_str(ssldecrypt_uat, uat_entry, &err)) {

                    ssl_debug_printf("ssl_parse_old_keys: Can't load UAT string %s: %s\n",

                                     uat_entry, err);

                    g_free(err);

                }

                wmem_free(NULL, uat_entry);

            }

            g_strfreev(parts);

        }

        g_strfreev(old_keys);

    }

}

#endif  /* HAVE_LIBGNUTLS */

static tap_packet_status

ssl_follow_tap_listener(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *ssl, tap_flags_t flags _U_)

{

    follow_info_t *      follow_info = (follow_info_t*) tapdata;

    follow_record_t * follow_record = NULL;

    const SslRecordInfo *appl_data = NULL;

    const SslPacketInfo *pi = (const SslPacketInfo*)ssl;

    show_stream_t        from = FROM_CLIENT;

    /* Skip packets without decrypted payload data. */

    if (!pi || !pi->records) return TAP_PACKET_DONT_REDRAW;

    /* Compute the packet's sender. */

    if (follow_info->client_port == 0) {

        follow_info->client_port = pinfo->srcport;

        copy_address(&follow_info->client_ip, &pinfo->src);

        follow_info->server_port = pinfo->destport;

        copy_address(&follow_info->server_ip, &pinfo->dst);

    }

    if (addresses_equal(&follow_info->client_ip, &pinfo->src) &&

            follow_info->client_port == pinfo->srcport) {

        from = FROM_CLIENT;

    } else {

        from = FROM_SERVER;

    }

    for (appl_data = pi->records; appl_data != NULL; appl_data = appl_data->next) {

        /* Include only application data in the record, skipping things like

         * Handshake messages and alerts. */

        if (appl_data->type != SSL_ID_APP_DATA) continue;

        /* TCP segments that contain the end of two or more TLS PDUs will be

           queued to TLS taps for each of those PDUs. Therefore a single

           packet could be processed by this TLS tap listener multiple times.

           The following test handles that scenario by treating the

           follow_info->bytes_written[] values as the next expected

           appl_data->seq. Any appl_data instances that fall below that have

           already been processed and must be skipped. */

        if (appl_data->seq < follow_info->bytes_written[from]) continue;

        /* Allocate a follow_record_t to hold the current appl_data

           instance's decrypted data. Even though it would be possible to

           consolidate multiple appl_data instances into a single record, it is

           beneficial to use a one-to-one mapping. This affords the Follow

           Stream dialog view modes (ASCII, EBCDIC, Hex Dump, C Arrays, Raw)

           the opportunity to accurately reflect TLS PDU boundaries. Currently

           the Hex Dump view does by starting a new line, and the C Arrays

           view does by starting a new array declaration. */

        follow_record = g_new(follow_record_t,1);

        follow_record->is_server = (from == FROM_SERVER);

        follow_record->packet_num = pinfo->num;

        follow_record->abs_ts = pinfo->abs_ts;

        follow_record->data = g_byte_array_sized_new(appl_data->data_len);

        follow_record->data = g_byte_array_append(follow_record->data,

                                              appl_data->plain_data,

                                              appl_data->data_len);

        /* Add the record to the follow_info structure. */

        follow_info->payload = g_list_prepend(follow_info->payload, follow_record);

        follow_info->bytes_written[from] += appl_data->data_len;

    }

    return TAP_PACKET_DONT_REDRAW;

}

/*********************************************************************

 *

 * Forward Declarations

 *

 *********************************************************************/

/*

 * SSL version 3 and TLS dissectors

 *

 */

/* record layer dissector */

static int dissect_ssl3_record(tvbuff_t *tvb, packet_info *pinfo,

                                proto_tree *tree, uint32_t offset,

                                SslSession *session, int is_from_server,

                                bool *need_desegmentation,

                                SslDecryptSession *conv_data,

                                uint8_t curr_layer_num_ssl,

                                struct tlsinfo *tlsinfo);

/* alert message dissector */

static void dissect_ssl3_alert(tvbuff_t *tvb, packet_info *pinfo,

                               proto_tree *tree, uint32_t offset,

                               uint32_t record_length, const SslSession *session,

                               struct tlsinfo *tlsinfo);

