/src/wireshark/epan/dissectors/packet-tls-utils.c
Line | Count | Source |
1 | | /* packet-tls-utils.c |
2 | | * ssl manipulation functions |
3 | | * By Paolo Abeni <paolo.abeni@email.com> |
4 | | * |
5 | | * Copyright (c) 2013, Hauke Mehrtens <hauke@hauke-m.de> |
6 | | * Copyright (c) 2014, Peter Wu <peter@lekensteyn.nl> |
7 | | * |
8 | | * Wireshark - Network traffic analyzer |
9 | | * By Gerald Combs <gerald@wireshark.org> |
10 | | * Copyright 1998 Gerald Combs |
11 | | * |
12 | | * SPDX-License-Identifier: GPL-2.0-or-later |
13 | | */ |
14 | | |
15 | | #include "config.h" |
16 | | |
17 | | #include <stdlib.h> |
18 | | #include <errno.h> |
19 | | |
20 | | #include <epan/packet.h> |
21 | | #include <epan/strutil.h> |
22 | | #include <epan/addr_resolv.h> |
23 | | #include <epan/expert.h> |
24 | | #include <epan/asn1.h> |
25 | | #include <epan/proto_data.h> |
26 | | #include <epan/oids.h> |
27 | | #include <epan/secrets.h> |
28 | | |
29 | | #include <wsutil/inet_cidr.h> |
30 | | #include <wsutil/filesystem.h> |
31 | | #include <wsutil/file_util.h> |
32 | | #include <wsutil/str_util.h> |
33 | | #include <wsutil/report_message.h> |
34 | | #include <wsutil/pint.h> |
35 | | #include <wsutil/strtoi.h> |
36 | | #include <wsutil/wsgcrypt.h> |
37 | | #include <wsutil/rsa.h> |
38 | | #include <wsutil/ws_assert.h> |
39 | | #include <wsutil/zlib_compat.h> |
40 | | #include "packet-ber.h" |
41 | | #include "packet-x509af.h" |
42 | | #include "packet-x509if.h" |
43 | | #include "packet-tls-utils.h" |
44 | | #include "packet-ocsp.h" |
45 | | #include "packet-tls.h" |
46 | | #include "packet-dtls.h" |
47 | | #include "packet-quic.h" |
48 | | #if defined(HAVE_LIBGNUTLS) |
49 | | #include <gnutls/abstract.h> |
50 | | #include <gnutls/x509.h> |
51 | | #include <gnutls/pkcs12.h> |
52 | | #endif |
53 | | |
54 | | /* JA3/JA3S calculations must ignore GREASE values |
55 | | * as described in RFC 8701. |
56 | | */ |
57 | 10.2k | #define IS_GREASE_TLS(x) ((((x) & 0x0f0f) == 0x0a0a) && \ |
58 | 10.2k | (((x) & 0xff) == (((x)>>8) & 0xff))) |
59 | | |
60 | | /* Section 22.3 of RFC 9000 (QUIC) reserves values of this |
61 | | * form for a similar purpose as GREASE. |
62 | | */ |
63 | 0 | #define IS_GREASE_QUIC(x) ((x) > 27 ? ((((x) - 27) % 31) == 0) : 0) |
64 | | |
65 | | #define DTLS13_MAX_EPOCH 10 |
66 | | |
67 | | /* Lookup tables {{{ */ |
68 | | const value_string ssl_version_short_names[] = { |
69 | | { SSLV2_VERSION, "SSLv2" }, |
70 | | { SSLV3_VERSION, "SSLv3" }, |
71 | | { TLSV1_VERSION, "TLSv1" }, |
72 | | { TLCPV1_VERSION, "TLCP" }, |
73 | | { TLSV1DOT1_VERSION, "TLSv1.1" }, |
74 | | { TLSV1DOT2_VERSION, "TLSv1.2" }, |
75 | | { TLSV1DOT3_VERSION, "TLSv1.3" }, |
76 | | { DTLSV1DOT0_VERSION, "DTLSv1.0" }, |
77 | | { DTLSV1DOT2_VERSION, "DTLSv1.2" }, |
78 | | { DTLSV1DOT3_VERSION, "DTLSv1.3" }, |
79 | | { DTLSV1DOT0_OPENSSL_VERSION, "DTLS 1.0 (OpenSSL pre 0.9.8f)" }, |
80 | | { 0x00, NULL } |
81 | | }; |
82 | | |
83 | | const value_string ssl_versions[] = { |
84 | | { SSLV2_VERSION, "SSL 2.0" }, |
85 | | { SSLV3_VERSION, "SSL 3.0" }, |
86 | | { TLSV1_VERSION, "TLS 1.0" }, |
87 | | { TLCPV1_VERSION, "TLCP" }, |
88 | | { TLSV1DOT1_VERSION, "TLS 1.1" }, |
89 | | { TLSV1DOT2_VERSION, "TLS 1.2" }, |
90 | | { TLSV1DOT3_VERSION, "TLS 1.3" }, |
91 | | { 0x7F0E, "TLS 1.3 (draft 14)" }, |
92 | | { 0x7F0F, "TLS 1.3 (draft 15)" }, |
93 | | { 0x7F10, "TLS 1.3 (draft 16)" }, |
94 | | { 0x7F11, "TLS 1.3 (draft 17)" }, |
95 | | { 0x7F12, "TLS 1.3 (draft 18)" }, |
96 | | { 0x7F13, "TLS 1.3 (draft 19)" }, |
97 | | { 0x7F14, "TLS 1.3 (draft 20)" }, |
98 | | { 0x7F15, "TLS 1.3 (draft 21)" }, |
99 | | { 0x7F16, "TLS 1.3 (draft 22)" }, |
100 | | { 0x7F17, "TLS 1.3 (draft 23)" }, |
101 | | { 0x7F18, "TLS 1.3 (draft 24)" }, |
102 | | { 0x7F19, "TLS 1.3 (draft 25)" }, |
103 | | { 0x7F1A, "TLS 1.3 (draft 26)" }, |
104 | | { 0x7F1B, "TLS 1.3 (draft 27)" }, |
105 | | { 0x7F1C, "TLS 1.3 (draft 28)" }, |
106 | | { 0xFB17, "TLS 1.3 (Facebook draft 23)" }, |
107 | | { 0xFB1A, "TLS 1.3 (Facebook draft 26)" }, |
108 | | { DTLSV1DOT0_OPENSSL_VERSION, "DTLS 1.0 (OpenSSL pre 0.9.8f)" }, |
109 | | { DTLSV1DOT0_VERSION, "DTLS 1.0" }, |
110 | | { DTLSV1DOT2_VERSION, "DTLS 1.2" }, |
111 | | { DTLSV1DOT3_VERSION, "DTLS 1.3" }, |
112 | | { 0x0A0A, "Reserved (GREASE)" }, /* RFC 8701 */ |
113 | | { 0x1A1A, "Reserved (GREASE)" }, /* RFC 8701 */ |
114 | | { 0x2A2A, "Reserved (GREASE)" }, /* RFC 8701 */ |
115 | | { 0x3A3A, "Reserved (GREASE)" }, /* RFC 8701 */ |
116 | | { 0x4A4A, "Reserved (GREASE)" }, /* RFC 8701 */ |
117 | | { 0x5A5A, "Reserved (GREASE)" }, /* RFC 8701 */ |
118 | | { 0x6A6A, "Reserved (GREASE)" }, /* RFC 8701 */ |
119 | | { 0x7A7A, "Reserved (GREASE)" }, /* RFC 8701 */ |
120 | | { 0x8A8A, "Reserved (GREASE)" }, /* RFC 8701 */ |
121 | | { 0x9A9A, "Reserved (GREASE)" }, /* RFC 8701 */ |
122 | | { 0xAAAA, "Reserved (GREASE)" }, /* RFC 8701 */ |
123 | | { 0xBABA, "Reserved (GREASE)" }, /* RFC 8701 */ |
124 | | { 0xCACA, "Reserved (GREASE)" }, /* RFC 8701 */ |
125 | | { 0xDADA, "Reserved (GREASE)" }, /* RFC 8701 */ |
126 | | { 0xEAEA, "Reserved (GREASE)" }, /* RFC 8701 */ |
127 | | { 0xFAFA, "Reserved (GREASE)" }, /* RFC 8701 */ |
128 | | { 0x00, NULL } |
129 | | }; |
130 | | |
131 | | static const value_string ssl_version_ja4_names[] = { |
132 | | { 0x0100, "s1" }, |
133 | | { SSLV2_VERSION, "s2" }, |
134 | | { SSLV3_VERSION, "s3" }, |
135 | | { TLSV1_VERSION, "10" }, |
136 | | { TLSV1DOT1_VERSION, "11" }, |
137 | | { TLSV1DOT2_VERSION, "12" }, |
138 | | { TLSV1DOT3_VERSION, "13" }, |
139 | | { DTLSV1DOT0_VERSION, "d1" }, |
140 | | { DTLSV1DOT2_VERSION, "d2" }, |
141 | | { DTLSV1DOT3_VERSION, "d3" }, |
142 | | { 0x00, NULL } |
143 | | }; |
144 | | |
145 | | const value_string ssl_20_msg_types[] = { |
146 | | { SSL2_HND_ERROR, "Error" }, |
147 | | { SSL2_HND_CLIENT_HELLO, "Client Hello" }, |
148 | | { SSL2_HND_CLIENT_MASTER_KEY, "Client Master Key" }, |
149 | | { SSL2_HND_CLIENT_FINISHED, "Client Finished" }, |
150 | | { SSL2_HND_SERVER_HELLO, "Server Hello" }, |
151 | | { SSL2_HND_SERVER_VERIFY, "Server Verify" }, |
152 | | { SSL2_HND_SERVER_FINISHED, "Server Finished" }, |
153 | | { SSL2_HND_REQUEST_CERTIFICATE, "Request Certificate" }, |
154 | | { SSL2_HND_CLIENT_CERTIFICATE, "Client Certificate" }, |
155 | | { 0x00, NULL } |
156 | | }; |
157 | | /* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */ |
158 | | /* Note: sorted by ascending value so value_string-ext can do a binary search */ |
159 | | static const value_string ssl_20_cipher_suites[] = { |
160 | | { 0x000000, "TLS_NULL_WITH_NULL_NULL" }, |
161 | | { 0x000001, "TLS_RSA_WITH_NULL_MD5" }, |
162 | | { 0x000002, "TLS_RSA_WITH_NULL_SHA" }, |
163 | | { 0x000003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" }, |
164 | | { 0x000004, "TLS_RSA_WITH_RC4_128_MD5" }, |
165 | | { 0x000005, "TLS_RSA_WITH_RC4_128_SHA" }, |
166 | | { 0x000006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" }, |
167 | | { 0x000007, "TLS_RSA_WITH_IDEA_CBC_SHA" }, |
168 | | { 0x000008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
169 | | { 0x000009, "TLS_RSA_WITH_DES_CBC_SHA" }, |
170 | | { 0x00000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" }, |
171 | | { 0x00000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" }, |
172 | | { 0x00000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" }, |
173 | | { 0x00000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" }, |
174 | | { 0x00000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
175 | | { 0x00000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" }, |
176 | | { 0x000010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" }, |
177 | | { 0x000011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" }, |
178 | | { 0x000012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" }, |
179 | | { 0x000013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" }, |
180 | | { 0x000014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
181 | | { 0x000015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" }, |
182 | | { 0x000016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" }, |
183 | | { 0x000017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" }, |
184 | | { 0x000018, "TLS_DH_anon_WITH_RC4_128_MD5" }, |
185 | | { 0x000019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" }, |
186 | | { 0x00001a, "TLS_DH_anon_WITH_DES_CBC_SHA" }, |
187 | | { 0x00001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" }, |
188 | | { 0x00001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" }, |
189 | | { 0x00001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" }, |
190 | | #if 0 |
191 | | { 0x00001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" }, |
192 | | #endif |
193 | | /* RFC 2712 */ |
194 | | { 0x00001E, "TLS_KRB5_WITH_DES_CBC_SHA" }, |
195 | | { 0x00001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" }, |
196 | | { 0x000020, "TLS_KRB5_WITH_RC4_128_SHA" }, |
197 | | { 0x000021, "TLS_KRB5_WITH_IDEA_CBC_SHA" }, |
198 | | { 0x000022, "TLS_KRB5_WITH_DES_CBC_MD5" }, |
199 | | { 0x000023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" }, |
200 | | { 0x000024, "TLS_KRB5_WITH_RC4_128_MD5" }, |
201 | | { 0x000025, "TLS_KRB5_WITH_IDEA_CBC_MD5" }, |
202 | | { 0x000026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" }, |
203 | | { 0x000027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" }, |
204 | | { 0x000028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" }, |
205 | | { 0x000029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" }, |
206 | | { 0x00002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" }, |
207 | | { 0x00002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" }, |
208 | | /* RFC 4785 */ |
209 | | { 0x00002C, "TLS_PSK_WITH_NULL_SHA" }, |
210 | | { 0x00002D, "TLS_DHE_PSK_WITH_NULL_SHA" }, |
211 | | { 0x00002E, "TLS_RSA_PSK_WITH_NULL_SHA" }, |
212 | | /* RFC 5246 */ |
213 | | { 0x00002f, "TLS_RSA_WITH_AES_128_CBC_SHA" }, |
214 | | { 0x000030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" }, |
215 | | { 0x000031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" }, |
216 | | { 0x000032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" }, |
217 | | { 0x000033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" }, |
218 | | { 0x000034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" }, |
219 | | { 0x000035, "TLS_RSA_WITH_AES_256_CBC_SHA" }, |
220 | | { 0x000036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" }, |
221 | | { 0x000037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" }, |
222 | | { 0x000038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" }, |
223 | | { 0x000039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" }, |
224 | | { 0x00003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" }, |
225 | | { 0x00003B, "TLS_RSA_WITH_NULL_SHA256" }, |
226 | | { 0x00003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" }, |
227 | | { 0x00003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" }, |
228 | | { 0x00003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" }, |
229 | | { 0x00003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" }, |
230 | | { 0x000040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" }, |
231 | | { 0x000041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
232 | | { 0x000042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" }, |
233 | | { 0x000043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
234 | | { 0x000044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" }, |
235 | | { 0x000045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
236 | | { 0x000046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" }, |
237 | | { 0x000047, "TLS_ECDH_ECDSA_WITH_NULL_SHA" }, |
238 | | { 0x000048, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" }, |
239 | | { 0x000049, "TLS_ECDH_ECDSA_WITH_DES_CBC_SHA" }, |
240 | | { 0x00004A, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" }, |
241 | | { 0x00004B, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" }, |
242 | | { 0x00004C, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" }, |
243 | | { 0x000060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" }, |
244 | | { 0x000061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" }, |
245 | | { 0x000062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" }, |
246 | | { 0x000063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" }, |
247 | | { 0x000064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" }, |
248 | | { 0x000065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" }, |
249 | | { 0x000066, "TLS_DHE_DSS_WITH_RC4_128_SHA" }, |
250 | | { 0x000067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" }, |
251 | | { 0x000068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" }, |
252 | | { 0x000069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" }, |
253 | | { 0x00006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" }, |
254 | | { 0x00006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" }, |
255 | | { 0x00006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" }, |
256 | | { 0x00006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" }, |
257 | | /* 0x00,0x6E-83 Unassigned */ |
258 | | { 0x000084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
259 | | { 0x000085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" }, |
260 | | { 0x000086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
261 | | { 0x000087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" }, |
262 | | { 0x000088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
263 | | { 0x000089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" }, |
264 | | /* RFC 4279 */ |
265 | | { 0x00008A, "TLS_PSK_WITH_RC4_128_SHA" }, |
266 | | { 0x00008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" }, |
267 | | { 0x00008C, "TLS_PSK_WITH_AES_128_CBC_SHA" }, |
268 | | { 0x00008D, "TLS_PSK_WITH_AES_256_CBC_SHA" }, |
269 | | { 0x00008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" }, |
270 | | { 0x00008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" }, |
271 | | { 0x000090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" }, |
272 | | { 0x000091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" }, |
273 | | { 0x000092, "TLS_RSA_PSK_WITH_RC4_128_SHA" }, |
274 | | { 0x000093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" }, |
275 | | { 0x000094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" }, |
276 | | { 0x000095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" }, |
277 | | /* RFC 4162 */ |
278 | | { 0x000096, "TLS_RSA_WITH_SEED_CBC_SHA" }, |
279 | | { 0x000097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" }, |
280 | | { 0x000098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" }, |
281 | | { 0x000099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" }, |
282 | | { 0x00009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" }, |
283 | | { 0x00009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" }, |
284 | | /* RFC 5288 */ |
285 | | { 0x00009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" }, |
286 | | { 0x00009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" }, |
287 | | { 0x00009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" }, |
288 | | { 0x00009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" }, |
289 | | { 0x0000A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" }, |
290 | | { 0x0000A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" }, |
291 | | { 0x0000A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" }, |
292 | | { 0x0000A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" }, |
293 | | { 0x0000A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" }, |
294 | | { 0x0000A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" }, |
295 | | { 0x0000A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" }, |
296 | | { 0x0000A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" }, |
297 | | /* RFC 5487 */ |
298 | | { 0x0000A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" }, |
299 | | { 0x0000A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" }, |
300 | | { 0x0000AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" }, |
301 | | { 0x0000AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" }, |
302 | | { 0x0000AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" }, |
303 | | { 0x0000AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" }, |
304 | | { 0x0000AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" }, |
305 | | { 0x0000AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" }, |
306 | | { 0x0000B0, "TLS_PSK_WITH_NULL_SHA256" }, |
307 | | { 0x0000B1, "TLS_PSK_WITH_NULL_SHA384" }, |
308 | | { 0x0000B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" }, |
309 | | { 0x0000B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" }, |
310 | | { 0x0000B4, "TLS_DHE_PSK_WITH_NULL_SHA256" }, |
311 | | { 0x0000B5, "TLS_DHE_PSK_WITH_NULL_SHA384" }, |
312 | | { 0x0000B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" }, |
313 | | { 0x0000B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" }, |
314 | | { 0x0000B8, "TLS_RSA_PSK_WITH_NULL_SHA256" }, |
315 | | { 0x0000B9, "TLS_RSA_PSK_WITH_NULL_SHA384" }, |
316 | | /* From RFC 5932 */ |
317 | | { 0x0000BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
318 | | { 0x0000BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" }, |
319 | | { 0x0000BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
320 | | { 0x0000BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" }, |
321 | | { 0x0000BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
322 | | { 0x0000BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" }, |
323 | | { 0x0000C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
324 | | { 0x0000C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" }, |
325 | | { 0x0000C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
326 | | { 0x0000C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" }, |
327 | | { 0x0000C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
328 | | { 0x0000C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" }, |
329 | | /* 0x00,0xC6-FE Unassigned */ |
330 | | { 0x0000FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" }, |
331 | | /* 0x01-BF,* Unassigned */ |
332 | | /* From RFC 4492 */ |
333 | | { 0x00c001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" }, |
334 | | { 0x00c002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" }, |
335 | | { 0x00c003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" }, |
336 | | { 0x00c004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" }, |
337 | | { 0x00c005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" }, |
338 | | { 0x00c006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" }, |
339 | | { 0x00c007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" }, |
340 | | { 0x00c008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" }, |
341 | | { 0x00c009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" }, |
342 | | { 0x00c00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" }, |
343 | | { 0x00c00b, "TLS_ECDH_RSA_WITH_NULL_SHA" }, |
344 | | { 0x00c00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" }, |
345 | | { 0x00c00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" }, |
346 | | { 0x00c00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" }, |
347 | | { 0x00c00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" }, |
348 | | { 0x00c010, "TLS_ECDHE_RSA_WITH_NULL_SHA" }, |
349 | | { 0x00c011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" }, |
350 | | { 0x00c012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" }, |
351 | | { 0x00c013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" }, |
352 | | { 0x00c014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" }, |
353 | | { 0x00c015, "TLS_ECDH_anon_WITH_NULL_SHA" }, |
354 | | { 0x00c016, "TLS_ECDH_anon_WITH_RC4_128_SHA" }, |
355 | | { 0x00c017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" }, |
356 | | { 0x00c018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" }, |
357 | | { 0x00c019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" }, |
358 | | /* RFC 5054 */ |
359 | | { 0x00C01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" }, |
360 | | { 0x00C01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" }, |
361 | | { 0x00C01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" }, |
362 | | { 0x00C01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" }, |
363 | | { 0x00C01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" }, |
364 | | { 0x00C01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" }, |
365 | | { 0x00C020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" }, |
366 | | { 0x00C021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" }, |
367 | | { 0x00C022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" }, |
368 | | /* RFC 5589 */ |
369 | | { 0x00C023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" }, |
370 | | { 0x00C024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" }, |
371 | | { 0x00C025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" }, |
372 | | { 0x00C026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" }, |
373 | | { 0x00C027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" }, |
374 | | { 0x00C028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" }, |
375 | | { 0x00C029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" }, |
376 | | { 0x00C02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" }, |
377 | | { 0x00C02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" }, |
378 | | { 0x00C02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" }, |
379 | | { 0x00C02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" }, |
380 | | { 0x00C02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" }, |
381 | | { 0x00C02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" }, |
382 | | { 0x00C030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" }, |
383 | | { 0x00C031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" }, |
384 | | { 0x00C032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" }, |
385 | | /* RFC 5489 */ |
386 | | { 0x00C033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" }, |
387 | | { 0x00C034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" }, |
388 | | { 0x00C035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" }, |
389 | | { 0x00C036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" }, |
390 | | { 0x00C037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" }, |
391 | | { 0x00C038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" }, |
392 | | { 0x00C039, "TLS_ECDHE_PSK_WITH_NULL_SHA" }, |
393 | | { 0x00C03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" }, |
394 | | { 0x00C03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" }, |
395 | | /* 0xC0,0x3C-FF Unassigned |
396 | | 0xC1-FD,* Unassigned |
397 | | 0xFE,0x00-FD Unassigned |
398 | | 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen] |
399 | | 0xFF,0x00-FF Reserved for Private Use [RFC5246] |
400 | | */ |
401 | | |
402 | | /* old numbers used in the beginning |
403 | | * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */ |
404 | | { 0x00CC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
405 | | { 0x00CC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" }, |
406 | | { 0x00CC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
407 | | |
408 | | /* https://tools.ietf.org/html/rfc7905 */ |
409 | | { 0x00CCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
410 | | { 0x00CCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" }, |
411 | | { 0x00CCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
412 | | { 0x00CCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
413 | | { 0x00CCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
414 | | { 0x00CCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
415 | | { 0x00CCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
416 | | |
417 | | /* GM/T 0024-2014 */ |
418 | | { 0x00e001, "ECDHE_SM1_SM3"}, |
419 | | { 0x00e003, "ECC_SM1_SM3"}, |
420 | | { 0x00e005, "IBSDH_SM1_SM3"}, |
421 | | { 0x00e007, "IBC_SM1_SM3"}, |
422 | | { 0x00e009, "RSA_SM1_SM3"}, |
423 | | { 0x00e00a, "RSA_SM1_SHA1"}, |
424 | | { 0x00e011, "ECDHE_SM4_CBC_SM3"}, |
425 | | { 0x00e013, "ECC_SM4_CBC_SM3"}, |
426 | | { 0x00e015, "IBSDH_SM4_CBC_SM3"}, |
427 | | { 0x00e017, "IBC_SM4_CBC_SM3"}, |
428 | | { 0x00e019, "RSA_SM4_CBC_SM3"}, |
429 | | { 0x00e01a, "RSA_SM4_CBC_SHA1"}, |
430 | | { 0x00e01c, "RSA_SM4_CBC_SHA256"}, |
431 | | { 0x00e051, "ECDHE_SM4_GCM_SM3"}, |
432 | | { 0x00e053, "ECC_SM4_GCM_SM3"}, |
433 | | { 0x00e055, "IBSDH_SM4_GCM_SM3"}, |
434 | | { 0x00e057, "IBC_SM4_GCM_SM3"}, |
435 | | { 0x00e059, "RSA_SM4_GCM_SM3"}, |
436 | | { 0x00e05a, "RSA_SM4_GCM_SHA256"}, |
437 | | |
438 | | /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */ |
439 | | { 0x00E410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
440 | | { 0x00E411, "TLS_RSA_WITH_SALSA20_SHA1" }, |
441 | | { 0x00E412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
442 | | { 0x00E413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" }, |
443 | | { 0x00E414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" }, |
444 | | { 0x00E415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" }, |
445 | | { 0x00E416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
446 | | { 0x00E417, "TLS_PSK_WITH_SALSA20_SHA1" }, |
447 | | { 0x00E418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
448 | | { 0x00E419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" }, |
449 | | { 0x00E41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
450 | | { 0x00E41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" }, |
451 | | { 0x00E41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
452 | | { 0x00E41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" }, |
453 | | { 0x00E41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
454 | | { 0x00E41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" }, |
455 | | |
456 | | /* these from http://www.mozilla.org/projects/ |
457 | | security/pki/nss/ssl/fips-ssl-ciphersuites.html */ |
458 | | { 0x00fefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"}, |
459 | | { 0x00feff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" }, |
460 | | { 0x00ffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" }, |
461 | | { 0x00ffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"}, |
462 | | /* note that ciphersuites of {0x00????} are TLS cipher suites in |
463 | | * a sslv2 client hello message; the ???? above is the two-byte |
464 | | * tls cipher suite id |
465 | | */ |
466 | | |
467 | | { 0x010080, "SSL2_RC4_128_WITH_MD5" }, |
468 | | { 0x020080, "SSL2_RC4_128_EXPORT40_WITH_MD5" }, |
469 | | { 0x030080, "SSL2_RC2_128_CBC_WITH_MD5" }, |
470 | | { 0x040080, "SSL2_RC2_128_CBC_EXPORT40_WITH_MD5" }, |
471 | | { 0x050080, "SSL2_IDEA_128_CBC_WITH_MD5" }, |
472 | | { 0x060040, "SSL2_DES_64_CBC_WITH_MD5" }, |
473 | | { 0x0700c0, "SSL2_DES_192_EDE3_CBC_WITH_MD5" }, |
474 | | { 0x080080, "SSL2_RC4_64_WITH_MD5" }, |
475 | | |
476 | | { 0x00, NULL } |
477 | | }; |
478 | | |
479 | | value_string_ext ssl_20_cipher_suites_ext = VALUE_STRING_EXT_INIT(ssl_20_cipher_suites); |
480 | | |
481 | | |
482 | | /* |
483 | | * Supported Groups (formerly named "EC Named Curve"). |
484 | | * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 |
485 | | */ |
486 | | const value_string ssl_extension_curves[] = { |
487 | | { 1, "sect163k1" }, |
488 | | { 2, "sect163r1" }, |
489 | | { 3, "sect163r2" }, |
490 | | { 4, "sect193r1" }, |
491 | | { 5, "sect193r2" }, |
492 | | { 6, "sect233k1" }, |
493 | | { 7, "sect233r1" }, |
494 | | { 8, "sect239k1" }, |
495 | | { 9, "sect283k1" }, |
496 | | { 10, "sect283r1" }, |
497 | | { 11, "sect409k1" }, |
498 | | { 12, "sect409r1" }, |
499 | | { 13, "sect571k1" }, |
500 | | { 14, "sect571r1" }, |
501 | | { 15, "secp160k1" }, |
502 | | { 16, "secp160r1" }, |
503 | | { 17, "secp160r2" }, |
504 | | { 18, "secp192k1" }, |
505 | | { 19, "secp192r1" }, |
506 | | { 20, "secp224k1" }, |
507 | | { 21, "secp224r1" }, |
508 | | { 22, "secp256k1" }, |
509 | | { 23, "secp256r1" }, |
510 | | { 24, "secp384r1" }, |
511 | | { 25, "secp521r1" }, |
512 | | { 26, "brainpoolP256r1" }, /* RFC 7027 */ |
513 | | { 27, "brainpoolP384r1" }, /* RFC 7027 */ |
514 | | { 28, "brainpoolP512r1" }, /* RFC 7027 */ |
515 | | { 29, "x25519" }, /* RFC 8446 / RFC 8422 */ |
516 | | { 30, "x448" }, /* RFC 8446 / RFC 8422 */ |
517 | | { 31, "brainpoolP256r1tls13" }, /* RFC8734 */ |
518 | | { 32, "brainpoolP384r1tls13" }, /* RFC8734 */ |
519 | | { 33, "brainpoolP512r1tls13" }, /* RFC8734 */ |
520 | | { 34, "GC256A" }, /* RFC9189 */ |
521 | | { 35, "GC256B" }, /* RFC9189 */ |
522 | | { 36, "GC256C" }, /* RFC9189 */ |
523 | | { 37, "GC256D" }, /* RFC9189 */ |
524 | | { 38, "GC512A" }, /* RFC9189 */ |
525 | | { 39, "GC512B" }, /* RFC9189 */ |
526 | | { 40, "GC512C" }, /* RFC9189 */ |
527 | | { 41, "curveSM2" }, /* RFC 8998 */ |
528 | | { 256, "ffdhe2048" }, /* RFC 7919 */ |
529 | | { 257, "ffdhe3072" }, /* RFC 7919 */ |
530 | | { 258, "ffdhe4096" }, /* RFC 7919 */ |
531 | | { 259, "ffdhe6144" }, /* RFC 7919 */ |
532 | | { 260, "ffdhe8192" }, /* RFC 7919 */ |
533 | | { 512, "MLKEM512"}, /* draft-connolly-tls-mlkem-key-agreement-03 */ |
534 | | { 513, "MLKEM768"}, /* draft-connolly-tls-mlkem-key-agreement-03 */ |
535 | | { 514, "MLKEM1024"}, /* draft-connolly-tls-mlkem-key-agreement-03 */ |
536 | | { 2570, "Reserved (GREASE)" }, /* RFC 8701 */ |
537 | | { 4587, "SecP256r1MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-02 */ |
538 | | { 4588, "X25519MLKEM768" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */ |
539 | | { 4589, "SecP384r1MLKEM1024" }, /* draft-kwiatkowski-tls-ecdhe-mlkem-03 */ |
540 | | { 6682, "Reserved (GREASE)" }, /* RFC 8701 */ |
541 | | { 10794, "Reserved (GREASE)" }, /* RFC 8701 */ |
542 | | { 14906, "Reserved (GREASE)" }, /* RFC 8701 */ |
543 | | { 19018, "Reserved (GREASE)" }, /* RFC 8701 */ |
544 | | { 23130, "Reserved (GREASE)" }, /* RFC 8701 */ |
545 | | { 25497, "X25519Kyber768Draft00 (OBSOLETE)" }, /* draft-tls-westerbaan-xyber768d00-02 */ |
546 | | { 25498, "SecP256r1Kyber768Draft00 (OBSOLETE)" }, /* draft-kwiatkowski-tls-ecdhe-kyber-01 */ |
547 | | { 27242, "Reserved (GREASE)" }, /* RFC 8701 */ |
548 | | { 31354, "Reserved (GREASE)" }, /* RFC 8701 */ |
549 | | { 35466, "Reserved (GREASE)" }, /* RFC 8701 */ |
550 | | { 39578, "Reserved (GREASE)" }, /* RFC 8701 */ |
551 | | { 43690, "Reserved (GREASE)" }, /* RFC 8701 */ |
552 | | { 47802, "Reserved (GREASE)" }, /* RFC 8701 */ |
553 | | { 51914, "Reserved (GREASE)" }, /* RFC 8701 */ |
554 | | { 56026, "Reserved (GREASE)" }, /* RFC 8701 */ |
555 | | { 60138, "Reserved (GREASE)" }, /* RFC 8701 */ |
556 | | { 64250, "Reserved (GREASE)" }, /* RFC 8701 */ |
557 | | { 0xFF01, "arbitrary_explicit_prime_curves" }, |
558 | | { 0xFF02, "arbitrary_explicit_char2_curves" }, |
559 | | /* Below are various unofficial values that have been used for testing. */ |
560 | | /* PQC key exchange algorithms from OQS-OpenSSL, |
561 | | see https://github.com/open-quantum-safe/oqs-provider/blob/main/oqs-template/oqs-kem-info.md |
562 | | These use IANA unassigned values and this list may be incomplete. |
563 | | */ |
564 | | { 0x2F00, "p256_frodo640aes" }, |
565 | | { 0x2F01, "p256_frodo640shake" }, |
566 | | { 0x2F02, "p384_frodo976aes" }, |
567 | | { 0x0203, "frodo976shake" }, |
568 | | { 0x2F03, "p384_frodo976shake" }, |
569 | | { 0x0204, "frodo1344aes" }, |
570 | | { 0x2F04, "p521_frodo1344aes" }, |
571 | | { 0x0205, "frodo1344shake" }, |
572 | | { 0x2F05, "p521_frodo1344shake" }, |
573 | | { 0x023A, "kyber512" }, |
574 | | { 0x2F3A, "p256_kyber512" }, |
575 | | { 0x023C, "kyber768" }, |
576 | | { 0x2F3C, "p384_kyber768" }, |
577 | | { 0x023D, "kyber1024" }, |
578 | | { 0x2F3D, "p521_kyber1024" }, |
579 | | { 0x0214, "ntru_hps2048509" }, |
580 | | { 0x2F14, "p256_ntru_hps2048509" }, |
581 | | { 0x0215, "ntru_hps2048677" }, |
582 | | { 0x2F15, "p384_ntru_hps2048677" }, |
583 | | { 0x0216, "ntru_hps4096821" }, |
584 | | { 0x2F16, "p521_ntru_hps4096821" }, |
585 | | { 0x0245, "ntru_hps40961229" }, |
586 | | { 0x2F45, "p521_ntru_hps40961229" }, |
587 | | { 0x0217, "ntru_hrss701" }, |
588 | | { 0x2F17, "p384_ntru_hrss701" }, |
589 | | { 0x0246, "ntru_hrss1373" }, |
590 | | { 0x2F46, "p521_ntru_hrss1373" }, |
591 | | { 0x0218, "lightsaber" }, |
592 | | { 0x2F18, "p256_lightsaber" }, |
593 | | { 0x0219, "saber" }, |
594 | | { 0x2F19, "p384_saber" }, |
595 | | { 0x021A, "firesaber" }, |
596 | | { 0x2F1A, "p521_firesaber" }, |
597 | | { 0x021B, "sidhp434" }, |
598 | | { 0x2F1B, "p256_sidhp434" }, |
599 | | { 0x021C, "sidhp503" }, |
600 | | { 0x2F1C, "p256_sidhp503" }, |
601 | | { 0x021D, "sidhp610" }, |
602 | | { 0x2F1D, "p384_sidhp610" }, |
603 | | { 0x021E, "sidhp751" }, |
604 | | { 0x2F1E, "p521_sidhp751" }, |
605 | | { 0x021F, "sikep434" }, |
606 | | { 0x2F1F, "p256_sikep434" }, |
607 | | { 0x0220, "sikep503" }, |
608 | | { 0x2F20, "p256_sikep503" }, |
609 | | { 0x0221, "sikep610" }, |
610 | | { 0x2F21, "p384_sikep610" }, |
611 | | { 0x0222, "sikep751" }, |
612 | | { 0x2F22, "p521_sikep751" }, |
613 | | { 0x0238, "bikel1" }, |
614 | | { 0x2F38, "p256_bikel1" }, |
615 | | { 0x023B, "bikel3" }, |
616 | | { 0x2F3B, "p384_bikel3" }, |
617 | | { 0x023E, "kyber90s512" }, |
618 | | { 0x2F3E, "p256_kyber90s512" }, |
619 | | { 0x023F, "kyber90s768" }, |
620 | | { 0x2F3F, "p384_kyber90s768" }, |
621 | | { 0x0240, "kyber90s1024" }, |
622 | | { 0x2F40, "p521_kyber90s1024" }, |
623 | | { 0x022C, "hqc128" }, |
624 | | { 0x2F2C, "p256_hqc128" }, |
625 | | { 0x022D, "hqc192" }, |
626 | | { 0x2F2D, "p384_hqc192" }, |
627 | | { 0x022E, "hqc256" }, |
628 | | { 0x2F2E, "p521_hqc256" }, |
629 | | { 0x022F, "ntrulpr653" }, |
630 | | { 0x2F2F, "p256_ntrulpr653" }, |
631 | | { 0x0230, "ntrulpr761" }, |
632 | | { 0x2F43, "p256_ntrulpr761" }, |
633 | | { 0x0231, "ntrulpr857" }, |
634 | | { 0x2F31, "p384_ntrulpr857" }, |
635 | | { 0x0241, "ntrulpr1277" }, |
636 | | { 0x2F41, "p521_ntrulpr1277" }, |
637 | | { 0x0232, "sntrup653" }, |
638 | | { 0x2F32, "p256_sntrup653" }, |
639 | | { 0x0233, "sntrup761" }, |
640 | | { 0x2F44, "p256_sntrup761" }, |
641 | | { 0x0234, "sntrup857" }, |
642 | | { 0x2F34, "p384_sntrup857" }, |
643 | | { 0x0242, "sntrup1277" }, |
644 | | { 0x2F42, "p521_sntrup1277" }, |
645 | | /* Other PQ key exchange algorithms, using Reserved for Private Use values |
646 | | https://blog.cloudflare.com/post-quantum-for-all |
647 | | https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.txt */ |
648 | | { 0xFE30, "X25519Kyber512Draft00 (OBSOLETE)" }, |
649 | | { 0xFE31, "X25519Kyber768Draft00 (OBSOLETE)" }, |
650 | | { 0x00, NULL } |
651 | | }; |
652 | | |
653 | | const value_string ssl_curve_types[] = { |
654 | | { 1, "explicit_prime" }, |
655 | | { 2, "explicit_char2" }, |
656 | | { 3, "named_curve" }, |
657 | | { 0x00, NULL } |
658 | | }; |
659 | | |
660 | | const value_string ssl_extension_ec_point_formats[] = { |
661 | | { 0, "uncompressed" }, |
662 | | { 1, "ansiX962_compressed_prime" }, |
663 | | { 2, "ansiX962_compressed_char2" }, |
664 | | { 0x00, NULL } |
665 | | }; |
666 | | |
667 | | const value_string ssl_20_certificate_type[] = { |
668 | | { 0x00, "N/A" }, |
669 | | { 0x01, "X.509 Certificate" }, |
670 | | { 0x00, NULL } |
671 | | }; |
672 | | |
673 | | const value_string ssl_31_content_type[] = { |
674 | | { 20, "Change Cipher Spec" }, |
675 | | { 21, "Alert" }, |
676 | | { 22, "Handshake" }, |
677 | | { 23, "Application Data" }, |
678 | | { 24, "Heartbeat" }, |
679 | | { 25, "Connection ID" }, |
680 | | { 0x00, NULL } |
681 | | }; |
682 | | |
683 | | #if 0 |
684 | | /* XXX - would be used if we dissected the body of a Change Cipher Spec |
685 | | message. */ |
686 | | const value_string ssl_31_change_cipher_spec[] = { |
687 | | { 1, "Change Cipher Spec" }, |
688 | | { 0x00, NULL } |
689 | | }; |
690 | | #endif |
691 | | |
692 | | const value_string ssl_31_alert_level[] = { |
693 | | { 1, "Warning" }, |
694 | | { 2, "Fatal" }, |
695 | | { 0x00, NULL } |
696 | | }; |
697 | | |
698 | | const value_string ssl_31_alert_description[] = { |
699 | | { 0, "Close Notify" }, |
700 | | { 1, "End of Early Data" }, |
701 | | { 10, "Unexpected Message" }, |
702 | | { 20, "Bad Record MAC" }, |
703 | | { 21, "Decryption Failed" }, |
704 | | { 22, "Record Overflow" }, |
705 | | { 30, "Decompression Failure" }, |
706 | | { 40, "Handshake Failure" }, |
707 | | { 41, "No Certificate" }, |
708 | | { 42, "Bad Certificate" }, |
709 | | { 43, "Unsupported Certificate" }, |
710 | | { 44, "Certificate Revoked" }, |
711 | | { 45, "Certificate Expired" }, |
712 | | { 46, "Certificate Unknown" }, |
713 | | { 47, "Illegal Parameter" }, |
714 | | { 48, "Unknown CA" }, |
715 | | { 49, "Access Denied" }, |
716 | | { 50, "Decode Error" }, |
717 | | { 51, "Decrypt Error" }, |
718 | | { 60, "Export Restriction" }, |
719 | | { 70, "Protocol Version" }, |
720 | | { 71, "Insufficient Security" }, |
721 | | { 80, "Internal Error" }, |
722 | | { 86, "Inappropriate Fallback" }, |
723 | | { 90, "User Canceled" }, |
724 | | { 100, "No Renegotiation" }, |
725 | | { 109, "Missing Extension" }, |
726 | | { 110, "Unsupported Extension" }, |
727 | | { 111, "Certificate Unobtainable" }, |
728 | | { 112, "Unrecognized Name" }, |
729 | | { 113, "Bad Certificate Status Response" }, |
730 | | { 114, "Bad Certificate Hash Value" }, |
731 | | { 115, "Unknown PSK Identity" }, |
732 | | { 116, "Certificate Required" }, |
733 | | { 120, "No application Protocol" }, |
734 | | { 121, "ECH Required" }, |
735 | | { 0x00, NULL } |
736 | | }; |
737 | | |
738 | | const value_string ssl_31_handshake_type[] = { |
739 | | { SSL_HND_HELLO_REQUEST, "Hello Request" }, |
740 | | { SSL_HND_CLIENT_HELLO, "Client Hello" }, |
741 | | { SSL_HND_SERVER_HELLO, "Server Hello" }, |
742 | | { SSL_HND_HELLO_VERIFY_REQUEST, "Hello Verify Request"}, |
743 | | { SSL_HND_NEWSESSION_TICKET, "New Session Ticket" }, |
744 | | { SSL_HND_END_OF_EARLY_DATA, "End of Early Data" }, |
745 | | { SSL_HND_HELLO_RETRY_REQUEST, "Hello Retry Request" }, |
746 | | { SSL_HND_ENCRYPTED_EXTENSIONS, "Encrypted Extensions" }, |
747 | | { SSL_HND_CERTIFICATE, "Certificate" }, |
748 | | { SSL_HND_SERVER_KEY_EXCHG, "Server Key Exchange" }, |
749 | | { SSL_HND_CERT_REQUEST, "Certificate Request" }, |
750 | | { SSL_HND_SVR_HELLO_DONE, "Server Hello Done" }, |
751 | | { SSL_HND_CERT_VERIFY, "Certificate Verify" }, |
752 | | { SSL_HND_CLIENT_KEY_EXCHG, "Client Key Exchange" }, |
753 | | { SSL_HND_FINISHED, "Finished" }, |
754 | | { SSL_HND_CERT_URL, "Client Certificate URL" }, |
755 | | { SSL_HND_CERT_STATUS, "Certificate Status" }, |
756 | | { SSL_HND_SUPPLEMENTAL_DATA, "Supplemental Data" }, |
757 | | { SSL_HND_KEY_UPDATE, "Key Update" }, |
758 | | { SSL_HND_COMPRESSED_CERTIFICATE, "Compressed Certificate" }, |
759 | | { SSL_HND_ENCRYPTED_EXTS, "Encrypted Extensions" }, |
760 | | { 0x00, NULL } |
761 | | }; |
762 | | |
763 | | const value_string tls_heartbeat_type[] = { |
764 | | { 1, "Request" }, |
765 | | { 2, "Response" }, |
766 | | { 0x00, NULL } |
767 | | }; |
768 | | |
769 | | const value_string tls_heartbeat_mode[] = { |
770 | | { 1, "Peer allowed to send requests" }, |
771 | | { 2, "Peer not allowed to send requests" }, |
772 | | { 0x00, NULL } |
773 | | }; |
774 | | |
775 | | const value_string ssl_31_compression_method[] = { |
776 | | { 0, "null" }, |
777 | | { 1, "DEFLATE" }, |
778 | | { 64, "LZS" }, |
779 | | { 0x00, NULL } |
780 | | }; |
781 | | |
782 | | #if 0 |
783 | | /* XXX - would be used if we dissected a Signature, as would be |
784 | | seen in a server key exchange or certificate verify message. */ |
785 | | const value_string ssl_31_key_exchange_algorithm[] = { |
786 | | { 0, "RSA" }, |
787 | | { 1, "Diffie Hellman" }, |
788 | | { 0x00, NULL } |
789 | | }; |
790 | | |
791 | | const value_string ssl_31_signature_algorithm[] = { |
792 | | { 0, "Anonymous" }, |
793 | | { 1, "RSA" }, |
794 | | { 2, "DSA" }, |
795 | | { 0x00, NULL } |
796 | | }; |
797 | | #endif |
798 | | |
799 | | const value_string ssl_31_client_certificate_type[] = { |
800 | | { 1, "RSA Sign" }, |
801 | | { 2, "DSS Sign" }, |
802 | | { 3, "RSA Fixed DH" }, |
803 | | { 4, "DSS Fixed DH" }, |
804 | | /* GOST certificate types */ |
805 | | /* Section 3.5 of draft-chudov-cryptopro-cptls-04 */ |
806 | | { 21, "GOST R 34.10-94" }, |
807 | | { 22, "GOST R 34.10-2001" }, |
808 | | /* END GOST certificate types */ |
809 | | { 64, "ECDSA Sign" }, |
810 | | { 65, "RSA Fixed ECDH" }, |
811 | | { 66, "ECDSA Fixed ECDH" }, |
812 | | { 80, "IBC Params" }, |
813 | | { 0x00, NULL } |
814 | | }; |
815 | | |
816 | | #if 0 |
817 | | /* XXX - would be used if we dissected exchange keys, as would be |
818 | | seen in a client key exchange message. */ |
819 | | const value_string ssl_31_public_value_encoding[] = { |
820 | | { 0, "Implicit" }, |
821 | | { 1, "Explicit" }, |
822 | | { 0x00, NULL } |
823 | | }; |
824 | | #endif |
825 | | |
826 | | /* http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */ |
827 | | /* Note: sorted by ascending value so value_string_ext fcns can do a binary search */ |
828 | | static const value_string ssl_31_ciphersuite[] = { |
829 | | /* RFC 2246, RFC 4346, RFC 5246 */ |
830 | | { 0x0000, "TLS_NULL_WITH_NULL_NULL" }, |
831 | | { 0x0001, "TLS_RSA_WITH_NULL_MD5" }, |
832 | | { 0x0002, "TLS_RSA_WITH_NULL_SHA" }, |
833 | | { 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5" }, |
834 | | { 0x0004, "TLS_RSA_WITH_RC4_128_MD5" }, |
835 | | { 0x0005, "TLS_RSA_WITH_RC4_128_SHA" }, |
836 | | { 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5" }, |
837 | | { 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA" }, |
838 | | { 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
839 | | { 0x0009, "TLS_RSA_WITH_DES_CBC_SHA" }, |
840 | | { 0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA" }, |
841 | | { 0x000b, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA" }, |
842 | | { 0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA" }, |
843 | | { 0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA" }, |
844 | | { 0x000e, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
845 | | { 0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA" }, |
846 | | { 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA" }, |
847 | | { 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" }, |
848 | | { 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA" }, |
849 | | { 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" }, |
850 | | { 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA" }, |
851 | | { 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA" }, |
852 | | { 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA" }, |
853 | | { 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5" }, |
854 | | { 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5" }, |
855 | | { 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA" }, |
856 | | { 0x001a, "TLS_DH_anon_WITH_DES_CBC_SHA" }, |
857 | | { 0x001b, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA" }, |
858 | | |
859 | | { 0x001c, "SSL_FORTEZZA_KEA_WITH_NULL_SHA" }, |
860 | | { 0x001d, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA" }, |
861 | | #if 0 /* Because it clashes with KRB5, is never used any more, and is safe |
862 | | to remove according to David Hopwood <david.hopwood@zetnet.co.uk> |
863 | | of the ietf-tls list */ |
864 | | { 0x001e, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA" }, |
865 | | #endif |
866 | | /* RFC 2712 */ |
867 | | { 0x001E, "TLS_KRB5_WITH_DES_CBC_SHA" }, |
868 | | { 0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA" }, |
869 | | { 0x0020, "TLS_KRB5_WITH_RC4_128_SHA" }, |
870 | | { 0x0021, "TLS_KRB5_WITH_IDEA_CBC_SHA" }, |
871 | | { 0x0022, "TLS_KRB5_WITH_DES_CBC_MD5" }, |
872 | | { 0x0023, "TLS_KRB5_WITH_3DES_EDE_CBC_MD5" }, |
873 | | { 0x0024, "TLS_KRB5_WITH_RC4_128_MD5" }, |
874 | | { 0x0025, "TLS_KRB5_WITH_IDEA_CBC_MD5" }, |
875 | | { 0x0026, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA" }, |
876 | | { 0x0027, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA" }, |
877 | | { 0x0028, "TLS_KRB5_EXPORT_WITH_RC4_40_SHA" }, |
878 | | { 0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5" }, |
879 | | { 0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5" }, |
880 | | { 0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5" }, |
881 | | /* RFC 4785 */ |
882 | | { 0x002C, "TLS_PSK_WITH_NULL_SHA" }, |
883 | | { 0x002D, "TLS_DHE_PSK_WITH_NULL_SHA" }, |
884 | | { 0x002E, "TLS_RSA_PSK_WITH_NULL_SHA" }, |
885 | | /* RFC 5246 */ |
886 | | { 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA" }, |
887 | | { 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA" }, |
888 | | { 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA" }, |
889 | | { 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" }, |
890 | | { 0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" }, |
891 | | { 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA" }, |
892 | | { 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA" }, |
893 | | { 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA" }, |
894 | | { 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA" }, |
895 | | { 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" }, |
896 | | { 0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" }, |
897 | | { 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA" }, |
898 | | { 0x003B, "TLS_RSA_WITH_NULL_SHA256" }, |
899 | | { 0x003C, "TLS_RSA_WITH_AES_128_CBC_SHA256" }, |
900 | | { 0x003D, "TLS_RSA_WITH_AES_256_CBC_SHA256" }, |
901 | | { 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256" }, |
902 | | { 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256" }, |
903 | | { 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" }, |
904 | | /* RFC 4132 */ |
905 | | { 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
906 | | { 0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA" }, |
907 | | { 0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
908 | | { 0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA" }, |
909 | | { 0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA" }, |
910 | | { 0x0046, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA" }, |
911 | | /* 0x00,0x60-66 Reserved to avoid conflicts with widely deployed implementations */ |
912 | | /* --- ??? --- */ |
913 | | { 0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5" }, |
914 | | { 0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5" }, |
915 | | /* draft-ietf-tls-56-bit-ciphersuites-01.txt */ |
916 | | { 0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" }, |
917 | | { 0x0063, "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA" }, |
918 | | { 0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA" }, |
919 | | { 0x0065, "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA" }, |
920 | | { 0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA" }, |
921 | | /* --- ??? ---*/ |
922 | | { 0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" }, |
923 | | { 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256" }, |
924 | | { 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256" }, |
925 | | { 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" }, |
926 | | { 0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" }, |
927 | | { 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256" }, |
928 | | { 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256" }, |
929 | | /* draft-chudov-cryptopro-cptls-04.txt */ |
930 | | { 0x0080, "TLS_GOSTR341094_WITH_28147_CNT_IMIT" }, |
931 | | { 0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT" }, |
932 | | { 0x0082, "TLS_GOSTR341094_WITH_NULL_GOSTR3411" }, |
933 | | { 0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411" }, |
934 | | /* RFC 4132 */ |
935 | | { 0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
936 | | { 0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA" }, |
937 | | { 0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
938 | | { 0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA" }, |
939 | | { 0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA" }, |
940 | | { 0x0089, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA" }, |
941 | | /* RFC 4279 */ |
942 | | { 0x008A, "TLS_PSK_WITH_RC4_128_SHA" }, |
943 | | { 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA" }, |
944 | | { 0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA" }, |
945 | | { 0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA" }, |
946 | | { 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA" }, |
947 | | { 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA" }, |
948 | | { 0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA" }, |
949 | | { 0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA" }, |
950 | | { 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA" }, |
951 | | { 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA" }, |
952 | | { 0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA" }, |
953 | | { 0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA" }, |
954 | | /* RFC 4162 */ |
955 | | { 0x0096, "TLS_RSA_WITH_SEED_CBC_SHA" }, |
956 | | { 0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA" }, |
957 | | { 0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA" }, |
958 | | { 0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA" }, |
959 | | { 0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA" }, |
960 | | { 0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA" }, |
961 | | /* RFC 5288 */ |
962 | | { 0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256" }, |
963 | | { 0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384" }, |
964 | | { 0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" }, |
965 | | { 0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" }, |
966 | | { 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256" }, |
967 | | { 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384" }, |
968 | | { 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" }, |
969 | | { 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" }, |
970 | | { 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256" }, |
971 | | { 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384" }, |
972 | | { 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256" }, |
973 | | { 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384" }, |
974 | | /* RFC 5487 */ |
975 | | { 0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256" }, |
976 | | { 0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384" }, |
977 | | { 0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256" }, |
978 | | { 0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384" }, |
979 | | { 0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256" }, |
980 | | { 0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384" }, |
981 | | { 0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256" }, |
982 | | { 0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384" }, |
983 | | { 0x00B0, "TLS_PSK_WITH_NULL_SHA256" }, |
984 | | { 0x00B1, "TLS_PSK_WITH_NULL_SHA384" }, |
985 | | { 0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256" }, |
986 | | { 0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384" }, |
987 | | { 0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256" }, |
988 | | { 0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384" }, |
989 | | { 0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256" }, |
990 | | { 0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384" }, |
991 | | { 0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256" }, |
992 | | { 0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384" }, |
993 | | /* From RFC 5932 */ |
994 | | { 0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
995 | | { 0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256" }, |
996 | | { 0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
997 | | { 0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256" }, |
998 | | { 0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
999 | | { 0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256" }, |
1000 | | { 0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
1001 | | { 0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256" }, |
1002 | | { 0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
1003 | | { 0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256" }, |
1004 | | { 0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256" }, |
1005 | | { 0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256" }, |
1006 | | /* RFC 8998 */ |
1007 | | { 0x00C6, "TLS_SM4_GCM_SM3" }, |
1008 | | { 0x00C7, "TLS_SM4_CCM_SM3" }, |
1009 | | /* 0x00,0xC8-FE Unassigned */ |
1010 | | /* From RFC 5746 */ |
1011 | | { 0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" }, |
1012 | | /* RFC 8701 */ |
1013 | | { 0x0A0A, "Reserved (GREASE)" }, |
1014 | | /* RFC 8446 */ |
1015 | | { 0x1301, "TLS_AES_128_GCM_SHA256" }, |
1016 | | { 0x1302, "TLS_AES_256_GCM_SHA384" }, |
1017 | | { 0x1303, "TLS_CHACHA20_POLY1305_SHA256" }, |
1018 | | { 0x1304, "TLS_AES_128_CCM_SHA256" }, |
1019 | | { 0x1305, "TLS_AES_128_CCM_8_SHA256" }, |
1020 | | /* RFC 8701 */ |
1021 | | { 0x1A1A, "Reserved (GREASE)" }, |
1022 | | { 0x2A2A, "Reserved (GREASE)" }, |
1023 | | { 0x3A3A, "Reserved (GREASE)" }, |
1024 | | { 0x4A4A, "Reserved (GREASE)" }, |
1025 | | /* From RFC 7507 */ |
1026 | | { 0x5600, "TLS_FALLBACK_SCSV" }, |
1027 | | /* RFC 8701 */ |
1028 | | { 0x5A5A, "Reserved (GREASE)" }, |
1029 | | { 0x6A6A, "Reserved (GREASE)" }, |
1030 | | { 0x7A7A, "Reserved (GREASE)" }, |
1031 | | { 0x8A8A, "Reserved (GREASE)" }, |
1032 | | { 0x9A9A, "Reserved (GREASE)" }, |
1033 | | { 0xAAAA, "Reserved (GREASE)" }, |
1034 | | { 0xBABA, "Reserved (GREASE)" }, |
1035 | | /* From RFC 4492 */ |
1036 | | { 0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA" }, |
1037 | | { 0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA" }, |
1038 | | { 0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA" }, |
1039 | | { 0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" }, |
1040 | | { 0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" }, |
1041 | | { 0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA" }, |
1042 | | { 0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA" }, |
1043 | | { 0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA" }, |
1044 | | { 0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" }, |
1045 | | { 0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" }, |
1046 | | { 0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA" }, |
1047 | | { 0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA" }, |
1048 | | { 0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA" }, |
1049 | | { 0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" }, |
1050 | | { 0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" }, |
1051 | | { 0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA" }, |
1052 | | { 0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA" }, |
1053 | | { 0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" }, |
1054 | | { 0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" }, |
1055 | | { 0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" }, |
1056 | | { 0xc015, "TLS_ECDH_anon_WITH_NULL_SHA" }, |
1057 | | { 0xc016, "TLS_ECDH_anon_WITH_RC4_128_SHA" }, |
1058 | | { 0xc017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" }, |
1059 | | { 0xc018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA" }, |
1060 | | { 0xc019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA" }, |
1061 | | /* RFC 5054 */ |
1062 | | { 0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA" }, |
1063 | | { 0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA" }, |
1064 | | { 0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA" }, |
1065 | | { 0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA" }, |
1066 | | { 0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA" }, |
1067 | | { 0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA" }, |
1068 | | { 0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA" }, |
1069 | | { 0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA" }, |
1070 | | { 0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA" }, |
1071 | | /* RFC 5589 */ |
1072 | | { 0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" }, |
1073 | | { 0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" }, |
1074 | | { 0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" }, |
1075 | | { 0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" }, |
1076 | | { 0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" }, |
1077 | | { 0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" }, |
1078 | | { 0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" }, |
1079 | | { 0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" }, |
1080 | | { 0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" }, |
1081 | | { 0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" }, |
1082 | | { 0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" }, |
1083 | | { 0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" }, |
1084 | | { 0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" }, |
1085 | | { 0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" }, |
1086 | | { 0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" }, |
1087 | | { 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" }, |
1088 | | /* RFC 5489 */ |
1089 | | { 0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA" }, |
1090 | | { 0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA" }, |
1091 | | { 0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA" }, |
1092 | | { 0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA" }, |
1093 | | { 0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256" }, |
1094 | | { 0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384" }, |
1095 | | { 0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA" }, |
1096 | | { 0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256" }, |
1097 | | { 0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384" }, |
1098 | | /* RFC 6209 */ |
1099 | | { 0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256" }, |
1100 | | { 0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384" }, |
1101 | | { 0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256" }, |
1102 | | { 0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384" }, |
1103 | | { 0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256" }, |
1104 | | { 0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384" }, |
1105 | | { 0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256" }, |
1106 | | { 0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384" }, |
1107 | | { 0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256" }, |
1108 | | { 0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384" }, |
1109 | | { 0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256" }, |
1110 | | { 0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384" }, |
1111 | | { 0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256" }, |
1112 | | { 0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384" }, |
1113 | | { 0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256" }, |
1114 | | { 0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384" }, |
1115 | | { 0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256" }, |
1116 | | { 0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384" }, |
1117 | | { 0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256" }, |
1118 | | { 0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384" }, |
1119 | | { 0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256" }, |
1120 | | { 0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384" }, |
1121 | | { 0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256" }, |
1122 | | { 0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384" }, |
1123 | | { 0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256" }, |
1124 | | { 0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384" }, |
1125 | | { 0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256" }, |
1126 | | { 0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384" }, |
1127 | | { 0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256" }, |
1128 | | { 0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384" }, |
1129 | | { 0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256" }, |
1130 | | { 0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384" }, |
1131 | | { 0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256" }, |
1132 | | { 0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384" }, |
1133 | | { 0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256" }, |
1134 | | { 0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384" }, |
1135 | | { 0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" }, |
1136 | | { 0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" }, |
1137 | | { 0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256" }, |
1138 | | { 0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384" }, |
1139 | | { 0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256" }, |
1140 | | { 0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384" }, |
1141 | | { 0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256" }, |
1142 | | { 0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384" }, |
1143 | | { 0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256" }, |
1144 | | { 0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384" }, |
1145 | | { 0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256" }, |
1146 | | { 0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384" }, |
1147 | | { 0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256" }, |
1148 | | { 0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384" }, |
1149 | | { 0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256" }, |
1150 | | { 0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384" }, |
1151 | | { 0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256" }, |
1152 | | { 0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384" }, |
1153 | | /* RFC 6367 */ |
1154 | | { 0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
1155 | | { 0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" }, |
1156 | | { 0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
1157 | | { 0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" }, |
1158 | | { 0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
1159 | | { 0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" }, |
1160 | | { 0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256" }, |
1161 | | { 0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" }, |
1162 | | { 0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1163 | | { 0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1164 | | { 0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1165 | | { 0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1166 | | { 0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1167 | | { 0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1168 | | { 0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256" }, |
1169 | | { 0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" }, |
1170 | | { 0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256" }, |
1171 | | { 0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384" }, |
1172 | | { 0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256" }, |
1173 | | { 0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384" }, |
1174 | | { 0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1175 | | { 0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1176 | | { 0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1177 | | { 0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1178 | | { 0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1179 | | { 0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1180 | | { 0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256" }, |
1181 | | { 0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384" }, |
1182 | | { 0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256" }, |
1183 | | { 0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384" }, |
1184 | | { 0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256" }, |
1185 | | { 0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384" }, |
1186 | | { 0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256" }, |
1187 | | { 0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384" }, |
1188 | | { 0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256" }, |
1189 | | { 0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384" }, |
1190 | | { 0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" }, |
1191 | | { 0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" }, |
1192 | | { 0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256" }, |
1193 | | { 0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" }, |
1194 | | { 0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256" }, |
1195 | | { 0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384" }, |
1196 | | /* RFC 6655 */ |
1197 | | { 0xC09C, "TLS_RSA_WITH_AES_128_CCM" }, |
1198 | | { 0xC09D, "TLS_RSA_WITH_AES_256_CCM" }, |
1199 | | { 0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM" }, |
1200 | | { 0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM" }, |
1201 | | { 0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8" }, |
1202 | | { 0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8" }, |
1203 | | { 0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8" }, |
1204 | | { 0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8" }, |
1205 | | { 0xC0A4, "TLS_PSK_WITH_AES_128_CCM" }, |