/* handshake protocol dissector */

static void dissect_tls_handshake(tvbuff_t *tvb, packet_info *pinfo,

                       proto_tree *tree, uint32_t offset,

                       uint32_t offset_end, bool maybe_encrypted,

                       unsigned record_id, uint8_t curr_layer_num_tls,

                       SslSession *session, int is_from_server,

                       SslDecryptSession *ssl,

                       const uint16_t version);

static void dissect_tls_handshake_full(tvbuff_t *tvb, packet_info *pinfo,

                                  proto_tree *tree, uint32_t offset,

                                  SslSession *session, int is_from_server,

                                  SslDecryptSession *conv_data,

                                  const uint16_t version,

                                  bool is_first_msg, uint8_t curr_layer_num_tls);

/* heartbeat message dissector */

static void dissect_ssl3_heartbeat(tvbuff_t *tvb, packet_info *pinfo,

                                   proto_tree *tree, uint32_t offset,

                                   const SslSession *session, uint32_t record_length,

                                   bool decrypted);

static void dissect_ssl3_hnd_encrypted_exts(tvbuff_t *tvb,

                                            proto_tree *tree,

                                            uint32_t offset);

/*

 * SSL version 2 dissectors

 *

 */

/* record layer dissector */

static int dissect_ssl2_record(tvbuff_t *tvb, packet_info *pinfo,

                                proto_tree *tree, uint32_t offset,

                                SslSession *session,

                                bool *need_desegmentation,

                                SslDecryptSession *ssl);

/* client hello dissector */

static void dissect_ssl2_hnd_client_hello(tvbuff_t *tvb, packet_info *pinfo,

                                          proto_tree *tree,

                                          uint32_t offset,

                                          SslDecryptSession *ssl);

/* client master key dissector */

static void dissect_ssl2_hnd_client_master_key(tvbuff_t *tvb,

                                               proto_tree *tree,

                                               uint32_t offset);

/* server hello dissector */

static void dissect_ssl2_hnd_server_hello(tvbuff_t *tvb,

                                          proto_tree *tree,

                                          uint32_t offset, packet_info *pinfo);

/*

 * Support Functions

 *

 */

static int   ssl_is_valid_ssl_version(const uint16_t version);

static int   ssl_is_v2_client_hello(tvbuff_t *tvb, const uint32_t offset);

static int   ssl_looks_like_sslv2(tvbuff_t *tvb, const uint32_t offset);

static int   ssl_looks_like_sslv3(tvbuff_t *tvb, const uint32_t offset);

static int   ssl_looks_like_valid_v2_handshake(tvbuff_t *tvb,

                                               const uint32_t offset,

                                               const uint32_t record_length);

static void

process_ssl_payload(tvbuff_t *tvb, int offset, packet_info *pinfo,

                    proto_tree *tree, SslSession *session,

                    dissector_handle_t app_handle_port,

                    struct tlsinfo *tlsinfo);

static uint32_t

tls_msp_fragment_id(struct tcp_multisegment_pdu *msp);

static void

print_tls_fragment_tree(fragment_head *ipfd_head, proto_tree *tree, proto_tree *tls_tree, packet_info *pinfo, tvbuff_t *next_tvb);

/*********************************************************************

 *

 * Main dissector

 *

 *********************************************************************/

/*

 * Code to actually dissect the packets

 */

static int

dissect_ssl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

    conversation_t    *conversation;

    proto_item        *ti;

    proto_tree        *ssl_tree;

    uint32_t           offset;

    bool               need_desegmentation;

    SslDecryptSession *ssl_session, *ssl_session_save;

    SslSession        *session;

    int                is_from_server;

    struct tcpinfo    *tcpinfo;

    struct tlsinfo     tlsinfo;

    /*

     * A single packet may contain multiple TLS records. Two possible scenarios:

     *

     * - Multiple TLS records belonging to the same TLS session.

     * - TLS within a different encrypted TLS tunnel.

     *

     * To support the second case, 'curr_layer_num_ssl' is used as identifier

     * for the current TLS layer.

     */

    uint8_t            curr_layer_num_ssl = pinfo->curr_proto_layer_num;

    ti = NULL;

    ssl_tree   = NULL;

    offset = 0;

    ssl_session = NULL;

    memset(&tlsinfo, 0, sizeof(tlsinfo));

    tcpinfo = (struct tcpinfo*)data;

    if (tvb_captured_length(tvb) > 4) {

        const uint8_t *tmp = tvb_get_ptr(tvb, 0, 4);

        if (g_ascii_isprint(tmp[0]) &&

                g_ascii_isprint(tmp[1]) &&

                g_ascii_isprint(tmp[2]) &&

                g_ascii_isprint(tmp[3])) {

            /* it is extremely unlikely that real TLS traffic starts with four

             * printable ascii characters; this looks like it's unencrypted

             * text, so assume it's not ours (SSL does have some unencrypted

             * text fields in certain packets, but you'd have to get very

             * unlucky with TCP fragmentation to have one of those fields at the

             * beginning of a TCP payload at the beginning of the capture where

             * reassembly hasn't started yet) */

            return 0;

        }

    }

    ssl_debug_printf("\ndissect_ssl enter frame #%u (%s)\n", pinfo->num, (pinfo->fd->visited)?"already visited":"first time");

    /* Track the version using conversations to reduce the

     * chance that a packet that simply *looks* like a v2 or

     * v3 packet is dissected improperly.  This also allows

     * us to more frequently set the protocol column properly

     * for continuation data frames.

     *

     * Also: We use the copy in conv_version as our cached copy,

     *       so that we don't have to search the conversation

     *       table every time we want the version; when setting

     *       the conv_version, must set the copy in the conversation

     *       in addition to conv_version

     */

    /* Get the conversation with the deinterlacing strategy,

     * assuming it does exist, as created by an underlying proto.

     */

    conversation = find_conversation_strat(pinfo, conversation_pt_to_conversation_type(pinfo->ptype), 0);

    if(conversation == NULL) {

        conversation = conversation_new(pinfo->num, &pinfo->src,

            &pinfo->dst, conversation_pt_to_conversation_type(pinfo->ptype),

            pinfo->srcport, pinfo->destport, 0);

    }

    ssl_session_save = ssl_session = ssl_get_session(conversation, tls_handle);

    session = &ssl_session->session;

    is_from_server = ssl_packet_from_server(session, ssl_associations, pinfo);

    if (session->last_nontls_frame != 0 &&

        session->last_nontls_frame >= pinfo->num) {

        /* This conversation started at a different protocol and STARTTLS was

         * used, but this packet comes too early. */

        return 0;

    }

    /* try decryption only the first time we see this packet

     * (to keep cipher synchronized) */

    if (pinfo->fd->visited)

         ssl_session = NULL;

    ssl_debug_printf("  conversation = %p, ssl_session = %p\n", (void *)conversation, (void *)ssl_session);

    /* Initialize the protocol column; we'll override it later when we

     * detect a different version or flavor of TLS (assuming we don't

     * throw an exception before we get the chance to do so). */

    col_set_str(pinfo->cinfo, COL_PROTOCOL,

             val_to_str_const(session->version, ssl_version_short_names, "SSL"));

    /* clear the info column */

    col_clear(pinfo->cinfo, COL_INFO);

    /* TCP packets and TLS records are orthogonal.

     * A tcp packet may contain multiple ssl records and an ssl

     * record may be spread across multiple tcp packets.

     *

     * This loop accounts for multiple ssl records in a single

     * frame, but not a single ssl record across multiple tcp

     * packets.

     *

     * Handling the single ssl record across multiple packets

     * may be possible using wireshark conversations, but

     * probably not cleanly.  May have to wait for tcp stream

     * reassembly.

     */

    /* Create display subtree for TLS as a whole */

    if (tree)

    {

        ti = proto_tree_add_item(tree, proto_tls, tvb, 0, -1, ENC_NA);

        ssl_tree = proto_item_add_subtree(ti, ett_tls);

    }

    /* iterate through the records in this tvbuff */

    while (tvb_reported_length_remaining(tvb, offset) > 0)

    {

        ssl_debug_printf("  record: offset = %d, reported_length_remaining = %d\n", offset, tvb_reported_length_remaining(tvb, offset));

        /*

         * Assume, for now, that this doesn't need desegmentation.

         */

        need_desegmentation = false;

        /* first try to dispatch off the cached version

         * known to be associated with the conversation

         */

        switch (session->version) {

        case SSLV2_VERSION:

            offset = dissect_ssl2_record(tvb, pinfo, ssl_tree,

                                         offset, session,

                                         &need_desegmentation,

                                         ssl_session);

            break;

        case SSLV3_VERSION:

        case TLSV1_VERSION:

        case TLSV1DOT1_VERSION:

        case TLSV1DOT2_VERSION:

        case TLCPV1_VERSION:

            /* SSLv3/TLS record headers need at least 1+2+2 = 5 bytes. */

            if (tvb_reported_length_remaining(tvb, offset) < 5) {

                if (tls_desegment && pinfo->can_desegment) {

                    pinfo->desegment_offset = offset;

                    pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;

                    need_desegmentation = true;

                } else {

                    /* Not enough bytes available. Stop here. */

                    offset = tvb_reported_length(tvb);

                }

                break;