1206 | | { 0xC0A5, "TLS_PSK_WITH_AES_256_CCM" }, |
1207 | | { 0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM" }, |
1208 | | { 0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM" }, |
1209 | | { 0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8" }, |
1210 | | { 0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8" }, |
1211 | | { 0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8" }, |
1212 | | { 0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8" }, |
1213 | | /* RFC 7251 */ |
1214 | | { 0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" }, |
1215 | | { 0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM" }, |
1216 | | { 0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" }, |
1217 | | { 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8" }, |
1218 | | /* RFC 8492 */ |
1219 | | { 0xC0B0, "TLS_ECCPWD_WITH_AES_128_GCM_SHA256" }, |
1220 | | { 0xC0B1, "TLS_ECCPWD_WITH_AES_256_GCM_SHA384" }, |
1221 | | { 0xC0B2, "TLS_ECCPWD_WITH_AES_128_CCM_SHA256" }, |
1222 | | { 0xC0B3, "TLS_ECCPWD_WITH_AES_256_CCM_SHA384" }, |
1223 | | /* draft-camwinget-tls-ts13-macciphersuites */ |
1224 | | { 0xC0B4, "TLS_SHA256_SHA256" }, |
1225 | | { 0xC0B5, "TLS_SHA384_SHA384" }, |
1226 | | /* https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt */ |
1227 | | { 0xC0FF, "TLS_ECJPAKE_WITH_AES_128_CCM_8" }, |
1228 | | /* draft-smyshlyaev-tls12-gost-suites */ |
1229 | | { 0xC100, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC" }, |
1230 | | { 0xC101, "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC" }, |
1231 | | { 0xC102, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT" }, |
1232 | | /* draft-smyshlyaev-tls13-gost-suites */ |
1233 | | { 0xC103, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L" }, |
1234 | | { 0xC104, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L" }, |
1235 | | { 0xC105, "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S" }, |
1236 | | { 0xC106, "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S" }, |
1237 | | /* RFC 8701 */ |
1238 | | { 0xCACA, "Reserved (GREASE)" }, |
1239 | | /* |
1240 | | 0xC0,0xAB-FF Unassigned |
1241 | | 0xC1,0x03-FD,* Unassigned |
1242 | | 0xFE,0x00-FD Unassigned |
1243 | | 0xFE,0xFE-FF Reserved to avoid conflicts with widely deployed implementations [Pasi_Eronen] |
1244 | | 0xFF,0x00-FF Reserved for Private Use [RFC5246] |
1245 | | */ |
1246 | | /* old numbers used in the beginning |
1247 | | * https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305 */ |
1248 | | { 0xCC13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1249 | | { 0xCC14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1250 | | { 0xCC15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1251 | | /* RFC 7905 */ |
1252 | | { 0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1253 | | { 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1254 | | { 0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" }, |
1255 | | { 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
1256 | | { 0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
1257 | | { 0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
1258 | | { 0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256" }, |
1259 | | /* RFC 8442 */ |
1260 | | { 0xD001, "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256" }, |
1261 | | { 0xD002, "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384" }, |
1262 | | { 0xD003, "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256" }, |
1263 | | { 0xD005, "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256" }, |
1264 | | /* RFC 8701 */ |
1265 | | { 0xDADA, "Reserved (GREASE)" }, |
1266 | | /* GM/T 0024-2014 */ |
1267 | | { 0xe001, "ECDHE_SM1_SM3"}, |
1268 | | { 0xe003, "ECC_SM1_SM3"}, |
1269 | | { 0xe005, "IBSDH_SM1_SM3"}, |
1270 | | { 0xe007, "IBC_SM1_SM3"}, |
1271 | | { 0xe009, "RSA_SM1_SM3"}, |
1272 | | { 0xe00a, "RSA_SM1_SHA1"}, |
1273 | | { 0xe011, "ECDHE_SM4_CBC_SM3"}, |
1274 | | { 0xe013, "ECC_SM4_CBC_SM3"}, |
1275 | | { 0xe015, "IBSDH_SM4_CBC_SM3"}, |
1276 | | { 0xe017, "IBC_SM4_CBC_SM3"}, |
1277 | | { 0xe019, "RSA_SM4_CBC_SM3"}, |
1278 | | { 0xe01a, "RSA_SM4_CBC_SHA1"}, |
1279 | | { 0xe01c, "RSA_SM4_CBC_SHA256"}, |
1280 | | { 0xe051, "ECDHE_SM4_GCM_SM3"}, |
1281 | | { 0xe053, "ECC_SM4_GCM_SM3"}, |
1282 | | { 0xe055, "IBSDH_SM4_GCM_SM3"}, |
1283 | | { 0xe057, "IBC_SM4_GCM_SM3"}, |
1284 | | { 0xe059, "RSA_SM4_GCM_SM3"}, |
1285 | | { 0xe05a, "RSA_SM4_GCM_SHA256"}, |
1286 | | /* https://tools.ietf.org/html/draft-josefsson-salsa20-tls */ |
1287 | | { 0xE410, "TLS_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
1288 | | { 0xE411, "TLS_RSA_WITH_SALSA20_SHA1" }, |
1289 | | { 0xE412, "TLS_ECDHE_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
1290 | | { 0xE413, "TLS_ECDHE_RSA_WITH_SALSA20_SHA1" }, |
1291 | | { 0xE414, "TLS_ECDHE_ECDSA_WITH_ESTREAM_SALSA20_SHA1" }, |
1292 | | { 0xE415, "TLS_ECDHE_ECDSA_WITH_SALSA20_SHA1" }, |
1293 | | { 0xE416, "TLS_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
1294 | | { 0xE417, "TLS_PSK_WITH_SALSA20_SHA1" }, |
1295 | | { 0xE418, "TLS_ECDHE_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
1296 | | { 0xE419, "TLS_ECDHE_PSK_WITH_SALSA20_SHA1" }, |
1297 | | { 0xE41A, "TLS_RSA_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
1298 | | { 0xE41B, "TLS_RSA_PSK_WITH_SALSA20_SHA1" }, |
1299 | | { 0xE41C, "TLS_DHE_PSK_WITH_ESTREAM_SALSA20_SHA1" }, |
1300 | | { 0xE41D, "TLS_DHE_PSK_WITH_SALSA20_SHA1" }, |
1301 | | { 0xE41E, "TLS_DHE_RSA_WITH_ESTREAM_SALSA20_SHA1" }, |
1302 | | { 0xE41F, "TLS_DHE_RSA_WITH_SALSA20_SHA1" }, |
1303 | | /* RFC 8701 */ |
1304 | | { 0xEAEA, "Reserved (GREASE)" }, |
1305 | | { 0xFAFA, "Reserved (GREASE)" }, |
1306 | | /* these from http://www.mozilla.org/projects/ |
1307 | | security/pki/nss/ssl/fips-ssl-ciphersuites.html */ |
1308 | | { 0xfefe, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"}, |
1309 | | { 0xfeff, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" }, |
1310 | | /* https://datatracker.ietf.org/doc/html/rfc9189 */ |
1311 | | { 0xff85, "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"}, |
1312 | | { 0xffe0, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA" }, |
1313 | | { 0xffe1, "SSL_RSA_FIPS_WITH_DES_CBC_SHA" }, |
1314 | | /* note that ciphersuites 0xff00 - 0xffff are private */ |
1315 | | { 0x00, NULL } |
1316 | | }; |
1317 | | |
1318 | | value_string_ext ssl_31_ciphersuite_ext = VALUE_STRING_EXT_INIT(ssl_31_ciphersuite); |
1319 | | |
1320 | | /* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1 */ |
1321 | | const value_string tls_hello_extension_types[] = { |
1322 | | { SSL_HND_HELLO_EXT_SERVER_NAME, "server_name" }, /* RFC 6066 */ |
1323 | | { SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH, "max_fragment_length" },/* RFC 6066 */ |
1324 | | { SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL, "client_certificate_url" }, /* RFC 6066 */ |
1325 | | { SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS, "trusted_ca_keys" }, /* RFC 6066 */ |
1326 | | { SSL_HND_HELLO_EXT_TRUNCATED_HMAC, "truncated_hmac" }, /* RFC 6066 */ |
1327 | | { SSL_HND_HELLO_EXT_STATUS_REQUEST, "status_request" }, /* RFC 6066 */ |
1328 | | { SSL_HND_HELLO_EXT_USER_MAPPING, "user_mapping" }, /* RFC 4681 */ |
1329 | | { SSL_HND_HELLO_EXT_CLIENT_AUTHZ, "client_authz" }, /* RFC 5878 */ |
1330 | | { SSL_HND_HELLO_EXT_SERVER_AUTHZ, "server_authz" }, /* RFC 5878 */ |
1331 | | { SSL_HND_HELLO_EXT_CERT_TYPE, "cert_type" }, /* RFC 6091 */ |
1332 | | { SSL_HND_HELLO_EXT_SUPPORTED_GROUPS, "supported_groups" }, /* RFC 4492, RFC 7919 */ |
1333 | | { SSL_HND_HELLO_EXT_EC_POINT_FORMATS, "ec_point_formats" }, /* RFC 4492 */ |
1334 | | { SSL_HND_HELLO_EXT_SRP, "srp" }, /* RFC 5054 */ |
1335 | | { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS, "signature_algorithms" }, /* RFC 5246 */ |
1336 | | { SSL_HND_HELLO_EXT_USE_SRTP, "use_srtp" }, /* RFC 5764 */ |
1337 | | { SSL_HND_HELLO_EXT_HEARTBEAT, "heartbeat" }, /* RFC 6520 */ |
1338 | | { SSL_HND_HELLO_EXT_ALPN, "application_layer_protocol_negotiation" }, /* RFC 7301 */ |
1339 | | { SSL_HND_HELLO_EXT_STATUS_REQUEST_V2, "status_request_v2" }, /* RFC 6961 */ |
1340 | | { SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP, "signed_certificate_timestamp" }, /* RFC 6962 */ |
1341 | | { SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE, "client_certificate_type" }, /* RFC 7250 */ |
1342 | | { SSL_HND_HELLO_EXT_SERVER_CERT_TYPE, "server_certificate_type" }, /* RFC 7250 */ |
1343 | | { SSL_HND_HELLO_EXT_PADDING, "padding" }, /* RFC 7685 */ |
1344 | | { SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC, "encrypt_then_mac" }, /* RFC 7366 */ |
1345 | | { SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET, "extended_master_secret" }, /* RFC 7627 */ |
1346 | | { SSL_HND_HELLO_EXT_TOKEN_BINDING, "token_binding" }, /* https://tools.ietf.org/html/draft-ietf-tokbind-negotiation */ |
1347 | | { SSL_HND_HELLO_EXT_CACHED_INFO, "cached_info" }, /* RFC 7924 */ |
1348 | | { SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE, "compress_certificate" }, /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03 */ |
1349 | | { SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT, "record_size_limit" }, /* RFC 8449 */ |
1350 | | { SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS, "delegated_credentials" }, /* draft-ietf-tls-subcerts-10.txt */ |
1351 | | { SSL_HND_HELLO_EXT_SESSION_TICKET_TLS, "session_ticket" }, /* RFC 5077 / RFC 8447 */ |
1352 | | { SSL_HND_HELLO_EXT_KEY_SHARE_OLD, "Reserved (key_share)" }, /* https://tools.ietf.org/html/draft-ietf-tls-tls13-22 (removed in -23) */ |
1353 | | { SSL_HND_HELLO_EXT_PRE_SHARED_KEY, "pre_shared_key" }, /* RFC 8446 */ |
1354 | | { SSL_HND_HELLO_EXT_EARLY_DATA, "early_data" }, /* RFC 8446 */ |
1355 | | { SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS, "supported_versions" }, /* RFC 8446 */ |
1356 | | { SSL_HND_HELLO_EXT_COOKIE, "cookie" }, /* RFC 8446 */ |
1357 | | { SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES, "psk_key_exchange_modes" }, /* RFC 8446 */ |
1358 | | { SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO, "Reserved (ticket_early_data_info)" }, /* draft-ietf-tls-tls13-18 (removed in -19) */ |
1359 | | { SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES, "certificate_authorities" }, /* RFC 8446 */ |
1360 | | { SSL_HND_HELLO_EXT_OID_FILTERS, "oid_filters" }, /* RFC 8446 */ |
1361 | | { SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH, "post_handshake_auth" }, /* RFC 8446 */ |
1362 | | { SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT, "signature_algorithms_cert" }, /* RFC 8446 */ |
1363 | | { SSL_HND_HELLO_EXT_KEY_SHARE, "key_share" }, /* RFC 8446 */ |
1364 | | { SSL_HND_HELLO_EXT_TRANSPARENCY_INFO, "transparency_info" }, /* draft-ietf-trans-rfc6962-bis-41 */ |
1365 | | { SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED, "connection_id (deprecated)" }, /* draft-ietf-tls-dtls-connection-id-07 */ |
1366 | | { SSL_HND_HELLO_EXT_CONNECTION_ID, "connection_id" }, /* RFC 9146 */ |
1367 | | { SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH, "external_id_hash" }, /* RFC 8844 */ |
1368 | | { SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID, "external_session_id" }, /* RFC 8844 */ |
1369 | | { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1, "quic_transport_parameters" }, /* draft-ietf-quic-tls-33 */ |
1370 | | { SSL_HND_HELLO_EXT_TICKET_REQUEST, "ticket_request" }, /* draft-ietf-tls-ticketrequests-07 */ |
1371 | | { SSL_HND_HELLO_EXT_DNSSEC_CHAIN, "dnssec_chain" }, /* RFC 9102 */ |
1372 | | { SSL_HND_HELLO_EXT_GREASE_0A0A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1373 | | { SSL_HND_HELLO_EXT_GREASE_1A1A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1374 | | { SSL_HND_HELLO_EXT_GREASE_2A2A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1375 | | { SSL_HND_HELLO_EXT_NPN, "next_protocol_negotiation"}, /* https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-03 */ |
1376 | | { SSL_HND_HELLO_EXT_GREASE_3A3A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1377 | | { SSL_HND_HELLO_EXT_ALPS_OLD, "application_settings_old" }, /* draft-vvv-tls-alps-01 */ |
1378 | | { SSL_HND_HELLO_EXT_ALPS, "application_settings" }, /* draft-vvv-tls-alps-01 */ /* https://chromestatus.com/feature/5149147365900288 */ |
1379 | | { SSL_HND_HELLO_EXT_GREASE_4A4A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1380 | | { SSL_HND_HELLO_EXT_GREASE_5A5A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1381 | | { SSL_HND_HELLO_EXT_GREASE_6A6A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1382 | | { SSL_HND_HELLO_EXT_CHANNEL_ID_OLD, "channel_id_old" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-00 |
1383 | | https://twitter.com/ericlaw/status/274237352531083264 */ |
1384 | | { SSL_HND_HELLO_EXT_CHANNEL_ID, "channel_id" }, /* https://tools.ietf.org/html/draft-balfanz-tls-channelid-01 |
1385 | | https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslt.h&l=209 */ |
1386 | | { SSL_HND_HELLO_EXT_RENEGOTIATION_INFO, "renegotiation_info" }, /* RFC 5746 */ |
1387 | | { SSL_HND_HELLO_EXT_GREASE_7A7A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1388 | | { SSL_HND_HELLO_EXT_GREASE_8A8A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1389 | | { SSL_HND_HELLO_EXT_GREASE_9A9A, "Reserved (GREASE)" }, /* RFC 8701 */ |
1390 | | { SSL_HND_HELLO_EXT_GREASE_AAAA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1391 | | { SSL_HND_HELLO_EXT_GREASE_BABA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1392 | | { SSL_HND_HELLO_EXT_GREASE_CACA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1393 | | { SSL_HND_HELLO_EXT_GREASE_DADA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1394 | | { SSL_HND_HELLO_EXT_GREASE_EAEA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1395 | | { SSL_HND_HELLO_EXT_GREASE_FAFA, "Reserved (GREASE)" }, /* RFC 8701 */ |
1396 | | { SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS, "quic_transport_parameters (drafts version)" }, /* https://tools.ietf.org/html/draft-ietf-quic-tls */ |
1397 | | { SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME, "encrypted_server_name" }, /* https://tools.ietf.org/html/draft-ietf-tls-esni-01 */ |
1398 | | { SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO, "encrypted_client_hello" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */ |
1399 | | { SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS, "ech_outer_extensions" }, /* https://datatracker.ietf.org/doc/draft-ietf-tls-esni/17/ */ |
1400 | | { 0, NULL } |
1401 | | }; |
1402 | | |
1403 | | const value_string tls_hello_ext_server_name_type_vs[] = { |
1404 | | { 0, "host_name" }, |
1405 | | { 0, NULL } |
1406 | | }; |
1407 | | |
1408 | | /* RFC 6066 Section 4 */ |
1409 | | const value_string tls_hello_ext_max_fragment_length[] = { |
1410 | | { 1, "512" }, // 2^9 |
1411 | | { 2, "1024" }, // 2^10 |
1412 | | { 3, "2048" }, // 2^11 |
1413 | | { 4, "4096" }, // 2^12 |
1414 | | { 0, NULL } |
1415 | | }; |
1416 | | |
1417 | | /* RFC 8446 Section 4.2.9 */ |
1418 | | const value_string tls_hello_ext_psk_ke_mode[] = { |
1419 | | { 0, "PSK-only key establishment (psk_ke)" }, |
1420 | | { 1, "PSK with (EC)DHE key establishment (psk_dhe_ke)" }, |
1421 | | { 0, NULL } |
1422 | | }; |
1423 | | |
1424 | | /* RFC 6066 Section 6 */ |
1425 | | const value_string tls_hello_ext_trusted_ca_key_type[] = { |
1426 | | {0, "pre_agreed"}, |
1427 | | {1, "key_sha1_hash"}, |
1428 | | {2, "x509_name"}, |
1429 | | {3, "cert_sha1_hash"}, |
1430 | | {0, NULL} |
1431 | | }; |
1432 | | |
1433 | | const value_string tls13_key_update_request[] = { |
1434 | | { 0, "update_not_requested" }, |
1435 | | { 1, "update_requested" }, |
1436 | | { 0, NULL } |
1437 | | }; |
1438 | | |
1439 | | /* RFC 5246 7.4.1.4.1 */ |
1440 | | /* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml */ |
1441 | | /* Note that the TLS 1.3 SignatureScheme registry reserves all values |
1442 | | * with first octet 0x00-0x06 and all values with second octet 0x00-0x03 |
1443 | | * for backwards compatibility with TLS 1.2 SignatureAndHashAlgorithm. |
1444 | | * |
1445 | | * RFC 8422 and RFC 9189 add official support in TLS 1.2 for some algorithms |
1446 | | * originally defined for TLS 1.3, and extend the TLS SignatureAlgorithm |
1447 | | * and TLS HashAlgorithm registries, but the new values are not compatible |
1448 | | * with all of the TLS 1.3-only SignatureSchemes. Adding those values could |
1449 | | * cause confusion if used to interpret one of those schemes in a |
1450 | | * signature_algorithms extension offered in a TLS 1.3 ClientHello. |
1451 | | */ |
1452 | | const value_string tls_hash_algorithm[] = { |
1453 | | { 0, "None" }, |
1454 | | { 1, "MD5" }, |
1455 | | { 2, "SHA1" }, |
1456 | | { 3, "SHA224" }, |
1457 | | { 4, "SHA256" }, |
1458 | | { 5, "SHA384" }, |
1459 | | { 6, "SHA512" }, |
1460 | | #if 0 |
1461 | | /* RFC 8422 adds this to the HashAlgorithm registry, but it really |
1462 | | * only applies to 0x0807 and 0x0808, not for other TLS 1.3 |
1463 | | * SignatureSchemes with 0x08 in the octet used for Hash in TLS 1.2. |
1464 | | * E.g., we don't want to display this for 0x0806 rsa_pss_rsae_sha512. |
1465 | | */ |
1466 | | { 8, "Intrinsic" }, |
1467 | | #endif |
1468 | | { 0, NULL } |
1469 | | }; |
1470 | | |
1471 | | const value_string tls_signature_algorithm[] = { |
1472 | | { 0, "Anonymous" }, |
1473 | | { 1, "RSA" }, |
1474 | | { 2, "DSA" }, |
1475 | | { 3, "ECDSA" }, |
1476 | | #if 0 |
1477 | | /* As above. */ |
1478 | | { 7, "ED25519" }, |
1479 | | { 8, "ED448" }, |
1480 | | { 64, "GOSTR34102012_256" }, |
1481 | | { 65, "GOSTR34102012_512" }, |
1482 | | #endif |
1483 | | { 0, NULL } |
1484 | | }; |
1485 | | |
1486 | | /* RFC 8446 Section 4.2.3 */ |
1487 | | const value_string tls13_signature_algorithm[] = { |
1488 | | { 0x0201, "rsa_pkcs1_sha1" }, |
1489 | | { 0x0203, "ecdsa_sha1" }, |
1490 | | { 0x0401, "rsa_pkcs1_sha256" }, |
1491 | | { 0x0403, "ecdsa_secp256r1_sha256" }, |
1492 | | { 0x0420, "rsa_pkcs1_sha256_legacy" }, /* draft-davidben-tls13-pkcs1-01 */ |
1493 | | { 0x0501, "rsa_pkcs1_sha384" }, |
1494 | | { 0x0503, "ecdsa_secp384r1_sha384" }, |
1495 | | { 0x0520, "rsa_pkcs1_sha384_legacy" }, /* draft-davidben-tls13-pkcs1-01 */ |
1496 | | { 0x0601, "rsa_pkcs1_sha512" }, |
1497 | | { 0x0603, "ecdsa_secp521r1_sha512" }, |
1498 | | { 0x0620, "rsa_pkcs1_sha512_legacy" }, /* draft-davidben-tls13-pkcs1-01 */ |
1499 | | { 0x0708, "sm2sig_sm3" }, |
1500 | | { 0x0709, "gostr34102012_256a" }, /* RFC9367 */ |
1501 | | { 0x070a, "gostr34102012_256b" }, /* RFC9367 */ |
1502 | | { 0x070b, "gostr34102012_256c" }, /* RFC9367 */ |
1503 | | { 0x070c, "gostr34102012_256d" }, /* RFC9367 */ |
1504 | | { 0x070d, "gostr34102012_512a" }, /* RFC9367 */ |
1505 | | { 0x070e, "gostr34102012_512b" }, /* RFC9367 */ |
1506 | | { 0x070f, "gostr34102012_512c" }, /* RFC9367 */ |
1507 | | { 0x0804, "rsa_pss_rsae_sha256" }, |
1508 | | { 0x0805, "rsa_pss_rsae_sha384" }, |
1509 | | { 0x0806, "rsa_pss_rsae_sha512" }, |
1510 | | { 0x0807, "ed25519" }, |
1511 | | { 0x0808, "ed448" }, |
1512 | | { 0x0809, "rsa_pss_pss_sha256" }, |
1513 | | { 0x080a, "rsa_pss_pss_sha384" }, |
1514 | | { 0x080b, "rsa_pss_pss_sha512" }, |
1515 | | { 0x081a, "ecdsa_brainpoolP256r1tls13_sha256" }, /* RFC8734 */ |
1516 | | { 0x081b, "ecdsa_brainpoolP384r1tls13_sha384" }, /* RFC8734 */ |
1517 | | { 0x081c, "ecdsa_brainpoolP512r1tls13_sha512" }, /* RFC8734 */ |
1518 | | /* PQC digital signature algorithms from OQS-OpenSSL, |
1519 | | see https://github.com/open-quantum-safe/openssl/blob/OQS-OpenSSL_1_1_1-stable/oqs-template/oqs-sig-info.md */ |
1520 | | { 0xfea0, "dilithium2" }, |
1521 | | { 0xfea1, "p256_dilithium2" }, |
1522 | | { 0xfea2, "rsa3072_dilithium2" }, |
1523 | | { 0xfea3, "dilithium3" }, |
1524 | | { 0xfea4, "p384_dilithium3" }, |
1525 | | { 0xfea5, "dilithium5" }, |
1526 | | { 0xfea6, "p521_dilithium5" }, |
1527 | | { 0xfea7, "dilithium2_aes" }, |
1528 | | { 0xfea8, "p256_dilithium2_aes" }, |
1529 | | { 0xfea9, "rsa3072_dilithium2_aes" }, |
1530 | | { 0xfeaa, "dilithium3_aes" }, |
1531 | | { 0xfeab, "p384_dilithium3_aes" }, |
1532 | | { 0xfeac, "dilithium5_aes" }, |
1533 | | { 0xfead, "p521_dilithium5_aes" }, |
1534 | | { 0xfe0b, "falcon512" }, |
1535 | | { 0xfe0c, "p256_falcon512" }, |
1536 | | { 0xfe0d, "rsa3072_falcon512" }, |
1537 | | { 0xfe0e, "falcon1024" }, |
1538 | | { 0xfe0f, "p521_falcon1024" }, |
1539 | | { 0xfe96, "picnicl1full" }, |
1540 | | { 0xfe97, "p256_picnicl1full" }, |
1541 | | { 0xfe98, "rsa3072_picnicl1full" }, |
1542 | | { 0xfe1b, "picnic3l1" }, |
1543 | | { 0xfe1c, "p256_picnic3l1" }, |
1544 | | { 0xfe1d, "rsa3072_picnic3l1" }, |
1545 | | { 0xfe27, "rainbowIclassic" }, |
1546 | | { 0xfe28, "p256_rainbowIclassic" }, |
1547 | | { 0xfe29, "rsa3072_rainbowIclassic" }, |
1548 | | { 0xfe3c, "rainbowVclassic" }, |
1549 | | { 0xfe3d, "p521_rainbowVclassic" }, |
1550 | | { 0xfe42, "sphincsharaka128frobust" }, |
1551 | | { 0xfe43, "p256_sphincsharaka128frobust" }, |
1552 | | { 0xfe44, "rsa3072_sphincsharaka128frobust" }, |
1553 | | { 0xfe5e, "sphincssha256128frobust" }, |
1554 | | { 0xfe5f, "p256_sphincssha256128frobust" }, |
1555 | | { 0xfe60, "rsa3072_sphincssha256128frobust" }, |
1556 | | { 0xfe7a, "sphincsshake256128frobust" }, |
1557 | | { 0xfe7b, "p256_sphincsshake256128frobust" }, |
1558 | | { 0xfe7c, "rsa3072_sphincsshake256128frobust" }, |
1559 | | { 0, NULL } |
1560 | | }; |
1561 | | |
1562 | | /* RFC 6091 3.1 */ |
1563 | | const value_string tls_certificate_type[] = { |
1564 | | { 0, "X.509" }, |
1565 | | { 1, "OpenPGP" }, |
1566 | | { SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY, "Raw Public Key" }, /* RFC 7250 */ |
1567 | | { 0, NULL } |
1568 | | }; |
1569 | | |
1570 | | const value_string tls_cert_chain_type[] = { |
1571 | | { SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT, "Individual Certificates" }, |
1572 | | { SSL_HND_CERT_URL_TYPE_PKIPATH, "PKI Path" }, |
1573 | | { 0, NULL } |
1574 | | }; |
1575 | | |
1576 | | const value_string tls_cert_status_type[] = { |
1577 | | { SSL_HND_CERT_STATUS_TYPE_OCSP, "OCSP" }, |
1578 | | { SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI, "OCSP Multi" }, |
1579 | | { 0, NULL } |
1580 | | }; |
1581 | | |
1582 | | /* Generated by tools/make-tls-ct-logids.py |
1583 | | * Last-Modified Sat, 15 Nov 2025 14:27:28 GMT, 187 entries. */ |
1584 | | static const bytes_string ct_logids[] = { |
1585 | | { (const uint8_t[]){ |
1586 | | 0xb2, 0x1e, 0x05, 0xcc, 0x8b, 0xa2, 0xcd, 0x8a, 0x20, 0x4e, 0x87, |
1587 | | 0x66, 0xf9, 0x2b, 0xb9, 0x8a, 0x25, 0x20, 0x67, 0x6b, 0xda, 0xfa, |
1588 | | 0x70, 0xe7, 0xb2, 0x49, 0x53, 0x2d, 0xef, 0x8b, 0x90, 0x5e, |
1589 | | }, |
1590 | | 32, "Google 'Argon2020' log" }, |
1591 | | { (const uint8_t[]){ |
1592 | | 0xf6, 0x5c, 0x94, 0x2f, 0xd1, 0x77, 0x30, 0x22, 0x14, 0x54, 0x18, |
1593 | | 0x08, 0x30, 0x94, 0x56, 0x8e, 0xe3, 0x4d, 0x13, 0x19, 0x33, 0xbf, |
1594 | | 0xdf, 0x0c, 0x2f, 0x20, 0x0b, 0xcc, 0x4e, 0xf1, 0x64, 0xe3, |
1595 | | }, |
1596 | | 32, "Google 'Argon2021' log" }, |
1597 | | { (const uint8_t[]){ |
1598 | | 0x29, 0x79, 0xbe, 0xf0, 0x9e, 0x39, 0x39, 0x21, 0xf0, 0x56, 0x73, |
1599 | | 0x9f, 0x63, 0xa5, 0x77, 0xe5, 0xbe, 0x57, 0x7d, 0x9c, 0x60, 0x0a, |
1600 | | 0xf8, 0xf9, 0x4d, 0x5d, 0x26, 0x5c, 0x25, 0x5d, 0xc7, 0x84, |
1601 | | }, |
1602 | | 32, "Google 'Argon2022' log" }, |
1603 | | { (const uint8_t[]){ |
1604 | | 0xe8, 0x3e, 0xd0, 0xda, 0x3e, 0xf5, 0x06, 0x35, 0x32, 0xe7, 0x57, |
1605 | | 0x28, 0xbc, 0x89, 0x6b, 0xc9, 0x03, 0xd3, 0xcb, 0xd1, 0x11, 0x6b, |
1606 | | 0xec, 0xeb, 0x69, 0xe1, 0x77, 0x7d, 0x6d, 0x06, 0xbd, 0x6e, |
1607 | | }, |
1608 | | 32, "Google 'Argon2023' log" }, |
1609 | | { (const uint8_t[]){ |
1610 | | 0xee, 0xcd, 0xd0, 0x64, 0xd5, 0xdb, 0x1a, 0xce, 0xc5, 0x5c, 0xb7, |
1611 | | 0x9d, 0xb4, 0xcd, 0x13, 0xa2, 0x32, 0x87, 0x46, 0x7c, 0xbc, 0xec, |
1612 | | 0xde, 0xc3, 0x51, 0x48, 0x59, 0x46, 0x71, 0x1f, 0xb5, 0x9b, |
1613 | | }, |
1614 | | 32, "Google 'Argon2024' log" }, |
1615 | | { (const uint8_t[]){ |
1616 | | 0x4e, 0x75, 0xa3, 0x27, 0x5c, 0x9a, 0x10, 0xc3, 0x38, 0x5b, 0x6c, |
1617 | | 0xd4, 0xdf, 0x3f, 0x52, 0xeb, 0x1d, 0xf0, 0xe0, 0x8e, 0x1b, 0x8d, |
1618 | | 0x69, 0xc0, 0xb1, 0xfa, 0x64, 0xb1, 0x62, 0x9a, 0x39, 0xdf, |
1619 | | }, |
1620 | | 32, "Google 'Argon2025h1' log" }, |
1621 | | { (const uint8_t[]){ |
1622 | | 0x12, 0xf1, 0x4e, 0x34, 0xbd, 0x53, 0x72, 0x4c, 0x84, 0x06, 0x19, |
1623 | | 0xc3, 0x8f, 0x3f, 0x7a, 0x13, 0xf8, 0xe7, 0xb5, 0x62, 0x87, 0x88, |
1624 | | 0x9c, 0x6d, 0x30, 0x05, 0x84, 0xeb, 0xe5, 0x86, 0x26, 0x3a, |
1625 | | }, |
1626 | | 32, "Google 'Argon2025h2' log" }, |
1627 | | { (const uint8_t[]){ |
1628 | | 0x0e, 0x57, 0x94, 0xbc, 0xf3, 0xae, 0xa9, 0x3e, 0x33, 0x1b, 0x2c, |
1629 | | 0x99, 0x07, 0xb3, 0xf7, 0x90, 0xdf, 0x9b, 0xc2, 0x3d, 0x71, 0x32, |
1630 | | 0x25, 0xdd, 0x21, 0xa9, 0x25, 0xac, 0x61, 0xc5, 0x4e, 0x21, |
1631 | | }, |
1632 | | 32, "Google 'Argon2026h1' log" }, |
1633 | | { (const uint8_t[]){ |
1634 | | 0xd7, 0x6d, 0x7d, 0x10, 0xd1, 0xa7, 0xf5, 0x77, 0xc2, 0xc7, 0xe9, |
1635 | | 0x5f, 0xd7, 0x00, 0xbf, 0xf9, 0x82, 0xc9, 0x33, 0x5a, 0x65, 0xe1, |
1636 | | 0xd0, 0xb3, 0x01, 0x73, 0x17, 0xc0, 0xc8, 0xc5, 0x69, 0x77, |
1637 | | }, |
1638 | | 32, "Google 'Argon2026h2' log" }, |
1639 | | { (const uint8_t[]){ |
1640 | | 0xd6, 0xd5, 0x8d, 0xa9, 0xd0, 0x17, 0x53, 0xf3, 0x6a, 0x4a, 0xa0, |
1641 | | 0xc7, 0x57, 0x49, 0x02, 0xaf, 0xeb, 0xc7, 0xdc, 0x2c, 0xd3, 0x8c, |
1642 | | 0xd9, 0xf7, 0x64, 0xc8, 0x0c, 0x89, 0x19, 0x1e, 0x9f, 0x02, |
1643 | | }, |
1644 | | 32, "Google 'Argon2027h1'" }, |
1645 | | { (const uint8_t[]){ |
1646 | | 0x07, 0xb7, 0x5c, 0x1b, 0xe5, 0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6, |
1647 | | 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6, 0x57, 0x7c, 0x57, 0x94, 0xb7, |
1648 | | 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69, 0xd3, 0xa2, 0x1c, |
1649 | | }, |
1650 | | 32, "Google 'Xenon2020' log" }, |
1651 | | { (const uint8_t[]){ |
1652 | | 0x7d, 0x3e, 0xf2, 0xf8, 0x8f, 0xff, 0x88, 0x55, 0x68, 0x24, 0xc2, |
1653 | | 0xc0, 0xca, 0x9e, 0x52, 0x89, 0x79, 0x2b, 0xc5, 0x0e, 0x78, 0x09, |
1654 | | 0x7f, 0x2e, 0x6a, 0x97, 0x68, 0x99, 0x7e, 0x22, 0xf0, 0xd7, |
1655 | | }, |
1656 | | 32, "Google 'Xenon2021' log" }, |
1657 | | { (const uint8_t[]){ |
1658 | | 0x46, 0xa5, 0x55, 0xeb, 0x75, 0xfa, 0x91, 0x20, 0x30, 0xb5, 0xa2, |
1659 | | 0x89, 0x69, 0xf4, 0xf3, 0x7d, 0x11, 0x2c, 0x41, 0x74, 0xbe, 0xfd, |
1660 | | 0x49, 0xb8, 0x85, 0xab, 0xf2, 0xfc, 0x70, 0xfe, 0x6d, 0x47, |
1661 | | }, |
1662 | | 32, "Google 'Xenon2022' log" }, |
1663 | | { (const uint8_t[]){ |
1664 | | 0xad, 0xf7, 0xbe, 0xfa, 0x7c, 0xff, 0x10, 0xc8, 0x8b, 0x9d, 0x3d, |
1665 | | 0x9c, 0x1e, 0x3e, 0x18, 0x6a, 0xb4, 0x67, 0x29, 0x5d, 0xcf, 0xb1, |
1666 | | 0x0c, 0x24, 0xca, 0x85, 0x86, 0x34, 0xeb, 0xdc, 0x82, 0x8a, |
1667 | | }, |
1668 | | 32, "Google 'Xenon2023' log" }, |
1669 | | { (const uint8_t[]){ |
1670 | | 0x76, 0xff, 0x88, 0x3f, 0x0a, 0xb6, 0xfb, 0x95, 0x51, 0xc2, 0x61, |
1671 | | 0xcc, 0xf5, 0x87, 0xba, 0x34, 0xb4, 0xa4, 0xcd, 0xbb, 0x29, 0xdc, |
1672 | | 0x68, 0x42, 0x0a, 0x9f, 0xe6, 0x67, 0x4c, 0x5a, 0x3a, 0x74, |
1673 | | }, |
1674 | | 32, "Google 'Xenon2024' log" }, |
1675 | | { (const uint8_t[]){ |
1676 | | 0xcf, 0x11, 0x56, 0xee, 0xd5, 0x2e, 0x7c, 0xaf, 0xf3, 0x87, 0x5b, |
1677 | | 0xd9, 0x69, 0x2e, 0x9b, 0xe9, 0x1a, 0x71, 0x67, 0x4a, 0xb0, 0x17, |
1678 | | 0xec, 0xac, 0x01, 0xd2, 0x5b, 0x77, 0xce, 0xcc, 0x3b, 0x08, |
1679 | | }, |
1680 | | 32, "Google 'Xenon2025h1' log" }, |
1681 | | { (const uint8_t[]){ |
1682 | | 0xdd, 0xdc, 0xca, 0x34, 0x95, 0xd7, 0xe1, 0x16, 0x05, 0xe7, 0x95, |
1683 | | 0x32, 0xfa, 0xc7, 0x9f, 0xf8, 0x3d, 0x1c, 0x50, 0xdf, 0xdb, 0x00, |
1684 | | 0x3a, 0x14, 0x12, 0x76, 0x0a, 0x2c, 0xac, 0xbb, 0xc8, 0x2a, |
1685 | | }, |
1686 | | 32, "Google 'Xenon2025h2' log" }, |
1687 | | { (const uint8_t[]){ |
1688 | | 0x96, 0x97, 0x64, 0xbf, 0x55, 0x58, 0x97, 0xad, 0xf7, 0x43, 0x87, |
1689 | | 0x68, 0x37, 0x08, 0x42, 0x77, 0xe9, 0xf0, 0x3a, 0xd5, 0xf6, 0xa4, |
1690 | | 0xf3, 0x36, 0x6e, 0x46, 0xa4, 0x3f, 0x0f, 0xca, 0xa9, 0xc6, |
1691 | | }, |
1692 | | 32, "Google 'Xenon2026h1' log" }, |
1693 | | { (const uint8_t[]){ |
1694 | | 0xd8, 0x09, 0x55, 0x3b, 0x94, 0x4f, 0x7a, 0xff, 0xc8, 0x16, 0x19, |
1695 | | 0x6f, 0x94, 0x4f, 0x85, 0xab, 0xb0, 0xf8, 0xfc, 0x5e, 0x87, 0x55, |
1696 | | 0x26, 0x0f, 0x15, 0xd1, 0x2e, 0x72, 0xbb, 0x45, 0x4b, 0x14, |
1697 | | }, |
1698 | | 32, "Google 'Xenon2026h2' log" }, |
1699 | | { (const uint8_t[]){ |
1700 | | 0x44, 0xc2, 0xbd, 0x0c, 0xe9, 0x14, 0x0e, 0x64, 0xa5, 0xc9, 0x4a, |
1701 | | 0x01, 0x93, 0x0a, 0x5a, 0xa1, 0xbb, 0x35, 0x97, 0x0e, 0x00, 0xee, |
1702 | | 0x11, 0x16, 0x89, 0x68, 0x2a, 0x1c, 0x44, 0xd7, 0xb5, 0x66, |
1703 | | }, |
1704 | | 32, "Google 'Xenon2027h1'" }, |
1705 | | { (const uint8_t[]){ |
1706 | | 0x68, 0xf6, 0x98, 0xf8, 0x1f, 0x64, 0x82, 0xbe, 0x3a, 0x8c, 0xee, |
1707 | | 0xb9, 0x28, 0x1d, 0x4c, 0xfc, 0x71, 0x51, 0x5d, 0x67, 0x93, 0xd4, |
1708 | | 0x44, 0xd1, 0x0a, 0x67, 0xac, 0xbb, 0x4f, 0x4f, 0xfb, 0xc4, |
1709 | | }, |
1710 | | 32, "Google 'Aviator' log" }, |
1711 | | { (const uint8_t[]){ |
1712 | | 0x29, 0x3c, 0x51, 0x96, 0x54, 0xc8, 0x39, 0x65, 0xba, 0xaa, 0x50, |
1713 | | 0xfc, 0x58, 0x07, 0xd4, 0xb7, 0x6f, 0xbf, 0x58, 0x7a, 0x29, 0x72, |
1714 | | 0xdc, 0xa4, 0xc3, 0x0c, 0xf4, 0xe5, 0x45, 0x47, 0xf4, 0x78, |
1715 | | }, |
1716 | | 32, "Google 'Icarus' log" }, |
1717 | | { (const uint8_t[]){ |
1718 | | 0xa4, 0xb9, 0x09, 0x90, 0xb4, 0x18, 0x58, 0x14, 0x87, 0xbb, 0x13, |
1719 | | 0xa2, 0xcc, 0x67, 0x70, 0x0a, 0x3c, 0x35, 0x98, 0x04, 0xf9, 0x1b, |
1720 | | 0xdf, 0xb8, 0xe3, 0x77, 0xcd, 0x0e, 0xc8, 0x0d, 0xdc, 0x10, |
1721 | | }, |
1722 | | 32, "Google 'Pilot' log" }, |
1723 | | { (const uint8_t[]){ |
1724 | | 0xee, 0x4b, 0xbd, 0xb7, 0x75, 0xce, 0x60, 0xba, 0xe1, 0x42, 0x69, |
1725 | | 0x1f, 0xab, 0xe1, 0x9e, 0x66, 0xa3, 0x0f, 0x7e, 0x5f, 0xb0, 0x72, |
1726 | | 0xd8, 0x83, 0x00, 0xc4, 0x7b, 0x89, 0x7a, 0xa8, 0xfd, 0xcb, |
1727 | | }, |
1728 | | 32, "Google 'Rocketeer' log" }, |
1729 | | { (const uint8_t[]){ |
1730 | | 0xbb, 0xd9, 0xdf, 0xbc, 0x1f, 0x8a, 0x71, 0xb5, 0x93, 0x94, 0x23, |
1731 | | 0x97, 0xaa, 0x92, 0x7b, 0x47, 0x38, 0x57, 0x95, 0x0a, 0xab, 0x52, |
1732 | | 0xe8, 0x1a, 0x90, 0x96, 0x64, 0x36, 0x8e, 0x1e, 0xd1, 0x85, |
1733 | | }, |
1734 | | 32, "Google 'Skydiver' log" }, |
1735 | | { (const uint8_t[]){ |
1736 | | 0xfa, 0xd4, 0xc9, 0x7c, 0xc4, 0x9e, 0xe2, 0xf8, 0xac, 0x85, 0xc5, |
1737 | | 0xea, 0x5c, 0xea, 0x09, 0xd0, 0x22, 0x0d, 0xbb, 0xf4, 0xe4, 0x9c, |
1738 | | 0x6b, 0x50, 0x66, 0x2f, 0xf8, 0x68, 0xf8, 0x6b, 0x8c, 0x28, |
1739 | | }, |
1740 | | 32, "Google 'Argon2017' log" }, |
1741 | | { (const uint8_t[]){ |
1742 | | 0xa4, 0x50, 0x12, 0x69, 0x05, 0x5a, 0x15, 0x54, 0x5e, 0x62, 0x11, |
1743 | | 0xab, 0x37, 0xbc, 0x10, 0x3f, 0x62, 0xae, 0x55, 0x76, 0xa4, 0x5e, |
1744 | | 0x4b, 0x17, 0x14, 0x45, 0x3e, 0x1b, 0x22, 0x10, 0x6a, 0x25, |
1745 | | }, |
1746 | | 32, "Google 'Argon2018' log" }, |
1747 | | { (const uint8_t[]){ |
1748 | | 0x63, 0xf2, 0xdb, 0xcd, 0xe8, 0x3b, 0xcc, 0x2c, 0xcf, 0x0b, 0x72, |
1749 | | 0x84, 0x27, 0x57, 0x6b, 0x33, 0xa4, 0x8d, 0x61, 0x77, 0x8f, 0xbd, |
1750 | | 0x75, 0xa6, 0x38, 0xb1, 0xc7, 0x68, 0x54, 0x4b, 0xd8, 0x8d, |
1751 | | }, |
1752 | | 32, "Google 'Argon2019' log" }, |
1753 | | { (const uint8_t[]){ |
1754 | | 0xb1, 0x0c, 0xd5, 0x59, 0xa6, 0xd6, 0x78, 0x46, 0x81, 0x1f, 0x7d, |
1755 | | 0xf9, 0xa5, 0x15, 0x32, 0x73, 0x9a, 0xc4, 0x8d, 0x70, 0x3b, 0xea, |
1756 | | 0x03, 0x23, 0xda, 0x5d, 0x38, 0x75, 0x5b, 0xc0, 0xad, 0x4e, |
1757 | | }, |
1758 | | 32, "Google 'Xenon2018' log" }, |
1759 | | { (const uint8_t[]){ |
1760 | | 0x08, 0x41, 0x14, 0x98, 0x00, 0x71, 0x53, 0x2c, 0x16, 0x19, 0x04, |
1761 | | 0x60, 0xbc, 0xfc, 0x47, 0xfd, 0xc2, 0x65, 0x3a, 0xfa, 0x29, 0x2c, |
1762 | | 0x72, 0xb3, 0x7f, 0xf8, 0x63, 0xae, 0x29, 0xcc, 0xc9, 0xf0, |
1763 | | }, |
1764 | | 32, "Google 'Xenon2019' log" }, |
1765 | | { (const uint8_t[]){ |
1766 | | 0xa8, 0x99, 0xd8, 0x78, 0x0c, 0x92, 0x90, 0xaa, 0xf4, 0x62, 0xf3, |
1767 | | 0x18, 0x80, 0xcc, 0xfb, 0xd5, 0x24, 0x51, 0xe9, 0x70, 0xd0, 0xfb, |
1768 | | 0xf5, 0x91, 0xef, 0x75, 0xb0, 0xd9, 0x9b, 0x64, 0x56, 0x81, |
1769 | | }, |
1770 | | 32, "Google 'Submariner' log" }, |
1771 | | { (const uint8_t[]){ |
1772 | | 0x1d, 0x02, 0x4b, 0x8e, 0xb1, 0x49, 0x8b, 0x34, 0x4d, 0xfd, 0x87, |
1773 | | 0xea, 0x3e, 0xfc, 0x09, 0x96, 0xf7, 0x50, 0x6f, 0x23, 0x5d, 0x1d, |
1774 | | 0x49, 0x70, 0x61, 0xa4, 0x77, 0x3c, 0x43, 0x9c, 0x25, 0xfb, |
1775 | | }, |
1776 | | 32, "Google 'Daedalus' log" }, |
1777 | | { (const uint8_t[]){ |
1778 | | 0xb0, 0xcc, 0x83, 0xe5, 0xa5, 0xf9, 0x7d, 0x6b, 0xaf, 0x7c, 0x09, |
1779 | | 0xcc, 0x28, 0x49, 0x04, 0x87, 0x2a, 0xc7, 0xe8, 0x8b, 0x13, 0x2c, |
1780 | | 0x63, 0x50, 0xb7, 0xc6, 0xfd, 0x26, 0xe1, 0x6c, 0x6c, 0x77, |
1781 | | }, |
1782 | | 32, "Google 'Testtube' log" }, |
1783 | | { (const uint8_t[]){ |
1784 | | 0xc3, 0xbf, 0x03, 0xa7, 0xe1, 0xca, 0x88, 0x41, 0xc6, 0x07, 0xba, |
1785 | | 0xe3, 0xff, 0x42, 0x70, 0xfc, 0xa5, 0xec, 0x45, 0xb1, 0x86, 0xeb, |
1786 | | 0xbe, 0x4e, 0x2c, 0xf3, 0xfc, 0x77, 0x86, 0x30, 0xf5, 0xf6, |
1787 | | }, |
1788 | | 32, "Google 'Crucible' log" }, |
1789 | | { (const uint8_t[]){ |
1790 | | 0x52, 0xeb, 0x4b, 0x22, 0x5e, 0xc8, 0x96, 0x97, 0x48, 0x50, 0x67, |
1791 | | 0x5f, 0x23, 0xe4, 0x3b, 0xc1, 0xd0, 0x21, 0xe3, 0x21, 0x4c, 0xe5, |
1792 | | 0x2e, 0xcd, 0x5f, 0xa8, 0x7c, 0x20, 0x3c, 0xdf, 0xca, 0x03, |
1793 | | }, |
1794 | | 32, "Google 'Solera2018' log" }, |
1795 | | { (const uint8_t[]){ |
1796 | | 0x0b, 0x76, 0x0e, 0x9a, 0x8b, 0x9a, 0x68, 0x2f, 0x88, 0x98, 0x5b, |
1797 | | 0x15, 0xe9, 0x47, 0x50, 0x1a, 0x56, 0x44, 0x6b, 0xba, 0x88, 0x30, |
1798 | | 0x78, 0x5c, 0x38, 0x42, 0x99, 0x43, 0x86, 0x45, 0x0c, 0x00, |
1799 | | }, |
1800 | | 32, "Google 'Solera2019' log" }, |
1801 | | { (const uint8_t[]){ |
1802 | | 0x1f, 0xc7, 0x2c, 0xe5, 0xa1, 0xb7, 0x99, 0xf4, 0x00, 0xc3, 0x59, |
1803 | | 0xbf, 0xf9, 0x6c, 0xa3, 0x91, 0x35, 0x48, 0xe8, 0x64, 0x42, 0x20, |
1804 | | 0x61, 0x09, 0x52, 0xe9, 0xba, 0x17, 0x74, 0xf7, 0xba, 0xc7, |
1805 | | }, |
1806 | | 32, "Google 'Solera2020' log" }, |
1807 | | { (const uint8_t[]){ |
1808 | | 0xa3, 0xc9, 0x98, 0x45, 0xe8, 0x0a, 0xb7, 0xce, 0x00, 0x15, 0x7b, |
1809 | | 0x37, 0x42, 0xdf, 0x02, 0x07, 0xdd, 0x27, 0x2b, 0x2b, 0x60, 0x2e, |
1810 | | 0xcf, 0x98, 0xee, 0x2c, 0x12, 0xdb, 0x9c, 0x5a, 0xe7, 0xe7, |
1811 | | }, |
1812 | | 32, "Google 'Solera2021' log" }, |
1813 | | { (const uint8_t[]){ |
1814 | | 0x69, 0x7a, 0xaf, 0xca, 0x1a, 0x6b, 0x53, 0x6f, 0xae, 0x21, 0x20, |
1815 | | 0x50, 0x46, 0xde, 0xba, 0xd7, 0xe0, 0xea, 0xea, 0x13, 0xd2, 0x43, |
1816 | | 0x2e, 0x6e, 0x9d, 0x8f, 0xb3, 0x79, 0xf2, 0xb9, 0xaa, 0xf3, |
1817 | | }, |
1818 | | 32, "Google 'Solera2022' log" }, |
1819 | | { (const uint8_t[]){ |
1820 | | 0xf9, 0x7e, 0x97, 0xb8, 0xd3, 0x3e, 0xf7, 0xa1, 0x59, 0x02, 0xa5, |
1821 | | 0x3a, 0x19, 0xe1, 0x79, 0x90, 0xe5, 0xdc, 0x40, 0x6a, 0x03, 0x18, |
1822 | | 0x25, 0xba, 0xad, 0x93, 0xe9, 0x8f, 0x9b, 0x9c, 0x69, 0xcb, |
1823 | | }, |
1824 | | 32, "Google 'Solera2023' log" }, |
1825 | | { (const uint8_t[]){ |
1826 | | 0x30, 0x24, 0xce, 0x7e, 0xeb, 0x16, 0x88, 0x62, 0x72, 0x4b, 0xea, |
1827 | | 0x70, 0x2e, 0xff, 0xf9, 0x92, 0xcf, 0xe4, 0x56, 0x43, 0x41, 0x91, |
1828 | | 0xaa, 0x59, 0x5b, 0x25, 0xf8, 0x02, 0x26, 0xc8, 0x00, 0x17, |
1829 | | }, |
1830 | | 32, "Google 'Solera2024' log" }, |
1831 | | { (const uint8_t[]){ |
1832 | | 0x3f, 0xe1, 0xcb, 0x46, 0xed, 0x47, 0x35, 0x79, 0xaf, 0x01, 0x41, |
1833 | | 0xf9, 0x72, 0x4d, 0x9d, 0xc4, 0x43, 0x47, 0x2d, 0x75, 0x6e, 0x85, |
1834 | | 0xe7, 0x71, 0x9c, 0x55, 0x82, 0x48, 0x5d, 0xd4, 0xe1, 0xe4, |
1835 | | }, |
1836 | | 32, "Google 'Solera2025h1' log" }, |
1837 | | { (const uint8_t[]){ |
1838 | | 0x26, 0x02, 0x39, 0x48, 0x87, 0x4c, 0xf7, 0xfc, 0xd0, 0xfb, 0x64, |
1839 | | 0x71, 0xa4, 0x3e, 0x84, 0x7e, 0xbb, 0x20, 0x0a, 0xe6, 0xe2, 0xfa, |
1840 | | 0x24, 0x23, 0x6d, 0xf6, 0xd1, 0xa6, 0x06, 0x63, 0x0f, 0xb1, |
1841 | | }, |
1842 | | 32, "Google 'Solera2025h2' log" }, |
1843 | | { (const uint8_t[]){ |
1844 | | 0xc8, 0x4b, 0x90, 0x7a, 0x07, 0xbe, 0xaa, 0x29, 0xa6, 0x14, 0xc2, |
1845 | | 0x45, 0x84, 0xb7, 0xa3, 0xf6, 0x62, 0x43, 0x94, 0x68, 0x7b, 0x25, |
1846 | | 0xfe, 0x62, 0x83, 0x8b, 0x71, 0xec, 0x42, 0x2a, 0xd2, 0xf9, |
1847 | | }, |
1848 | | 32, "Google 'Solera2026h1' log" }, |
1849 | | { (const uint8_t[]){ |
1850 | | 0x62, 0xe9, 0x00, 0x60, 0x04, 0xa3, 0x07, 0x95, 0x5a, 0x75, 0x44, |
1851 | | 0xb4, 0xd5, 0x84, 0xa9, 0x62, 0x68, 0xca, 0x1d, 0x6e, 0x45, 0x85, |
1852 | | 0xad, 0xf0, 0x91, 0x6d, 0xfe, 0x5f, 0xdc, 0x1f, 0x04, 0xdb, |
1853 | | }, |
1854 | | 32, "Google 'Solera2026h2' log" }, |
1855 | | { (const uint8_t[]){ |
1856 | | 0x3d, 0xe4, 0x92, 0xa8, 0x98, 0x93, 0xad, 0x70, 0x5e, 0x78, 0x46, |
1857 | | 0xed, 0x21, 0xd4, 0x8d, 0xca, 0xfb, 0xad, 0x13, 0x9e, 0xa6, 0x4e, |
1858 | | 0xd1, 0xe3, 0x49, 0xf9, 0x00, 0xb0, 0xa2, 0xcd, 0xa5, 0xe2, |
1859 | | }, |
1860 | | 32, "Google 'Solera2027h1' log" }, |
1861 | | { (const uint8_t[]){ |
1862 | | 0x5e, 0xa7, 0x73, 0xf9, 0xdf, 0x56, 0xc0, 0xe7, 0xb5, 0x36, 0x48, |
1863 | | 0x7d, 0xd0, 0x49, 0xe0, 0x32, 0x7a, 0x91, 0x9a, 0x0c, 0x84, 0xa1, |
1864 | | 0x12, 0x12, 0x84, 0x18, 0x75, 0x96, 0x81, 0x71, 0x45, 0x58, |
1865 | | }, |
1866 | | 32, "Cloudflare 'Nimbus2020' Log" }, |
1867 | | { (const uint8_t[]){ |
1868 | | 0x44, 0x94, 0x65, 0x2e, 0xb0, 0xee, 0xce, 0xaf, 0xc4, 0x40, 0x07, |
1869 | | 0xd8, 0xa8, 0xfe, 0x28, 0xc0, 0xda, 0xe6, 0x82, 0xbe, 0xd8, 0xcb, |
1870 | | 0x31, 0xb5, 0x3f, 0xd3, 0x33, 0x96, 0xb5, 0xb6, 0x81, 0xa8, |
1871 | | }, |
1872 | | 32, "Cloudflare 'Nimbus2021' Log" }, |
1873 | | { (const uint8_t[]){ |
1874 | | 0x41, 0xc8, 0xca, 0xb1, 0xdf, 0x22, 0x46, 0x4a, 0x10, 0xc6, 0xa1, |
1875 | | 0x3a, 0x09, 0x42, 0x87, 0x5e, 0x4e, 0x31, 0x8b, 0x1b, 0x03, 0xeb, |
1876 | | 0xeb, 0x4b, 0xc7, 0x68, 0xf0, 0x90, 0x62, 0x96, 0x06, 0xf6, |
1877 | | }, |
1878 | | 32, "Cloudflare 'Nimbus2022' Log" }, |
1879 | | { (const uint8_t[]){ |
1880 | | 0x7a, 0x32, 0x8c, 0x54, 0xd8, 0xb7, 0x2d, 0xb6, 0x20, 0xea, 0x38, |
1881 | | 0xe0, 0x52, 0x1e, 0xe9, 0x84, 0x16, 0x70, 0x32, 0x13, 0x85, 0x4d, |
1882 | | 0x3b, 0xd2, 0x2b, 0xc1, 0x3a, 0x57, 0xa3, 0x52, 0xeb, 0x52, |
1883 | | }, |
1884 | | 32, "Cloudflare 'Nimbus2023' Log" }, |
1885 | | { (const uint8_t[]){ |
1886 | | 0xda, 0xb6, 0xbf, 0x6b, 0x3f, 0xb5, 0xb6, 0x22, 0x9f, 0x9b, 0xc2, |
1887 | | 0xbb, 0x5c, 0x6b, 0xe8, 0x70, 0x91, 0x71, 0x6c, 0xbb, 0x51, 0x84, |
1888 | | 0x85, 0x34, 0xbd, 0xa4, 0x3d, 0x30, 0x48, 0xd7, 0xfb, 0xab, |
1889 | | }, |
1890 | | 32, "Cloudflare 'Nimbus2024' Log" }, |
1891 | | { (const uint8_t[]){ |
1892 | | 0xcc, 0xfb, 0x0f, 0x6a, 0x85, 0x71, 0x09, 0x65, 0xfe, 0x95, 0x9b, |
1893 | | 0x53, 0xce, 0xe9, 0xb2, 0x7c, 0x22, 0xe9, 0x85, 0x5c, 0x0d, 0x97, |
1894 | | 0x8d, 0xb6, 0xa9, 0x7e, 0x54, 0xc0, 0xfe, 0x4c, 0x0d, 0xb0, |
1895 | | }, |
1896 | | 32, "Cloudflare 'Nimbus2025'" }, |
1897 | | { (const uint8_t[]){ |
1898 | | 0xcb, 0x38, 0xf7, 0x15, 0x89, 0x7c, 0x84, 0xa1, 0x44, 0x5f, 0x5b, |
1899 | | 0xc1, 0xdd, 0xfb, 0xc9, 0x6e, 0xf2, 0x9a, 0x59, 0xcd, 0x47, 0x0a, |
1900 | | 0x69, 0x05, 0x85, 0xb0, 0xcb, 0x14, 0xc3, 0x14, 0x58, 0xe7, |
1901 | | }, |
1902 | | 32, "Cloudflare 'Nimbus2026'" }, |
1903 | | { (const uint8_t[]){ |
1904 | | 0x4c, 0x63, 0xdc, 0x98, 0xe5, 0x9c, 0x1d, 0xab, 0x88, 0xf6, 0x1e, |
1905 | | 0x8a, 0x3d, 0xde, 0xae, 0x8f, 0xab, 0x44, 0xa3, 0x37, 0x7b, 0x5f, |
1906 | | 0x9b, 0x94, 0xc3, 0xfb, 0xa1, 0x9c, 0xfc, 0xc1, 0xbe, 0x26, |
1907 | | }, |
1908 | | 32, "Cloudflare 'Nimbus2027'" }, |
1909 | | { (const uint8_t[]){ |
1910 | | 0x1f, 0xbc, 0x36, 0xe0, 0x02, 0xed, 0xe9, 0x7f, 0x40, 0x19, 0x9e, |
1911 | | 0x86, 0xb3, 0x57, 0x3b, 0x8a, 0x42, 0x17, 0xd8, 0x01, 0x87, 0x74, |
1912 | | 0x6a, 0xd0, 0xda, 0x03, 0xa0, 0x60, 0x54, 0xd2, 0x0d, 0xf4, |
1913 | | }, |
1914 | | 32, "Cloudflare 'Nimbus2017' Log" }, |
1915 | | { (const uint8_t[]){ |
1916 | | 0xdb, 0x74, 0xaf, 0xee, 0xcb, 0x29, 0xec, 0xb1, 0xfe, 0xca, 0x3e, |
1917 | | 0x71, 0x6d, 0x2c, 0xe5, 0xb9, 0xaa, 0xbb, 0x36, 0xf7, 0x84, 0x71, |
1918 | | 0x83, 0xc7, 0x5d, 0x9d, 0x4f, 0x37, 0xb6, 0x1f, 0xbf, 0x64, |
1919 | | }, |
1920 | | 32, "Cloudflare 'Nimbus2018' Log" }, |
1921 | | { (const uint8_t[]){ |
1922 | | 0x74, 0x7e, 0xda, 0x83, 0x31, 0xad, 0x33, 0x10, 0x91, 0x21, 0x9c, |
1923 | | 0xce, 0x25, 0x4f, 0x42, 0x70, 0xc2, 0xbf, 0xfd, 0x5e, 0x42, 0x20, |
1924 | | 0x08, 0xc6, 0x37, 0x35, 0x79, 0xe6, 0x10, 0x7b, 0xcc, 0x56, |
1925 | | }, |
1926 | | 32, "Cloudflare 'Nimbus2019' Log" }, |
1927 | | { (const uint8_t[]){ |
1928 | | 0x56, 0x14, 0x06, 0x9a, 0x2f, 0xd7, 0xc2, 0xec, 0xd3, 0xf5, 0xe1, |
1929 | | 0xbd, 0x44, 0xb2, 0x3e, 0xc7, 0x46, 0x76, 0xb9, 0xbc, 0x99, 0x11, |
1930 | | 0x5c, 0xc0, 0xef, 0x94, 0x98, 0x55, 0xd6, 0x89, 0xd0, 0xdd, |
1931 | | }, |
1932 | | 32, "DigiCert Log Server" }, |
1933 | | { (const uint8_t[]){ |
1934 | | 0x87, 0x75, 0xbf, 0xe7, 0x59, 0x7c, 0xf8, 0x8c, 0x43, 0x99, 0x5f, |
1935 | | 0xbd, 0xf3, 0x6e, 0xff, 0x56, 0x8d, 0x47, 0x56, 0x36, 0xff, 0x4a, |
1936 | | 0xb5, 0x60, 0xc1, 0xb4, 0xea, 0xff, 0x5e, 0xa0, 0x83, 0x0f, |
1937 | | }, |
1938 | | 32, "DigiCert Log Server 2" }, |
1939 | | { (const uint8_t[]){ |
1940 | | 0xf0, 0x95, 0xa4, 0x59, 0xf2, 0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d, |
1941 | | 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b, 0xfe, 0x1d, 0x47, 0xe3, 0x99, |
1942 | | 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa, 0x8e, 0xb2, 0x73, |
1943 | | }, |
1944 | | 32, "DigiCert Yeti2020 Log" }, |
1945 | | { (const uint8_t[]){ |
1946 | | 0x5c, 0xdc, 0x43, 0x92, 0xfe, 0xe6, 0xab, 0x45, 0x44, 0xb1, 0x5e, |
1947 | | 0x9a, 0xd4, 0x56, 0xe6, 0x10, 0x37, 0xfb, 0xd5, 0xfa, 0x47, 0xdc, |
1948 | | 0xa1, 0x73, 0x94, 0xb2, 0x5e, 0xe6, 0xf6, 0xc7, 0x0e, 0xca, |
1949 | | }, |
1950 | | 32, "DigiCert Yeti2021 Log" }, |
1951 | | { (const uint8_t[]){ |
1952 | | 0x22, 0x45, 0x45, 0x07, 0x59, 0x55, 0x24, 0x56, 0x96, 0x3f, 0xa1, |
1953 | | 0x2f, 0xf1, 0xf7, 0x6d, 0x86, 0xe0, 0x23, 0x26, 0x63, 0xad, 0xc0, |
1954 | | 0x4b, 0x7f, 0x5d, 0xc6, 0x83, 0x5c, 0x6e, 0xe2, 0x0f, 0x02, |
1955 | | }, |
1956 | | 32, "DigiCert Yeti2022 Log" }, |
1957 | | { (const uint8_t[]){ |
1958 | | 0x35, 0xcf, 0x19, 0x1b, 0xbf, 0xb1, 0x6c, 0x57, 0xbf, 0x0f, 0xad, |
1959 | | 0x4c, 0x6d, 0x42, 0xcb, 0xbb, 0xb6, 0x27, 0x20, 0x26, 0x51, 0xea, |
1960 | | 0x3f, 0xe1, 0x2a, 0xef, 0xa8, 0x03, 0xc3, 0x3b, 0xd6, 0x4c, |
1961 | | }, |
1962 | | 32, "DigiCert Yeti2023 Log" }, |
1963 | | { (const uint8_t[]){ |
1964 | | 0x48, 0xb0, 0xe3, 0x6b, 0xda, 0xa6, 0x47, 0x34, 0x0f, 0xe5, 0x6a, |
1965 | | 0x02, 0xfa, 0x9d, 0x30, 0xeb, 0x1c, 0x52, 0x01, 0xcb, 0x56, 0xdd, |
1966 | | 0x2c, 0x81, 0xd9, 0xbb, 0xbf, 0xab, 0x39, 0xd8, 0x84, 0x73, |
1967 | | }, |
1968 | | 32, "DigiCert Yeti2024 Log" }, |
1969 | | { (const uint8_t[]){ |
1970 | | 0x7d, 0x59, 0x1e, 0x12, 0xe1, 0x78, 0x2a, 0x7b, 0x1c, 0x61, 0x67, |
1971 | | 0x7c, 0x5e, 0xfd, 0xf8, 0xd0, 0x87, 0x5c, 0x14, 0xa0, 0x4e, 0x95, |
1972 | | 0x9e, 0xb9, 0x03, 0x2f, 0xd9, 0x0e, 0x8c, 0x2e, 0x79, 0xb8, |
1973 | | }, |
1974 | | 32, "DigiCert Yeti2025 Log" }, |
1975 | | { (const uint8_t[]){ |
1976 | | 0xc6, 0x52, 0xa0, 0xec, 0x48, 0xce, 0xb3, 0xfc, 0xab, 0x17, 0x09, |
1977 | | 0x92, 0xc4, 0x3a, 0x87, 0x41, 0x33, 0x09, 0xe8, 0x00, 0x65, 0xa2, |
1978 | | 0x62, 0x52, 0x40, 0x1b, 0xa3, 0x36, 0x2a, 0x17, 0xc5, 0x65, |
1979 | | }, |
1980 | | 32, "DigiCert Nessie2020 Log" }, |
1981 | | { (const uint8_t[]){ |
1982 | | 0xee, 0xc0, 0x95, 0xee, 0x8d, 0x72, 0x64, 0x0f, 0x92, 0xe3, 0xc3, |
1983 | | 0xb9, 0x1b, 0xc7, 0x12, 0xa3, 0x69, 0x6a, 0x09, 0x7b, 0x4b, 0x6a, |
1984 | | 0x1a, 0x14, 0x38, 0xe6, 0x47, 0xb2, 0xcb, 0xed, 0xc5, 0xf9, |
1985 | | }, |
1986 | | 32, "DigiCert Nessie2021 Log" }, |
1987 | | { (const uint8_t[]){ |
1988 | | 0x51, 0xa3, 0xb0, 0xf5, 0xfd, 0x01, 0x79, 0x9c, 0x56, 0x6d, 0xb8, |
1989 | | 0x37, 0x78, 0x8f, 0x0c, 0xa4, 0x7a, 0xcc, 0x1b, 0x27, 0xcb, 0xf7, |
1990 | | 0x9e, 0x88, 0x42, 0x9a, 0x0d, 0xfe, 0xd4, 0x8b, 0x05, 0xe5, |
1991 | | }, |
1992 | | 32, "DigiCert Nessie2022 Log" }, |
1993 | | { (const uint8_t[]){ |
1994 | | 0xb3, 0x73, 0x77, 0x07, 0xe1, 0x84, 0x50, 0xf8, 0x63, 0x86, 0xd6, |
1995 | | 0x05, 0xa9, 0xdc, 0x11, 0x09, 0x4a, 0x79, 0x2d, 0xb1, 0x67, 0x0c, |
1996 | | 0x0b, 0x87, 0xdc, 0xf0, 0x03, 0x0e, 0x79, 0x36, 0xa5, 0x9a, |
1997 | | }, |
1998 | | 32, "DigiCert Nessie2023 Log" }, |
1999 | | { (const uint8_t[]){ |
2000 | | 0x73, 0xd9, 0x9e, 0x89, 0x1b, 0x4c, 0x96, 0x78, 0xa0, 0x20, 0x7d, |
2001 | | 0x47, 0x9d, 0xe6, 0xb2, 0xc6, 0x1c, 0xd0, 0x51, 0x5e, 0x71, 0x19, |
2002 | | 0x2a, 0x8c, 0x6b, 0x80, 0x10, 0x7a, 0xc1, 0x77, 0x72, 0xb5, |
2003 | | }, |
2004 | | 32, "DigiCert Nessie2024 Log" }, |
2005 | | { (const uint8_t[]){ |
2006 | | 0xe6, 0xd2, 0x31, 0x63, 0x40, 0x77, 0x8c, 0xc1, 0x10, 0x41, 0x06, |
2007 | | 0xd7, 0x71, 0xb9, 0xce, 0xc1, 0xd2, 0x40, 0xf6, 0x96, 0x84, 0x86, |
2008 | | 0xfb, 0xba, 0x87, 0x32, 0x1d, 0xfd, 0x1e, 0x37, 0x8e, 0x50, |
2009 | | }, |
2010 | | 32, "DigiCert Nessie2025 Log" }, |
2011 | | { (const uint8_t[]){ |
2012 | | 0xb6, 0x9d, 0xdc, 0xbc, 0x3c, 0x1a, 0xbd, 0xef, 0x6f, 0x9f, 0xd6, |
2013 | | 0x0c, 0x88, 0xb1, 0x06, 0x7b, 0x77, 0xf0, 0x82, 0x68, 0x8b, 0x2d, |
2014 | | 0x78, 0x65, 0xd0, 0x4b, 0x39, 0xab, 0xe9, 0x27, 0xa5, 0x75, |
2015 | | }, |
2016 | | 32, "DigiCert 'Wyvern2024h1' Log" }, |
2017 | | { (const uint8_t[]){ |
2018 | | 0x0c, 0x2a, 0xef, 0x2c, 0x4a, 0x5b, 0x98, 0x83, 0xd4, 0xdd, 0xa3, |
2019 | | 0x82, 0xfe, 0x50, 0xfb, 0x51, 0x88, 0xb3, 0xe9, 0x73, 0x33, 0xa1, |
2020 | | 0xec, 0x53, 0xa0, 0x9d, 0xc9, 0xa7, 0x9d, 0x0d, 0x08, 0x20, |
2021 | | }, |
2022 | | 32, "DigiCert 'Wyvern2024h2' Log" }, |
2023 | | { (const uint8_t[]){ |
2024 | | 0x73, 0x20, 0x22, 0x0f, 0x08, 0x16, 0x8a, 0xf9, 0xf3, 0xc4, 0xa6, |
2025 | | 0x8b, 0x0a, 0xb2, 0x6a, 0x9a, 0x4a, 0x00, 0xee, 0xf5, 0x77, 0x85, |
2026 | | 0x8a, 0x08, 0x4d, 0x05, 0x00, 0xd4, 0xa5, 0x42, 0x44, 0x59, |
2027 | | }, |
2028 | | 32, "DigiCert 'Wyvern2025h1' Log" }, |
2029 | | { (const uint8_t[]){ |
2030 | | 0xed, 0x3c, 0x4b, 0xd6, 0xe8, 0x06, 0xc2, 0xa4, 0xa2, 0x00, 0x57, |
2031 | | 0xdb, 0xcb, 0x24, 0xe2, 0x38, 0x01, 0xdf, 0x51, 0x2f, 0xed, 0xc4, |
2032 | | 0x86, 0xc5, 0x70, 0x0f, 0x20, 0xdd, 0xb7, 0x3e, 0x3f, 0xe0, |
2033 | | }, |
2034 | | 32, "DigiCert 'Wyvern2025h2' Log" }, |
2035 | | { (const uint8_t[]){ |
2036 | | 0x64, 0x11, 0xc4, 0x6c, 0xa4, 0x12, 0xec, 0xa7, 0x89, 0x1c, 0xa2, |
2037 | | 0x02, 0x2e, 0x00, 0xbc, 0xab, 0x4f, 0x28, 0x07, 0xd4, 0x1e, 0x35, |
2038 | | 0x27, 0xab, 0xea, 0xfe, 0xd5, 0x03, 0xc9, 0x7d, 0xcd, 0xf0, |
2039 | | }, |
2040 | | 32, "DigiCert 'Wyvern2026h1'" }, |
2041 | | { (const uint8_t[]){ |
2042 | | 0xc2, 0x31, 0x7e, 0x57, 0x45, 0x19, 0xa3, 0x45, 0xee, 0x7f, 0x38, |
2043 | | 0xde, 0xb2, 0x90, 0x41, 0xeb, 0xc7, 0xc2, 0x21, 0x5a, 0x22, 0xbf, |
2044 | | 0x7f, 0xd5, 0xb5, 0xad, 0x76, 0x9a, 0xd9, 0x0e, 0x52, 0xcd, |
2045 | | }, |
2046 | | 32, "DigiCert 'Wyvern2026h2'" }, |
2047 | | { (const uint8_t[]){ |
2048 | | 0x00, 0x1a, 0x5d, 0x1a, 0x1c, 0x2d, 0x93, 0x75, 0xb6, 0x48, 0x55, |
2049 | | 0x78, 0xf8, 0x2f, 0x71, 0xa1, 0xae, 0x6e, 0xef, 0x39, 0x7d, 0x29, |
2050 | | 0x7c, 0x8a, 0xe3, 0x15, 0x7b, 0xca, 0xde, 0xe1, 0xa0, 0x1e, |
2051 | | }, |
2052 | | 32, "DigiCert 'Wyvern2027h1'" }, |
2053 | | { (const uint8_t[]){ |
2054 | | 0x37, 0xaa, 0x07, 0xcc, 0x21, 0x6f, 0x2e, 0x6d, 0x91, 0x9c, 0x70, |
2055 | | 0x9d, 0x24, 0xd8, 0xf7, 0x31, 0xb0, 0x0f, 0x2b, 0x14, 0x7c, 0x62, |
2056 | | 0x1c, 0xc0, 0x91, 0xa5, 0xfa, 0x1a, 0x84, 0xd8, 0x16, 0xdd, |
2057 | | }, |
2058 | | 32, "DigiCert 'Wyvern2027h2'" }, |
2059 | | { (const uint8_t[]){ |
2060 | | 0xdb, 0x07, 0x6c, 0xde, 0x6a, 0x8b, 0x78, 0xec, 0x58, 0xd6, 0x05, |
2061 | | 0x64, 0x96, 0xeb, 0x6a, 0x26, 0xa8, 0xc5, 0x9e, 0x72, 0x12, 0x93, |
2062 | | 0xe8, 0xac, 0x03, 0x27, 0xdd, 0xde, 0x89, 0xdb, 0x5a, 0x2a, |
2063 | | }, |
2064 | | 32, "DigiCert 'Sphinx2024h1' Log" }, |
2065 | | { (const uint8_t[]){ |
2066 | | 0xdc, 0xc9, 0x5e, 0x6f, 0xa2, 0x99, 0xb9, 0xb0, 0xfd, 0xbd, 0x6c, |
2067 | | 0xa6, 0xa3, 0x6e, 0x1d, 0x72, 0xc4, 0x21, 0x2f, 0xdd, 0x1e, 0x0f, |
2068 | | 0x47, 0x55, 0x3a, 0x36, 0xd6, 0xcf, 0x1a, 0xd1, 0x1d, 0x8d, |
2069 | | }, |
2070 | | 32, "DigiCert 'Sphinx2024h2' Log" }, |
2071 | | { (const uint8_t[]){ |
2072 | | 0xde, 0x85, 0x81, 0xd7, 0x50, 0x24, 0x7c, 0x6b, 0xcd, 0xcb, 0xaf, |
2073 | | 0x56, 0x37, 0xc5, 0xe7, 0x81, 0xc6, 0x4c, 0xe4, 0x6e, 0xd6, 0x17, |
2074 | | 0x63, 0x9f, 0x8f, 0x34, 0xa7, 0x26, 0xc9, 0xe2, 0xbd, 0x37, |
2075 | | }, |
2076 | | 32, "DigiCert 'Sphinx2025h1' Log" }, |
2077 | | { (const uint8_t[]){ |
2078 | | 0xa4, 0x42, 0xc5, 0x06, 0x49, 0x60, 0x61, 0x54, 0x8f, 0x0f, 0xd4, |
2079 | | 0xea, 0x9c, 0xfb, 0x7a, 0x2d, 0x26, 0x45, 0x4d, 0x87, 0xa9, 0x7f, |
2080 | | 0x2f, 0xdf, 0x45, 0x59, 0xf6, 0x27, 0x4f, 0x3a, 0x84, 0x54, |
2081 | | }, |
2082 | | 32, "DigiCert 'Sphinx2025h2' Log" }, |
2083 | | { (const uint8_t[]){ |
2084 | | 0x49, 0x9c, 0x9b, 0x69, 0xde, 0x1d, 0x7c, 0xec, 0xfc, 0x36, 0xde, |
2085 | | 0xcd, 0x87, 0x64, 0xa6, 0xb8, 0x5b, 0xaf, 0x0a, 0x87, 0x80, 0x19, |
2086 | | 0xd1, 0x55, 0x52, 0xfb, 0xe9, 0xeb, 0x29, 0xdd, 0xf8, 0xc3, |
2087 | | }, |
2088 | | 32, "DigiCert 'Sphinx2026h1'" }, |
2089 | | { (const uint8_t[]){ |
2090 | | 0x94, 0x4e, 0x43, 0x87, 0xfa, 0xec, 0xc1, 0xef, 0x81, 0xf3, 0x19, |
2091 | | 0x24, 0x26, 0xa8, 0x18, 0x65, 0x01, 0xc7, 0xd3, 0x5f, 0x38, 0x02, |
2092 | | 0x01, 0x3f, 0x72, 0x67, 0x7d, 0x55, 0x37, 0x2e, 0x19, 0xd8, |
2093 | | }, |
2094 | | 32, "DigiCert 'Sphinx2026h2'" }, |
2095 | | { (const uint8_t[]){ |
2096 | | 0x46, 0xa2, 0x39, 0x67, 0xc6, 0x0d, 0xb6, 0x46, 0x87, 0xc6, 0x6f, |
2097 | | 0x3d, 0xf9, 0x99, 0x94, 0x76, 0x93, 0xa6, 0xa6, 0x11, 0x20, 0x84, |
2098 | | 0x57, 0xd5, 0x55, 0xe7, 0xe3, 0xd0, 0xa1, 0xd9, 0xb6, 0x46, |
2099 | | }, |
2100 | | 32, "DigiCert 'sphinx2027h1'" }, |
2101 | | { (const uint8_t[]){ |
2102 | | 0x1f, 0xb0, 0xf8, 0xa9, 0x2d, 0x8a, 0xdd, 0xa1, 0x21, 0x77, 0x6c, |
2103 | | 0x05, 0xe2, 0xaa, 0x2e, 0x15, 0xba, 0xcb, 0xc6, 0x2b, 0x65, 0x39, |
2104 | | 0x36, 0x95, 0x57, 0x6a, 0xaa, 0xb5, 0x2e, 0x11, 0xd1, 0x1d, |
2105 | | }, |
2106 | | 32, "DigiCert 'sphinx2027h2'" }, |
2107 | | { (const uint8_t[]){ |
2108 | | 0xdd, 0xeb, 0x1d, 0x2b, 0x7a, 0x0d, 0x4f, 0xa6, 0x20, 0x8b, 0x81, |
2109 | | 0xad, 0x81, 0x68, 0x70, 0x7e, 0x2e, 0x8e, 0x9d, 0x01, 0xd5, 0x5c, |
2110 | | 0x88, 0x8d, 0x3d, 0x11, 0xc4, 0xcd, 0xb6, 0xec, 0xbe, 0xcc, |
2111 | | }, |
2112 | | 32, "Symantec log" }, |
2113 | | { (const uint8_t[]){ |
2114 | | 0xbc, 0x78, 0xe1, 0xdf, 0xc5, 0xf6, 0x3c, 0x68, 0x46, 0x49, 0x33, |
2115 | | 0x4d, 0xa1, 0x0f, 0xa1, 0x5f, 0x09, 0x79, 0x69, 0x20, 0x09, 0xc0, |
2116 | | 0x81, 0xb4, 0xf3, 0xf6, 0x91, 0x7f, 0x3e, 0xd9, 0xb8, 0xa5, |
2117 | | }, |
2118 | | 32, "Symantec 'Vega' log" }, |
2119 | | { (const uint8_t[]){ |
2120 | | 0x15, 0x97, 0x04, 0x88, 0xd7, 0xb9, 0x97, 0xa0, 0x5b, 0xeb, 0x52, |
2121 | | 0x51, 0x2a, 0xde, 0xe8, 0xd2, 0xe8, 0xb4, 0xa3, 0x16, 0x52, 0x64, |
2122 | | 0x12, 0x1a, 0x9f, 0xab, 0xfb, 0xd5, 0xf8, 0x5a, 0xd9, 0x3f, |
2123 | | }, |
2124 | | 32, "Symantec 'Sirius' log" }, |
2125 | | { (const uint8_t[]){ |
2126 | | 0x05, 0x9c, 0x01, 0xd3, 0x20, 0xe0, 0x07, 0x84, 0x13, 0x95, 0x80, |
2127 | | 0x49, 0x8d, 0x11, 0x7c, 0x90, 0x32, 0x66, 0xaf, 0xaf, 0x72, 0x50, |
2128 | | 0xb5, 0xaf, 0x3b, 0x46, 0xa4, 0x3e, 0x11, 0x84, 0x0d, 0x4a, |
2129 | | }, |
2130 | | 32, "DigiCert Yeti2022-2 Log" }, |
2131 | | { (const uint8_t[]){ |
2132 | | 0xc1, 0x16, 0x4a, 0xe0, 0xa7, 0x72, 0xd2, 0xd4, 0x39, 0x2d, 0xc8, |
2133 | | 0x0a, 0xc1, 0x07, 0x70, 0xd4, 0xf0, 0xc4, 0x9b, 0xde, 0x99, 0x1a, |
2134 | | 0x48, 0x40, 0xc1, 0xfa, 0x07, 0x51, 0x64, 0xf6, 0x33, 0x60, |
2135 | | }, |
2136 | | 32, "DigiCert Yeti2018 Log" }, |
2137 | | { (const uint8_t[]){ |
2138 | | 0xe2, 0x69, 0x4b, 0xae, 0x26, 0xe8, 0xe9, 0x40, 0x09, 0xe8, 0x86, |
2139 | | 0x1b, 0xb6, 0x3b, 0x83, 0xd4, 0x3e, 0xe7, 0xfe, 0x74, 0x88, 0xfb, |
2140 | | 0xa4, 0x8f, 0x28, 0x93, 0x01, 0x9d, 0xdd, 0xf1, 0xdb, 0xfe, |
2141 | | }, |
2142 | | 32, "DigiCert Yeti2019 Log" }, |
2143 | | { (const uint8_t[]){ |
2144 | | 0x6f, 0xf1, 0x41, 0xb5, 0x64, 0x7e, 0x42, 0x22, 0xf7, 0xef, 0x05, |
2145 | | 0x2c, 0xef, 0xae, 0x7c, 0x21, 0xfd, 0x60, 0x8e, 0x27, 0xd2, 0xaf, |
2146 | | 0x5a, 0x6e, 0x9f, 0x4b, 0x8a, 0x37, 0xd6, 0x63, 0x3e, 0xe5, |
2147 | | }, |
2148 | | 32, "DigiCert Nessie2018 Log" }, |
2149 | | { (const uint8_t[]){ |
2150 | | 0xfe, 0x44, 0x61, 0x08, 0xb1, 0xd0, 0x1a, 0xb7, 0x8a, 0x62, 0xcc, |
2151 | | 0xfe, 0xab, 0x6a, 0xb2, 0xb2, 0xba, 0xbf, 0xf3, 0xab, 0xda, 0xd8, |
2152 | | 0x0a, 0x4d, 0x8b, 0x30, 0xdf, 0x2d, 0x00, 0x08, 0x83, 0x0c, |
2153 | | }, |
2154 | | 32, "DigiCert Nessie2019 Log" }, |
2155 | | { (const uint8_t[]){ |
2156 | | 0xa7, 0xce, 0x4a, 0x4e, 0x62, 0x07, 0xe0, 0xad, 0xde, 0xe5, 0xfd, |
2157 | | 0xaa, 0x4b, 0x1f, 0x86, 0x76, 0x87, 0x67, 0xb5, 0xd0, 0x02, 0xa5, |
2158 | | 0x5d, 0x47, 0x31, 0x0e, 0x7e, 0x67, 0x0a, 0x95, 0xea, 0xb2, |
2159 | | }, |
2160 | | 32, "Symantec Deneb" }, |
2161 | | { (const uint8_t[]){ |
2162 | | 0xcd, 0xb5, 0x17, 0x9b, 0x7f, 0xc1, 0xc0, 0x46, 0xfe, 0xea, 0x31, |
2163 | | 0x13, 0x6a, 0x3f, 0x8f, 0x00, 0x2e, 0x61, 0x82, 0xfa, 0xf8, 0x89, |
2164 | | 0x6f, 0xec, 0xc8, 0xb2, 0xf5, 0xb5, 0xab, 0x60, 0x49, 0x00, |
2165 | | }, |
2166 | | 32, "Certly.IO log" }, |
2167 | | { (const uint8_t[]){ |
2168 | | 0x74, 0x61, 0xb4, 0xa0, 0x9c, 0xfb, 0x3d, 0x41, 0xd7, 0x51, 0x59, |
2169 | | 0x57, 0x5b, 0x2e, 0x76, 0x49, 0xa4, 0x45, 0xa8, 0xd2, 0x77, 0x09, |
2170 | | 0xb0, 0xcc, 0x56, 0x4a, 0x64, 0x82, 0xb7, 0xeb, 0x41, 0xa3, |
2171 | | }, |
2172 | | 32, "Izenpe log" }, |
2173 | | { (const uint8_t[]){ |
2174 | | 0x89, 0x41, 0x44, 0x9c, 0x70, 0x74, 0x2e, 0x06, 0xb9, 0xfc, 0x9c, |
2175 | | 0xe7, 0xb1, 0x16, 0xba, 0x00, 0x24, 0xaa, 0x36, 0xd5, 0x9a, 0xf4, |
2176 | | 0x4f, 0x02, 0x04, 0x40, 0x4f, 0x00, 0xf7, 0xea, 0x85, 0x66, |
2177 | | }, |
2178 | | 32, "Izenpe 'Argi' log" }, |
2179 | | { (const uint8_t[]){ |
2180 | | 0x41, 0xb2, 0xdc, 0x2e, 0x89, 0xe6, 0x3c, 0xe4, 0xaf, 0x1b, 0xa7, |
2181 | | 0xbb, 0x29, 0xbf, 0x68, 0xc6, 0xde, 0xe6, 0xf9, 0xf1, 0xcc, 0x04, |
2182 | | 0x7e, 0x30, 0xdf, 0xfa, 0xe3, 0xb3, 0xba, 0x25, 0x92, 0x63, |
2183 | | }, |
2184 | | 32, "WoSign log" }, |
2185 | | { (const uint8_t[]){ |
2186 | | 0x9e, 0x4f, 0xf7, 0x3d, 0xc3, 0xce, 0x22, 0x0b, 0x69, 0x21, 0x7c, |
2187 | | 0x89, 0x9e, 0x46, 0x80, 0x76, 0xab, 0xf8, 0xd7, 0x86, 0x36, 0xd5, |
2188 | | 0xcc, 0xfc, 0x85, 0xa3, 0x1a, 0x75, 0x62, 0x8b, 0xa8, 0x8b, |
2189 | | }, |
2190 | | 32, "WoSign CT log #1" }, |
2191 | | { (const uint8_t[]){ |
2192 | | 0x63, 0xd0, 0x00, 0x60, 0x26, 0xdd, 0xe1, 0x0b, 0xb0, 0x60, 0x1f, |
2193 | | 0x45, 0x24, 0x46, 0x96, 0x5e, 0xe2, 0xb6, 0xea, 0x2c, 0xd4, 0xfb, |
2194 | | 0xc9, 0x5a, 0xc8, 0x66, 0xa5, 0x50, 0xaf, 0x90, 0x75, 0xb7, |
2195 | | }, |
2196 | | 32, "WoSign log 2" }, |
2197 | | { (const uint8_t[]){ |
2198 | | 0xac, 0x3b, 0x9a, 0xed, 0x7f, 0xa9, 0x67, 0x47, 0x57, 0x15, 0x9e, |
2199 | | 0x6d, 0x7d, 0x57, 0x56, 0x72, 0xf9, 0xd9, 0x81, 0x00, 0x94, 0x1e, |
2200 | | 0x9b, 0xde, 0xff, 0xec, 0xa1, 0x31, 0x3b, 0x75, 0x78, 0x2d, |
2201 | | }, |
2202 | | 32, "Venafi log" }, |
2203 | | { (const uint8_t[]){ |
2204 | | 0x03, 0x01, 0x9d, 0xf3, 0xfd, 0x85, 0xa6, 0x9a, 0x8e, 0xbd, 0x1f, |
2205 | | 0xac, 0xc6, 0xda, 0x9b, 0xa7, 0x3e, 0x46, 0x97, 0x74, 0xfe, 0x77, |
2206 | | 0xf5, 0x79, 0xfc, 0x5a, 0x08, 0xb8, 0x32, 0x8c, 0x1d, 0x6b, |
2207 | | }, |
2208 | | 32, "Venafi Gen2 CT log" }, |
2209 | | { (const uint8_t[]){ |
2210 | | 0xa5, 0x77, 0xac, 0x9c, 0xed, 0x75, 0x48, 0xdd, 0x8f, 0x02, 0x5b, |
2211 | | 0x67, 0xa2, 0x41, 0x08, 0x9d, 0xf8, 0x6e, 0x0f, 0x47, 0x6e, 0xc2, |
2212 | | 0x03, 0xc2, 0xec, 0xbe, 0xdb, 0x18, 0x5f, 0x28, 0x26, 0x38, |
2213 | | }, |
2214 | | 32, "CNNIC CT log" }, |
2215 | | { (const uint8_t[]){ |
2216 | | 0x34, 0xbb, 0x6a, 0xd6, 0xc3, 0xdf, 0x9c, 0x03, 0xee, 0xa8, 0xa4, |
2217 | | 0x99, 0xff, 0x78, 0x91, 0x48, 0x6c, 0x9d, 0x5e, 0x5c, 0xac, 0x92, |
2218 | | 0xd0, 0x1f, 0x7b, 0xfd, 0x1b, 0xce, 0x19, 0xdb, 0x48, 0xef, |
2219 | | }, |
2220 | | 32, "StartCom log" }, |
2221 | | { (const uint8_t[]){ |
2222 | | 0x55, 0x81, 0xd4, 0xc2, 0x16, 0x90, 0x36, 0x01, 0x4a, 0xea, 0x0b, |
2223 | | 0x9b, 0x57, 0x3c, 0x53, 0xf0, 0xc0, 0xe4, 0x38, 0x78, 0x70, 0x25, |
2224 | | 0x08, 0x17, 0x2f, 0xa3, 0xaa, 0x1d, 0x07, 0x13, 0xd3, 0x0c, |
2225 | | }, |
2226 | | 32, "Sectigo 'Sabre' CT log" }, |
2227 | | { (const uint8_t[]){ |
2228 | | 0xa2, 0xe2, 0xbf, 0xd6, 0x1e, 0xde, 0x2f, 0x2f, 0x07, 0xa0, 0xd6, |
2229 | | 0x4e, 0x6d, 0x37, 0xa7, 0xdc, 0x65, 0x43, 0xb0, 0xc6, 0xb5, 0x2e, |
2230 | | 0xa2, 0xda, 0xb7, 0x8a, 0xf8, 0x9a, 0x6d, 0xf5, 0x17, 0xd8, |
2231 | | }, |
2232 | | 32, "Sectigo 'Sabre2024h1'" }, |
2233 | | { (const uint8_t[]){ |
2234 | | 0x19, 0x98, 0x10, 0x71, 0x09, 0xf0, 0xd6, 0x52, 0x2e, 0x30, 0x80, |
2235 | | 0xd2, 0x9e, 0x3f, 0x64, 0xbb, 0x83, 0x6e, 0x28, 0xcc, 0xf9, 0x0f, |
2236 | | 0x52, 0x8e, 0xee, 0xdf, 0xce, 0x4a, 0x3f, 0x16, 0xb4, 0xca, |
2237 | | }, |
2238 | | 32, "Sectigo 'Sabre2024h2'" }, |
2239 | | { (const uint8_t[]){ |
2240 | | 0xe0, 0x92, 0xb3, 0xfc, 0x0c, 0x1d, 0xc8, 0xe7, 0x68, 0x36, 0x1f, |
2241 | | 0xde, 0x61, 0xb9, 0x96, 0x4d, 0x0a, 0x52, 0x78, 0x19, 0x8a, 0x72, |
2242 | | 0xd6, 0x72, 0xc4, 0xb0, 0x4d, 0xa5, 0x6d, 0x6f, 0x54, 0x04, |
2243 | | }, |
2244 | | 32, "Sectigo 'Sabre2025h1'" }, |
2245 | | { (const uint8_t[]){ |
2246 | | 0x1a, 0x04, 0xff, 0x49, 0xd0, 0x54, 0x1d, 0x40, 0xaf, 0xf6, 0xa0, |
2247 | | 0xc3, 0xbf, 0xf1, 0xd8, 0xc4, 0x67, 0x2f, 0x4e, 0xec, 0xee, 0x23, |
2248 | | 0x40, 0x68, 0x98, 0x6b, 0x17, 0x40, 0x2e, 0xdc, 0x89, 0x7d, |
2249 | | }, |
2250 | | 32, "Sectigo 'Sabre2025h2'" }, |
2251 | | { (const uint8_t[]){ |
2252 | | 0x6f, 0x53, 0x76, 0xac, 0x31, 0xf0, 0x31, 0x19, 0xd8, 0x99, 0x00, |
2253 | | 0xa4, 0x51, 0x15, 0xff, 0x77, 0x15, 0x1c, 0x11, 0xd9, 0x02, 0xc1, |
2254 | | 0x00, 0x29, 0x06, 0x8d, 0xb2, 0x08, 0x9a, 0x37, 0xd9, 0x13, |
2255 | | }, |
2256 | | 32, "Sectigo 'Mammoth' CT log" }, |
2257 | | { (const uint8_t[]){ |
2258 | | 0x29, 0xd0, 0x3a, 0x1b, 0xb6, 0x74, 0xaa, 0x71, 0x1c, 0xd3, 0x03, |
2259 | | 0x5b, 0x65, 0x57, 0xc1, 0x4f, 0x8a, 0xa7, 0x8b, 0x4f, 0xe8, 0x38, |
2260 | | 0x94, 0x49, 0xec, 0xa4, 0x53, 0xf9, 0x44, 0xbd, 0x24, 0x68, |
2261 | | }, |
2262 | | 32, "Sectigo 'Mammoth2024h1'" }, |
2263 | | { (const uint8_t[]){ |
2264 | | 0x50, 0x85, 0x01, 0x58, 0xdc, 0xb6, 0x05, 0x95, 0xc0, 0x0e, 0x92, |
2265 | | 0xa8, 0x11, 0x02, 0xec, 0xcd, 0xfe, 0x3f, 0x6b, 0x78, 0x58, 0x42, |
2266 | | 0x9f, 0x57, 0x98, 0x35, 0x38, 0xc9, 0xda, 0x52, 0x50, 0x63, |
2267 | | }, |
2268 | | 32, "Sectigo 'Mammoth2024h1b'" }, |
2269 | | { (const uint8_t[]){ |
2270 | | 0xdf, 0xe1, 0x56, 0xeb, 0xaa, 0x05, 0xaf, 0xb5, 0x9c, 0x0f, 0x86, |
2271 | | 0x71, 0x8d, 0xa8, 0xc0, 0x32, 0x4e, 0xae, 0x56, 0xd9, 0x6e, 0xa7, |
2272 | | 0xf5, 0xa5, 0x6a, 0x01, 0xd1, 0xc1, 0x3b, 0xbe, 0x52, 0x5c, |
2273 | | }, |
2274 | | 32, "Sectigo 'Mammoth2024h2'" }, |
2275 | | { (const uint8_t[]){ |
2276 | | 0x13, 0x4a, 0xdf, 0x1a, 0xb5, 0x98, 0x42, 0x09, 0x78, 0x0c, 0x6f, |
2277 | | 0xef, 0x4c, 0x7a, 0x91, 0xa4, 0x16, 0xb7, 0x23, 0x49, 0xce, 0x58, |
2278 | | 0x57, 0x6a, 0xdf, 0xae, 0xda, 0xa7, 0xc2, 0xab, 0xe0, 0x22, |
2279 | | }, |
2280 | | 32, "Sectigo 'Mammoth2025h1'" }, |
2281 | | { (const uint8_t[]){ |
2282 | | 0xaf, 0x18, 0x1a, 0x28, 0xd6, 0x8c, 0xa3, 0xe0, 0xa9, 0x8a, 0x4c, |
2283 | | 0x9c, 0x67, 0xab, 0x09, 0xf8, 0xbb, 0xbc, 0x22, 0xba, 0xae, 0xbc, |
2284 | | 0xb1, 0x38, 0xa3, 0xa1, 0x9d, 0xd3, 0xf9, 0xb6, 0x03, 0x0d, |
2285 | | }, |
2286 | | 32, "Sectigo 'Mammoth2025h2'" }, |
2287 | | { (const uint8_t[]){ |
2288 | | 0x25, 0x2f, 0x94, 0xc2, 0x2b, 0x29, 0xe9, 0x6e, 0x9f, 0x41, 0x1a, |
2289 | | 0x72, 0x07, 0x2b, 0x69, 0x5c, 0x5b, 0x52, 0xff, 0x97, 0xa9, 0x0d, |
2290 | | 0x25, 0x40, 0xbb, 0xfc, 0xdc, 0x51, 0xec, 0x4d, 0xee, 0x0b, |
2291 | | }, |
2292 | | 32, "Sectigo 'Mammoth2026h1'" }, |
2293 | | { (const uint8_t[]){ |
2294 | | 0x94, 0xb1, 0xc1, 0x8a, 0xb0, 0xd0, 0x57, 0xc4, 0x7b, 0xe0, 0xac, |
2295 | | 0x04, 0x0e, 0x1f, 0x2c, 0xbc, 0x8d, 0xc3, 0x75, 0x72, 0x7b, 0xc9, |
2296 | | 0x51, 0xf2, 0x0a, 0x52, 0x61, 0x26, 0x86, 0x3b, 0xa7, 0x3c, |
2297 | | }, |
2298 | | 32, "Sectigo 'Mammoth2026h2'" }, |
2299 | | { (const uint8_t[]){ |
2300 | | 0x56, 0x6c, 0xd5, 0xa3, 0x76, 0xbe, 0x83, 0xdf, 0xe3, 0x42, 0xb6, |
2301 | | 0x75, 0xc4, 0x9c, 0x23, 0x24, 0x98, 0xa7, 0x69, 0xba, 0xc3, 0x82, |
2302 | | 0xcb, 0xab, 0x49, 0xa3, 0x87, 0x7d, 0x9a, 0xb3, 0x2d, 0x01, |
2303 | | }, |
2304 | | 32, "Sectigo 'Sabre2026h1'" }, |
2305 | | { (const uint8_t[]){ |
2306 | | 0x1f, 0x56, 0xd1, 0xab, 0x94, 0x70, 0x4a, 0x41, 0xdd, 0x3f, 0xea, |
2307 | | 0xfd, 0xf4, 0x69, 0x93, 0x55, 0x30, 0x2c, 0x14, 0x31, 0xbf, 0xe6, |
2308 | | 0x13, 0x46, 0x08, 0x9f, 0xff, 0xae, 0x79, 0x5d, 0xcc, 0x2f, |
2309 | | }, |
2310 | | 32, "Sectigo 'Sabre2026h2'" }, |
2311 | | { (const uint8_t[]){ |
2312 | | 0x0d, 0x1d, 0xbc, 0x89, 0x44, 0xe9, 0xf5, 0x00, 0x55, 0x42, 0xd7, |
2313 | | 0x2d, 0x3e, 0x14, 0x4c, 0xcc, 0x43, 0x08, 0x2a, 0xb6, 0xea, 0x1e, |
2314 | | 0x94, 0xdf, 0xd7, 0x06, 0x65, 0x7d, 0x2e, 0x86, 0xf3, 0x01, |
2315 | | }, |
2316 | | 32, "Sectigo 'Elephant2025h2'" }, |
2317 | | { (const uint8_t[]){ |
2318 | | 0xd1, 0x6e, 0xa9, 0xa5, 0x68, 0x07, 0x7e, 0x66, 0x35, 0xa0, 0x3f, |
2319 | | 0x37, 0xa5, 0xdd, 0xbc, 0x03, 0xa5, 0x3c, 0x41, 0x12, 0x14, 0xd4, |
2320 | | 0x88, 0x18, 0xf5, 0xe9, 0x31, 0xb3, 0x23, 0xcb, 0x95, 0x04, |
2321 | | }, |
2322 | | 32, "Sectigo 'Elephant2026h1'" }, |
2323 | | { (const uint8_t[]){ |
2324 | | 0xaf, 0x67, 0x88, 0x3b, 0x57, 0xb0, 0x4e, 0xdd, 0x8f, 0xa6, 0xd9, |
2325 | | 0x7e, 0xf6, 0x2e, 0xa8, 0xeb, 0x81, 0x0a, 0xc7, 0x71, 0x60, 0xf0, |
2326 | | 0x24, 0x5e, 0x55, 0xd6, 0x0c, 0x2f, 0xe7, 0x85, 0x87, 0x3a, |
2327 | | }, |
2328 | | 32, "Sectigo 'Elephant2026h2'" }, |
2329 | | { (const uint8_t[]){ |
2330 | | 0x60, 0x4c, 0x9a, 0xaf, 0x7a, 0x7f, 0x77, 0x5f, 0x01, 0xd4, 0x06, |
2331 | | 0xfc, 0x92, 0x0d, 0xc8, 0x99, 0xeb, 0x0b, 0x1c, 0x7d, 0xf8, 0xc9, |
2332 | | 0x52, 0x1b, 0xfa, 0xfa, 0x17, 0x77, 0x3b, 0x97, 0x8b, 0xc9, |
2333 | | }, |
2334 | | 32, "Sectigo 'Elephant2027h1'" }, |
2335 | | { (const uint8_t[]){ |
2336 | | 0xa2, 0x49, 0x0c, 0xdc, 0xdb, 0x8e, 0x33, 0xa4, 0x00, 0x32, 0x17, |
2337 | | 0x60, 0xd6, 0xd4, 0xd5, 0x1a, 0x20, 0x36, 0x19, 0x1e, 0xa7, 0x7d, |
2338 | | 0x96, 0x8b, 0xe2, 0x6a, 0x8a, 0x00, 0xf6, 0xff, 0xff, 0xf7, |
2339 | | }, |
2340 | | 32, "Sectigo 'Elephant2027h2'" }, |
2341 | | { (const uint8_t[]){ |
2342 | | 0x5c, 0xa5, 0x77, 0xd2, 0x9b, 0x7f, 0x8b, 0xaf, 0x41, 0x9e, 0xd8, |
2343 | | 0xec, 0xab, 0xfb, 0x6d, 0xcb, 0xae, 0xc3, 0x85, 0x37, 0x02, 0xd5, |
2344 | | 0x74, 0x6f, 0x17, 0x4d, 0xad, 0x3c, 0x93, 0x4a, 0xa9, 0x6a, |
2345 | | }, |
2346 | | 32, "Sectigo 'Tiger2025h2'" }, |
2347 | | { (const uint8_t[]){ |
2348 | | 0x16, 0x83, 0x2d, 0xab, 0xf0, 0xa9, 0x25, 0x0f, 0x0f, 0xf0, 0x3a, |
2349 | | 0xa5, 0x45, 0xff, 0xc8, 0xbf, 0xc8, 0x23, 0xd0, 0x87, 0x4b, 0xf6, |
2350 | | 0x04, 0x29, 0x27, 0xf8, 0xe7, 0x1f, 0x33, 0x13, 0xf5, 0xfa, |
2351 | | }, |
2352 | | 32, "Sectigo 'Tiger2026h1'" }, |
2353 | | { (const uint8_t[]){ |
2354 | | 0xc8, 0xa3, 0xc4, 0x7f, 0xc7, 0xb3, 0xad, 0xb9, 0x35, 0x6b, 0x01, |
2355 | | 0x3f, 0x6a, 0x7a, 0x12, 0x6d, 0xe3, 0x3a, 0x4e, 0x43, 0xa5, 0xc6, |
2356 | | 0x46, 0xf9, 0x97, 0xad, 0x39, 0x75, 0x99, 0x1d, 0xcf, 0x9a, |
2357 | | }, |
2358 | | 32, "Sectigo 'Tiger2026h2'" }, |
2359 | | { (const uint8_t[]){ |
2360 | | 0x1c, 0x9f, 0x68, 0x2c, 0xe9, 0xfa, 0xf0, 0x45, 0x69, 0x50, 0xf8, |
2361 | | 0x1b, 0x96, 0x8a, 0x87, 0xdd, 0xdb, 0x32, 0x10, 0xd8, 0x4c, 0xe6, |
2362 | | 0xc8, 0xb2, 0xe3, 0x82, 0x52, 0x4a, 0xc4, 0xcf, 0x59, 0x9f, |
2363 | | }, |
2364 | | 32, "Sectigo 'Tiger2027h1'" }, |
2365 | | { (const uint8_t[]){ |
2366 | | 0x03, 0x80, 0x2a, 0xc2, 0x62, 0xf6, 0xe0, 0x5e, 0x03, 0xf8, 0xbc, |
2367 | | 0x6f, 0x7b, 0x98, 0x51, 0x32, 0x4f, 0xd7, 0x6a, 0x3d, 0xf5, 0xb7, |
2368 | | 0x59, 0x51, 0x75, 0xe2, 0x22, 0xfb, 0x8e, 0x9b, 0xd5, 0xf6, |
2369 | | }, |
2370 | | 32, "Sectigo 'Tiger2027h2'" }, |
2371 | | { (const uint8_t[]){ |
2372 | | 0xdb, 0x76, 0xfd, 0xad, 0xac, 0x65, 0xe7, 0xd0, 0x95, 0x08, 0x88, |
2373 | | 0x6e, 0x21, 0x59, 0xbd, 0x8b, 0x90, 0x35, 0x2f, 0x5f, 0xea, 0xd3, |
2374 | | 0xe3, 0xdc, 0x5e, 0x22, 0xeb, 0x35, 0x0a, 0xcc, 0x7b, 0x98, |
2375 | | }, |
2376 | | 32, "Sectigo 'Dodo' CT log" }, |
2377 | | { (const uint8_t[]){ |
2378 | | 0xe7, 0x12, 0xf2, 0xb0, 0x37, 0x7e, 0x1a, 0x62, 0xfb, 0x8e, 0xc9, |
2379 | | 0x0c, 0x61, 0x84, 0xf1, 0xea, 0x7b, 0x37, 0xcb, 0x56, 0x1d, 0x11, |
2380 | | 0x26, 0x5b, 0xf3, 0xe0, 0xf3, 0x4b, 0xf2, 0x41, 0x54, 0x6e, |
2381 | | }, |
2382 | | 32, "Let's Encrypt 'Oak2020' log" }, |
2383 | | { (const uint8_t[]){ |
2384 | | 0x94, 0x20, 0xbc, 0x1e, 0x8e, 0xd5, 0x8d, 0x6c, 0x88, 0x73, 0x1f, |
2385 | | 0x82, 0x8b, 0x22, 0x2c, 0x0d, 0xd1, 0xda, 0x4d, 0x5e, 0x6c, 0x4f, |
2386 | | 0x94, 0x3d, 0x61, 0xdb, 0x4e, 0x2f, 0x58, 0x4d, 0xa2, 0xc2, |
2387 | | }, |
2388 | | 32, "Let's Encrypt 'Oak2021' log" }, |
2389 | | { (const uint8_t[]){ |
2390 | | 0xdf, 0xa5, 0x5e, 0xab, 0x68, 0x82, 0x4f, 0x1f, 0x6c, 0xad, 0xee, |
2391 | | 0xb8, 0x5f, 0x4e, 0x3e, 0x5a, 0xea, 0xcd, 0xa2, 0x12, 0xa4, 0x6a, |
2392 | | 0x5e, 0x8e, 0x3b, 0x12, 0xc0, 0x20, 0x44, 0x5c, 0x2a, 0x73, |
2393 | | }, |
2394 | | 32, "Let's Encrypt 'Oak2022' log" }, |
2395 | | { (const uint8_t[]){ |
2396 | | 0xb7, 0x3e, 0xfb, 0x24, 0xdf, 0x9c, 0x4d, 0xba, 0x75, 0xf2, 0x39, |
2397 | | 0xc5, 0xba, 0x58, 0xf4, 0x6c, 0x5d, 0xfc, 0x42, 0xcf, 0x7a, 0x9f, |
2398 | | 0x35, 0xc4, 0x9e, 0x1d, 0x09, 0x81, 0x25, 0xed, 0xb4, 0x99, |
2399 | | }, |
2400 | | 32, "Let's Encrypt 'Oak2023' log" }, |
2401 | | { (const uint8_t[]){ |
2402 | | 0x3b, 0x53, 0x77, 0x75, 0x3e, 0x2d, 0xb9, 0x80, 0x4e, 0x8b, 0x30, |
2403 | | 0x5b, 0x06, 0xfe, 0x40, 0x3b, 0x67, 0xd8, 0x4f, 0xc3, 0xf4, 0xc7, |
2404 | | 0xbd, 0x00, 0x0d, 0x2d, 0x72, 0x6f, 0xe1, 0xfa, 0xd4, 0x17, |
2405 | | }, |
2406 | | 32, "Let's Encrypt 'Oak2024H1' log" }, |
2407 | | { (const uint8_t[]){ |
2408 | | 0x3f, 0x17, 0x4b, 0x4f, 0xd7, 0x22, 0x47, 0x58, 0x94, 0x1d, 0x65, |
2409 | | 0x1c, 0x84, 0xbe, 0x0d, 0x12, 0xed, 0x90, 0x37, 0x7f, 0x1f, 0x85, |
2410 | | 0x6a, 0xeb, 0xc1, 0xbf, 0x28, 0x85, 0xec, 0xf8, 0x64, 0x6e, |
2411 | | }, |
2412 | | 32, "Let's Encrypt 'Oak2024H2' log" }, |
2413 | | { (const uint8_t[]){ |
2414 | | 0xa2, 0xe3, 0x0a, 0xe4, 0x45, 0xef, 0xbd, 0xad, 0x9b, 0x7e, 0x38, |
2415 | | 0xed, 0x47, 0x67, 0x77, 0x53, 0xd7, 0x82, 0x5b, 0x84, 0x94, 0xd7, |
2416 | | 0x2b, 0x5e, 0x1b, 0x2c, 0xc4, 0xb9, 0x50, 0xa4, 0x47, 0xe7, |
2417 | | }, |
2418 | | 32, "Let's Encrypt 'Oak2025h1'" }, |
2419 | | { (const uint8_t[]){ |
2420 | | 0x0d, 0xe1, 0xf2, 0x30, 0x2b, 0xd3, 0x0d, 0xc1, 0x40, 0x62, 0x12, |
2421 | | 0x09, 0xea, 0x55, 0x2e, 0xfc, 0x47, 0x74, 0x7c, 0xb1, 0xd7, 0xe9, |
2422 | | 0x30, 0xef, 0x0e, 0x42, 0x1e, 0xb4, 0x7e, 0x4e, 0xaa, 0x34, |
2423 | | }, |
2424 | | 32, "Let's Encrypt 'Oak2025h2'" }, |
2425 | | { (const uint8_t[]){ |
2426 | | 0x19, 0x86, 0xd4, 0xc7, 0x28, 0xaa, 0x6f, 0xfe, 0xba, 0x03, 0x6f, |
2427 | | 0x78, 0x2a, 0x4d, 0x01, 0x91, 0xaa, 0xce, 0x2d, 0x72, 0x31, 0x0f, |
2428 | | 0xae, 0xce, 0x5d, 0x70, 0x41, 0x2d, 0x25, 0x4c, 0xc7, 0xd4, |
2429 | | }, |
2430 | | 32, "Let's Encrypt 'Oak2026h1'" }, |
2431 | | { (const uint8_t[]){ |
2432 | | 0xac, 0xab, 0x30, 0x70, 0x6c, 0xeb, 0xec, 0x84, 0x31, 0xf4, 0x13, |
2433 | | 0xd2, 0xf4, 0x91, 0x5f, 0x11, 0x1e, 0x42, 0x24, 0x43, 0xb1, 0xf2, |
2434 | | 0xa6, 0x8c, 0x4f, 0x3c, 0x2b, 0x3b, 0xa7, 0x1e, 0x02, 0xc3, |
2435 | | }, |
2436 | | 32, "Let's Encrypt 'Oak2026h2'" }, |
2437 | | { (const uint8_t[]){ |
2438 | | 0x65, 0x9b, 0x33, 0x50, 0xf4, 0x3b, 0x12, 0xcc, 0x5e, 0xa5, 0xab, |
2439 | | 0x4e, 0xc7, 0x65, 0xd3, 0xfd, 0xe6, 0xc8, 0x82, 0x43, 0x77, 0x77, |
2440 | | 0x78, 0xe7, 0x20, 0x03, 0xf9, 0xeb, 0x2b, 0x8c, 0x31, 0x29, |
2441 | | }, |
2442 | | 32, "Let's Encrypt 'Oak2019' log" }, |
2443 | | { (const uint8_t[]){ |
2444 | | 0x84, 0x9f, 0x5f, 0x7f, 0x58, 0xd2, 0xbf, 0x7b, 0x54, 0xec, 0xbd, |
2445 | | 0x74, 0x61, 0x1c, 0xea, 0x45, 0xc4, 0x9c, 0x98, 0xf1, 0xd6, 0x48, |
2446 | | 0x1b, 0xc6, 0xf6, 0x9e, 0x8c, 0x17, 0x4f, 0x24, 0xf3, 0xcf, |
2447 | | }, |
2448 | | 32, "Let's Encrypt 'Testflume2019' log" }, |
2449 | | { (const uint8_t[]){ |
2450 | | 0x23, 0x2d, 0x41, 0xa4, 0xcd, 0xac, 0x87, 0xce, 0xd9, 0xf9, 0x43, |
2451 | | 0xf4, 0x68, 0xc2, 0x82, 0x09, 0x5a, 0xe0, 0x9d, 0x30, 0xd6, 0x2e, |
2452 | | 0x2f, 0xa6, 0x5d, 0xdc, 0x3b, 0x91, 0x9c, 0x2e, 0x46, 0x8f, |
2453 | | }, |
2454 | | 32, "Let's Encrypt 'Sapling 2022h2' log" }, |
2455 | | { (const uint8_t[]){ |
2456 | | 0xc1, 0x83, 0x24, 0x0b, 0xf1, 0xa4, 0x50, 0xc7, 0x6f, 0xbb, 0x00, |
2457 | | 0x72, 0x69, 0xdc, 0xac, 0x3b, 0xe2, 0x2a, 0x48, 0x05, 0xd4, 0xdb, |
2458 | | 0xe0, 0x49, 0x66, 0xc3, 0xc8, 0xab, 0xc4, 0x47, 0xb0, 0x0c, |
2459 | | }, |
2460 | | 32, "Let's Encrypt 'Sapling 2023h1' log" }, |
2461 | | { (const uint8_t[]){ |
2462 | | 0xc6, 0x3f, 0x22, 0x18, 0xc3, 0x7d, 0x56, 0xa6, 0xaa, 0x06, 0xb5, |
2463 | | 0x96, 0xda, 0x8e, 0x53, 0xd4, 0xd7, 0x15, 0x6d, 0x1e, 0x9b, 0xac, |
2464 | | 0x8e, 0x44, 0xd2, 0x20, 0x2d, 0xe6, 0x4d, 0x69, 0xd9, 0xdc, |
2465 | | }, |
2466 | | 32, "Let's Encrypt 'Testflume2020' log" }, |
2467 | | { (const uint8_t[]){ |
2468 | | 0x03, 0xed, 0xf1, 0xda, 0x97, 0x76, 0xb6, 0xf3, 0x8c, 0x34, 0x1e, |
2469 | | 0x39, 0xed, 0x9d, 0x70, 0x7a, 0x75, 0x70, 0x36, 0x9c, 0xf9, 0x84, |
2470 | | 0x4f, 0x32, 0x7f, 0xe9, 0xe1, 0x41, 0x38, 0x36, 0x1b, 0x60, |
2471 | | }, |
2472 | | 32, "Let's Encrypt 'Testflume2021' log" }, |
2473 | | { (const uint8_t[]){ |
2474 | | 0x23, 0x27, 0xef, 0xda, 0x35, 0x25, 0x10, 0xdb, 0xc0, 0x19, 0xef, |
2475 | | 0x49, 0x1a, 0xe3, 0xff, 0x1c, 0xc5, 0xa4, 0x79, 0xbc, 0xe3, 0x78, |
2476 | | 0x78, 0x36, 0x0e, 0xe3, 0x18, 0xcf, 0xfb, 0x64, 0xf8, 0xc8, |
2477 | | }, |
2478 | | 32, "Let's Encrypt 'Testflume2022' log" }, |
2479 | | { (const uint8_t[]){ |
2480 | | 0x55, 0x34, 0xb7, 0xab, 0x5a, 0x6a, 0xc3, 0xa7, 0xcb, 0xeb, 0xa6, |
2481 | | 0x54, 0x87, 0xb2, 0xa2, 0xd7, 0x1b, 0x48, 0xf6, 0x50, 0xfa, 0x17, |
2482 | | 0xc5, 0x19, 0x7c, 0x97, 0xa0, 0xcb, 0x20, 0x76, 0xf3, 0xc6, |
2483 | | }, |
2484 | | 32, "Let's Encrypt 'Testflume2023' log" }, |
2485 | | { (const uint8_t[]){ |
2486 | | 0x29, 0x6a, 0xfa, 0x2d, 0x56, 0x8b, 0xca, 0x0d, 0x2e, 0xa8, 0x44, |
2487 | | 0x95, 0x6a, 0xe9, 0x72, 0x1f, 0xc3, 0x5f, 0xa3, 0x55, 0xec, 0xda, |
2488 | | 0x99, 0x69, 0x3a, 0xaf, 0xd4, 0x58, 0xa7, 0x1a, 0xef, 0xdd, |
2489 | | }, |
2490 | | 32, "Let's Encrypt 'Clicky' log" }, |
2491 | | { (const uint8_t[]){ |
2492 | | 0xa5, 0x95, 0x94, 0x3b, 0x53, 0x70, 0xbe, 0xe9, 0x06, 0xe0, 0x05, |
2493 | | 0x0d, 0x1f, 0xb5, 0xbb, 0xc6, 0xa4, 0x0e, 0x65, 0xf2, 0x65, 0xae, |
2494 | | 0x85, 0x2c, 0x76, 0x36, 0x3f, 0xad, 0xb2, 0x33, 0x36, 0xed, |
2495 | | }, |
2496 | | 32, "Trust Asia Log2020" }, |
2497 | | { (const uint8_t[]){ |
2498 | | 0xa8, 0xdc, 0x52, 0xf6, 0x3d, 0x6b, 0x24, 0x25, 0xe5, 0x31, 0xe3, |
2499 | | 0x7c, 0xf4, 0xe4, 0x4a, 0x71, 0x4f, 0x14, 0x2a, 0x20, 0x80, 0x3b, |
2500 | | 0x0d, 0x04, 0xd2, 0xe2, 0xee, 0x06, 0x64, 0x79, 0x4a, 0x23, |
2501 | | }, |
2502 | | 32, "Trust Asia CT2021" }, |
2503 | | { (const uint8_t[]){ |
2504 | | 0x67, 0x8d, 0xb6, 0x5b, 0x3e, 0x74, 0x43, 0xb6, 0xf3, 0xa3, 0x70, |
2505 | | 0xd5, 0xe1, 0x3a, 0xb1, 0xb4, 0x3b, 0xe0, 0xa0, 0xd3, 0x51, 0xf7, |
2506 | | 0xca, 0x74, 0x22, 0x50, 0xc7, 0xc6, 0xfa, 0x51, 0xa8, 0x8a, |
2507 | | }, |
2508 | | 32, "Trust Asia Log2021" }, |
2509 | | { (const uint8_t[]){ |
2510 | | 0xc3, 0x65, 0xf9, 0xb3, 0x65, 0x4f, 0x32, 0x83, 0xc7, 0x9d, 0xa9, |
2511 | | 0x8e, 0x93, 0xd7, 0x41, 0x8f, 0x5b, 0xab, 0x7b, 0xe3, 0x25, 0x2c, |
2512 | | 0x98, 0xe1, 0xd2, 0xf0, 0x4b, 0xb9, 0xeb, 0x42, 0x7d, 0x23, |
2513 | | }, |
2514 | | 32, "Trust Asia Log2022" }, |
2515 | | { (const uint8_t[]){ |
2516 | | 0xe8, 0x7e, 0xa7, 0x66, 0x0b, 0xc2, 0x6c, 0xf6, 0x00, 0x2e, 0xf5, |
2517 | | 0x72, 0x5d, 0x3f, 0xe0, 0xe3, 0x31, 0xb9, 0x39, 0x3b, 0xb9, 0x2f, |
2518 | | 0xbf, 0x58, 0xeb, 0x3b, 0x90, 0x49, 0xda, 0xf5, 0x43, 0x5a, |
2519 | | }, |
2520 | | 32, "Trust Asia Log2023" }, |
2521 | | { (const uint8_t[]){ |
2522 | | 0x30, 0x6d, 0x29, 0x57, 0x6a, 0xd2, 0x1a, 0x9d, 0x4a, 0xe1, 0x2a, |
2523 | | 0xca, 0xd8, 0xaa, 0x8a, 0x78, 0x3a, 0xa6, 0x5a, 0x32, 0x11, 0x60, |
2524 | | 0xac, 0xff, 0x5b, 0x0e, 0xee, 0x4c, 0xa3, 0x20, 0x1d, 0x05, |
2525 | | }, |
2526 | | 32, "Trust Asia Log2024" }, |
2527 | | { (const uint8_t[]){ |
2528 | | 0x87, 0x4f, 0xb5, 0x0d, 0xc0, 0x29, 0xd9, 0x93, 0x1d, 0xe5, 0x73, |
2529 | | 0xe9, 0xf2, 0x89, 0x9e, 0x8e, 0x45, 0x33, 0xb3, 0x92, 0xd3, 0x8b, |
2530 | | 0x0a, 0x46, 0x25, 0x74, 0xbf, 0x0f, 0xee, 0xb2, 0xfc, 0x1e, |
2531 | | }, |
2532 | | 32, "Trust Asia Log2024-2" }, |
2533 | | { (const uint8_t[]){ |
2534 | | 0x28, 0xe2, 0x81, 0x38, 0xfd, 0x83, 0x21, 0x45, 0xe9, 0xa9, 0xd6, |
2535 | | 0xaa, 0x75, 0x37, 0x6d, 0x83, 0x77, 0xa8, 0x85, 0x12, 0xb3, 0xc0, |
2536 | | 0x7f, 0x72, 0x41, 0x48, 0x21, 0xdc, 0xbd, 0xe9, 0x8c, 0x66, |
2537 | | }, |
2538 | | 32, "TrustAsia Log2025a" }, |
2539 | | { (const uint8_t[]){ |
2540 | | 0x28, 0x2c, 0x8b, 0xdd, 0x81, 0x0f, 0xf9, 0x09, 0x12, 0x0a, 0xce, |
2541 | | 0x16, 0xd6, 0xe0, 0xec, 0x20, 0x1b, 0xea, 0x82, 0xa3, 0xa4, 0xaf, |
2542 | | 0x19, 0xd9, 0xef, 0xfb, 0x59, 0xe8, 0x3f, 0xdc, 0x42, 0x68, |
2543 | | }, |
2544 | | 32, "TrustAsia Log2025b" }, |
2545 | | { (const uint8_t[]){ |
2546 | | 0x74, 0xdb, 0x9d, 0x58, 0xf7, 0xd4, 0x7e, 0x9d, 0xfd, 0x78, 0x7a, |
2547 | | 0x16, 0x2a, 0x99, 0x1c, 0x18, 0xcf, 0x69, 0x8d, 0xa7, 0xc7, 0x29, |
2548 | | 0x91, 0x8c, 0x9a, 0x18, 0xb0, 0x45, 0x0d, 0xba, 0x44, 0xbc, |
2549 | | }, |
2550 | | 32, "TrustAsia 'log2026a'" }, |
2551 | | { (const uint8_t[]){ |
2552 | | 0x25, 0xb7, 0xef, 0xde, 0xa1, 0x13, 0x01, 0x93, 0xed, 0x93, 0x07, |
2553 | | 0x97, 0x70, 0xaa, 0x32, 0x2a, 0x26, 0x62, 0x0d, 0xe3, 0x5a, 0xc8, |
2554 | | 0xaa, 0x7c, 0x75, 0x19, 0x7d, 0xe0, 0xb1, 0xa9, 0xe0, 0x65, |
2555 | | }, |
2556 | | 32, "TrustAsia 'log2026b'" }, |
2557 | | { (const uint8_t[]){ |
2558 | | 0xed, 0xda, 0xeb, 0x81, 0x5c, 0x63, 0x21, 0x34, 0x49, 0xb4, 0x7b, |
2559 | | 0xe5, 0x07, 0x79, 0x05, 0xab, 0xd0, 0xd9, 0x31, 0x47, 0xc2, 0x7a, |
2560 | | 0xc5, 0x14, 0x6b, 0x3b, 0xc5, 0x8e, 0x43, 0xe9, 0xb6, 0xc7, |
2561 | | }, |
2562 | | 32, "TrustAsia 'HETU2027'" }, |
2563 | | { (const uint8_t[]){ |
2564 | | 0x45, 0x35, 0x94, 0x98, 0xd9, 0x3a, 0x89, 0xe0, 0x28, 0x03, 0x08, |
2565 | | 0xd3, 0x7d, 0x62, 0x6d, 0xc4, 0x23, 0x75, 0x47, 0x58, 0xdc, 0xe0, |
2566 | | 0x37, 0x00, 0x36, 0xfb, 0xab, 0x0e, 0xdf, 0x8a, 0x6b, 0xcf, |
2567 | | }, |
2568 | | 32, "Trust Asia Log1" }, |
2569 | | { (const uint8_t[]){ |
2570 | | 0xc9, 0xcf, 0x89, 0x0a, 0x21, 0x10, 0x9c, 0x66, 0x6c, 0xc1, 0x7a, |
2571 | | 0x3e, 0xd0, 0x65, 0xc9, 0x30, 0xd0, 0xe0, 0x13, 0x5a, 0x9f, 0xeb, |
2572 | | 0xa8, 0x5a, 0xf1, 0x42, 0x10, 0xb8, 0x07, 0x24, 0x21, 0xaa, |
2573 | | }, |
2574 | | 32, "GDCA CT log #1" }, |
2575 | | { (const uint8_t[]){ |
2576 | | 0x92, 0x4a, 0x30, 0xf9, 0x09, 0x33, 0x6f, 0xf4, 0x35, 0xd6, 0x99, |
2577 | | 0x3a, 0x10, 0xac, 0x75, 0xa2, 0xc6, 0x41, 0x72, 0x8e, 0x7f, 0xc2, |
2578 | | 0xd6, 0x59, 0xae, 0x61, 0x88, 0xff, 0xad, 0x40, 0xce, 0x01, |
2579 | | }, |
2580 | | 32, "GDCA CT log #2" }, |
2581 | | { (const uint8_t[]){ |
2582 | | 0x71, 0x7e, 0xa7, 0x42, 0x09, 0x75, 0xbe, 0x84, 0xa2, 0x72, 0x35, |
2583 | | 0x53, 0xf1, 0x77, 0x7c, 0x26, 0xdd, 0x51, 0xaf, 0x4e, 0x10, 0x21, |
2584 | | 0x44, 0x09, 0x4d, 0x90, 0x19, 0xb4, 0x62, 0xfb, 0x66, 0x68, |
2585 | | }, |
2586 | | 32, "GDCA Log 1" }, |
2587 | | { (const uint8_t[]){ |
2588 | | 0x14, 0x30, 0x8d, 0x90, 0xcc, 0xd0, 0x30, 0x13, 0x50, 0x05, 0xc0, |
2589 | | 0x1c, 0xa5, 0x26, 0xd8, 0x1e, 0x84, 0xe8, 0x76, 0x24, 0xe3, 0x9b, |
2590 | | 0x62, 0x48, 0xe0, 0x8f, 0x72, 0x4a, 0xea, 0x3b, 0xb4, 0x2a, |
2591 | | }, |
2592 | | 32, "GDCA Log 2" }, |
2593 | | { (const uint8_t[]){ |
2594 | | 0xe0, 0x12, 0x76, 0x29, 0xe9, 0x04, 0x96, 0x56, 0x4e, 0x3d, 0x01, |
2595 | | 0x47, 0x98, 0x44, 0x98, 0xaa, 0x48, 0xf8, 0xad, 0xb1, 0x66, 0x00, |
2596 | | 0xeb, 0x79, 0x02, 0xa1, 0xef, 0x99, 0x09, 0x90, 0x62, 0x73, |
2597 | | }, |
2598 | | 32, "PuChuangSiDa CT log" }, |
2599 | | { (const uint8_t[]){ |
2600 | | 0x53, 0x7b, 0x69, 0xa3, 0x56, 0x43, 0x35, 0xa9, 0xc0, 0x49, 0x04, |
2601 | | 0xe3, 0x95, 0x93, 0xb2, 0xc2, 0x98, 0xeb, 0x8d, 0x7a, 0x6e, 0x83, |
2602 | | 0x02, 0x36, 0x35, 0xc6, 0x27, 0x24, 0x8c, 0xd6, 0xb4, 0x40, |
2603 | | }, |
2604 | | 32, "Nordu 'flimsy' log" }, |
2605 | | { (const uint8_t[]){ |
2606 | | 0xaa, 0xe7, 0x0b, 0x7f, 0x3c, 0xb8, 0xd5, 0x66, 0xc8, 0x6c, 0x2f, |
2607 | | 0x16, 0x97, 0x9c, 0x9f, 0x44, 0x5f, 0x69, 0xab, 0x0e, 0xb4, 0x53, |
2608 | | 0x55, 0x89, 0xb2, 0xf7, 0x7a, 0x03, 0x01, 0x04, 0xf3, 0xcd, |
2609 | | }, |
2610 | | 32, "Nordu 'plausible' log" }, |
2611 | | { (const uint8_t[]){ |
2612 | | 0xcf, 0x55, 0xe2, 0x89, 0x23, 0x49, 0x7c, 0x34, 0x0d, 0x52, 0x06, |
2613 | | 0xd0, 0x53, 0x53, 0xae, 0xb2, 0x58, 0x34, 0xb5, 0x2f, 0x1f, 0x8d, |
2614 | | 0xc9, 0x52, 0x68, 0x09, 0xf2, 0x12, 0xef, 0xdd, 0x7c, 0xa6, |
2615 | | }, |
2616 | | 32, "SHECA CT log 1" }, |
2617 | | { (const uint8_t[]){ |
2618 | | 0x32, 0xdc, 0x59, 0xc2, 0xd4, 0xc4, 0x19, 0x68, 0xd5, 0x6e, 0x14, |
2619 | | 0xbc, 0x61, 0xac, 0x8f, 0x0e, 0x45, 0xdb, 0x39, 0xfa, 0xf3, 0xc1, |
2620 | | 0x55, 0xaa, 0x42, 0x52, 0xf5, 0x00, 0x1f, 0xa0, 0xc6, 0x23, |
2621 | | }, |
2622 | | 32, "SHECA CT log 2" }, |
2623 | | { (const uint8_t[]){ |
2624 | | 0x96, 0x06, 0xc0, 0x2c, 0x69, 0x00, 0x33, 0xaa, 0x1d, 0x14, 0x5f, |
2625 | | 0x59, 0xc6, 0xe2, 0x64, 0x8d, 0x05, 0x49, 0xf0, 0xdf, 0x96, 0xaa, |
2626 | | 0xb8, 0xdb, 0x91, 0x5a, 0x70, 0xd8, 0xec, 0xf3, 0x90, 0xa5, |
2627 | | }, |
2628 | | 32, "Akamai CT Log" }, |
2629 | | { (const uint8_t[]){ |
2630 | | 0x39, 0x37, 0x6f, 0x54, 0x5f, 0x7b, 0x46, 0x07, 0xf5, 0x97, 0x42, |
2631 | | 0xd7, 0x68, 0xcd, 0x5d, 0x24, 0x37, 0xbf, 0x34, 0x73, 0xb6, 0x53, |
2632 | | 0x4a, 0x48, 0x34, 0xbc, 0xf7, 0x2e, 0x68, 0x1c, 0x83, 0xc9, |
2633 | | }, |
2634 | | 32, "Alpha CT Log" }, |
2635 | | { (const uint8_t[]){ |
2636 | | 0xb0, 0xb7, 0x84, 0xbc, 0x81, 0xc0, 0xdd, 0xc4, 0x75, 0x44, 0xe8, |
2637 | | 0x83, 0xf0, 0x59, 0x85, 0xbb, 0x90, 0x77, 0xd1, 0x34, 0xd8, 0xab, |
2638 | | 0x88, 0xb2, 0xb2, 0xe5, 0x33, 0x98, 0x0b, 0x8e, 0x50, 0x8b, |
2639 | | }, |
2640 | | 32, "Up In The Air 'Behind the Sofa' log" }, |
2641 | | { (const uint8_t[]){ |
2642 | | 0x47, 0x44, 0x47, 0x7c, 0x75, 0xde, 0x42, 0x6d, 0x5c, 0x44, 0xef, |
2643 | | 0xd4, 0xa9, 0x2c, 0x96, 0x77, 0x59, 0x7f, 0x65, 0x7a, 0x8f, 0xe0, |
2644 | | 0xca, 0xdb, 0xc6, 0xd6, 0x16, 0xed, 0xa4, 0x97, 0xc4, 0x25, |
2645 | | }, |
2646 | | 32, "Qihoo 360 2020" }, |
2647 | | { (const uint8_t[]){ |
2648 | | 0xc6, 0xd7, 0xed, 0x9e, 0xdb, 0x8e, 0x74, 0xf0, 0xa7, 0x1b, 0x4d, |
2649 | | 0x4a, 0x98, 0x4b, 0xcb, 0xeb, 0xab, 0xbd, 0x28, 0xcc, 0x1f, 0xd7, |
2650 | | 0x63, 0x29, 0xe8, 0x87, 0x26, 0xcd, 0x4c, 0x25, 0x46, 0x63, |
2651 | | }, |
2652 | | 32, "Qihoo 360 2021" }, |
2653 | | { (const uint8_t[]){ |
2654 | | 0x66, 0x3c, 0xb0, 0x9c, 0x1f, 0xcd, 0x9b, 0xaa, 0x62, 0x76, 0x3c, |
2655 | | 0xcb, 0x53, 0x4e, 0xec, 0x80, 0x58, 0x12, 0x28, 0x05, 0x07, 0xac, |
2656 | | 0x69, 0xa4, 0x5f, 0xcd, 0x38, 0xcf, 0x4c, 0xc7, 0x4c, 0xf1, |
2657 | | }, |
2658 | | 32, "Qihoo 360 2022" }, |
2659 | | { (const uint8_t[]){ |
2660 | | 0xe2, 0x64, 0x7f, 0x6e, 0xda, 0x34, 0x05, 0x03, 0xc6, 0x4d, 0x4e, |
2661 | | 0x10, 0xa8, 0x69, 0x68, 0x1f, 0xde, 0x9c, 0x5a, 0x2c, 0xf3, 0xb3, |
2662 | | 0x2d, 0x5f, 0x20, 0x0b, 0x96, 0x36, 0x05, 0x90, 0x88, 0x23, |
2663 | | }, |
2664 | | 32, "Qihoo 360 2023" }, |
2665 | | { (const uint8_t[]){ |
2666 | | 0xc5, 0xcf, 0xe5, 0x4b, 0x61, 0x51, 0xb4, 0x9b, 0x14, 0x2e, 0xd2, |
2667 | | 0x63, 0xbd, 0xe7, 0x32, 0x93, 0x36, 0x37, 0x99, 0x79, 0x95, 0x50, |
2668 | | 0xae, 0x44, 0x35, 0xcd, 0x1a, 0x69, 0x97, 0xc9, 0xc3, 0xc3, |
2669 | | }, |
2670 | | 32, "Qihoo 360 v1 2020" }, |
2671 | | { (const uint8_t[]){ |
2672 | | 0x48, 0x14, 0x58, 0x7c, 0xf2, 0x8b, 0x08, 0xfe, 0x68, 0x3f, 0xd2, |
2673 | | 0xbc, 0xd9, 0x45, 0x99, 0x4c, 0x2e, 0xb7, 0x4c, 0x8a, 0xe8, 0xc8, |
2674 | | 0x7f, 0xce, 0x42, 0x9b, 0x7c, 0xd3, 0x1d, 0x51, 0xbd, 0xc4, |
2675 | | }, |
2676 | | 32, "Qihoo 360 v1 2021" }, |
2677 | | { (const uint8_t[]){ |
2678 | | 0x49, 0x11, 0xb8, 0xd6, 0x14, 0xcf, 0xd3, 0xd9, 0x9f, 0x16, 0xd3, |
2679 | | 0x76, 0x54, 0x5e, 0xe1, 0xb8, 0xcc, 0xfc, 0x51, 0x1f, 0x50, 0x9f, |
2680 | | 0x08, 0x0b, 0xa0, 0xa0, 0x87, 0xd9, 0x1d, 0xfa, 0xee, 0xa9, |
2681 | | }, |
2682 | | 32, "Qihoo 360 v1 2022" }, |
2683 | | { (const uint8_t[]){ |
2684 | | 0xb6, 0x74, 0x0b, 0x12, 0x00, 0x2e, 0x03, 0x3f, 0xd0, 0xe7, 0xe9, |
2685 | | 0x41, 0xf4, 0xba, 0x3e, 0xe1, 0xbf, 0xc1, 0x49, 0xb5, 0x24, 0xb4, |
2686 | | 0xcf, 0x62, 0x8d, 0x53, 0xef, 0xea, 0x1f, 0x40, 0x3a, 0x8d, |
2687 | | }, |
2688 | | 32, "Qihoo 360 v1 2023" }, |
2689 | | { (const uint8_t[]){ |
2690 | | 0x2e, 0xd6, 0xa4, 0x4d, 0xeb, 0x8f, 0x0c, 0x86, 0x46, 0x67, 0x76, |
2691 | | 0x9c, 0x4e, 0xdd, 0x04, 0x1f, 0x84, 0x23, 0x67, 0x55, 0xfa, 0x3a, |
2692 | | 0xac, 0xa6, 0x34, 0xd0, 0x93, 0x5d, 0xfc, 0xd5, 0x9a, 0x70, |
2693 | | }, |
2694 | | 32, "Bogus placeholder log to unbreak misbehaving CT libraries" }, |
2695 | | { (const uint8_t[]){ |
2696 | | 0x39, 0xb9, 0x87, 0x88, 0x28, 0x19, 0x5f, 0x3b, 0x2d, 0x0d, 0x1b, |
2697 | | 0x48, 0x14, 0xa3, 0xae, 0x8c, 0x0d, 0x01, 0xfe, 0x48, 0x62, 0x21, |
2698 | | 0xdd, 0x69, 0x39, 0x7d, 0x76, 0xf7, 0x85, 0x74, 0x11, 0xc3, |
2699 | | }, |
2700 | | 32, "Merklemap 'CompactLog' log" }, |
2701 | | { (const uint8_t[]){ |
2702 | | 0xd2, 0xfc, 0x65, 0x2f, 0xa5, 0xf9, 0xb7, 0x38, 0xb8, 0x37, 0x55, |
2703 | | 0xfa, 0x5e, 0xb1, 0x5f, 0x0b, 0x45, 0x25, 0x3f, 0x4e, 0x8f, 0xa3, |
2704 | | 0xb9, 0xb6, 0x4f, 0xd4, 0xde, 0x56, 0x62, 0xd1, 0x87, 0x08, |
2705 | | }, |
2706 | | 32, "Bogus RFC6962 log to avoid breaking misbehaving CT libraries" }, |
2707 | | { NULL, 0, NULL } |
2708 | | }; |
2709 | | |
2710 | | /* |
2711 | | * Application-Layer Protocol Negotiation (ALPN) dissector tables. |
2712 | | */ |
2713 | | static dissector_table_t ssl_alpn_dissector_table; |
2714 | | static dissector_table_t dtls_alpn_dissector_table; |
2715 | | |
2716 | | /* |
2717 | | * Special cases for prefix matching of the ALPN, if the ALPN includes |
2718 | | * a version number for a draft or protocol revision. |
2719 | | */ |
2720 | | typedef struct ssl_alpn_prefix_match_protocol { |
2721 | | const char *proto_prefix; |
2722 | | const char *dissector_name; |
2723 | | } ssl_alpn_prefix_match_protocol_t; |
2724 | | |
2725 | | static const ssl_alpn_prefix_match_protocol_t ssl_alpn_prefix_match_protocols[] = { |
2726 | | /* SPDY moves so fast, just 1, 2 and 3 are registered with IANA but there |
2727 | | * already exists 3.1 as of this writing... match the prefix. */ |
2728 | | { "spdy/", "spdy" }, |
2729 | | /* draft-ietf-httpbis-http2-16 */ |
2730 | | { "h2-", "http2" }, /* draft versions */ |
2731 | | }; |
2732 | | |
2733 | | const value_string compress_certificate_algorithm_vals[] = { |
2734 | | { 1, "zlib" }, |
2735 | | { 2, "brotli" }, |
2736 | | { 3, "zstd" }, |
2737 | | { 0, NULL } |
2738 | | }; |
2739 | | |
2740 | | |
2741 | | const val64_string quic_transport_parameter_id[] = { |
2742 | | { SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID, "original_destination_connection_id" }, |
2743 | | { SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT, "max_idle_timeout" }, |
2744 | | { SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN, "stateless_reset_token" }, |
2745 | | { SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE, "max_udp_payload_size" }, |
2746 | | { SSL_HND_QUIC_TP_INITIAL_MAX_DATA, "initial_max_data" }, |
2747 | | { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL, "initial_max_stream_data_bidi_local" }, |
2748 | | { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE, "initial_max_stream_data_bidi_remote" }, |
2749 | | { SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI, "initial_max_stream_data_uni" }, |
2750 | | { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI, "initial_max_streams_uni" }, |
2751 | | { SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI, "initial_max_streams_bidi" }, |
2752 | | { SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT, "ack_delay_exponent" }, |
2753 | | { SSL_HND_QUIC_TP_MAX_ACK_DELAY, "max_ack_delay" }, |
2754 | | { SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION, "disable_active_migration" }, |
2755 | | { SSL_HND_QUIC_TP_PREFERRED_ADDRESS, "preferred_address" }, |
2756 | | { SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT, "active_connection_id_limit" }, |
2757 | | { SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID, "initial_source_connection_id" }, |
2758 | | { SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID, "retry_source_connection_id" }, |
2759 | | { SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE, "max_datagram_frame_size" }, |
2760 | | { SSL_HND_QUIC_TP_CIBIR_ENCODING, "cibir_encoding" }, |
2761 | | { SSL_HND_QUIC_TP_LOSS_BITS, "loss_bits" }, |
2762 | | { SSL_HND_QUIC_TP_GREASE_QUIC_BIT, "grease_quic_bit" }, |
2763 | | { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP, "enable_time_stamp" }, |
2764 | | { SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2, "enable_time_stamp_v2" }, |
2765 | | { SSL_HND_QUIC_TP_VERSION_INFORMATION, "version_information" }, |
2766 | | { SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT, "version_information_draft" }, |
2767 | | { SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD, "min_ack_delay" }, |
2768 | | { SSL_HND_QUIC_TP_GOOGLE_USER_AGENT, "google_user_agent" }, |
2769 | | { SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED, "google_key_update_not_yet_supported" }, |
2770 | | { SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION, "google_quic_version" }, |
2771 | | { SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT, "google_initial_rtt" }, |
2772 | | { SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE, "google_support_handshake_done" }, |
2773 | | { SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS, "google_quic_params" }, |
2774 | | { SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS, "google_connection_options" }, |
2775 | | { SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY, "facebook_partial_reliability" }, |
2776 | | { SSL_HND_QUIC_TP_ADDRESS_DISCOVERY, "address_discovery" }, |
2777 | | { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1, "min_ack_delay (draft-01)" }, |
2778 | | { SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05, "min_ack_delay (draft-05)" }, |
2779 | | { SSL_HND_QUIC_TP_MIN_ACK_DELAY, "min_ack_delay" }, |
2780 | | { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04, "enable_multipath (draft-04)" }, |
2781 | | { SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05, "enable_multipath (draft-05)" }, |
2782 | | { SSL_HND_QUIC_TP_ENABLE_MULTIPATH, "enable_multipath (draft-06)" }, |
2783 | | { SSL_HND_QUIC_TP_INITIAL_MAX_PATHS, "initial_max_paths (draft-07/08)" }, |
2784 | | { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT09, "initial_max_path_id (draft-09/10)" }, |
2785 | | { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT11, "initial_max_path_id (draft-11)" }, |
2786 | | { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT12, "initial_max_path_id (draft-12)" }, |
2787 | | { SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID, "initial_max_path_id" }, |
2788 | | { 0, NULL } |
2789 | | }; |
2790 | | |
2791 | | /* https://tools.ietf.org/html/draft-ietf-quic-address-discovery-00 */ |
2792 | | const val64_string quic_address_discovery_vals[] = { |
2793 | | { 0, "The node is willing to provide address observations to its peer, but is not interested in receiving address observations itself" }, |
2794 | | { 1, "The node is interested in receiving address observations, but it is not willing to provide address observations" }, |
2795 | | { 2, "The node is interested in receiving address observations, and it is willing to provide address observations" }, |
2796 | | { 0, NULL } |
2797 | | }; |
2798 | | |
2799 | | /* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */ |
2800 | | const val64_string quic_enable_time_stamp_v2_vals[] = { |
2801 | | { 1, "I would like to receive TIME_STAMP frames" }, |
2802 | | { 2, "I am able to generate TIME_STAMP frames" }, |
2803 | | { 3, "I am able to generate TIME_STAMP frames and I would like to receive them" }, |
2804 | | { 0, NULL } |
2805 | | }; |
2806 | | |
2807 | | /* https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/04/ */ |
2808 | | const val64_string quic_enable_multipath_vals[] = { |
2809 | | { 0, "don't support multipath" }, |
2810 | | { 1, "support multipath as defined in this document" }, |
2811 | | { 0, NULL } |
2812 | | }; |
2813 | | |
2814 | | /* https://www.ietf.org/archive/id/draft-ietf-tls-esni-16.txt */ |
2815 | | const value_string tls_hello_ext_ech_clienthello_types[] = { |
2816 | | { 0, "Outer Client Hello" }, |
2817 | | { 1, "Inner Client Hello" }, |
2818 | | { 0, NULL } |
2819 | | }; |
2820 | | |
2821 | | /* RFC 9180 */ |
2822 | | const value_string kem_id_type_vals[] = { |
2823 | | { 0x0000, "Reserved" }, |
2824 | | { 0x0010, "DHKEM(P-256, HKDF-SHA256)" }, |
2825 | | { 0x0011, "DHKEM(P-384, HKDF-SHA384)" }, |
2826 | | { 0x0012, "DHKEM(P-521, HKDF-SHA512)" }, |
2827 | | { 0x0020, "DHKEM(X25519, HKDF-SHA256)" }, |
2828 | | { 0x0021, "DHKEM(X448, HKDF-SHA512)" }, |
2829 | | { 0, NULL } |
2830 | | }; |
2831 | | const value_string kdf_id_type_vals[] = { |
2832 | | { 0x0000, "Reserved" }, |
2833 | | { 0x0001, "HKDF-SHA256" }, |
2834 | | { 0x0002, "HKDF-SHA384" }, |
2835 | | { 0x0003, "HKDF-SHA512" }, |
2836 | | { 0, NULL } |
2837 | | }; |
2838 | | const value_string aead_id_type_vals[] = { |
2839 | | { 0x0000, "Reserved" }, |
2840 | | { 0x0001, "AES-128-GCM" }, |
2841 | | { 0x0002, "AES-256-GCM" }, |
2842 | | { 0x0003, "ChaCha20Poly1305" }, |
2843 | | { 0xFFFF, "Export-only" }, |
2844 | | { 0, NULL } |
2845 | | }; |
2846 | | |
2847 | | const value_string token_binding_key_parameter_vals[] = { |
2848 | | { 0, "rsa2048_pkcs1.5" }, |
2849 | | { 1, "rsa2048_pss" }, |
2850 | | { 2, "ecdsap256" }, |
2851 | | { 0, NULL } |
2852 | | }; |
2853 | | |
2854 | | /* Lookup tables }}} */ |
2855 | | |
2856 | | void |
2857 | | quic_transport_parameter_id_base_custom(char *result, uint64_t parameter_id) |
2858 | 0 | { |
2859 | 0 | const char *label; |
2860 | 0 | if (IS_GREASE_QUIC(parameter_id)) { |
2861 | 0 | label = "GREASE"; |
2862 | 0 | } else { |
2863 | 0 | label = val64_to_str_const(parameter_id, quic_transport_parameter_id, "Unknown"); |
2864 | 0 | } |
2865 | 0 | snprintf(result, ITEM_LABEL_LENGTH, "%s (0x%02" PRIx64 ")", label, parameter_id); |
2866 | 0 | } |
2867 | | |
2868 | | /* we keep this internal to packet-tls-utils, as there should be |
2869 | | no need to access it any other way. |
2870 | | |
2871 | | This also allows us to hide the dependency on zlib. |
2872 | | */ |
2873 | | struct _SslDecompress { |
2874 | | int compression; |
2875 | | #ifdef USE_ZLIB_OR_ZLIBNG |
2876 | | zlib_stream istream; |
2877 | | #endif |
2878 | | }; |
2879 | | |
2880 | | /* To assist in parsing client/server key exchange messages |
2881 | | 0 indicates unknown */ |
2882 | | int ssl_get_keyex_alg(int cipher) |
2883 | 3 | { |
2884 | | /* Map Cipher suite number to Key Exchange algorithm {{{ */ |
2885 | 3 | switch(cipher) { |
2886 | 0 | case 0x0017: |
2887 | 0 | case 0x0018: |
2888 | 0 | case 0x0019: |
2889 | 0 | case 0x001a: |
2890 | 0 | case 0x001b: |
2891 | 0 | case 0x0034: |
2892 | 0 | case 0x003a: |
2893 | 0 | case 0x0046: |
2894 | 0 | case 0x006c: |
2895 | 0 | case 0x006d: |
2896 | 0 | case 0x0089: |
2897 | 0 | case 0x009b: |
2898 | 0 | case 0x00a6: |
2899 | 0 | case 0x00a7: |
2900 | 0 | case 0x00bf: |
2901 | 0 | case 0x00c5: |
2902 | 0 | case 0xc084: |
2903 | 0 | case 0xc085: |
2904 | 0 | return KEX_DH_ANON; |
2905 | 0 | case 0x000b: |
2906 | 0 | case 0x000c: |
2907 | 0 | case 0x000d: |
2908 | 0 | case 0x0030: |
2909 | 0 | case 0x0036: |
2910 | 0 | case 0x003e: |
2911 | 0 | case 0x0042: |
2912 | 0 | case 0x0068: |
2913 | 0 | case 0x0085: |
2914 | 0 | case 0x0097: |
2915 | 0 | case 0x00a4: |
2916 | 0 | case 0x00a5: |
2917 | 0 | case 0x00bb: |
2918 | 0 | case 0x00c1: |
2919 | 0 | case 0xc082: |
2920 | 0 | case 0xc083: |
2921 | 0 | return KEX_DH_DSS; |
2922 | 0 | case 0x000e: |
2923 | 0 | case 0x000f: |
2924 | 0 | case 0x0010: |
2925 | 0 | case 0x0031: |
2926 | 0 | case 0x0037: |
2927 | 0 | case 0x003f: |
2928 | 0 | case 0x0043: |
2929 | 0 | case 0x0069: |
2930 | 0 | case 0x0086: |
2931 | 0 | case 0x0098: |
2932 | 0 | case 0x00a0: |
2933 | 0 | case 0x00a1: |
2934 | 0 | case 0x00bc: |
2935 | 0 | case 0x00c2: |
2936 | 0 | case 0xc07e: |
2937 | 0 | case 0xc07f: |
2938 | 0 | return KEX_DH_RSA; |
2939 | 0 | case 0x0011: |
2940 | 0 | case 0x0012: |
2941 | 0 | case 0x0013: |
2942 | 0 | case 0x0032: |
2943 | 0 | case 0x0038: |
2944 | 0 | case 0x0040: |
2945 | 0 | case 0x0044: |
2946 | 0 | case 0x0063: |
2947 | 0 | case 0x0065: |
2948 | 0 | case 0x0066: |
2949 | 0 | case 0x006a: |
2950 | 0 | case 0x0087: |
2951 | 0 | case 0x0099: |
2952 | 0 | case 0x00a2: |
2953 | 0 | case 0x00a3: |
2954 | 0 | case 0x00bd: |
2955 | 0 | case 0x00c3: |
2956 | 0 | case 0xc080: |
2957 | 0 | case 0xc081: |
2958 | 0 | return KEX_DHE_DSS; |
2959 | 0 | case 0x002d: |
2960 | 0 | case 0x008e: |
2961 | 0 | case 0x008f: |
2962 | 0 | case 0x0090: |
2963 | 0 | case 0x0091: |
2964 | 0 | case 0x00aa: |
2965 | 0 | case 0x00ab: |
2966 | 0 | case 0x00b2: |
2967 | 0 | case 0x00b3: |
2968 | 0 | case 0x00b4: |
2969 | 0 | case 0x00b5: |
2970 | 0 | case 0xc090: |
2971 | 0 | case 0xc091: |
2972 | 0 | case 0xc096: |
2973 | 0 | case 0xc097: |
2974 | 0 | case 0xc0a6: |
2975 | 0 | case 0xc0a7: |
2976 | 0 | case 0xc0aa: |
2977 | 0 | case 0xc0ab: |
2978 | 0 | case 0xccad: |
2979 | 0 | case 0xe41c: |
2980 | 0 | case 0xe41d: |
2981 | 0 | return KEX_DHE_PSK; |
2982 | 0 | case 0x0014: |
2983 | 0 | case 0x0015: |
2984 | 0 | case 0x0016: |
2985 | 0 | case 0x0033: |
2986 | 0 | case 0x0039: |
2987 | 0 | case 0x0045: |
2988 | 0 | case 0x0067: |
2989 | 0 | case 0x006b: |
2990 | 0 | case 0x0088: |
2991 | 0 | case 0x009a: |
2992 | 0 | case 0x009e: |
2993 | 0 | case 0x009f: |
2994 | 0 | case 0x00be: |
2995 | 0 | case 0x00c4: |
2996 | 0 | case 0xc07c: |
2997 | 0 | case 0xc07d: |
2998 | 0 | case 0xc09e: |
2999 | 0 | case 0xc09f: |
3000 | 0 | case 0xc0a2: |
3001 | 0 | case 0xc0a3: |
3002 | 0 | case 0xccaa: |
3003 | 0 | case 0xe41e: |
3004 | 0 | case 0xe41f: |
3005 | 0 | return KEX_DHE_RSA; |
3006 | 0 | case 0xc015: |
3007 | 0 | case 0xc016: |
3008 | 0 | case 0xc017: |
3009 | 0 | case 0xc018: |
3010 | 0 | case 0xc019: |
3011 | 0 | return KEX_ECDH_ANON; |
3012 | 0 | case 0xc001: |
3013 | 0 | case 0xc002: |
3014 | 0 | case 0xc003: |
3015 | 0 | case 0xc004: |
3016 | 0 | case 0xc005: |
3017 | 0 | case 0xc025: |
3018 | 0 | case 0xc026: |
3019 | 0 | case 0xc02d: |
3020 | 0 | case 0xc02e: |
3021 | 0 | case 0xc074: |
3022 | 0 | case 0xc075: |
3023 | 0 | case 0xc088: |
3024 | 0 | case 0xc089: |
3025 | 0 | return KEX_ECDH_ECDSA; |
3026 | 0 | case 0xc00b: |
3027 | 0 | case 0xc00c: |
3028 | 0 | case 0xc00d: |
3029 | 0 | case 0xc00e: |
3030 | 0 | case 0xc00f: |
3031 | 0 | case 0xc029: |
3032 | 0 | case 0xc02a: |
3033 | 0 | case 0xc031: |
3034 | 0 | case 0xc032: |
3035 | 0 | case 0xc078: |
3036 | 0 | case 0xc079: |
3037 | 0 | case 0xc08c: |
3038 | 0 | case 0xc08d: |
3039 | 0 | return KEX_ECDH_RSA; |
3040 | 0 | case 0xc006: |
3041 | 0 | case 0xc007: |
3042 | 0 | case 0xc008: |
3043 | 0 | case 0xc009: |
3044 | 0 | case 0xc00a: |
3045 | 0 | case 0xc023: |
3046 | 0 | case 0xc024: |
3047 | 0 | case 0xc02b: |
3048 | 0 | case 0xc02c: |
3049 | 0 | case 0xc072: |
3050 | 0 | case 0xc073: |
3051 | 0 | case 0xc086: |
3052 | 0 | case 0xc087: |
3053 | 0 | case 0xc0ac: |
3054 | 0 | case 0xc0ad: |
3055 | 0 | case 0xc0ae: |
3056 | 0 | case 0xc0af: |
3057 | 0 | case 0xcca9: |
3058 | 0 | case 0xe414: |
3059 | 0 | case 0xe415: |
3060 | 0 | return KEX_ECDHE_ECDSA; |
3061 | 0 | case 0xc033: |
3062 | 0 | case 0xc034: |
3063 | 0 | case 0xc035: |
3064 | 0 | case 0xc036: |
3065 | 0 | case 0xc037: |
3066 | 0 | case 0xc038: |
3067 | 0 | case 0xc039: |
3068 | 0 | case 0xc03a: |
3069 | 0 | case 0xc03b: |
3070 | 0 | case 0xc09a: |
3071 | 0 | case 0xc09b: |
3072 | 0 | case 0xccac: |
3073 | 0 | case 0xe418: |
3074 | 0 | case 0xe419: |
3075 | 0 | case 0xd001: |
3076 | 0 | case 0xd002: |
3077 | 0 | case 0xd003: |
3078 | 0 | case 0xd005: |
3079 | 0 | return KEX_ECDHE_PSK; |
3080 | 0 | case 0xc010: |
3081 | 0 | case 0xc011: |
3082 | 0 | case 0xc012: |
3083 | 0 | case 0xc013: |
3084 | 0 | case 0xc014: |
3085 | 0 | case 0xc027: |
3086 | 0 | case 0xc028: |
3087 | 0 | case 0xc02f: |
3088 | 0 | case 0xc030: |
3089 | 0 | case 0xc076: |
3090 | 0 | case 0xc077: |
3091 | 0 | case 0xc08a: |
3092 | 0 | case 0xc08b: |
3093 | 0 | case 0xcca8: |
3094 | 0 | case 0xe412: |
3095 | 0 | case 0xe413: |
3096 | 0 | return KEX_ECDHE_RSA; |
3097 | 0 | case 0x001e: |
3098 | 0 | case 0x001f: |
3099 | 0 | case 0x0020: |
3100 | 0 | case 0x0021: |
3101 | 0 | case 0x0022: |
3102 | 0 | case 0x0023: |
3103 | 0 | case 0x0024: |
3104 | 0 | case 0x0025: |
3105 | 0 | case 0x0026: |
3106 | 0 | case 0x0027: |
3107 | 0 | case 0x0028: |
3108 | 0 | case 0x0029: |
3109 | 0 | case 0x002a: |
3110 | 0 | case 0x002b: |
3111 | 0 | return KEX_KRB5; |
3112 | 0 | case 0x002c: |
3113 | 0 | case 0x008a: |
3114 | 0 | case 0x008b: |
3115 | 0 | case 0x008c: |
3116 | 0 | case 0x008d: |
3117 | 0 | case 0x00a8: |
3118 | 0 | case 0x00a9: |
3119 | 0 | case 0x00ae: |
3120 | 0 | case 0x00af: |
3121 | 0 | case 0x00b0: |
3122 | 0 | case 0x00b1: |
3123 | 0 | case 0xc064: |
3124 | 0 | case 0xc065: |
3125 | 0 | case 0xc08e: |
3126 | 0 | case 0xc08f: |
3127 | 0 | case 0xc094: |
3128 | 0 | case 0xc095: |
3129 | 0 | case 0xc0a4: |
3130 | 0 | case 0xc0a5: |
3131 | 0 | case 0xc0a8: |
3132 | 0 | case 0xc0a9: |
3133 | 0 | case 0xccab: |
3134 | 0 | case 0xe416: |
3135 | 0 | case 0xe417: |
3136 | 0 | return KEX_PSK; |
3137 | 0 | case 0x0001: |
3138 | 0 | case 0x0002: |
3139 | 0 | case 0x0003: |
3140 | 0 | case 0x0004: |
3141 | 0 | case 0x0005: |
3142 | 0 | case 0x0006: |
3143 | 0 | case 0x0007: |
3144 | 0 | case 0x0008: |
3145 | 0 | case 0x0009: |
3146 | 0 | case 0x000a: |
3147 | 0 | case 0x002f: |
3148 | 0 | case 0x0035: |
3149 | 0 | case 0x003b: |
3150 | 0 | case 0x003c: |
3151 | 0 | case 0x003d: |
3152 | 0 | case 0x0041: |
3153 | 0 | case 0x0060: |
3154 | 0 | case 0x0061: |
3155 | 0 | case 0x0062: |
3156 | 0 | case 0x0064: |
3157 | 0 | case 0x0084: |
3158 | 0 | case 0x0096: |
3159 | 0 | case 0x009c: |
3160 | 0 | case 0x009d: |
3161 | 0 | case 0x00ba: |
3162 | 0 | case 0x00c0: |
3163 | 0 | case 0xc07a: |
3164 | 0 | case 0xc07b: |
3165 | 0 | case 0xc09c: |
3166 | 0 | case 0xc09d: |
3167 | 0 | case 0xc0a0: |
3168 | 0 | case 0xc0a1: |
3169 | 0 | case 0xe410: |
3170 | 0 | case 0xe411: |
3171 | 0 | case 0xfefe: |
3172 | 0 | case 0xfeff: |
3173 | 0 | case 0xffe0: |
3174 | 0 | case 0xffe1: |
3175 | 0 | return KEX_RSA; |
3176 | 0 | case 0x002e: |
3177 | 0 | case 0x0092: |
3178 | 0 | case 0x0093: |
3179 | 0 | case 0x0094: |
3180 | 0 | case 0x0095: |
3181 | 0 | case 0x00ac: |
3182 | 0 | case 0x00ad: |
3183 | 0 | case 0x00b6: |
3184 | 0 | case 0x00b7: |
3185 | 0 | case 0x00b8: |
3186 | 0 | case 0x00b9: |
3187 | 0 | case 0xc092: |
3188 | 0 | case 0xc093: |
3189 | 0 | case 0xc098: |
3190 | 0 | case 0xc099: |
3191 | 0 | case 0xccae: |
3192 | 0 | case 0xe41a: |
3193 | 0 | case 0xe41b: |
3194 | 0 | return KEX_RSA_PSK; |
3195 | 0 | case 0xc01a: |
3196 | 0 | case 0xc01d: |
3197 | 0 | case 0xc020: |
3198 | 0 | return KEX_SRP_SHA; |
3199 | 0 | case 0xc01c: |
3200 | 0 | case 0xc01f: |
3201 | 0 | case 0xc022: |
3202 | 0 | return KEX_SRP_SHA_DSS; |
3203 | 0 | case 0xc01b: |
3204 | 0 | case 0xc01e: |
3205 | 0 | case 0xc021: |
3206 | 0 | return KEX_SRP_SHA_RSA; |
3207 | 0 | case 0xc0ff: |
3208 | 0 | return KEX_ECJPAKE; |
3209 | 0 | case 0xe003: |
3210 | 0 | case 0xe013: |
3211 | 0 | case 0xe053: |
3212 | 0 | return KEX_ECC_SM2; |
3213 | 3 | default: |
3214 | 3 | break; |
3215 | 3 | } |
3216 | | |
3217 | 3 | return 0; |
3218 | | /* }}} */ |
3219 | 3 | } |
3220 | | |
3221 | | static wmem_list_t *connection_id_session_list; |
3222 | | |
3223 | | void |
3224 | 14 | ssl_init_cid_list(void) { |
3225 | 14 | connection_id_session_list = wmem_list_new(wmem_file_scope()); |
3226 | 14 | } |
3227 | | |
3228 | | void |
3229 | 0 | ssl_cleanup_cid_list(void) { |
3230 | 0 | wmem_destroy_list(connection_id_session_list); |
3231 | 0 | } |
3232 | | |
3233 | | void |
3234 | | ssl_add_session_by_cid(SslDecryptSession *session) |
3235 | 1 | { |
3236 | 1 | wmem_list_append(connection_id_session_list, session); |
3237 | 1 | } |
3238 | | |
3239 | | SslDecryptSession * |
3240 | | ssl_get_session_by_cid(tvbuff_t *tvb, uint32_t offset) |
3241 | 80 | { |
3242 | 80 | SslDecryptSession * ssl_cid = NULL; |
3243 | 80 | wmem_list_frame_t *it = wmem_list_head(connection_id_session_list); |
3244 | | |
3245 | 130 | while (it != NULL && ssl_cid == NULL) { |
3246 | 50 | SslDecryptSession * ssl = (SslDecryptSession *)wmem_list_frame_data(it); |
3247 | 50 | DISSECTOR_ASSERT(ssl != NULL); |
3248 | 50 | SslSession *session = &ssl->session; |
3249 | | |
3250 | 50 | if (session->client_cid_len > 0 && tvb_bytes_exist(tvb, offset, session->client_cid_len)) { |
3251 | 50 | if (tvb_memeql(tvb, offset, session->client_cid, session->client_cid_len) == 0) { |
3252 | 1 | ssl_cid = ssl; |
3253 | 1 | } |
3254 | 50 | } |
3255 | | |
3256 | 50 | if (session->server_cid_len > 0) { |
3257 | 0 | if (tvb_memeql(tvb, offset, session->server_cid, session->server_cid_len) == 0) { |
3258 | 0 | ssl_cid = ssl; |
3259 | 0 | } |
3260 | 0 | } |
3261 | | |
3262 | 50 | it = wmem_list_frame_next(it); |
3263 | 50 | } |
3264 | | |
3265 | 80 | return ssl_cid; |
3266 | 80 | } |
3267 | | |
3268 | | /* StringInfo structure (len + data) functions {{{ */ |
3269 | | |
3270 | | int |
3271 | | ssl_data_alloc(StringInfo* str, size_t len) |
3272 | 56 | { |
3273 | 56 | str->data = (unsigned char *)g_malloc(len); |
3274 | | /* the allocator can return a null pointer for a size equal to 0, |
3275 | | * and that must be allowed */ |
3276 | 56 | if (len > 0 && !str->data) |
3277 | 0 | return -1; |
3278 | 56 | str->data_len = (unsigned) len; |
3279 | 56 | return 0; |
3280 | 56 | } |
3281 | | |
3282 | | void |
3283 | | ssl_data_set(StringInfo* str, const unsigned char* data, unsigned len) |
3284 | 91 | { |
3285 | 91 | DISSECTOR_ASSERT(data); |
3286 | 91 | memcpy(str->data, data, len); |
3287 | 91 | str->data_len = len; |
3288 | 91 | } |
3289 | | |
3290 | | static int |
3291 | | ssl_data_realloc(StringInfo* str, unsigned len) |
3292 | 0 | { |
3293 | 0 | str->data = (unsigned char *)g_realloc(str->data, len); |
3294 | 0 | if (!str->data) |
3295 | 0 | return -1; |
3296 | 0 | str->data_len = len; |
3297 | 0 | return 0; |
3298 | 0 | } |
3299 | | |
3300 | | static StringInfo * |
3301 | | ssl_data_clone(StringInfo *str) |
3302 | 68 | { |
3303 | 68 | StringInfo *cloned_str; |
3304 | 68 | cloned_str = (StringInfo *) wmem_alloc0(wmem_file_scope(), |
3305 | 68 | sizeof(StringInfo) + str->data_len); |
3306 | 68 | cloned_str->data = (unsigned char *) (cloned_str + 1); |
3307 | 68 | ssl_data_set(cloned_str, str->data, str->data_len); |
3308 | 68 | return cloned_str; |
3309 | 68 | } |
3310 | | |
3311 | | static int |
3312 | | ssl_data_copy(StringInfo* dst, StringInfo* src) |
3313 | 0 | { |
3314 | 0 | if (dst->data_len < src->data_len) { |
3315 | 0 | if (ssl_data_realloc(dst, src->data_len)) |
3316 | 0 | return -1; |
3317 | 0 | } |
3318 | 0 | memcpy(dst->data, src->data, src->data_len); |
3319 | 0 | dst->data_len = src->data_len; |
3320 | 0 | return 0; |
3321 | 0 | } |
3322 | | |
3323 | | /* from_hex converts |hex_len| bytes of hex data from |in| and sets |*out| to |
3324 | | * the result. |out->data| will be allocated using wmem_file_scope. Returns true on |
3325 | | * success. */ |
3326 | 0 | static bool from_hex(StringInfo* out, const char* in, size_t hex_len) { |
3327 | 0 | size_t i; |
3328 | |
|
3329 | 0 | if (hex_len & 1) |
3330 | 0 | return false; |
3331 | | |
3332 | 0 | out->data = (unsigned char *)wmem_alloc(wmem_file_scope(), hex_len / 2); |
3333 | 0 | for (i = 0; i < hex_len / 2; i++) { |
3334 | 0 | int a = ws_xton(in[i*2]); |
3335 | 0 | int b = ws_xton(in[i*2 + 1]); |
3336 | 0 | if (a == -1 || b == -1) |
3337 | 0 | return false; |
3338 | 0 | out->data[i] = a << 4 | b; |
3339 | 0 | } |
3340 | 0 | out->data_len = (unsigned)hex_len / 2; |
3341 | 0 | return true; |
3342 | 0 | } |
3343 | | /* StringInfo structure (len + data) functions }}} */ |
3344 | | |
3345 | | |
3346 | | /* libgcrypt wrappers for HMAC/message digest operations {{{ */ |
3347 | | /* hmac abstraction layer */ |
3348 | 0 | #define SSL_HMAC gcry_md_hd_t |
3349 | | |
3350 | | static inline int |
3351 | | ssl_hmac_init(SSL_HMAC* md, int algo) |
3352 | 0 | { |
3353 | 0 | gcry_error_t err; |
3354 | 0 | const char *err_str, *err_src; |
3355 | |
|
3356 | 0 | err = gcry_md_open(md,algo, GCRY_MD_FLAG_HMAC); |
3357 | 0 | if (err != 0) { |
3358 | 0 | err_str = gcry_strerror(err); |
3359 | 0 | err_src = gcry_strsource(err); |
3360 | 0 | ssl_debug_printf("ssl_hmac_init(): gcry_md_open failed %s/%s", err_str, err_src); |
3361 | 0 | return -1; |
3362 | 0 | } |
3363 | 0 | return 0; |
3364 | 0 | } |
3365 | | |
3366 | | static inline int |
3367 | | ssl_hmac_setkey(SSL_HMAC* md, const void * key, int len) |
3368 | 0 | { |
3369 | 0 | gcry_error_t err; |
3370 | 0 | const char *err_str, *err_src; |
3371 | |
|
3372 | 0 | err = gcry_md_setkey (*(md), key, len); |
3373 | 0 | if (err != 0) { |
3374 | 0 | err_str = gcry_strerror(err); |
3375 | 0 | err_src = gcry_strsource(err); |
3376 | 0 | ssl_debug_printf("ssl_hmac_setkey(): gcry_md_setkey failed %s/%s", err_str, err_src); |
3377 | 0 | return -1; |
3378 | 0 | } |
3379 | 0 | return 0; |
3380 | 0 | } |
3381 | | |
3382 | | static inline int |
3383 | | ssl_hmac_reset(SSL_HMAC* md) |
3384 | 0 | { |
3385 | 0 | gcry_md_reset(*md); |
3386 | 0 | return 0; |
3387 | 0 | } |
3388 | | |
3389 | | static inline void |
3390 | | ssl_hmac_update(SSL_HMAC* md, const void* data, int len) |
3391 | 0 | { |
3392 | 0 | gcry_md_write(*(md), data, len); |
3393 | 0 | } |
3394 | | static inline void |
3395 | | ssl_hmac_final(SSL_HMAC* md, unsigned char* data, unsigned* datalen) |
3396 | 0 | { |
3397 | 0 | int algo; |
3398 | 0 | unsigned len; |
3399 | |
|
3400 | 0 | algo = gcry_md_get_algo (*(md)); |
3401 | 0 | len = gcry_md_get_algo_dlen(algo); |
3402 | 0 | DISSECTOR_ASSERT(len <= *datalen); |
3403 | 0 | memcpy(data, gcry_md_read(*(md), algo), len); |
3404 | 0 | *datalen = len; |
3405 | 0 | } |
3406 | | static inline void |
3407 | | ssl_hmac_cleanup(SSL_HMAC* md) |
3408 | 0 | { |
3409 | 0 | gcry_md_close(*(md)); |
3410 | 0 | } |
3411 | | |
3412 | | /* message digest abstraction layer*/ |
3413 | 0 | #define SSL_MD gcry_md_hd_t |
3414 | | |
3415 | | static inline int |
3416 | | ssl_md_init(SSL_MD* md, int algo) |
3417 | 0 | { |
3418 | 0 | gcry_error_t err; |
3419 | 0 | const char *err_str, *err_src; |
3420 | 0 | err = gcry_md_open(md,algo, 0); |
3421 | 0 | if (err != 0) { |
3422 | 0 | err_str = gcry_strerror(err); |
3423 | 0 | err_src = gcry_strsource(err); |
3424 | 0 | ssl_debug_printf("ssl_md_init(): gcry_md_open failed %s/%s", err_str, err_src); |
3425 | 0 | return -1; |
3426 | 0 | } |
3427 | 0 | return 0; |
3428 | 0 | } |
3429 | | static inline void |
3430 | | ssl_md_update(SSL_MD* md, const unsigned char* data, int len) |
3431 | 0 | { |
3432 | 0 | gcry_md_write(*(md), data, len); |
3433 | 0 | } |
3434 | | static inline void |
3435 | | ssl_md_final(SSL_MD* md, unsigned char* data, unsigned* datalen) |
3436 | 0 | { |
3437 | 0 | int algo; |
3438 | 0 | int len; |
3439 | 0 | algo = gcry_md_get_algo (*(md)); |
3440 | 0 | len = gcry_md_get_algo_dlen (algo); |
3441 | 0 | memcpy(data, gcry_md_read(*(md), algo), len); |
3442 | 0 | *datalen = len; |
3443 | 0 | } |
3444 | | static inline void |
3445 | | ssl_md_cleanup(SSL_MD* md) |
3446 | 0 | { |
3447 | 0 | gcry_md_close(*(md)); |
3448 | 0 | } |
3449 | | |
3450 | | static inline void |
3451 | | ssl_md_reset(SSL_MD* md) |
3452 | 0 | { |
3453 | 0 | gcry_md_reset(*md); |
3454 | 0 | } |
3455 | | |
3456 | | /* md5 /sha abstraction layer */ |
3457 | 0 | #define SSL_SHA_CTX gcry_md_hd_t |
3458 | 0 | #define SSL_MD5_CTX gcry_md_hd_t |
3459 | | |
3460 | | static inline int |
3461 | | ssl_sha_init(SSL_SHA_CTX* md) |
3462 | 0 | { |
3463 | 0 | gcry_error_t err; |
3464 | 0 | const char *err_str, *err_src; |
3465 | 0 | err = gcry_md_open(md, GCRY_MD_SHA1, 0); |
3466 | 0 | if (err != 0) { |
3467 | 0 | err_str = gcry_strerror(err); |
3468 | 0 | err_src = gcry_strsource(err); |
3469 | 0 | ssl_debug_printf("ssl_sha_init(): gcry_md_open failed %s/%s", err_str, err_src); |
3470 | 0 | return -1; |
3471 | 0 | } |
3472 | 0 | return 0; |
3473 | 0 | } |
3474 | | static inline void |
3475 | | ssl_sha_update(SSL_SHA_CTX* md, unsigned char* data, int len) |
3476 | 0 | { |
3477 | 0 | gcry_md_write(*(md), data, len); |
3478 | 0 | } |
3479 | | static inline void |
3480 | | ssl_sha_final(unsigned char* buf, SSL_SHA_CTX* md) |
3481 | 0 | { |
3482 | 0 | memcpy(buf, gcry_md_read(*(md), GCRY_MD_SHA1), |
3483 | 0 | gcry_md_get_algo_dlen(GCRY_MD_SHA1)); |
3484 | 0 | } |
3485 | | |
3486 | | static inline void |
3487 | | ssl_sha_reset(SSL_SHA_CTX* md) |
3488 | 0 | { |
3489 | 0 | gcry_md_reset(*md); |
3490 | 0 | } |
3491 | | |
3492 | | static inline void |
3493 | | ssl_sha_cleanup(SSL_SHA_CTX* md) |
3494 | 0 | { |
3495 | 0 | gcry_md_close(*(md)); |
3496 | 0 | } |
3497 | | |
3498 | | static inline int |
3499 | | ssl_md5_init(SSL_MD5_CTX* md) |
3500 | 0 | { |
3501 | 0 | gcry_error_t err; |
3502 | 0 | const char *err_str, *err_src; |
3503 | 0 | err = gcry_md_open(md,GCRY_MD_MD5, 0); |
3504 | 0 | if (err != 0) { |
3505 | 0 | err_str = gcry_strerror(err); |
3506 | 0 | err_src = gcry_strsource(err); |
3507 | 0 | ssl_debug_printf("ssl_md5_init(): gcry_md_open failed %s/%s", err_str, err_src); |
3508 | 0 | return -1; |
3509 | 0 | } |
3510 | 0 | return 0; |
3511 | 0 | } |
3512 | | static inline void |
3513 | | ssl_md5_update(SSL_MD5_CTX* md, unsigned char* data, int len) |
3514 | 0 | { |
3515 | 0 | gcry_md_write(*(md), data, len); |
3516 | 0 | } |
3517 | | static inline void |
3518 | | ssl_md5_final(unsigned char* buf, SSL_MD5_CTX* md) |
3519 | 0 | { |
3520 | 0 | memcpy(buf, gcry_md_read(*(md), GCRY_MD_MD5), |
3521 | 0 | gcry_md_get_algo_dlen(GCRY_MD_MD5)); |
3522 | 0 | } |
3523 | | |
3524 | | static inline void |
3525 | | ssl_md5_reset(SSL_MD5_CTX* md) |
3526 | 0 | { |
3527 | 0 | gcry_md_reset(*md); |
3528 | 0 | } |
3529 | | |
3530 | | static inline void |
3531 | | ssl_md5_cleanup(SSL_MD5_CTX* md) |
3532 | 0 | { |
3533 | 0 | gcry_md_close(*(md)); |
3534 | 0 | } |
3535 | | /* libgcrypt wrappers for HMAC/message digest operations }}} */ |
3536 | | |
3537 | | /* libgcrypt wrappers for Cipher state manipulation {{{ */ |
3538 | | int |
3539 | | ssl_cipher_setiv(SSL_CIPHER_CTX *cipher, unsigned char* iv, int iv_len) |
3540 | 0 | { |
3541 | 0 | int ret; |
3542 | | #if 0 |
3543 | | unsigned char *ivp; |
3544 | | int i; |
3545 | | gcry_cipher_hd_t c; |
3546 | | c=(gcry_cipher_hd_t)*cipher; |
3547 | | #endif |
3548 | 0 | ssl_debug_printf("--------------------------------------------------------------------"); |
3549 | | #if 0 |
3550 | | for(ivp=c->iv,i=0; i < iv_len; i++ ) |
3551 | | { |
3552 | | ssl_debug_printf("%d ",ivp[i]); |
3553 | | i++; |
3554 | | } |
3555 | | #endif |
3556 | 0 | ssl_debug_printf("--------------------------------------------------------------------"); |
3557 | 0 | ret = gcry_cipher_setiv(*(cipher), iv, iv_len); |
3558 | | #if 0 |
3559 | | for(ivp=c->iv,i=0; i < iv_len; i++ ) |
3560 | | { |
3561 | | ssl_debug_printf("%d ",ivp[i]); |
3562 | | i++; |
3563 | | } |
3564 | | #endif |
3565 | 0 | ssl_debug_printf("--------------------------------------------------------------------"); |
3566 | 0 | return ret; |
3567 | 0 | } |
3568 | | /* stream cipher abstraction layer*/ |
3569 | | static int |
3570 | | ssl_cipher_init(gcry_cipher_hd_t *cipher, int algo, unsigned char* sk, |
3571 | | unsigned char* iv, int mode) |
3572 | 0 | { |
3573 | 0 | int gcry_modes[] = { |
3574 | 0 | GCRY_CIPHER_MODE_STREAM, |
3575 | 0 | GCRY_CIPHER_MODE_CBC, |
3576 | 0 | GCRY_CIPHER_MODE_GCM, |
3577 | 0 | GCRY_CIPHER_MODE_CCM, |
3578 | 0 | GCRY_CIPHER_MODE_CCM, |
3579 | 0 | GCRY_CIPHER_MODE_POLY1305, |
3580 | 0 | GCRY_CIPHER_MODE_ECB, /* used for DTLSv1.3 seq number encryption */ |
3581 | 0 | }; |
3582 | 0 | int err; |
3583 | 0 | if (algo == -1) { |
3584 | | /* NULL mode */ |
3585 | 0 | *(cipher) = (gcry_cipher_hd_t)-1; |
3586 | 0 | return 0; |
3587 | 0 | } |
3588 | 0 | err = gcry_cipher_open(cipher, algo, gcry_modes[mode], 0); |
3589 | 0 | if (err !=0) |
3590 | 0 | return -1; |
3591 | 0 | err = gcry_cipher_setkey(*(cipher), sk, gcry_cipher_get_algo_keylen (algo)); |
3592 | 0 | if (err != 0) |
3593 | 0 | return -1; |
3594 | | /* AEAD cipher suites will set the nonce later. */ |
3595 | 0 | if (mode == MODE_CBC) { |
3596 | 0 | err = gcry_cipher_setiv(*(cipher), iv, gcry_cipher_get_algo_blklen(algo)); |
3597 | 0 | if (err != 0) |
3598 | 0 | return -1; |
3599 | 0 | } |
3600 | 0 | return 0; |
3601 | 0 | } |
3602 | | static inline int |
3603 | | ssl_cipher_decrypt(gcry_cipher_hd_t *cipher, unsigned char * out, int outl, |
3604 | | const unsigned char * in, int inl) |
3605 | 0 | { |
3606 | 0 | if ((*cipher) == (gcry_cipher_hd_t)-1) |
3607 | 0 | { |
3608 | 0 | if (in && inl) |
3609 | 0 | memcpy(out, in, outl < inl ? outl : inl); |
3610 | 0 | return 0; |
3611 | 0 | } |
3612 | 0 | return gcry_cipher_decrypt ( *(cipher), out, outl, in, inl); |
3613 | 0 | } |
3614 | | static inline int |
3615 | | ssl_get_digest_by_name(const char*name) |
3616 | 0 | { |
3617 | 0 | return gcry_md_map_name(name); |
3618 | 0 | } |
3619 | | static inline int |
3620 | | ssl_get_cipher_by_name(const char* name) |
3621 | 0 | { |
3622 | 0 | return gcry_cipher_map_name(name); |
3623 | 0 | } |
3624 | | |
3625 | | static inline void |
3626 | | ssl_cipher_cleanup(gcry_cipher_hd_t *cipher) |
3627 | 0 | { |
3628 | 0 | if ((*cipher) != (gcry_cipher_hd_t)-1) |
3629 | 0 | gcry_cipher_close(*cipher); |
3630 | 0 | *cipher = NULL; |
3631 | 0 | } |
3632 | | /* }}} */ |
3633 | | |
3634 | | /* Digests, Ciphers and Cipher Suites registry {{{ */ |
3635 | | static const SslDigestAlgo digests[]={ |
3636 | | {"MD5", 16}, |
3637 | | {"SHA1", 20}, |
3638 | | {"SHA256", 32}, |
3639 | | {"SHA384", 48}, |
3640 | | {"SM3", 32}, |
3641 | | {"Not Applicable", 0}, |
3642 | | }; |
3643 | | |
3644 | | #define DIGEST_MAX_SIZE 48 |
3645 | | |
3646 | | /* get index digest index */ |
3647 | | static const SslDigestAlgo * |
3648 | 0 | ssl_cipher_suite_dig(const SslCipherSuite *cs) { |
3649 | 0 | if (!cs || cs->dig < DIG_MD5 || cs->dig > DIG_NA) { |
3650 | 0 | return &digests[DIG_NA - DIG_MD5]; |
3651 | 0 | } |
3652 | 0 | return &digests[cs->dig - DIG_MD5]; |
3653 | 0 | } |
3654 | | |
3655 | | static const char *ciphers[]={ |
3656 | | "DES", |
3657 | | "3DES", |
3658 | | "ARCFOUR", /* libgcrypt does not support rc4, but this should be 100% compatible*/ |
3659 | | "RFC2268_128", /* libgcrypt name for RC2 with a 128-bit key */ |
3660 | | "IDEA", |
3661 | | "AES", |
3662 | | "AES256", |
3663 | | "CAMELLIA128", |
3664 | | "CAMELLIA256", |
3665 | | "SEED", |
3666 | | "CHACHA20", /* since Libgcrypt 1.7.0 */ |
3667 | | "SM1", |
3668 | | "SM4", |
3669 | | "*UNKNOWN*" |
3670 | | }; |
3671 | | |
3672 | | static const SslCipherSuite cipher_suites[]={ |
3673 | | {0x0001,KEX_RSA, ENC_NULL, DIG_MD5, MODE_STREAM}, /* TLS_RSA_WITH_NULL_MD5 */ |
3674 | | {0x0002,KEX_RSA, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA */ |
3675 | | {0x0003,KEX_RSA, ENC_RC4, DIG_MD5, MODE_STREAM}, /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */ |
3676 | | {0x0004,KEX_RSA, ENC_RC4, DIG_MD5, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_MD5 */ |
3677 | | {0x0005,KEX_RSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_RSA_WITH_RC4_128_SHA */ |
3678 | | {0x0006,KEX_RSA, ENC_RC2, DIG_MD5, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */ |
3679 | | {0x0007,KEX_RSA, ENC_IDEA, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_IDEA_CBC_SHA */ |
3680 | | {0x0008,KEX_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
3681 | | {0x0009,KEX_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_DES_CBC_SHA */ |
3682 | | {0x000A,KEX_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_3DES_EDE_CBC_SHA */ |
3683 | | {0x000B,KEX_DH_DSS, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */ |
3684 | | {0x000C,KEX_DH_DSS, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_DES_CBC_SHA */ |
3685 | | {0x000D,KEX_DH_DSS, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA */ |
3686 | | {0x000E,KEX_DH_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
3687 | | {0x000F,KEX_DH_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_DES_CBC_SHA */ |
3688 | | {0x0010,KEX_DH_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA */ |
3689 | | {0x0011,KEX_DHE_DSS, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */ |
3690 | | {0x0012,KEX_DHE_DSS, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_DES_CBC_SHA */ |
3691 | | {0x0013,KEX_DHE_DSS, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA */ |
3692 | | {0x0014,KEX_DHE_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
3693 | | {0x0015,KEX_DHE_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_DES_CBC_SHA */ |
3694 | | {0x0016,KEX_DHE_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */ |
3695 | | {0x0017,KEX_DH_ANON, ENC_RC4, DIG_MD5, MODE_STREAM}, /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */ |
3696 | | {0x0018,KEX_DH_ANON, ENC_RC4, DIG_MD5, MODE_STREAM}, /* TLS_DH_anon_WITH_RC4_128_MD5 */ |
3697 | | {0x0019,KEX_DH_ANON, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */ |
3698 | | {0x001A,KEX_DH_ANON, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_DES_CBC_SHA */ |
3699 | | {0x001B,KEX_DH_ANON, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_3DES_EDE_CBC_SHA */ |
3700 | | {0x002C,KEX_PSK, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA */ |
3701 | | {0x002D,KEX_DHE_PSK, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA */ |
3702 | | {0x002E,KEX_RSA_PSK, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA */ |
3703 | | {0x002F,KEX_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA */ |
3704 | | {0x0030,KEX_DH_DSS, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA */ |
3705 | | {0x0031,KEX_DH_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA */ |
3706 | | {0x0032,KEX_DHE_DSS, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA */ |
3707 | | {0x0033,KEX_DHE_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA */ |
3708 | | {0x0034,KEX_DH_ANON, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA */ |
3709 | | {0x0035,KEX_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA */ |
3710 | | {0x0036,KEX_DH_DSS, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA */ |
3711 | | {0x0037,KEX_DH_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA */ |
3712 | | {0x0038,KEX_DHE_DSS, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA */ |
3713 | | {0x0039,KEX_DHE_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */ |
3714 | | {0x003A,KEX_DH_ANON, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA */ |
3715 | | {0x003B,KEX_RSA, ENC_NULL, DIG_SHA256, MODE_STREAM}, /* TLS_RSA_WITH_NULL_SHA256 */ |
3716 | | {0x003C,KEX_RSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_RSA_WITH_AES_128_CBC_SHA256 */ |
3717 | | {0x003D,KEX_RSA, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_RSA_WITH_AES_256_CBC_SHA256 */ |
3718 | | {0x003E,KEX_DH_DSS, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_128_CBC_SHA256 */ |
3719 | | {0x003F,KEX_DH_RSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_128_CBC_SHA256 */ |
3720 | | {0x0040,KEX_DHE_DSS, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 */ |
3721 | | {0x0041,KEX_RSA, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA */ |
3722 | | {0x0042,KEX_DH_DSS, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA */ |
3723 | | {0x0043,KEX_DH_RSA, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA */ |
3724 | | {0x0044,KEX_DHE_DSS, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA */ |
3725 | | {0x0045,KEX_DHE_RSA, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA */ |
3726 | | {0x0046,KEX_DH_ANON, ENC_CAMELLIA128,DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA */ |
3727 | | {0x0060,KEX_RSA, ENC_RC4, DIG_MD5, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */ |
3728 | | {0x0061,KEX_RSA, ENC_RC2, DIG_MD5, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */ |
3729 | | {0x0062,KEX_RSA, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */ |
3730 | | {0x0063,KEX_DHE_DSS, ENC_DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */ |
3731 | | {0x0064,KEX_RSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */ |
3732 | | {0x0065,KEX_DHE_DSS, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */ |
3733 | | {0x0066,KEX_DHE_DSS, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_DHE_DSS_WITH_RC4_128_SHA */ |
3734 | | {0x0067,KEX_DHE_RSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */ |
3735 | | {0x0068,KEX_DH_DSS, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_DH_DSS_WITH_AES_256_CBC_SHA256 */ |
3736 | | {0x0069,KEX_DH_RSA, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_DH_RSA_WITH_AES_256_CBC_SHA256 */ |
3737 | | {0x006A,KEX_DHE_DSS, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 */ |
3738 | | {0x006B,KEX_DHE_RSA, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 */ |
3739 | | {0x006C,KEX_DH_ANON, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */ |
3740 | | {0x006D,KEX_DH_ANON, ENC_AES256, DIG_SHA256, MODE_CBC }, /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */ |
3741 | | {0x0084,KEX_RSA, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA */ |
3742 | | {0x0085,KEX_DH_DSS, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA */ |
3743 | | {0x0086,KEX_DH_RSA, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA */ |
3744 | | {0x0087,KEX_DHE_DSS, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA */ |
3745 | | {0x0088,KEX_DHE_RSA, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA */ |
3746 | | {0x0089,KEX_DH_ANON, ENC_CAMELLIA256,DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA */ |
3747 | | {0x008A,KEX_PSK, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_PSK_WITH_RC4_128_SHA */ |
3748 | | {0x008B,KEX_PSK, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_PSK_WITH_3DES_EDE_CBC_SHA */ |
3749 | | {0x008C,KEX_PSK, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA */ |
3750 | | {0x008D,KEX_PSK, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA */ |
3751 | | {0x008E,KEX_DHE_PSK, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_DHE_PSK_WITH_RC4_128_SHA */ |
3752 | | {0x008F,KEX_DHE_PSK, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA */ |
3753 | | {0x0090,KEX_DHE_PSK, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA */ |
3754 | | {0x0091,KEX_DHE_PSK, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA */ |
3755 | | {0x0092,KEX_RSA_PSK, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_RSA_PSK_WITH_RC4_128_SHA */ |
3756 | | {0x0093,KEX_RSA_PSK, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA */ |
3757 | | {0x0094,KEX_RSA_PSK, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA */ |
3758 | | {0x0095,KEX_RSA_PSK, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA */ |
3759 | | {0x0096,KEX_RSA, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_RSA_WITH_SEED_CBC_SHA */ |
3760 | | {0x0097,KEX_DH_DSS, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_DH_DSS_WITH_SEED_CBC_SHA */ |
3761 | | {0x0098,KEX_DH_RSA, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_DH_RSA_WITH_SEED_CBC_SHA */ |
3762 | | {0x0099,KEX_DHE_DSS, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_DHE_DSS_WITH_SEED_CBC_SHA */ |
3763 | | {0x009A,KEX_DHE_RSA, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_DHE_RSA_WITH_SEED_CBC_SHA */ |
3764 | | {0x009B,KEX_DH_ANON, ENC_SEED, DIG_SHA, MODE_CBC }, /* TLS_DH_anon_WITH_SEED_CBC_SHA */ |
3765 | | {0x009C,KEX_RSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_RSA_WITH_AES_128_GCM_SHA256 */ |
3766 | | {0x009D,KEX_RSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_RSA_WITH_AES_256_GCM_SHA384 */ |
3767 | | {0x009E,KEX_DHE_RSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */ |
3768 | | {0x009F,KEX_DHE_RSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */ |
3769 | | {0x00A0,KEX_DH_RSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_128_GCM_SHA256 */ |
3770 | | {0x00A1,KEX_DH_RSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DH_RSA_WITH_AES_256_GCM_SHA384 */ |
3771 | | {0x00A2,KEX_DHE_DSS, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 */ |
3772 | | {0x00A3,KEX_DHE_DSS, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */ |
3773 | | {0x00A4,KEX_DH_DSS, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_128_GCM_SHA256 */ |
3774 | | {0x00A5,KEX_DH_DSS, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DH_DSS_WITH_AES_256_GCM_SHA384 */ |
3775 | | {0x00A6,KEX_DH_ANON, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */ |
3776 | | {0x00A7,KEX_DH_ANON, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */ |
3777 | | {0x00A8,KEX_PSK, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_PSK_WITH_AES_128_GCM_SHA256 */ |
3778 | | {0x00A9,KEX_PSK, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_PSK_WITH_AES_256_GCM_SHA384 */ |
3779 | | {0x00AA,KEX_DHE_PSK, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */ |
3780 | | {0x00AB,KEX_DHE_PSK, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */ |
3781 | | {0x00AC,KEX_RSA_PSK, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 */ |
3782 | | {0x00AD,KEX_RSA_PSK, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 */ |
3783 | | {0x00AE,KEX_PSK, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_PSK_WITH_AES_128_CBC_SHA256 */ |
3784 | | {0x00AF,KEX_PSK, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_PSK_WITH_AES_256_CBC_SHA384 */ |
3785 | | {0x00B0,KEX_PSK, ENC_NULL, DIG_SHA256, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA256 */ |
3786 | | {0x00B1,KEX_PSK, ENC_NULL, DIG_SHA384, MODE_STREAM}, /* TLS_PSK_WITH_NULL_SHA384 */ |
3787 | | {0x00B2,KEX_DHE_PSK, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 */ |
3788 | | {0x00B3,KEX_DHE_PSK, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 */ |
3789 | | {0x00B4,KEX_DHE_PSK, ENC_NULL, DIG_SHA256, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA256 */ |
3790 | | {0x00B5,KEX_DHE_PSK, ENC_NULL, DIG_SHA384, MODE_STREAM}, /* TLS_DHE_PSK_WITH_NULL_SHA384 */ |
3791 | | {0x00B6,KEX_RSA_PSK, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 */ |
3792 | | {0x00B7,KEX_RSA_PSK, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 */ |
3793 | | {0x00B8,KEX_RSA_PSK, ENC_NULL, DIG_SHA256, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA256 */ |
3794 | | {0x00B9,KEX_RSA_PSK, ENC_NULL, DIG_SHA384, MODE_STREAM}, /* TLS_RSA_PSK_WITH_NULL_SHA384 */ |
3795 | | {0x00BA,KEX_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3796 | | {0x00BB,KEX_DH_DSS, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 */ |
3797 | | {0x00BC,KEX_DH_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3798 | | {0x00BD,KEX_DHE_DSS, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 */ |
3799 | | {0x00BE,KEX_DHE_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3800 | | {0x00BF,KEX_DH_ANON, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 */ |
3801 | | {0x00C0,KEX_RSA, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 */ |
3802 | | {0x00C1,KEX_DH_DSS, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 */ |
3803 | | {0x00C2,KEX_DH_RSA, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 */ |
3804 | | {0x00C3,KEX_DHE_DSS, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 */ |
3805 | | {0x00C4,KEX_DHE_RSA, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 */ |
3806 | | {0x00C5,KEX_DH_ANON, ENC_CAMELLIA256,DIG_SHA256, MODE_CBC }, /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */ |
3807 | | |
3808 | | /* NOTE: TLS 1.3 cipher suites are incompatible with TLS 1.2. */ |
3809 | | {0x1301,KEX_TLS13, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_AES_128_GCM_SHA256 */ |
3810 | | {0x1302,KEX_TLS13, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_AES_256_GCM_SHA384 */ |
3811 | | {0x1303,KEX_TLS13, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_CHACHA20_POLY1305_SHA256 */ |
3812 | | {0x1304,KEX_TLS13, ENC_AES, DIG_SHA256, MODE_CCM }, /* TLS_AES_128_CCM_SHA256 */ |
3813 | | {0x1305,KEX_TLS13, ENC_AES, DIG_SHA256, MODE_CCM_8 }, /* TLS_AES_128_CCM_8_SHA256 */ |
3814 | | {0x00C6,KEX_TLS13, ENC_SM4, DIG_SM3, MODE_GCM }, /* TLS_SM4_GCM_SM3 */ |
3815 | | |
3816 | | {0xC001,KEX_ECDH_ECDSA, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_NULL_SHA */ |
3817 | | {0xC002,KEX_ECDH_ECDSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */ |
3818 | | {0xC003,KEX_ECDH_ECDSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA */ |
3819 | | {0xC004,KEX_ECDH_ECDSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA */ |
3820 | | {0xC005,KEX_ECDH_ECDSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA */ |
3821 | | {0xC006,KEX_ECDHE_ECDSA, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */ |
3822 | | {0xC007,KEX_ECDHE_ECDSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA */ |
3823 | | {0xC008,KEX_ECDHE_ECDSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA */ |
3824 | | {0xC009,KEX_ECDHE_ECDSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */ |
3825 | | {0xC00A,KEX_ECDHE_ECDSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */ |
3826 | | {0xC00B,KEX_ECDH_RSA, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_NULL_SHA */ |
3827 | | {0xC00C,KEX_ECDH_RSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_RSA_WITH_RC4_128_SHA */ |
3828 | | {0xC00D,KEX_ECDH_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA */ |
3829 | | {0xC00E,KEX_ECDH_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA */ |
3830 | | {0xC00F,KEX_ECDH_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */ |
3831 | | {0xC0FF,KEX_ECJPAKE, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_ECJPAKE_WITH_AES_128_CCM_8 */ |
3832 | | {0xC010,KEX_ECDHE_RSA, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_NULL_SHA */ |
3833 | | {0xC011,KEX_ECDHE_RSA, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */ |
3834 | | {0xC012,KEX_ECDHE_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA */ |
3835 | | {0xC013,KEX_ECDHE_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA */ |
3836 | | {0xC014,KEX_ECDHE_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */ |
3837 | | {0xC015,KEX_ECDH_ANON, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_anon_WITH_NULL_SHA */ |
3838 | | {0xC016,KEX_ECDH_ANON, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDH_anon_WITH_RC4_128_SHA */ |
3839 | | {0xC017,KEX_ECDH_ANON, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */ |
3840 | | {0xC018,KEX_ECDH_ANON, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */ |
3841 | | {0xC019,KEX_ECDH_ANON, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */ |
3842 | | {0xC01A,KEX_SRP_SHA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA */ |
3843 | | {0xC01B,KEX_SRP_SHA_RSA, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA */ |
3844 | | {0xC01C,KEX_SRP_SHA_DSS, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA */ |
3845 | | {0xC01D,KEX_SRP_SHA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_128_CBC_SHA */ |
3846 | | {0xC01E,KEX_SRP_SHA_RSA, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA */ |
3847 | | {0xC01F,KEX_SRP_SHA_DSS, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA */ |
3848 | | {0xC020,KEX_SRP_SHA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_WITH_AES_256_CBC_SHA */ |
3849 | | {0xC021,KEX_SRP_SHA_RSA, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA */ |
3850 | | {0xC022,KEX_SRP_SHA_DSS, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA */ |
3851 | | {0xC023,KEX_ECDHE_ECDSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */ |
3852 | | {0xC024,KEX_ECDHE_ECDSA, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */ |
3853 | | {0xC025,KEX_ECDH_ECDSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 */ |
3854 | | {0xC026,KEX_ECDH_ECDSA, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 */ |