            }

            /* the version tracking code works too well ;-)

             * at times, we may visit a v2 client hello after

             * we already know the version of the connection;

             * work around that here by detecting and calling

             * the v2 dissector instead

             */

            if (ssl_is_v2_client_hello(tvb, offset))

            {

                offset = dissect_ssl2_record(tvb, pinfo, ssl_tree,

                                             offset, session,

                                             &need_desegmentation,

                                             ssl_session);

            }

            else

            {

                offset = dissect_ssl3_record(tvb, pinfo, ssl_tree,

                                             offset, session, is_from_server,

                                             &need_desegmentation,

                                             ssl_session,

                                             curr_layer_num_ssl, &tlsinfo);

            }

            break;

            /* that failed, so apply some heuristics based

             * on this individual packet

             */

        default:

            /*

             * If the version is unknown, assume SSLv3/TLS which has a record

             * size of at least 5 bytes (SSLv2 record header is two or three

             * bytes, but the data will hopefully be larger than three bytes).

             */

            if (tvb_reported_length_remaining(tvb, offset) < 5) {

                if (tls_desegment && pinfo->can_desegment) {

                    pinfo->desegment_offset = offset;

                    pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;

                    need_desegmentation = true;

                } else {

                    /* Not enough bytes available. Stop here. */

                    offset = tvb_reported_length(tvb);

                }

                break;

            }

            if (ssl_looks_like_sslv2(tvb, offset))

            {

                /* looks like sslv2 client hello */

                offset = dissect_ssl2_record(tvb, pinfo, ssl_tree,

                                             offset, session,

                                             &need_desegmentation,

                                             ssl_session);

            }

            else if (ssl_looks_like_sslv3(tvb, offset))

            {

                /* looks like sslv3 or tls */

                offset = dissect_ssl3_record(tvb, pinfo, ssl_tree,

                                             offset, session, is_from_server,

                                             &need_desegmentation,

                                             ssl_session,

                                             curr_layer_num_ssl, &tlsinfo);

            }

            else

            {

                /* looks like something unknown, so lump into

                 * continuation data

                 */

                offset = tvb_reported_length(tvb);

                col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, "Continuation Data");

            }

            break;

        }

        /* Desegmentation return check */

        if (need_desegmentation) {

          ssl_debug_printf("  need_desegmentation: offset = %d, reported_length_remaining = %d\n",

                           offset, tvb_reported_length_remaining(tvb, offset));

          /* Make data available to ssl_follow_tap_listener */

          tap_queue_packet(tls_follow_tap, pinfo, p_get_proto_data(wmem_file_scope(), pinfo, proto_tls, curr_layer_num_ssl));

          return tvb_captured_length(tvb);

        }

    }

    unsigned ret = tvb_captured_length(tvb);

    /* Check for needing to reassemble at end of stream */

    ssl_session = ssl_session_save;

    if (ssl_session) {

        SslDecoder *decoder;

        /* retrieve decoder for this packet direction. Retrieve it

         * here because the decoder could have been created while

         * processing the records (e.g., an Early Data HTTP request

         * and response, with no Content-Length.) */

        if (is_from_server != 0) {

            decoder = ssl_session->server;

        }

        else {

            decoder = ssl_session->client;

        }

        if (decoder && decoder->flow && decoder->flow->flags & TCP_FLOW_REASSEMBLE_UNTIL_FIN) {

            /* We want to reassemble at the end of the stream. Are we

             * there? */

            /* There might be more than one record, and we don't want to tell

             * the application dissector that we got a TCP FIN if there are

             * more app data records to come. We add the FIN here.

             * XXX: We could have some logic to do so in dissect_ssl3_record()

             * when we're on the last record. Note that the last record could

             * be an alert, or this could be a FIN with no data, so we'd still

             * have to check here anyway.)

             */

            if (tcpinfo) {

                tlsinfo.end_of_stream |= (tcpinfo->flags & TH_FIN);

            }

            if (!tlsinfo.end_of_stream) {

                /* No. Tell the TCP dissector that we want to desegment

                 * at FIN, so that it will call the TLS dissector at FIN

                 * even if there is no TCP payload.

                 *

                 * However, tell it that we've already dissected all the

                 * the data in the packet, so that we avoid getting it

                 * later and trying to decrypt the records again.

                 * (XXX: An alternative would be checking for already decrypted

                 * records before trying to decrypt on the first pass.)