3855 | | {0xC027,KEX_ECDHE_RSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 */ |
3856 | | {0xC028,KEX_ECDHE_RSA, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */ |
3857 | | {0xC029,KEX_ECDH_RSA, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 */ |
3858 | | {0xC02A,KEX_ECDH_RSA, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 */ |
3859 | | {0xC02B,KEX_ECDHE_ECDSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */ |
3860 | | {0xC02C,KEX_ECDHE_ECDSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */ |
3861 | | {0xC02D,KEX_ECDH_ECDSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 */ |
3862 | | {0xC02E,KEX_ECDH_ECDSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 */ |
3863 | | {0xC02F,KEX_ECDHE_RSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */ |
3864 | | {0xC030,KEX_ECDHE_RSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */ |
3865 | | {0xC031,KEX_ECDH_RSA, ENC_AES, DIG_SHA256, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 */ |
3866 | | {0xC032,KEX_ECDH_RSA, ENC_AES256, DIG_SHA384, MODE_GCM }, /* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 */ |
3867 | | {0xC033,KEX_ECDHE_PSK, ENC_RC4, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_RC4_128_SHA */ |
3868 | | {0xC034,KEX_ECDHE_PSK, ENC_3DES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA */ |
3869 | | {0xC035,KEX_ECDHE_PSK, ENC_AES, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA */ |
3870 | | {0xC036,KEX_ECDHE_PSK, ENC_AES256, DIG_SHA, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA */ |
3871 | | {0xC037,KEX_ECDHE_PSK, ENC_AES, DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 */ |
3872 | | {0xC038,KEX_ECDHE_PSK, ENC_AES256, DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 */ |
3873 | | {0xC039,KEX_ECDHE_PSK, ENC_NULL, DIG_SHA, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA */ |
3874 | | {0xC03A,KEX_ECDHE_PSK, ENC_NULL, DIG_SHA256, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA256 */ |
3875 | | {0xC03B,KEX_ECDHE_PSK, ENC_NULL, DIG_SHA384, MODE_STREAM}, /* TLS_ECDHE_PSK_WITH_NULL_SHA384 */ |
3876 | | {0xC072,KEX_ECDHE_ECDSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3877 | | {0xC073,KEX_ECDHE_ECDSA, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */ |
3878 | | {0xC074,KEX_ECDH_ECDSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3879 | | {0xC075,KEX_ECDH_ECDSA, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 */ |
3880 | | {0xC076,KEX_ECDHE_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3881 | | {0xC077,KEX_ECDHE_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 */ |
3882 | | {0xC078,KEX_ECDH_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 */ |
3883 | | {0xC079,KEX_ECDH_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 */ |
3884 | | {0xC07A,KEX_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3885 | | {0xC07B,KEX_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3886 | | {0xC07C,KEX_DHE_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3887 | | {0xC07D,KEX_DHE_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3888 | | {0xC07E,KEX_DH_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3889 | | {0xC07F,KEX_DH_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3890 | | {0xC080,KEX_DHE_DSS, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 */ |
3891 | | {0xC081,KEX_DHE_DSS, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 */ |
3892 | | {0xC082,KEX_DH_DSS, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 */ |
3893 | | {0xC083,KEX_DH_DSS, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */ |
3894 | | {0xC084,KEX_DH_ANON, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 */ |
3895 | | {0xC085,KEX_DH_ANON, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 */ |
3896 | | {0xC086,KEX_ECDHE_ECDSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3897 | | {0xC087,KEX_ECDHE_ECDSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3898 | | {0xC088,KEX_ECDH_ECDSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3899 | | {0xC089,KEX_ECDH_ECDSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3900 | | {0xC08A,KEX_ECDHE_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3901 | | {0xC08B,KEX_ECDHE_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3902 | | {0xC08C,KEX_ECDH_RSA, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 */ |
3903 | | {0xC08D,KEX_ECDH_RSA, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ |
3904 | | {0xC08E,KEX_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 */ |
3905 | | {0xC08F,KEX_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 */ |
3906 | | {0xC090,KEX_DHE_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 */ |
3907 | | {0xC091,KEX_DHE_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 */ |
3908 | | {0xC092,KEX_RSA_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 */ |
3909 | | {0xC093,KEX_RSA_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_GCM }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 */ |
3910 | | {0xC094,KEX_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ |
3911 | | {0xC095,KEX_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 */ |
3912 | | {0xC096,KEX_DHE_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ |
3913 | | {0xC097,KEX_DHE_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */ |
3914 | | {0xC098,KEX_RSA_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ |
3915 | | {0xC099,KEX_RSA_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 */ |
3916 | | {0xC09A,KEX_ECDHE_PSK, ENC_CAMELLIA128,DIG_SHA256, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ |
3917 | | {0xC09B,KEX_ECDHE_PSK, ENC_CAMELLIA256,DIG_SHA384, MODE_CBC }, /* TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 */ |
3918 | | {0xC09C,KEX_RSA, ENC_AES, DIG_NA, MODE_CCM }, /* TLS_RSA_WITH_AES_128_CCM */ |
3919 | | {0xC09D,KEX_RSA, ENC_AES256, DIG_NA, MODE_CCM }, /* TLS_RSA_WITH_AES_256_CCM */ |
3920 | | {0xC09E,KEX_DHE_RSA, ENC_AES, DIG_NA, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_128_CCM */ |
3921 | | {0xC09F,KEX_DHE_RSA, ENC_AES256, DIG_NA, MODE_CCM }, /* TLS_DHE_RSA_WITH_AES_256_CCM */ |
3922 | | {0xC0A0,KEX_RSA, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_128_CCM_8 */ |
3923 | | {0xC0A1,KEX_RSA, ENC_AES256, DIG_NA, MODE_CCM_8 }, /* TLS_RSA_WITH_AES_256_CCM_8 */ |
3924 | | {0xC0A2,KEX_DHE_RSA, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_128_CCM_8 */ |
3925 | | {0xC0A3,KEX_DHE_RSA, ENC_AES256, DIG_NA, MODE_CCM_8 }, /* TLS_DHE_RSA_WITH_AES_256_CCM_8 */ |
3926 | | {0xC0A4,KEX_PSK, ENC_AES, DIG_NA, MODE_CCM }, /* TLS_PSK_WITH_AES_128_CCM */ |
3927 | | {0xC0A5,KEX_PSK, ENC_AES256, DIG_NA, MODE_CCM }, /* TLS_PSK_WITH_AES_256_CCM */ |
3928 | | {0xC0A6,KEX_DHE_PSK, ENC_AES, DIG_NA, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_128_CCM */ |
3929 | | {0xC0A7,KEX_DHE_PSK, ENC_AES256, DIG_NA, MODE_CCM }, /* TLS_DHE_PSK_WITH_AES_256_CCM */ |
3930 | | {0xC0A8,KEX_PSK, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_128_CCM_8 */ |
3931 | | {0xC0A9,KEX_PSK, ENC_AES256, DIG_NA, MODE_CCM_8 }, /* TLS_PSK_WITH_AES_256_CCM_8 */ |
3932 | | {0xC0AA,KEX_DHE_PSK, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_128_CCM_8 */ |
3933 | | {0xC0AB,KEX_DHE_PSK, ENC_AES256, DIG_NA, MODE_CCM_8 }, /* TLS_PSK_DHE_WITH_AES_256_CCM_8 */ |
3934 | | {0xC0AC,KEX_ECDHE_ECDSA, ENC_AES, DIG_NA, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM */ |
3935 | | {0xC0AD,KEX_ECDHE_ECDSA, ENC_AES256, DIG_NA, MODE_CCM }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM */ |
3936 | | {0xC0AE,KEX_ECDHE_ECDSA, ENC_AES, DIG_NA, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */ |
3937 | | {0xC0AF,KEX_ECDHE_ECDSA, ENC_AES256, DIG_NA, MODE_CCM_8 }, /* TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 */ |
3938 | | {0xCCA8,KEX_ECDHE_RSA, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */ |
3939 | | {0xCCA9,KEX_ECDHE_ECDSA, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */ |
3940 | | {0xCCAA,KEX_DHE_RSA, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */ |
3941 | | {0xCCAB,KEX_PSK, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 */ |
3942 | | {0xCCAC,KEX_ECDHE_PSK, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */ |
3943 | | {0xCCAD,KEX_DHE_PSK, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */ |
3944 | | {0xCCAE,KEX_RSA_PSK, ENC_CHACHA20, DIG_SHA256, MODE_POLY1305 }, /* TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 */ |
3945 | | {0xD001,KEX_ECDHE_PSK, ENC_AES, DIG_SHA256, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */ |
3946 | | {0xD002,KEX_ECDHE_PSK, ENC_AES256, DIG_SHA384, MODE_GCM}, /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */ |
3947 | | {0xD003,KEX_ECDHE_PSK, ENC_AES, DIG_SHA256, MODE_CCM_8}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256 */ |
3948 | | {0xD005,KEX_ECDHE_PSK, ENC_AES, DIG_SHA256, MODE_CCM}, /* TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256 */ |
3949 | | /* GM */ |
3950 | | {0xe001,KEX_ECDHE_SM2, ENC_SM1, DIG_SM3, MODE_CBC}, /* ECDHE_SM1_SM3 */ |
3951 | | {0xe003,KEX_ECC_SM2, ENC_SM1, DIG_SM3, MODE_CBC}, /* ECC_SM1_SM3 */ |
3952 | | {0xe005,KEX_IBSDH_SM9, ENC_SM1, DIG_SM3, MODE_CBC}, /* IBSDH_SM1_SM3 */ |
3953 | | {0xe007,KEX_IBC_SM9, ENC_SM1, DIG_SM3, MODE_CBC}, /* IBC_SM1_SM3 */ |
3954 | | {0xe009,KEX_RSA, ENC_SM1, DIG_SM3, MODE_CBC}, /* RSA_SM1_SM3 */ |
3955 | | {0xe00a,KEX_RSA, ENC_SM1, DIG_SHA, MODE_CBC}, /* RSA_SM1_SHA1 */ |
3956 | | {0xe011,KEX_ECDHE_SM2, ENC_SM4, DIG_SM3, MODE_CBC}, /* ECDHE_SM4_CBC_SM3 */ |
3957 | | {0xe013,KEX_ECC_SM2, ENC_SM4, DIG_SM3, MODE_CBC}, /* ECC_SM4_CBC_SM3 */ |
3958 | | {0xe015,KEX_IBSDH_SM9, ENC_SM4, DIG_SM3, MODE_CBC}, /* IBSDH_SM4_CBC_SM3 */ |
3959 | | {0xe017,KEX_IBC_SM9, ENC_SM4, DIG_SM3, MODE_CBC}, /* IBC_SM4_CBC_SM3 */ |
3960 | | {0xe019,KEX_RSA, ENC_SM4, DIG_SM3, MODE_CBC}, /* RSA_SM4_CBC_SM3 */ |
3961 | | {0xe01a,KEX_RSA, ENC_SM4, DIG_SHA, MODE_CBC}, /* RSA_SM4_CBC_SHA1 */ |
3962 | | {0xe01c,KEX_RSA, ENC_SM4, DIG_SHA256, MODE_CBC}, /* RSA_SM4_CBC_SHA256 */ |
3963 | | {0xe051,KEX_ECDHE_SM2, ENC_SM4, DIG_SM3, MODE_GCM}, /* ECDHE_SM4_GCM_SM3 */ |
3964 | | {0xe053,KEX_ECC_SM2, ENC_SM4, DIG_SM3, MODE_GCM}, /* ECC_SM4_GCM_SM3 */ |
3965 | | {0xe055,KEX_IBSDH_SM9, ENC_SM4, DIG_SM3, MODE_GCM}, /* IBSDH_SM4_GCM_SM3 */ |
3966 | | {0xe057,KEX_IBC_SM9, ENC_SM4, DIG_SM3, MODE_GCM}, /* IBC_SM4_GCM_SM3 */ |
3967 | | {0xe059,KEX_RSA, ENC_SM4, DIG_SM3, MODE_GCM}, /* RSA_SM4_GCM_SM3 */ |
3968 | | {0xe05a,KEX_RSA, ENC_SM4, DIG_SHA256, MODE_GCM}, /* RSA_SM4_GCM_SHA256 */ |
3969 | | {-1, 0, 0, 0, MODE_STREAM} |
3970 | | }; |
3971 | | |
3972 | 0 | #define MAX_BLOCK_SIZE 16 |
3973 | | #define MAX_KEY_SIZE 32 |
3974 | | |
3975 | | const SslCipherSuite * |
3976 | | ssl_find_cipher(int num) |
3977 | 31 | { |
3978 | 31 | const SslCipherSuite *c; |
3979 | 7.50k | for(c=cipher_suites;c->number!=-1;c++){ |
3980 | 7.47k | if(c->number==num){ |
3981 | 6 | return c; |
3982 | 6 | } |
3983 | 7.47k | } |
3984 | | |
3985 | 25 | return NULL; |
3986 | 31 | } |
3987 | | |
3988 | | int |
3989 | | ssl_get_cipher_algo(const SslCipherSuite *cipher_suite) |
3990 | 0 | { |
3991 | 0 | return gcry_cipher_map_name(ciphers[cipher_suite->enc - ENC_START]); |
3992 | 0 | } |
3993 | | |
3994 | | unsigned |
3995 | | ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite) |
3996 | 0 | { |
3997 | 0 | int cipher_algo; |
3998 | 0 | if (cipher_suite->mode != MODE_CBC) return 0; |
3999 | 0 | cipher_algo = ssl_get_cipher_by_name(ciphers[cipher_suite->enc - ENC_START]); |
4000 | 0 | return (unsigned)gcry_cipher_get_algo_blklen(cipher_algo); |
4001 | 0 | } |
4002 | | |
4003 | | static unsigned |
4004 | | ssl_get_cipher_export_keymat_size(int cipher_suite_num) |
4005 | 0 | { |
4006 | 0 | switch (cipher_suite_num) { |
4007 | | /* See RFC 6101 (SSL 3.0), Table 2, column Key Material. */ |
4008 | 0 | case 0x0003: /* TLS_RSA_EXPORT_WITH_RC4_40_MD5 */ |
4009 | 0 | case 0x0006: /* TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */ |
4010 | 0 | case 0x0008: /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
4011 | 0 | case 0x000B: /* TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA */ |
4012 | 0 | case 0x000E: /* TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
4013 | 0 | case 0x0011: /* TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA */ |
4014 | 0 | case 0x0014: /* TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA */ |
4015 | 0 | case 0x0017: /* TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 */ |
4016 | 0 | case 0x0019: /* TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA */ |
4017 | 0 | return 5; |
4018 | | |
4019 | | /* not defined in below draft, but "implemented by several vendors", |
4020 | | * https://www.ietf.org/mail-archive/web/tls/current/msg00036.html */ |
4021 | 0 | case 0x0060: /* TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 */ |
4022 | 0 | case 0x0061: /* TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 */ |
4023 | 0 | return 7; |
4024 | | |
4025 | | /* Note: the draft states that DES_CBC needs 8 bytes, but Wireshark always |
4026 | | * used 7. Until a pcap proves 8, let's use the old value. Link: |
4027 | | * https://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 */ |
4028 | 0 | case 0x0062: /* TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA */ |
4029 | 0 | case 0x0063: /* TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA */ |
4030 | 0 | case 0x0064: /* TLS_RSA_EXPORT1024_WITH_RC4_56_SHA */ |
4031 | 0 | case 0x0065: /* TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA */ |
4032 | 0 | return 7; |
4033 | | |
4034 | 0 | default: |
4035 | 0 | return 0; |
4036 | 0 | } |
4037 | 0 | } |
4038 | | |
4039 | | /* Digests, Ciphers and Cipher Suites registry }}} */ |
4040 | | |
4041 | | |
4042 | | /* HMAC and the Pseudorandom function {{{ */ |
4043 | | static int |
4044 | | tls_hash(StringInfo *secret, StringInfo *seed, int md, |
4045 | | StringInfo *out, unsigned out_len) |
4046 | 0 | { |
4047 | | /* RFC 2246 5. HMAC and the pseudorandom function |
4048 | | * '+' denotes concatenation. |
4049 | | * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + |
4050 | | * HMAC_hash(secret, A(2) + seed) + ... |
4051 | | * A(0) = seed |
4052 | | * A(i) = HMAC_hash(secret, A(i - 1)) |
4053 | | */ |
4054 | 0 | uint8_t *ptr; |
4055 | 0 | unsigned left, tocpy; |
4056 | 0 | uint8_t *A; |
4057 | 0 | uint8_t _A[DIGEST_MAX_SIZE], tmp[DIGEST_MAX_SIZE]; |
4058 | 0 | unsigned A_l, tmp_l; |
4059 | 0 | SSL_HMAC hm; |
4060 | |
|
4061 | 0 | ptr = out->data; |
4062 | 0 | left = out_len; |
4063 | |
|
4064 | 0 | ssl_print_string("tls_hash: hash secret", secret); |
4065 | 0 | ssl_print_string("tls_hash: hash seed", seed); |
4066 | | /* A(0) = seed */ |
4067 | 0 | A = seed->data; |
4068 | 0 | A_l = seed->data_len; |
4069 | |
|
4070 | 0 | if (ssl_hmac_init(&hm, md) != 0) { |
4071 | 0 | return -1; |
4072 | 0 | } |
4073 | 0 | while (left) { |
4074 | | /* A(i) = HMAC_hash(secret, A(i-1)) */ |
4075 | 0 | ssl_hmac_setkey(&hm, secret->data, secret->data_len); |
4076 | 0 | ssl_hmac_update(&hm, A, A_l); |
4077 | 0 | A_l = sizeof(_A); /* upper bound len for hash output */ |
4078 | 0 | ssl_hmac_final(&hm, _A, &A_l); |
4079 | 0 | A = _A; |
4080 | | |
4081 | | /* HMAC_hash(secret, A(i) + seed) */ |
4082 | 0 | ssl_hmac_reset(&hm); |
4083 | 0 | ssl_hmac_setkey(&hm, secret->data, secret->data_len); |
4084 | 0 | ssl_hmac_update(&hm, A, A_l); |
4085 | 0 | ssl_hmac_update(&hm, seed->data, seed->data_len); |
4086 | 0 | tmp_l = sizeof(tmp); /* upper bound len for hash output */ |
4087 | 0 | ssl_hmac_final(&hm, tmp, &tmp_l); |
4088 | 0 | ssl_hmac_reset(&hm); |
4089 | | |
4090 | | /* ssl_hmac_final puts the actual digest output size in tmp_l */ |
4091 | 0 | tocpy = MIN(left, tmp_l); |
4092 | 0 | memcpy(ptr, tmp, tocpy); |
4093 | 0 | ptr += tocpy; |
4094 | 0 | left -= tocpy; |
4095 | 0 | } |
4096 | 0 | ssl_hmac_cleanup(&hm); |
4097 | 0 | out->data_len = out_len; |
4098 | |
|
4099 | 0 | ssl_print_string("hash out", out); |
4100 | 0 | return 0; |
4101 | 0 | } |
4102 | | |
4103 | | static bool |
4104 | | tls_prf(StringInfo* secret, const char *usage, |
4105 | | StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len) |
4106 | 0 | { |
4107 | 0 | StringInfo seed, sha_out, md5_out; |
4108 | 0 | uint8_t *ptr; |
4109 | 0 | StringInfo s1, s2; |
4110 | 0 | unsigned i,s_l; |
4111 | 0 | size_t usage_len, rnd2_len; |
4112 | 0 | bool success = false; |
4113 | 0 | usage_len = strlen(usage); |
4114 | 0 | rnd2_len = rnd2 ? rnd2->data_len : 0; |
4115 | | |
4116 | | /* initialize buffer for sha, md5 random seed*/ |
4117 | 0 | if (ssl_data_alloc(&sha_out, MAX(out_len, 20)) < 0) { |
4118 | 0 | ssl_debug_printf("tls_prf: can't allocate sha out\n"); |
4119 | 0 | return false; |
4120 | 0 | } |
4121 | 0 | if (ssl_data_alloc(&md5_out, MAX(out_len, 16)) < 0) { |
4122 | 0 | ssl_debug_printf("tls_prf: can't allocate md5 out\n"); |
4123 | 0 | goto free_sha; |
4124 | 0 | } |
4125 | 0 | if (ssl_data_alloc(&seed, usage_len+rnd1->data_len+rnd2_len) < 0) { |
4126 | 0 | ssl_debug_printf("tls_prf: can't allocate rnd %d\n", |
4127 | 0 | (int) (usage_len+rnd1->data_len+rnd2_len)); |
4128 | 0 | goto free_md5; |
4129 | 0 | } |
4130 | | |
4131 | 0 | ptr=seed.data; |
4132 | 0 | memcpy(ptr,usage,usage_len); |
4133 | 0 | ptr+=usage_len; |
4134 | 0 | memcpy(ptr,rnd1->data,rnd1->data_len); |
4135 | 0 | if (rnd2_len > 0) { |
4136 | 0 | ptr+=rnd1->data_len; |
4137 | 0 | memcpy(ptr,rnd2->data,rnd2->data_len); |
4138 | | /*ptr+=rnd2->data_len;*/ |
4139 | 0 | } |
4140 | | |
4141 | | /* initialize buffer for client/server seeds*/ |
4142 | 0 | s_l=secret->data_len/2 + secret->data_len%2; |
4143 | 0 | if (ssl_data_alloc(&s1, s_l) < 0) { |
4144 | 0 | ssl_debug_printf("tls_prf: can't allocate secret %d\n", s_l); |
4145 | 0 | goto free_seed; |
4146 | 0 | } |
4147 | 0 | if (ssl_data_alloc(&s2, s_l) < 0) { |
4148 | 0 | ssl_debug_printf("tls_prf: can't allocate secret(2) %d\n", s_l); |
4149 | 0 | goto free_s1; |
4150 | 0 | } |
4151 | | |
4152 | 0 | memcpy(s1.data,secret->data,s_l); |
4153 | 0 | memcpy(s2.data,secret->data + (secret->data_len - s_l),s_l); |
4154 | |
|
4155 | 0 | ssl_debug_printf("tls_prf: tls_hash(md5 secret_len %d seed_len %d )\n", s1.data_len, seed.data_len); |
4156 | 0 | if(tls_hash(&s1, &seed, ssl_get_digest_by_name("MD5"), &md5_out, out_len) != 0) |
4157 | 0 | goto free_s2; |
4158 | 0 | ssl_debug_printf("tls_prf: tls_hash(sha)\n"); |
4159 | 0 | if(tls_hash(&s2, &seed, ssl_get_digest_by_name("SHA1"), &sha_out, out_len) != 0) |
4160 | 0 | goto free_s2; |
4161 | | |
4162 | 0 | for (i = 0; i < out_len; i++) |
4163 | 0 | out->data[i] = md5_out.data[i] ^ sha_out.data[i]; |
4164 | | /* success, now store the new meaningful data length */ |
4165 | 0 | out->data_len = out_len; |
4166 | 0 | success = true; |
4167 | |
|
4168 | 0 | ssl_print_string("PRF out",out); |
4169 | 0 | free_s2: |
4170 | 0 | g_free(s2.data); |
4171 | 0 | free_s1: |
4172 | 0 | g_free(s1.data); |
4173 | 0 | free_seed: |
4174 | 0 | g_free(seed.data); |
4175 | 0 | free_md5: |
4176 | 0 | g_free(md5_out.data); |
4177 | 0 | free_sha: |
4178 | 0 | g_free(sha_out.data); |
4179 | 0 | return success; |
4180 | 0 | } |
4181 | | |
4182 | | static bool |
4183 | | tls12_prf(int md, StringInfo* secret, const char* usage, |
4184 | | StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len) |
4185 | 0 | { |
4186 | 0 | StringInfo label_seed; |
4187 | 0 | int success; |
4188 | 0 | size_t usage_len, rnd2_len; |
4189 | 0 | rnd2_len = rnd2 ? rnd2->data_len : 0; |
4190 | |
|
4191 | 0 | usage_len = strlen(usage); |
4192 | 0 | if (ssl_data_alloc(&label_seed, usage_len+rnd1->data_len+rnd2_len) < 0) { |
4193 | 0 | ssl_debug_printf("tls12_prf: can't allocate label_seed\n"); |
4194 | 0 | return false; |
4195 | 0 | } |
4196 | 0 | memcpy(label_seed.data, usage, usage_len); |
4197 | 0 | memcpy(label_seed.data+usage_len, rnd1->data, rnd1->data_len); |
4198 | 0 | if (rnd2_len > 0) |
4199 | 0 | memcpy(label_seed.data+usage_len+rnd1->data_len, rnd2->data, rnd2->data_len); |
4200 | |
|
4201 | 0 | ssl_debug_printf("tls12_prf: tls_hash(hash_alg %s secret_len %d seed_len %d )\n", gcry_md_algo_name(md), secret->data_len, label_seed.data_len); |
4202 | 0 | success = tls_hash(secret, &label_seed, md, out, out_len); |
4203 | 0 | g_free(label_seed.data); |
4204 | 0 | if(success != -1){ |
4205 | 0 | ssl_print_string("PRF out", out); |
4206 | 0 | return true; |
4207 | 0 | } |
4208 | 0 | return false; |
4209 | 0 | } |
4210 | | |
4211 | | static bool |
4212 | | ssl3_generate_export_iv(StringInfo *r1, StringInfo *r2, |
4213 | | StringInfo *out, unsigned out_len) |
4214 | 0 | { |
4215 | 0 | SSL_MD5_CTX md5; |
4216 | 0 | uint8_t tmp[16]; |
4217 | |
|
4218 | 0 | if (ssl_md5_init(&md5) != 0) { |
4219 | 0 | return false; |
4220 | 0 | } |
4221 | 0 | ssl_md5_update(&md5,r1->data,r1->data_len); |
4222 | 0 | ssl_md5_update(&md5,r2->data,r2->data_len); |
4223 | 0 | ssl_md5_final(tmp,&md5); |
4224 | 0 | ssl_md5_cleanup(&md5); |
4225 | |
|
4226 | 0 | DISSECTOR_ASSERT(out_len <= sizeof(tmp)); |
4227 | 0 | ssl_data_set(out, tmp, out_len); |
4228 | 0 | ssl_print_string("export iv", out); |
4229 | 0 | return true; |
4230 | 0 | } |
4231 | | |
4232 | | static bool |
4233 | | ssl3_prf(StringInfo* secret, const char* usage, |
4234 | | StringInfo* rnd1, StringInfo* rnd2, StringInfo* out, unsigned out_len) |
4235 | 0 | { |
4236 | 0 | SSL_MD5_CTX md5; |
4237 | 0 | SSL_SHA_CTX sha; |
4238 | 0 | unsigned off; |
4239 | 0 | int i = 0,j; |
4240 | 0 | uint8_t buf[20]; |
4241 | |
|
4242 | 0 | if (ssl_sha_init(&sha) != 0) { |
4243 | 0 | return false; |
4244 | 0 | } |
4245 | 0 | if (ssl_md5_init(&md5) != 0) { |
4246 | 0 | ssl_sha_cleanup(&sha); |
4247 | 0 | return false; |
4248 | 0 | } |
4249 | 0 | for (off = 0; off < out_len; off += 16) { |
4250 | 0 | unsigned char outbuf[16]; |
4251 | 0 | i++; |
4252 | |
|
4253 | 0 | ssl_debug_printf("ssl3_prf: sha1_hash(%d)\n",i); |
4254 | | /* A, BB, CCC, ... */ |
4255 | 0 | for(j=0;j<i;j++){ |
4256 | 0 | buf[j]=64+i; |
4257 | 0 | } |
4258 | |
|
4259 | 0 | ssl_sha_update(&sha,buf,i); |
4260 | 0 | ssl_sha_update(&sha,secret->data,secret->data_len); |
4261 | |
|
4262 | 0 | if(!strcmp(usage,"client write key") || !strcmp(usage,"server write key")){ |
4263 | 0 | if (rnd2) |
4264 | 0 | ssl_sha_update(&sha,rnd2->data,rnd2->data_len); |
4265 | 0 | ssl_sha_update(&sha,rnd1->data,rnd1->data_len); |
4266 | 0 | } |
4267 | 0 | else{ |
4268 | 0 | ssl_sha_update(&sha,rnd1->data,rnd1->data_len); |
4269 | 0 | if (rnd2) |
4270 | 0 | ssl_sha_update(&sha,rnd2->data,rnd2->data_len); |
4271 | 0 | } |
4272 | |
|
4273 | 0 | ssl_sha_final(buf,&sha); |
4274 | 0 | ssl_sha_reset(&sha); |
4275 | |
|
4276 | 0 | ssl_debug_printf("ssl3_prf: md5_hash(%d) datalen %d\n",i, |
4277 | 0 | secret->data_len); |
4278 | 0 | ssl_md5_update(&md5,secret->data,secret->data_len); |
4279 | 0 | ssl_md5_update(&md5,buf,20); |
4280 | 0 | ssl_md5_final(outbuf,&md5); |
4281 | 0 | ssl_md5_reset(&md5); |
4282 | |
|
4283 | 0 | memcpy(out->data + off, outbuf, MIN(out_len - off, 16)); |
4284 | 0 | } |
4285 | 0 | ssl_sha_cleanup(&sha); |
4286 | 0 | ssl_md5_cleanup(&md5); |
4287 | 0 | out->data_len = out_len; |
4288 | |
|
4289 | 0 | return true; |
4290 | 0 | } |
4291 | | |
4292 | | /* out_len is the wanted output length for the pseudorandom function. |
4293 | | * Ensure that ssl->cipher_suite is set. */ |
4294 | | static bool |
4295 | | prf(SslDecryptSession *ssl, StringInfo *secret, const char *usage, |
4296 | | StringInfo *rnd1, StringInfo *rnd2, StringInfo *out, unsigned out_len) |
4297 | 0 | { |
4298 | 0 | switch (ssl->session.version) { |
4299 | 0 | case SSLV3_VERSION: |
4300 | 0 | return ssl3_prf(secret, usage, rnd1, rnd2, out, out_len); |
4301 | | |
4302 | 0 | case TLSV1_VERSION: |
4303 | 0 | case TLSV1DOT1_VERSION: |
4304 | 0 | case DTLSV1DOT0_VERSION: |
4305 | 0 | case DTLSV1DOT0_OPENSSL_VERSION: |
4306 | 0 | return tls_prf(secret, usage, rnd1, rnd2, out, out_len); |
4307 | | |
4308 | 0 | default: /* TLSv1.2 */ |
4309 | 0 | switch (ssl->cipher_suite->dig) { |
4310 | 0 | case DIG_SM3: |
4311 | | #if GCRYPT_VERSION_NUMBER >= 0x010900 |
4312 | | return tls12_prf(GCRY_MD_SM3, secret, usage, rnd1, rnd2, |
4313 | | out, out_len); |
4314 | | #else |
4315 | 0 | return false; |
4316 | 0 | #endif |
4317 | 0 | case DIG_SHA384: |
4318 | 0 | return tls12_prf(GCRY_MD_SHA384, secret, usage, rnd1, rnd2, |
4319 | 0 | out, out_len); |
4320 | 0 | default: |
4321 | 0 | return tls12_prf(GCRY_MD_SHA256, secret, usage, rnd1, rnd2, |
4322 | 0 | out, out_len); |
4323 | 0 | } |
4324 | 0 | } |
4325 | 0 | } |
4326 | | |
4327 | | static int tls_handshake_hash(SslDecryptSession* ssl, StringInfo* out) |
4328 | 0 | { |
4329 | 0 | SSL_MD5_CTX md5; |
4330 | 0 | SSL_SHA_CTX sha; |
4331 | |
|
4332 | 0 | if (ssl_data_alloc(out, 36) < 0) |
4333 | 0 | return -1; |
4334 | | |
4335 | 0 | if (ssl_md5_init(&md5) != 0) |
4336 | 0 | return -1; |
4337 | 0 | ssl_md5_update(&md5,ssl->handshake_data.data,ssl->handshake_data.data_len); |
4338 | 0 | ssl_md5_final(out->data,&md5); |
4339 | 0 | ssl_md5_cleanup(&md5); |
4340 | |
|
4341 | 0 | if (ssl_sha_init(&sha) != 0) |
4342 | 0 | return -1; |
4343 | 0 | ssl_sha_update(&sha,ssl->handshake_data.data,ssl->handshake_data.data_len); |
4344 | 0 | ssl_sha_final(out->data+16,&sha); |
4345 | 0 | ssl_sha_cleanup(&sha); |
4346 | 0 | return 0; |
4347 | 0 | } |
4348 | | |
4349 | | static int tls12_handshake_hash(SslDecryptSession* ssl, int md, StringInfo* out) |
4350 | 0 | { |
4351 | 0 | SSL_MD mc; |
4352 | 0 | uint8_t tmp[48]; |
4353 | 0 | unsigned len; |
4354 | |
|
4355 | 0 | if (ssl_md_init(&mc, md) != 0) |
4356 | 0 | return -1; |
4357 | 0 | ssl_md_update(&mc,ssl->handshake_data.data,ssl->handshake_data.data_len); |
4358 | 0 | ssl_md_final(&mc, tmp, &len); |
4359 | 0 | ssl_md_cleanup(&mc); |
4360 | |
|
4361 | 0 | if (ssl_data_alloc(out, len) < 0) |
4362 | 0 | return -1; |
4363 | 0 | memcpy(out->data, tmp, len); |
4364 | 0 | return 0; |
4365 | 0 | } |
4366 | | |
4367 | | /** |
4368 | | * Obtains the label prefix used in HKDF-Expand-Label. This function can be |
4369 | | * inlined and removed once support for draft 19 and before is dropped. |
4370 | | */ |
4371 | | static inline const char * |
4372 | | tls13_hkdf_label_prefix(SslDecryptSession *ssl_session) |
4373 | 0 | { |
4374 | 0 | if (ssl_session->session.tls13_draft_version && ssl_session->session.tls13_draft_version < 20) { |
4375 | 0 | return "TLS 1.3, "; |
4376 | 0 | } else if (ssl_session->session.version == DTLSV1DOT3_VERSION) { |
4377 | 0 | return "dtls13"; |
4378 | 0 | } else { |
4379 | 0 | return "tls13 "; |
4380 | 0 | } |
4381 | 0 | } |
4382 | | |
4383 | | /* |
4384 | | * Computes HKDF-Expand-Label(Secret, Label, Hash(context_value), Length) with a |
4385 | | * custom label prefix. If "context_hash" is NULL, then an empty context is |
4386 | | * used. Otherwise it must have the same length as the hash algorithm output. |
4387 | | */ |
4388 | | bool |
4389 | | tls13_hkdf_expand_label_context(int md, const StringInfo *secret, |
4390 | | const char *label_prefix, const char *label, |
4391 | | const uint8_t *context_hash, uint8_t context_length, |
4392 | | uint16_t out_len, unsigned char **out) |
4393 | 144 | { |
4394 | | /* RFC 8446 Section 7.1: |
4395 | | * HKDF-Expand-Label(Secret, Label, Context, Length) = |
4396 | | * HKDF-Expand(Secret, HkdfLabel, Length) |
4397 | | * struct { |
4398 | | * uint16 length = Length; |
4399 | | * opaque label<7..255> = "tls13 " + Label; // "tls13 " is label prefix. |
4400 | | * opaque context<0..255> = Context; |
4401 | | * } HkdfLabel; |
4402 | | * |
4403 | | * RFC 5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF): |
4404 | | * HKDF-Expand(PRK, info, L) -> OKM |
4405 | | */ |
4406 | 144 | gcry_error_t err; |
4407 | 144 | const unsigned label_prefix_length = (unsigned) strlen(label_prefix); |
4408 | 144 | const unsigned label_length = (unsigned) strlen(label); |
4409 | | |
4410 | | /* Some sanity checks */ |
4411 | 144 | DISSECTOR_ASSERT(label_length > 0 && label_prefix_length + label_length <= 255); |
4412 | | |
4413 | | /* info = HkdfLabel { length, label, context } */ |
4414 | 144 | GByteArray *info = g_byte_array_new(); |
4415 | 144 | const uint16_t length = g_htons(out_len); |
4416 | 144 | g_byte_array_append(info, (const uint8_t *)&length, sizeof(length)); |
4417 | | |
4418 | 144 | const uint8_t label_vector_length = label_prefix_length + label_length; |
4419 | 144 | g_byte_array_append(info, &label_vector_length, 1); |
4420 | 144 | g_byte_array_append(info, (const uint8_t *)label_prefix, label_prefix_length); |
4421 | 144 | g_byte_array_append(info, (const uint8_t*)label, label_length); |
4422 | | |
4423 | 144 | g_byte_array_append(info, &context_length, 1); |
4424 | 144 | if (context_length) { |
4425 | 0 | g_byte_array_append(info, context_hash, context_length); |
4426 | 0 | } |
4427 | | |
4428 | 144 | *out = (unsigned char *)wmem_alloc(NULL, out_len); |
4429 | 144 | err = hkdf_expand(md, secret->data, secret->data_len, info->data, info->len, *out, out_len); |
4430 | 144 | g_byte_array_free(info, true); |
4431 | | |
4432 | 144 | if (err) { |
4433 | 0 | ssl_debug_printf("%s failed %d: %s\n", G_STRFUNC, md, gcry_strerror(err)); |
4434 | 0 | wmem_free(NULL, *out); |
4435 | 0 | *out = NULL; |
4436 | 0 | return false; |
4437 | 0 | } |
4438 | | |
4439 | 144 | return true; |
4440 | 144 | } |
4441 | | |
4442 | | bool |
4443 | | tls13_hkdf_expand_label(int md, const StringInfo *secret, |
4444 | | const char *label_prefix, const char *label, |
4445 | | uint16_t out_len, unsigned char **out) |
4446 | 144 | { |
4447 | 144 | return tls13_hkdf_expand_label_context(md, secret, label_prefix, label, NULL, 0, out_len, out); |
4448 | 144 | } |
4449 | | /* HMAC and the Pseudorandom function }}} */ |
4450 | | |
4451 | | /* Record Decompression (after decryption) {{{ */ |
4452 | | #ifdef USE_ZLIB_OR_ZLIBNG |
4453 | | /* memory allocation functions for zlib initialization */ |
4454 | | static void* ssl_zalloc(void* opaque _U_, unsigned int no, unsigned int size) |
4455 | 0 | { |
4456 | 0 | return g_malloc0(no*size); |
4457 | 0 | } |
4458 | | static void ssl_zfree(void* opaque _U_, void* addr) |
4459 | 0 | { |
4460 | 0 | g_free(addr); |
4461 | 0 | } |
4462 | | #endif /* USE_ZLIB_OR_ZLIBNG */ |
4463 | | |
4464 | | static SslDecompress* |
4465 | | ssl_create_decompressor(int compression) |
4466 | 0 | { |
4467 | 0 | SslDecompress *decomp; |
4468 | 0 | #ifdef USE_ZLIB_OR_ZLIBNG |
4469 | 0 | int err; |
4470 | 0 | #endif |
4471 | |
|
4472 | 0 | if (compression == 0) return NULL; |
4473 | 0 | ssl_debug_printf("ssl_create_decompressor: compression method %d\n", compression); |
4474 | 0 | decomp = wmem_new(wmem_file_scope(), SslDecompress); |
4475 | 0 | decomp->compression = compression; |
4476 | 0 | switch (decomp->compression) { |
4477 | 0 | #ifdef USE_ZLIB_OR_ZLIBNG |
4478 | 0 | case 1: /* DEFLATE */ |
4479 | 0 | decomp->istream.zalloc = ssl_zalloc; |
4480 | 0 | decomp->istream.zfree = ssl_zfree; |
4481 | 0 | decomp->istream.opaque = Z_NULL; |
4482 | 0 | decomp->istream.next_in = Z_NULL; |
4483 | 0 | decomp->istream.next_out = Z_NULL; |
4484 | 0 | decomp->istream.avail_in = 0; |
4485 | 0 | decomp->istream.avail_out = 0; |
4486 | 0 | err = ZLIB_PREFIX(inflateInit)(&decomp->istream); |
4487 | 0 | if (err != Z_OK) { |
4488 | 0 | ssl_debug_printf("ssl_create_decompressor: inflateInit_() failed - %d\n", err); |
4489 | 0 | return NULL; |
4490 | 0 | } |
4491 | 0 | break; |
4492 | 0 | #endif /* USE_ZLIB_OR_ZLIBNG */ |
4493 | 0 | default: |
4494 | 0 | ssl_debug_printf("ssl_create_decompressor: unsupported compression method %d\n", decomp->compression); |
4495 | 0 | return NULL; |
4496 | 0 | } |
4497 | 0 | return decomp; |
4498 | 0 | } |
4499 | | |
4500 | | #ifdef USE_ZLIB_OR_ZLIBNG |
4501 | | static int |
4502 | | ssl_decompress_record(SslDecompress* decomp, const unsigned char* in, unsigned inl, StringInfo* out_str, unsigned* outl) |
4503 | 0 | { |
4504 | 0 | int err; |
4505 | |
|
4506 | 0 | switch (decomp->compression) { |
4507 | 0 | case 1: /* DEFLATE */ |
4508 | 0 | err = Z_OK; |
4509 | 0 | if (out_str->data_len < 16384) { /* maximal plain length */ |
4510 | 0 | ssl_data_realloc(out_str, 16384); |
4511 | 0 | } |
4512 | 0 | #ifdef z_const |
4513 | 0 | decomp->istream.next_in = in; |
4514 | | #else |
4515 | | DIAG_OFF(cast-qual) |
4516 | | decomp->istream.next_in = (Bytef *)in; |
4517 | | DIAG_ON(cast-qual) |
4518 | | #endif |
4519 | 0 | decomp->istream.avail_in = inl; |
4520 | 0 | decomp->istream.next_out = out_str->data; |
4521 | 0 | decomp->istream.avail_out = out_str->data_len; |
4522 | 0 | if (inl > 0) |
4523 | 0 | err = ZLIB_PREFIX(inflate)(&decomp->istream, Z_SYNC_FLUSH); |
4524 | 0 | if (err != Z_OK) { |
4525 | 0 | ssl_debug_printf("ssl_decompress_record: inflate() failed - %d\n", err); |
4526 | 0 | return -1; |
4527 | 0 | } |
4528 | 0 | *outl = out_str->data_len - decomp->istream.avail_out; |
4529 | 0 | break; |
4530 | 0 | default: |
4531 | 0 | ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression); |
4532 | 0 | return -1; |
4533 | 0 | } |
4534 | 0 | return 0; |
4535 | 0 | } |
4536 | | #else /* USE_ZLIB_OR_ZLIBNG */ |
4537 | | int |
4538 | | ssl_decompress_record(SslDecompress* decomp _U_, const unsigned char* in _U_, unsigned inl _U_, StringInfo* out_str _U_, unsigned* outl _U_) |
4539 | | { |
4540 | | ssl_debug_printf("ssl_decompress_record: unsupported compression method %d\n", decomp->compression); |
4541 | | return -1; |
4542 | | } |
4543 | | #endif /* USE_ZLIB_OR_ZLIBNG */ |
4544 | | /* Record Decompression (after decryption) }}} */ |
4545 | | |
4546 | | /* Create a new structure to store decrypted chunks. {{{ */ |
4547 | | static SslFlow* |
4548 | | ssl_create_flow(void) |
4549 | 0 | { |
4550 | 0 | SslFlow *flow; |
4551 | |
|
4552 | 0 | flow = wmem_new(wmem_file_scope(), SslFlow); |
4553 | 0 | flow->byte_seq = 0; |
4554 | 0 | flow->flags = 0; |
4555 | 0 | flow->multisegment_pdus = wmem_tree_new(wmem_file_scope()); |
4556 | 0 | return flow; |
4557 | 0 | } |
4558 | | /* }}} */ |
4559 | | |
4560 | | /* Use the negotiated security parameters for decryption. {{{ */ |
4561 | | void |
4562 | | ssl_change_cipher(SslDecryptSession *ssl_session, bool server) |
4563 | 5 | { |
4564 | 5 | SslDecoder **new_decoder = server ? &ssl_session->server_new : &ssl_session->client_new; |
4565 | 5 | SslDecoder **dest = server ? &ssl_session->server : &ssl_session->client; |
4566 | 5 | ssl_debug_printf("ssl_change_cipher %s%s\n", server ? "SERVER" : "CLIENT", |
4567 | 5 | *new_decoder ? "" : " (No decoder found - retransmission?)"); |
4568 | 5 | if (*new_decoder) { |
4569 | 0 | *dest = *new_decoder; |
4570 | 0 | *new_decoder = NULL; |
4571 | 0 | } |
4572 | 5 | } |
4573 | | /* }}} */ |
4574 | | |
4575 | | /* Init cipher state given some security parameters. {{{ */ |
4576 | | static bool |
4577 | | ssl_decoder_destroy_cb(wmem_allocator_t *, wmem_cb_event_t, void *); |
4578 | | |
4579 | | static SslDecoder* |
4580 | | ssl_create_decoder(const SslCipherSuite *cipher_suite, int cipher_algo, |
4581 | | int compression, uint8_t *mk, uint8_t *sk, uint8_t *sn_key, uint8_t *iv, unsigned iv_length) |
4582 | 0 | { |
4583 | 0 | SslDecoder *dec; |
4584 | 0 | ssl_cipher_mode_t mode = cipher_suite->mode; |
4585 | |
|
4586 | 0 | dec = wmem_new0(wmem_file_scope(), SslDecoder); |
4587 | | /* init mac buffer: mac storage is embedded into decoder struct to save a |
4588 | | memory allocation and waste samo more memory*/ |
4589 | 0 | dec->cipher_suite=cipher_suite; |
4590 | 0 | dec->compression = compression; |
4591 | 0 | if ((mode == MODE_STREAM && mk != NULL) || mode == MODE_CBC) { |
4592 | | // AEAD ciphers use no MAC key, but stream and block ciphers do. Note |
4593 | | // the special case for NULL ciphers, even if there is insufficiency |
4594 | | // keying material (including MAC key), we will can still create |
4595 | | // decoders since "decryption" is easy for such ciphers. |
4596 | 0 | dec->mac_key.data = dec->_mac_key_or_write_iv; |
4597 | 0 | ssl_data_set(&dec->mac_key, mk, ssl_cipher_suite_dig(cipher_suite)->len); |
4598 | 0 | } else if (mode == MODE_GCM || mode == MODE_CCM || mode == MODE_CCM_8 || mode == MODE_POLY1305) { |
4599 | | // Input for the nonce, to be used with AEAD ciphers. |
4600 | 0 | DISSECTOR_ASSERT(iv_length <= sizeof(dec->_mac_key_or_write_iv)); |
4601 | 0 | dec->write_iv.data = dec->_mac_key_or_write_iv; |
4602 | 0 | ssl_data_set(&dec->write_iv, iv, iv_length); |
4603 | 0 | } |
4604 | 0 | dec->seq = 0; |
4605 | 0 | dec->decomp = ssl_create_decompressor(compression); |
4606 | 0 | wmem_register_callback(wmem_file_scope(), ssl_decoder_destroy_cb, dec); |
4607 | |
|
4608 | 0 | if (ssl_cipher_init(&dec->evp,cipher_algo,sk,iv,cipher_suite->mode) < 0) { |
4609 | 0 | ssl_debug_printf("%s: can't create cipher id:%d mode:%d\n", G_STRFUNC, |
4610 | 0 | cipher_algo, cipher_suite->mode); |
4611 | 0 | return NULL; |
4612 | 0 | } |
4613 | | |
4614 | 0 | if (cipher_suite->enc != ENC_NULL && sn_key != NULL) { |
4615 | 0 | if (cipher_suite->enc == ENC_AES || cipher_suite->enc == ENC_AES256) { |
4616 | 0 | mode = MODE_ECB; |
4617 | 0 | } else if (cipher_suite->enc == ENC_CHACHA20) { |
4618 | 0 | mode = MODE_STREAM; |
4619 | 0 | } else { |
4620 | 0 | ssl_debug_printf("not supported encryption algorithm for DTLSv1.3\n"); |
4621 | 0 | return NULL; |
4622 | 0 | } |
4623 | | |
4624 | 0 | if (ssl_cipher_init(&dec->sn_evp, cipher_algo, sn_key, NULL, mode) < 0) { |
4625 | 0 | ssl_debug_printf("%s: can't create cipher id:%d mode:%d for seq number decryption\n", G_STRFUNC, |
4626 | 0 | cipher_algo, MODE_ECB); |
4627 | 0 | ssl_cipher_cleanup(&dec->evp); |
4628 | 0 | dec->evp = NULL; |
4629 | 0 | return NULL; |
4630 | 0 | } |
4631 | 0 | } else { |
4632 | 0 | dec->sn_evp = NULL; |
4633 | 0 | } |
4634 | | |
4635 | 0 | dec->dtls13_aad.data = NULL; |
4636 | 0 | dec->dtls13_aad.data_len = 0; |
4637 | 0 | ssl_debug_printf("decoder initialized (digest len %d)\n", ssl_cipher_suite_dig(cipher_suite)->len); |
4638 | 0 | return dec; |
4639 | 0 | } |
4640 | | |
4641 | | static bool |
4642 | | ssl_decoder_destroy_cb(wmem_allocator_t *allocator _U_, wmem_cb_event_t event _U_, void *user_data) |
4643 | 0 | { |
4644 | 0 | SslDecoder *dec = (SslDecoder *) user_data; |
4645 | |
|
4646 | 0 | if (dec->evp) |
4647 | 0 | ssl_cipher_cleanup(&dec->evp); |
4648 | 0 | if (dec->sn_evp) |
4649 | 0 | ssl_cipher_cleanup(&dec->sn_evp); |
4650 | |
|
4651 | 0 | #ifdef USE_ZLIB_OR_ZLIBNG |
4652 | 0 | if (dec->decomp != NULL && dec->decomp->compression == 1 /* DEFLATE */) |
4653 | 0 | ZLIB_PREFIX(inflateEnd)(&dec->decomp->istream); |
4654 | 0 | #endif |
4655 | |
|
4656 | 0 | return false; |
4657 | 0 | } |
4658 | | /* }}} */ |
4659 | | |
4660 | | /* (Pre-)master secrets calculations {{{ */ |
4661 | | #ifdef HAVE_LIBGNUTLS |
4662 | | static bool |
4663 | | ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session, |
4664 | | StringInfo *encrypted_pre_master, |
4665 | | GHashTable *key_hash); |
4666 | | #endif /* HAVE_LIBGNUTLS */ |
4667 | | |
4668 | | static bool |
4669 | | ssl_restore_master_key(SslDecryptSession *ssl, const char *label, |
4670 | | bool is_pre_master, GHashTable *ht, StringInfo *key); |
4671 | | |
4672 | | bool |
4673 | | ssl_generate_pre_master_secret(SslDecryptSession *ssl_session, |
4674 | | uint32_t length, tvbuff_t *tvb, uint32_t offset, |
4675 | | const char *ssl_psk, packet_info *pinfo, |
4676 | | #ifdef HAVE_LIBGNUTLS |
4677 | | GHashTable *key_hash, |
4678 | | #endif |
4679 | | const ssl_master_key_map_t *mk_map) |
4680 | 3 | { |
4681 | | /* check for required session data */ |
4682 | 3 | ssl_debug_printf("%s: found SSL_HND_CLIENT_KEY_EXCHG, state %X\n", |
4683 | 3 | G_STRFUNC, ssl_session->state); |
4684 | 3 | if ((ssl_session->state & (SSL_CIPHER|SSL_CLIENT_RANDOM|SSL_SERVER_RANDOM|SSL_VERSION)) != |
4685 | 3 | (SSL_CIPHER|SSL_CLIENT_RANDOM|SSL_SERVER_RANDOM|SSL_VERSION)) { |
4686 | 3 | ssl_debug_printf("%s: not enough data to generate key (required state %X)\n", G_STRFUNC, |
4687 | 3 | (SSL_CIPHER|SSL_CLIENT_RANDOM|SSL_SERVER_RANDOM|SSL_VERSION)); |
4688 | 3 | return false; |
4689 | 3 | } |
4690 | | |
4691 | 0 | if (ssl_session->session.version == TLSV1DOT3_VERSION) { |
4692 | 0 | ssl_debug_printf("%s: detected TLS 1.3 which has no pre-master secrets\n", G_STRFUNC); |
4693 | 0 | return false; |
4694 | 0 | } |
4695 | | |
4696 | | /* check to see if the PMS was provided to us*/ |
4697 | 0 | if (ssl_restore_master_key(ssl_session, "Unencrypted pre-master secret", true, |
4698 | 0 | mk_map->pms, &ssl_session->client_random)) { |
4699 | 0 | return true; |
4700 | 0 | } |
4701 | | |
4702 | 0 | if (ssl_session->cipher_suite->kex == KEX_PSK) |
4703 | 0 | { |
4704 | | /* calculate pre master secret*/ |
4705 | 0 | StringInfo pre_master_secret; |
4706 | 0 | unsigned psk_len, pre_master_len; |
4707 | |
|
4708 | 0 | if (!ssl_psk || (ssl_psk[0] == 0)) { |
4709 | 0 | ssl_debug_printf("%s: can't find pre-shared key\n", G_STRFUNC); |
4710 | 0 | return false; |
4711 | 0 | } |
4712 | | |
4713 | | /* convert hex string into char*/ |
4714 | 0 | if (!from_hex(&ssl_session->psk, ssl_psk, strlen(ssl_psk))) { |
4715 | 0 | ssl_debug_printf("%s: ssl.psk/dtls.psk contains invalid hex\n", |
4716 | 0 | G_STRFUNC); |
4717 | 0 | return false; |
4718 | 0 | } |
4719 | | |
4720 | 0 | psk_len = ssl_session->psk.data_len; |
4721 | 0 | if (psk_len >= (2 << 15)) { |
4722 | 0 | ssl_debug_printf("%s: ssl.psk/dtls.psk must not be larger than 2^15 - 1\n", |
4723 | 0 | G_STRFUNC); |
4724 | 0 | return false; |
4725 | 0 | } |
4726 | | |
4727 | | |
4728 | 0 | pre_master_len = psk_len * 2 + 4; |
4729 | |
|
4730 | 0 | pre_master_secret.data = (unsigned char *)wmem_alloc(wmem_file_scope(), pre_master_len); |
4731 | 0 | pre_master_secret.data_len = pre_master_len; |
4732 | | /* 2 bytes psk_len*/ |
4733 | 0 | pre_master_secret.data[0] = psk_len >> 8; |
4734 | 0 | pre_master_secret.data[1] = psk_len & 0xFF; |
4735 | | /* psk_len bytes times 0*/ |
4736 | 0 | memset(&pre_master_secret.data[2], 0, psk_len); |
4737 | | /* 2 bytes psk_len*/ |
4738 | 0 | pre_master_secret.data[psk_len + 2] = psk_len >> 8; |
4739 | 0 | pre_master_secret.data[psk_len + 3] = psk_len & 0xFF; |
4740 | | /* psk*/ |
4741 | 0 | memcpy(&pre_master_secret.data[psk_len + 4], ssl_session->psk.data, psk_len); |
4742 | |
|
4743 | 0 | ssl_session->pre_master_secret.data = pre_master_secret.data; |
4744 | 0 | ssl_session->pre_master_secret.data_len = pre_master_len; |
4745 | | /*ssl_debug_printf("pre master secret",&ssl->pre_master_secret);*/ |
4746 | | |
4747 | | /* Remove the master secret if it was there. |
4748 | | This forces keying material regeneration in |
4749 | | case we're renegotiating */ |
4750 | 0 | ssl_session->state &= ~(SSL_MASTER_SECRET|SSL_HAVE_SESSION_KEY); |
4751 | 0 | ssl_session->state |= SSL_PRE_MASTER_SECRET; |
4752 | 0 | return true; |
4753 | 0 | } |
4754 | 0 | else |
4755 | 0 | { |
4756 | 0 | unsigned encrlen, skip; |
4757 | 0 | encrlen = length; |
4758 | 0 | skip = 0; |
4759 | | |
4760 | | /* get encrypted data, on tls1 we have to skip two bytes |
4761 | | * (it's the encrypted len and should be equal to record len - 2) |
4762 | | * in case of rsa1024 that would be 128 + 2 = 130; for psk not necessary |
4763 | | */ |
4764 | 0 | if (ssl_session->cipher_suite->kex == KEX_RSA && |
4765 | 0 | (ssl_session->session.version == TLSV1_VERSION || |
4766 | 0 | ssl_session->session.version == TLSV1DOT1_VERSION || |
4767 | 0 | ssl_session->session.version == TLSV1DOT2_VERSION || |
4768 | 0 | ssl_session->session.version == DTLSV1DOT0_VERSION || |
4769 | 0 | ssl_session->session.version == DTLSV1DOT2_VERSION || |
4770 | 0 | ssl_session->session.version == TLCPV1_VERSION )) |
4771 | 0 | { |
4772 | 0 | encrlen = tvb_get_ntohs(tvb, offset); |
4773 | 0 | skip = 2; |
4774 | 0 | if (encrlen > length - 2) |
4775 | 0 | { |
4776 | 0 | ssl_debug_printf("%s: wrong encrypted length (%d max %d)\n", |
4777 | 0 | G_STRFUNC, encrlen, length); |
4778 | 0 | return false; |
4779 | 0 | } |
4780 | 0 | } |
4781 | | /* the valid lower bound is higher than 8, but it is sufficient for the |
4782 | | * ssl keylog file below */ |
4783 | 0 | if (encrlen < 8) { |
4784 | 0 | ssl_debug_printf("%s: invalid encrypted pre-master key length %d\n", |
4785 | 0 | G_STRFUNC, encrlen); |
4786 | 0 | return false; |
4787 | 0 | } |
4788 | | |
4789 | 0 | StringInfo encrypted_pre_master = { |
4790 | 0 | .data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset + skip, encrlen), |
4791 | 0 | .data_len = encrlen, |
4792 | 0 | }; |
4793 | |
|
4794 | | #ifdef HAVE_LIBGNUTLS |
4795 | | /* Try to lookup an appropriate RSA private key to decrypt the Encrypted Pre-Master Secret. */ |
4796 | | if (ssl_session->cert_key_id) { |
4797 | | if (ssl_decrypt_pre_master_secret(ssl_session, &encrypted_pre_master, key_hash)) |
4798 | | return true; |
4799 | | |
4800 | | ssl_debug_printf("%s: can't decrypt pre-master secret\n", |
4801 | | G_STRFUNC); |
4802 | | } |
4803 | | #endif /* HAVE_LIBGNUTLS */ |
4804 | | |
4805 | | /* try to find the pre-master secret from the encrypted one. The |
4806 | | * ssl key logfile stores only the first 8 bytes, so truncate it */ |
4807 | 0 | encrypted_pre_master.data_len = 8; |
4808 | 0 | if (ssl_restore_master_key(ssl_session, "Encrypted pre-master secret", |
4809 | 0 | true, mk_map->pre_master, &encrypted_pre_master)) |
4810 | 0 | return true; |
4811 | 0 | } |
4812 | 0 | return false; |
4813 | 0 | } |
4814 | | |
4815 | | /* Used for (D)TLS 1.2 and earlier versions (not with TLS 1.3). */ |
4816 | | int |
4817 | | ssl_generate_keyring_material(SslDecryptSession*ssl_session) |
4818 | 0 | { |
4819 | 0 | StringInfo key_block = { NULL, 0 }; |
4820 | 0 | uint8_t _iv_c[MAX_BLOCK_SIZE],_iv_s[MAX_BLOCK_SIZE]; |
4821 | 0 | uint8_t _key_c[MAX_KEY_SIZE],_key_s[MAX_KEY_SIZE]; |
4822 | 0 | int needed; |
4823 | 0 | int cipher_algo = -1; /* special value (-1) for NULL encryption */ |
4824 | 0 | unsigned encr_key_len, write_iv_len = 0; |
4825 | 0 | bool is_export_cipher; |
4826 | 0 | uint8_t *ptr, *c_iv = NULL, *s_iv = NULL; |
4827 | 0 | uint8_t *c_wk = NULL, *s_wk = NULL, *c_mk = NULL, *s_mk = NULL; |
4828 | 0 | const SslCipherSuite *cipher_suite = ssl_session->cipher_suite; |
4829 | | |
4830 | | /* (D)TLS 1.3 is handled directly in tls13_change_key. */ |
4831 | 0 | if (ssl_session->session.version == TLSV1DOT3_VERSION || ssl_session->session.version == DTLSV1DOT3_VERSION) { |
4832 | 0 | ssl_debug_printf("%s: detected TLS 1.3. Should not have been called!\n", G_STRFUNC); |
4833 | 0 | return -1; |
4834 | 0 | } |
4835 | | |
4836 | | /* check for enough info to proceed */ |
4837 | 0 | unsigned need_all = SSL_CIPHER|SSL_CLIENT_RANDOM|SSL_SERVER_RANDOM|SSL_VERSION; |
4838 | 0 | unsigned need_any = SSL_MASTER_SECRET | SSL_PRE_MASTER_SECRET; |
4839 | 0 | if (((ssl_session->state & need_all) != need_all) || ((ssl_session->state & need_any) == 0)) { |
4840 | 0 | ssl_debug_printf("ssl_generate_keyring_material not enough data to generate key " |
4841 | 0 | "(0x%02X required 0x%02X or 0x%02X)\n", ssl_session->state, |
4842 | 0 | need_all|SSL_MASTER_SECRET, need_all|SSL_PRE_MASTER_SECRET); |
4843 | | /* Special case: for NULL encryption, allow dissection of data even if |
4844 | | * the Client Hello is missing (MAC keys are now skipped though). */ |
4845 | 0 | need_all = SSL_CIPHER|SSL_VERSION; |
4846 | 0 | if ((ssl_session->state & need_all) == need_all && |
4847 | 0 | cipher_suite->enc == ENC_NULL) { |
4848 | 0 | ssl_debug_printf("%s NULL cipher found, will create a decoder but " |
4849 | 0 | "skip MAC validation as keys are missing.\n", G_STRFUNC); |
4850 | 0 | goto create_decoders; |
4851 | 0 | } |
4852 | | |
4853 | 0 | return -1; |
4854 | 0 | } |
4855 | | |
4856 | | /* if master key is not available, generate is from the pre-master secret */ |
4857 | 0 | if (!(ssl_session->state & SSL_MASTER_SECRET)) { |
4858 | 0 | if ((ssl_session->state & SSL_EXTENDED_MASTER_SECRET_MASK) == SSL_EXTENDED_MASTER_SECRET_MASK) { |
4859 | 0 | StringInfo handshake_hashed_data; |
4860 | 0 | int ret; |
4861 | |
|
4862 | 0 | handshake_hashed_data.data = NULL; |
4863 | 0 | handshake_hashed_data.data_len = 0; |
4864 | |
|
4865 | 0 | ssl_debug_printf("%s:PRF(pre_master_secret_extended)\n", G_STRFUNC); |
4866 | 0 | ssl_print_string("pre master secret",&ssl_session->pre_master_secret); |
4867 | 0 | DISSECTOR_ASSERT(ssl_session->handshake_data.data_len > 0); |
4868 | |
|
4869 | 0 | switch(ssl_session->session.version) { |
4870 | 0 | case TLSV1_VERSION: |
4871 | 0 | case TLSV1DOT1_VERSION: |
4872 | 0 | case DTLSV1DOT0_VERSION: |
4873 | 0 | case DTLSV1DOT0_OPENSSL_VERSION: |
4874 | 0 | case TLCPV1_VERSION: |
4875 | 0 | ret = tls_handshake_hash(ssl_session, &handshake_hashed_data); |
4876 | 0 | break; |
4877 | 0 | default: |
4878 | 0 | switch (cipher_suite->dig) { |
4879 | 0 | case DIG_SHA384: |
4880 | 0 | ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA384, &handshake_hashed_data); |
4881 | 0 | break; |
4882 | 0 | default: |
4883 | 0 | ret = tls12_handshake_hash(ssl_session, GCRY_MD_SHA256, &handshake_hashed_data); |
4884 | 0 | break; |
4885 | 0 | } |
4886 | 0 | break; |
4887 | 0 | } |
4888 | 0 | if (ret) { |
4889 | 0 | ssl_debug_printf("%s can't generate handshake hash\n", G_STRFUNC); |
4890 | 0 | return -1; |
4891 | 0 | } |
4892 | | |
4893 | 0 | wmem_free(wmem_file_scope(), ssl_session->handshake_data.data); |
4894 | 0 | ssl_session->handshake_data.data = NULL; |
4895 | 0 | ssl_session->handshake_data.data_len = 0; |
4896 | |
|
4897 | 0 | if (!prf(ssl_session, &ssl_session->pre_master_secret, "extended master secret", |
4898 | 0 | &handshake_hashed_data, |
4899 | 0 | NULL, &ssl_session->master_secret, |
4900 | 0 | SSL_MASTER_SECRET_LENGTH)) { |
4901 | 0 | ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC); |
4902 | 0 | g_free(handshake_hashed_data.data); |
4903 | 0 | return -1; |
4904 | 0 | } |
4905 | 0 | g_free(handshake_hashed_data.data); |
4906 | 0 | } else { |
4907 | 0 | ssl_debug_printf("%s:PRF(pre_master_secret)\n", G_STRFUNC); |
4908 | 0 | ssl_print_string("pre master secret",&ssl_session->pre_master_secret); |
4909 | 0 | ssl_print_string("client random",&ssl_session->client_random); |
4910 | 0 | ssl_print_string("server random",&ssl_session->server_random); |
4911 | 0 | if (!prf(ssl_session, &ssl_session->pre_master_secret, "master secret", |
4912 | 0 | &ssl_session->client_random, |
4913 | 0 | &ssl_session->server_random, &ssl_session->master_secret, |
4914 | 0 | SSL_MASTER_SECRET_LENGTH)) { |
4915 | 0 | ssl_debug_printf("%s can't generate master_secret\n", G_STRFUNC); |
4916 | 0 | return -1; |
4917 | 0 | } |
4918 | 0 | } |
4919 | 0 | ssl_print_string("master secret",&ssl_session->master_secret); |
4920 | | |
4921 | | /* the pre-master secret has been 'consumed' so we must clear it now */ |
4922 | 0 | ssl_session->state &= ~SSL_PRE_MASTER_SECRET; |
4923 | 0 | ssl_session->state |= SSL_MASTER_SECRET; |
4924 | 0 | } |
4925 | | |
4926 | | /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */ |
4927 | 0 | if (cipher_suite->enc != ENC_NULL) { |
4928 | 0 | const char *cipher_name = ciphers[cipher_suite->enc-ENC_START]; |
4929 | 0 | ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC, cipher_name); |
4930 | 0 | cipher_algo = ssl_get_cipher_by_name(cipher_name); |
4931 | 0 | if (cipher_algo == 0) { |
4932 | 0 | ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC, cipher_name); |
4933 | 0 | return -1; |
4934 | 0 | } |
4935 | 0 | } |
4936 | | |
4937 | | /* Export ciphers consume less material from the key block. */ |
4938 | 0 | encr_key_len = ssl_get_cipher_export_keymat_size(cipher_suite->number); |
4939 | 0 | is_export_cipher = encr_key_len > 0; |
4940 | 0 | if (!is_export_cipher && cipher_suite->enc != ENC_NULL) { |
4941 | 0 | encr_key_len = (unsigned)gcry_cipher_get_algo_keylen(cipher_algo); |
4942 | 0 | } |
4943 | |
|
4944 | 0 | if (cipher_suite->mode == MODE_CBC) { |
4945 | 0 | write_iv_len = (unsigned)gcry_cipher_get_algo_blklen(cipher_algo); |
4946 | 0 | } else if (cipher_suite->mode == MODE_GCM || cipher_suite->mode == MODE_CCM || cipher_suite->mode == MODE_CCM_8) { |
4947 | | /* account for a four-byte salt for client and server side (from |
4948 | | * client_write_IV and server_write_IV), see GCMNonce (RFC 5288) */ |
4949 | 0 | write_iv_len = 4; |
4950 | 0 | } else if (cipher_suite->mode == MODE_POLY1305) { |
4951 | | /* RFC 7905: SecurityParameters.fixed_iv_length is twelve bytes */ |
4952 | 0 | write_iv_len = 12; |
4953 | 0 | } |
4954 | | |
4955 | | /* Compute the key block. First figure out how much data we need */ |
4956 | 0 | needed = ssl_cipher_suite_dig(cipher_suite)->len*2; /* MAC key */ |
4957 | 0 | needed += 2 * encr_key_len; /* encryption key */ |
4958 | 0 | needed += 2 * write_iv_len; /* write IV */ |
4959 | |
|
4960 | 0 | key_block.data = (unsigned char *)g_malloc(needed); |
4961 | 0 | ssl_debug_printf("%s sess key generation\n", G_STRFUNC); |
4962 | 0 | if (!prf(ssl_session, &ssl_session->master_secret, "key expansion", |
4963 | 0 | &ssl_session->server_random,&ssl_session->client_random, |
4964 | 0 | &key_block, needed)) { |
4965 | 0 | ssl_debug_printf("%s can't generate key_block\n", G_STRFUNC); |
4966 | 0 | goto fail; |
4967 | 0 | } |
4968 | 0 | ssl_print_string("key expansion", &key_block); |
4969 | |
|
4970 | 0 | ptr=key_block.data; |
4971 | | /* client/server write MAC key (for non-AEAD ciphers) */ |
4972 | 0 | if (cipher_suite->mode == MODE_STREAM || cipher_suite->mode == MODE_CBC) { |
4973 | 0 | c_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len; |
4974 | 0 | s_mk=ptr; ptr+=ssl_cipher_suite_dig(cipher_suite)->len; |
4975 | 0 | } |
4976 | | /* client/server write encryption key */ |
4977 | 0 | c_wk=ptr; ptr += encr_key_len; |
4978 | 0 | s_wk=ptr; ptr += encr_key_len; |
4979 | | /* client/server write IV (used as IV (for CBC) or salt (for AEAD)) */ |
4980 | 0 | if (write_iv_len > 0) { |
4981 | 0 | c_iv=ptr; ptr += write_iv_len; |
4982 | 0 | s_iv=ptr; /* ptr += write_iv_len; */ |
4983 | 0 | } |
4984 | | |
4985 | | /* export ciphers work with a smaller key length */ |
4986 | 0 | if (is_export_cipher) { |
4987 | 0 | if (cipher_suite->mode == MODE_CBC) { |
4988 | | |
4989 | | /* We only have room for MAX_BLOCK_SIZE bytes IVs, but that's |
4990 | | all we should need. This is a sanity check */ |
4991 | 0 | if (write_iv_len > MAX_BLOCK_SIZE) { |
4992 | 0 | ssl_debug_printf("%s cipher suite block must be at most %d nut is %d\n", |
4993 | 0 | G_STRFUNC, MAX_BLOCK_SIZE, write_iv_len); |
4994 | 0 | goto fail; |
4995 | 0 | } |
4996 | | |
4997 | 0 | if(ssl_session->session.version==SSLV3_VERSION){ |
4998 | | /* The length of these fields are ignored by this caller */ |
4999 | 0 | StringInfo iv_c, iv_s; |
5000 | 0 | iv_c.data = _iv_c; |
5001 | 0 | iv_s.data = _iv_s; |
5002 | |
|
5003 | 0 | ssl_debug_printf("%s ssl3_generate_export_iv\n", G_STRFUNC); |
5004 | 0 | if (!ssl3_generate_export_iv(&ssl_session->client_random, |
5005 | 0 | &ssl_session->server_random, &iv_c, write_iv_len)) { |
5006 | 0 | goto fail; |
5007 | 0 | } |
5008 | 0 | ssl_debug_printf("%s ssl3_generate_export_iv(2)\n", G_STRFUNC); |
5009 | 0 | if (!ssl3_generate_export_iv(&ssl_session->server_random, |
5010 | 0 | &ssl_session->client_random, &iv_s, write_iv_len)) { |
5011 | 0 | goto fail; |
5012 | 0 | } |
5013 | 0 | } |
5014 | 0 | else{ |
5015 | 0 | uint8_t _iv_block[MAX_BLOCK_SIZE * 2]; |
5016 | 0 | StringInfo iv_block; |
5017 | 0 | StringInfo key_null; |
5018 | 0 | uint8_t _key_null; |
5019 | |
|
5020 | 0 | key_null.data = &_key_null; |
5021 | 0 | key_null.data_len = 0; |
5022 | |
|
5023 | 0 | iv_block.data = _iv_block; |
5024 | |
|
5025 | 0 | ssl_debug_printf("%s prf(iv_block)\n", G_STRFUNC); |
5026 | 0 | if (!prf(ssl_session, &key_null, "IV block", |
5027 | 0 | &ssl_session->client_random, |
5028 | 0 | &ssl_session->server_random, &iv_block, |
5029 | 0 | write_iv_len * 2)) { |
5030 | 0 | ssl_debug_printf("%s can't generate tls31 iv block\n", G_STRFUNC); |
5031 | 0 | goto fail; |
5032 | 0 | } |
5033 | | |
5034 | 0 | memcpy(_iv_c, iv_block.data, write_iv_len); |
5035 | 0 | memcpy(_iv_s, iv_block.data + write_iv_len, write_iv_len); |
5036 | 0 | } |
5037 | | |
5038 | 0 | c_iv=_iv_c; |
5039 | 0 | s_iv=_iv_s; |
5040 | 0 | } |
5041 | | |
5042 | 0 | if (ssl_session->session.version==SSLV3_VERSION){ |
5043 | |
|
5044 | 0 | SSL_MD5_CTX md5; |
5045 | 0 | ssl_debug_printf("%s MD5(client_random)\n", G_STRFUNC); |
5046 | |
|
5047 | 0 | if (ssl_md5_init(&md5) != 0) |
5048 | 0 | goto fail; |
5049 | 0 | ssl_md5_update(&md5,c_wk,encr_key_len); |
5050 | 0 | ssl_md5_update(&md5,ssl_session->client_random.data, |
5051 | 0 | ssl_session->client_random.data_len); |
5052 | 0 | ssl_md5_update(&md5,ssl_session->server_random.data, |
5053 | 0 | ssl_session->server_random.data_len); |
5054 | 0 | ssl_md5_final(_key_c,&md5); |
5055 | 0 | ssl_md5_cleanup(&md5); |
5056 | 0 | c_wk=_key_c; |
5057 | |
|
5058 | 0 | if (ssl_md5_init(&md5) != 0) |
5059 | 0 | goto fail; |
5060 | 0 | ssl_debug_printf("%s MD5(server_random)\n", G_STRFUNC); |
5061 | 0 | ssl_md5_update(&md5,s_wk,encr_key_len); |
5062 | 0 | ssl_md5_update(&md5,ssl_session->server_random.data, |
5063 | 0 | ssl_session->server_random.data_len); |
5064 | 0 | ssl_md5_update(&md5,ssl_session->client_random.data, |
5065 | 0 | ssl_session->client_random.data_len); |
5066 | 0 | ssl_md5_final(_key_s,&md5); |
5067 | 0 | ssl_md5_cleanup(&md5); |
5068 | 0 | s_wk=_key_s; |
5069 | 0 | } |
5070 | 0 | else{ |
5071 | 0 | StringInfo key_c, key_s, k; |
5072 | 0 | key_c.data = _key_c; |
5073 | 0 | key_s.data = _key_s; |
5074 | |
|
5075 | 0 | k.data = c_wk; |
5076 | 0 | k.data_len = encr_key_len; |
5077 | 0 | ssl_debug_printf("%s PRF(key_c)\n", G_STRFUNC); |
5078 | 0 | if (!prf(ssl_session, &k, "client write key", |
5079 | 0 | &ssl_session->client_random, |
5080 | 0 | &ssl_session->server_random, &key_c, sizeof(_key_c))) { |
5081 | 0 | ssl_debug_printf("%s can't generate tll31 server key \n", G_STRFUNC); |
5082 | 0 | goto fail; |
5083 | 0 | } |
5084 | 0 | c_wk=_key_c; |
5085 | |
|
5086 | 0 | k.data = s_wk; |
5087 | 0 | k.data_len = encr_key_len; |
5088 | 0 | ssl_debug_printf("%s PRF(key_s)\n", G_STRFUNC); |
5089 | 0 | if (!prf(ssl_session, &k, "server write key", |
5090 | 0 | &ssl_session->client_random, |
5091 | 0 | &ssl_session->server_random, &key_s, sizeof(_key_s))) { |
5092 | 0 | ssl_debug_printf("%s can't generate tll31 client key \n", G_STRFUNC); |
5093 | 0 | goto fail; |
5094 | 0 | } |
5095 | 0 | s_wk=_key_s; |
5096 | 0 | } |
5097 | 0 | } |
5098 | | |
5099 | | /* show key material info */ |
5100 | 0 | if (c_mk != NULL) { |
5101 | 0 | ssl_print_data("Client MAC key",c_mk,ssl_cipher_suite_dig(cipher_suite)->len); |
5102 | 0 | ssl_print_data("Server MAC key",s_mk,ssl_cipher_suite_dig(cipher_suite)->len); |
5103 | 0 | } |
5104 | 0 | ssl_print_data("Client Write key", c_wk, encr_key_len); |
5105 | 0 | ssl_print_data("Server Write key", s_wk, encr_key_len); |
5106 | | /* used as IV for CBC mode and the AEAD implicit nonce (salt) */ |
5107 | 0 | if (write_iv_len > 0) { |
5108 | 0 | ssl_print_data("Client Write IV", c_iv, write_iv_len); |
5109 | 0 | ssl_print_data("Server Write IV", s_iv, write_iv_len); |
5110 | 0 | } |
5111 | |
|
5112 | 0 | create_decoders: |
5113 | | /* create both client and server ciphers*/ |
5114 | 0 | ssl_debug_printf("%s ssl_create_decoder(client)\n", G_STRFUNC); |
5115 | 0 | ssl_session->client_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, c_mk, c_wk, NULL, c_iv, write_iv_len); |
5116 | 0 | if (!ssl_session->client_new) { |
5117 | 0 | ssl_debug_printf("%s can't init client decoder\n", G_STRFUNC); |
5118 | 0 | goto fail; |
5119 | 0 | } |
5120 | 0 | ssl_debug_printf("%s ssl_create_decoder(server)\n", G_STRFUNC); |
5121 | 0 | ssl_session->server_new = ssl_create_decoder(cipher_suite, cipher_algo, ssl_session->session.compression, s_mk, s_wk, NULL, s_iv, write_iv_len); |
5122 | 0 | if (!ssl_session->server_new) { |
5123 | 0 | ssl_debug_printf("%s can't init server decoder\n", G_STRFUNC); |
5124 | 0 | goto fail; |
5125 | 0 | } |
5126 | | |
5127 | | /* Continue the SSL stream after renegotiation with new keys. */ |
5128 | 0 | ssl_session->client_new->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow(); |
5129 | 0 | ssl_session->server_new->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow(); |
5130 | |
|
5131 | 0 | ssl_debug_printf("%s: client seq %" PRIu64 ", server seq %" PRIu64 "\n", |
5132 | 0 | G_STRFUNC, ssl_session->client_new->seq, ssl_session->server_new->seq); |
5133 | 0 | g_free(key_block.data); |
5134 | 0 | ssl_session->state |= SSL_HAVE_SESSION_KEY; |
5135 | 0 | return 0; |
5136 | | |
5137 | 0 | fail: |
5138 | 0 | g_free(key_block.data); |
5139 | 0 | return -1; |
5140 | 0 | } |
5141 | | |
5142 | | /* Generated the key material based on the given secret. */ |
5143 | | bool |
5144 | | tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, bool is_from_server) |
5145 | 0 | { |
5146 | 0 | bool success = false; |
5147 | 0 | unsigned char *write_key = NULL, *write_iv = NULL; |
5148 | 0 | unsigned char *sn_key = NULL; |
5149 | 0 | SslDecoder *decoder; |
5150 | 0 | unsigned key_length, iv_length; |
5151 | 0 | int hash_algo; |
5152 | 0 | const SslCipherSuite *cipher_suite = ssl_session->cipher_suite; |
5153 | 0 | int cipher_algo; |
5154 | |
|
5155 | 0 | if ((ssl_session->session.version != TLSV1DOT3_VERSION) && (ssl_session->session.version != DTLSV1DOT3_VERSION)) { |
5156 | 0 | ssl_debug_printf("%s only usable for TLS 1.3, not %#x!\n", G_STRFUNC, |
5157 | 0 | ssl_session->session.version); |
5158 | 0 | return false; |
5159 | 0 | } |
5160 | | |
5161 | 0 | if (cipher_suite == NULL) { |
5162 | 0 | ssl_debug_printf("%s Unknown cipher\n", G_STRFUNC); |
5163 | 0 | return false; |
5164 | 0 | } |
5165 | | |
5166 | 0 | if (cipher_suite->kex != KEX_TLS13) { |
5167 | 0 | ssl_debug_printf("%s Invalid cipher suite 0x%04x spotted!\n", G_STRFUNC, cipher_suite->number); |
5168 | 0 | return false; |
5169 | 0 | } |
5170 | | |
5171 | | /* Find the Libgcrypt cipher algorithm for the given SSL cipher suite ID */ |
5172 | 0 | const char *cipher_name = ciphers[cipher_suite->enc-ENC_START]; |
5173 | 0 | ssl_debug_printf("%s CIPHER: %s\n", G_STRFUNC, cipher_name); |
5174 | 0 | cipher_algo = ssl_get_cipher_by_name(cipher_name); |
5175 | 0 | if (cipher_algo == 0) { |
5176 | 0 | ssl_debug_printf("%s can't find cipher %s\n", G_STRFUNC, cipher_name); |
5177 | 0 | return false; |
5178 | 0 | } |
5179 | | |
5180 | 0 | const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name; |
5181 | 0 | hash_algo = ssl_get_digest_by_name(hash_name); |
5182 | 0 | if (!hash_algo) { |
5183 | 0 | ssl_debug_printf("%s can't find hash function %s\n", G_STRFUNC, hash_name); |
5184 | 0 | return false; |
5185 | 0 | } |
5186 | | |
5187 | 0 | key_length = (unsigned) gcry_cipher_get_algo_keylen(cipher_algo); |
5188 | | /* AES-GCM/AES-CCM/Poly1305-ChaCha20 all have N_MIN=N_MAX = 12. */ |
5189 | 0 | iv_length = 12; |
5190 | 0 | ssl_debug_printf("%s key_length %u iv_length %u\n", G_STRFUNC, key_length, iv_length); |
5191 | |
|
5192 | 0 | const char *label_prefix = tls13_hkdf_label_prefix(ssl_session); |
5193 | 0 | if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "key", key_length, &write_key)) { |
5194 | 0 | ssl_debug_printf("%s write_key expansion failed\n", G_STRFUNC); |
5195 | 0 | return false; |
5196 | 0 | } |
5197 | 0 | if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "iv", iv_length, &write_iv)) { |
5198 | 0 | ssl_debug_printf("%s write_iv expansion failed\n", G_STRFUNC); |
5199 | 0 | goto end; |
5200 | 0 | } |
5201 | | |
5202 | 0 | if (ssl_session->session.version == DTLSV1DOT3_VERSION) { |
5203 | 0 | if (!tls13_hkdf_expand_label(hash_algo, secret, label_prefix, "sn", key_length, &sn_key)) { |
5204 | 0 | ssl_debug_printf("%s sn_key expansion failed\n", G_STRFUNC); |
5205 | 0 | goto end; |
5206 | 0 | } |
5207 | 0 | } |
5208 | | |
5209 | 0 | ssl_print_data(is_from_server ? "Server Write Key" : "Client Write Key", write_key, key_length); |
5210 | 0 | ssl_print_data(is_from_server ? "Server Write IV" : "Client Write IV", write_iv, iv_length); |
5211 | 0 | if (ssl_session->session.version == DTLSV1DOT3_VERSION) { |
5212 | 0 | ssl_print_data(is_from_server ? "Server Write SN" : "Client Write SN", sn_key, key_length); |
5213 | 0 | } |
5214 | |
|
5215 | 0 | ssl_debug_printf("%s ssl_create_decoder(%s)\n", G_STRFUNC, is_from_server ? "server" : "client"); |
5216 | 0 | decoder = ssl_create_decoder(cipher_suite, cipher_algo, 0, NULL, write_key, sn_key, write_iv, iv_length); |
5217 | 0 | if (!decoder) { |
5218 | 0 | ssl_debug_printf("%s can't init %s decoder\n", G_STRFUNC, is_from_server ? "server" : "client"); |
5219 | 0 | goto end; |
5220 | 0 | } |
5221 | | |
5222 | | /* Continue the TLS session with new keys, but reuse old flow to keep things |
5223 | | * like "Follow TLS" working (by linking application data records). */ |
5224 | 0 | if (is_from_server) { |
5225 | 0 | decoder->flow = ssl_session->server ? ssl_session->server->flow : ssl_create_flow(); |
5226 | 0 | ssl_session->server = decoder; |
5227 | 0 | } else { |
5228 | 0 | decoder->flow = ssl_session->client ? ssl_session->client->flow : ssl_create_flow(); |
5229 | 0 | ssl_session->client = decoder; |
5230 | 0 | } |
5231 | 0 | ssl_debug_printf("%s %s ready using cipher suite 0x%04x (cipher %s hash %s)\n", G_STRFUNC, |
5232 | 0 | is_from_server ? "Server" : "Client", cipher_suite->number, cipher_name, hash_name); |
5233 | 0 | success = true; |
5234 | |
|
5235 | 0 | end: |
5236 | 0 | wmem_free(NULL, write_key); |
5237 | 0 | wmem_free(NULL, write_iv); |
5238 | 0 | if (sn_key) |
5239 | 0 | wmem_free(NULL, sn_key); |
5240 | 0 | return success; |
5241 | 0 | } |
5242 | | /* (Pre-)master secrets calculations }}} */ |
5243 | | |
5244 | | #ifdef HAVE_LIBGNUTLS |
5245 | | /* Decrypt RSA pre-master secret using RSA private key. {{{ */ |
5246 | | static bool |
5247 | | ssl_decrypt_pre_master_secret(SslDecryptSession *ssl_session, |
5248 | | StringInfo *encrypted_pre_master, GHashTable *key_hash) |
5249 | | { |
5250 | | int ret; |
5251 | | |
5252 | | if (!encrypted_pre_master) |
5253 | | return false; |
5254 | | |
5255 | | if (KEX_IS_DH(ssl_session->cipher_suite->kex)) { |
5256 | | ssl_debug_printf("%s: session uses Diffie-Hellman key exchange " |
5257 | | "(cipher suite 0x%04X %s) and cannot be decrypted " |
5258 | | "using a RSA private key file.\n", |
5259 | | G_STRFUNC, ssl_session->session.cipher, |
5260 | | val_to_str_ext_const(ssl_session->session.cipher, |
5261 | | &ssl_31_ciphersuite_ext, "unknown")); |
5262 | | return false; |
5263 | | } else if (ssl_session->cipher_suite->kex != KEX_RSA) { |
5264 | | ssl_debug_printf("%s key exchange %d different from KEX_RSA (%d)\n", |
5265 | | G_STRFUNC, ssl_session->cipher_suite->kex, KEX_RSA); |
5266 | | return false; |
5267 | | } |
5268 | | |
5269 | | gnutls_privkey_t pk = (gnutls_privkey_t)g_hash_table_lookup(key_hash, ssl_session->cert_key_id); |
5270 | | |
5271 | | ssl_print_string("pre master encrypted", encrypted_pre_master); |
5272 | | ssl_debug_printf("%s: RSA_private_decrypt\n", G_STRFUNC); |
5273 | | const gnutls_datum_t epms = { encrypted_pre_master->data, encrypted_pre_master->data_len }; |
5274 | | gnutls_datum_t pms = { 0 }; |
5275 | | if (pk) { |
5276 | | // Try to decrypt using the RSA keys table from (D)TLS preferences. |
5277 | | ret = gnutls_privkey_decrypt_data(pk, 0, &epms, &pms); |
5278 | | } else { |
5279 | | // Try to decrypt using a hardware token. |
5280 | | ret = secrets_rsa_decrypt(ssl_session->cert_key_id, epms.data, epms.size, &pms.data, &pms.size); |
5281 | | } |
5282 | | if (ret < 0) { |
5283 | | ssl_debug_printf("%s: decryption failed: %d (%s)\n", G_STRFUNC, ret, gnutls_strerror(ret)); |
5284 | | return false; |
5285 | | } |
5286 | | |
5287 | | if (pms.size != 48) { |
5288 | | ssl_debug_printf("%s wrong pre_master_secret length (%d, expected %d)\n", |
5289 | | G_STRFUNC, pms.size, 48); |
5290 | | if (pk) { |
5291 | | gnutls_free(pms.data); |
5292 | | } else { |
5293 | | g_free(pms.data); |
5294 | | } |
5295 | | return false; |
5296 | | } |
5297 | | |
5298 | | ssl_session->pre_master_secret.data = (uint8_t *)wmem_memdup(wmem_file_scope(), pms.data, 48); |
5299 | | ssl_session->pre_master_secret.data_len = 48; |
5300 | | if (pk) { |
5301 | | gnutls_free(pms.data); |
5302 | | } else { |
5303 | | g_free(pms.data); |
5304 | | } |
5305 | | ssl_print_string("pre master secret", &ssl_session->pre_master_secret); |
5306 | | |
5307 | | /* Remove the master secret if it was there. |
5308 | | This forces keying material regeneration in |
5309 | | case we're renegotiating */ |
5310 | | ssl_session->state &= ~(SSL_MASTER_SECRET|SSL_HAVE_SESSION_KEY); |
5311 | | ssl_session->state |= SSL_PRE_MASTER_SECRET; |
5312 | | return true; |
5313 | | } /* }}} */ |
5314 | | #endif /* HAVE_LIBGNUTLS */ |
5315 | | |
5316 | | /* Decryption integrity check {{{ */ |
5317 | | |
5318 | | static int |
5319 | | tls_check_mac(SslDecoder*decoder, int ct, int ver, uint8_t* data, |
5320 | | uint32_t datalen, uint8_t* mac) |
5321 | 0 | { |
5322 | 0 | SSL_HMAC hm; |
5323 | 0 | int md; |
5324 | 0 | uint32_t len; |
5325 | 0 | uint8_t buf[DIGEST_MAX_SIZE]; |
5326 | 0 | int16_t temp; |
5327 | |
|
5328 | 0 | md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name); |
5329 | 0 | ssl_debug_printf("tls_check_mac mac type:%s md %d\n", |
5330 | 0 | ssl_cipher_suite_dig(decoder->cipher_suite)->name, md); |
5331 | |
|
5332 | 0 | if (ssl_hmac_init(&hm,md) != 0) |
5333 | 0 | return -1; |
5334 | 0 | if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0) |
5335 | 0 | return -1; |
5336 | | |
5337 | | /* hash sequence number */ |
5338 | 0 | phtonu64(buf, decoder->seq); |
5339 | |
|
5340 | 0 | decoder->seq++; |
5341 | |
|
5342 | 0 | ssl_hmac_update(&hm,buf,8); |
5343 | | |
5344 | | /* hash content type */ |
5345 | 0 | buf[0]=ct; |
5346 | 0 | ssl_hmac_update(&hm,buf,1); |
5347 | | |
5348 | | /* hash version,data length and data*/ |
5349 | | /* *((int16_t*)buf) = g_htons(ver); */ |
5350 | 0 | temp = g_htons(ver); |
5351 | 0 | memcpy(buf, &temp, 2); |
5352 | 0 | ssl_hmac_update(&hm,buf,2); |
5353 | | |
5354 | | /* *((int16_t*)buf) = g_htons(datalen); */ |
5355 | 0 | temp = g_htons(datalen); |
5356 | 0 | memcpy(buf, &temp, 2); |
5357 | 0 | ssl_hmac_update(&hm,buf,2); |
5358 | 0 | ssl_hmac_update(&hm,data,datalen); |
5359 | | |
5360 | | /* get digest and digest len*/ |
5361 | 0 | len = sizeof(buf); |
5362 | 0 | ssl_hmac_final(&hm,buf,&len); |
5363 | 0 | ssl_hmac_cleanup(&hm); |
5364 | 0 | ssl_print_data("Mac", buf, len); |
5365 | 0 | if(memcmp(mac,buf,len)) |
5366 | 0 | return -1; |
5367 | | |
5368 | 0 | return 0; |
5369 | 0 | } |
5370 | | |
5371 | | static int |
5372 | | ssl3_check_mac(SslDecoder*decoder,int ct,uint8_t* data, |
5373 | | uint32_t datalen, uint8_t* mac) |
5374 | 0 | { |
5375 | 0 | SSL_MD mc; |
5376 | 0 | int md; |
5377 | 0 | uint32_t len; |
5378 | 0 | uint8_t buf[64],dgst[20]; |
5379 | 0 | int pad_ct; |
5380 | 0 | int16_t temp; |
5381 | |
|
5382 | 0 | pad_ct=(decoder->cipher_suite->dig==DIG_SHA)?40:48; |
5383 | | |
5384 | | /* get cipher used for digest computation */ |
5385 | 0 | md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name); |
5386 | 0 | if (ssl_md_init(&mc,md) !=0) |
5387 | 0 | return -1; |
5388 | | |
5389 | | /* do hash computation on data && padding */ |
5390 | 0 | ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len); |
5391 | | |
5392 | | /* hash padding*/ |
5393 | 0 | memset(buf,0x36,pad_ct); |
5394 | 0 | ssl_md_update(&mc,buf,pad_ct); |
5395 | | |
5396 | | /* hash sequence number */ |
5397 | 0 | phtonu64(buf, decoder->seq); |
5398 | 0 | decoder->seq++; |
5399 | 0 | ssl_md_update(&mc,buf,8); |
5400 | | |
5401 | | /* hash content type */ |
5402 | 0 | buf[0]=ct; |
5403 | 0 | ssl_md_update(&mc,buf,1); |
5404 | | |
5405 | | /* hash data length in network byte order and data*/ |
5406 | | /* *((int16_t* )buf) = g_htons(datalen); */ |
5407 | 0 | temp = g_htons(datalen); |
5408 | 0 | memcpy(buf, &temp, 2); |
5409 | 0 | ssl_md_update(&mc,buf,2); |
5410 | 0 | ssl_md_update(&mc,data,datalen); |
5411 | | |
5412 | | /* get partial digest */ |
5413 | 0 | ssl_md_final(&mc,dgst,&len); |
5414 | 0 | ssl_md_reset(&mc); |
5415 | | |
5416 | | /* hash mac key */ |
5417 | 0 | ssl_md_update(&mc,decoder->mac_key.data,decoder->mac_key.data_len); |
5418 | | |
5419 | | /* hash padding and partial digest*/ |
5420 | 0 | memset(buf,0x5c,pad_ct); |
5421 | 0 | ssl_md_update(&mc,buf,pad_ct); |
5422 | 0 | ssl_md_update(&mc,dgst,len); |
5423 | |
|
5424 | 0 | ssl_md_final(&mc,dgst,&len); |
5425 | 0 | ssl_md_cleanup(&mc); |
5426 | |
|
5427 | 0 | if(memcmp(mac,dgst,len)) |
5428 | 0 | return -1; |
5429 | | |
5430 | 0 | return 0; |
5431 | 0 | } |
5432 | | |
5433 | | static int |
5434 | | dtls_check_mac(SslDecryptSession *ssl, SslDecoder*decoder, int ct, uint8_t* data, |
5435 | | uint32_t datalen, uint8_t* mac, const unsigned char *cid, uint8_t cidl) |
5436 | 0 | { |
5437 | 0 | SSL_HMAC hm; |
5438 | 0 | int md; |
5439 | 0 | uint32_t len; |
5440 | 0 | uint8_t buf[DIGEST_MAX_SIZE]; |
5441 | 0 | int16_t temp; |
5442 | |
|
5443 | 0 | int ver = ssl->session.version; |
5444 | 0 | bool is_cid = ((ct == SSL_ID_TLS12_CID) && (ver == DTLSV1DOT2_VERSION)); |
5445 | |
|
5446 | 0 | md=ssl_get_digest_by_name(ssl_cipher_suite_dig(decoder->cipher_suite)->name); |
5447 | 0 | ssl_debug_printf("dtls_check_mac mac type:%s md %d\n", |
5448 | 0 | ssl_cipher_suite_dig(decoder->cipher_suite)->name, md); |
5449 | |
|
5450 | 0 | if (ssl_hmac_init(&hm,md) != 0) |
5451 | 0 | return -1; |
5452 | 0 | if (ssl_hmac_setkey(&hm,decoder->mac_key.data,decoder->mac_key.data_len) != 0) |
5453 | 0 | return -1; |
5454 | | |
5455 | 0 | ssl_debug_printf("dtls_check_mac seq: %" PRIu64 " epoch: %d\n",decoder->seq,decoder->epoch); |
5456 | |
|
5457 | 0 | if (is_cid && !ssl->session.deprecated_cid) { |
5458 | | /* hash seq num placeholder */ |
5459 | 0 | memset(buf,0xFF,8); |
5460 | 0 | ssl_hmac_update(&hm,buf,8); |
5461 | | |
5462 | | /* hash content type + cid length + content type */ |
5463 | 0 | buf[0]=ct; |
5464 | 0 | buf[1]=cidl; |
5465 | 0 | buf[2]=ct; |
5466 | 0 | ssl_hmac_update(&hm,buf,3); |
5467 | | |
5468 | | /* hash version */ |
5469 | 0 | temp = g_htons(ver); |
5470 | 0 | memcpy(buf, &temp, 2); |
5471 | 0 | ssl_hmac_update(&hm,buf,2); |
5472 | | |
5473 | | /* hash sequence number */ |
5474 | 0 | phtonu64(buf, decoder->seq); |
5475 | 0 | buf[0]=decoder->epoch>>8; |
5476 | 0 | buf[1]=(uint8_t)decoder->epoch; |
5477 | 0 | ssl_hmac_update(&hm,buf,8); |
5478 | | |
5479 | | /* hash cid */ |
5480 | 0 | ssl_hmac_update(&hm,cid,cidl); |
5481 | 0 | } else { |
5482 | | /* hash sequence number */ |
5483 | 0 | phtonu64(buf, decoder->seq); |
5484 | 0 | buf[0]=decoder->epoch>>8; |
5485 | 0 | buf[1]=(uint8_t)decoder->epoch; |
5486 | 0 | ssl_hmac_update(&hm,buf,8); |
5487 | | |
5488 | | /* hash content type */ |
5489 | 0 | buf[0]=ct; |
5490 | 0 | ssl_hmac_update(&hm,buf,1); |
5491 | | |
5492 | | /* hash version */ |
5493 | 0 | temp = g_htons(ver); |
5494 | 0 | memcpy(buf, &temp, 2); |
5495 | 0 | ssl_hmac_update(&hm,buf,2); |
5496 | |
|
5497 | 0 | if (is_cid && ssl->session.deprecated_cid) { |
5498 | | /* hash cid */ |
5499 | 0 | ssl_hmac_update(&hm,cid,cidl); |
5500 | | |
5501 | | /* hash cid length */ |
5502 | 0 | buf[0] = cidl; |
5503 | 0 | ssl_hmac_update(&hm,buf,1); |
5504 | 0 | } |
5505 | 0 | } |
5506 | | |
5507 | | /* data length and data */ |
5508 | 0 | temp = g_htons(datalen); |
5509 | 0 | memcpy(buf, &temp, 2); |
5510 | 0 | ssl_hmac_update(&hm,buf,2); |
5511 | 0 | ssl_hmac_update(&hm,data,datalen); |
5512 | | |
5513 | | /* get digest and digest len */ |
5514 | 0 | len = sizeof(buf); |
5515 | 0 | ssl_hmac_final(&hm,buf,&len); |
5516 | 0 | ssl_hmac_cleanup(&hm); |
5517 | 0 | ssl_print_data("Mac", buf, len); |
5518 | 0 | if(memcmp(mac,buf,len)) |
5519 | 0 | return -1; |
5520 | | |
5521 | 0 | return 0; |
5522 | 0 | } |
5523 | | /* Decryption integrity check }}} */ |
5524 | | |
5525 | | |
5526 | | static bool |
5527 | | tls_decrypt_aead_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, |
5528 | | uint8_t ct, uint16_t record_version, |
5529 | | bool ignore_mac_failed, |
5530 | | const unsigned char *in, uint16_t inl, |
5531 | | const unsigned char *cid, uint8_t cidl, |
5532 | | StringInfo *out_str, unsigned *outl) |
5533 | 0 | { |
5534 | | /* RFC 5246 (TLS 1.2) 6.2.3.3 defines the TLSCipherText.fragment as: |
5535 | | * GenericAEADCipher: { nonce_explicit, [content] } |
5536 | | * In TLS 1.3 this explicit nonce is gone. |
5537 | | * With AES GCM/CCM, "[content]" is actually the concatenation of the |
5538 | | * ciphertext and authentication tag. |
5539 | | */ |
5540 | 0 | const uint16_t version = ssl->session.version; |
5541 | 0 | const bool is_v12 = version == TLSV1DOT2_VERSION || version == DTLSV1DOT2_VERSION || version == TLCPV1_VERSION; |
5542 | 0 | gcry_error_t err; |
5543 | 0 | const unsigned char *explicit_nonce = NULL, *ciphertext; |
5544 | 0 | unsigned ciphertext_len, auth_tag_len; |
5545 | 0 | unsigned char nonce[12]; |
5546 | 0 | const ssl_cipher_mode_t cipher_mode = decoder->cipher_suite->mode; |
5547 | 0 | const bool is_cid = ct == SSL_ID_TLS12_CID && version == DTLSV1DOT2_VERSION; |
5548 | 0 | const uint8_t draft_version = ssl->session.tls13_draft_version; |
5549 | 0 | const unsigned char *auth_tag_wire; |
5550 | 0 | unsigned char auth_tag_calc[16]; |
5551 | 0 | unsigned char *aad = NULL; |
5552 | 0 | unsigned aad_len = 0; |
5553 | |
|
5554 | 0 | switch (cipher_mode) { |
5555 | 0 | case MODE_GCM: |
5556 | 0 | case MODE_CCM: |
5557 | 0 | case MODE_POLY1305: |
5558 | 0 | auth_tag_len = 16; |
5559 | 0 | break; |
5560 | 0 | case MODE_CCM_8: |
5561 | 0 | auth_tag_len = 8; |
5562 | 0 | break; |
5563 | 0 | default: |
5564 | 0 | ssl_debug_printf("%s unsupported cipher!\n", G_STRFUNC); |
5565 | 0 | return false; |
5566 | 0 | } |
5567 | | |
5568 | | /* Parse input into explicit nonce (TLS 1.2 only), ciphertext and tag. */ |
5569 | 0 | if (is_v12 && cipher_mode != MODE_POLY1305) { |
5570 | 0 | if (inl < EXPLICIT_NONCE_LEN + auth_tag_len) { |
5571 | 0 | ssl_debug_printf("%s input %d is too small for explicit nonce %d and auth tag %d\n", |
5572 | 0 | G_STRFUNC, inl, EXPLICIT_NONCE_LEN, auth_tag_len); |
5573 | 0 | return false; |
5574 | 0 | } |
5575 | 0 | explicit_nonce = in; |
5576 | 0 | ciphertext = explicit_nonce + EXPLICIT_NONCE_LEN; |
5577 | 0 | ciphertext_len = inl - EXPLICIT_NONCE_LEN - auth_tag_len; |
5578 | 0 | } else if (version == TLSV1DOT3_VERSION || version == DTLSV1DOT3_VERSION || cipher_mode == MODE_POLY1305) { |
5579 | 0 | if (inl < auth_tag_len) { |
5580 | 0 | ssl_debug_printf("%s input %d has no space for auth tag %d\n", G_STRFUNC, inl, auth_tag_len); |
5581 | 0 | return false; |
5582 | 0 | } |
5583 | 0 | ciphertext = in; |
5584 | 0 | ciphertext_len = inl - auth_tag_len; |
5585 | 0 | } else { |
5586 | 0 | ssl_debug_printf("%s Unexpected TLS version %#x\n", G_STRFUNC, version); |
5587 | 0 | return false; |
5588 | 0 | } |
5589 | 0 | auth_tag_wire = ciphertext + ciphertext_len; |
5590 | | |
5591 | | /* |
5592 | | * Nonce construction is version-specific. Note that AEAD_CHACHA20_POLY1305 |
5593 | | * (RFC 7905) uses a nonce construction similar to TLS 1.3. |
5594 | | */ |
5595 | 0 | if (is_v12 && cipher_mode != MODE_POLY1305) { |
5596 | 0 | DISSECTOR_ASSERT(decoder->write_iv.data_len == IMPLICIT_NONCE_LEN); |
5597 | | /* Implicit (4) and explicit (8) part of nonce. */ |
5598 | 0 | memcpy(nonce, decoder->write_iv.data, IMPLICIT_NONCE_LEN); |
5599 | 0 | memcpy(nonce + IMPLICIT_NONCE_LEN, explicit_nonce, EXPLICIT_NONCE_LEN); |
5600 | |
|
5601 | 0 | } else if (version == TLSV1DOT3_VERSION || version == DTLSV1DOT3_VERSION || cipher_mode == MODE_POLY1305) { |
5602 | | /* |
5603 | | * Technically the nonce length must be at least 8 bytes, but for |
5604 | | * AES-GCM, AES-CCM and Poly1305-ChaCha20 the nonce length is exact 12. |
5605 | | */ |
5606 | 0 | const unsigned nonce_len = 12; |
5607 | 0 | DISSECTOR_ASSERT(decoder->write_iv.data_len == nonce_len); |
5608 | 0 | memcpy(nonce, decoder->write_iv.data, decoder->write_iv.data_len); |
5609 | | /* Sequence number is left-padded with zeroes and XORed with write_iv */ |
5610 | 0 | phtonu64(nonce + nonce_len - 8, pntohu64(nonce + nonce_len - 8) ^ decoder->seq); |
5611 | 0 | ssl_debug_printf("%s seq %" PRIu64 "\n", G_STRFUNC, decoder->seq); |
5612 | 0 | } |
5613 | | |
5614 | | /* Set nonce and additional authentication data */ |
5615 | 0 | gcry_cipher_reset(decoder->evp); |
5616 | 0 | ssl_print_data("nonce", nonce, 12); |
5617 | 0 | err = gcry_cipher_setiv(decoder->evp, nonce, 12); |
5618 | 0 | if (err) { |
5619 | 0 | ssl_debug_printf("%s failed to set nonce: %s\n", G_STRFUNC, gcry_strerror(err)); |
5620 | 0 | return false; |
5621 | 0 | } |
5622 | | |
5623 | | /* (D)TLS 1.2 needs specific AAD, TLS 1.3 (before -25) uses empty AAD. */ |
5624 | 0 | if (is_cid) { /* if connection ID */ |
5625 | 0 | if (ssl->session.deprecated_cid) { |
5626 | 0 | aad_len = 14 + cidl; |
5627 | 0 | aad = wmem_alloc(allocator, aad_len); |
5628 | 0 | phtonu64(aad, decoder->seq); /* record sequence number */ |
5629 | 0 | phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */ |
5630 | 0 | aad[8] = ct; /* TLSCompressed.type */ |
5631 | 0 | phtonu16(aad + 9, record_version); /* TLSCompressed.version */ |
5632 | 0 | memcpy(aad + 11, cid, cidl); /* cid */ |
5633 | 0 | aad[11 + cidl] = cidl; /* cid_length */ |
5634 | 0 | phtonu16(aad + 12 + cidl, ciphertext_len); /* TLSCompressed.length */ |
5635 | 0 | } else { |
5636 | 0 | aad_len = 23 + cidl; |
5637 | 0 | aad = wmem_alloc(allocator, aad_len); |
5638 | 0 | memset(aad, 0xFF, 8); /* seq_num_placeholder */ |
5639 | 0 | aad[8] = ct; /* TLSCompressed.type */ |
5640 | 0 | aad[9] = cidl; /* cid_length */ |
5641 | 0 | aad[10] = ct; /* TLSCompressed.type */ |
5642 | 0 | phtonu16(aad + 11, record_version); /* TLSCompressed.version */ |
5643 | 0 | phtonu64(aad + 13, decoder->seq); /* record sequence number */ |
5644 | 0 | phtonu16(aad + 13, decoder->epoch); /* DTLS 1.2 includes epoch. */ |
5645 | 0 | memcpy(aad + 21, cid, cidl); /* cid */ |
5646 | 0 | phtonu16(aad + 21 + cidl, ciphertext_len); /* TLSCompressed.length */ |
5647 | 0 | } |
5648 | 0 | } else if (is_v12) { |
5649 | 0 | aad_len = 13; |
5650 | 0 | aad = wmem_alloc(allocator, aad_len); |
5651 | 0 | phtonu64(aad, decoder->seq); /* record sequence number */ |
5652 | 0 | if (version == DTLSV1DOT2_VERSION) { |
5653 | 0 | phtonu16(aad, decoder->epoch); /* DTLS 1.2 includes epoch. */ |
5654 | 0 | } |
5655 | 0 | aad[8] = ct; /* TLSCompressed.type */ |
5656 | 0 | phtonu16(aad + 9, record_version); /* TLSCompressed.version */ |
5657 | 0 | phtonu16(aad + 11, ciphertext_len); /* TLSCompressed.length */ |
5658 | 0 | } else if (version == DTLSV1DOT3_VERSION) { |
5659 | 0 | aad_len = decoder->dtls13_aad.data_len; |
5660 | 0 | aad = decoder->dtls13_aad.data; |
5661 | 0 | } else if (draft_version >= 25 || draft_version == 0) { |
5662 | 0 | aad_len = 5; |
5663 | 0 | aad = wmem_alloc(allocator, aad_len); |
5664 | 0 | aad[0] = ct; /* TLSCiphertext.opaque_type (23) */ |
5665 | 0 | phtonu16(aad + 1, record_version); /* TLSCiphertext.legacy_record_version (0x0303) */ |
5666 | 0 | phtonu16(aad + 3, inl); /* TLSCiphertext.length */ |
5667 | 0 | } |
5668 | |
|
5669 | 0 | if (decoder->cipher_suite->mode == MODE_CCM || decoder->cipher_suite->mode == MODE_CCM_8) { |
5670 | | /* size of plaintext, additional authenticated data and auth tag. */ |
5671 | 0 | uint64_t lengths[3] = { ciphertext_len, aad_len, auth_tag_len }; |
5672 | |
|
5673 | 0 | gcry_cipher_ctl(decoder->evp, GCRYCTL_SET_CCM_LENGTHS, lengths, sizeof(lengths)); |
5674 | 0 | } |
5675 | |
|
5676 | 0 | if (aad && aad_len > 0) { |
5677 | 0 | ssl_print_data("AAD", aad, aad_len); |
5678 | 0 | err = gcry_cipher_authenticate(decoder->evp, aad, aad_len); |
5679 | 0 | if (err) { |
5680 | 0 | ssl_debug_printf("%s failed to set AAD: %s\n", G_STRFUNC, gcry_strerror(err)); |
5681 | 0 | return false; |
5682 | 0 | } |
5683 | 0 | } |
5684 | | |
5685 | | /* Decrypt now that nonce and AAD are set. */ |
5686 | 0 | err = gcry_cipher_decrypt(decoder->evp, out_str->data, out_str->data_len, ciphertext, ciphertext_len); |
5687 | 0 | if (err) { |
5688 | 0 | ssl_debug_printf("%s decrypt failed: %s\n", G_STRFUNC, gcry_strerror(err)); |
5689 | 0 | return false; |
5690 | 0 | } |
5691 | | |
5692 | | /* Check authentication tag for authenticity (replaces MAC) */ |
5693 | 0 | err = gcry_cipher_gettag(decoder->evp, auth_tag_calc, auth_tag_len); |
5694 | 0 | if (err == 0 && !memcmp(auth_tag_calc, auth_tag_wire, auth_tag_len)) { |
5695 | 0 | ssl_print_data("auth_tag(OK)", auth_tag_calc, auth_tag_len); |
5696 | 0 | } else { |
5697 | 0 | if (err) { |
5698 | 0 | ssl_debug_printf("%s cannot obtain tag: %s\n", G_STRFUNC, gcry_strerror(err)); |
5699 | 0 | } else { |
5700 | 0 | ssl_debug_printf("%s auth tag mismatch\n", G_STRFUNC); |
5701 | 0 | ssl_print_data("auth_tag(expect)", auth_tag_calc, auth_tag_len); |
5702 | 0 | ssl_print_data("auth_tag(actual)", auth_tag_wire, auth_tag_len); |
5703 | 0 | } |
5704 | 0 | if (ignore_mac_failed) { |
5705 | 0 | ssl_debug_printf("%s: auth check failed, but ignored for troubleshooting ;-)\n", G_STRFUNC); |
5706 | 0 | } else { |
5707 | 0 | return false; |
5708 | 0 | } |
5709 | 0 | } |
5710 | | |
5711 | | /* |
5712 | | * Increment the (implicit) sequence number for TLS 1.2/1.3 and TLCP 1.1. This is done |
5713 | | * after successful authentication to ensure that early data is skipped when |
5714 | | * CLIENT_EARLY_TRAFFIC_SECRET keys are unavailable. |
5715 | | */ |
5716 | 0 | if (version == TLSV1DOT2_VERSION || version == TLSV1DOT3_VERSION || version == TLCPV1_VERSION) { |
5717 | 0 | decoder->seq++; |
5718 | 0 | } |
5719 | |
|
5720 | 0 | ssl_print_data("Plaintext", out_str->data, ciphertext_len); |
5721 | 0 | *outl = ciphertext_len; |
5722 | 0 | return true; |
5723 | 0 | } |
5724 | | |
5725 | | /* Record decryption glue based on security parameters {{{ */ |
5726 | | /* Assume that we are called only for a non-NULL decoder which also means that |
5727 | | * we have a non-NULL decoder->cipher_suite. */ |
5728 | | int |
5729 | | ssl_decrypt_record(wmem_allocator_t* allocator, SslDecryptSession *ssl, SslDecoder *decoder, uint8_t ct, uint16_t record_version, |
5730 | | bool ignore_mac_failed, |
5731 | | const unsigned char *in, uint16_t inl, const unsigned char *cid, uint8_t cidl, |
5732 | | StringInfo *comp_str, StringInfo *out_str, unsigned *outl) |
5733 | 0 | { |
5734 | 0 | unsigned pad, worklen, uncomplen, maclen, mac_fraglen = 0; |
5735 | 0 | uint8_t *mac = NULL, *mac_frag = NULL; |
5736 | |
|
5737 | 0 | ssl_debug_printf("ssl_decrypt_record ciphertext len %d\n", inl); |
5738 | 0 | ssl_print_data("Ciphertext",in, inl); |
5739 | |
|
5740 | 0 | if (((ssl->session.version == TLSV1DOT3_VERSION || ssl->session.version == DTLSV1DOT3_VERSION)) |
5741 | 0 | != (decoder->cipher_suite->kex == KEX_TLS13)) { |
5742 | 0 | ssl_debug_printf("%s Invalid cipher suite for the protocol version!\n", G_STRFUNC); |
5743 | 0 | return -1; |
5744 | 0 | } |
5745 | | |
5746 | | /* ensure we have enough storage space for decrypted data */ |
5747 | 0 | if (inl > out_str->data_len) |
5748 | 0 | { |
5749 | 0 | ssl_debug_printf("ssl_decrypt_record: allocating %d bytes for decrypt data (old len %d)\n", |
5750 | 0 | inl + 32, out_str->data_len); |
5751 | 0 | ssl_data_realloc(out_str, inl + 32); |
5752 | 0 | } |
5753 | | |
5754 | | /* AEAD ciphers (GenericAEADCipher in TLS 1.2; TLS 1.3) have no padding nor |
5755 | | * a separate MAC, so use a different routine for simplicity. */ |
5756 | 0 | if (decoder->cipher_suite->mode == MODE_GCM || |
5757 | 0 | decoder->cipher_suite->mode == MODE_CCM || |
5758 | 0 | decoder->cipher_suite->mode == MODE_CCM_8 || |
5759 | 0 | decoder->cipher_suite->mode == MODE_POLY1305 || |
5760 | 0 | ssl->session.version == TLSV1DOT3_VERSION || |
5761 | 0 | ssl->session.version == DTLSV1DOT3_VERSION) { |
5762 | |
|
5763 | 0 | if (!tls_decrypt_aead_record(allocator, ssl, decoder, ct, record_version, ignore_mac_failed, in, inl, cid, cidl, out_str, &worklen)) { |
5764 | | /* decryption failed */ |
5765 | 0 | return -1; |
5766 | 0 | } |
5767 | | |
5768 | 0 | goto skip_mac; |
5769 | 0 | } |
5770 | | |
5771 | | /* RFC 6101/2246: SSLCipherText/TLSCipherText has two structures for types: |
5772 | | * (notation: { unencrypted, [ encrypted ] }) |
5773 | | * GenericStreamCipher: { [content, mac] } |
5774 | | * GenericBlockCipher: { IV (TLS 1.1+), [content, mac, padding, padding_len] } |
5775 | | * RFC 5426 (TLS 1.2): TLSCipherText has additionally: |
5776 | | * GenericAEADCipher: { nonce_explicit, [content] } |
5777 | | * RFC 4347 (DTLS): based on TLS 1.1, only GenericBlockCipher is supported. |
5778 | | * RFC 6347 (DTLS 1.2): based on TLS 1.2, includes GenericAEADCipher too. |
5779 | | */ |
5780 | | |
5781 | 0 | maclen = ssl_cipher_suite_dig(decoder->cipher_suite)->len; |
5782 | | |
5783 | | /* (TLS 1.1 and later, DTLS) Extract explicit IV for GenericBlockCipher */ |
5784 | 0 | if (decoder->cipher_suite->mode == MODE_CBC) { |
5785 | 0 | unsigned blocksize = 0; |
5786 | |
|
5787 | 0 | switch (ssl->session.version) { |
5788 | 0 | case TLSV1DOT1_VERSION: |
5789 | 0 | case TLSV1DOT2_VERSION: |
5790 | 0 | case DTLSV1DOT0_VERSION: |
5791 | 0 | case DTLSV1DOT2_VERSION: |
5792 | 0 | case DTLSV1DOT3_VERSION: |
5793 | 0 | case DTLSV1DOT0_OPENSSL_VERSION: |
5794 | 0 | case TLCPV1_VERSION: |
5795 | 0 | blocksize = ssl_get_cipher_blocksize(decoder->cipher_suite); |
5796 | 0 | if (inl < blocksize) { |
5797 | 0 | ssl_debug_printf("ssl_decrypt_record failed: input %d has no space for IV %d\n", |
5798 | 0 | inl, blocksize); |
5799 | 0 | return -1; |
5800 | 0 | } |
5801 | 0 | pad = gcry_cipher_setiv(decoder->evp, in, blocksize); |
5802 | 0 | if (pad != 0) { |
5803 | 0 | ssl_debug_printf("ssl_decrypt_record failed: failed to set IV: %s %s\n", |
5804 | 0 | gcry_strsource (pad), gcry_strerror (pad)); |
5805 | 0 | } |
5806 | |
|
5807 | 0 | inl -= blocksize; |
5808 | 0 | in += blocksize; |
5809 | 0 | break; |
5810 | 0 | } |
5811 | | |
5812 | | /* Encrypt-then-MAC for (D)TLS (RFC 7366) */ |
5813 | 0 | if (ssl->state & SSL_ENCRYPT_THEN_MAC) { |
5814 | | /* |
5815 | | * MAC is calculated over (IV + ) ENCRYPTED contents: |
5816 | | * |
5817 | | * MAC(MAC_write_key, ... + |
5818 | | * IV + // for TLS 1.1 or greater |
5819 | | * TLSCiphertext.enc_content); |
5820 | | */ |
5821 | 0 | if (inl < maclen) { |
5822 | 0 | ssl_debug_printf("%s failed: input %d has no space for MAC %d\n", |
5823 | 0 | G_STRFUNC, inl, maclen); |
5824 | 0 | return -1; |
5825 | 0 | } |
5826 | 0 | inl -= maclen; |
5827 | 0 | mac = (uint8_t *)in + inl; |
5828 | 0 | mac_frag = (uint8_t *)in - blocksize; |
5829 | 0 | mac_fraglen = blocksize + inl; |
5830 | 0 | } |
5831 | 0 | } |
5832 | | |
5833 | | /* First decrypt*/ |
5834 | 0 | if ((pad = ssl_cipher_decrypt(&decoder->evp, out_str->data, out_str->data_len, in, inl)) != 0) { |
5835 | 0 | ssl_debug_printf("ssl_decrypt_record failed: ssl_cipher_decrypt: %s %s\n", gcry_strsource (pad), |
5836 | 0 | gcry_strerror (pad)); |
5837 | 0 | return -1; |
5838 | 0 | } |
5839 | | |
5840 | 0 | ssl_print_data("Plaintext", out_str->data, inl); |
5841 | 0 | worklen=inl; |
5842 | | |
5843 | | |
5844 | | /* strip padding for GenericBlockCipher */ |
5845 | 0 | if (decoder->cipher_suite->mode == MODE_CBC) { |
5846 | 0 | if (inl < 1) { /* Should this check happen earlier? */ |
5847 | 0 | ssl_debug_printf("ssl_decrypt_record failed: input length %d too small\n", inl); |
5848 | 0 | return -1; |
5849 | 0 | } |
5850 | 0 | pad=out_str->data[inl-1]; |
5851 | 0 | if (worklen <= pad) { |
5852 | 0 | ssl_debug_printf("ssl_decrypt_record failed: padding %d too large for work %d\n", |
5853 | 0 | pad, worklen); |
5854 | 0 | return -1; |
5855 | 0 | } |
5856 | 0 | worklen-=(pad+1); |
5857 | 0 | ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n", |
5858 | 0 | pad, worklen); |
5859 | 0 | } |
5860 | | |
5861 | | /* MAC for GenericStreamCipher and GenericBlockCipher. |
5862 | | * (normal case without Encrypt-then-MAC (RFC 7366) extension. */ |
5863 | 0 | if (!mac) { |
5864 | | /* |
5865 | | * MAC is calculated over the DECRYPTED contents: |
5866 | | * |
5867 | | * MAC(MAC_write_key, ... + TLSCompressed.fragment); |
5868 | | */ |
5869 | 0 | if (worklen < maclen) { |
5870 | 0 | ssl_debug_printf("%s wrong record len/padding outlen %d\n work %d\n", G_STRFUNC, *outl, worklen); |
5871 | 0 | return -1; |
5872 | 0 | } |
5873 | 0 | worklen -= maclen; |
5874 | 0 | mac = out_str->data + worklen; |
5875 | 0 | mac_frag = out_str->data; |
5876 | 0 | mac_fraglen = worklen; |
5877 | 0 | } |
5878 | | |
5879 | | /* If NULL encryption active and no keys are available, do not bother |
5880 | | * checking the MAC. We do not have keys for that. */ |
5881 | 0 | if (decoder->cipher_suite->mode == MODE_STREAM && |
5882 | 0 | decoder->cipher_suite->enc == ENC_NULL && |
5883 | 0 | !(ssl->state & SSL_MASTER_SECRET)) { |
5884 | 0 | ssl_debug_printf("MAC check skipped due to missing keys\n"); |
5885 | 0 | decoder->seq++; // Increment this for display |
5886 | 0 | goto skip_mac; |
5887 | 0 | } |
5888 | | |
5889 | | /* Now check the MAC */ |
5890 | 0 | ssl_debug_printf("checking mac (len %d, version %X, ct %d seq %" PRIu64 ")\n", |
5891 | 0 | worklen, ssl->session.version, ct, decoder->seq); |
5892 | 0 | if(ssl->session.version==SSLV3_VERSION){ |
5893 | 0 | if(ssl3_check_mac(decoder,ct,mac_frag,mac_fraglen,mac) < 0) { |
5894 | 0 | if(ignore_mac_failed) { |
5895 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n"); |
5896 | 0 | } |
5897 | 0 | else{ |
5898 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed\n"); |
5899 | 0 | return -1; |
5900 | 0 | } |
5901 | 0 | } |
5902 | 0 | else{ |
5903 | 0 | ssl_debug_printf("ssl_decrypt_record: mac ok\n"); |
5904 | 0 | } |
5905 | 0 | } |
5906 | 0 | else if(ssl->session.version==TLSV1_VERSION || ssl->session.version==TLSV1DOT1_VERSION || ssl->session.version==TLSV1DOT2_VERSION || ssl->session.version==TLCPV1_VERSION){ |
5907 | 0 | if(tls_check_mac(decoder,ct,ssl->session.version,mac_frag,mac_fraglen,mac)< 0) { |
5908 | 0 | if(ignore_mac_failed) { |
5909 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n"); |
5910 | 0 | } |
5911 | 0 | else{ |
5912 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed\n"); |
5913 | 0 | return -1; |
5914 | 0 | } |
5915 | 0 | } |
5916 | 0 | else{ |
5917 | 0 | ssl_debug_printf("ssl_decrypt_record: mac ok\n"); |
5918 | 0 | } |
5919 | 0 | } |
5920 | 0 | else if(ssl->session.version==DTLSV1DOT0_VERSION || |
5921 | 0 | ssl->session.version==DTLSV1DOT2_VERSION || |
5922 | 0 | ssl->session.version==DTLSV1DOT0_OPENSSL_VERSION){ |
5923 | | /* Try rfc-compliant mac first, and if failed, try old openssl's non-rfc-compliant mac */ |
5924 | 0 | if(dtls_check_mac(ssl,decoder,ct,mac_frag,mac_fraglen,mac,cid,cidl)>= 0) { |
5925 | 0 | ssl_debug_printf("ssl_decrypt_record: mac ok\n"); |
5926 | 0 | } |
5927 | 0 | else if(tls_check_mac(decoder,ct,TLSV1_VERSION,mac_frag,mac_fraglen,mac)>= 0) { |
5928 | 0 | ssl_debug_printf("ssl_decrypt_record: dtls rfc-compliant mac failed, but old openssl's non-rfc-compliant mac ok\n"); |
5929 | 0 | } |
5930 | 0 | else if(ignore_mac_failed) { |
5931 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed, but ignored for troubleshooting ;-)\n"); |
5932 | 0 | } |
5933 | 0 | else{ |
5934 | 0 | ssl_debug_printf("ssl_decrypt_record: mac failed\n"); |
5935 | 0 | return -1; |
5936 | 0 | } |
5937 | 0 | } |
5938 | 0 | skip_mac: |
5939 | |
|
5940 | 0 | *outl = worklen; |
5941 | |
|
5942 | 0 | if (decoder->compression > 0) { |
5943 | 0 | ssl_debug_printf("ssl_decrypt_record: compression method %d\n", decoder->compression); |
5944 | 0 | ssl_data_copy(comp_str, out_str); |
5945 | 0 | ssl_print_data("Plaintext compressed", comp_str->data, worklen); |
5946 | 0 | if (!decoder->decomp) { |
5947 | 0 | ssl_debug_printf("decrypt_ssl3_record: no decoder available\n"); |
5948 | 0 | return -1; |
5949 | 0 | } |
5950 | 0 | if (ssl_decompress_record(decoder->decomp, comp_str->data, worklen, out_str, &uncomplen) < 0) return -1; |
5951 | 0 | ssl_print_data("Plaintext uncompressed", out_str->data, uncomplen); |
5952 | 0 | *outl = uncomplen; |
5953 | 0 | } |
5954 | | |
5955 | 0 | return 0; |
5956 | 0 | } |
5957 | | /* Record decryption glue based on security parameters }}} */ |
5958 | | |
5959 | | |
5960 | | |
5961 | | #ifdef HAVE_LIBGNUTLS |
5962 | | |
5963 | | /* RSA private key file processing {{{ */ |
5964 | | static void |
5965 | | ssl_find_private_key_by_pubkey(SslDecryptSession *ssl, |
5966 | | const gnutls_datum_t *subjectPublicKeyInfo) |
5967 | | { |
5968 | | gnutls_pubkey_t pubkey = NULL; |
5969 | | cert_key_id_t key_id; |
5970 | | size_t key_id_len = sizeof(key_id); |
5971 | | int r; |
5972 | | |
5973 | | if (!subjectPublicKeyInfo->size) { |
5974 | | ssl_debug_printf("%s: could not find SubjectPublicKeyInfo\n", G_STRFUNC); |
5975 | | return; |
5976 | | } |
5977 | | |
5978 | | r = gnutls_pubkey_init(&pubkey); |
5979 | | if (r < 0) { |
5980 | | ssl_debug_printf("%s: failed to init pubkey: %s\n", |
5981 | | G_STRFUNC, gnutls_strerror(r)); |
5982 | | return; |
5983 | | } |
5984 | | |
5985 | | r = gnutls_pubkey_import(pubkey, subjectPublicKeyInfo, GNUTLS_X509_FMT_DER); |
5986 | | if (r < 0) { |
5987 | | ssl_debug_printf("%s: failed to import pubkey from handshake: %s\n", |
5988 | | G_STRFUNC, gnutls_strerror(r)); |
5989 | | goto end; |
5990 | | } |
5991 | | |
5992 | | if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL) != GNUTLS_PK_RSA) { |
5993 | | ssl_debug_printf("%s: Not a RSA public key - ignoring.\n", G_STRFUNC); |
5994 | | goto end; |
5995 | | } |
5996 | | |
5997 | | /* Generate a 20-byte SHA-1 hash. */ |
5998 | | r = gnutls_pubkey_get_key_id(pubkey, 0, key_id.key_id, &key_id_len); |
5999 | | if (r < 0) { |
6000 | | ssl_debug_printf("%s: failed to extract key id from pubkey: %s\n", |
6001 | | G_STRFUNC, gnutls_strerror(r)); |
6002 | | goto end; |
6003 | | } |
6004 | | |
6005 | | if (key_id_len != sizeof(key_id)) { |
6006 | | ssl_debug_printf("%s: expected Key ID size %zu, got %zu\n", |
6007 | | G_STRFUNC, sizeof(key_id), key_id_len); |
6008 | | goto end; |
6009 | | } |
6010 | | |
6011 | | ssl_print_data("Certificate.KeyID", key_id.key_id, key_id_len); |
6012 | | ssl->cert_key_id = wmem_new(wmem_file_scope(), cert_key_id_t); |
6013 | | *ssl->cert_key_id = key_id; |
6014 | | |
6015 | | end: |
6016 | | gnutls_pubkey_deinit(pubkey); |
6017 | | } |
6018 | | |
6019 | | /* RSA private key file processing }}} */ |
6020 | | #endif /* HAVE_LIBGNUTLS */ |
6021 | | |
6022 | | /*--- Start of dissector-related code below ---*/ |
6023 | | |
6024 | | /* This is not a "protocol" but ensures that this gets called during |
6025 | | * the handoff stage. */ |
6026 | | void proto_reg_handoff_tls_utils(void); |
6027 | | |
6028 | | static dissector_handle_t base_tls_handle; |
6029 | | static dissector_handle_t dtls_handle; |
6030 | | |
6031 | | void |
6032 | | proto_reg_handoff_tls_utils(void) |
6033 | 14 | { |
6034 | 14 | base_tls_handle = find_dissector("tls"); |
6035 | 14 | dtls_handle = find_dissector("dtls"); |
6036 | 14 | } |
6037 | | |
6038 | | /* get ssl data for this session. if no ssl data is found allocate a new one*/ |
6039 | | SslDecryptSession * |
6040 | | ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle) |
6041 | 787 | { |
6042 | 787 | void *conv_data; |
6043 | 787 | SslDecryptSession *ssl_session; |
6044 | 787 | int proto_ssl; |
6045 | | |
6046 | | /* Note proto_ssl is tls for either the main tls_handle or the |
6047 | | * tls13_handshake handle used by QUIC. */ |
6048 | 787 | proto_ssl = dissector_handle_get_protocol_index(tls_handle); |
6049 | 787 | conv_data = conversation_get_proto_data(conversation, proto_ssl); |
6050 | 787 | if (conv_data != NULL) |
6051 | 533 | return (SslDecryptSession *)conv_data; |
6052 | | |
6053 | | /* no previous SSL conversation info, initialize it. */ |
6054 | 254 | ssl_session = wmem_new0(wmem_file_scope(), SslDecryptSession); |
6055 | | |
6056 | | /* data_len is the part that is meaningful, not the allocated length */ |
6057 | 254 | ssl_session->master_secret.data_len = 0; |
6058 | 254 | ssl_session->master_secret.data = ssl_session->_master_secret; |
6059 | 254 | ssl_session->session_id.data_len = 0; |
6060 | 254 | ssl_session->session_id.data = ssl_session->_session_id; |
6061 | 254 | ssl_session->client_random.data_len = 0; |
6062 | 254 | ssl_session->client_random.data = ssl_session->_client_random; |
6063 | 254 | ssl_session->server_random.data_len = 0; |
6064 | 254 | ssl_session->server_random.data = ssl_session->_server_random; |
6065 | 254 | ssl_session->session_ticket.data_len = 0; |
6066 | 254 | ssl_session->session_ticket.data = NULL; /* will be re-alloced as needed */ |
6067 | 254 | ssl_session->server_data_for_iv.data_len = 0; |
6068 | 254 | ssl_session->server_data_for_iv.data = ssl_session->_server_data_for_iv; |
6069 | 254 | ssl_session->client_data_for_iv.data_len = 0; |
6070 | 254 | ssl_session->client_data_for_iv.data = ssl_session->_client_data_for_iv; |
6071 | 254 | ssl_session->app_data_segment.data = NULL; |
6072 | 254 | ssl_session->app_data_segment.data_len = 0; |
6073 | 254 | ssl_session->handshake_data.data=NULL; |
6074 | 254 | ssl_session->handshake_data.data_len=0; |
6075 | 254 | ssl_session->ech_transcript.data=NULL; |
6076 | 254 | ssl_session->ech_transcript.data_len=0; |
6077 | | |
6078 | | /* Initialize parameters which are not necessary specific to decryption. */ |
6079 | 254 | ssl_session->session.version = SSL_VER_UNKNOWN; |
6080 | 254 | clear_address(&ssl_session->session.srv_addr); |
6081 | 254 | ssl_session->session.srv_ptype = PT_NONE; |
6082 | 254 | ssl_session->session.srv_port = 0; |
6083 | 254 | ssl_session->session.dtls13_current_epoch[0] = ssl_session->session.dtls13_current_epoch[1] = 0; |
6084 | 254 | ssl_session->session.dtls13_next_seq_num[0] = ssl_session->session.dtls13_next_seq_num[1] = 0; |
6085 | 254 | ssl_session->session.client_random.data_len = 0; |
6086 | 254 | ssl_session->session.client_random.data = ssl_session->session._client_random; |
6087 | 254 | memset(ssl_session->session.ech_confirmation, 0, sizeof(ssl_session->session.ech_confirmation)); |
6088 | 254 | memset(ssl_session->session.hrr_ech_confirmation, 0, sizeof(ssl_session->session.hrr_ech_confirmation)); |
6089 | 254 | memset(ssl_session->session.first_ech_auth_tag, 0, sizeof(ssl_session->session.first_ech_auth_tag)); |
6090 | 254 | ssl_session->session.ech = false; |
6091 | 254 | ssl_session->session.hrr_ech_declined = false; |
6092 | 254 | ssl_session->session.first_ch_ech_frame = 0; |
6093 | | |
6094 | | /* We want to increment the stream count for the normal tls handle and |
6095 | | * dtls handle, but presumably not for the tls13_handshake handle used |
6096 | | * by QUIC (it has its own Follow Stream handling, and the QUIC stream |
6097 | | * doesn't get sent to the TLS follow tap.) |
6098 | | */ |
6099 | 254 | if (tls_handle == base_tls_handle) { |
6100 | 117 | ssl_session->session.stream = tls_increment_stream_count(); |
6101 | 137 | } else if (tls_handle == dtls_handle) { |
6102 | 137 | ssl_session->session.stream = dtls_increment_stream_count(); |
6103 | 137 | } |
6104 | | |
6105 | 254 | conversation_add_proto_data(conversation, proto_ssl, ssl_session); |
6106 | 254 | return ssl_session; |
6107 | 787 | } |
6108 | | |
6109 | | void ssl_reset_session(SslSession *session, SslDecryptSession *ssl, bool is_client) |
6110 | 217 | { |
6111 | 217 | if (ssl) { |
6112 | | /* Ensure that secrets are not restored using stale identifiers. Split |
6113 | | * between client and server in case the packets somehow got out of order. */ |
6114 | 217 | int clear_flags = SSL_HAVE_SESSION_KEY | SSL_MASTER_SECRET | SSL_PRE_MASTER_SECRET; |
6115 | | |
6116 | 217 | if (is_client) { |
6117 | 185 | clear_flags |= SSL_CLIENT_EXTENDED_MASTER_SECRET; |
6118 | 185 | ssl->session_id.data_len = 0; |
6119 | 185 | ssl->session_ticket.data_len = 0; |
6120 | 185 | ssl->master_secret.data_len = 0; |
6121 | 185 | ssl->client_random.data_len = 0; |
6122 | 185 | ssl->has_early_data = false; |
6123 | 185 | if (ssl->handshake_data.data_len > 0) { |
6124 | | // The EMS handshake hash starts with at the Client Hello, |
6125 | | // ensure that any messages before it are forgotten. |
6126 | 21 | wmem_free(wmem_file_scope(), ssl->handshake_data.data); |
6127 | 21 | ssl->handshake_data.data = NULL; |
6128 | 21 | ssl->handshake_data.data_len = 0; |
6129 | 21 | } |
6130 | 185 | } else { |
6131 | 32 | clear_flags |= SSL_SERVER_EXTENDED_MASTER_SECRET | SSL_NEW_SESSION_TICKET; |
6132 | 32 | ssl->server_random.data_len = 0; |
6133 | 32 | ssl->pre_master_secret.data_len = 0; |
6134 | | #ifdef HAVE_LIBGNUTLS |
6135 | | ssl->cert_key_id = NULL; |
6136 | | #endif |
6137 | 32 | ssl->psk.data_len = 0; |
6138 | 32 | } |
6139 | | |
6140 | 217 | if (ssl->state & clear_flags) { |
6141 | 0 | ssl_debug_printf("%s detected renegotiation, clearing 0x%02x (%s side)\n", |
6142 | 0 | G_STRFUNC, ssl->state & clear_flags, is_client ? "client" : "server"); |
6143 | 0 | ssl->state &= ~clear_flags; |
6144 | 0 | } |
6145 | 217 | } |
6146 | | |
6147 | | /* These flags might be used for non-decryption purposes and may affect the |
6148 | | * dissection, so reset them as well. */ |
6149 | 217 | if (is_client) { |
6150 | 185 | session->client_cert_type = 0; |
6151 | 185 | } else { |
6152 | 32 | session->compression = 0; |
6153 | 32 | session->server_cert_type = 0; |
6154 | | /* session->is_session_resumed is already handled in the ServerHello dissection. */ |
6155 | 32 | } |
6156 | 217 | session->dtls13_next_seq_num[0] = session->dtls13_next_seq_num[1] = 0; |
6157 | 217 | session->dtls13_current_epoch[0] = session->dtls13_current_epoch[1] = 0; |
6158 | 217 | } |
6159 | | |
6160 | | void |
6161 | | tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo, |
6162 | | dissector_handle_t app_handle) |
6163 | 58 | { |
6164 | 58 | conversation_t *conversation; |
6165 | 58 | SslSession *session; |
6166 | | |
6167 | | /* Ignore if the TLS or other dissector is disabled. */ |
6168 | 58 | if (!tls_handle || !app_handle) |
6169 | 0 | return; |
6170 | | |
6171 | 58 | conversation = find_or_create_conversation(pinfo); |
6172 | 58 | session = &ssl_get_session(conversation, tls_handle)->session; |
6173 | 58 | session->app_handle = app_handle; |
6174 | 58 | } |
6175 | | |
6176 | | static uint32_t |
6177 | | ssl_starttls(dissector_handle_t tls_handle, packet_info *pinfo, |
6178 | | dissector_handle_t app_handle, uint32_t last_nontls_frame) |
6179 | 9 | { |
6180 | 9 | conversation_t *conversation; |
6181 | 9 | SslSession *session; |
6182 | | |
6183 | | /* Ignore if the TLS dissector is disabled. */ |
6184 | 9 | if (!tls_handle) |
6185 | 0 | return 0; |
6186 | | /* The caller should always pass a valid handle to its own dissector. */ |
6187 | 9 | DISSECTOR_ASSERT(app_handle); |
6188 | | |
6189 | 9 | conversation = find_or_create_conversation(pinfo); |
6190 | 9 | session = &ssl_get_session(conversation, tls_handle)->session; |
6191 | | |
6192 | 9 | ssl_debug_printf("%s: old frame %d, app_handle=%p (%s)\n", G_STRFUNC, |
6193 | 9 | session->last_nontls_frame, |
6194 | 9 | (void *)session->app_handle, |
6195 | 9 | dissector_handle_get_dissector_name(session->app_handle)); |
6196 | 9 | ssl_debug_printf("%s: current frame %d, app_handle=%p (%s)\n", G_STRFUNC, |
6197 | 9 | pinfo->num, (void *)app_handle, |
6198 | 9 | dissector_handle_get_dissector_name(app_handle)); |
6199 | | |
6200 | | /* Do not switch again if a dissector did it before. */ |
6201 | 9 | if (session->last_nontls_frame) { |
6202 | 0 | ssl_debug_printf("%s: not overriding previous app handle!\n", G_STRFUNC); |
6203 | 0 | return session->last_nontls_frame; |
6204 | 0 | } |
6205 | | |
6206 | 9 | session->app_handle = app_handle; |
6207 | | /* The TLS dissector should be called first for this conversation. */ |
6208 | 9 | conversation_set_dissector(conversation, tls_handle); |
6209 | | /* TLS starts after this frame. */ |
6210 | 9 | session->last_nontls_frame = last_nontls_frame; |
6211 | 9 | return 0; |
6212 | 9 | } |
6213 | | |
6214 | | /* ssl_starttls_ack: mark future frames as encrypted. */ |
6215 | | uint32_t |
6216 | | ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo, |
6217 | | dissector_handle_t app_handle) |
6218 | 0 | { |
6219 | 0 | return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num); |
6220 | 0 | } |
6221 | | |
6222 | | uint32_t |
6223 | | ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo, |
6224 | | dissector_handle_t app_handle) |
6225 | 9 | { |
6226 | 9 | return ssl_starttls(tls_handle, pinfo, app_handle, pinfo->num - 1); |
6227 | 9 | } |
6228 | | |
6229 | | dissector_handle_t |
6230 | | ssl_find_appdata_dissector(const char *name) |
6231 | 0 | { |
6232 | | /* Accept 'http' for backwards compatibility and sanity. */ |
6233 | 0 | if (!strcmp(name, "http")) |
6234 | 0 | name = "http-over-tls"; |
6235 | | /* XXX - Should this check to see if the dissector is actually added for |
6236 | | * Decode As in the appropriate table? |
6237 | | */ |
6238 | 0 | return find_dissector(name); |
6239 | 0 | } |
6240 | | |
6241 | | /* Functions for TLS/DTLS sessions and RSA private keys hashtables. {{{ */ |
6242 | | static int |
6243 | | ssl_equal (const void *v, const void *v2) |
6244 | 22 | { |
6245 | 22 | const StringInfo *val1; |
6246 | 22 | const StringInfo *val2; |
6247 | 22 | val1 = (const StringInfo *)v; |
6248 | 22 | val2 = (const StringInfo *)v2; |
6249 | | |
6250 | 22 | if (val1->data_len == val2->data_len && |
6251 | 22 | !memcmp(val1->data, val2->data, val2->data_len)) { |
6252 | 18 | return 1; |
6253 | 18 | } |
6254 | 4 | return 0; |
6255 | 22 | } |
6256 | | |
6257 | | static unsigned |
6258 | | ssl_hash (const void *v) |
6259 | 69 | { |
6260 | 69 | unsigned l,hash; |
6261 | 69 | const StringInfo* id; |
6262 | 69 | const unsigned* cur; |
6263 | 69 | hash = 0; |
6264 | 69 | id = (const StringInfo*) v; |
6265 | | |
6266 | | /* id and id->data are mallocated in ssl_save_master_key(). As such 'data' |
6267 | | * should be aligned for any kind of access (for example as a unsigned as |
6268 | | * is done below). The intermediate void* cast is to prevent "cast |
6269 | | * increases required alignment of target type" warnings on CPUs (such |
6270 | | * as SPARCs) that do not allow misaligned memory accesses. |
6271 | | */ |
6272 | 69 | cur = (const unsigned*)(void*) id->data; |
6273 | | |
6274 | 552 | for (l=4; (l < id->data_len); l+=4, cur++) |
6275 | 483 | hash = hash ^ (*cur); |
6276 | | |
6277 | 69 | return hash; |
6278 | 69 | } |
6279 | | /* Functions for TLS/DTLS sessions and RSA private keys hashtables. }}} */ |
6280 | | |
6281 | | /* Handling of association between tls/dtls ports and clear text protocol. {{{ */ |
6282 | | void |
6283 | | ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool tcp) |
6284 | 588 | { |
6285 | 588 | DISSECTOR_ASSERT(main_handle); |
6286 | 588 | DISSECTOR_ASSERT(subdissector_handle); |
6287 | | /* Registration is required for Export PDU feature to work properly. */ |
6288 | 588 | DISSECTOR_ASSERT_HINT(dissector_handle_get_dissector_name(subdissector_handle), |
6289 | 588 | "SSL appdata dissectors must register with register_dissector()!"); |
6290 | 588 | ssl_debug_printf("association_add %s port %d handle %p\n", dissector_table_name, port, (void *)subdissector_handle); |
6291 | | |
6292 | 588 | if (port) { |
6293 | 378 | dissector_add_uint(dissector_table_name, port, subdissector_handle); |
6294 | 378 | if (tcp) |
6295 | 336 | dissector_add_uint("tcp.port", port, main_handle); |
6296 | 42 | else |
6297 | 42 | dissector_add_uint("udp.port", port, main_handle); |
6298 | 378 | dissector_add_uint("sctp.port", port, main_handle); |
6299 | 378 | } else { |
6300 | 210 | dissector_add_for_decode_as(dissector_table_name, subdissector_handle); |
6301 | 210 | } |
6302 | 588 | } |
6303 | | |
6304 | | void |
6305 | | ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, unsigned port, bool tcp) |
6306 | 0 | { |
6307 | 0 | ssl_debug_printf("ssl_association_remove removing %s %u - handle %p\n", |
6308 | 0 | tcp?"TCP":"UDP", port, (void *)subdissector_handle); |
6309 | 0 | if (main_handle) { |
6310 | 0 | dissector_delete_uint(tcp?"tcp.port":"udp.port", port, main_handle); |
6311 | 0 | dissector_delete_uint("sctp.port", port, main_handle); |
6312 | 0 | } |
6313 | |
|
6314 | 0 | if (port) { |
6315 | 0 | dissector_delete_uint(dissector_table_name, port, subdissector_handle); |
6316 | 0 | } |
6317 | 0 | } |
6318 | | |
6319 | | void |
6320 | | ssl_set_server(SslSession *session, address *addr, port_type ptype, uint32_t port) |
6321 | 190 | { |
6322 | 190 | copy_address_wmem(wmem_file_scope(), &session->srv_addr, addr); |
6323 | 190 | session->srv_ptype = ptype; |
6324 | 190 | session->srv_port = port; |
6325 | 190 | } |
6326 | | |
6327 | | int |
6328 | | ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo) |
6329 | 1.27k | { |
6330 | 1.27k | int ret; |
6331 | 1.27k | if (session && session->srv_addr.type != AT_NONE) { |
6332 | 144 | ret = (session->srv_ptype == pinfo->ptype) && |
6333 | 144 | (session->srv_port == pinfo->srcport) && |
6334 | 0 | addresses_equal(&session->srv_addr, &pinfo->src); |
6335 | 1.12k | } else { |
6336 | 1.12k | ret = (dissector_get_uint_handle(table, pinfo->srcport) != 0); |
6337 | 1.12k | } |
6338 | | |
6339 | 1.27k | ssl_debug_printf("packet_from_server: is from server - %s\n", (ret)?"TRUE":"FALSE"); |
6340 | 1.27k | return ret; |
6341 | 1.27k | } |
6342 | | /* Handling of association between tls/dtls ports and clear text protocol. }}} */ |
6343 | | |
6344 | | |
6345 | | /* Links SSL records with the real packet data. {{{ */ |
6346 | | SslPacketInfo * |
6347 | | tls_add_packet_info(int proto, packet_info *pinfo, uint8_t curr_layer_num_ssl) |
6348 | 25 | { |
6349 | 25 | SslPacketInfo *pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl); |
6350 | 25 | if (!pi) { |
6351 | 18 | pi = wmem_new0(wmem_file_scope(), SslPacketInfo); |
6352 | 18 | pi->srcport = pinfo->srcport; |
6353 | 18 | pi->destport = pinfo->destport; |
6354 | 18 | p_add_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl, pi); |
6355 | 18 | } |
6356 | | |
6357 | 25 | return pi; |
6358 | 25 | } |
6359 | | |
6360 | | /** |
6361 | | * Remembers the decrypted TLS record fragment (TLSInnerPlaintext in TLS 1.3) to |
6362 | | * avoid the need for a decoder in the second pass. Additionally, it remembers |
6363 | | * sequence numbers (for reassembly and Follow TLS Stream). |
6364 | | * |
6365 | | * @param proto The protocol identifier (proto_ssl or proto_dtls). |
6366 | | * @param pinfo The packet where the record originates from. |
6367 | | * @param plain_data Decrypted plaintext to store in the record. |
6368 | | * @param plain_data_len Total length of the plaintext. |
6369 | | * @param content_len Length of the plaintext section corresponding to the record content. |
6370 | | * @param record_id The identifier for this record within the current packet. |
6371 | | * @param flow Information about sequence numbers, etc. |
6372 | | * @param type TLS Content Type (such as handshake or application_data). |
6373 | | * @param curr_layer_num_ssl The layer identifier for this TLS session. |
6374 | | */ |
6375 | | void |
6376 | | ssl_add_record_info(int proto, packet_info *pinfo, |
6377 | | const unsigned char *plain_data, int plain_data_len, int content_len, |
6378 | | int record_id, SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl, |
6379 | | uint64_t record_seq) |
6380 | 0 | { |
6381 | 0 | SslRecordInfo* rec, **prec; |
6382 | 0 | SslPacketInfo *pi = tls_add_packet_info(proto, pinfo, curr_layer_num_ssl); |
6383 | |
|
6384 | 0 | ws_assert(content_len <= plain_data_len); |
6385 | |
|
6386 | 0 | rec = wmem_new(wmem_file_scope(), SslRecordInfo); |
6387 | 0 | rec->plain_data = (unsigned char *)wmem_memdup(wmem_file_scope(), plain_data, plain_data_len); |
6388 | 0 | rec->plain_data_len = plain_data_len; |
6389 | 0 | rec->content_len = content_len; |
6390 | 0 | rec->id = record_id; |
6391 | 0 | rec->type = type; |
6392 | 0 | rec->next = NULL; |
6393 | 0 | rec->record_seq = record_seq; |
6394 | |
|
6395 | 0 | if (flow && type == SSL_ID_APP_DATA) { |
6396 | 0 | rec->seq = flow->byte_seq; |
6397 | 0 | rec->flow = flow; |
6398 | 0 | flow->byte_seq += content_len; |
6399 | 0 | ssl_debug_printf("%s stored decrypted record seq=%d nxtseq=%d flow=%p\n", |
6400 | 0 | G_STRFUNC, rec->seq, rec->seq + content_len, (void*)flow); |
6401 | 0 | } |
6402 | | |
6403 | | /* Remember decrypted records. */ |
6404 | 0 | prec = &pi->records; |
6405 | 0 | while (*prec) prec = &(*prec)->next; |
6406 | 0 | *prec = rec; |
6407 | 0 | } |
6408 | | |
6409 | | /* search in packet data for the specified id; return a newly created tvb for the associated data */ |
6410 | | tvbuff_t* |
6411 | | ssl_get_record_info(tvbuff_t *parent_tvb, int proto, packet_info *pinfo, int record_id, uint8_t curr_layer_num_ssl, SslRecordInfo **matched_record) |
6412 | 527 | { |
6413 | 527 | SslRecordInfo* rec; |
6414 | 527 | SslPacketInfo* pi; |
6415 | 527 | pi = (SslPacketInfo *)p_get_proto_data(wmem_file_scope(), pinfo, proto, curr_layer_num_ssl); |
6416 | | |
6417 | 527 | if (!pi) |
6418 | 518 | return NULL; |
6419 | | |
6420 | 9 | for (rec = pi->records; rec; rec = rec->next) |
6421 | 0 | if (rec->id == record_id) { |
6422 | 0 | *matched_record = rec; |
6423 | | /* link new real_data_tvb with a parent tvb so it is freed when frame dissection is complete */ |
6424 | 0 | return tvb_new_child_real_data(parent_tvb, rec->plain_data, rec->plain_data_len, rec->plain_data_len); |
6425 | 0 | } |
6426 | | |
6427 | 9 | return NULL; |
6428 | 9 | } |
6429 | | /* Links SSL records with the real packet data. }}} */ |
6430 | | |
6431 | | /* initialize/reset per capture state data (ssl sessions cache). {{{ */ |
6432 | | void |
6433 | | ssl_common_init(ssl_master_key_map_t *mk_map, |
6434 | | StringInfo *decrypted_data, StringInfo *compressed_data) |
6435 | 14 | { |
6436 | 14 | mk_map->session = g_hash_table_new(ssl_hash, ssl_equal); |
6437 | 14 | mk_map->tickets = g_hash_table_new(ssl_hash, ssl_equal); |
6438 | 14 | mk_map->crandom = g_hash_table_new(ssl_hash, ssl_equal); |
6439 | 14 | mk_map->pre_master = g_hash_table_new(ssl_hash, ssl_equal); |
6440 | 14 | mk_map->pms = g_hash_table_new(ssl_hash, ssl_equal); |
6441 | 14 | mk_map->tls13_client_early = g_hash_table_new(ssl_hash, ssl_equal); |
6442 | 14 | mk_map->tls13_client_handshake = g_hash_table_new(ssl_hash, ssl_equal); |
6443 | 14 | mk_map->tls13_server_handshake = g_hash_table_new(ssl_hash, ssl_equal); |
6444 | 14 | mk_map->tls13_client_appdata = g_hash_table_new(ssl_hash, ssl_equal); |
6445 | 14 | mk_map->tls13_server_appdata = g_hash_table_new(ssl_hash, ssl_equal); |
6446 | 14 | mk_map->tls13_early_exporter = g_hash_table_new(ssl_hash, ssl_equal); |
6447 | 14 | mk_map->tls13_exporter = g_hash_table_new(ssl_hash, ssl_equal); |
6448 | | |
6449 | 14 | mk_map->ech_secret = g_hash_table_new(ssl_hash, ssl_equal); |
6450 | 14 | mk_map->ech_config = g_hash_table_new(ssl_hash, ssl_equal); |
6451 | | |
6452 | 14 | mk_map->used_crandom = g_hash_table_new(ssl_hash, ssl_equal); |
6453 | | |
6454 | 14 | ssl_data_alloc(decrypted_data, 32); |
6455 | 14 | ssl_data_alloc(compressed_data, 32); |
6456 | 14 | } |
6457 | | |
6458 | | void |
6459 | | ssl_common_cleanup(ssl_master_key_map_t *mk_map, FILE **ssl_keylog_file, |
6460 | | StringInfo *decrypted_data, StringInfo *compressed_data) |
6461 | 0 | { |
6462 | 0 | g_hash_table_destroy(mk_map->session); |
6463 | 0 | g_hash_table_destroy(mk_map->tickets); |
6464 | 0 | g_hash_table_destroy(mk_map->crandom); |
6465 | 0 | g_hash_table_destroy(mk_map->pre_master); |
6466 | 0 | g_hash_table_destroy(mk_map->pms); |
6467 | 0 | g_hash_table_destroy(mk_map->tls13_client_early); |
6468 | 0 | g_hash_table_destroy(mk_map->tls13_client_handshake); |
6469 | 0 | g_hash_table_destroy(mk_map->tls13_server_handshake); |
6470 | 0 | g_hash_table_destroy(mk_map->tls13_client_appdata); |
6471 | 0 | g_hash_table_destroy(mk_map->tls13_server_appdata); |
6472 | 0 | g_hash_table_destroy(mk_map->tls13_early_exporter); |
6473 | 0 | g_hash_table_destroy(mk_map->tls13_exporter); |
6474 | |
|
6475 | 0 | g_hash_table_destroy(mk_map->ech_secret); |
6476 | 0 | g_hash_table_destroy(mk_map->ech_config); |
6477 | |
|
6478 | 0 | g_hash_table_destroy(mk_map->used_crandom); |
6479 | |
|
6480 | 0 | g_free(decrypted_data->data); |
6481 | 0 | g_free(compressed_data->data); |
6482 | | |
6483 | | /* close the previous keylog file now that the cache are cleared, this |
6484 | | * allows the cache to be filled with the full keylog file contents. */ |
6485 | 0 | if (*ssl_keylog_file) { |
6486 | 0 | fclose(*ssl_keylog_file); |
6487 | 0 | *ssl_keylog_file = NULL; |
6488 | 0 | } |
6489 | 0 | } |
6490 | | /* }}} */ |
6491 | | |
6492 | | /* parse ssl related preferences (private keys and ports association strings) */ |
6493 | | #if defined(HAVE_LIBGNUTLS) |
6494 | | /* Load a single RSA key file item from preferences. {{{ */ |
6495 | | void |
6496 | | ssl_parse_key_list(const ssldecrypt_assoc_t *uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, bool tcp) |
6497 | | { |
6498 | | gnutls_x509_privkey_t x509_priv_key; |
6499 | | gnutls_privkey_t priv_key = NULL; |
6500 | | FILE* fp = NULL; |
6501 | | int ret; |
6502 | | size_t key_id_len = 20; |
6503 | | unsigned char *key_id = NULL; |
6504 | | char *err = NULL; |
6505 | | dissector_handle_t handle; |
6506 | | /* try to load keys file first */ |
6507 | | fp = ws_fopen(uats->keyfile, "rb"); |
6508 | | if (!fp) { |
6509 | | report_open_failure(uats->keyfile, errno, false); |
6510 | | return; |
6511 | | } |
6512 | | |
6513 | | if ((int)strlen(uats->password) == 0) { |
6514 | | x509_priv_key = rsa_load_pem_key(fp, &err); |
6515 | | } else { |
6516 | | x509_priv_key = rsa_load_pkcs12(fp, uats->password, &err); |
6517 | | } |
6518 | | fclose(fp); |
6519 | | |
6520 | | if (!x509_priv_key) { |
6521 | | if (err) { |
6522 | | report_failure("Can't load private key from %s: %s", |
6523 | | uats->keyfile, err); |
6524 | | g_free(err); |
6525 | | } else |
6526 | | report_failure("Can't load private key from %s: unknown error", |
6527 | | uats->keyfile); |
6528 | | return; |
6529 | | } |
6530 | | if (err) { |
6531 | | report_failure("Load of private key from %s \"succeeded\" with error %s", |
6532 | | uats->keyfile, err); |
6533 | | g_free(err); |
6534 | | } |
6535 | | |
6536 | | gnutls_privkey_init(&priv_key); |
6537 | | ret = gnutls_privkey_import_x509(priv_key, x509_priv_key, |
6538 | | GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE|GNUTLS_PRIVKEY_IMPORT_COPY); |
6539 | | if (ret < 0) { |
6540 | | report_failure("Can't convert private key %s: %s", |
6541 | | uats->keyfile, gnutls_strerror(ret)); |
6542 | | goto end; |
6543 | | } |
6544 | | |
6545 | | key_id = (unsigned char *) g_malloc0(key_id_len); |
6546 | | ret = gnutls_x509_privkey_get_key_id(x509_priv_key, 0, key_id, &key_id_len); |
6547 | | if (ret < 0) { |
6548 | | report_failure("Can't calculate public key ID for %s: %s", |
6549 | | uats->keyfile, gnutls_strerror(ret)); |
6550 | | goto end; |
6551 | | } |
6552 | | ssl_print_data("KeyID", key_id, key_id_len); |
6553 | | if (key_id_len != 20) { |
6554 | | report_failure("Expected Key ID size %u for %s, got %zu", 20, |
6555 | | uats->keyfile, key_id_len); |
6556 | | goto end; |
6557 | | } |
6558 | | |
6559 | | g_hash_table_replace(key_hash, key_id, priv_key); |
6560 | | key_id = NULL; /* used in key_hash, do not free. */ |
6561 | | priv_key = NULL; |
6562 | | ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile); |
6563 | | |
6564 | | handle = ssl_find_appdata_dissector(uats->protocol); |
6565 | | if (handle) { |
6566 | | /* Port to subprotocol mapping */ |
6567 | | uint16_t port = 0; |
6568 | | if (ws_strtou16(uats->port, NULL, &port)) { |
6569 | | if (port > 0) { |
6570 | | ssl_debug_printf("ssl_init port '%d' filename '%s' password(only for p12 file) '%s'\n", |
6571 | | port, uats->keyfile, uats->password); |
6572 | | |
6573 | | ssl_association_add(dissector_table_name, main_handle, handle, port, tcp); |
6574 | | } |
6575 | | } else { |
6576 | | if (strcmp(uats->port, "start_tls")) |
6577 | | ssl_debug_printf("invalid ssl_init_port: %s\n", uats->port); |
6578 | | } |
6579 | | } |
6580 | | |
6581 | | end: |
6582 | | gnutls_x509_privkey_deinit(x509_priv_key); |
6583 | | gnutls_privkey_deinit(priv_key); |
6584 | | g_free(key_id); |
6585 | | } |
6586 | | /* }}} */ |
6587 | | #endif |
6588 | | |
6589 | | |
6590 | | /* Store/load a known (pre-)master secret from/for this SSL session. {{{ */ |
6591 | | /** store a known (pre-)master secret into cache */ |
6592 | | static void |
6593 | | ssl_save_master_key(const char *label, GHashTable *ht, StringInfo *key, |
6594 | | StringInfo *mk) |
6595 | 0 | { |
6596 | 0 | StringInfo *ht_key, *master_secret; |
6597 | |
|
6598 | 0 | if (key->data_len == 0) { |
6599 | 0 | ssl_debug_printf("%s: not saving empty %s!\n", G_STRFUNC, label); |
6600 | 0 | return; |
6601 | 0 | } |
6602 | | |
6603 | 0 | if (mk->data_len == 0) { |
6604 | 0 | ssl_debug_printf("%s not saving empty (pre-)master secret for %s!\n", |
6605 | 0 | G_STRFUNC, label); |
6606 | 0 | return; |
6607 | 0 | } |
6608 | | |
6609 | | /* ssl_hash() depends on session_ticket->data being aligned for unsigned access |
6610 | | * so be careful in changing how it is allocated. */ |
6611 | 0 | ht_key = ssl_data_clone(key); |
6612 | 0 | master_secret = ssl_data_clone(mk); |
6613 | 0 | g_hash_table_insert(ht, ht_key, master_secret); |
6614 | |
|
6615 | 0 | ssl_debug_printf("%s inserted (pre-)master secret for %s\n", G_STRFUNC, label); |
6616 | 0 | ssl_print_string("stored key", ht_key); |
6617 | 0 | ssl_print_string("stored (pre-)master secret", master_secret); |
6618 | 0 | } |
6619 | | |
6620 | | /** restore a (pre-)master secret given some key in the cache */ |
6621 | | static bool |
6622 | | ssl_restore_master_key(SslDecryptSession *ssl, const char *label, |
6623 | | bool is_pre_master, GHashTable *ht, StringInfo *key) |
6624 | 3 | { |
6625 | 3 | StringInfo *ms; |
6626 | | |
6627 | 3 | if (key->data_len == 0) { |
6628 | 2 | ssl_debug_printf("%s can't restore %smaster secret using an empty %s\n", |
6629 | 2 | G_STRFUNC, is_pre_master ? "pre-" : "", label); |
6630 | 2 | return false; |
6631 | 2 | } |
6632 | | |
6633 | 1 | ms = (StringInfo *)g_hash_table_lookup(ht, key); |
6634 | 1 | if (!ms) { |
6635 | 1 | ssl_debug_printf("%s can't find %smaster secret by %s\n", G_STRFUNC, |
6636 | 1 | is_pre_master ? "pre-" : "", label); |
6637 | 1 | return false; |
6638 | 1 | } |
6639 | | |
6640 | | /* (pre)master secret found, clear knowledge of other keys and set it in the |
6641 | | * current conversation */ |
6642 | 0 | ssl->state &= ~(SSL_MASTER_SECRET | SSL_PRE_MASTER_SECRET | |
6643 | 0 | SSL_HAVE_SESSION_KEY); |
6644 | 0 | if (is_pre_master) { |
6645 | | /* unlike master secret, pre-master secret has a variable size (48 for |
6646 | | * RSA, varying for PSK) and is therefore not statically allocated */ |
6647 | 0 | ssl->pre_master_secret.data = (unsigned char *) wmem_alloc(wmem_file_scope(), |
6648 | 0 | ms->data_len); |
6649 | 0 | ssl_data_set(&ssl->pre_master_secret, ms->data, ms->data_len); |
6650 | 0 | ssl->state |= SSL_PRE_MASTER_SECRET; |
6651 | 0 | } else { |
6652 | 0 | ssl_data_set(&ssl->master_secret, ms->data, ms->data_len); |
6653 | 0 | ssl->state |= SSL_MASTER_SECRET; |
6654 | 0 | } |
6655 | 0 | ssl_debug_printf("%s %smaster secret retrieved using %s\n", G_STRFUNC, |
6656 | 0 | is_pre_master ? "pre-" : "", label); |
6657 | 0 | ssl_print_string(label, key); |
6658 | 0 | ssl_print_string("(pre-)master secret", ms); |
6659 | 0 | return true; |
6660 | 1 | } |
6661 | | /* Store/load a known (pre-)master secret from/for this SSL session. }}} */ |
6662 | | |
6663 | | /* Should be called when all parameters are ready (after ChangeCipherSpec), and |
6664 | | * the decoder should be attempted to be initialized. {{{*/ |
6665 | | void |
6666 | | ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map) |
6667 | 5 | { |
6668 | 5 | if (ssl->session.version == TLSV1DOT3_VERSION) { |
6669 | | /* TLS 1.3 implementations only provide secrets derived from the master |
6670 | | * secret which are loaded in tls13_change_key. No master secrets can be |
6671 | | * loaded here, so just return. */ |
6672 | 0 | return; |
6673 | 0 | } |
6674 | 5 | ssl_debug_printf("%s state = 0x%02X\n", G_STRFUNC, ssl->state); |
6675 | 5 | if (ssl->state & SSL_HAVE_SESSION_KEY) { |
6676 | 0 | ssl_debug_printf(" session key already available, nothing to do.\n"); |
6677 | 0 | return; |
6678 | 0 | } |
6679 | 5 | if (!(ssl->state & SSL_CIPHER)) { |
6680 | 4 | ssl_debug_printf(" Cipher suite (Server Hello) is missing!\n"); |
6681 | 4 | return; |
6682 | 4 | } |
6683 | | |
6684 | | /* for decryption, there needs to be a master secret (which can be derived |
6685 | | * from pre-master secret). If missing, try to pick a master key from cache |
6686 | | * (an earlier packet in the capture or key logfile). */ |
6687 | 1 | if (!(ssl->state & (SSL_MASTER_SECRET | SSL_PRE_MASTER_SECRET)) && |
6688 | 1 | !ssl_restore_master_key(ssl, "Session ID", false, |
6689 | 1 | mk_map->session, &ssl->session_id) && |
6690 | 1 | (!ssl->session.is_session_resumed || |
6691 | 1 | !ssl_restore_master_key(ssl, "Session Ticket", false, |
6692 | 1 | mk_map->tickets, &ssl->session_ticket)) && |
6693 | 1 | !ssl_restore_master_key(ssl, "Client Random", false, |
6694 | 1 | mk_map->crandom, &ssl->client_random)) { |
6695 | 1 | if (ssl->cipher_suite->enc != ENC_NULL) { |
6696 | | /* how unfortunate, the master secret could not be found */ |
6697 | 1 | ssl_debug_printf(" Cannot find master secret\n"); |
6698 | 1 | return; |
6699 | 1 | } else { |
6700 | 0 | ssl_debug_printf(" Cannot find master secret, continuing anyway " |
6701 | 0 | "because of a NULL cipher\n"); |
6702 | 0 | } |
6703 | 1 | } |
6704 | | |
6705 | 0 | if (ssl_generate_keyring_material(ssl) < 0) { |
6706 | 0 | ssl_debug_printf("%s can't generate keyring material\n", G_STRFUNC); |
6707 | 0 | return; |
6708 | 0 | } |
6709 | | /* Save Client Random/ Session ID for "SSL Export Session keys" */ |
6710 | 0 | ssl_save_master_key("Client Random", mk_map->crandom, |
6711 | 0 | &ssl->client_random, &ssl->master_secret); |
6712 | 0 | ssl_save_master_key("Session ID", mk_map->session, |
6713 | 0 | &ssl->session_id, &ssl->master_secret); |
6714 | | /* Only save the new secrets if the server sent the ticket. The client |
6715 | | * ticket might have become stale. */ |
6716 | 0 | if (ssl->state & SSL_NEW_SESSION_TICKET) { |
6717 | 0 | ssl_save_master_key("Session Ticket", mk_map->tickets, |
6718 | 0 | &ssl->session_ticket, &ssl->master_secret); |
6719 | 0 | } |
6720 | 0 | } /* }}} */ |
6721 | | |
6722 | | /* Load the traffic key secret from the keylog file. */ |
6723 | | StringInfo * |
6724 | | tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map, |
6725 | | bool is_from_server, TLSRecordType type) |
6726 | 38 | { |
6727 | 38 | GHashTable *key_map; |
6728 | 38 | const char *label; |
6729 | | |
6730 | 38 | if (ssl->session.version != TLSV1DOT3_VERSION && ssl->session.version != DTLSV1DOT3_VERSION) { |
6731 | 38 | ssl_debug_printf("%s TLS version %#x is not 1.3\n", G_STRFUNC, ssl->session.version); |
6732 | 38 | return NULL; |
6733 | 38 | } |
6734 | | |
6735 | 0 | if (ssl->client_random.data_len == 0) { |
6736 | | /* May happen if Hello message is missing and Finished is found. */ |
6737 | 0 | ssl_debug_printf("%s missing Client Random\n", G_STRFUNC); |
6738 | 0 | return NULL; |
6739 | 0 | } |
6740 | | |
6741 | 0 | switch (type) { |
6742 | 0 | case TLS_SECRET_0RTT_APP: |
6743 | 0 | DISSECTOR_ASSERT(!is_from_server); |
6744 | 0 | label = "CLIENT_EARLY_TRAFFIC_SECRET"; |
6745 | 0 | key_map = mk_map->tls13_client_early; |
6746 | 0 | break; |
6747 | 0 | case TLS_SECRET_HANDSHAKE: |
6748 | 0 | if (is_from_server) { |
6749 | 0 | label = "SERVER_HANDSHAKE_TRAFFIC_SECRET"; |
6750 | 0 | key_map = mk_map->tls13_server_handshake; |
6751 | 0 | } else { |