                 */

                pinfo->desegment_offset = tvb_captured_length(tvb);

                pinfo->desegment_len = DESEGMENT_UNTIL_FIN;

            } else {

                ssl_debug_printf("  desegmenting at end of stream (FIN)\n");

                struct tcp_multisegment_pdu *msp;

                msp = (struct tcp_multisegment_pdu *)wmem_tree_lookup32_le(decoder->flow->multisegment_pdus, decoder->flow->byte_seq);

                if (msp) {

                    fragment_head *ipfd_head;

                    ipfd_head = fragment_add(&ssl_reassembly_table, tvb, offset,

                                             pinfo, tls_msp_fragment_id(msp), msp,

                                             decoder->flow->byte_seq - msp->seq,

                                             0, false);

                    if (ipfd_head && ipfd_head->reassembled_in == pinfo->num) {

                        tvbuff_t *next_tvb;

                        /* create a new TVB structure for desegmented data */

                        next_tvb = tvb_new_chain(tvb, ipfd_head->tvb_data);

                        /* add desegmented data to the data source list */

                        add_new_data_source(pinfo, next_tvb, "Reassembled TLS");

                        /* Show details of the reassembly */

                        print_tls_fragment_tree(ipfd_head, tree, ssl_tree, pinfo, next_tvb);

                        /*

                         * Supply the sequence number of the first of the

                         * reassembled bytes.

                         */

                        tlsinfo.seq = msp->seq;

                        /* indicate that this is reassembled data */

                        tlsinfo.is_reassembled = true;

                        /* call subdissector */

                        process_ssl_payload(next_tvb, 0, pinfo, tree, session, session->app_handle, &tlsinfo);

                        if (ret == 0) {

                            /* XXX: Workaround for #15159. Ordinarily we

                             * return the number of bytes dissected, but zero

                             * indicates the dissector rejecting the data. If

                             * we are dissecting at FIN, but there were no new

                             * records added, we want to indicate that the

                             * dissector accepted the zero length payload so

                             * that the TLS (and, e.g. HTTP) layers don't get

                             * removed. So artificially return 1 instead.

                             * (The TCP dissector will ignore the number.)

                             */

                            ret = 1;

                        }

                    }

                }

            }

        }

    }

    col_set_fence(pinfo->cinfo, COL_INFO);

    ssl_debug_flush();

    /* Make data available to ssl_follow_tap_listener */

    tap_queue_packet(tls_follow_tap, pinfo, p_get_proto_data(wmem_file_scope(), pinfo, proto_tls, curr_layer_num_ssl));

    return ret;

}

/*

 * Dissect ECHConfigList structure, for use by the DNS dissector.

 */

static int

dissect_tls_echconfig(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

    return ssl_dissect_ext_ech_echconfiglist(&dissect_ssl3_hf, tvb, pinfo,

                                             tree, 0, tvb_reported_length(tvb));

}

/*

 * Dissect TLS 1.3 handshake messages (without the record layer).

 * For use by QUIC (draft -13).

 */

static int

dissect_tls13_handshake(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)

{

    conversation_t    *conversation;

    SslDecryptSession *ssl_session;

    SslSession        *session;

    int                is_from_server;

    proto_item        *ti;

    proto_tree        *ssl_tree;

    /**

     * A value that uniquely identifies this fragment in this frame.

     */

    unsigned           record_id = GPOINTER_TO_UINT(data);

    ssl_debug_printf("\n%s enter frame #%u (%s)\n", G_STRFUNC, pinfo->num, (pinfo->fd->visited)?"already visited":"first time");

    conversation = find_or_create_conversation(pinfo);

    ssl_session = ssl_get_session(conversation, tls_handle);

    session = &ssl_session->session;

    is_from_server = ssl_packet_from_server(session, ssl_associations, pinfo);

    if (session->version == SSL_VER_UNKNOWN) {

        session->version = TLSV1DOT3_VERSION;

        ssl_session->state |= SSL_VERSION;

        ssl_session->state |= SSL_QUIC_RECORD_LAYER;

    }

    /*

     * First pass: collect state (including Client Random for key matching).

     * Second pass: dissection only, no need to collect state.

     */

    if (PINFO_FD_VISITED(pinfo)) {

         ssl_session = NULL;

    }

    ssl_debug_printf("  conversation = %p, ssl_session = %p, from_server = %d\n",

                     (void *)conversation, (void *)ssl_session, is_from_server);

    /* Add a proto_tls item to allow simple "tls" display filter */

    ti = proto_tree_add_item(tree, proto_tls, tvb, 0, -1, ENC_NA);

    ssl_tree = proto_item_add_subtree(ti, ett_tls);