6752 | 0 | label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET"; |
6753 | 0 | key_map = mk_map->tls13_client_handshake; |
6754 | 0 | } |
6755 | 0 | break; |
6756 | 0 | case TLS_SECRET_APP: |
6757 | 0 | if (is_from_server) { |
6758 | 0 | label = "SERVER_TRAFFIC_SECRET_0"; |
6759 | 0 | key_map = mk_map->tls13_server_appdata; |
6760 | 0 | } else { |
6761 | 0 | label = "CLIENT_TRAFFIC_SECRET_0"; |
6762 | 0 | key_map = mk_map->tls13_client_appdata; |
6763 | 0 | } |
6764 | 0 | break; |
6765 | 0 | default: |
6766 | 0 | ws_assert_not_reached(); |
6767 | 0 | } |
6768 | | |
6769 | | /* Transitioning to new keys, mark old ones as unusable. */ |
6770 | 0 | ssl_debug_printf("%s transitioning to new key, old state 0x%02x\n", G_STRFUNC, ssl->state); |
6771 | 0 | ssl->state &= ~(SSL_MASTER_SECRET | SSL_PRE_MASTER_SECRET | SSL_HAVE_SESSION_KEY); |
6772 | |
|
6773 | 0 | StringInfo *secret = (StringInfo *)g_hash_table_lookup(key_map, &ssl->client_random); |
6774 | 0 | if (!secret) { |
6775 | 0 | ssl_debug_printf("%s Cannot find %s, decryption impossible\n", G_STRFUNC, label); |
6776 | | /* Disable decryption, the keys are invalid. */ |
6777 | 0 | if (is_from_server) { |
6778 | 0 | ssl->server = NULL; |
6779 | 0 | } else { |
6780 | 0 | ssl->client = NULL; |
6781 | 0 | } |
6782 | 0 | return NULL; |
6783 | 0 | } |
6784 | | |
6785 | | /* TLS 1.3 secret found, set new keys. */ |
6786 | 0 | ssl_debug_printf("%s Retrieved TLS 1.3 traffic secret.\n", G_STRFUNC); |
6787 | 0 | ssl_print_string("Client Random", &ssl->client_random); |
6788 | 0 | ssl_print_string(label, secret); |
6789 | 0 | return secret; |
6790 | 0 | } |
6791 | | |
6792 | | /* Load the new key. */ |
6793 | | void |
6794 | | tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map, |
6795 | | bool is_from_server, TLSRecordType type) |
6796 | 28 | { |
6797 | 28 | if (ssl->state & SSL_QUIC_RECORD_LAYER) { |
6798 | | /* |
6799 | | * QUIC does not use the TLS record layer for message protection. |
6800 | | * The required keys will be extracted later by QUIC. |
6801 | | */ |
6802 | 0 | return; |
6803 | 0 | } |
6804 | | |
6805 | 28 | StringInfo *secret = tls13_load_secret(ssl, mk_map, is_from_server, type); |
6806 | 28 | if (!secret) { |
6807 | 28 | if (type != TLS_SECRET_HANDSHAKE) { |
6808 | 18 | return; |
6809 | 18 | } |
6810 | | /* |
6811 | | * Workaround for when for some reason we don't have the handshake |
6812 | | * secret but do have the application traffic secret. (#20240) |
6813 | | * If we can't find the handshake secret, we'll never decrypt the |
6814 | | * Finished message, so we won't know when to change to the app |
6815 | | * traffic key, so we do so now. |
6816 | | */ |
6817 | 10 | type = TLS_SECRET_APP; |
6818 | 10 | secret = tls13_load_secret(ssl, mk_map, is_from_server, type); |
6819 | 10 | if (!secret) { |
6820 | 10 | return; |
6821 | 10 | } |
6822 | 10 | } |
6823 | | |
6824 | 0 | if (tls13_generate_keys(ssl, secret, is_from_server)) { |
6825 | | /* |
6826 | | * Remember the application traffic secret to support Key Update. The |
6827 | | * other secrets cannot be used for this purpose, so free them. |
6828 | | */ |
6829 | 0 | SslDecoder *decoder = is_from_server ? ssl->server : ssl->client; |
6830 | 0 | StringInfo *app_secret = &decoder->app_traffic_secret; |
6831 | 0 | if (type == TLS_SECRET_APP) { |
6832 | 0 | app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(), |
6833 | 0 | app_secret->data, |
6834 | 0 | secret->data_len); |
6835 | 0 | ssl_data_set(app_secret, secret->data, secret->data_len); |
6836 | 0 | } else { |
6837 | 0 | wmem_free(wmem_file_scope(), app_secret->data); |
6838 | 0 | app_secret->data = NULL; |
6839 | 0 | app_secret->data_len = 0; |
6840 | 0 | } |
6841 | 0 | } |
6842 | 0 | } |
6843 | | |
6844 | | /** |
6845 | | * Update to next application data traffic secret for TLS 1.3. The previous |
6846 | | * secret should have been set by tls13_change_key. |
6847 | | */ |
6848 | | void |
6849 | | tls13_key_update(SslDecryptSession *ssl, bool is_from_server) |
6850 | 0 | { |
6851 | | /* RFC 8446 Section 7.2: |
6852 | | * application_traffic_secret_N+1 = |
6853 | | * HKDF-Expand-Label(application_traffic_secret_N, |
6854 | | * "traffic upd", "", Hash.length) |
6855 | | * |
6856 | | * Both application_traffic_secret_N are of the same length (Hash.length). |
6857 | | */ |
6858 | 0 | const SslCipherSuite *cipher_suite = ssl->cipher_suite; |
6859 | 0 | SslDecoder *decoder = is_from_server ? ssl->server : ssl->client; |
6860 | 0 | StringInfo *app_secret = decoder ? &decoder->app_traffic_secret : NULL; |
6861 | 0 | uint8_t tls13_draft_version = ssl->session.tls13_draft_version; |
6862 | |
|
6863 | 0 | if (!cipher_suite || !app_secret || app_secret->data_len == 0) { |
6864 | 0 | ssl_debug_printf("%s Cannot perform Key Update due to missing info\n", G_STRFUNC); |
6865 | 0 | return; |
6866 | 0 | } |
6867 | | |
6868 | | /* |
6869 | | * Previous traffic secret is available, so find the hash function, |
6870 | | * expand the new traffic secret and generate new keys. |
6871 | | */ |
6872 | 0 | const char *hash_name = ssl_cipher_suite_dig(cipher_suite)->name; |
6873 | 0 | int hash_algo = ssl_get_digest_by_name(hash_name); |
6874 | 0 | const unsigned hash_len = app_secret->data_len; |
6875 | 0 | unsigned char *new_secret; |
6876 | 0 | const char *label = "traffic upd"; |
6877 | 0 | if (tls13_draft_version && tls13_draft_version < 20) { |
6878 | 0 | label = "application traffic secret"; |
6879 | 0 | } |
6880 | 0 | if (!tls13_hkdf_expand_label(hash_algo, app_secret, |
6881 | 0 | tls13_hkdf_label_prefix(ssl), |
6882 | 0 | label, hash_len, &new_secret)) { |
6883 | 0 | ssl_debug_printf("%s traffic_secret_N+1 expansion failed\n", G_STRFUNC); |
6884 | 0 | return; |
6885 | 0 | } |
6886 | 0 | ssl_data_set(app_secret, new_secret, hash_len); |
6887 | 0 | if (tls13_generate_keys(ssl, app_secret, is_from_server)) { |
6888 | | /* |
6889 | | * Remember the application traffic secret on the new decoder to |
6890 | | * support another Key Update. |
6891 | | */ |
6892 | 0 | decoder = is_from_server ? ssl->server : ssl->client; |
6893 | 0 | app_secret = &decoder->app_traffic_secret; |
6894 | 0 | app_secret->data = (unsigned char *) wmem_realloc(wmem_file_scope(), |
6895 | 0 | app_secret->data, |
6896 | 0 | hash_len); |
6897 | 0 | ssl_data_set(app_secret, new_secret, hash_len); |
6898 | 0 | } |
6899 | 0 | wmem_free(NULL, new_secret); |
6900 | 0 | } |
6901 | | |
6902 | | void |
6903 | | tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map) |
6904 | 68 | { |
6905 | 68 | if (ssl && (ssl->state & SSL_CLIENT_RANDOM)) { |
6906 | 68 | g_hash_table_add(mk_map->used_crandom, ssl_data_clone(&ssl->client_random)); |
6907 | 68 | } |
6908 | 68 | } |
6909 | | |
6910 | | /** SSL keylog file handling. {{{ */ |
6911 | | |
6912 | | static GRegex * |
6913 | | ssl_compile_keyfile_regex(void) |
6914 | 0 | { |
6915 | 0 | #define OCTET "(?:[[:xdigit:]]{2})" |
6916 | 0 | const char *pattern = |
6917 | 0 | "(?:" |
6918 | | /* Matches Client Hellos having this Client Random */ |
6919 | 0 | "PMS_CLIENT_RANDOM (?<client_random_pms>" OCTET "{32}) " |
6920 | | /* Matches first part of encrypted RSA pre-master secret */ |
6921 | 0 | "|RSA (?<encrypted_pmk>" OCTET "{8}) " |
6922 | | /* Pre-Master-Secret is given, it is 48 bytes for RSA, |
6923 | | but it can be of any length for DHE */ |
6924 | 0 | ")(?<pms>" OCTET "+)" |
6925 | 0 | "|(?:" |
6926 | | /* Matches Server Hellos having a Session ID */ |
6927 | 0 | "RSA Session-ID:(?<session_id>" OCTET "+) Master-Key:" |
6928 | | /* Matches Client Hellos having this Client Random */ |
6929 | 0 | "|CLIENT_RANDOM (?<client_random>" OCTET "{32}) " |
6930 | | /* Master-Secret is given, its length is fixed */ |
6931 | 0 | ")(?<master_secret>" OCTET "{" G_STRINGIFY(SSL_MASTER_SECRET_LENGTH) "})" |
6932 | 0 | "|(?" |
6933 | | /* TLS 1.3 Client Random to Derived Secrets mapping. */ |
6934 | 0 | ":CLIENT_EARLY_TRAFFIC_SECRET (?<client_early>" OCTET "{32})" |
6935 | 0 | "|CLIENT_HANDSHAKE_TRAFFIC_SECRET (?<client_handshake>" OCTET "{32})" |
6936 | 0 | "|SERVER_HANDSHAKE_TRAFFIC_SECRET (?<server_handshake>" OCTET "{32})" |
6937 | 0 | "|CLIENT_TRAFFIC_SECRET_0 (?<client_appdata>" OCTET "{32})" |
6938 | 0 | "|SERVER_TRAFFIC_SECRET_0 (?<server_appdata>" OCTET "{32})" |
6939 | 0 | "|EARLY_EXPORTER_SECRET (?<early_exporter>" OCTET "{32})" |
6940 | 0 | "|EXPORTER_SECRET (?<exporter>" OCTET "{32})" |
6941 | | /* ECH. Secret length is defined by HPKE KEM Nsecret and can vary between 32 and 64 bytes */ |
6942 | | /* These labels and their notation are specified in draft-ietf-tls-ech-keylogfile-01 */ |
6943 | 0 | "|ECH_SECRET (?<ech_secret>" OCTET "{32,64})" |
6944 | 0 | "|ECH_CONFIG (?<ech_config>" OCTET "{22,})" |
6945 | 0 | ") (?<derived_secret>" OCTET "+)"; |
6946 | 0 | #undef OCTET |
6947 | 0 | static GRegex *regex = NULL; |
6948 | 0 | GError *gerr = NULL; |
6949 | |
|
6950 | 0 | if (!regex) { |
6951 | 0 | regex = g_regex_new(pattern, |
6952 | 0 | (GRegexCompileFlags)(G_REGEX_OPTIMIZE | G_REGEX_ANCHORED | G_REGEX_RAW), |
6953 | 0 | G_REGEX_MATCH_ANCHORED, &gerr); |
6954 | 0 | if (gerr) { |
6955 | 0 | ssl_debug_printf("%s failed to compile regex: %s\n", G_STRFUNC, |
6956 | 0 | gerr->message); |
6957 | 0 | g_error_free(gerr); |
6958 | 0 | regex = NULL; |
6959 | 0 | } |
6960 | 0 | } |
6961 | |
|
6962 | 0 | return regex; |
6963 | 0 | } |
6964 | | |
6965 | | typedef struct ssl_master_key_match_group { |
6966 | | const char *re_group_name; |
6967 | | GHashTable *master_key_ht; |
6968 | | } ssl_master_key_match_group_t; |
6969 | | |
6970 | | void |
6971 | | tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const uint8_t *data, unsigned datalen) |
6972 | 0 | { |
6973 | 0 | ssl_master_key_match_group_t mk_groups[] = { |
6974 | 0 | { "encrypted_pmk", mk_map->pre_master }, |
6975 | 0 | { "session_id", mk_map->session }, |
6976 | 0 | { "client_random", mk_map->crandom }, |
6977 | 0 | { "client_random_pms", mk_map->pms }, |
6978 | | /* TLS 1.3 map from Client Random to derived secret. */ |
6979 | 0 | { "client_early", mk_map->tls13_client_early }, |
6980 | 0 | { "client_handshake", mk_map->tls13_client_handshake }, |
6981 | 0 | { "server_handshake", mk_map->tls13_server_handshake }, |
6982 | 0 | { "client_appdata", mk_map->tls13_client_appdata }, |
6983 | 0 | { "server_appdata", mk_map->tls13_server_appdata }, |
6984 | 0 | { "early_exporter", mk_map->tls13_early_exporter }, |
6985 | 0 | { "exporter", mk_map->tls13_exporter }, |
6986 | 0 | { "ech_secret", mk_map->ech_secret }, |
6987 | 0 | { "ech_config", mk_map->ech_config }, |
6988 | 0 | }; |
6989 | | |
6990 | | /* The format of the file is a series of records with one of the following formats: |
6991 | | * - "RSA xxxx yyyy" |
6992 | | * Where xxxx are the first 8 bytes of the encrypted pre-master secret (hex-encoded) |
6993 | | * Where yyyy is the cleartext pre-master secret (hex-encoded) |
6994 | | * (this is the original format introduced with bug 4349) |
6995 | | * |
6996 | | * - "RSA Session-ID:xxxx Master-Key:yyyy" |
6997 | | * Where xxxx is the SSL session ID (hex-encoded) |
6998 | | * Where yyyy is the cleartext master secret (hex-encoded) |
6999 | | * (added to support openssl s_client Master-Key output) |
7000 | | * This is somewhat is a misnomer because there's nothing RSA specific |
7001 | | * about this. |
7002 | | * |
7003 | | * - "PMS_CLIENT_RANDOM xxxx yyyy" |
7004 | | * Where xxxx is the client_random from the ClientHello (hex-encoded) |
7005 | | * Where yyyy is the cleartext pre-master secret (hex-encoded) |
7006 | | * (This format allows SSL connections to be decrypted, if a user can |
7007 | | * capture the PMS but could not recover the MS for a specific session |
7008 | | * with a SSL Server.) |
7009 | | * |
7010 | | * - "CLIENT_RANDOM xxxx yyyy" |
7011 | | * Where xxxx is the client_random from the ClientHello (hex-encoded) |
7012 | | * Where yyyy is the cleartext master secret (hex-encoded) |
7013 | | * (This format allows non-RSA SSL connections to be decrypted, i.e. |
7014 | | * ECDHE-RSA.) |
7015 | | * |
7016 | | * - "CLIENT_EARLY_TRAFFIC_SECRET xxxx yyyy" |
7017 | | * - "CLIENT_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy" |
7018 | | * - "SERVER_HANDSHAKE_TRAFFIC_SECRET xxxx yyyy" |
7019 | | * - "CLIENT_TRAFFIC_SECRET_0 xxxx yyyy" |
7020 | | * - "SERVER_TRAFFIC_SECRET_0 xxxx yyyy" |
7021 | | * - "EARLY_EXPORTER_SECRET xxxx yyyy" |
7022 | | * - "EXPORTER_SECRET xxxx yyyy" |
7023 | | * Where xxxx is the client_random from the ClientHello (hex-encoded) |
7024 | | * Where yyyy is the secret (hex-encoded) derived from the early, |
7025 | | * handshake or master secrets. (This format is introduced with TLS 1.3 |
7026 | | * and supported by BoringSSL, OpenSSL, etc. See bug 12779.) |
7027 | | */ |
7028 | 0 | GRegex *regex = ssl_compile_keyfile_regex(); |
7029 | 0 | if (!regex) |
7030 | 0 | return; |
7031 | | |
7032 | 0 | const char *next_line = (const char *)data; |
7033 | 0 | const char *line_end = next_line + datalen; |
7034 | 0 | while (next_line && next_line < line_end) { |
7035 | 0 | const char *line = next_line; |
7036 | 0 | next_line = (const char *)memchr(line, '\n', line_end - line); |
7037 | 0 | ssize_t linelen; |
7038 | |
|
7039 | 0 | if (next_line) { |
7040 | 0 | linelen = next_line - line; |
7041 | 0 | next_line++; /* drop LF */ |
7042 | 0 | } else { |
7043 | 0 | linelen = (ssize_t)(line_end - line); |
7044 | 0 | } |
7045 | 0 | if (linelen > 0 && line[linelen - 1] == '\r') { |
7046 | 0 | linelen--; /* drop CR */ |
7047 | 0 | } |
7048 | |
|
7049 | 0 | ssl_debug_printf(" checking keylog line: %.*s\n", (int)linelen, line); |
7050 | 0 | GMatchInfo *mi; |
7051 | 0 | if (g_regex_match_full(regex, line, linelen, 0, G_REGEX_MATCH_ANCHORED, &mi, NULL)) { |
7052 | 0 | char *hex_key, *hex_pre_ms_or_ms; |
7053 | 0 | StringInfo *key = wmem_new(wmem_file_scope(), StringInfo); |
7054 | 0 | StringInfo *pre_ms_or_ms = NULL; |
7055 | 0 | GHashTable *ht = NULL; |
7056 | | |
7057 | | /* Is the PMS being supplied with the PMS_CLIENT_RANDOM |
7058 | | * otherwise we will use the Master Secret |
7059 | | */ |
7060 | 0 | hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "master_secret"); |
7061 | 0 | if (hex_pre_ms_or_ms == NULL || !*hex_pre_ms_or_ms) { |
7062 | 0 | g_free(hex_pre_ms_or_ms); |
7063 | 0 | hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "pms"); |
7064 | 0 | } |
7065 | 0 | if (hex_pre_ms_or_ms == NULL || !*hex_pre_ms_or_ms) { |
7066 | 0 | g_free(hex_pre_ms_or_ms); |
7067 | 0 | hex_pre_ms_or_ms = g_match_info_fetch_named(mi, "derived_secret"); |
7068 | 0 | } |
7069 | | /* There is always a match, otherwise the regex is wrong. */ |
7070 | 0 | DISSECTOR_ASSERT(hex_pre_ms_or_ms && strlen(hex_pre_ms_or_ms)); |
7071 | | |
7072 | | /* convert from hex to bytes and save to hashtable */ |
7073 | 0 | pre_ms_or_ms = wmem_new(wmem_file_scope(), StringInfo); |
7074 | 0 | from_hex(pre_ms_or_ms, hex_pre_ms_or_ms, strlen(hex_pre_ms_or_ms)); |
7075 | 0 | g_free(hex_pre_ms_or_ms); |
7076 | | |
7077 | | /* Find a master key from any format (CLIENT_RANDOM, SID, ...) */ |
7078 | 0 | for (unsigned i = 0; i < G_N_ELEMENTS(mk_groups); i++) { |
7079 | 0 | ssl_master_key_match_group_t *g = &mk_groups[i]; |
7080 | 0 | hex_key = g_match_info_fetch_named(mi, g->re_group_name); |
7081 | 0 | if (hex_key && *hex_key) { |
7082 | 0 | ssl_debug_printf(" matched %s\n", g->re_group_name); |
7083 | 0 | ht = g->master_key_ht; |
7084 | 0 | from_hex(key, hex_key, strlen(hex_key)); |
7085 | 0 | g_free(hex_key); |
7086 | 0 | break; |
7087 | 0 | } |
7088 | 0 | g_free(hex_key); |
7089 | 0 | } |
7090 | 0 | DISSECTOR_ASSERT(ht); /* Cannot be reached, or regex is wrong. */ |
7091 | |
|
7092 | 0 | g_hash_table_insert(ht, key, pre_ms_or_ms); |
7093 | |
|
7094 | 0 | } else if (linelen > 0 && line[0] != '#') { |
7095 | 0 | ssl_debug_printf(" unrecognized line\n"); |
7096 | 0 | } |
7097 | | /* always free match info even if there is no match. */ |
7098 | 0 | g_match_info_free(mi); |
7099 | 0 | } |
7100 | 0 | } |
7101 | | |
7102 | | void |
7103 | | ssl_load_keyfile(const char *tls_keylog_filename, FILE **keylog_file, |
7104 | | const ssl_master_key_map_t *mk_map) |
7105 | 41 | { |
7106 | | /* no need to try if no key log file is configured. */ |
7107 | 41 | if (!tls_keylog_filename || !*tls_keylog_filename) { |
7108 | 41 | ssl_debug_printf("%s dtls/tls.keylog_file is not configured!\n", |
7109 | 41 | G_STRFUNC); |
7110 | 41 | return; |
7111 | 41 | } |
7112 | | |
7113 | | /* Validate regexes before even trying to use it. */ |
7114 | 0 | if (!ssl_compile_keyfile_regex()) { |
7115 | 0 | return; |
7116 | 0 | } |
7117 | | |
7118 | 0 | ssl_debug_printf("trying to use TLS keylog in %s\n", tls_keylog_filename); |
7119 | | |
7120 | | /* if the keylog file was deleted/overwritten, re-open it */ |
7121 | 0 | if (*keylog_file && file_needs_reopen(ws_fileno(*keylog_file), tls_keylog_filename)) { |
7122 | 0 | ssl_debug_printf("%s file got deleted, trying to re-open\n", G_STRFUNC); |
7123 | 0 | fclose(*keylog_file); |
7124 | 0 | *keylog_file = NULL; |
7125 | 0 | } |
7126 | |
|
7127 | 0 | if (*keylog_file == NULL) { |
7128 | 0 | *keylog_file = ws_fopen(tls_keylog_filename, "r"); |
7129 | 0 | if (!*keylog_file) { |
7130 | 0 | ssl_debug_printf("%s failed to open SSL keylog\n", G_STRFUNC); |
7131 | 0 | return; |
7132 | 0 | } |
7133 | 0 | } |
7134 | | |
7135 | 0 | for (;;) { |
7136 | 0 | char buf[1110], *line; |
7137 | 0 | line = fgets(buf, sizeof(buf), *keylog_file); |
7138 | 0 | if (!line) { |
7139 | 0 | if (feof(*keylog_file)) { |
7140 | | /* Ensure that newly appended keys can be read in the future. */ |
7141 | 0 | clearerr(*keylog_file); |
7142 | 0 | } else if (ferror(*keylog_file)) { |
7143 | 0 | ssl_debug_printf("%s Error while reading key log file, closing it!\n", G_STRFUNC); |
7144 | 0 | fclose(*keylog_file); |
7145 | 0 | *keylog_file = NULL; |
7146 | 0 | } |
7147 | 0 | break; |
7148 | 0 | } |
7149 | 0 | tls_keylog_process_lines(mk_map, (uint8_t *)line, (int)strlen(line)); |
7150 | 0 | } |
7151 | 0 | } |
7152 | | /** SSL keylog file handling. }}} */ |
7153 | | |
7154 | | #ifdef SSL_DECRYPT_DEBUG /* {{{ */ |
7155 | | |
7156 | | static FILE* ssl_debug_file; |
7157 | | |
7158 | | void |
7159 | | ssl_set_debug(const char* name) |
7160 | 0 | { |
7161 | 0 | static int debug_file_must_be_closed; |
7162 | 0 | int use_stderr; |
7163 | |
|
7164 | 0 | use_stderr = name?(strcmp(name, SSL_DEBUG_USE_STDERR) == 0):0; |
7165 | |
|
7166 | 0 | if (debug_file_must_be_closed) |
7167 | 0 | fclose(ssl_debug_file); |
7168 | |
|
7169 | 0 | if (use_stderr) |
7170 | 0 | ssl_debug_file = stderr; |
7171 | 0 | else if (!name || (strcmp(name, "") ==0)) |
7172 | 0 | ssl_debug_file = NULL; |
7173 | 0 | else |
7174 | 0 | ssl_debug_file = ws_fopen(name, "w"); |
7175 | |
|
7176 | 0 | if (!use_stderr && ssl_debug_file) |
7177 | 0 | debug_file_must_be_closed = 1; |
7178 | 0 | else |
7179 | 0 | debug_file_must_be_closed = 0; |
7180 | |
|
7181 | 0 | ssl_debug_printf("Wireshark SSL debug log \n\n"); |
7182 | | #ifdef HAVE_LIBGNUTLS |
7183 | | ssl_debug_printf("GnuTLS version: %s\n", gnutls_check_version(NULL)); |
7184 | | #endif |
7185 | 0 | ssl_debug_printf("Libgcrypt version: %s\n", gcry_check_version(NULL)); |
7186 | 0 | ssl_debug_printf("\n"); |
7187 | 0 | } |
7188 | | |
7189 | | void |
7190 | | ssl_debug_flush(void) |
7191 | 181 | { |
7192 | 181 | if (ssl_debug_file) |
7193 | 0 | fflush(ssl_debug_file); |
7194 | 181 | } |
7195 | | |
7196 | | void |
7197 | | ssl_debug_printf(const char* fmt, ...) |
7198 | 6.09k | { |
7199 | 6.09k | va_list ap; |
7200 | | |
7201 | 6.09k | if (!ssl_debug_file) |
7202 | 6.09k | return; |
7203 | | |
7204 | 6.09k | va_start(ap, fmt); |
7205 | 0 | vfprintf(ssl_debug_file, fmt, ap); |
7206 | 0 | va_end(ap); |
7207 | 0 | } |
7208 | | |
7209 | | void |
7210 | | ssl_print_data(const char* name, const unsigned char* data, size_t len) |
7211 | 0 | { |
7212 | 0 | size_t i, j, k; |
7213 | 0 | if (!ssl_debug_file) |
7214 | 0 | return; |
7215 | 0 | fprintf(ssl_debug_file,"%s[%d]:\n",name, (int) len); |
7216 | 0 | for (i=0; i<len; i+=16) { |
7217 | 0 | fprintf(ssl_debug_file,"| "); |
7218 | 0 | for (j=i, k=0; k<16 && j<len; ++j, ++k) |
7219 | 0 | fprintf(ssl_debug_file,"%.2x ",data[j]); |
7220 | 0 | for (; k<16; ++k) |
7221 | 0 | fprintf(ssl_debug_file," "); |
7222 | 0 | fputc('|', ssl_debug_file); |
7223 | 0 | for (j=i, k=0; k<16 && j<len; ++j, ++k) { |
7224 | 0 | unsigned char c = data[j]; |
7225 | 0 | if (!g_ascii_isprint(c) || (c=='\t')) c = '.'; |
7226 | 0 | fputc(c, ssl_debug_file); |
7227 | 0 | } |
7228 | 0 | for (; k<16; ++k) |
7229 | 0 | fputc(' ', ssl_debug_file); |
7230 | 0 | fprintf(ssl_debug_file,"|\n"); |
7231 | 0 | } |
7232 | 0 | } |
7233 | | |
7234 | | void |
7235 | | ssl_print_string(const char* name, const StringInfo* data) |
7236 | 0 | { |
7237 | 0 | ssl_print_data(name, data->data, data->data_len); |
7238 | 0 | } |
7239 | | #endif /* SSL_DECRYPT_DEBUG }}} */ |
7240 | | |
7241 | | /* UAT preferences callbacks. {{{ */ |
7242 | | /* checks for SSL and DTLS UAT key list fields */ |
7243 | | |
7244 | | bool |
7245 | | ssldecrypt_uat_fld_ip_chk_cb(void* r _U_, const char* p _U_, unsigned len _U_, const void* u1 _U_, const void* u2 _U_, char** err) |
7246 | 0 | { |
7247 | | // This should be removed in favor of Decode As. Make it optional. |
7248 | 0 | *err = NULL; |
7249 | 0 | return true; |
7250 | 0 | } |
7251 | | |
7252 | | bool |
7253 | | ssldecrypt_uat_fld_port_chk_cb(void* r _U_, const char* p, unsigned len _U_, const void* u1 _U_, const void* u2 _U_, char** err) |
7254 | 0 | { |
7255 | 0 | if (!p || strlen(p) == 0u) { |
7256 | | // This should be removed in favor of Decode As. Make it optional. |
7257 | 0 | *err = NULL; |
7258 | 0 | return true; |
7259 | 0 | } |
7260 | | |
7261 | 0 | if (strcmp(p, "start_tls") != 0){ |
7262 | 0 | uint16_t port; |
7263 | 0 | if (!ws_strtou16(p, NULL, &port)) { |
7264 | 0 | *err = g_strdup("Invalid port given."); |
7265 | 0 | return false; |
7266 | 0 | } |
7267 | 0 | } |
7268 | | |
7269 | 0 | *err = NULL; |
7270 | 0 | return true; |
7271 | 0 | } |
7272 | | |
7273 | | bool |
7274 | | ssldecrypt_uat_fld_fileopen_chk_cb(void* r _U_, const char* p, unsigned len _U_, const void* u1 _U_, const void* u2 _U_, char** err) |
7275 | 0 | { |
7276 | 0 | ws_statb64 st; |
7277 | |
|
7278 | 0 | if (!p || strlen(p) == 0u) { |
7279 | 0 | *err = g_strdup("No filename given."); |
7280 | 0 | return false; |
7281 | 0 | } else { |
7282 | 0 | if (ws_stat64(p, &st) != 0) { |
7283 | 0 | *err = ws_strdup_printf("File '%s' does not exist or access is denied.", p); |
7284 | 0 | return false; |
7285 | 0 | } |
7286 | 0 | } |
7287 | | |
7288 | 0 | *err = NULL; |
7289 | 0 | return true; |
7290 | 0 | } |
7291 | | |
7292 | | bool |
7293 | | ssldecrypt_uat_fld_password_chk_cb(void *r _U_, const char *p _U_, unsigned len _U_, const void *u1 _U_, const void *u2 _U_, char **err) |
7294 | 0 | { |
7295 | | #if defined(HAVE_LIBGNUTLS) |
7296 | | ssldecrypt_assoc_t* f = (ssldecrypt_assoc_t *)r; |
7297 | | FILE *fp = NULL; |
7298 | | |
7299 | | if (p && (strlen(p) > 0u)) { |
7300 | | fp = ws_fopen(f->keyfile, "rb"); |
7301 | | if (fp) { |
7302 | | char *msg = NULL; |
7303 | | gnutls_x509_privkey_t priv_key = rsa_load_pkcs12(fp, p, &msg); |
7304 | | if (!priv_key) { |
7305 | | fclose(fp); |
7306 | | *err = ws_strdup_printf("Could not load PKCS#12 key file: %s", msg); |
7307 | | g_free(msg); |
7308 | | return false; |
7309 | | } |
7310 | | g_free(msg); |
7311 | | gnutls_x509_privkey_deinit(priv_key); |
7312 | | fclose(fp); |
7313 | | } else { |
7314 | | *err = ws_strdup_printf("Leave this field blank if the keyfile is not PKCS#12."); |
7315 | | return false; |
7316 | | } |
7317 | | } |
7318 | | |
7319 | | *err = NULL; |
7320 | | return true; |
7321 | | #else |
7322 | 0 | *err = g_strdup("Cannot load key files, support is not compiled in."); |
7323 | 0 | return false; |
7324 | 0 | #endif |
7325 | 0 | } |
7326 | | /* UAT preferences callbacks. }}} */ |
7327 | | |
7328 | | /** maximum size of ssl_association_info() string */ |
7329 | 0 | #define SSL_ASSOC_MAX_LEN 8192 |
7330 | | |
7331 | | typedef struct ssl_association_info_callback_data |
7332 | | { |
7333 | | char *str; |
7334 | | const char *table_protocol; |
7335 | | } ssl_association_info_callback_data_t; |
7336 | | |
7337 | | /** |
7338 | | * callback function used by ssl_association_info() to traverse the SSL associations. |
7339 | | */ |
7340 | | static void |
7341 | | ssl_association_info_(const char *table _U_, void *handle, void *user_data) |
7342 | 0 | { |
7343 | 0 | ssl_association_info_callback_data_t* data = (ssl_association_info_callback_data_t*)user_data; |
7344 | 0 | const int l = (const int)strlen(data->str); |
7345 | 0 | snprintf(data->str+l, SSL_ASSOC_MAX_LEN-l, "'%s' (%s)\n", dissector_handle_get_dissector_name((dissector_handle_t)handle), dissector_handle_get_description((dissector_handle_t)handle)); |
7346 | 0 | } |
7347 | | |
7348 | | /** |
7349 | | * @return an information string on the SSL protocol associations. The string must be freed. |
7350 | | */ |
7351 | | char* |
7352 | | ssl_association_info(const char* dissector_table_name, const char* table_protocol) |
7353 | 0 | { |
7354 | 0 | ssl_association_info_callback_data_t data; |
7355 | |
|
7356 | 0 | data.str = (char *)g_malloc0(SSL_ASSOC_MAX_LEN); |
7357 | 0 | data.table_protocol = table_protocol; |
7358 | 0 | dissector_table_foreach_handle(dissector_table_name, ssl_association_info_, &data); |
7359 | 0 | return data.str; |
7360 | 0 | } |
7361 | | |
7362 | | |
7363 | | /** Begin of code related to dissection of wire data. */ |
7364 | | |
7365 | | /* Helpers for dissecting Variable-Length Vectors. {{{ */ |
7366 | | bool |
7367 | | ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
7368 | | unsigned offset, unsigned offset_end, uint32_t *ret_length, |
7369 | | int hf_length, uint32_t min_value, uint32_t max_value) |
7370 | 7.71k | { |
7371 | 7.71k | unsigned veclen_size; |
7372 | 7.71k | uint32_t veclen_value; |
7373 | 7.71k | proto_item *pi; |
7374 | | |
7375 | 7.71k | DISSECTOR_ASSERT_CMPUINT(min_value, <=, max_value); |
7376 | 7.71k | if (offset > offset_end) { |
7377 | 9 | expert_add_info_format(pinfo, tree, &hf->ei.malformed_buffer_too_small, |
7378 | 9 | "Vector offset is past buffer end offset (%u > %u)", |
7379 | 9 | offset, offset_end); |
7380 | 9 | *ret_length = 0; |
7381 | 9 | return false; /* Cannot read length. */ |
7382 | 9 | } |
7383 | | |
7384 | 7.71k | if (max_value > 0xffffff) { |
7385 | 0 | veclen_size = 4; |
7386 | 7.71k | } else if (max_value > 0xffff) { |
7387 | 0 | veclen_size = 3; |
7388 | 7.71k | } else if (max_value > 0xff) { |
7389 | 7.38k | veclen_size = 2; |
7390 | 7.38k | } else { |
7391 | 328 | veclen_size = 1; |
7392 | 328 | } |
7393 | | |
7394 | 7.71k | if (offset_end - offset < veclen_size) { |
7395 | 3.25k | proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small, |
7396 | 3.25k | tvb, offset, offset_end - offset, |
7397 | 3.25k | "No more room for vector of length %u", |
7398 | 3.25k | veclen_size); |
7399 | 3.25k | *ret_length = 0; |
7400 | 3.25k | return false; /* Cannot read length. */ |
7401 | 3.25k | } |
7402 | | |
7403 | 4.45k | pi = proto_tree_add_item_ret_uint(tree, hf_length, tvb, offset, veclen_size, ENC_BIG_ENDIAN, &veclen_value); |
7404 | 4.45k | offset += veclen_size; |
7405 | | |
7406 | 4.45k | if (veclen_value < min_value) { |
7407 | 1.15k | expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length, |
7408 | 1.15k | "Vector length %u is smaller than minimum %u", |
7409 | 1.15k | veclen_value, min_value); |
7410 | 3.30k | } else if (veclen_value > max_value) { |
7411 | 48 | expert_add_info_format(pinfo, pi, &hf->ei.malformed_vector_length, |
7412 | 48 | "Vector length %u is larger than maximum %u", |
7413 | 48 | veclen_value, max_value); |
7414 | 48 | } |
7415 | | |
7416 | 4.45k | if (offset_end - offset < veclen_value) { |
7417 | 500 | expert_add_info_format(pinfo, pi, &hf->ei.malformed_buffer_too_small, |
7418 | 500 | "Vector length %u is too large, truncating it to %u", |
7419 | 500 | veclen_value, offset_end - offset); |
7420 | 500 | *ret_length = offset_end - offset; |
7421 | 500 | return false; /* Length is truncated to avoid overflow. */ |
7422 | 500 | } |
7423 | | |
7424 | 3.95k | *ret_length = veclen_value; |
7425 | 3.95k | return true; /* Length is OK. */ |
7426 | 4.45k | } |
7427 | | |
7428 | | bool |
7429 | | ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
7430 | | unsigned offset, unsigned offset_end) |
7431 | 2.94k | { |
7432 | 2.94k | if (offset < offset_end) { |
7433 | 433 | unsigned trailing = offset_end - offset; |
7434 | 433 | proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_trailing_data, |
7435 | 433 | tvb, offset, trailing, |
7436 | 433 | "%u trailing byte%s unprocessed", |
7437 | 433 | trailing, plurality(trailing, " was", "s were")); |
7438 | 433 | return false; /* unprocessed data warning */ |
7439 | 2.51k | } else if (offset > offset_end) { |
7440 | | /* |
7441 | | * Returned offset runs past the end. This should not happen and is |
7442 | | * possibly a dissector bug. |
7443 | | */ |
7444 | 526 | unsigned excess = offset - offset_end; |
7445 | 526 | proto_tree_add_expert_format(tree, pinfo, &hf->ei.malformed_buffer_too_small, |
7446 | 526 | tvb, offset_end, excess, |
7447 | 526 | "Dissector processed too much data (%u byte%s)", |
7448 | 526 | excess, plurality(excess, "", "s")); |
7449 | 526 | return false; /* overflow error */ |
7450 | 526 | } |
7451 | | |
7452 | 1.98k | return true; /* OK, offset matches. */ |
7453 | 2.94k | } |
7454 | | /** }}} */ |
7455 | | |
7456 | | |
7457 | | static uint32_t |
7458 | | ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
7459 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
7460 | | uint16_t version, int hf_sig_len, int hf_sig); |
7461 | | |
7462 | | /* change_cipher_spec(20) dissection */ |
7463 | | void |
7464 | | ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7465 | | packet_info *pinfo, proto_tree *tree, |
7466 | | uint32_t offset, SslSession *session, |
7467 | | bool is_from_server, |
7468 | | const SslDecryptSession *ssl) |
7469 | 5 | { |
7470 | | /* |
7471 | | * struct { |
7472 | | * enum { change_cipher_spec(1), (255) } type; |
7473 | | * } ChangeCipherSpec; |
7474 | | */ |
7475 | 5 | proto_item *ti; |
7476 | 5 | proto_item_set_text(tree, |
7477 | 5 | "%s Record Layer: %s Protocol: Change Cipher Spec", |
7478 | 5 | val_to_str_const(session->version, ssl_version_short_names, "SSL"), |
7479 | 5 | val_to_str_const(SSL_ID_CHG_CIPHER_SPEC, ssl_31_content_type, "unknown")); |
7480 | 5 | ti = proto_tree_add_item(tree, hf->hf.change_cipher_spec, tvb, offset, 1, ENC_NA); |
7481 | | |
7482 | 5 | if (session->version == TLSV1DOT3_VERSION) { |
7483 | | /* CCS is a dummy message in TLS 1.3, do not parse it further. */ |
7484 | 0 | return; |
7485 | 0 | } |
7486 | | |
7487 | | /* Remember frame number of first CCS */ |
7488 | 5 | uint32_t *ccs_frame = is_from_server ? &session->server_ccs_frame : &session->client_ccs_frame; |
7489 | 5 | if (*ccs_frame == 0) |
7490 | 4 | *ccs_frame = pinfo->num; |
7491 | | |
7492 | | /* Use heuristics to detect an abbreviated handshake, assume that missing |
7493 | | * ServerHelloDone implies reusing previously negotiating keys. Then when |
7494 | | * a Session ID or ticket is present, it must be a resumed session. |
7495 | | * Normally this should be done at the Finished message, but that may be |
7496 | | * encrypted so we do it here, at the last cleartext message. */ |
7497 | 5 | if (is_from_server && ssl) { |
7498 | 1 | if (session->is_session_resumed) { |
7499 | 0 | const char *resumed = NULL; |
7500 | 0 | if (ssl->session_ticket.data_len) { |
7501 | 0 | resumed = "Session Ticket"; |
7502 | 0 | } else if (ssl->session_id.data_len) { |
7503 | 0 | resumed = "Session ID"; |
7504 | 0 | } |
7505 | 0 | if (resumed) { |
7506 | 0 | ssl_debug_printf("%s Session resumption using %s\n", G_STRFUNC, resumed); |
7507 | 0 | } else { |
7508 | | /* Can happen if the capture somehow starts in the middle */ |
7509 | 0 | ssl_debug_printf("%s No Session resumption, missing packets?\n", G_STRFUNC); |
7510 | 0 | } |
7511 | 1 | } else { |
7512 | 1 | ssl_debug_printf("%s Not using Session resumption\n", G_STRFUNC); |
7513 | 1 | } |
7514 | 1 | } |
7515 | 5 | if (is_from_server && session->is_session_resumed) |
7516 | 0 | expert_add_info(pinfo, ti, &hf->ei.resumed); |
7517 | 5 | } |
7518 | | |
7519 | | /** Begin of handshake(22) record dissections */ |
7520 | | |
7521 | | /* Dissects a SignatureScheme (TLS 1.3) or SignatureAndHashAlgorithm (TLS 1.2). |
7522 | | * {{{ */ |
7523 | | static void |
7524 | | tls_dissect_signature_algorithm(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, ja4_data_t *ja4_data) |
7525 | 0 | { |
7526 | 0 | uint32_t sighash, hashalg, sigalg; |
7527 | 0 | proto_item *ti_sigalg; |
7528 | 0 | proto_tree *sigalg_tree; |
7529 | |
|
7530 | 0 | ti_sigalg = proto_tree_add_item_ret_uint(tree, hf->hf.hs_sig_hash_alg, tvb, |
7531 | 0 | offset, 2, ENC_BIG_ENDIAN, &sighash); |
7532 | 0 | if (ja4_data) { |
7533 | 0 | wmem_list_append(ja4_data->sighash_list, GUINT_TO_POINTER(sighash)); |
7534 | 0 | } |
7535 | |
|
7536 | 0 | sigalg_tree = proto_item_add_subtree(ti_sigalg, hf->ett.hs_sig_hash_alg); |
7537 | | |
7538 | | /* TLS 1.2: SignatureAndHashAlgorithm { hash, signature } */ |
7539 | 0 | proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_hash, tvb, |
7540 | 0 | offset, 1, ENC_BIG_ENDIAN, &hashalg); |
7541 | 0 | proto_tree_add_item_ret_uint(sigalg_tree, hf->hf.hs_sig_hash_sig, tvb, |
7542 | 0 | offset + 1, 1, ENC_BIG_ENDIAN, &sigalg); |
7543 | | |
7544 | | /* No TLS 1.3 SignatureScheme? Fallback to TLS 1.2 interpretation. */ |
7545 | 0 | if (!try_val_to_str(sighash, tls13_signature_algorithm)) { |
7546 | 0 | proto_item_set_text(ti_sigalg, "Signature Algorithm: %s %s (0x%04x)", |
7547 | 0 | val_to_str_const(hashalg, tls_hash_algorithm, "Unknown"), |
7548 | 0 | val_to_str_const(sigalg, tls_signature_algorithm, "Unknown"), |
7549 | 0 | sighash); |
7550 | 0 | } |
7551 | 0 | } /* }}} */ |
7552 | | |
7553 | | /* dissect a list of hash algorithms, return the number of bytes dissected |
7554 | | this is used for the signature algorithms extension and for the |
7555 | | TLS1.2 certificate request. {{{ */ |
7556 | | static int |
7557 | | ssl_dissect_hash_alg_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, |
7558 | | packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data) |
7559 | 4 | { |
7560 | | /* https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 |
7561 | | * struct { |
7562 | | * HashAlgorithm hash; |
7563 | | * SignatureAlgorithm signature; |
7564 | | * } SignatureAndHashAlgorithm; |
7565 | | * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; |
7566 | | */ |
7567 | 4 | proto_tree *subtree; |
7568 | 4 | proto_item *ti; |
7569 | 4 | unsigned sh_alg_length; |
7570 | 4 | uint32_t next_offset; |
7571 | | |
7572 | | /* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2> */ |
7573 | 4 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sh_alg_length, |
7574 | 4 | hf->hf.hs_sig_hash_alg_len, 2, UINT16_MAX - 1)) { |
7575 | 4 | return offset_end; |
7576 | 4 | } |
7577 | 0 | offset += 2; |
7578 | 0 | next_offset = offset + sh_alg_length; |
7579 | |
|
7580 | 0 | ti = proto_tree_add_none_format(tree, hf->hf.hs_sig_hash_algs, tvb, offset, sh_alg_length, |
7581 | 0 | "Signature Hash Algorithms (%u algorithm%s)", |
7582 | 0 | sh_alg_length / 2, plurality(sh_alg_length / 2, "", "s")); |
7583 | 0 | subtree = proto_item_add_subtree(ti, hf->ett.hs_sig_hash_algs); |
7584 | |
|
7585 | 0 | while (offset + 2 <= next_offset) { |
7586 | 0 | tls_dissect_signature_algorithm(hf, tvb, subtree, offset, ja4_data); |
7587 | 0 | offset += 2; |
7588 | 0 | } |
7589 | |
|
7590 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) { |
7591 | 0 | offset = next_offset; |
7592 | 0 | } |
7593 | |
|
7594 | 0 | return offset; |
7595 | 4 | } /* }}} */ |
7596 | | |
7597 | | /* Dissection of DistinguishedName (for CertificateRequest and |
7598 | | * certificate_authorities extension). {{{ */ |
7599 | | static uint32_t |
7600 | | tls_dissect_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
7601 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
7602 | 0 | { |
7603 | 0 | proto_item *ti; |
7604 | 0 | proto_tree *subtree; |
7605 | 0 | uint32_t dnames_length, next_offset; |
7606 | 0 | asn1_ctx_t asn1_ctx; |
7607 | 0 | int dnames_count = 100; /* the maximum number of DNs to add to the tree */ |
7608 | | |
7609 | | /* Note: minimum length is 0 for TLS 1.1/1.2 and 3 for earlier/later */ |
7610 | | /* DistinguishedName certificate_authorities<0..2^16-1> */ |
7611 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &dnames_length, |
7612 | 0 | hf->hf.hs_dnames_len, 0, UINT16_MAX)) { |
7613 | 0 | return offset_end; |
7614 | 0 | } |
7615 | 0 | offset += 2; |
7616 | 0 | next_offset = offset + dnames_length; |
7617 | |
|
7618 | 0 | if (dnames_length > 0) { |
7619 | 0 | ti = proto_tree_add_none_format(tree, |
7620 | 0 | hf->hf.hs_dnames, |
7621 | 0 | tvb, offset, dnames_length, |
7622 | 0 | "Distinguished Names (%d byte%s)", |
7623 | 0 | dnames_length, |
7624 | 0 | plurality(dnames_length, "", "s")); |
7625 | 0 | subtree = proto_item_add_subtree(ti, hf->ett.dnames); |
7626 | |
|
7627 | 0 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
7628 | |
|
7629 | 0 | while (offset < next_offset) { |
7630 | | /* get the length of the current certificate */ |
7631 | 0 | uint32_t name_length; |
7632 | |
|
7633 | 0 | if (dnames_count-- == 0) { |
7634 | | /* stop adding to tree when the list is considered too large |
7635 | | * https://gitlab.com/wireshark/wireshark/-/issues/16202 |
7636 | | Note: dnames_count must be set low enough not to hit the |
7637 | | limit set by PINFO_LAYER_MAX_RECURSION_DEPTH in packet.c |
7638 | | */ |
7639 | 0 | ti = proto_tree_add_item(subtree, hf->hf.hs_dnames_truncated, |
7640 | 0 | tvb, offset, next_offset - offset, ENC_NA); |
7641 | 0 | proto_item_set_generated(ti); |
7642 | 0 | return next_offset; |
7643 | 0 | } |
7644 | | |
7645 | | /* opaque DistinguishedName<1..2^16-1> */ |
7646 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &name_length, |
7647 | 0 | hf->hf.hs_dname_len, 1, UINT16_MAX)) { |
7648 | 0 | return next_offset; |
7649 | 0 | } |
7650 | 0 | offset += 2; |
7651 | |
|
7652 | 0 | dissect_x509if_DistinguishedName(false, tvb, offset, &asn1_ctx, |
7653 | 0 | subtree, hf->hf.hs_dname); |
7654 | 0 | offset += name_length; |
7655 | 0 | } |
7656 | 0 | } |
7657 | 0 | return offset; |
7658 | 0 | } /* }}} */ |
7659 | | |
7660 | | |
7661 | | /** TLS Extensions (in Client Hello and Server Hello). {{{ */ |
7662 | | static int |
7663 | | ssl_dissect_hnd_hello_ext_sig_hash_algs(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7664 | | proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, ja4_data_t *ja4_data) |
7665 | 4 | { |
7666 | 4 | return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, ja4_data); |
7667 | 4 | } |
7668 | | |
7669 | | static int |
7670 | | ssl_dissect_hnd_ext_delegated_credentials(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7671 | | proto_tree *tree, packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type) |
7672 | 0 | { |
7673 | 0 | if (hnd_type == SSL_HND_CLIENT_HELLO || |
7674 | 0 | hnd_type == SSL_HND_CERT_REQUEST) { |
7675 | | /* |
7676 | | * struct { |
7677 | | * SignatureScheme supported_signature_algorithm<2..2^16-2>; |
7678 | | * } SignatureSchemeList; |
7679 | | */ |
7680 | |
|
7681 | 0 | return ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL); |
7682 | 0 | } else { |
7683 | 0 | asn1_ctx_t asn1_ctx; |
7684 | 0 | unsigned pubkey_length, sign_length; |
7685 | | |
7686 | | /* |
7687 | | * struct { |
7688 | | * uint32 valid_time; |
7689 | | * SignatureScheme expected_cert_verify_algorithm; |
7690 | | * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; |
7691 | | * } Credential; |
7692 | | * |
7693 | | * struct { |
7694 | | * Credential cred; |
7695 | | * SignatureScheme algorithm; |
7696 | | * opaque signature<0..2^16-1>; |
7697 | | * } DelegatedCredential; |
7698 | | */ |
7699 | |
|
7700 | 0 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
7701 | |
|
7702 | 0 | proto_tree_add_item(tree, hf->hf.hs_cred_valid_time, tvb, offset, 4, ENC_BIG_ENDIAN); |
7703 | 0 | offset += 4; |
7704 | |
|
7705 | 0 | tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL); |
7706 | 0 | offset += 2; |
7707 | |
|
7708 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &pubkey_length, |
7709 | 0 | hf->hf.hs_cred_pubkey_len, 1, G_MAXUINT24)) { |
7710 | 0 | return offset_end; |
7711 | 0 | } |
7712 | 0 | offset += 3; |
7713 | 0 | dissect_x509af_SubjectPublicKeyInfo(false, tvb, offset, &asn1_ctx, tree, hf->hf.hs_cred_pubkey); |
7714 | 0 | offset += pubkey_length; |
7715 | |
|
7716 | 0 | tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL); |
7717 | 0 | offset += 2; |
7718 | |
|
7719 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sign_length, |
7720 | 0 | hf->hf.hs_cred_signature_len, 1, UINT16_MAX)) { |
7721 | 0 | return offset_end; |
7722 | 0 | } |
7723 | 0 | offset += 2; |
7724 | 0 | proto_tree_add_item(tree, hf->hf.hs_cred_signature, |
7725 | 0 | tvb, offset, sign_length, ENC_ASCII|ENC_NA); |
7726 | 0 | offset += sign_length; |
7727 | |
|
7728 | 0 | return offset; |
7729 | 0 | } |
7730 | 0 | } |
7731 | | |
7732 | | static int |
7733 | | ssl_dissect_hnd_hello_ext_alps(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7734 | | packet_info *pinfo, proto_tree *tree, |
7735 | | uint32_t offset, uint32_t offset_end, |
7736 | | uint8_t hnd_type) |
7737 | 0 | { |
7738 | | |
7739 | | /* https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01#section-4 */ |
7740 | |
|
7741 | 0 | switch (hnd_type) { |
7742 | 0 | case SSL_HND_CLIENT_HELLO: { |
7743 | 0 | proto_tree *alps_tree; |
7744 | 0 | proto_item *ti; |
7745 | 0 | uint32_t next_offset, alps_length, name_length; |
7746 | | |
7747 | | /* |
7748 | | * opaque ProtocolName<1..2^8-1>; |
7749 | | * struct { |
7750 | | * ProtocolName supported_protocols<2..2^16-1> |
7751 | | * } ApplicationSettingsSupport; |
7752 | | */ |
7753 | |
|
7754 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alps_length, |
7755 | 0 | hf->hf.hs_ext_alps_len, 2, UINT16_MAX)) { |
7756 | 0 | return offset_end; |
7757 | 0 | } |
7758 | 0 | offset += 2; |
7759 | 0 | next_offset = offset + alps_length; |
7760 | |
|
7761 | 0 | ti = proto_tree_add_item(tree, hf->hf.hs_ext_alps_alpn_list, |
7762 | 0 | tvb, offset, alps_length, ENC_NA); |
7763 | 0 | alps_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alps); |
7764 | | |
7765 | | /* Parse list (note missing check for end of vector, ssl_add_vector below |
7766 | | * ensures that data is always available.) */ |
7767 | 0 | while (offset < next_offset) { |
7768 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, alps_tree, offset, next_offset, &name_length, |
7769 | 0 | hf->hf.hs_ext_alps_alpn_str_len, 1, UINT8_MAX)) { |
7770 | 0 | return next_offset; |
7771 | 0 | } |
7772 | 0 | offset++; |
7773 | |
|
7774 | 0 | proto_tree_add_item(alps_tree, hf->hf.hs_ext_alps_alpn_str, |
7775 | 0 | tvb, offset, name_length, ENC_ASCII|ENC_NA); |
7776 | 0 | offset += name_length; |
7777 | 0 | } |
7778 | | |
7779 | 0 | return offset; |
7780 | 0 | } |
7781 | 0 | case SSL_HND_ENCRYPTED_EXTS: |
7782 | | /* Opaque blob */ |
7783 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_alps_settings, |
7784 | 0 | tvb, offset, offset_end - offset, ENC_ASCII|ENC_NA); |
7785 | 0 | break; |
7786 | 0 | } |
7787 | | |
7788 | 0 | return offset_end; |
7789 | 0 | } |
7790 | | |
7791 | | static int |
7792 | | ssl_dissect_hnd_hello_ext_alpn(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7793 | | packet_info *pinfo, proto_tree *tree, |
7794 | | uint32_t offset, uint32_t offset_end, |
7795 | | uint8_t hnd_type, SslSession *session, |
7796 | | bool is_dtls, ja4_data_t *ja4_data) |
7797 | 2 | { |
7798 | | |
7799 | | /* https://tools.ietf.org/html/rfc7301#section-3.1 |
7800 | | * opaque ProtocolName<1..2^8-1>; |
7801 | | * struct { |
7802 | | * ProtocolName protocol_name_list<2..2^16-1> |
7803 | | * } ProtocolNameList; |
7804 | | */ |
7805 | 2 | proto_tree *alpn_tree; |
7806 | 2 | proto_item *ti; |
7807 | 2 | uint32_t next_offset, alpn_length, name_length; |
7808 | 2 | const char *proto_name = NULL, *client_proto_name = NULL; |
7809 | | |
7810 | | /* ProtocolName protocol_name_list<2..2^16-1> */ |
7811 | 2 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &alpn_length, |
7812 | 2 | hf->hf.hs_ext_alpn_len, 2, UINT16_MAX)) { |
7813 | 2 | return offset_end; |
7814 | 2 | } |
7815 | 0 | offset += 2; |
7816 | 0 | next_offset = offset + alpn_length; |
7817 | |
|
7818 | 0 | ti = proto_tree_add_item(tree, hf->hf.hs_ext_alpn_list, |
7819 | 0 | tvb, offset, alpn_length, ENC_NA); |
7820 | 0 | alpn_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_alpn); |
7821 | | |
7822 | | /* Parse list (note missing check for end of vector, ssl_add_vector below |
7823 | | * ensures that data is always available.) */ |
7824 | 0 | while (offset < next_offset) { |
7825 | | /* opaque ProtocolName<1..2^8-1> */ |
7826 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, alpn_tree, offset, next_offset, &name_length, |
7827 | 0 | hf->hf.hs_ext_alpn_str_len, 1, UINT8_MAX)) { |
7828 | 0 | return next_offset; |
7829 | 0 | } |
7830 | 0 | offset++; |
7831 | |
|
7832 | 0 | proto_tree_add_item(alpn_tree, hf->hf.hs_ext_alpn_str, |
7833 | 0 | tvb, offset, name_length, ENC_ASCII|ENC_NA); |
7834 | 0 | if (ja4_data && wmem_strbuf_get_len(ja4_data->alpn) == 0) { |
7835 | 0 | const char alpn_first_char = (char)tvb_get_uint8(tvb,offset); |
7836 | 0 | const char alpn_last_char = (char)tvb_get_uint8(tvb,offset + name_length - 1); |
7837 | 0 | if ((g_ascii_isprint(alpn_first_char)) && g_ascii_isprint(alpn_last_char)) { |
7838 | 0 | wmem_strbuf_append_printf(ja4_data->alpn, "%c%c", alpn_first_char, alpn_last_char); |
7839 | 0 | } |
7840 | 0 | else { |
7841 | 0 | wmem_strbuf_append_printf(ja4_data->alpn, "%x%x",(alpn_first_char >> 4) & 0x0F, |
7842 | 0 | alpn_last_char & 0x0F); |
7843 | 0 | } |
7844 | 0 | } |
7845 | | /* Remember first ALPN ProtocolName entry for server. */ |
7846 | 0 | if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { |
7847 | | /* '\0'-terminated string for dissector table match and prefix |
7848 | | * comparison purposes. */ |
7849 | 0 | proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset, |
7850 | 0 | name_length, ENC_ASCII); |
7851 | 0 | } else if (hnd_type == SSL_HND_CLIENT_HELLO) { |
7852 | 0 | client_proto_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset, |
7853 | 0 | name_length, ENC_ASCII); |
7854 | 0 | } |
7855 | 0 | offset += name_length; |
7856 | 0 | } |
7857 | | |
7858 | | /* If ALPN is given in ServerHello, then ProtocolNameList MUST contain |
7859 | | * exactly one "ProtocolName". */ |
7860 | 0 | if (proto_name) { |
7861 | 0 | dissector_handle_t handle; |
7862 | |
|
7863 | 0 | session->alpn_name = wmem_strdup(wmem_file_scope(), proto_name); |
7864 | |
|
7865 | 0 | if (is_dtls) { |
7866 | 0 | handle = dissector_get_string_handle(dtls_alpn_dissector_table, |
7867 | 0 | proto_name); |
7868 | 0 | } else { |
7869 | 0 | handle = dissector_get_string_handle(ssl_alpn_dissector_table, |
7870 | 0 | proto_name); |
7871 | 0 | if (handle == NULL) { |
7872 | | /* Try prefix matching */ |
7873 | 0 | for (size_t i = 0; i < G_N_ELEMENTS(ssl_alpn_prefix_match_protocols); i++) { |
7874 | 0 | const ssl_alpn_prefix_match_protocol_t *alpn_proto = &ssl_alpn_prefix_match_protocols[i]; |
7875 | | |
7876 | | /* string_string is inappropriate as it compares strings |
7877 | | * while "byte strings MUST NOT be truncated" (RFC 7301) */ |
7878 | 0 | if (g_str_has_prefix(proto_name, alpn_proto->proto_prefix)) { |
7879 | 0 | handle = find_dissector(alpn_proto->dissector_name); |
7880 | 0 | break; |
7881 | 0 | } |
7882 | 0 | } |
7883 | 0 | } |
7884 | 0 | } |
7885 | 0 | if (handle != NULL) { |
7886 | | /* ProtocolName match, so set the App data dissector handle. |
7887 | | * This may override protocols given via the UAT dialog, but |
7888 | | * since the ALPN hint is precise, do it anyway. */ |
7889 | 0 | ssl_debug_printf("%s: changing handle %p to %p (%s)", G_STRFUNC, |
7890 | 0 | (void *)session->app_handle, |
7891 | 0 | (void *)handle, |
7892 | 0 | dissector_handle_get_dissector_name(handle)); |
7893 | 0 | session->app_handle = handle; |
7894 | 0 | } |
7895 | 0 | } else if (client_proto_name) { |
7896 | | // No current use for looking up the handle as the only consumer of this API is currently the QUIC dissector |
7897 | | // and it just needs the string since there are/were various HTTP/3 ALPNs to check for. |
7898 | 0 | session->client_alpn_name = wmem_strdup(wmem_file_scope(), client_proto_name); |
7899 | 0 | } |
7900 | |
|
7901 | 0 | return offset; |
7902 | 0 | } |
7903 | | |
7904 | | static int |
7905 | | ssl_dissect_hnd_hello_ext_npn(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7906 | | packet_info *pinfo, proto_tree *tree, |
7907 | | uint32_t offset, uint32_t offset_end) |
7908 | 0 | { |
7909 | | /* https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-3 |
7910 | | * The "extension_data" field of a "next_protocol_negotiation" extension |
7911 | | * in a "ServerHello" contains an optional list of protocols advertised |
7912 | | * by the server. Protocols are named by opaque, non-empty byte strings |
7913 | | * and the list of protocols is serialized as a concatenation of 8-bit, |
7914 | | * length prefixed byte strings. Implementations MUST ensure that the |
7915 | | * empty string is not included and that no byte strings are truncated. |
7916 | | */ |
7917 | 0 | uint32_t npn_length; |
7918 | 0 | proto_tree *npn_tree; |
7919 | | |
7920 | | /* List is optional, do not add tree if there are no entries. */ |
7921 | 0 | if (offset == offset_end) { |
7922 | 0 | return offset; |
7923 | 0 | } |
7924 | | |
7925 | 0 | npn_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_npn, NULL, "Next Protocol Negotiation"); |
7926 | |
|
7927 | 0 | while (offset < offset_end) { |
7928 | | /* non-empty, 8-bit length prefixed strings means range 1..255 */ |
7929 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, npn_tree, offset, offset_end, &npn_length, |
7930 | 0 | hf->hf.hs_ext_npn_str_len, 1, UINT8_MAX)) { |
7931 | 0 | return offset_end; |
7932 | 0 | } |
7933 | 0 | offset++; |
7934 | |
|
7935 | 0 | proto_tree_add_item(npn_tree, hf->hf.hs_ext_npn_str, |
7936 | 0 | tvb, offset, npn_length, ENC_ASCII|ENC_NA); |
7937 | 0 | offset += npn_length; |
7938 | 0 | } |
7939 | | |
7940 | 0 | return offset; |
7941 | 0 | } |
7942 | | |
7943 | | static int |
7944 | | ssl_dissect_hnd_hello_ext_reneg_info(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
7945 | | packet_info *pinfo, proto_tree *tree, |
7946 | | uint32_t offset, uint32_t offset_end) |
7947 | 7 | { |
7948 | | /* https://tools.ietf.org/html/rfc5746#section-3.2 |
7949 | | * struct { |
7950 | | * opaque renegotiated_connection<0..255>; |
7951 | | * } RenegotiationInfo; |
7952 | | * |
7953 | | */ |
7954 | 7 | proto_tree *reneg_info_tree; |
7955 | 7 | uint32_t reneg_info_length; |
7956 | | |
7957 | 7 | reneg_info_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_reneg_info, NULL, "Renegotiation Info extension"); |
7958 | | |
7959 | | /* opaque renegotiated_connection<0..255> */ |
7960 | 7 | if (!ssl_add_vector(hf, tvb, pinfo, reneg_info_tree, offset, offset_end, &reneg_info_length, |
7961 | 7 | hf->hf.hs_ext_reneg_info_len, 0, 255)) { |
7962 | 6 | return offset_end; |
7963 | 6 | } |
7964 | 1 | offset++; |
7965 | | |
7966 | 1 | if (reneg_info_length > 0) { |
7967 | 0 | proto_tree_add_item(reneg_info_tree, hf->hf.hs_ext_reneg_info, tvb, offset, reneg_info_length, ENC_NA); |
7968 | 0 | offset += reneg_info_length; |
7969 | 0 | } |
7970 | | |
7971 | 1 | return offset; |
7972 | 7 | } |
7973 | | |
7974 | | static int |
7975 | | ssl_dissect_hnd_hello_ext_key_share_entry(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
7976 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
7977 | | const char **group_name_out) |
7978 | 0 | { |
7979 | | /* RFC 8446 Section 4.2.8 |
7980 | | * struct { |
7981 | | * NamedGroup group; |
7982 | | * opaque key_exchange<1..2^16-1>; |
7983 | | * } KeyShareEntry; |
7984 | | */ |
7985 | 0 | uint32_t key_exchange_length, group; |
7986 | 0 | proto_tree *ks_tree; |
7987 | |
|
7988 | 0 | ks_tree = proto_tree_add_subtree(tree, tvb, offset, 4, hf->ett.hs_ext_key_share_ks, NULL, "Key Share Entry"); |
7989 | |
|
7990 | 0 | proto_tree_add_item_ret_uint(ks_tree, hf->hf.hs_ext_key_share_group, tvb, offset, 2, ENC_BIG_ENDIAN, &group); |
7991 | 0 | offset += 2; |
7992 | 0 | const char *group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)"); |
7993 | 0 | proto_item_append_text(ks_tree, ": Group: %s", group_name); |
7994 | 0 | if (group_name_out) { |
7995 | 0 | *group_name_out = !IS_GREASE_TLS(group) ? group_name : NULL; |
7996 | 0 | } |
7997 | | |
7998 | | /* opaque key_exchange<1..2^16-1> */ |
7999 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, ks_tree, offset, offset_end, &key_exchange_length, |
8000 | 0 | hf->hf.hs_ext_key_share_key_exchange_length, 1, UINT16_MAX)) { |
8001 | 0 | return offset_end; /* Bad (possible truncated) length, skip to end of KeyShare extension. */ |
8002 | 0 | } |
8003 | 0 | offset += 2; |
8004 | 0 | proto_item_set_len(ks_tree, 2 + 2 + key_exchange_length); |
8005 | 0 | proto_item_append_text(ks_tree, ", Key Exchange length: %u", key_exchange_length); |
8006 | |
|
8007 | 0 | proto_tree_add_item(ks_tree, hf->hf.hs_ext_key_share_key_exchange, tvb, offset, key_exchange_length, ENC_NA); |
8008 | 0 | offset += key_exchange_length; |
8009 | |
|
8010 | 0 | return offset; |
8011 | 0 | } |
8012 | | |
8013 | | static int |
8014 | | ssl_dissect_hnd_hello_ext_key_share(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8015 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8016 | | uint8_t hnd_type) |
8017 | 3 | { |
8018 | 3 | proto_tree *key_share_tree; |
8019 | 3 | uint32_t next_offset; |
8020 | 3 | uint32_t client_shares_length; |
8021 | 3 | uint32_t group; |
8022 | 3 | const char *group_name = NULL; |
8023 | | |
8024 | 3 | if (offset_end <= offset) { /* Check if ext_len == 0 and "overflow" (offset + ext_len) > uint32_t) */ |
8025 | 3 | return offset; |
8026 | 3 | } |
8027 | | |
8028 | 0 | key_share_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_key_share, NULL, "Key Share extension"); |
8029 | |
|
8030 | 0 | switch(hnd_type){ |
8031 | 0 | case SSL_HND_CLIENT_HELLO: |
8032 | | /* KeyShareEntry client_shares<0..2^16-1> */ |
8033 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, key_share_tree, offset, offset_end, &client_shares_length, |
8034 | 0 | hf->hf.hs_ext_key_share_client_length, 0, UINT16_MAX)) { |
8035 | 0 | return offset_end; |
8036 | 0 | } |
8037 | 0 | offset += 2; |
8038 | 0 | next_offset = offset + client_shares_length; |
8039 | 0 | const char *sep = " "; |
8040 | 0 | while (offset + 4 <= next_offset) { /* (NamedGroup (2 bytes), key_exchange (1 byte for length, 1 byte minimum data) */ |
8041 | 0 | offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, next_offset, &group_name); |
8042 | 0 | if (group_name) { |
8043 | 0 | proto_item_append_text(tree, "%s%s", sep, group_name); |
8044 | 0 | sep = ", "; |
8045 | 0 | } |
8046 | 0 | } |
8047 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, key_share_tree, offset, next_offset)) { |
8048 | 0 | return next_offset; |
8049 | 0 | } |
8050 | 0 | break; |
8051 | 0 | case SSL_HND_SERVER_HELLO: |
8052 | 0 | offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, key_share_tree, offset, offset_end, &group_name); |
8053 | 0 | if (group_name) { |
8054 | 0 | proto_item_append_text(tree, " %s", group_name); |
8055 | 0 | } |
8056 | 0 | break; |
8057 | 0 | case SSL_HND_HELLO_RETRY_REQUEST: |
8058 | 0 | proto_tree_add_item_ret_uint(key_share_tree, hf->hf.hs_ext_key_share_selected_group, tvb, offset, 2, ENC_BIG_ENDIAN, &group); |
8059 | 0 | offset += 2; |
8060 | 0 | group_name = val_to_str(pinfo->pool, group, ssl_extension_curves, "Unknown (%u)"); |
8061 | 0 | proto_item_append_text(tree, " %s", group_name); |
8062 | 0 | break; |
8063 | 0 | default: /* no default */ |
8064 | 0 | break; |
8065 | 0 | } |
8066 | | |
8067 | 0 | return offset; |
8068 | 0 | } |
8069 | | |
8070 | | static int |
8071 | | ssl_dissect_hnd_hello_ext_pre_shared_key(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8072 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8073 | | uint8_t hnd_type) |
8074 | 0 | { |
8075 | | /* RFC 8446 Section 4.2.11 |
8076 | | * struct { |
8077 | | * opaque identity<1..2^16-1>; |
8078 | | * uint32 obfuscated_ticket_age; |
8079 | | * } PskIdentity; |
8080 | | * opaque PskBinderEntry<32..255>; |
8081 | | * struct { |
8082 | | * select (Handshake.msg_type) { |
8083 | | * case client_hello: |
8084 | | * PskIdentity identities<7..2^16-1>; |
8085 | | * PskBinderEntry binders<33..2^16-1>; |
8086 | | * case server_hello: |
8087 | | * uint16 selected_identity; |
8088 | | * }; |
8089 | | * } PreSharedKeyExtension; |
8090 | | */ |
8091 | |
|
8092 | 0 | proto_tree *psk_tree; |
8093 | |
|
8094 | 0 | psk_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_pre_shared_key, NULL, "Pre-Shared Key extension"); |
8095 | |
|
8096 | 0 | switch (hnd_type){ |
8097 | 0 | case SSL_HND_CLIENT_HELLO: { |
8098 | 0 | uint32_t identities_length, identities_end, binders_length; |
8099 | | |
8100 | | /* PskIdentity identities<7..2^16-1> */ |
8101 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &identities_length, |
8102 | 0 | hf->hf.hs_ext_psk_identities_length, 7, UINT16_MAX)) { |
8103 | 0 | return offset_end; |
8104 | 0 | } |
8105 | 0 | offset += 2; |
8106 | 0 | identities_end = offset + identities_length; |
8107 | |
|
8108 | 0 | while (offset < identities_end) { |
8109 | 0 | uint32_t identity_length; |
8110 | 0 | proto_tree *identity_tree; |
8111 | |
|
8112 | 0 | identity_tree = proto_tree_add_subtree(psk_tree, tvb, offset, 4, hf->ett.hs_ext_psk_identity, NULL, "PSK Identity ("); |
8113 | | |
8114 | | /* opaque identity<1..2^16-1> */ |
8115 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, identity_tree, offset, identities_end, &identity_length, |
8116 | 0 | hf->hf.hs_ext_psk_identity_identity_length, 1, UINT16_MAX)) { |
8117 | 0 | return identities_end; |
8118 | 0 | } |
8119 | 0 | offset += 2; |
8120 | 0 | proto_item_append_text(identity_tree, "length: %u)", identity_length); |
8121 | |
|
8122 | 0 | proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_identity, tvb, offset, identity_length, ENC_BIG_ENDIAN); |
8123 | 0 | offset += identity_length; |
8124 | |
|
8125 | 0 | proto_tree_add_item(identity_tree, hf->hf.hs_ext_psk_identity_obfuscated_ticket_age, tvb, offset, 4, ENC_BIG_ENDIAN); |
8126 | 0 | offset += 4; |
8127 | |
|
8128 | 0 | proto_item_set_len(identity_tree, 2 + identity_length + 4); |
8129 | 0 | } |
8130 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, psk_tree, offset, identities_end)) { |
8131 | 0 | offset = identities_end; |
8132 | 0 | } |
8133 | | |
8134 | | /* PskBinderEntry binders<33..2^16-1> */ |
8135 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, psk_tree, offset, offset_end, &binders_length, |
8136 | 0 | hf->hf.hs_ext_psk_binders_length, 33, UINT16_MAX)) { |
8137 | 0 | return offset_end; |
8138 | 0 | } |
8139 | 0 | offset += 2; |
8140 | |
|
8141 | 0 | proto_item *binders_item; |
8142 | 0 | proto_tree *binders_tree; |
8143 | 0 | binders_item = proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_binders, tvb, offset, binders_length, ENC_NA); |
8144 | 0 | binders_tree = proto_item_add_subtree(binders_item, hf->ett.hs_ext_psk_binders); |
8145 | 0 | uint32_t binders_end = offset + binders_length; |
8146 | 0 | while (offset < binders_end) { |
8147 | 0 | uint32_t binder_length; |
8148 | 0 | proto_item *binder_item; |
8149 | 0 | proto_tree *binder_tree; |
8150 | |
|
8151 | 0 | binder_item = proto_tree_add_item(binders_tree, hf->hf.hs_ext_psk_binder, tvb, offset, 1, ENC_NA); |
8152 | 0 | binder_tree = proto_item_add_subtree(binder_item, hf->ett.hs_ext_psk_binder); |
8153 | | |
8154 | | /* opaque PskBinderEntry<32..255>; */ |
8155 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, binder_tree, offset, binders_end, &binder_length, |
8156 | 0 | hf->hf.hs_ext_psk_binder_binder_length, 32, 255)) { |
8157 | 0 | return binders_end; |
8158 | 0 | } |
8159 | 0 | offset += 1; |
8160 | 0 | proto_item_append_text(binder_tree, " (length: %u)", binder_length); |
8161 | |
|
8162 | 0 | proto_tree_add_item(binder_tree, hf->hf.hs_ext_psk_binder_binder, tvb, offset, binder_length, ENC_BIG_ENDIAN); |
8163 | 0 | offset += binder_length; |
8164 | |
|
8165 | 0 | proto_item_set_end(binder_item, tvb, offset); |
8166 | 0 | } |
8167 | 0 | } |
8168 | 0 | break; |
8169 | 0 | case SSL_HND_SERVER_HELLO: { |
8170 | 0 | proto_tree_add_item(psk_tree, hf->hf.hs_ext_psk_identity_selected, tvb, offset, 2, ENC_BIG_ENDIAN); |
8171 | 0 | offset += 2; |
8172 | 0 | } |
8173 | 0 | break; |
8174 | 0 | default: |
8175 | 0 | break; |
8176 | 0 | } |
8177 | | |
8178 | 0 | return offset; |
8179 | 0 | } |
8180 | | |
8181 | | static uint32_t |
8182 | | ssl_dissect_hnd_hello_ext_early_data(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U_, |
8183 | | proto_tree *tree, uint32_t offset, uint32_t offset_end _U_, |
8184 | | uint8_t hnd_type, SslDecryptSession *ssl) |
8185 | 2 | { |
8186 | | /* RFC 8446 Section 4.2.10 |
8187 | | * struct {} Empty; |
8188 | | * struct { |
8189 | | * select (Handshake.msg_type) { |
8190 | | * case new_session_ticket: uint32 max_early_data_size; |
8191 | | * case client_hello: Empty; |
8192 | | * case encrypted_extensions: Empty; |
8193 | | * }; |
8194 | | * } EarlyDataIndication; |
8195 | | */ |
8196 | 2 | switch (hnd_type) { |
8197 | 1 | case SSL_HND_CLIENT_HELLO: |
8198 | | /* Remember that early_data will follow the handshake. */ |
8199 | 1 | if (ssl) { |
8200 | 1 | ssl_debug_printf("%s found early_data extension\n", G_STRFUNC); |
8201 | 1 | ssl->has_early_data = true; |
8202 | 1 | } |
8203 | 1 | break; |
8204 | 0 | case SSL_HND_NEWSESSION_TICKET: |
8205 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_max_early_data_size, tvb, offset, 4, ENC_BIG_ENDIAN); |
8206 | 0 | offset += 4; |
8207 | 0 | break; |
8208 | 1 | default: |
8209 | 1 | break; |
8210 | 2 | } |
8211 | 2 | return offset; |
8212 | 2 | } |
8213 | | |
8214 | | static uint16_t |
8215 | | tls_try_get_version(bool is_dtls, uint16_t version, uint8_t *draft_version) |
8216 | 204 | { |
8217 | 204 | if (draft_version) { |
8218 | 204 | *draft_version = 0; |
8219 | 204 | } |
8220 | 204 | if (!is_dtls) { |
8221 | 5 | uint8_t tls13_draft = extract_tls13_draft_version(version); |
8222 | 5 | if (tls13_draft != 0) { |
8223 | | /* This is TLS 1.3 (a draft version). */ |
8224 | 0 | if (draft_version) { |
8225 | 0 | *draft_version = tls13_draft; |
8226 | 0 | } |
8227 | 0 | version = TLSV1DOT3_VERSION; |
8228 | 0 | } |
8229 | 5 | if (version == 0xfb17 || version == 0xfb1a) { |
8230 | | /* Unofficial TLS 1.3 draft version for Facebook fizz. */ |
8231 | 0 | tls13_draft = (uint8_t)version; |
8232 | 0 | if (draft_version) { |
8233 | 0 | *draft_version = tls13_draft; |
8234 | 0 | } |
8235 | 0 | version = TLSV1DOT3_VERSION; |
8236 | 0 | } |
8237 | 5 | } |
8238 | | |
8239 | 204 | switch (version) { |
8240 | 3 | case SSLV3_VERSION: |
8241 | 3 | case TLSV1_VERSION: |
8242 | 3 | case TLSV1DOT1_VERSION: |
8243 | 5 | case TLSV1DOT2_VERSION: |
8244 | 5 | case TLSV1DOT3_VERSION: |
8245 | 10 | case TLCPV1_VERSION: |
8246 | 10 | if (is_dtls) |
8247 | 5 | return SSL_VER_UNKNOWN; |
8248 | 5 | break; |
8249 | | |
8250 | 5 | case DTLSV1DOT0_VERSION: |
8251 | 26 | case DTLSV1DOT0_OPENSSL_VERSION: |
8252 | 27 | case DTLSV1DOT2_VERSION: |
8253 | 27 | case DTLSV1DOT3_VERSION: |
8254 | 27 | if (!is_dtls) |
8255 | 0 | return SSL_VER_UNKNOWN; |
8256 | 27 | break; |
8257 | | |
8258 | 167 | default: /* invalid version number */ |
8259 | 167 | return SSL_VER_UNKNOWN; |
8260 | 204 | } |
8261 | | |
8262 | 32 | return version; |
8263 | 204 | } |
8264 | | |
8265 | | static int |
8266 | | ssl_dissect_hnd_hello_ext_supported_versions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8267 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8268 | | SslSession *session, bool is_dtls, ja4_data_t *ja4_data) |
8269 | 0 | { |
8270 | | |
8271 | | /* RFC 8446 Section 4.2.1 |
8272 | | * struct { |
8273 | | * ProtocolVersion versions<2..254>; // ClientHello |
8274 | | * } SupportedVersions; |
8275 | | * Note that ServerHello and HelloRetryRequest are handled by the caller. |
8276 | | */ |
8277 | 0 | uint32_t versions_length, next_offset; |
8278 | | /* ProtocolVersion versions<2..254> */ |
8279 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &versions_length, |
8280 | 0 | hf->hf.hs_ext_supported_versions_len, 2, 254)) { |
8281 | 0 | return offset_end; |
8282 | 0 | } |
8283 | 0 | offset++; |
8284 | 0 | next_offset = offset + versions_length; |
8285 | |
|
8286 | 0 | unsigned version; |
8287 | 0 | unsigned current_version, lowest_version = SSL_VER_UNKNOWN; |
8288 | 0 | uint8_t draft_version, max_draft_version = 0; |
8289 | 0 | const char *sep = " "; |
8290 | 0 | while (offset + 2 <= next_offset) { |
8291 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN, &version); |
8292 | 0 | offset += 2; |
8293 | |
|
8294 | 0 | if (!IS_GREASE_TLS(version)) { |
8295 | 0 | proto_item_append_text(tree, "%s%s", sep, val_to_str(pinfo->pool, version, ssl_versions, "Unknown (0x%04x)")); |
8296 | 0 | sep = ", "; |
8297 | 0 | } |
8298 | |
|
8299 | 0 | current_version = tls_try_get_version(is_dtls, version, &draft_version); |
8300 | 0 | if (session->version == SSL_VER_UNKNOWN) { |
8301 | 0 | if (lowest_version == SSL_VER_UNKNOWN) { |
8302 | 0 | lowest_version = current_version; |
8303 | 0 | } else if (current_version != SSL_VER_UNKNOWN) { |
8304 | 0 | if (!is_dtls) { |
8305 | 0 | lowest_version = MIN(lowest_version, current_version); |
8306 | 0 | } else { |
8307 | 0 | lowest_version = MAX(lowest_version, current_version); |
8308 | 0 | } |
8309 | 0 | } |
8310 | 0 | } |
8311 | 0 | max_draft_version = MAX(draft_version, max_draft_version); |
8312 | 0 | if (ja4_data && !IS_GREASE_TLS(version)) { |
8313 | | /* The DTLS version numbers get mapped to "00" for unknown per |
8314 | | * JA4 spec, but if JA4 ever does support DTLS we'll probably |
8315 | | * need to take the MIN instead of MAX here for DTLS. |
8316 | | */ |
8317 | 0 | ja4_data->max_version = MAX(version, ja4_data->max_version); |
8318 | 0 | } |
8319 | 0 | } |
8320 | 0 | if (session->version == SSL_VER_UNKNOWN && lowest_version != SSL_VER_UNKNOWN) { |
8321 | 0 | col_set_str(pinfo->cinfo, COL_PROTOCOL, |
8322 | 0 | val_to_str_const(version, ssl_version_short_names, is_dtls ? "DTLS" : "TLS")); |
8323 | 0 | } |
8324 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) { |
8325 | 0 | offset = next_offset; |
8326 | 0 | } |
8327 | | |
8328 | | /* XXX remove this when draft 19 support is dropped, |
8329 | | * this is only required for early data decryption. */ |
8330 | 0 | if (max_draft_version) { |
8331 | 0 | session->tls13_draft_version = max_draft_version; |
8332 | 0 | } |
8333 | |
|
8334 | 0 | return offset; |
8335 | 0 | } |
8336 | | |
8337 | | static int |
8338 | | ssl_dissect_hnd_hello_ext_cookie(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
8339 | | packet_info *pinfo, proto_tree *tree, |
8340 | | uint32_t offset, uint32_t offset_end) |
8341 | 2 | { |
8342 | | /* RFC 8446 Section 4.2.2 |
8343 | | * struct { |
8344 | | * opaque cookie<1..2^16-1>; |
8345 | | * } Cookie; |
8346 | | */ |
8347 | 2 | uint32_t cookie_length; |
8348 | | /* opaque cookie<1..2^16-1> */ |
8349 | 2 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length, |
8350 | 2 | hf->hf.hs_ext_cookie_len, 1, UINT16_MAX)) { |
8351 | 1 | return offset_end; |
8352 | 1 | } |
8353 | 1 | offset += 2; |
8354 | | |
8355 | 1 | proto_tree_add_item(tree, hf->hf.hs_ext_cookie, tvb, offset, cookie_length, ENC_NA); |
8356 | 1 | offset += cookie_length; |
8357 | | |
8358 | 1 | return offset; |
8359 | 2 | } |
8360 | | |
8361 | | static int |
8362 | | ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8363 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
8364 | 5 | { |
8365 | | /* RFC 8446 Section 4.2.9 |
8366 | | * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode; |
8367 | | * |
8368 | | * struct { |
8369 | | * PskKeyExchangeMode ke_modes<1..255>; |
8370 | | * } PskKeyExchangeModes; |
8371 | | */ |
8372 | 5 | uint32_t ke_modes_length, next_offset; |
8373 | | |
8374 | | /* PskKeyExchangeMode ke_modes<1..255> */ |
8375 | 5 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ke_modes_length, |
8376 | 5 | hf->hf.hs_ext_psk_ke_modes_length, 1, 255)) { |
8377 | 5 | return offset_end; |
8378 | 5 | } |
8379 | 0 | offset++; |
8380 | 0 | next_offset = offset + ke_modes_length; |
8381 | |
|
8382 | 0 | while (offset < next_offset) { |
8383 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_psk_ke_mode, tvb, offset, 1, ENC_NA); |
8384 | 0 | offset++; |
8385 | 0 | } |
8386 | |
|
8387 | 0 | return offset; |
8388 | 5 | } |
8389 | | |
8390 | | static uint32_t |
8391 | | ssl_dissect_hnd_hello_ext_certificate_authorities(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8392 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
8393 | 0 | { |
8394 | | /* RFC 8446 Section 4.2.4 |
8395 | | * opaque DistinguishedName<1..2^16-1>; |
8396 | | * struct { |
8397 | | * DistinguishedName authorities<3..2^16-1>; |
8398 | | * } CertificateAuthoritiesExtension; |
8399 | | */ |
8400 | 0 | return tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end); |
8401 | 0 | } |
8402 | | |
8403 | | static int |
8404 | | ssl_dissect_hnd_hello_ext_oid_filters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8405 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
8406 | 1 | { |
8407 | | /* RFC 8446 Section 4.2.5 |
8408 | | * struct { |
8409 | | * opaque certificate_extension_oid<1..2^8-1>; |
8410 | | * opaque certificate_extension_values<0..2^16-1>; |
8411 | | * } OIDFilter; |
8412 | | * struct { |
8413 | | * OIDFilter filters<0..2^16-1>; |
8414 | | * } OIDFilterExtension; |
8415 | | */ |
8416 | 1 | proto_tree *subtree; |
8417 | 1 | uint32_t filters_length, oid_length, values_length, value_offset; |
8418 | 1 | asn1_ctx_t asn1_ctx; |
8419 | 1 | const char *oid, *name; |
8420 | | |
8421 | | /* OIDFilter filters<0..2^16-1> */ |
8422 | 1 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &filters_length, |
8423 | 1 | hf->hf.hs_ext_psk_ke_modes_length, 0, UINT16_MAX)) { |
8424 | 0 | return offset_end; |
8425 | 0 | } |
8426 | 1 | offset += 2; |
8427 | 1 | offset_end = offset + filters_length; |
8428 | | |
8429 | 1 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
8430 | | |
8431 | 2 | while (offset < offset_end) { |
8432 | 1 | subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
8433 | 1 | hf->ett.hs_ext_oid_filter, NULL, "OID Filter"); |
8434 | | |
8435 | | /* opaque certificate_extension_oid<1..2^8-1> */ |
8436 | 1 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &oid_length, |
8437 | 1 | hf->hf.hs_ext_oid_filters_oid_length, 1, UINT8_MAX)) { |
8438 | 0 | return offset_end; |
8439 | 0 | } |
8440 | 1 | offset++; |
8441 | 1 | dissect_ber_object_identifier_str(false, &asn1_ctx, subtree, tvb, offset, |
8442 | 1 | hf->hf.hs_ext_oid_filters_oid, &oid); |
8443 | 1 | offset += oid_length; |
8444 | | |
8445 | | /* Append OID to tree label */ |
8446 | 1 | name = oid_resolved_from_string(pinfo->pool, oid); |
8447 | 1 | proto_item_append_text(subtree, " (%s)", name ? name : oid); |
8448 | | |
8449 | | /* opaque certificate_extension_values<0..2^16-1> */ |
8450 | 1 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &values_length, |
8451 | 1 | hf->hf.hs_ext_oid_filters_values_length, 0, UINT16_MAX)) { |
8452 | 0 | return offset_end; |
8453 | 0 | } |
8454 | 1 | offset += 2; |
8455 | 1 | proto_item_set_len(subtree, 1 + oid_length + 2 + values_length); |
8456 | 1 | if (values_length > 0) { |
8457 | 1 | value_offset = offset; |
8458 | 1 | value_offset = dissect_ber_identifier(pinfo, subtree, tvb, value_offset, NULL, NULL, NULL); |
8459 | 1 | value_offset = dissect_ber_length(pinfo, subtree, tvb, value_offset, NULL, NULL); |
8460 | 1 | call_ber_oid_callback(oid, tvb, value_offset, pinfo, subtree, NULL); |
8461 | 1 | } |
8462 | 1 | offset += values_length; |
8463 | 1 | } |
8464 | | |
8465 | 1 | return offset; |
8466 | 1 | } |
8467 | | |
8468 | | static int |
8469 | | ssl_dissect_hnd_hello_ext_server_name(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
8470 | | packet_info *pinfo, proto_tree *tree, |
8471 | | uint32_t offset, uint32_t offset_end) |
8472 | 480 | { |
8473 | | /* https://tools.ietf.org/html/rfc6066#section-3 |
8474 | | * |
8475 | | * struct { |
8476 | | * NameType name_type; |
8477 | | * select (name_type) { |
8478 | | * case host_name: HostName; |
8479 | | * } name; |
8480 | | * } ServerName; |
8481 | | * |
8482 | | * enum { |
8483 | | * host_name(0), (255) |
8484 | | * } NameType; |
8485 | | * |
8486 | | * opaque HostName<1..2^16-1>; |
8487 | | * |
8488 | | * struct { |
8489 | | * ServerName server_name_list<1..2^16-1> |
8490 | | * } ServerNameList; |
8491 | | */ |
8492 | 480 | proto_tree *server_name_tree; |
8493 | 480 | uint32_t list_length, server_name_length, next_offset; |
8494 | | |
8495 | | /* The server SHALL include "server_name" extension with empty data. */ |
8496 | 480 | if (offset == offset_end) { |
8497 | 410 | return offset; |
8498 | 410 | } |
8499 | | |
8500 | 70 | server_name_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, hf->ett.hs_ext_server_name, NULL, "Server Name Indication extension"); |
8501 | | |
8502 | | /* ServerName server_name_list<1..2^16-1> */ |
8503 | 70 | if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, offset_end, &list_length, |
8504 | 70 | hf->hf.hs_ext_server_name_list_len, 1, UINT16_MAX)) { |
8505 | 27 | return offset_end; |
8506 | 27 | } |
8507 | 43 | offset += 2; |
8508 | 43 | next_offset = offset + list_length; |
8509 | | |
8510 | 80 | while (offset < next_offset) { |
8511 | 47 | uint32_t name_type; |
8512 | 47 | const char *server_name = NULL; |
8513 | 47 | proto_tree_add_item_ret_uint(server_name_tree, hf->hf.hs_ext_server_name_type, |
8514 | 47 | tvb, offset, 1, ENC_NA, &name_type); |
8515 | 47 | offset++; |
8516 | | |
8517 | | /* opaque HostName<1..2^16-1> */ |
8518 | 47 | if (!ssl_add_vector(hf, tvb, pinfo, server_name_tree, offset, next_offset, &server_name_length, |
8519 | 47 | hf->hf.hs_ext_server_name_len, 1, UINT16_MAX)) { |
8520 | 10 | return next_offset; |
8521 | 10 | } |
8522 | 37 | offset += 2; |
8523 | | |
8524 | 37 | proto_tree_add_item_ret_string(server_name_tree, hf->hf.hs_ext_server_name, |
8525 | 37 | tvb, offset, server_name_length, ENC_ASCII|ENC_NA, |
8526 | 37 | pinfo->pool, (const uint8_t**)&server_name); |
8527 | 37 | offset += server_name_length; |
8528 | | // Each type must only occur once, so we don't check for duplicates. |
8529 | 37 | if (name_type == 0) { |
8530 | 23 | proto_item_append_text(tree, " name=%s", server_name); |
8531 | 23 | col_append_fstr(pinfo->cinfo, COL_INFO, " (SNI=%s)", server_name); |
8532 | | |
8533 | 23 | if (gbl_resolv_flags.handshake_sni_addr_resolution) { |
8534 | | // Client Hello: Client (Src) -> Server (Dst) |
8535 | 0 | switch (pinfo->dst.type) { |
8536 | 0 | case AT_IPv4: |
8537 | 0 | if (pinfo->dst.len == sizeof(uint32_t)) { |
8538 | 0 | add_ipv4_name(*(uint32_t *)pinfo->dst.data, server_name, false); |
8539 | 0 | } |
8540 | 0 | break; |
8541 | 0 | case AT_IPv6: |
8542 | 0 | if (pinfo->dst.len == sizeof(ws_in6_addr)) { |
8543 | 0 | add_ipv6_name(pinfo->dst.data, server_name, false); |
8544 | 0 | } |
8545 | 0 | break; |
8546 | 0 | } |
8547 | 0 | } |
8548 | 23 | } |
8549 | 37 | } |
8550 | 33 | return offset; |
8551 | 43 | } |
8552 | | |
8553 | | static int |
8554 | | ssl_dissect_hnd_hello_ext_session_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
8555 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, SslDecryptSession *ssl) |
8556 | 5 | { |
8557 | 5 | unsigned ext_len = offset_end - offset; |
8558 | 5 | if (hnd_type == SSL_HND_CLIENT_HELLO && ssl && ext_len != 0) { |
8559 | 2 | tvb_ensure_bytes_exist(tvb, offset, ext_len); |
8560 | | /* Save the Session Ticket such that it can be used as identifier for |
8561 | | * restoring a previous Master Secret (in ChangeCipherSpec) */ |
8562 | 2 | ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(), |
8563 | 2 | ssl->session_ticket.data, ext_len); |
8564 | 2 | ssl->session_ticket.data_len = ext_len; |
8565 | 2 | tvb_memcpy(tvb,ssl->session_ticket.data, offset, ext_len); |
8566 | 2 | } |
8567 | 5 | proto_tree_add_item(tree, hf->hf.hs_ext_session_ticket, |
8568 | 5 | tvb, offset, ext_len, ENC_NA); |
8569 | 5 | return offset + ext_len; |
8570 | 5 | } |
8571 | | |
8572 | | static int |
8573 | | ssl_dissect_hnd_hello_ext_cert_type(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
8574 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8575 | | uint8_t hnd_type, uint16_t ext_type, SslSession *session) |
8576 | 2 | { |
8577 | 2 | uint8_t cert_list_length; |
8578 | 2 | uint8_t cert_type; |
8579 | 2 | proto_tree *cert_list_tree; |
8580 | 2 | proto_item *ti; |
8581 | | |
8582 | 2 | switch(hnd_type){ |
8583 | 2 | case SSL_HND_CLIENT_HELLO: |
8584 | 2 | cert_list_length = tvb_get_uint8(tvb, offset); |
8585 | 2 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_types_len, |
8586 | 2 | tvb, offset, 1, ENC_BIG_ENDIAN); |
8587 | 2 | offset += 1; |
8588 | 2 | if (offset_end - offset != (uint32_t)cert_list_length) |
8589 | 2 | return offset; |
8590 | | |
8591 | 0 | ti = proto_tree_add_item(tree, hf->hf.hs_ext_cert_types, tvb, offset, |
8592 | 0 | cert_list_length, cert_list_length); |
8593 | 0 | proto_item_append_text(ti, " (%d)", cert_list_length); |
8594 | | |
8595 | | /* make this a subtree */ |
8596 | 0 | cert_list_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_cert_types); |
8597 | | |
8598 | | /* loop over all point formats */ |
8599 | 0 | while (cert_list_length > 0) |
8600 | 0 | { |
8601 | 0 | proto_tree_add_item(cert_list_tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
8602 | 0 | offset++; |
8603 | 0 | cert_list_length--; |
8604 | 0 | } |
8605 | 0 | break; |
8606 | 0 | case SSL_HND_SERVER_HELLO: |
8607 | 0 | case SSL_HND_ENCRYPTED_EXTENSIONS: |
8608 | 0 | case SSL_HND_CERTIFICATE: |
8609 | 0 | cert_type = tvb_get_uint8(tvb, offset); |
8610 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
8611 | 0 | offset += 1; |
8612 | 0 | if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE || ext_type == SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE) { |
8613 | 0 | session->client_cert_type = cert_type; |
8614 | 0 | } |
8615 | 0 | if (ext_type == SSL_HND_HELLO_EXT_CERT_TYPE || ext_type == SSL_HND_HELLO_EXT_SERVER_CERT_TYPE) { |
8616 | 0 | session->server_cert_type = cert_type; |
8617 | 0 | } |
8618 | 0 | break; |
8619 | 0 | default: /* no default */ |
8620 | 0 | break; |
8621 | 2 | } |
8622 | | |
8623 | 0 | return offset; |
8624 | 2 | } |
8625 | | |
8626 | | static uint32_t |
8627 | | ssl_dissect_hnd_hello_ext_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8628 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8629 | | uint8_t hnd_type, SslDecryptSession *ssl _U_) |
8630 | 3 | { |
8631 | 3 | uint32_t compress_certificate_algorithms_length, next_offset; |
8632 | | |
8633 | | /* https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-03#section-3.0 |
8634 | | * enum { |
8635 | | * zlib(1), |
8636 | | * brotli(2), |
8637 | | * (65535) |
8638 | | * } CertificateCompressionAlgorithm; |
8639 | | * |
8640 | | * struct { |
8641 | | * CertificateCompressionAlgorithm algorithms<1..2^8-1>; |
8642 | | * } CertificateCompressionAlgorithms; |
8643 | | */ |
8644 | 3 | switch (hnd_type) { |
8645 | 3 | case SSL_HND_CLIENT_HELLO: |
8646 | 3 | case SSL_HND_CERT_REQUEST: |
8647 | | /* CertificateCompressionAlgorithm algorithms<1..2^8-1>;*/ |
8648 | 3 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compress_certificate_algorithms_length, |
8649 | 3 | hf->hf.hs_ext_compress_certificate_algorithms_length, 1, UINT8_MAX-1)) { |
8650 | 3 | return offset_end; |
8651 | 3 | } |
8652 | 0 | offset += 1; |
8653 | 0 | next_offset = offset + compress_certificate_algorithms_length; |
8654 | |
|
8655 | 0 | while (offset < next_offset) { |
8656 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_algorithm, |
8657 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
8658 | 0 | offset += 2; |
8659 | 0 | } |
8660 | 0 | break; |
8661 | 0 | default: |
8662 | 0 | break; |
8663 | 3 | } |
8664 | | |
8665 | 0 | return offset; |
8666 | 3 | } |
8667 | | |
8668 | | static uint32_t |
8669 | | ssl_dissect_hnd_hello_ext_token_binding(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8670 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8671 | | uint8_t hnd_type, SslDecryptSession *ssl _U_) |
8672 | 0 | { |
8673 | 0 | uint32_t key_parameters_length, next_offset; |
8674 | 0 | proto_item *p_ti; |
8675 | 0 | proto_tree *p_tree; |
8676 | | |
8677 | | /* RFC 8472 |
8678 | | * |
8679 | | * struct { |
8680 | | * uint8 major; |
8681 | | * uint8 minor; |
8682 | | * } TB_ProtocolVersion; |
8683 | | * |
8684 | | * enum { |
8685 | | * rsa2048_pkcs1.5(0), rsa2048_pss(1), ecdsap256(2), (255) |
8686 | | * } TokenBindingKeyParameters; |
8687 | | * |
8688 | | * struct { |
8689 | | * TB_ProtocolVersion token_binding_version; |
8690 | | * TokenBindingKeyParameters key_parameters_list<1..2^8-1> |
8691 | | * } TokenBindingParameters; |
8692 | | */ |
8693 | |
|
8694 | 0 | switch (hnd_type) { |
8695 | 0 | case SSL_HND_CLIENT_HELLO: |
8696 | 0 | case SSL_HND_SERVER_HELLO: |
8697 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_major, tvb, offset, 1, ENC_BIG_ENDIAN); |
8698 | 0 | offset += 1; |
8699 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_token_binding_version_minor, tvb, offset, 1, ENC_BIG_ENDIAN); |
8700 | 0 | offset += 1; |
8701 | |
|
8702 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &key_parameters_length, |
8703 | 0 | hf->hf.hs_ext_token_binding_key_parameters_length, 1, UINT8_MAX)) { |
8704 | 0 | return offset_end; |
8705 | 0 | } |
8706 | 0 | offset += 1; |
8707 | 0 | next_offset = offset + key_parameters_length; |
8708 | |
|
8709 | 0 | p_ti = proto_tree_add_none_format(tree, |
8710 | 0 | hf->hf.hs_ext_token_binding_key_parameters, |
8711 | 0 | tvb, offset, key_parameters_length, |
8712 | 0 | "Key parameters identifiers (%d identifier%s)", |
8713 | 0 | key_parameters_length, |
8714 | 0 | plurality(key_parameters_length, "", "s")); |
8715 | 0 | p_tree = proto_item_add_subtree(p_ti, hf->ett.hs_ext_token_binding_key_parameters); |
8716 | |
|
8717 | 0 | while (offset < next_offset) { |
8718 | 0 | proto_tree_add_item(p_tree, hf->hf.hs_ext_token_binding_key_parameter, |
8719 | 0 | tvb, offset, 1, ENC_BIG_ENDIAN); |
8720 | 0 | offset += 1; |
8721 | 0 | } |
8722 | |
|
8723 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, p_tree, offset, next_offset)) { |
8724 | 0 | offset = next_offset; |
8725 | 0 | } |
8726 | |
|
8727 | 0 | break; |
8728 | 0 | default: |
8729 | 0 | break; |
8730 | 0 | } |
8731 | | |
8732 | 0 | return offset; |
8733 | 0 | } |
8734 | | |
8735 | | static uint32_t |
8736 | | ssl_dissect_hnd_hello_ext_quic_transport_parameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
8737 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
8738 | | uint8_t hnd_type, SslDecryptSession *ssl _U_) |
8739 | 1 | { |
8740 | 1 | bool use_varint_encoding = true; // Whether this is draft -27 or newer. |
8741 | 1 | uint32_t next_offset; |
8742 | | |
8743 | | /* https://tools.ietf.org/html/draft-ietf-quic-transport-25#section-18 |
8744 | | * |
8745 | | * Note: the following structures are not literally defined in the spec, |
8746 | | * they instead use an ASCII diagram. |
8747 | | * |
8748 | | * struct { |
8749 | | * uint16 id; |
8750 | | * opaque value<0..2^16-1>; |
8751 | | * } TransportParameter; // before draft -27 |
8752 | | * TransportParameter TransportParameters<0..2^16-1>; // before draft -27 |
8753 | | * |
8754 | | * struct { |
8755 | | * opaque ipv4Address[4]; |
8756 | | * uint16 ipv4Port; |
8757 | | * opaque ipv6Address[16]; |
8758 | | * uint16 ipv6Port; |
8759 | | * opaque connectionId<0..18>; |
8760 | | * opaque statelessResetToken[16]; |
8761 | | * } PreferredAddress; |
8762 | | */ |
8763 | | |
8764 | 1 | if (offset_end - offset >= 6 && |
8765 | 0 | 2 + (unsigned)tvb_get_ntohs(tvb, offset) == offset_end - offset && |
8766 | 0 | 6 + (unsigned)tvb_get_ntohs(tvb, offset + 4) <= offset_end - offset) { |
8767 | | // Assume encoding of Transport Parameters draft -26 or older with at |
8768 | | // least one transport parameter that has a valid length. |
8769 | 0 | use_varint_encoding = false; |
8770 | 0 | } |
8771 | | |
8772 | 1 | if (use_varint_encoding) { |
8773 | 1 | next_offset = offset_end; |
8774 | 1 | } else { |
8775 | 0 | uint32_t quic_length; |
8776 | | // Assume draft -26 or earlier. |
8777 | | /* TransportParameter TransportParameters<0..2^16-1>; */ |
8778 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &quic_length, |
8779 | 0 | hf->hf.hs_ext_quictp_len, 0, UINT16_MAX)) { |
8780 | 0 | return offset_end; |
8781 | 0 | } |
8782 | 0 | offset += 2; |
8783 | 0 | next_offset = offset + quic_length; |
8784 | 0 | } |
8785 | | |
8786 | 1 | while (offset < next_offset) { |
8787 | 0 | uint64_t parameter_type; /* 62-bit space */ |
8788 | 0 | uint32_t parameter_length; |
8789 | 0 | proto_tree *parameter_tree; |
8790 | 0 | uint32_t parameter_end_offset; |
8791 | 0 | uint64_t value; |
8792 | 0 | uint32_t i; |
8793 | 0 | int len = 0; |
8794 | |
|
8795 | 0 | parameter_tree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.hs_ext_quictp_parameter, |
8796 | 0 | NULL, "Parameter"); |
8797 | | /* TransportParameter ID and Length. */ |
8798 | 0 | if (use_varint_encoding) { |
8799 | 0 | uint64_t parameter_length64; |
8800 | 0 | int type_len = 0; |
8801 | |
|
8802 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_type, |
8803 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, ¶meter_type, &type_len); |
8804 | 0 | offset += type_len; |
8805 | |
|
8806 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_len, |
8807 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, ¶meter_length64, &len); |
8808 | 0 | parameter_length = (uint32_t)parameter_length64; |
8809 | 0 | offset += len; |
8810 | |
|
8811 | 0 | proto_item_set_len(parameter_tree, type_len + len + parameter_length); |
8812 | 0 | } else { |
8813 | 0 | parameter_type = tvb_get_ntohs(tvb, offset); |
8814 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_type, |
8815 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
8816 | 0 | offset += 2; |
8817 | | |
8818 | | /* opaque value<0..2^16-1> */ |
8819 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, next_offset, ¶meter_length, |
8820 | 0 | hf->hf.hs_ext_quictp_parameter_len_old, 0, UINT16_MAX)) { |
8821 | 0 | return next_offset; |
8822 | 0 | } |
8823 | 0 | offset += 2; |
8824 | |
|
8825 | 0 | proto_item_set_len(parameter_tree, 4 + parameter_length); |
8826 | 0 | } |
8827 | | |
8828 | 0 | if (IS_GREASE_QUIC(parameter_type)) { |
8829 | 0 | proto_item_append_text(parameter_tree, ": GREASE"); |
8830 | 0 | } else { |
8831 | 0 | proto_item_append_text(parameter_tree, ": %s", val64_to_str_wmem(pinfo->pool, parameter_type, quic_transport_parameter_id, "Unknown 0x%04x")); |
8832 | 0 | } |
8833 | |
|
8834 | 0 | proto_item_append_text(parameter_tree, " (len=%u)", parameter_length); |
8835 | 0 | parameter_end_offset = offset + parameter_length; |
8836 | | |
8837 | | /* Omit the value field if the parameter's length is 0. */ |
8838 | 0 | if (parameter_length != 0) { |
8839 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_value, |
8840 | 0 | tvb, offset, parameter_length, ENC_NA); |
8841 | 0 | } |
8842 | |
|
8843 | 0 | switch (parameter_type) { |
8844 | 0 | case SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID: |
8845 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_original_destination_connection_id, |
8846 | 0 | tvb, offset, parameter_length, ENC_NA); |
8847 | 0 | offset += parameter_length; |
8848 | 0 | break; |
8849 | 0 | case SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT: |
8850 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_idle_timeout, |
8851 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8852 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64 " ms", value); |
8853 | 0 | offset += len; |
8854 | 0 | break; |
8855 | 0 | case SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN: |
8856 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_stateless_reset_token, |
8857 | 0 | tvb, offset, 16, ENC_BIG_ENDIAN); |
8858 | 0 | quic_add_stateless_reset_token(pinfo, tvb, offset, NULL); |
8859 | 0 | offset += 16; |
8860 | 0 | break; |
8861 | 0 | case SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE: |
8862 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_udp_payload_size, |
8863 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8864 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8865 | | /*TODO display expert info about invalid value (< 1252 or >65527) ? */ |
8866 | 0 | offset += len; |
8867 | 0 | break; |
8868 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_DATA: |
8869 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_data, |
8870 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8871 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8872 | 0 | offset += len; |
8873 | 0 | break; |
8874 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL: |
8875 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local, |
8876 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8877 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8878 | 0 | offset += len; |
8879 | 0 | break; |
8880 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE: |
8881 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote, |
8882 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8883 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8884 | 0 | offset += len; |
8885 | 0 | break; |
8886 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI: |
8887 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_stream_data_uni, |
8888 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8889 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8890 | 0 | offset += len; |
8891 | 0 | break; |
8892 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI: |
8893 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_uni, |
8894 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8895 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8896 | 0 | offset += len; |
8897 | 0 | break; |
8898 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI: |
8899 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_streams_bidi, |
8900 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8901 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8902 | 0 | offset += len; |
8903 | 0 | break; |
8904 | 0 | case SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT: |
8905 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_ack_delay_exponent, |
8906 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, NULL, &len); |
8907 | | /*TODO display multiplier (x8) and expert info about invalid value (> 20) ? */ |
8908 | 0 | offset += len; |
8909 | 0 | break; |
8910 | 0 | case SSL_HND_QUIC_TP_MAX_ACK_DELAY: |
8911 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_ack_delay, |
8912 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8913 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8914 | 0 | offset += len; |
8915 | 0 | break; |
8916 | 0 | case SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION: |
8917 | | /* No Payload */ |
8918 | 0 | break; |
8919 | 0 | case SSL_HND_QUIC_TP_PREFERRED_ADDRESS: { |
8920 | 0 | uint32_t connectionid_length; |
8921 | 0 | quic_cid_t cid; |
8922 | |
|
8923 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4address, |
8924 | 0 | tvb, offset, 4, ENC_BIG_ENDIAN); |
8925 | 0 | offset += 4; |
8926 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv4port, |
8927 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
8928 | 0 | offset += 2; |
8929 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6address, |
8930 | 0 | tvb, offset, 16, ENC_NA); |
8931 | 0 | offset += 16; |
8932 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_ipv6port, |
8933 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
8934 | 0 | offset += 2; |
8935 | | /* XXX - Should we add these addresses and ports as addresses that the client |
8936 | | * is allowed / expected to migrate the server address to? Right now we don't |
8937 | | * enforce that (see RFC 9000 Section 9, which implies that while the client |
8938 | | * can migrate to whatever address it wants, it can only migrate the server |
8939 | | * address to the Server's Preferred Address as in 9.6. Also Issue #20165.) |
8940 | | */ |
8941 | |
|
8942 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, parameter_tree, offset, offset_end, &connectionid_length, |
8943 | 0 | hf->hf.hs_ext_quictp_parameter_pa_connectionid_length, 0, 20)) { |
8944 | 0 | break; |
8945 | 0 | } |
8946 | 0 | offset += 1; |
8947 | |
|
8948 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_connectionid, |
8949 | 0 | tvb, offset, connectionid_length, ENC_NA); |
8950 | 0 | if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH) { |
8951 | 0 | cid.len = connectionid_length; |
8952 | | // RFC 9000 5.1.1 "If the preferred_address transport |
8953 | | // parameter is sent, the sequence number of the supplied |
8954 | | // connection ID is 1." |
8955 | 0 | cid.seq_num = 1; |
8956 | | // Multipath draft-07 "Also, the Path Identifier for the |
8957 | | // connection ID specified in the "preferred address" |
8958 | | // transport parameter is 0." |
8959 | 0 | cid.path_id = 0; |
8960 | 0 | tvb_memcpy(tvb, cid.cid, offset, connectionid_length); |
8961 | 0 | quic_add_connection(pinfo, &cid); |
8962 | 0 | } |
8963 | 0 | offset += connectionid_length; |
8964 | |
|
8965 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_pa_statelessresettoken, |
8966 | 0 | tvb, offset, 16, ENC_NA); |
8967 | 0 | if (connectionid_length >= 1 && connectionid_length <= QUIC_MAX_CID_LENGTH) { |
8968 | 0 | quic_add_stateless_reset_token(pinfo, tvb, offset, &cid); |
8969 | 0 | } |
8970 | 0 | offset += 16; |
8971 | 0 | } |
8972 | 0 | break; |
8973 | 0 | case SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT: |
8974 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_active_connection_id_limit, |
8975 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8976 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8977 | 0 | offset += len; |
8978 | 0 | break; |
8979 | 0 | case SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID: |
8980 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_source_connection_id, |
8981 | 0 | tvb, offset, parameter_length, ENC_NA); |
8982 | 0 | offset += parameter_length; |
8983 | 0 | break; |
8984 | 0 | case SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID: |
8985 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_retry_source_connection_id, |
8986 | 0 | tvb, offset, parameter_length, ENC_NA); |
8987 | 0 | offset += parameter_length; |
8988 | 0 | break; |
8989 | 0 | case SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE: |
8990 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_max_datagram_frame_size, |
8991 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8992 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
8993 | 0 | offset += len; |
8994 | 0 | break; |
8995 | 0 | case SSL_HND_QUIC_TP_CIBIR_ENCODING: |
8996 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_length, |
8997 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
8998 | 0 | proto_item_append_text(parameter_tree, " Length: %" PRIu64, value); |
8999 | 0 | offset += len; |
9000 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_cibir_encoding_offset, |
9001 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9002 | 0 | proto_item_append_text(parameter_tree, ", Offset: %" PRIu64, value); |
9003 | 0 | offset += len; |
9004 | 0 | break; |
9005 | 0 | case SSL_HND_QUIC_TP_LOSS_BITS: |
9006 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_loss_bits, |
9007 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9008 | 0 | if (len > 0) { |
9009 | 0 | quic_add_loss_bits(pinfo, value); |
9010 | 0 | } |
9011 | 0 | offset += 1; |
9012 | 0 | break; |
9013 | 0 | case SSL_HND_QUIC_TP_ADDRESS_DISCOVERY: |
9014 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_address_discovery, |
9015 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, NULL, &len); |
9016 | 0 | offset += len; |
9017 | 0 | break; |
9018 | 0 | case SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD: |
9019 | 0 | case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1: |
9020 | 0 | case SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05: |
9021 | 0 | case SSL_HND_QUIC_TP_MIN_ACK_DELAY: |
9022 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_min_ack_delay, |
9023 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9024 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64, value); |
9025 | 0 | offset += len; |
9026 | 0 | break; |
9027 | 0 | case SSL_HND_QUIC_TP_GOOGLE_USER_AGENT: |
9028 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_user_agent_id, |
9029 | 0 | tvb, offset, parameter_length, ENC_ASCII|ENC_NA); |
9030 | 0 | offset += parameter_length; |
9031 | 0 | break; |
9032 | 0 | case SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED: |
9033 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported, |
9034 | 0 | tvb, offset, parameter_length, ENC_NA); |
9035 | 0 | offset += parameter_length; |
9036 | 0 | break; |
9037 | 0 | case SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION: |
9038 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_version, |
9039 | 0 | tvb, offset, 4, ENC_BIG_ENDIAN); |
9040 | 0 | offset += 4; |
9041 | 0 | if (hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS) { /* From server */ |
9042 | 0 | uint32_t versions_length; |
9043 | |
|
9044 | 0 | proto_tree_add_item_ret_uint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_supported_versions_length, |
9045 | 0 | tvb, offset, 1, ENC_NA, &versions_length); |
9046 | 0 | offset += 1; |
9047 | 0 | for (i = 0; i < versions_length / 4; i++) { |
9048 | 0 | quic_proto_tree_add_version(tvb, parameter_tree, |
9049 | 0 | hf->hf.hs_ext_quictp_parameter_google_supported_version, offset); |
9050 | 0 | offset += 4; |
9051 | 0 | } |
9052 | 0 | } |
9053 | 0 | break; |
9054 | 0 | case SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT: |
9055 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_initial_rtt, |
9056 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9057 | 0 | proto_item_append_text(parameter_tree, " %" PRIu64 " us", value); |
9058 | 0 | offset += len; |
9059 | 0 | break; |
9060 | 0 | case SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE: |
9061 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_support_handshake_done, |
9062 | 0 | tvb, offset, parameter_length, ENC_NA); |
9063 | 0 | offset += parameter_length; |
9064 | 0 | break; |
9065 | 0 | case SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS: |
9066 | | /* This field was used for non-standard Google-specific parameters encoded as a |
9067 | | * Google QUIC_CRYPTO CHLO and it has been replaced (version >= T051) by individual |
9068 | | * parameters. Report it as a bytes blob... */ |
9069 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params, |
9070 | 0 | tvb, offset, parameter_length, ENC_NA); |
9071 | | /* ... and try decoding it: not sure what the first 4 bytes are (but they seems to be always 0) */ |
9072 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_quic_params_unknown_field, |
9073 | 0 | tvb, offset, 4, ENC_NA); |
9074 | 0 | dissect_gquic_tags(tvb, pinfo, parameter_tree, offset + 4); |
9075 | 0 | offset += parameter_length; |
9076 | 0 | break; |
9077 | 0 | case SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS: |
9078 | 0 | proto_tree_add_item(parameter_tree, hf->hf.hs_ext_quictp_parameter_google_connection_options, |
9079 | 0 | tvb, offset, parameter_length, ENC_NA); |
9080 | 0 | offset += parameter_length; |
9081 | 0 | break; |
9082 | 0 | case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP: |
9083 | | /* No Payload */ |
9084 | 0 | break; |
9085 | 0 | case SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2: |
9086 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_time_stamp_v2, |
9087 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9088 | 0 | offset += parameter_length; |
9089 | 0 | break; |
9090 | 0 | case SSL_HND_QUIC_TP_VERSION_INFORMATION_DRAFT: |
9091 | 0 | case SSL_HND_QUIC_TP_VERSION_INFORMATION: |
9092 | 0 | quic_proto_tree_add_version(tvb, parameter_tree, |
9093 | 0 | hf->hf.hs_ext_quictp_parameter_chosen_version, offset); |
9094 | 0 | offset += 4; |
9095 | 0 | for (i = 4; i < parameter_length; i += 4) { |
9096 | 0 | quic_proto_tree_add_version(tvb, parameter_tree, |
9097 | 0 | hf->hf.hs_ext_quictp_parameter_other_version, offset); |
9098 | 0 | offset += 4; |
9099 | 0 | } |
9100 | 0 | break; |
9101 | 0 | case SSL_HND_QUIC_TP_GREASE_QUIC_BIT: |
9102 | | /* No Payload */ |
9103 | 0 | quic_add_grease_quic_bit(pinfo); |
9104 | 0 | break; |
9105 | 0 | case SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY: |
9106 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_facebook_partial_reliability, |
9107 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9108 | 0 | offset += parameter_length; |
9109 | 0 | break; |
9110 | 0 | case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04: |
9111 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_enable_multipath, |
9112 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9113 | 0 | if (value == 1) { |
9114 | 0 | quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID); |
9115 | 0 | } |
9116 | 0 | offset += parameter_length; |
9117 | 0 | break; |
9118 | 0 | case SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05: |
9119 | 0 | case SSL_HND_QUIC_TP_ENABLE_MULTIPATH: |
9120 | | /* No Payload */ |
9121 | 0 | quic_add_multipath(pinfo, QUIC_MP_NO_PATH_ID); |
9122 | 0 | break; |
9123 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_PATHS: |
9124 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_paths, |
9125 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9126 | 0 | if (value > 1) { |
9127 | 0 | quic_add_multipath(pinfo, QUIC_MP_PATH_ID); |
9128 | 0 | } |
9129 | | /* multipath draft-07: "The value of the initial_max_paths |
9130 | | * parameter MUST be at least 2." TODO: Expert Info? */ |
9131 | 0 | offset += parameter_length; |
9132 | 0 | break; |
9133 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT09: |
9134 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT11: |
9135 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT12: |
9136 | 0 | case SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID: |
9137 | 0 | proto_tree_add_item_ret_varint(parameter_tree, hf->hf.hs_ext_quictp_parameter_initial_max_path_id, |
9138 | 0 | tvb, offset, -1, ENC_VARINT_QUIC, &value, &len); |
9139 | | /* multipath draft-09 and later: "If an endpoint receives an |
9140 | | * initial_max_path_id transport parameter with value 0, the |
9141 | | * peer aims to enable the multipath extension without allowing |
9142 | | * extra paths immediately." |
9143 | | */ |
9144 | 0 | quic_add_multipath(pinfo, QUIC_MP_PATH_ID); |
9145 | 0 | offset += parameter_length; |
9146 | 0 | break; |
9147 | 0 | default: |
9148 | 0 | offset += parameter_length; |
9149 | | /*TODO display expert info about unknown ? */ |
9150 | 0 | break; |
9151 | 0 | } |
9152 | | |
9153 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, parameter_tree, offset, parameter_end_offset)) { |
9154 | | /* Dissection did not end at expected location, fix it. */ |
9155 | 0 | offset = parameter_end_offset; |
9156 | 0 | } |
9157 | 0 | } |
9158 | | |
9159 | 1 | return offset; |
9160 | 1 | } |
9161 | | |
9162 | | static int |
9163 | | ssl_dissect_hnd_hello_common(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9164 | | proto_tree *tree, uint32_t offset, |
9165 | | SslSession *session, SslDecryptSession *ssl, |
9166 | | bool from_server, bool is_hrr) |
9167 | 211 | { |
9168 | 211 | uint8_t sessid_length; |
9169 | 211 | proto_item *ti; |
9170 | 211 | proto_tree *rnd_tree; |
9171 | 211 | proto_tree *ti_rnd; |
9172 | 211 | proto_tree *ech_confirm_tree; |
9173 | 211 | uint8_t draft_version = session->tls13_draft_version; |
9174 | | |
9175 | 211 | if (ssl) { |
9176 | 211 | StringInfo *rnd; |
9177 | 211 | if (from_server) |
9178 | 31 | rnd = &ssl->server_random; |
9179 | 180 | else |
9180 | 180 | rnd = &ssl->client_random; |
9181 | | |
9182 | | /* save provided random for later keyring generation */ |
9183 | 211 | tvb_memcpy(tvb, rnd->data, offset, 32); |
9184 | 211 | rnd->data_len = 32; |
9185 | 211 | if (from_server) |
9186 | 31 | ssl->state |= SSL_SERVER_RANDOM; |
9187 | 180 | else |
9188 | 180 | ssl->state |= SSL_CLIENT_RANDOM; |
9189 | 211 | ssl_debug_printf("%s found %s RANDOM -> state 0x%02X\n", G_STRFUNC, |
9190 | 211 | from_server ? "SERVER" : "CLIENT", ssl->state); |
9191 | 211 | } |
9192 | | |
9193 | 211 | if (!from_server && session->client_random.data_len == 0) { |
9194 | 26 | session->client_random.data_len = 32; |
9195 | 26 | tvb_memcpy(tvb, session->client_random.data, offset, 32); |
9196 | 26 | } |
9197 | | |
9198 | 211 | ti_rnd = proto_tree_add_item(tree, hf->hf.hs_random, tvb, offset, 32, ENC_NA); |
9199 | | |
9200 | 211 | if ((session->version != TLSV1DOT3_VERSION) && (session->version != DTLSV1DOT3_VERSION)) { /* No time on first bytes random with TLS 1.3 */ |
9201 | | |
9202 | 209 | rnd_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random); |
9203 | | /* show the time */ |
9204 | 209 | proto_tree_add_item(rnd_tree, hf->hf.hs_random_time, |
9205 | 209 | tvb, offset, 4, ENC_TIME_SECS|ENC_BIG_ENDIAN); |
9206 | 209 | offset += 4; |
9207 | | |
9208 | | /* show the random bytes */ |
9209 | 209 | proto_tree_add_item(rnd_tree, hf->hf.hs_random_bytes, |
9210 | 209 | tvb, offset, 28, ENC_NA); |
9211 | 209 | offset += 28; |
9212 | 209 | } else { |
9213 | 2 | if (is_hrr) { |
9214 | 0 | proto_item_append_text(ti_rnd, " (HelloRetryRequest magic)"); |
9215 | 2 | } else if (from_server && session->ech) { |
9216 | 0 | ech_confirm_tree = proto_item_add_subtree(ti_rnd, hf->ett.hs_random); |
9217 | 0 | proto_tree_add_item(ech_confirm_tree, hf->hf.hs_ech_confirm, tvb, offset + 24, 8, ENC_NA); |
9218 | 0 | ti = proto_tree_add_bytes_with_length(ech_confirm_tree, hf->hf.hs_ech_confirm_compute, tvb, offset + 24, 0, |
9219 | 0 | session->ech_confirmation, 8); |
9220 | 0 | proto_item_set_generated(ti); |
9221 | 0 | if (memcmp(session->ech_confirmation, tvb_get_ptr(tvb, offset+24, 8), 8)) { |
9222 | 0 | expert_add_info(pinfo, ti, &hf->ei.ech_rejected); |
9223 | 0 | } else { |
9224 | 0 | expert_add_info(pinfo, ti, &hf->ei.ech_accepted); |
9225 | 0 | } |
9226 | 0 | } |
9227 | | |
9228 | 2 | offset += 32; |
9229 | 2 | } |
9230 | | |
9231 | | /* No Session ID with TLS 1.3 on Server Hello before draft -22 */ |
9232 | 211 | if (from_server == 0 || !(session->version == TLSV1DOT3_VERSION && draft_version > 0 && draft_version < 22)) { |
9233 | | /* show the session id (length followed by actual Session ID) */ |
9234 | 209 | sessid_length = tvb_get_uint8(tvb, offset); |
9235 | 209 | proto_tree_add_item(tree, hf->hf.hs_session_id_len, |
9236 | 209 | tvb, offset, 1, ENC_BIG_ENDIAN); |
9237 | 209 | offset++; |
9238 | | |
9239 | 209 | if (ssl) { |
9240 | | /* save the authoritative SID for later use in ChangeCipherSpec. |
9241 | | * (D)TLS restricts the SID to 32 chars, it does not make sense to |
9242 | | * save more, so ignore larger ones. */ |
9243 | 209 | if (from_server && sessid_length <= 32) { |
9244 | 3 | tvb_memcpy(tvb, ssl->session_id.data, offset, sessid_length); |
9245 | 3 | ssl->session_id.data_len = sessid_length; |
9246 | 3 | } |
9247 | 209 | } |
9248 | 209 | if (sessid_length > 0) { |
9249 | 104 | proto_tree_add_item(tree, hf->hf.hs_session_id, |
9250 | 104 | tvb, offset, sessid_length, ENC_NA); |
9251 | 104 | offset += sessid_length; |
9252 | 104 | } |
9253 | 209 | } |
9254 | | |
9255 | 211 | return offset; |
9256 | 211 | } |
9257 | | |
9258 | | static int |
9259 | | ssl_dissect_hnd_hello_ext_status_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9260 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
9261 | | bool has_length) |
9262 | 2 | { |
9263 | | /* TLS 1.2/1.3 status_request Client Hello Extension. |
9264 | | * TLS 1.2 status_request_v2 CertificateStatusRequestItemV2 type. |
9265 | | * https://tools.ietf.org/html/rfc6066#section-8 (status_request) |
9266 | | * https://tools.ietf.org/html/rfc6961#section-2.2 (status_request_v2) |
9267 | | * struct { |
9268 | | * CertificateStatusType status_type; |
9269 | | * uint16 request_length; // for status_request_v2 |
9270 | | * select (status_type) { |
9271 | | * case ocsp: OCSPStatusRequest; |
9272 | | * case ocsp_multi: OCSPStatusRequest; |
9273 | | * } request; |
9274 | | * } CertificateStatusRequest; // CertificateStatusRequestItemV2 |
9275 | | * |
9276 | | * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType; |
9277 | | * struct { |
9278 | | * ResponderID responder_id_list<0..2^16-1>; |
9279 | | * Extensions request_extensions; |
9280 | | * } OCSPStatusRequest; |
9281 | | * opaque ResponderID<1..2^16-1>; |
9282 | | * opaque Extensions<0..2^16-1>; |
9283 | | */ |
9284 | 2 | unsigned cert_status_type; |
9285 | | |
9286 | 2 | cert_status_type = tvb_get_uint8(tvb, offset); |
9287 | 2 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_type, |
9288 | 2 | tvb, offset, 1, ENC_NA); |
9289 | 2 | offset++; |
9290 | | |
9291 | 2 | if (has_length) { |
9292 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_status_request_len, |
9293 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
9294 | 0 | offset += 2; |
9295 | 0 | } |
9296 | | |
9297 | 2 | switch (cert_status_type) { |
9298 | 0 | case SSL_HND_CERT_STATUS_TYPE_OCSP: |
9299 | 0 | case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI: |
9300 | 0 | { |
9301 | 0 | uint32_t responder_id_list_len; |
9302 | 0 | uint32_t request_extensions_len; |
9303 | | |
9304 | | /* ResponderID responder_id_list<0..2^16-1> */ |
9305 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &responder_id_list_len, |
9306 | 0 | hf->hf.hs_ext_cert_status_responder_id_list_len, 0, UINT16_MAX)) { |
9307 | 0 | return offset_end; |
9308 | 0 | } |
9309 | 0 | offset += 2; |
9310 | 0 | if (responder_id_list_len != 0) { |
9311 | 0 | proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded, |
9312 | 0 | tvb, offset, responder_id_list_len, |
9313 | 0 | "Responder ID list is not implemented, contact Wireshark" |
9314 | 0 | " developers if you want this to be supported"); |
9315 | 0 | } |
9316 | 0 | offset += responder_id_list_len; |
9317 | | |
9318 | | /* opaque Extensions<0..2^16-1> */ |
9319 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &request_extensions_len, |
9320 | 0 | hf->hf.hs_ext_cert_status_request_extensions_len, 0, UINT16_MAX)) { |
9321 | 0 | return offset_end; |
9322 | 0 | } |
9323 | 0 | offset += 2; |
9324 | 0 | if (request_extensions_len != 0) { |
9325 | 0 | proto_tree_add_expert_format(tree, pinfo, &hf->ei.hs_ext_cert_status_undecoded, |
9326 | 0 | tvb, offset, request_extensions_len, |
9327 | 0 | "Request Extensions are not implemented, contact" |
9328 | 0 | " Wireshark developers if you want this to be supported"); |
9329 | 0 | } |
9330 | 0 | offset += request_extensions_len; |
9331 | 0 | break; |
9332 | 0 | } |
9333 | 2 | } |
9334 | | |
9335 | 2 | return offset; |
9336 | 2 | } |
9337 | | |
9338 | | static unsigned |
9339 | | ssl_dissect_hnd_hello_ext_status_request_v2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9340 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
9341 | 0 | { |
9342 | | /* https://tools.ietf.org/html/rfc6961#section-2.2 |
9343 | | * struct { |
9344 | | * CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1>; |
9345 | | * } CertificateStatusRequestListV2; |
9346 | | */ |
9347 | 0 | uint32_t req_list_length, next_offset; |
9348 | | |
9349 | | /* CertificateStatusRequestItemV2 certificate_status_req_list<1..2^16-1> */ |
9350 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &req_list_length, |
9351 | 0 | hf->hf.hs_ext_cert_status_request_list_len, 1, UINT16_MAX)) { |
9352 | 0 | return offset_end; |
9353 | 0 | } |
9354 | 0 | offset += 2; |
9355 | 0 | next_offset = offset + req_list_length; |
9356 | |
|
9357 | 0 | while (offset < next_offset) { |
9358 | 0 | offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, tree, offset, next_offset, true); |
9359 | 0 | } |
9360 | |
|
9361 | 0 | return offset; |
9362 | 0 | } |
9363 | | |
9364 | | static uint32_t |
9365 | | tls_dissect_ocsp_response(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
9366 | | uint32_t offset, uint32_t offset_end) |
9367 | 0 | { |
9368 | 0 | uint32_t response_length; |
9369 | 0 | proto_item *ocsp_resp; |
9370 | 0 | proto_tree *ocsp_resp_tree; |
9371 | 0 | asn1_ctx_t asn1_ctx; |
9372 | | |
9373 | | /* opaque OCSPResponse<1..2^24-1>; */ |
9374 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &response_length, |
9375 | 0 | hf->hf.hs_ocsp_response_len, 1, G_MAXUINT24)) { |
9376 | 0 | return offset_end; |
9377 | 0 | } |
9378 | 0 | offset += 3; |
9379 | |
|
9380 | 0 | ocsp_resp = proto_tree_add_item(tree, proto_ocsp, tvb, offset, |
9381 | 0 | response_length, ENC_BIG_ENDIAN); |
9382 | 0 | proto_item_set_text(ocsp_resp, "OCSP Response"); |
9383 | 0 | ocsp_resp_tree = proto_item_add_subtree(ocsp_resp, hf->ett.ocsp_response); |
9384 | 0 | if (proto_is_protocol_enabled(find_protocol_by_id(proto_ocsp))) { |
9385 | 0 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
9386 | 0 | dissect_ocsp_OCSPResponse(false, tvb, offset, &asn1_ctx, ocsp_resp_tree, -1); |
9387 | 0 | } |
9388 | 0 | offset += response_length; |
9389 | |
|
9390 | 0 | return offset; |
9391 | 0 | } |
9392 | | |
9393 | | uint32_t |
9394 | | tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9395 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
9396 | 3 | { |
9397 | | /* TLS 1.2 "CertificateStatus" handshake message. |
9398 | | * TLS 1.3 "status_request" Certificate extension. |
9399 | | * struct { |
9400 | | * CertificateStatusType status_type; |
9401 | | * select (status_type) { |
9402 | | * case ocsp: OCSPResponse; |
9403 | | * case ocsp_multi: OCSPResponseList; // status_request_v2 |
9404 | | * } response; |
9405 | | * } CertificateStatus; |
9406 | | * opaque OCSPResponse<1..2^24-1>; |
9407 | | * struct { |
9408 | | * OCSPResponse ocsp_response_list<1..2^24-1>; |
9409 | | * } OCSPResponseList; // status_request_v2 |
9410 | | */ |
9411 | 3 | uint32_t status_type, resp_list_length, next_offset; |
9412 | | |
9413 | 3 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_cert_status_type, |
9414 | 3 | tvb, offset, 1, ENC_BIG_ENDIAN, &status_type); |
9415 | 3 | offset += 1; |
9416 | | |
9417 | 3 | switch (status_type) { |
9418 | 0 | case SSL_HND_CERT_STATUS_TYPE_OCSP: |
9419 | 0 | offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, offset_end); |
9420 | 0 | break; |
9421 | | |
9422 | 0 | case SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI: |
9423 | | /* OCSPResponse ocsp_response_list<1..2^24-1> */ |
9424 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &resp_list_length, |
9425 | 0 | hf->hf.hs_ocsp_response_list_len, 1, G_MAXUINT24)) { |
9426 | 0 | return offset_end; |
9427 | 0 | } |
9428 | 0 | offset += 3; |
9429 | 0 | next_offset = offset + resp_list_length; |
9430 | |
|
9431 | 0 | while (offset < next_offset) { |
9432 | 0 | offset = tls_dissect_ocsp_response(hf, tvb, pinfo, tree, offset, next_offset); |
9433 | 0 | } |
9434 | 0 | break; |
9435 | 3 | } |
9436 | | |
9437 | 1 | return offset; |
9438 | 3 | } |
9439 | | |
9440 | | static unsigned |
9441 | | ssl_dissect_hnd_hello_ext_supported_groups(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9442 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
9443 | | wmem_strbuf_t *ja3) |
9444 | 10 | { |
9445 | | /* RFC 8446 Section 4.2.7 |
9446 | | * enum { ..., (0xFFFF) } NamedGroup; |
9447 | | * struct { |
9448 | | * NamedGroup named_group_list<2..2^16-1> |
9449 | | * } NamedGroupList; |
9450 | | * |
9451 | | * NOTE: "NamedCurve" (RFC 4492) is renamed to "NamedGroup" (RFC 7919) and |
9452 | | * the extension itself from "elliptic_curves" to "supported_groups". |
9453 | | */ |
9454 | 10 | uint32_t groups_length, next_offset; |
9455 | 10 | proto_tree *groups_tree; |
9456 | 10 | proto_item *ti; |
9457 | 10 | char *ja3_dash = ""; |
9458 | | |
9459 | | /* NamedGroup named_group_list<2..2^16-1> */ |
9460 | 10 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &groups_length, |
9461 | 10 | hf->hf.hs_ext_supported_groups_len, 2, UINT16_MAX)) { |
9462 | 2 | return offset_end; |
9463 | 2 | } |
9464 | 8 | offset += 2; |
9465 | 8 | next_offset = offset + groups_length; |
9466 | | |
9467 | 8 | ti = proto_tree_add_none_format(tree, |
9468 | 8 | hf->hf.hs_ext_supported_groups, |
9469 | 8 | tvb, offset, groups_length, |
9470 | 8 | "Supported Groups (%d group%s)", |
9471 | 8 | groups_length / 2, |
9472 | 8 | plurality(groups_length/2, "", "s")); |
9473 | | |
9474 | | /* make this a subtree */ |
9475 | 8 | groups_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_groups); |
9476 | | |
9477 | 8 | if (ja3) { |
9478 | 6 | wmem_strbuf_append_c(ja3, ','); |
9479 | 6 | } |
9480 | | /* loop over all groups */ |
9481 | 2.09k | while (offset + 2 <= offset_end) { |
9482 | 2.08k | uint32_t ext_supported_group; |
9483 | | |
9484 | 2.08k | proto_tree_add_item_ret_uint(groups_tree, hf->hf.hs_ext_supported_group, tvb, offset, 2, |
9485 | 2.08k | ENC_BIG_ENDIAN, &ext_supported_group); |
9486 | 2.08k | offset += 2; |
9487 | 2.08k | if (ja3 && !IS_GREASE_TLS(ext_supported_group)) { |
9488 | 1.64k | wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_supported_group); |
9489 | 1.64k | ja3_dash = "-"; |
9490 | 1.64k | } |
9491 | 2.08k | } |
9492 | 8 | if (!ssl_end_vector(hf, tvb, pinfo, groups_tree, offset, next_offset)) { |
9493 | 0 | offset = next_offset; |
9494 | 0 | } |
9495 | | |
9496 | 8 | return offset; |
9497 | 10 | } |
9498 | | |
9499 | | static int |
9500 | | ssl_dissect_hnd_hello_ext_ec_point_formats(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
9501 | | proto_tree *tree, uint32_t offset, wmem_strbuf_t *ja3) |
9502 | 3 | { |
9503 | 3 | uint8_t ecpf_length; |
9504 | 3 | proto_tree *ecpf_tree; |
9505 | 3 | proto_item *ti; |
9506 | | |
9507 | 3 | ecpf_length = tvb_get_uint8(tvb, offset); |
9508 | 3 | proto_tree_add_item(tree, hf->hf.hs_ext_ec_point_formats_len, |
9509 | 3 | tvb, offset, 1, ENC_BIG_ENDIAN); |
9510 | | |
9511 | 3 | offset += 1; |
9512 | 3 | ti = proto_tree_add_none_format(tree, |
9513 | 3 | hf->hf.hs_ext_ec_point_formats, |
9514 | 3 | tvb, offset, ecpf_length, |
9515 | 3 | "Elliptic curves point formats (%d)", |
9516 | 3 | ecpf_length); |
9517 | | |
9518 | | /* make this a subtree */ |
9519 | 3 | ecpf_tree = proto_item_add_subtree(ti, hf->ett.hs_ext_curves_point_formats); |
9520 | | |
9521 | 3 | if (ja3) { |
9522 | 3 | wmem_strbuf_append_c(ja3, ','); |
9523 | 3 | } |
9524 | | |
9525 | | /* loop over all point formats */ |
9526 | 253 | while (ecpf_length > 0) |
9527 | 250 | { |
9528 | 250 | uint32_t ext_ec_point_format; |
9529 | | |
9530 | 250 | proto_tree_add_item_ret_uint(ecpf_tree, hf->hf.hs_ext_ec_point_format, tvb, offset, 1, |
9531 | 250 | ENC_BIG_ENDIAN, &ext_ec_point_format); |
9532 | 250 | offset++; |
9533 | 250 | ecpf_length--; |
9534 | 250 | if (ja3) { |
9535 | 248 | wmem_strbuf_append_printf(ja3, "%i", ext_ec_point_format); |
9536 | 248 | if (ecpf_length > 0) { |
9537 | 247 | wmem_strbuf_append_c(ja3, '-'); |
9538 | 247 | } |
9539 | 248 | } |
9540 | 250 | } |
9541 | | |
9542 | 3 | return offset; |
9543 | 3 | } |
9544 | | |
9545 | | static int |
9546 | | ssl_dissect_hnd_hello_ext_srp(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
9547 | | packet_info *pinfo, proto_tree *tree, |
9548 | | uint32_t offset, uint32_t next_offset) |
9549 | 1 | { |
9550 | | /* https://tools.ietf.org/html/rfc5054#section-2.8.1 |
9551 | | * opaque srp_I<1..2^8-1>; |
9552 | | */ |
9553 | 1 | uint32_t username_len; |
9554 | | |
9555 | 1 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, next_offset, &username_len, |
9556 | 1 | hf->hf.hs_ext_srp_len, 1, UINT8_MAX)) { |
9557 | 1 | return next_offset; |
9558 | 1 | } |
9559 | 0 | offset++; |
9560 | |
|
9561 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_srp_username, |
9562 | 0 | tvb, offset, username_len, ENC_UTF_8|ENC_NA); |
9563 | 0 | offset += username_len; |
9564 | |
|
9565 | 0 | return offset; |
9566 | 1 | } |
9567 | | |
9568 | | static uint32_t |
9569 | | tls_dissect_sct(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
9570 | | uint32_t offset, uint32_t offset_end, uint16_t version) |
9571 | 0 | { |
9572 | | /* https://tools.ietf.org/html/rfc6962#section-3.2 |
9573 | | * enum { v1(0), (255) } Version; |
9574 | | * struct { |
9575 | | * opaque key_id[32]; |
9576 | | * } LogID; |
9577 | | * opaque CtExtensions<0..2^16-1>; |
9578 | | * struct { |
9579 | | * Version sct_version; |
9580 | | * LogID id; |
9581 | | * uint64 timestamp; |
9582 | | * CtExtensions extensions; |
9583 | | * digitally-signed struct { ... }; |
9584 | | * } SignedCertificateTimestamp; |
9585 | | */ |
9586 | 0 | uint32_t sct_version; |
9587 | 0 | uint64_t sct_timestamp_ms; |
9588 | 0 | nstime_t sct_timestamp; |
9589 | 0 | uint32_t exts_len; |
9590 | 0 | const char *log_name; |
9591 | |
|
9592 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.sct_sct_version, tvb, offset, 1, ENC_NA, &sct_version); |
9593 | 0 | offset++; |
9594 | 0 | if (sct_version != 0) { |
9595 | | // TODO expert info about unknown SCT version? |
9596 | 0 | return offset; |
9597 | 0 | } |
9598 | 0 | proto_tree_add_item(tree, hf->hf.sct_sct_logid, tvb, offset, 32, ENC_BIG_ENDIAN); |
9599 | 0 | log_name = bytesval_to_str_wmem(pinfo->pool, tvb_get_ptr(tvb, offset, 32), 32, ct_logids, "Unknown Log"); |
9600 | 0 | proto_item_append_text(tree, " (%s)", log_name); |
9601 | 0 | offset += 32; |
9602 | 0 | sct_timestamp_ms = tvb_get_ntoh64(tvb, offset); |
9603 | 0 | sct_timestamp.secs = (time_t)(sct_timestamp_ms / 1000); |
9604 | 0 | sct_timestamp.nsecs = (int)((sct_timestamp_ms % 1000) * 1000000); |
9605 | 0 | proto_tree_add_time(tree, hf->hf.sct_sct_timestamp, tvb, offset, 8, &sct_timestamp); |
9606 | 0 | offset += 8; |
9607 | | /* opaque CtExtensions<0..2^16-1> */ |
9608 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len, |
9609 | 0 | hf->hf.sct_sct_extensions_length, 0, UINT16_MAX)) { |
9610 | 0 | return offset_end; |
9611 | 0 | } |
9612 | 0 | offset += 2; |
9613 | 0 | if (exts_len > 0) { |
9614 | 0 | proto_tree_add_item(tree, hf->hf.sct_sct_extensions, tvb, offset, exts_len, ENC_BIG_ENDIAN); |
9615 | 0 | offset += exts_len; |
9616 | 0 | } |
9617 | 0 | offset = ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version, |
9618 | 0 | hf->hf.sct_sct_signature_length, |
9619 | 0 | hf->hf.sct_sct_signature); |
9620 | 0 | return offset; |
9621 | 0 | } |
9622 | | |
9623 | | uint32_t |
9624 | | tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
9625 | | uint32_t offset, uint32_t offset_end, uint16_t version) |
9626 | 0 | { |
9627 | | /* https://tools.ietf.org/html/rfc6962#section-3.3 |
9628 | | * opaque SerializedSCT<1..2^16-1>; |
9629 | | * struct { |
9630 | | * SerializedSCT sct_list <1..2^16-1>; |
9631 | | * } SignedCertificateTimestampList; |
9632 | | */ |
9633 | 0 | uint32_t list_length, sct_length, next_offset; |
9634 | 0 | proto_tree *subtree; |
9635 | | |
9636 | | /* SerializedSCT sct_list <1..2^16-1> */ |
9637 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &list_length, |
9638 | 0 | hf->hf.sct_scts_length, 1, UINT16_MAX)) { |
9639 | 0 | return offset_end; |
9640 | 0 | } |
9641 | 0 | offset += 2; |
9642 | |
|
9643 | 0 | while (offset < offset_end) { |
9644 | 0 | subtree = proto_tree_add_subtree(tree, tvb, offset, 2, hf->ett.sct, NULL, "Signed Certificate Timestamp"); |
9645 | | |
9646 | | /* opaque SerializedSCT<1..2^16-1> */ |
9647 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &sct_length, |
9648 | 0 | hf->hf.sct_sct_length, 1, UINT16_MAX)) { |
9649 | 0 | return offset_end; |
9650 | 0 | } |
9651 | 0 | offset += 2; |
9652 | 0 | next_offset = offset + sct_length; |
9653 | 0 | proto_item_set_len(subtree, 2 + sct_length); |
9654 | 0 | offset = tls_dissect_sct(hf, tvb, pinfo, subtree, offset, next_offset, version); |
9655 | 0 | if (!ssl_end_vector(hf, tvb, pinfo, subtree, offset, next_offset)) { |
9656 | 0 | offset = next_offset; |
9657 | 0 | } |
9658 | 0 | } |
9659 | | |
9660 | 0 | return offset; |
9661 | 0 | } |
9662 | | |
9663 | | static int |
9664 | | dissect_ech_hpke_cipher_suite(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo _U_, |
9665 | | proto_tree *tree, uint32_t offset) |
9666 | 1.44k | { |
9667 | 1.44k | uint32_t kdf_id, aead_id; |
9668 | 1.44k | proto_item *cs_ti; |
9669 | 1.44k | proto_tree *cs_tree; |
9670 | | |
9671 | 1.44k | cs_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig_cipher_suite, |
9672 | 1.44k | tvb, offset, 4, ENC_NA); |
9673 | 1.44k | cs_tree = proto_item_add_subtree(cs_ti, hf->ett.ech_hpke_cipher_suite); |
9674 | | |
9675 | 1.44k | proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_kdf_id, |
9676 | 1.44k | tvb, offset, 2, ENC_BIG_ENDIAN, &kdf_id); |
9677 | 1.44k | offset += 2; |
9678 | 1.44k | proto_tree_add_item_ret_uint(cs_tree, hf->hf.ech_hpke_keyconfig_cipher_suite_aead_id, |
9679 | 1.44k | tvb, offset, 2, ENC_BIG_ENDIAN, &aead_id); |
9680 | 1.44k | offset += 2; |
9681 | | |
9682 | 1.44k | proto_item_append_text(cs_ti, ": %s/%s", |
9683 | 1.44k | val_to_str_const(kdf_id, kdf_id_type_vals, "Unknown"), |
9684 | 1.44k | val_to_str_const(aead_id, aead_id_type_vals, "Unknown")); |
9685 | 1.44k | return offset; |
9686 | 1.44k | } |
9687 | | |
9688 | | static int |
9689 | | dissect_ech_hpke_key_config(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9690 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
9691 | | uint32_t *config_id) |
9692 | 683 | { |
9693 | 683 | uint32_t length, cipher_suite_length; |
9694 | 683 | proto_item *kc_ti, *css_ti; |
9695 | 683 | proto_tree *kc_tree, *css_tree; |
9696 | 683 | uint32_t original_offset = offset, next_offset; |
9697 | | |
9698 | 683 | kc_ti = proto_tree_add_item(tree, hf->hf.ech_hpke_keyconfig, |
9699 | 683 | tvb, offset, -1, ENC_NA); |
9700 | 683 | kc_tree = proto_item_add_subtree(kc_ti, hf->ett.ech_hpke_keyconfig); |
9701 | | |
9702 | 683 | proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_config_id, |
9703 | 683 | tvb, offset, 1, ENC_BIG_ENDIAN, config_id); |
9704 | 683 | offset += 1; |
9705 | 683 | proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_kem_id, |
9706 | 683 | tvb, offset, 2, ENC_BIG_ENDIAN); |
9707 | 683 | offset += 2; |
9708 | 683 | proto_tree_add_item_ret_uint(kc_tree, hf->hf.ech_hpke_keyconfig_public_key_length, |
9709 | 683 | tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
9710 | 683 | offset += 2; |
9711 | 683 | proto_tree_add_item(kc_tree, hf->hf.ech_hpke_keyconfig_public_key, |
9712 | 683 | tvb, offset, length, ENC_NA); |
9713 | 683 | offset += length; |
9714 | | |
9715 | | /* HpkeSymmetricCipherSuite cipher_suites<4..2^16-4> */ |
9716 | 683 | if (!ssl_add_vector(hf, tvb, pinfo, kc_tree, offset, offset_end, &cipher_suite_length, |
9717 | 683 | hf->hf.ech_hpke_keyconfig_cipher_suites_length, 4, UINT16_MAX - 3)) { |
9718 | 4 | return offset_end; |
9719 | 4 | } |
9720 | 679 | offset += 2; |
9721 | 679 | next_offset = offset + cipher_suite_length; |
9722 | | |
9723 | 679 | css_ti = proto_tree_add_none_format(kc_tree, |
9724 | 679 | hf->hf.ech_hpke_keyconfig_cipher_suites, |
9725 | 679 | tvb, offset, cipher_suite_length, |
9726 | 679 | "Cipher Suites (%d suite%s)", |
9727 | 679 | cipher_suite_length / 4, |
9728 | 679 | plurality(cipher_suite_length / 4, "", "s")); |
9729 | 679 | css_tree = proto_item_add_subtree(css_ti, hf->ett.ech_hpke_cipher_suites); |
9730 | | |
9731 | | |
9732 | 2.12k | while (offset + 4 <= next_offset) { |
9733 | 1.44k | offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, css_tree, offset); |
9734 | 1.44k | } |
9735 | | |
9736 | 679 | if (!ssl_end_vector(hf, tvb, pinfo, css_tree, offset, next_offset)) { |
9737 | 321 | offset = next_offset; |
9738 | 321 | } |
9739 | | |
9740 | 679 | proto_item_set_len(kc_ti, offset - original_offset); |
9741 | | |
9742 | 679 | return offset; |
9743 | 683 | } |
9744 | | |
9745 | | static int |
9746 | | dissect_ech_echconfig_contents(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9747 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
9748 | | const uint8_t **public_name, uint32_t *config_id) |
9749 | 683 | { |
9750 | 683 | uint32_t public_name_length, extensions_length, next_offset; |
9751 | | |
9752 | 683 | offset = dissect_ech_hpke_key_config(hf, tvb, pinfo, tree, offset, offset_end, config_id); |
9753 | 683 | proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_maximum_name_length, |
9754 | 683 | tvb, offset, 1, ENC_BIG_ENDIAN); |
9755 | 683 | offset += 1; |
9756 | 683 | proto_tree_add_item_ret_uint(tree, hf->hf.ech_echconfigcontents_public_name_length, |
9757 | 683 | tvb, offset, 1, ENC_BIG_ENDIAN, &public_name_length); |
9758 | 683 | offset += 1; |
9759 | 683 | proto_tree_add_item_ret_string(tree, hf->hf.ech_echconfigcontents_public_name, |
9760 | 683 | tvb, offset, public_name_length, ENC_ASCII, pinfo->pool, public_name); |
9761 | 683 | offset += public_name_length; |
9762 | | |
9763 | | /* Extension extensions<0..2^16-1>; */ |
9764 | 683 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &extensions_length, |
9765 | 683 | hf->hf.ech_echconfigcontents_extensions_length, 0, UINT16_MAX)) { |
9766 | 104 | return offset_end; |
9767 | 104 | } |
9768 | 579 | offset += 2; |
9769 | 579 | next_offset = offset + extensions_length; |
9770 | | |
9771 | 579 | if (extensions_length > 0) { |
9772 | 280 | proto_tree_add_item(tree, hf->hf.ech_echconfigcontents_extensions, |
9773 | 280 | tvb, offset, extensions_length, ENC_NA); |
9774 | 280 | } |
9775 | 579 | offset += extensions_length; |
9776 | | |
9777 | 579 | if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) { |
9778 | 0 | offset = next_offset; |
9779 | 0 | } |
9780 | | |
9781 | 579 | return offset; |
9782 | 683 | } |
9783 | | |
9784 | | static int |
9785 | | dissect_ech_echconfig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9786 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
9787 | 2.97k | { |
9788 | 2.97k | uint32_t version, length; |
9789 | 2.97k | proto_item *ech_ti; |
9790 | 2.97k | proto_tree *ech_tree; |
9791 | 2.97k | const uint8_t *public_name = NULL; |
9792 | 2.97k | uint32_t config_id = 0; |
9793 | | |
9794 | 2.97k | ech_ti = proto_tree_add_item(tree, hf->hf.ech_echconfig, tvb, offset, -1, ENC_NA); |
9795 | 2.97k | ech_tree = proto_item_add_subtree(ech_ti, hf->ett.ech_echconfig); |
9796 | | |
9797 | 2.97k | proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_version, |
9798 | 2.97k | tvb, offset, 2, ENC_BIG_ENDIAN, &version); |
9799 | 2.97k | offset += 2; |
9800 | 2.97k | proto_tree_add_item_ret_uint(ech_tree, hf->hf.ech_echconfig_length, |
9801 | 2.97k | tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
9802 | 2.97k | offset += 2; |
9803 | | |
9804 | 2.97k | proto_item_set_len(ech_ti, 4 + length); |
9805 | | |
9806 | 2.97k | switch(version) { |
9807 | 683 | case 0xfe0d: |
9808 | 683 | dissect_ech_echconfig_contents(hf, tvb, pinfo, ech_tree, offset, offset_end, &public_name, &config_id); |
9809 | 683 | proto_item_append_text(ech_ti, ": id=%d %s", config_id, public_name); |
9810 | 683 | break; |
9811 | | |
9812 | 2.15k | default: |
9813 | 2.15k | expert_add_info_format(pinfo, ech_ti, &hf->ei.ech_echconfig_invalid_version, "Unsupported/unknown ECHConfig version 0x%x", version); |
9814 | 2.97k | } |
9815 | | |
9816 | 2.71k | return 4 + length; |
9817 | 2.97k | } |
9818 | | |
9819 | | uint32_t |
9820 | | ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9821 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
9822 | 4.76k | { |
9823 | 4.76k | uint32_t echconfiglist_length, next_offset; |
9824 | | |
9825 | | /* ECHConfig ECHConfigList<1..2^16-1>; */ |
9826 | 4.76k | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &echconfiglist_length, |
9827 | 4.76k | hf->hf.ech_echconfiglist_length, 1, UINT16_MAX)) { |
9828 | 3.51k | return offset_end; |
9829 | 3.51k | } |
9830 | 1.24k | offset += 2; |
9831 | 1.24k | next_offset = offset + echconfiglist_length; |
9832 | | |
9833 | 4.21k | while (offset < next_offset) { |
9834 | 2.97k | offset += dissect_ech_echconfig(hf, tvb, pinfo, tree, offset, offset_end); |
9835 | 2.97k | } |
9836 | | |
9837 | 1.24k | if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) { |
9838 | 406 | offset = next_offset; |
9839 | 406 | } |
9840 | | |
9841 | 1.24k | return offset; |
9842 | 4.76k | } |
9843 | | |
9844 | | static uint32_t |
9845 | | ssl_dissect_hnd_ech_outer_ext(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
9846 | | uint32_t offset, uint32_t offset_end) |
9847 | 3 | { |
9848 | 3 | uint32_t ext_length, next_offset; |
9849 | 3 | proto_tree *ext_tree; |
9850 | 3 | proto_item *ti; |
9851 | | |
9852 | 3 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &ext_length, |
9853 | 3 | hf->hf.hs_ext_ech_outer_ext_len, 2, UINT8_MAX)) { |
9854 | 0 | return offset_end; |
9855 | 0 | } |
9856 | 3 | offset += 1; |
9857 | 3 | next_offset = offset + ext_length; |
9858 | | |
9859 | 3 | ti = proto_tree_add_none_format(tree, |
9860 | 3 | hf->hf.hs_ext_ech_outer_ext, |
9861 | 3 | tvb, offset, ext_length, |
9862 | 3 | "Outer Extensions (%d extension%s)", |
9863 | 3 | ext_length / 2, |
9864 | 3 | plurality(ext_length/2, "", "s")); |
9865 | | |
9866 | 3 | ext_tree = proto_item_add_subtree(ti, hf->ett.hs_ext); |
9867 | | |
9868 | 182 | while (offset + 2 <= offset_end) { |
9869 | 179 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_type, tvb, offset, 2, ENC_BIG_ENDIAN); |
9870 | 179 | offset += 2; |
9871 | 179 | } |
9872 | | |
9873 | 3 | if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) { |
9874 | 1 | offset = next_offset; |
9875 | 1 | } |
9876 | | |
9877 | 3 | return offset; |
9878 | 3 | } |
9879 | | |
9880 | | static uint32_t |
9881 | | // NOLINTNEXTLINE(misc-no-recursion) |
9882 | | ssl_dissect_hnd_hello_ext_ech(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
9883 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
9884 | | uint8_t hnd_type, SslSession *session, SslDecryptSession *ssl, ssl_master_key_map_t *mk_map, |
9885 | | uint32_t initial_offset, uint32_t hello_length) |
9886 | 0 | { |
9887 | 0 | uint32_t ch_type, length; |
9888 | 0 | proto_item *ti, *payload_ti; |
9889 | 0 | proto_tree *retry_tree, *payload_tree; |
9890 | |
|
9891 | 0 | switch (hnd_type) { |
9892 | 0 | case SSL_HND_CLIENT_HELLO: |
9893 | | /* |
9894 | | * enum { outer(0), inner(1) } ECHClientHelloType; |
9895 | | * |
9896 | | * struct { |
9897 | | * ECHClientHelloType type; |
9898 | | * select (ECHClientHello.type) { |
9899 | | * case outer: |
9900 | | * HpkeSymmetricCipherSuite cipher_suite; |
9901 | | * uint8 config_id; |
9902 | | * opaque enc<0..2^16-1>; |
9903 | | * opaque payload<1..2^16-1>; |
9904 | | * case inner: |
9905 | | * Empty; |
9906 | | * }; |
9907 | | * } ECHClientHello; |
9908 | | */ |
9909 | |
|
9910 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.ech_clienthello_type, tvb, offset, 1, ENC_BIG_ENDIAN, &ch_type); |
9911 | 0 | offset += 1; |
9912 | 0 | switch (ch_type) { |
9913 | 0 | case 0: /* outer */ |
9914 | 0 | if (ssl && session->first_ch_ech_frame == 0) { |
9915 | 0 | session->first_ch_ech_frame = pinfo->num; |
9916 | 0 | } |
9917 | 0 | offset = dissect_ech_hpke_cipher_suite(hf, tvb, pinfo, tree, offset); |
9918 | 0 | uint16_t kdf_id = tvb_get_ntohs(tvb, offset - 4); |
9919 | 0 | uint16_t aead_id = tvb_get_ntohs(tvb, offset - 2); |
9920 | |
|
9921 | 0 | proto_tree_add_item(tree, hf->hf.ech_config_id, tvb, offset, 1, ENC_BIG_ENDIAN); |
9922 | 0 | uint8_t config_id = tvb_get_uint8(tvb, offset); |
9923 | 0 | offset += 1; |
9924 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.ech_enc_length, tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
9925 | 0 | offset += 2; |
9926 | 0 | proto_tree_add_item(tree, hf->hf.ech_enc, tvb, offset, length, ENC_NA); |
9927 | 0 | offset += length; |
9928 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.ech_payload_length, tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
9929 | 0 | offset += 2; |
9930 | 0 | payload_ti = proto_tree_add_item(tree, hf->hf.ech_payload, tvb, offset, length, ENC_NA); |
9931 | 0 | offset += length; |
9932 | |
|
9933 | 0 | if (!mk_map) { |
9934 | 0 | break; |
9935 | 0 | } |
9936 | 0 | if (session->client_random.data_len == 0) { |
9937 | 0 | ssl_debug_printf("%s missing Client Random\n", G_STRFUNC); |
9938 | 0 | break; |
9939 | 0 | } |
9940 | 0 | StringInfo *ech_secret = (StringInfo *)g_hash_table_lookup(mk_map->ech_secret, &session->client_random); |
9941 | 0 | StringInfo *ech_config = (StringInfo *)g_hash_table_lookup(mk_map->ech_config, &session->client_random); |
9942 | 0 | if (!ech_secret || !ech_config) { |
9943 | 0 | ssl_debug_printf("%s Cannot find ECH_SECRET or ECH_CONFIG, Encrypted Client Hello decryption impossible\n", |
9944 | 0 | G_STRFUNC); |
9945 | 0 | break; |
9946 | 0 | } |
9947 | | |
9948 | 0 | if (hpke_hkdf_len(kdf_id) == 0) { |
9949 | 0 | ssl_debug_printf("Unsupported KDF\n"); |
9950 | 0 | break; |
9951 | 0 | } |
9952 | | |
9953 | 0 | if (hpke_aead_key_len(aead_id) == 0) { |
9954 | 0 | ssl_debug_printf("Unsupported AEAD\n"); |
9955 | 0 | break; |
9956 | 0 | } |
9957 | | |
9958 | 0 | size_t aead_nonce_len = hpke_aead_nonce_len(aead_id); |
9959 | |
|
9960 | 0 | uint16_t version = GUINT16_FROM_BE(*(uint16_t *)ech_config->data); |
9961 | 0 | if (version != SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO) { |
9962 | 0 | ssl_debug_printf("Unexpected version in ECH Config\n"); |
9963 | 0 | break; |
9964 | 0 | } |
9965 | 0 | uint32_t ech_config_offset = 2; |
9966 | 0 | if (GUINT16_FROM_BE(*(uint16_t *)(ech_config->data + ech_config_offset)) != ech_config->data_len - 4) { |
9967 | 0 | ssl_debug_printf("Malformed ECH Config, invalid length\n"); |
9968 | 0 | break; |
9969 | 0 | } |
9970 | 0 | ech_config_offset += 2; |
9971 | 0 | if (*(ech_config->data + ech_config_offset) != config_id) { |
9972 | 0 | ssl_debug_printf("ECH Config version mismatch\n"); |
9973 | 0 | break; |
9974 | 0 | } |
9975 | 0 | ech_config_offset += 1; |
9976 | 0 | uint16_t kem_id_be = *(uint16_t *)(ech_config->data + ech_config_offset); |
9977 | 0 | uint16_t kem_id = GUINT16_FROM_BE(kem_id_be); |
9978 | 0 | uint8_t suite_id[HPKE_SUIT_ID_LEN]; |
9979 | 0 | hpke_suite_id(kem_id, kdf_id, aead_id, suite_id); |
9980 | 0 | GByteArray *info = g_byte_array_new(); |
9981 | 0 | g_byte_array_append(info, (const uint8_t*)"tls ech", 8); |
9982 | 0 | g_byte_array_append(info, ech_config->data, ech_config->data_len); |
9983 | 0 | uint8_t key[AEAD_MAX_KEY_LENGTH]; |
9984 | 0 | uint8_t base_nonce[HPKE_AEAD_NONCE_LENGTH]; |
9985 | 0 | if (hpke_key_schedule(kdf_id, aead_id, ech_secret->data, ech_secret->data_len, suite_id, info->data, info->len, HPKE_MODE_BASE, |
9986 | 0 | key, base_nonce)) { |
9987 | 0 | g_byte_array_free(info, TRUE); |
9988 | 0 | break; |
9989 | 0 | } |
9990 | 0 | g_byte_array_free(info, TRUE); |
9991 | 0 | gcry_cipher_hd_t cipher; |
9992 | 0 | if (hpke_setup_aead(&cipher, aead_id, key) || |
9993 | 0 | hpke_set_nonce(cipher, !session->hrr_ech_declined && pinfo->num > session->first_ch_ech_frame, base_nonce, aead_nonce_len)) { |
9994 | 0 | gcry_cipher_close(cipher); |
9995 | 0 | break; |
9996 | 0 | } |
9997 | 0 | const uint8_t *payload = tvb_get_ptr(tvb, offset - length, length); |
9998 | 0 | uint8_t *ech_aad = (uint8_t *)wmem_alloc(NULL, hello_length); |
9999 | 0 | tvb_memcpy(tvb, ech_aad, initial_offset, hello_length); |
10000 | 0 | memset(ech_aad + offset - length - initial_offset, 0, length); |
10001 | 0 | if (gcry_cipher_authenticate(cipher, ech_aad, hello_length)) { |
10002 | 0 | gcry_cipher_close(cipher); |
10003 | 0 | wmem_free(NULL, ech_aad); |
10004 | 0 | break; |
10005 | 0 | } |
10006 | 0 | wmem_free(NULL, ech_aad); |
10007 | 0 | uint8_t *ech_decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, length - 16); |
10008 | 0 | if (gcry_cipher_decrypt(cipher, ech_decrypted_data, length - 16, payload, length - 16)) { |
10009 | 0 | gcry_cipher_close(cipher); |
10010 | 0 | break; |
10011 | 0 | } |
10012 | 0 | unsigned char ech_auth_tag_calc[16]; |
10013 | 0 | if (gcry_cipher_gettag(cipher, ech_auth_tag_calc, 16)) { |
10014 | 0 | gcry_cipher_close(cipher); |
10015 | 0 | break; |
10016 | 0 | } |
10017 | 0 | if (ssl && !session->hrr_ech_declined && session->first_ch_ech_frame == pinfo->num) |
10018 | 0 | memcpy(session->first_ech_auth_tag, ech_auth_tag_calc, 16); |
10019 | 0 | gcry_cipher_close(cipher); |
10020 | 0 | if (memcmp(pinfo->num > session->first_ch_ech_frame ? ech_auth_tag_calc : session->first_ech_auth_tag, |
10021 | 0 | payload + length - 16, 16)) { |
10022 | 0 | ssl_debug_printf("%s ECH auth tag mismatch\n", G_STRFUNC); |
10023 | 0 | } else { |
10024 | 0 | payload_tree = proto_item_add_subtree(payload_ti, hf->ett.ech_decrypt); |
10025 | 0 | tvbuff_t *ech_tvb = tvb_new_child_real_data(tvb, ech_decrypted_data, length - 16, length - 16); |
10026 | 0 | add_new_data_source(pinfo, ech_tvb, "Client Hello Inner"); |
10027 | 0 | if (ssl) { |
10028 | 0 | tvb_memcpy(ech_tvb, ssl->client_random.data, 2, 32); |
10029 | 0 | uint32_t len_offset = ssl->ech_transcript.data_len; |
10030 | 0 | if (ssl->ech_transcript.data_len > 0) |
10031 | 0 | ssl->ech_transcript.data = (unsigned char*)wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data, |
10032 | 0 | ssl->ech_transcript.data_len + hello_length + 4); |
10033 | 0 | else |
10034 | 0 | ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), hello_length + 4); |
10035 | 0 | ssl->ech_transcript.data[ssl->ech_transcript.data_len] = SSL_HND_CLIENT_HELLO; |
10036 | 0 | ssl->ech_transcript.data[ssl->ech_transcript.data_len + 1] = 0; |
10037 | 0 | tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, 0, 34); |
10038 | 0 | ssl->ech_transcript.data_len += 38; |
10039 | 0 | tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset + 34, |
10040 | 0 | tvb_get_uint8(tvb, initial_offset + 34) + 1); |
10041 | 0 | ssl->ech_transcript.data_len += tvb_get_uint8(tvb, initial_offset + 34) + 1; |
10042 | 0 | uint32_t ech_offset = 35 + tvb_get_uint8(ech_tvb, 34); |
10043 | 0 | tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset, |
10044 | 0 | 2 + tvb_get_ntohs(ech_tvb, ech_offset)); |
10045 | 0 | ssl->ech_transcript.data_len += 2 + tvb_get_ntohs(ech_tvb, ech_offset); |
10046 | 0 | ech_offset += 2 + tvb_get_ntohs(ech_tvb, ech_offset); |
10047 | 0 | tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset, |
10048 | 0 | 1 + tvb_get_uint8(ech_tvb, ech_offset)); |
10049 | 0 | ssl->ech_transcript.data_len += 1 + tvb_get_uint8(ech_tvb, ech_offset); |
10050 | 0 | ech_offset += 1 + tvb_get_uint8(ech_tvb, ech_offset); |
10051 | 0 | uint32_t ech_extensions_len_offset = ssl->ech_transcript.data_len; |
10052 | 0 | ssl->ech_transcript.data_len += 2; |
10053 | 0 | uint16_t extensions_end = ech_offset + tvb_get_ntohs(ech_tvb, ech_offset) + 2; |
10054 | 0 | ech_offset += 2; |
10055 | 0 | while (extensions_end - ech_offset >= 4) { |
10056 | 0 | if (tvb_get_ntohs(ech_tvb, ech_offset) != SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS) { |
10057 | 0 | tvb_memcpy(ech_tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, ech_offset, |
10058 | 0 | 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2)); |
10059 | 0 | ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2); |
10060 | 0 | ech_offset += 4 + tvb_get_ntohs(ech_tvb, ech_offset + 2); |
10061 | 0 | } else if (tvb_get_ntohs(ech_tvb, ech_offset + 2) > 0) { |
10062 | 0 | uint8_t outer_extensions_end = tvb_get_uint8(ech_tvb, ech_offset + 4) + ech_offset + 5; |
10063 | 0 | ech_offset += 5; |
10064 | 0 | uint16_t outer_offset = initial_offset + 35 + tvb_get_uint8(tvb, initial_offset + 34); |
10065 | 0 | outer_offset += tvb_get_ntohs(tvb, outer_offset) + 2; |
10066 | 0 | outer_offset += tvb_get_uint8(tvb, outer_offset) + 3; |
10067 | 0 | while (outer_extensions_end - ech_offset >= 2) { |
10068 | 0 | while (hello_length - outer_offset >= 4) { |
10069 | 0 | if (tvb_get_ntohs(tvb, outer_offset) == tvb_get_ntohs(ech_tvb, ech_offset)) { |
10070 | 0 | tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, outer_offset, |
10071 | 0 | 4 + tvb_get_ntohs(tvb, outer_offset + 2)); |
10072 | 0 | ssl->ech_transcript.data_len += 4 + tvb_get_ntohs(tvb, outer_offset + 2); |
10073 | 0 | outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2); |
10074 | 0 | break; |
10075 | 0 | } else { |
10076 | 0 | outer_offset += 4 + tvb_get_ntohs(tvb, outer_offset + 2); |
10077 | 0 | } |
10078 | 0 | } |
10079 | 0 | ech_offset += 2; |
10080 | 0 | } |
10081 | 0 | } |
10082 | 0 | } |
10083 | 0 | uint16_t ech_extensions_len_be = GUINT16_TO_BE(ssl->ech_transcript.data_len - ech_extensions_len_offset - 2); |
10084 | 0 | *(ssl->ech_transcript.data + ech_extensions_len_offset) = ech_extensions_len_be & 0xff; |
10085 | 0 | *(ssl->ech_transcript.data + ech_extensions_len_offset + 1) = (ech_extensions_len_be >> 8); |
10086 | 0 | *(ssl->ech_transcript.data + len_offset + 2) = ((ssl->ech_transcript.data_len - len_offset - 4) >> 8); |
10087 | 0 | *(ssl->ech_transcript.data + len_offset + 3) = (ssl->ech_transcript.data_len - len_offset - 4) & 0xff; |
10088 | 0 | } |
10089 | 0 | uint32_t ech_padding_begin = (uint32_t)ssl_dissect_hnd_cli_hello(hf, ech_tvb, pinfo, payload_tree, 0, length - 16, session, |
10090 | 0 | ssl, NULL, mk_map); |
10091 | 0 | if (ech_padding_begin < length - 16) { |
10092 | 0 | proto_tree_add_item(payload_tree, hf->hf.ech_padding_data, ech_tvb, ech_padding_begin, length - 16 - ech_padding_begin, |
10093 | 0 | ENC_NA); |
10094 | 0 | } |
10095 | 0 | } |
10096 | |
|
10097 | 0 | break; |
10098 | 0 | case 1: /* inner */ |
10099 | 0 | break; |
10100 | 0 | } |
10101 | 0 | break; |
10102 | | |
10103 | 0 | case SSL_HND_ENCRYPTED_EXTENSIONS: |
10104 | | /* |
10105 | | * struct { |
10106 | | * ECHConfigList retry_configs; |
10107 | | * } ECHEncryptedExtensions; |
10108 | | */ |
10109 | |
|
10110 | 0 | ti = proto_tree_add_item(tree, hf->hf.ech_retry_configs, tvb, offset, offset_end - offset, ENC_NA); |
10111 | 0 | retry_tree = proto_item_add_subtree(ti, hf->ett.ech_retry_configs); |
10112 | 0 | offset = ssl_dissect_ext_ech_echconfiglist(hf, tvb, pinfo, retry_tree, offset, offset_end); |
10113 | 0 | break; |
10114 | | |
10115 | 0 | case SSL_HND_HELLO_RETRY_REQUEST: |
10116 | | /* |
10117 | | * struct { |
10118 | | * opaque confirmation[8]; |
10119 | | * } ECHHelloRetryRequest; |
10120 | | */ |
10121 | |
|
10122 | 0 | proto_tree_add_item(tree, hf->hf.ech_confirmation, tvb, offset, 8, ENC_NA); |
10123 | 0 | if (session->ech) { |
10124 | 0 | ti = proto_tree_add_bytes_with_length(tree, hf->hf.hs_ech_confirm_compute, tvb, offset, 0, session->hrr_ech_confirmation, 8); |
10125 | 0 | proto_item_set_generated(ti); |
10126 | 0 | if (memcmp(session->hrr_ech_confirmation, tvb_get_ptr(tvb, offset, 8), 8)) { |
10127 | 0 | expert_add_info(pinfo, ti, &hf->ei.ech_rejected); |
10128 | 0 | } else { |
10129 | 0 | expert_add_info(pinfo, ti, &hf->ei.ech_accepted); |
10130 | 0 | } |
10131 | 0 | } |
10132 | 0 | offset += 8; |
10133 | 0 | break; |
10134 | 0 | } |
10135 | | |
10136 | 0 | return offset; |
10137 | 0 | } |
10138 | | |
10139 | | static uint32_t |
10140 | | ssl_dissect_hnd_hello_ext_esni(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
10141 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
10142 | | uint8_t hnd_type, SslDecryptSession *ssl _U_) |
10143 | 0 | { |
10144 | 0 | uint32_t record_digest_length, encrypted_sni_length; |
10145 | |
|
10146 | 0 | switch (hnd_type) { |
10147 | 0 | case SSL_HND_CLIENT_HELLO: |
10148 | | /* |
10149 | | * struct { |
10150 | | * CipherSuite suite; |
10151 | | * KeyShareEntry key_share; |
10152 | | * opaque record_digest<0..2^16-1>; |
10153 | | * opaque encrypted_sni<0..2^16-1>; |
10154 | | * } ClientEncryptedSNI; |
10155 | | */ |
10156 | 0 | proto_tree_add_item(tree, hf->hf.esni_suite, tvb, offset, 2, ENC_BIG_ENDIAN); |
10157 | 0 | offset += 2; |
10158 | 0 | offset = ssl_dissect_hnd_hello_ext_key_share_entry(hf, tvb, pinfo, tree, offset, offset_end, NULL); |
10159 | | |
10160 | | /* opaque record_digest<0..2^16-1> */ |
10161 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &record_digest_length, |
10162 | 0 | hf->hf.esni_record_digest_length, 0, UINT16_MAX)) { |
10163 | 0 | return offset_end; |
10164 | 0 | } |
10165 | 0 | offset += 2; |
10166 | 0 | if (record_digest_length > 0) { |
10167 | 0 | proto_tree_add_item(tree, hf->hf.esni_record_digest, tvb, offset, record_digest_length, ENC_NA); |
10168 | 0 | offset += record_digest_length; |
10169 | 0 | } |
10170 | | |
10171 | | /* opaque encrypted_sni<0..2^16-1> */ |
10172 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &encrypted_sni_length, |
10173 | 0 | hf->hf.esni_encrypted_sni_length, 0, UINT16_MAX)) { |
10174 | 0 | return offset_end; |
10175 | 0 | } |
10176 | 0 | offset += 2; |
10177 | 0 | if (encrypted_sni_length > 0) { |
10178 | 0 | proto_tree_add_item(tree, hf->hf.esni_encrypted_sni, tvb, offset, encrypted_sni_length, ENC_NA); |
10179 | 0 | offset += encrypted_sni_length; |
10180 | 0 | } |
10181 | 0 | break; |
10182 | | |
10183 | 0 | case SSL_HND_ENCRYPTED_EXTENSIONS: |
10184 | 0 | proto_tree_add_item(tree, hf->hf.esni_nonce, tvb, offset, 16, ENC_NA); |
10185 | 0 | offset += 16; |
10186 | 0 | break; |
10187 | 0 | } |
10188 | | |
10189 | 0 | return offset; |
10190 | 0 | } |
10191 | | /** TLS Extensions (in Client Hello and Server Hello). }}} */ |
10192 | | |
10193 | | /* Connection ID dissection. {{{ */ |
10194 | | static uint32_t |
10195 | | ssl_dissect_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
10196 | | proto_tree *tree, uint32_t offset, SslDecryptSession *ssl, |
10197 | | uint8_t cidl, uint8_t **session_cid, uint8_t *session_cidl) |
10198 | 3 | { |
10199 | | /* keep track of the decrypt session only for the first pass */ |
10200 | 3 | if (cidl > 0 && !PINFO_FD_VISITED(pinfo)) { |
10201 | 1 | tvb_ensure_bytes_exist(tvb, offset + 1, cidl); |
10202 | 1 | *session_cidl = cidl; |
10203 | 1 | *session_cid = (uint8_t*)wmem_alloc0(wmem_file_scope(), cidl); |
10204 | 1 | tvb_memcpy(tvb, *session_cid, offset + 1, cidl); |
10205 | 1 | if (ssl) { |
10206 | 1 | ssl_add_session_by_cid(ssl); |
10207 | 1 | } |
10208 | 1 | } |
10209 | | |
10210 | 3 | proto_tree_add_item(tree, hf->hf.hs_ext_connection_id_length, |
10211 | 3 | tvb, offset, 1, ENC_NA); |
10212 | 3 | offset++; |
10213 | | |
10214 | 3 | if (cidl > 0) { |
10215 | 1 | proto_tree_add_item(tree, hf->hf.hs_ext_connection_id, |
10216 | 1 | tvb, offset, cidl, ENC_NA); |
10217 | 1 | offset += cidl; |
10218 | 1 | } |
10219 | | |
10220 | 3 | return offset; |
10221 | 3 | } |
10222 | | |
10223 | | static uint32_t |
10224 | | ssl_dissect_hnd_hello_ext_connection_id(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
10225 | | proto_tree *tree, uint32_t offset, uint8_t hnd_type, |
10226 | | SslSession *session, SslDecryptSession *ssl) |
10227 | 3 | { |
10228 | 3 | uint8_t cidl = tvb_get_uint8(tvb, offset); |
10229 | | |
10230 | 3 | switch (hnd_type) { |
10231 | 3 | case SSL_HND_CLIENT_HELLO: |
10232 | 3 | session->client_cid_len_present = true; |
10233 | 3 | return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl, |
10234 | 3 | cidl, &session->client_cid, &session->client_cid_len); |
10235 | 0 | case SSL_HND_SERVER_HELLO: |
10236 | 0 | session->server_cid_len_present = true; |
10237 | 0 | return ssl_dissect_ext_connection_id(hf, tvb, pinfo, tree, offset, ssl, |
10238 | 0 | cidl, &session->server_cid, &session->server_cid_len); |
10239 | 0 | default: |
10240 | 0 | return offset; |
10241 | 3 | } |
10242 | 3 | } /* }}} */ |
10243 | | |
10244 | | /* Trusted CA dissection. {{{ */ |
10245 | | static uint32_t |
10246 | | ssl_dissect_hnd_hello_ext_trusted_ca_keys(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
10247 | | uint32_t offset, uint32_t offset_end) |
10248 | 13 | { |
10249 | 13 | proto_item *ti; |
10250 | 13 | proto_tree *subtree; |
10251 | 13 | uint32_t keys_length, next_offset; |
10252 | | |
10253 | | /* |
10254 | | * struct { |
10255 | | * TrustedAuthority trusted_authorities_list<0..2^16-1>; |
10256 | | * } TrustedAuthorities; |
10257 | | * |
10258 | | * struct { |
10259 | | * IdentifierType identifier_type; |
10260 | | * select (identifier_type) { |
10261 | | * case pre_agreed: struct {}; |
10262 | | * case key_sha1_hash: SHA1Hash; |
10263 | | * case x509_name: DistinguishedName; |
10264 | | * case cert_sha1_hash: SHA1Hash; |
10265 | | * } identifier; |
10266 | | * } TrustedAuthority; |
10267 | | * |
10268 | | * enum { |
10269 | | * pre_agreed(0), key_sha1_hash(1), x509_name(2), |
10270 | | * cert_sha1_hash(3), (255) |
10271 | | * } IdentifierType; |
10272 | | * |
10273 | | * opaque DistinguishedName<1..2^16-1>; |
10274 | | * |
10275 | | */ |
10276 | | |
10277 | | |
10278 | | /* TrustedAuthority trusted_authorities_list<0..2^16-1> */ |
10279 | 13 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &keys_length, hf->hf.hs_ext_trusted_ca_keys_len, |
10280 | 13 | 0, UINT16_MAX)) |
10281 | 2 | { |
10282 | 2 | return offset_end; |
10283 | 2 | } |
10284 | 11 | offset += 2; |
10285 | 11 | next_offset = offset + keys_length; |
10286 | | |
10287 | 11 | if (keys_length > 0) |
10288 | 9 | { |
10289 | 9 | ti = proto_tree_add_none_format(tree, hf->hf.hs_ext_trusted_ca_keys_list, tvb, offset, keys_length, |
10290 | 9 | "Trusted CA keys (%d byte%s)", keys_length, plurality(keys_length, "", "s")); |
10291 | 9 | subtree = proto_item_add_subtree(ti, hf->ett.hs_ext_trusted_ca_keys); |
10292 | | |
10293 | 812 | while (offset < next_offset) |
10294 | 812 | { |
10295 | 812 | uint32_t identifier_type; |
10296 | 812 | proto_tree *trusted_key_tree; |
10297 | 812 | proto_item *trusted_key_item; |
10298 | 812 | asn1_ctx_t asn1_ctx; |
10299 | 812 | uint32_t key_len = 0; |
10300 | | |
10301 | 812 | identifier_type = tvb_get_uint8(tvb, offset); |
10302 | | |
10303 | | // Use 0 as length for now as we'll only know the size when we decode the identifier |
10304 | 812 | trusted_key_item = proto_tree_add_none_format(subtree, hf->hf.hs_ext_trusted_ca_key, tvb, |
10305 | 812 | offset, 0, "Trusted CA Key"); |
10306 | 812 | trusted_key_tree = proto_item_add_subtree(trusted_key_item, hf->ett.hs_ext_trusted_ca_key); |
10307 | | |
10308 | 812 | proto_tree_add_uint(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_type, tvb, |
10309 | 812 | offset, 1, identifier_type); |
10310 | 812 | offset++; |
10311 | | |
10312 | | /* |
10313 | | * enum { |
10314 | | * pre_agreed(0), key_sha1_hash(1), x509_name(2), |
10315 | | * cert_sha1_hash(3), (255) |
10316 | | * } IdentifierType; |
10317 | | */ |
10318 | 812 | switch (identifier_type) |
10319 | 812 | { |
10320 | 246 | case 0: |
10321 | 246 | key_len = 0; |
10322 | 246 | break; |
10323 | 12 | case 2: |
10324 | 12 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
10325 | | |
10326 | 12 | uint32_t name_length; |
10327 | | /* opaque DistinguishedName<1..2^16-1> */ |
10328 | 12 | if (!ssl_add_vector(hf, tvb, pinfo, trusted_key_tree, offset, next_offset, &name_length, |
10329 | 12 | hf->hf.hs_ext_trusted_ca_key_dname_len, 1, UINT16_MAX)) { |
10330 | 3 | return next_offset; |
10331 | 3 | } |
10332 | 9 | offset += 2; |
10333 | | |
10334 | 9 | dissect_x509if_DistinguishedName(false, tvb, offset, &asn1_ctx, |
10335 | 9 | trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_dname); |
10336 | 9 | offset += name_length; |
10337 | 9 | break; |
10338 | 24 | case 1: |
10339 | 38 | case 3: |
10340 | 38 | key_len = 20; |
10341 | | /* opaque SHA1Hash[20]; */ |
10342 | 38 | proto_tree_add_item(trusted_key_tree, hf->hf.hs_ext_trusted_ca_key_hash, tvb, |
10343 | 38 | offset, 20, ENC_NA); |
10344 | 38 | break; |
10345 | | |
10346 | 511 | default: |
10347 | 511 | key_len = 0; |
10348 | | /*TODO display expert info about unknown ? */ |
10349 | 511 | break; |
10350 | 812 | } |
10351 | 803 | proto_item_set_len(trusted_key_item, 1 + key_len); |
10352 | 803 | offset += key_len; |
10353 | 803 | } |
10354 | 9 | } |
10355 | | |
10356 | 2 | if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, next_offset)) |
10357 | 0 | { |
10358 | 0 | offset = next_offset; |
10359 | 0 | } |
10360 | | |
10361 | 2 | return offset; |
10362 | 11 | } /* }}} */ |
10363 | | |
10364 | | |
10365 | | /* Whether the Content and Handshake Types are valid; handle Protocol Version. {{{ */ |
10366 | | bool |
10367 | | ssl_is_valid_content_type(uint8_t type) |
10368 | 1.85k | { |
10369 | 1.85k | switch ((ContentType) type) { |
10370 | 19 | case SSL_ID_CHG_CIPHER_SPEC: |
10371 | 33 | case SSL_ID_ALERT: |
10372 | 447 | case SSL_ID_HANDSHAKE: |
10373 | 477 | case SSL_ID_APP_DATA: |
10374 | 489 | case SSL_ID_HEARTBEAT: |
10375 | 504 | case SSL_ID_TLS12_CID: |
10376 | 544 | case SSL_ID_DTLS13_ACK: |
10377 | 544 | return true; |
10378 | 1.85k | } |
10379 | 1.30k | return false; |
10380 | 1.85k | } |
10381 | | |
10382 | | bool |
10383 | | ssl_is_valid_handshake_type(uint8_t hs_type, bool is_dtls) |
10384 | 468 | { |
10385 | 468 | switch ((HandshakeType) hs_type) { |
10386 | 6 | case SSL_HND_HELLO_VERIFY_REQUEST: |
10387 | | /* hello_verify_request is DTLS-only */ |
10388 | 6 | return is_dtls; |
10389 | | |
10390 | 211 | case SSL_HND_HELLO_REQUEST: |
10391 | 250 | case SSL_HND_CLIENT_HELLO: |
10392 | 287 | case SSL_HND_SERVER_HELLO: |
10393 | 292 | case SSL_HND_NEWSESSION_TICKET: |
10394 | 293 | case SSL_HND_END_OF_EARLY_DATA: |
10395 | 306 | case SSL_HND_HELLO_RETRY_REQUEST: |
10396 | 308 | case SSL_HND_ENCRYPTED_EXTENSIONS: |
10397 | 310 | case SSL_HND_CERTIFICATE: |
10398 | 311 | case SSL_HND_SERVER_KEY_EXCHG: |
10399 | 315 | case SSL_HND_CERT_REQUEST: |
10400 | 316 | case SSL_HND_SVR_HELLO_DONE: |
10401 | 318 | case SSL_HND_CERT_VERIFY: |
10402 | 321 | case SSL_HND_CLIENT_KEY_EXCHG: |
10403 | 322 | case SSL_HND_FINISHED: |
10404 | 323 | case SSL_HND_CERT_URL: |
10405 | 428 | case SSL_HND_CERT_STATUS: |
10406 | 436 | case SSL_HND_SUPPLEMENTAL_DATA: |
10407 | 444 | case SSL_HND_KEY_UPDATE: |
10408 | 448 | case SSL_HND_COMPRESSED_CERTIFICATE: |
10409 | 448 | case SSL_HND_ENCRYPTED_EXTS: |
10410 | 448 | return true; |
10411 | 0 | case SSL_HND_MESSAGE_HASH: |
10412 | 0 | return false; |
10413 | 468 | } |
10414 | 14 | return false; |
10415 | 468 | } |
10416 | | |
10417 | | static bool |
10418 | | ssl_is_authoritative_version_message(uint8_t content_type, uint8_t handshake_type, |
10419 | | bool is_dtls) |
10420 | 251 | { |
10421 | | /* Consider all valid Handshake messages (except for Client Hello) and |
10422 | | * all other valid record types (other than Handshake) */ |
10423 | 251 | return (content_type == SSL_ID_HANDSHAKE && |
10424 | 209 | ssl_is_valid_handshake_type(handshake_type, is_dtls) && |
10425 | 197 | handshake_type != SSL_HND_CLIENT_HELLO) || |
10426 | 89 | (content_type != SSL_ID_HANDSHAKE && |
10427 | 42 | ssl_is_valid_content_type(content_type)); |
10428 | 251 | } |
10429 | | |
10430 | | /** |
10431 | | * Scan a Server Hello handshake message for the negotiated version. For TLS 1.3 |
10432 | | * draft 22 and newer, it also checks whether it is a HelloRetryRequest. |
10433 | | * Returns true if the supported_versions extension was found, false if not. |
10434 | | */ |
10435 | | bool |
10436 | | tls_scan_server_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end, |
10437 | | uint16_t *server_version, bool *is_hrr) |
10438 | 76 | { |
10439 | | /* SHA256("HelloRetryRequest") */ |
10440 | 76 | static const uint8_t tls13_hrr_random_magic[] = { |
10441 | 76 | 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91, |
10442 | 76 | 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c |
10443 | 76 | }; |
10444 | 76 | uint8_t session_id_length; |
10445 | | |
10446 | 76 | *server_version = tvb_get_ntohs(tvb, offset); |
10447 | | |
10448 | | /* |
10449 | | * Try to look for supported_versions extension. Minimum length: |
10450 | | * 2 + 32 + 1 = 35 (version, random, session id length) |
10451 | | * 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length) |
10452 | | * 2 + 2 + 2 = 6 (ext type, ext len, version) |
10453 | | * |
10454 | | * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3, |
10455 | | * there's a separate expert info warning for that. |
10456 | | */ |
10457 | 76 | if ((*server_version == TLSV1DOT2_VERSION || *server_version == DTLSV1DOT2_VERSION) && offset_end - offset >= 46) { |
10458 | 0 | offset += 2; |
10459 | 0 | if (is_hrr) { |
10460 | 0 | *is_hrr = tvb_memeql(tvb, offset, tls13_hrr_random_magic, sizeof(tls13_hrr_random_magic)) == 0; |
10461 | 0 | } |
10462 | 0 | offset += 32; |
10463 | 0 | session_id_length = tvb_get_uint8(tvb, offset); |
10464 | 0 | offset++; |
10465 | 0 | if (offset_end - offset < session_id_length + 5u) { |
10466 | 0 | return false; |
10467 | 0 | } |
10468 | 0 | offset += session_id_length + 5; |
10469 | |
|
10470 | 0 | while (offset_end - offset >= 6) { |
10471 | 0 | uint16_t ext_type = tvb_get_ntohs(tvb, offset); |
10472 | 0 | uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2); |
10473 | 0 | if (offset_end - offset < 4u + ext_len) { |
10474 | 0 | break; /* not enough data for type, length and data */ |
10475 | 0 | } |
10476 | 0 | if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS) { |
10477 | 0 | if (ext_len == 2) { |
10478 | 0 | *server_version = tvb_get_ntohs(tvb, offset + 4); |
10479 | 0 | } |
10480 | 0 | return true; |
10481 | 0 | } |
10482 | 0 | offset += 4 + ext_len; |
10483 | 0 | } |
10484 | 76 | } else { |
10485 | 76 | if (is_hrr) { |
10486 | 44 | *is_hrr = false; |
10487 | 44 | } |
10488 | 76 | } |
10489 | 76 | return false; |
10490 | 76 | } |
10491 | | |
10492 | | /** |
10493 | | * Scan a Client Hello handshake message to see if the supported_versions |
10494 | | * extension is found, in which case the version field is legacy_version. |
10495 | | */ |
10496 | | static bool |
10497 | | tls_scan_client_hello(tvbuff_t *tvb, uint32_t offset, uint32_t offset_end) |
10498 | 184 | { |
10499 | 184 | uint8_t session_id_length; |
10500 | | |
10501 | 184 | uint16_t client_version = tvb_get_ntohs(tvb, offset); |
10502 | | |
10503 | | /* |
10504 | | * Try to look for supported_versions extension. Minimum length: |
10505 | | * 2 + 32 + 1 = 35 (version, random, session id length) |
10506 | | * 2 + 2 + 1 + 2 = 5 (cipher suite, compression method, extensions length) |
10507 | | * 2 + 2 + 2 = 6 (ext type, ext len, version) |
10508 | | * |
10509 | | * We only check for the [legacy_]version field to be [D]TLS 1.2; if it's 1.3, |
10510 | | * there's a separate expert info warning for that. |
10511 | | */ |
10512 | 184 | if ((client_version == TLSV1DOT2_VERSION || client_version == DTLSV1DOT2_VERSION) && offset_end - offset >= 46) { |
10513 | 19 | offset += 2; |
10514 | 19 | offset += 32; |
10515 | 19 | session_id_length = tvb_get_uint8(tvb, offset); |
10516 | 19 | offset++; |
10517 | 19 | if (offset_end - offset < session_id_length + 2u) { |
10518 | 1 | return false; |
10519 | 1 | } |
10520 | 18 | offset += session_id_length; |
10521 | 18 | if (client_version == DTLSV1DOT2_VERSION) { |
10522 | 0 | uint8_t cookie_length = tvb_get_uint8(tvb, offset); |
10523 | 0 | offset++; |
10524 | 0 | if (offset_end - offset < cookie_length + 2u) { |
10525 | 0 | return false; |
10526 | 0 | } |
10527 | 0 | } |
10528 | 18 | uint16_t cipher_suites_length = tvb_get_ntohs(tvb, offset); |
10529 | 18 | offset += 2; |
10530 | 18 | if (offset_end - offset < cipher_suites_length + 1u) { |
10531 | 1 | return false; |
10532 | 1 | } |
10533 | 17 | offset += cipher_suites_length; |
10534 | 17 | uint8_t compression_methods_length = tvb_get_uint8(tvb, offset); |
10535 | 17 | offset++; |
10536 | 17 | if (offset_end - offset < compression_methods_length + 2u) { |
10537 | 1 | return false; |
10538 | 1 | } |
10539 | 16 | offset += compression_methods_length + 2; |
10540 | | |
10541 | 114 | while (offset_end - offset >= 6) { |
10542 | 108 | uint16_t ext_type = tvb_get_ntohs(tvb, offset); |
10543 | 108 | uint16_t ext_len = tvb_get_ntohs(tvb, offset + 2); |
10544 | 108 | if (offset_end - offset < 4u + ext_len) { |
10545 | 10 | break; /* not enough data for type, length and data */ |
10546 | 10 | } |
10547 | 98 | if (ext_type == SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS) { |
10548 | 0 | return true; |
10549 | 0 | } |
10550 | 98 | offset += 4 + ext_len; |
10551 | 98 | } |
10552 | 16 | } |
10553 | 181 | return false; |
10554 | 184 | } |
10555 | | void |
10556 | | ssl_try_set_version(SslSession *session, SslDecryptSession *ssl, |
10557 | | uint8_t content_type, uint8_t handshake_type, |
10558 | | bool is_dtls, uint16_t version) |
10559 | 251 | { |
10560 | 251 | uint8_t tls13_draft = 0; |
10561 | | |
10562 | 251 | if (!ssl_is_authoritative_version_message(content_type, handshake_type, |
10563 | 251 | is_dtls)) |
10564 | 47 | return; |
10565 | | |
10566 | 204 | version = tls_try_get_version(is_dtls, version, &tls13_draft); |
10567 | 204 | if (version == SSL_VER_UNKNOWN) { |
10568 | 172 | return; |
10569 | 172 | } |
10570 | | |
10571 | 32 | session->tls13_draft_version = tls13_draft; |
10572 | 32 | session->version = version; |
10573 | 32 | if (ssl) { |
10574 | 32 | ssl->state |= SSL_VERSION; |
10575 | 32 | ssl_debug_printf("%s found version 0x%04X -> state 0x%02X\n", G_STRFUNC, version, ssl->state); |
10576 | 32 | } |
10577 | 32 | } |
10578 | | |
10579 | | void |
10580 | | ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo, |
10581 | | ContentType content_type, |
10582 | | unsigned record_length, proto_item *length_pi, |
10583 | | uint16_t version, tvbuff_t *decrypted_tvb) |
10584 | 433 | { |
10585 | 433 | unsigned max_expansion; |
10586 | 433 | if (version == TLSV1DOT3_VERSION) { |
10587 | | /* TLS 1.3: Max length is 2^14 + 256 */ |
10588 | 0 | max_expansion = 256; |
10589 | 433 | } else { |
10590 | | /* RFC 5246, Section 6.2.3: TLSCiphertext.fragment length MUST NOT exceed 2^14 + 2048 */ |
10591 | 433 | max_expansion = 2048; |
10592 | 433 | } |
10593 | | /* |
10594 | | * RFC 5246 (TLS 1.2), Section 6.2.1 forbids zero-length Handshake, Alert |
10595 | | * and ChangeCipherSpec. |
10596 | | * RFC 6520 (Heartbeats) does not mention zero-length Heartbeat fragments, |
10597 | | * so assume it is permitted. |
10598 | | * RFC 6347 (DTLS 1.2) does not mention zero-length fragments either, so |
10599 | | * assume TLS 1.2 requirements. |
10600 | | */ |
10601 | 433 | if (record_length == 0 && |
10602 | 39 | (content_type == SSL_ID_CHG_CIPHER_SPEC || |
10603 | 36 | content_type == SSL_ID_ALERT || |
10604 | 32 | content_type == SSL_ID_HANDSHAKE)) { |
10605 | 31 | expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid, |
10606 | 31 | "Zero-length %s fragments are not allowed", |
10607 | 31 | val_to_str_const(content_type, ssl_31_content_type, "unknown")); |
10608 | 31 | } |
10609 | 433 | if (record_length > TLS_MAX_RECORD_LENGTH + max_expansion) { |
10610 | 103 | expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid, |
10611 | 103 | "TLSCiphertext length MUST NOT exceed 2^14 + %u", max_expansion); |
10612 | 103 | } |
10613 | 433 | if (decrypted_tvb && tvb_captured_length(decrypted_tvb) > TLS_MAX_RECORD_LENGTH) { |
10614 | 0 | expert_add_info_format(pinfo, length_pi, &hf->ei.record_length_invalid, |
10615 | 0 | "TLSPlaintext length MUST NOT exceed 2^14"); |
10616 | 0 | } |
10617 | 433 | } |
10618 | | |
10619 | | static void |
10620 | | ssl_set_cipher(SslDecryptSession *ssl, uint16_t cipher) |
10621 | 31 | { |
10622 | | /* store selected cipher suite for decryption */ |
10623 | 31 | ssl->session.cipher = cipher; |
10624 | | |
10625 | 31 | const SslCipherSuite *cs = ssl_find_cipher(cipher); |
10626 | 31 | if (!cs) { |
10627 | 25 | ssl->cipher_suite = NULL; |
10628 | 25 | ssl->state &= ~SSL_CIPHER; |
10629 | 25 | ssl_debug_printf("%s can't find cipher suite 0x%04X\n", G_STRFUNC, cipher); |
10630 | 25 | } else if (ssl->session.version == SSLV3_VERSION && !(cs->dig == DIG_MD5 || cs->dig == DIG_SHA)) { |
10631 | | /* A malicious packet capture contains a SSL 3.0 session using a TLS 1.2 |
10632 | | * cipher suite that uses for example MACAlgorithm SHA256. Reject that |
10633 | | * to avoid a potential buffer overflow in ssl3_check_mac. */ |
10634 | 0 | ssl->cipher_suite = NULL; |
10635 | 0 | ssl->state &= ~SSL_CIPHER; |
10636 | 0 | ssl_debug_printf("%s invalid SSL 3.0 cipher suite 0x%04X\n", G_STRFUNC, cipher); |
10637 | 6 | } else { |
10638 | | /* Cipher found, save this for the delayed decoder init */ |
10639 | 6 | ssl->cipher_suite = cs; |
10640 | 6 | ssl->state |= SSL_CIPHER; |
10641 | 6 | ssl_debug_printf("%s found CIPHER 0x%04X %s -> state 0x%02X\n", G_STRFUNC, cipher, |
10642 | 6 | val_to_str_ext_const(cipher, &ssl_31_ciphersuite_ext, "unknown"), |
10643 | 6 | ssl->state); |
10644 | 6 | } |
10645 | 31 | } |
10646 | | /* }}} */ |
10647 | | |
10648 | | |
10649 | | /* Client Hello and Server Hello dissections. {{{ */ |
10650 | | static int |
10651 | | ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, |
10652 | | packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, |
10653 | | SslSession *session, SslDecryptSession *ssl, |
10654 | | bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data, |
10655 | | ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length); |
10656 | | int |
10657 | | // NOLINTNEXTLINE(misc-no-recursion) |
10658 | | ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
10659 | | packet_info *pinfo, proto_tree *tree, uint32_t offset, |
10660 | | uint32_t offset_end, SslSession *session, |
10661 | | SslDecryptSession *ssl, dtls_hfs_t *dtls_hfs, ssl_master_key_map_t *mk_map) |
10662 | 185 | { |
10663 | | /* struct { |
10664 | | * ProtocolVersion client_version; |
10665 | | * Random random; |
10666 | | * SessionID session_id; |
10667 | | * opaque cookie<0..32>; //new field for DTLS |
10668 | | * CipherSuite cipher_suites<2..2^16-1>; |
10669 | | * CompressionMethod compression_methods<1..2^8-1>; |
10670 | | * Extension client_hello_extension_list<0..2^16-1>; |
10671 | | * } ClientHello; |
10672 | | */ |
10673 | 185 | proto_item *ti; |
10674 | 185 | proto_tree *cs_tree; |
10675 | 185 | uint32_t client_version; |
10676 | 185 | uint32_t cipher_suite_length; |
10677 | 185 | uint32_t compression_methods_length; |
10678 | 185 | uint8_t compression_method; |
10679 | 185 | uint32_t next_offset; |
10680 | 185 | uint32_t initial_offset = offset; |
10681 | 185 | uint32_t hello_length = offset_end - initial_offset; |
10682 | 185 | wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, ""); |
10683 | 185 | char *ja3_hash; |
10684 | 185 | char *ja3_dash = ""; |
10685 | 185 | char *ja4, *ja4_r, *ja4_hash, *ja4_b, *ja4_c; |
10686 | 185 | ja4_data_t ja4_data; |
10687 | 185 | wmem_strbuf_t *ja4_a = wmem_strbuf_new(pinfo->pool, ""); |
10688 | 185 | wmem_strbuf_t *ja4_br = wmem_strbuf_new(pinfo->pool, ""); |
10689 | 185 | wmem_strbuf_t *ja4_cr = wmem_strbuf_new(pinfo->pool, ""); |
10690 | 185 | wmem_list_frame_t *curr_entry; |
10691 | | |
10692 | 185 | ja4_data.max_version = 0; |
10693 | 185 | ja4_data.server_name_present = false; |
10694 | 185 | ja4_data.num_cipher_suites = 0; |
10695 | 185 | ja4_data.num_extensions = 0; |
10696 | 185 | ja4_data.alpn = wmem_strbuf_new(pinfo->pool, ""); |
10697 | 185 | ja4_data.cipher_list = wmem_list_new(pinfo->pool); |
10698 | 185 | ja4_data.extension_list = wmem_list_new(pinfo->pool); |
10699 | 185 | ja4_data.sighash_list = wmem_list_new(pinfo->pool); |
10700 | | |
10701 | | /* show the client version */ |
10702 | 185 | ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_client_version, tvb, |
10703 | 185 | offset, 2, ENC_BIG_ENDIAN, |
10704 | 185 | &client_version); |
10705 | 185 | if (tls_scan_client_hello(tvb, offset, offset_end)) { |
10706 | 0 | expert_add_info(pinfo, ti, &hf->ei.legacy_version); |
10707 | 0 | } |
10708 | 185 | offset += 2; |
10709 | 185 | wmem_strbuf_append_printf(ja3, "%i,", client_version); |
10710 | | |
10711 | | /* |
10712 | | * Is it version 1.3? |
10713 | | * If so, that's an error; TLS and DTLS 1.3 Client Hellos claim |
10714 | | * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446 |
10715 | | * section 4.1.2 "Client Hello" and RFC 9147 Section 5.3 "Client |
10716 | | * Hello". |
10717 | | */ |
10718 | 185 | if (dtls_hfs != NULL) { |
10719 | 175 | if (client_version == DTLSV1DOT3_VERSION) { |
10720 | | /* Don't do that. */ |
10721 | 0 | expert_add_info(pinfo, ti, &hf->ei.client_version_error); |
10722 | 0 | } |
10723 | 175 | } else { |
10724 | 10 | if (client_version == TLSV1DOT3_VERSION) { |
10725 | | /* Don't do that. */ |
10726 | 0 | expert_add_info(pinfo, ti, &hf->ei.client_version_error); |
10727 | 0 | } |
10728 | 10 | } |
10729 | | |
10730 | | /* dissect fields that are present in both ClientHello and ServerHello */ |
10731 | 185 | offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, false, false); |
10732 | | |
10733 | | /* fields specific for DTLS (cookie_len, cookie) */ |
10734 | 185 | if (dtls_hfs != NULL) { |
10735 | 172 | uint32_t cookie_length; |
10736 | | /* opaque cookie<0..32> (for DTLS only) */ |
10737 | 172 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cookie_length, |
10738 | 172 | dtls_hfs->hf_dtls_handshake_cookie_len, 0, 32)) { |
10739 | 3 | return offset; |
10740 | 3 | } |
10741 | 169 | offset++; |
10742 | 169 | if (cookie_length > 0) { |
10743 | 63 | proto_tree_add_item(tree, dtls_hfs->hf_dtls_handshake_cookie, |
10744 | 63 | tvb, offset, cookie_length, ENC_NA); |
10745 | 63 | offset += cookie_length; |
10746 | 63 | } |
10747 | 169 | } |
10748 | | |
10749 | | /* CipherSuite cipher_suites<2..2^16-1> */ |
10750 | 182 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cipher_suite_length, |
10751 | 182 | hf->hf.hs_cipher_suites_len, 2, UINT16_MAX)) { |
10752 | 4 | return offset; |
10753 | 4 | } |
10754 | 178 | offset += 2; |
10755 | 178 | next_offset = offset + cipher_suite_length; |
10756 | 178 | ti = proto_tree_add_none_format(tree, |
10757 | 178 | hf->hf.hs_cipher_suites, |
10758 | 178 | tvb, offset, cipher_suite_length, |
10759 | 178 | "Cipher Suites (%d suite%s)", |
10760 | 178 | cipher_suite_length / 2, |
10761 | 178 | plurality(cipher_suite_length/2, "", "s")); |
10762 | 178 | cs_tree = proto_item_add_subtree(ti, hf->ett.cipher_suites); |
10763 | 7.22k | while (offset + 2 <= next_offset) { |
10764 | 7.04k | uint32_t cipher_suite; |
10765 | | |
10766 | 7.04k | proto_tree_add_item_ret_uint(cs_tree, hf->hf.hs_cipher_suite, tvb, offset, 2, |
10767 | 7.04k | ENC_BIG_ENDIAN, &cipher_suite); |
10768 | 7.04k | offset += 2; |
10769 | 7.04k | if (!IS_GREASE_TLS(cipher_suite)) { |
10770 | 6.88k | wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, cipher_suite); |
10771 | 6.88k | ja3_dash = "-"; |
10772 | 6.88k | ja4_data.num_cipher_suites += 1; |
10773 | 6.88k | wmem_list_insert_sorted(ja4_data.cipher_list, GUINT_TO_POINTER(cipher_suite), wmem_compare_uint); |
10774 | 6.88k | } |
10775 | 7.04k | } |
10776 | 178 | wmem_strbuf_append_c(ja3, ','); |
10777 | 178 | if (!ssl_end_vector(hf, tvb, pinfo, cs_tree, offset, next_offset)) { |
10778 | 40 | offset = next_offset; |
10779 | 40 | } |
10780 | | |
10781 | | /* CompressionMethod compression_methods<1..2^8-1> */ |
10782 | 178 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compression_methods_length, |
10783 | 178 | hf->hf.hs_comp_methods_len, 1, UINT8_MAX)) { |
10784 | 2 | return offset; |
10785 | 2 | } |
10786 | 176 | offset++; |
10787 | 176 | next_offset = offset + compression_methods_length; |
10788 | 176 | ti = proto_tree_add_none_format(tree, |
10789 | 176 | hf->hf.hs_comp_methods, |
10790 | 176 | tvb, offset, compression_methods_length, |
10791 | 176 | "Compression Methods (%u method%s)", |
10792 | 176 | compression_methods_length, |
10793 | 176 | plurality(compression_methods_length, |
10794 | 176 | "", "s")); |
10795 | 176 | cs_tree = proto_item_add_subtree(ti, hf->ett.comp_methods); |
10796 | 6.10k | while (offset < next_offset) { |
10797 | 5.93k | compression_method = tvb_get_uint8(tvb, offset); |
10798 | | /* TODO: make reserved/private comp meth. fields selectable */ |
10799 | 5.93k | if (compression_method < 64) |
10800 | 2.95k | proto_tree_add_uint(cs_tree, hf->hf.hs_comp_method, |
10801 | 2.95k | tvb, offset, 1, compression_method); |
10802 | 2.97k | else if (compression_method > 63 && compression_method < 193) |
10803 | 1.28k | proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1, |
10804 | 1.28k | compression_method, "Reserved - to be assigned by IANA (%u)", |
10805 | 1.28k | compression_method); |
10806 | 1.69k | else |
10807 | 1.69k | proto_tree_add_uint_format_value(cs_tree, hf->hf.hs_comp_method, tvb, offset, 1, |
10808 | 1.69k | compression_method, "Private use range (%u)", |
10809 | 1.69k | compression_method); |
10810 | 5.93k | offset++; |
10811 | 5.93k | } |
10812 | | |
10813 | | /* SSL v3.0 has no extensions, so length field can indeed be missing. */ |
10814 | 176 | if (offset < offset_end) { |
10815 | 121 | offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset, |
10816 | 121 | offset_end, SSL_HND_CLIENT_HELLO, |
10817 | 121 | session, ssl, dtls_hfs != NULL, ja3, &ja4_data, mk_map, initial_offset, hello_length); |
10818 | 121 | if (ja4_data.max_version > 0) { |
10819 | 0 | client_version = ja4_data.max_version; |
10820 | 0 | } |
10821 | 121 | } else { |
10822 | 55 | wmem_strbuf_append_printf(ja3, ",,"); |
10823 | 55 | } |
10824 | | |
10825 | 176 | if (proto_is_frame_protocol(pinfo->layers,"tcp")) { |
10826 | 1 | wmem_strbuf_append(ja4_a, "t"); |
10827 | 175 | } else if (proto_is_frame_protocol(pinfo->layers,"quic")) { |
10828 | 0 | wmem_strbuf_append(ja4_a, "q"); |
10829 | 175 | } else if (proto_is_frame_protocol(pinfo->layers,"dtls")) { |
10830 | 58 | wmem_strbuf_append(ja4_a, "d"); |
10831 | 58 | } |
10832 | 176 | wmem_strbuf_append_printf(ja4_a, "%s", val_to_str_const(client_version, ssl_version_ja4_names, "00")); |
10833 | 176 | wmem_strbuf_append_printf(ja4_a, "%s", ja4_data.server_name_present ? "d" : "i"); |
10834 | 176 | if (ja4_data.num_cipher_suites > 99) { |
10835 | 6 | wmem_strbuf_append(ja4_a, "99"); |
10836 | 170 | } else { |
10837 | 170 | wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_cipher_suites); |
10838 | 170 | } |
10839 | 176 | if (ja4_data.num_extensions > 99) { |
10840 | 1 | wmem_strbuf_append(ja4_a, "99"); |
10841 | 175 | } else { |
10842 | 175 | wmem_strbuf_append_printf(ja4_a, "%02d", ja4_data.num_extensions); |
10843 | 175 | } |
10844 | 176 | if (wmem_strbuf_get_len(ja4_data.alpn) > 0 ) { |
10845 | 0 | wmem_strbuf_append_printf(ja4_a, "%s", wmem_strbuf_get_str(ja4_data.alpn)); |
10846 | 176 | } else { |
10847 | 176 | wmem_strbuf_append(ja4_a, "00"); |
10848 | 176 | } |
10849 | | |
10850 | 176 | curr_entry = wmem_list_head(ja4_data.cipher_list); |
10851 | 1.28k | for (unsigned i = 0; i < wmem_list_count(ja4_data.cipher_list); i++) { |
10852 | 1.10k | wmem_strbuf_append_printf(ja4_br, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))); |
10853 | 1.10k | if (i < wmem_list_count(ja4_data.cipher_list) - 1) { |
10854 | 1.07k | wmem_strbuf_append(ja4_br, ","); |
10855 | 1.07k | } |
10856 | 1.10k | curr_entry = wmem_list_frame_next(curr_entry); |
10857 | 1.10k | } |
10858 | | |
10859 | 176 | curr_entry = wmem_list_head(ja4_data.extension_list); |
10860 | 248 | for (unsigned i = 0; i < wmem_list_count(ja4_data.extension_list); i++) { |
10861 | 72 | wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))); |
10862 | 72 | if (i < wmem_list_count(ja4_data.extension_list) - 1) { |
10863 | 41 | wmem_strbuf_append(ja4_cr, ","); |
10864 | 41 | } |
10865 | 72 | curr_entry = wmem_list_frame_next(curr_entry); |
10866 | 72 | } |
10867 | | |
10868 | 176 | if (wmem_list_count(ja4_data.sighash_list) > 0) { |
10869 | 0 | wmem_strbuf_append(ja4_cr, "_"); |
10870 | 0 | curr_entry = wmem_list_head(ja4_data.sighash_list); |
10871 | 0 | for (unsigned i = 0; i < wmem_list_count(ja4_data.sighash_list); i++) { |
10872 | 0 | wmem_strbuf_append_printf(ja4_cr, "%04x", GPOINTER_TO_UINT(wmem_list_frame_data(curr_entry))); |
10873 | 0 | if (i < wmem_list_count(ja4_data.sighash_list) - 1) { |
10874 | 0 | wmem_strbuf_append(ja4_cr, ","); |
10875 | 0 | } |
10876 | 0 | curr_entry = wmem_list_frame_next(curr_entry); |
10877 | 0 | } |
10878 | 0 | } |
10879 | 176 | if ( wmem_strbuf_get_len(ja4_br) == 0 ) { |
10880 | 27 | ja4_hash = g_strdup("000000000000"); |
10881 | 149 | } else { |
10882 | 149 | ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_br),-1); |
10883 | 149 | } |
10884 | 176 | ja4_b = wmem_strndup(pinfo->pool, ja4_hash, 12); |
10885 | | |
10886 | 176 | g_free(ja4_hash); |
10887 | 176 | if ( wmem_strbuf_get_len(ja4_cr) == 0 ) { |
10888 | 28 | ja4_hash = g_strdup("000000000000"); |
10889 | 148 | } else { |
10890 | 148 | ja4_hash = g_compute_checksum_for_string(G_CHECKSUM_SHA256, wmem_strbuf_get_str(ja4_cr),-1); |
10891 | 148 | } |
10892 | 176 | ja4_c = wmem_strndup(pinfo->pool, ja4_hash, 12); |
10893 | 176 | g_free(ja4_hash); |
10894 | | |
10895 | 176 | ja4 = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), ja4_b, ja4_c); |
10896 | 176 | ja4_r = wmem_strdup_printf(pinfo->pool, "%s_%s_%s", wmem_strbuf_get_str(ja4_a), wmem_strbuf_get_str(ja4_br), wmem_strbuf_get_str(ja4_cr)); |
10897 | | |
10898 | 176 | ti = proto_tree_add_string(tree, hf->hf.hs_ja4, tvb, offset, 0, ja4); |
10899 | 176 | proto_item_set_generated(ti); |
10900 | 176 | ti = proto_tree_add_string(tree, hf->hf.hs_ja4_r, tvb, offset, 0, ja4_r); |
10901 | 176 | proto_item_set_generated(ti); |
10902 | | |
10903 | 176 | ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3), |
10904 | 176 | wmem_strbuf_get_len(ja3)); |
10905 | 176 | ti = proto_tree_add_string(tree, hf->hf.hs_ja3_full, tvb, offset, 0, wmem_strbuf_get_str(ja3)); |
10906 | 176 | proto_item_set_generated(ti); |
10907 | 176 | ti = proto_tree_add_string(tree, hf->hf.hs_ja3_hash, tvb, offset, 0, ja3_hash); |
10908 | 176 | proto_item_set_generated(ti); |
10909 | 176 | g_free(ja3_hash); |
10910 | 176 | return offset; |
10911 | 178 | } |
10912 | | |
10913 | | void |
10914 | | ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
10915 | | packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end, |
10916 | | SslSession *session, SslDecryptSession *ssl, |
10917 | | bool is_dtls, bool is_hrr) |
10918 | 31 | { |
10919 | | /* struct { |
10920 | | * ProtocolVersion server_version; |
10921 | | * Random random; |
10922 | | * SessionID session_id; // TLS 1.2 and before |
10923 | | * CipherSuite cipher_suite; |
10924 | | * CompressionMethod compression_method; // TLS 1.2 and before |
10925 | | * Extension server_hello_extension_list<0..2^16-1>; |
10926 | | * } ServerHello; |
10927 | | */ |
10928 | 31 | uint8_t draft_version = session->tls13_draft_version; |
10929 | 31 | proto_item *ti; |
10930 | 31 | uint32_t server_version; |
10931 | 31 | uint32_t cipher_suite; |
10932 | 31 | uint32_t initial_offset = offset; |
10933 | 31 | wmem_strbuf_t *ja3 = wmem_strbuf_new(pinfo->pool, ""); |
10934 | 31 | char *ja3_hash; |
10935 | | |
10936 | 31 | col_set_str(pinfo->cinfo, COL_PROTOCOL, |
10937 | 31 | val_to_str_const(session->version, ssl_version_short_names, "SSL")); |
10938 | | |
10939 | | /* Initially assume that the session is resumed. If this is not the case, a |
10940 | | * ServerHelloDone will be observed before the ChangeCipherSpec message |
10941 | | * which will reset this flag. */ |
10942 | 31 | session->is_session_resumed = true; |
10943 | | |
10944 | | /* show the server version */ |
10945 | 31 | ti = proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb, |
10946 | 31 | offset, 2, ENC_BIG_ENDIAN, &server_version); |
10947 | | |
10948 | 31 | uint16_t supported_server_version; |
10949 | 31 | if (tls_scan_server_hello(tvb, offset, offset_end, &supported_server_version, NULL)) { |
10950 | 0 | expert_add_info(pinfo, ti, &hf->ei.legacy_version); |
10951 | 0 | } |
10952 | | /* |
10953 | | * Is it version 1.3? |
10954 | | * If so, that's an error; TLS and DTLS 1.3 Server Hellos claim |
10955 | | * to be TLS 1.2, and mention 1.3 in an extension. See RFC 8446 |
10956 | | * section 4.1.3 "Server Hello" and RFC 9147 Section 5.4 "Server |
10957 | | * Hello". |
10958 | | */ |
10959 | 31 | if (is_dtls) { |
10960 | 31 | if (server_version == DTLSV1DOT3_VERSION) { |
10961 | | /* Don't do that. */ |
10962 | 0 | expert_add_info(pinfo, ti, &hf->ei.server_version_error); |
10963 | 0 | } |
10964 | 31 | } else { |
10965 | 0 | if (server_version == TLSV1DOT3_VERSION) { |
10966 | | /* Don't do that. */ |
10967 | 0 | expert_add_info(pinfo, ti, &hf->ei.server_version_error); |
10968 | 0 | } |
10969 | 0 | } |
10970 | | |
10971 | 31 | offset += 2; |
10972 | 31 | wmem_strbuf_append_printf(ja3, "%i", server_version); |
10973 | | |
10974 | | /* dissect fields that are present in both ClientHello and ServerHello */ |
10975 | 31 | offset = ssl_dissect_hnd_hello_common(hf, tvb, pinfo, tree, offset, session, ssl, true, is_hrr); |
10976 | | |
10977 | 31 | if (ssl) { |
10978 | | /* store selected cipher suite for decryption */ |
10979 | 31 | ssl_set_cipher(ssl, tvb_get_ntohs(tvb, offset)); |
10980 | 31 | } |
10981 | | |
10982 | | /* now the server-selected cipher suite */ |
10983 | 31 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_cipher_suite, |
10984 | 31 | tvb, offset, 2, ENC_BIG_ENDIAN, &cipher_suite); |
10985 | 31 | offset += 2; |
10986 | 31 | wmem_strbuf_append_printf(ja3, ",%i,", cipher_suite); |
10987 | | |
10988 | | /* No compression with TLS 1.3 before draft -22 */ |
10989 | 31 | if (!(session->version == TLSV1DOT3_VERSION && draft_version > 0 && draft_version < 22)) { |
10990 | 31 | if (ssl) { |
10991 | | /* store selected compression method for decryption */ |
10992 | 31 | ssl->session.compression = tvb_get_uint8(tvb, offset); |
10993 | 31 | } |
10994 | | /* and the server-selected compression method */ |
10995 | 31 | proto_tree_add_item(tree, hf->hf.hs_comp_method, |
10996 | 31 | tvb, offset, 1, ENC_BIG_ENDIAN); |
10997 | 31 | offset++; |
10998 | 31 | } |
10999 | | |
11000 | | /* SSL v3.0 has no extensions, so length field can indeed be missing. */ |
11001 | 31 | if (offset < offset_end) { |
11002 | 31 | offset = ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset, |
11003 | 31 | offset_end, |
11004 | 31 | is_hrr ? SSL_HND_HELLO_RETRY_REQUEST : SSL_HND_SERVER_HELLO, |
11005 | 31 | session, ssl, is_dtls, ja3, NULL, NULL, 0, 0); |
11006 | 31 | } |
11007 | | |
11008 | 31 | if (ssl && ssl->ech_transcript.data_len > 0 && (ssl->state & SSL_CIPHER) && ssl->client_random.data_len > 0) { |
11009 | 0 | int hash_algo = ssl_get_digest_by_name(ssl_cipher_suite_dig(ssl->cipher_suite)->name); |
11010 | 0 | if (hash_algo) { |
11011 | 0 | SSL_MD mc; |
11012 | 0 | unsigned char transcript_hash[DIGEST_MAX_SIZE]; |
11013 | 0 | unsigned char prk[DIGEST_MAX_SIZE]; |
11014 | 0 | unsigned char *ech_verify_out = NULL; |
11015 | 0 | unsigned int len; |
11016 | 0 | ssl_md_init(&mc, hash_algo); |
11017 | 0 | ssl_md_update(&mc, ssl->ech_transcript.data, ssl->ech_transcript.data_len); |
11018 | 0 | if (is_hrr) { |
11019 | 0 | ssl_md_final(&mc, transcript_hash, &len); |
11020 | 0 | ssl_md_cleanup(&mc); |
11021 | 0 | wmem_free(wmem_file_scope(), ssl->ech_transcript.data); |
11022 | 0 | ssl->ech_transcript.data_len = 4 + len; |
11023 | 0 | ssl->ech_transcript.data = (unsigned char*)wmem_alloc(wmem_file_scope(), 4 + len + 4 + offset_end - initial_offset); |
11024 | 0 | ssl->ech_transcript.data[0] = SSL_HND_MESSAGE_HASH; |
11025 | 0 | ssl->ech_transcript.data[1] = 0; |
11026 | 0 | ssl->ech_transcript.data[2] = 0; |
11027 | 0 | ssl->ech_transcript.data[3] = len; |
11028 | 0 | memcpy(ssl->ech_transcript.data + 4, transcript_hash, len); |
11029 | 0 | ssl_md_init(&mc, hash_algo); |
11030 | 0 | ssl_md_update(&mc, ssl->ech_transcript.data, 4 + len); |
11031 | 0 | } else { |
11032 | 0 | ssl->ech_transcript.data = wmem_realloc(wmem_file_scope(), ssl->ech_transcript.data, |
11033 | 0 | ssl->ech_transcript.data_len + 4 + offset_end - initial_offset); |
11034 | 0 | } |
11035 | 0 | if (initial_offset > 4) { |
11036 | 0 | tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len, initial_offset - 4, |
11037 | 0 | 4 + offset_end - initial_offset); |
11038 | 0 | if (is_hrr) |
11039 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 38), 38); |
11040 | 0 | else |
11041 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset-4, 30), 30); |
11042 | 0 | } else { |
11043 | 0 | uint8_t prefix[4] = {SSL_HND_SERVER_HELLO, 0x00, 0x00, 0x00}; |
11044 | 0 | prefix[2] = ((offset - initial_offset) >> 8); |
11045 | 0 | prefix[3] = (offset - initial_offset) & 0xff; |
11046 | 0 | memcpy(ssl->ech_transcript.data + ssl->ech_transcript.data_len, prefix, 4); |
11047 | 0 | tvb_memcpy(tvb, ssl->ech_transcript.data + ssl->ech_transcript.data_len + 4, initial_offset, |
11048 | 0 | offset_end - initial_offset); |
11049 | 0 | ssl_md_update(&mc, prefix, 4); |
11050 | 0 | if (is_hrr) |
11051 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 34), 34); |
11052 | 0 | else |
11053 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset, 26), 26); |
11054 | 0 | } |
11055 | 0 | ssl->ech_transcript.data_len += 4 + offset_end - initial_offset; |
11056 | 0 | uint8_t zeros[8] = { 0 }; |
11057 | 0 | uint32_t confirmation_offset = initial_offset + 26; |
11058 | 0 | if (is_hrr) { |
11059 | 0 | uint32_t hrr_offset = initial_offset + 34; |
11060 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, |
11061 | 0 | tvb_get_uint8(tvb, hrr_offset) + 1), tvb_get_uint8(tvb, hrr_offset) + 1); |
11062 | 0 | hrr_offset += tvb_get_uint8(tvb, hrr_offset) + 1; |
11063 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 3), 3); |
11064 | 0 | hrr_offset += 3; |
11065 | 0 | uint16_t extensions_end = hrr_offset + tvb_get_ntohs(tvb, hrr_offset) + 2; |
11066 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 2), 2); |
11067 | 0 | hrr_offset += 2; |
11068 | 0 | while (extensions_end - hrr_offset >= 4) { |
11069 | 0 | if (tvb_get_ntohs(tvb, hrr_offset) == SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO && |
11070 | 0 | tvb_get_ntohs(tvb, hrr_offset + 2) == 8) { |
11071 | 0 | confirmation_offset = hrr_offset + 4; |
11072 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, 4), 4); |
11073 | 0 | ssl_md_update(&mc, zeros, 8); |
11074 | 0 | hrr_offset += 12; |
11075 | 0 | } else { |
11076 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, hrr_offset, tvb_get_ntohs(tvb, hrr_offset + 2) + 4), |
11077 | 0 | tvb_get_ntohs(tvb, hrr_offset + 2) + 4); |
11078 | 0 | hrr_offset += tvb_get_ntohs(tvb, hrr_offset + 2) + 4; |
11079 | 0 | } |
11080 | 0 | } |
11081 | 0 | } else { |
11082 | 0 | ssl_md_update(&mc, zeros, 8); |
11083 | 0 | ssl_md_update(&mc, tvb_get_ptr(tvb, initial_offset + 34, offset - initial_offset - 34), |
11084 | 0 | offset - initial_offset - 34); |
11085 | 0 | } |
11086 | 0 | ssl_md_final(&mc, transcript_hash, &len); |
11087 | 0 | ssl_md_cleanup(&mc); |
11088 | 0 | hkdf_extract(hash_algo, NULL, 0, ssl->client_random.data, 32, prk); |
11089 | 0 | StringInfo prk_string = {prk, len}; |
11090 | 0 | if (tls13_hkdf_expand_label_context(hash_algo, &prk_string, tls13_hkdf_label_prefix(ssl), |
11091 | 0 | is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation", |
11092 | 0 | transcript_hash, len, 8, &ech_verify_out)) { |
11093 | 0 | memcpy(is_hrr ? ssl->session.hrr_ech_confirmation : ssl->session.ech_confirmation, ech_verify_out, 8); |
11094 | 0 | if (tvb_memeql(tvb, confirmation_offset, ech_verify_out, 8) == -1) { |
11095 | 0 | if (is_hrr) { |
11096 | 0 | ssl->session.hrr_ech_declined = true; |
11097 | 0 | ssl->session.first_ch_ech_frame = 0; |
11098 | 0 | } |
11099 | 0 | memcpy(ssl->client_random.data, ssl->session.client_random.data, ssl->session.client_random.data_len); |
11100 | 0 | ssl_print_data("Updated Client Random", ssl->client_random.data, 32); |
11101 | 0 | } |
11102 | 0 | wmem_free(NULL, ech_verify_out); |
11103 | 0 | } |
11104 | 0 | ssl->session.ech = true; |
11105 | 0 | } |
11106 | 0 | } |
11107 | | |
11108 | 31 | ja3_hash = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(ja3), |
11109 | 31 | wmem_strbuf_get_len(ja3)); |
11110 | 31 | ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_full, tvb, offset, 0, wmem_strbuf_get_str(ja3)); |
11111 | 31 | proto_item_set_generated(ti); |
11112 | 31 | ti = proto_tree_add_string(tree, hf->hf.hs_ja3s_hash, tvb, offset, 0, ja3_hash); |
11113 | 31 | proto_item_set_generated(ti); |
11114 | 31 | g_free(ja3_hash); |
11115 | 31 | } |
11116 | | /* Client Hello and Server Hello dissections. }}} */ |
11117 | | |
11118 | | /* New Session Ticket dissection. {{{ */ |
11119 | | void |
11120 | | ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
11121 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
11122 | | SslSession *session, SslDecryptSession *ssl, |
11123 | | bool is_dtls, GHashTable *session_hash) |
11124 | 2 | { |
11125 | | /* https://tools.ietf.org/html/rfc5077#section-3.3 (TLS >= 1.0): |
11126 | | * struct { |
11127 | | * uint32 ticket_lifetime_hint; |
11128 | | * opaque ticket<0..2^16-1>; |
11129 | | * } NewSessionTicket; |
11130 | | * |
11131 | | * RFC 8446 Section 4.6.1 (TLS 1.3): |
11132 | | * struct { |
11133 | | * uint32 ticket_lifetime; |
11134 | | * uint32 ticket_age_add; |
11135 | | * opaque ticket_nonce<0..255>; // new in draft -21, updated in -22 |
11136 | | * opaque ticket<1..2^16-1>; |
11137 | | * Extension extensions<0..2^16-2>; |
11138 | | * } NewSessionTicket; |
11139 | | */ |
11140 | 2 | proto_tree *subtree; |
11141 | 2 | proto_item *subitem; |
11142 | 2 | uint32_t ticket_len; |
11143 | 2 | bool is_tls13 = session->version == TLSV1DOT3_VERSION || session->version == DTLSV1DOT3_VERSION; |
11144 | 2 | unsigned char draft_version = session->tls13_draft_version; |
11145 | 2 | uint32_t lifetime_hint; |
11146 | | |
11147 | 2 | subtree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
11148 | 2 | hf->ett.session_ticket, NULL, |
11149 | 2 | "TLS Session Ticket"); |
11150 | | |
11151 | | /* ticket lifetime hint */ |
11152 | 2 | subitem = proto_tree_add_item_ret_uint(subtree, hf->hf.hs_session_ticket_lifetime_hint, |
11153 | 2 | tvb, offset, 4, ENC_BIG_ENDIAN, &lifetime_hint); |
11154 | 2 | offset += 4; |
11155 | | |
11156 | 2 | if (lifetime_hint >= 60) { |
11157 | 1 | char *time_str = unsigned_time_secs_to_str(pinfo->pool, lifetime_hint); |
11158 | 1 | proto_item_append_text(subitem, " (%s)", time_str); |
11159 | 1 | } |
11160 | | |
11161 | 2 | if (is_tls13) { |
11162 | | |
11163 | | /* for TLS 1.3: ticket_age_add */ |
11164 | 0 | proto_tree_add_item(subtree, hf->hf.hs_session_ticket_age_add, |
11165 | 0 | tvb, offset, 4, ENC_BIG_ENDIAN); |
11166 | 0 | offset += 4; |
11167 | | |
11168 | | /* for TLS 1.3: ticket_nonce (coming with Draft 21)*/ |
11169 | 0 | if (draft_version == 0 || draft_version >= 21) { |
11170 | 0 | uint32_t ticket_nonce_len; |
11171 | |
|
11172 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_nonce_len, |
11173 | 0 | hf->hf.hs_session_ticket_nonce_len, 0, 255)) { |
11174 | 0 | return; |
11175 | 0 | } |
11176 | 0 | offset++; |
11177 | |
|
11178 | 0 | proto_tree_add_item(subtree, hf->hf.hs_session_ticket_nonce, tvb, offset, ticket_nonce_len, ENC_NA); |
11179 | 0 | offset += ticket_nonce_len; |
11180 | 0 | } |
11181 | |
|
11182 | 0 | } |
11183 | | |
11184 | | /* opaque ticket<0..2^16-1> (with TLS 1.3 the minimum is 1) */ |
11185 | 2 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, offset_end, &ticket_len, |
11186 | 2 | hf->hf.hs_session_ticket_len, is_tls13 ? 1 : 0, UINT16_MAX)) { |
11187 | 2 | return; |
11188 | 2 | } |
11189 | 0 | offset += 2; |
11190 | | |
11191 | | /* Content depends on implementation, so just show data! */ |
11192 | 0 | proto_tree_add_item(subtree, hf->hf.hs_session_ticket, |
11193 | 0 | tvb, offset, ticket_len, ENC_NA); |
11194 | | /* save the session ticket to cache for ssl_finalize_decryption */ |
11195 | 0 | if (ssl && !is_tls13) { |
11196 | 0 | if (ssl->session.is_session_resumed) { |
11197 | | /* NewSessionTicket is received in ServerHello before ChangeCipherSpec |
11198 | | * (Abbreviated Handshake Using New Session Ticket). |
11199 | | * Restore the master key for this session ticket before saving |
11200 | | * it to the new session ticket. */ |
11201 | 0 | ssl_restore_master_key(ssl, "Session Ticket", false, |
11202 | 0 | session_hash, &ssl->session_ticket); |
11203 | 0 | } |
11204 | 0 | tvb_ensure_bytes_exist(tvb, offset, ticket_len); |
11205 | 0 | ssl->session_ticket.data = (unsigned char*)wmem_realloc(wmem_file_scope(), |
11206 | 0 | ssl->session_ticket.data, ticket_len); |
11207 | 0 | ssl->session_ticket.data_len = ticket_len; |
11208 | 0 | tvb_memcpy(tvb, ssl->session_ticket.data, offset, ticket_len); |
11209 | | /* NewSessionTicket is received after the first (client) |
11210 | | * ChangeCipherSpec, and before the second (server) ChangeCipherSpec. |
11211 | | * Since the second CCS has already the session key available it will |
11212 | | * just return. To ensure that the session ticket is mapped to a |
11213 | | * master key (from the first CCS), save the ticket here too. */ |
11214 | 0 | ssl_save_master_key("Session Ticket", session_hash, |
11215 | 0 | &ssl->session_ticket, &ssl->master_secret); |
11216 | 0 | ssl->state |= SSL_NEW_SESSION_TICKET; |
11217 | 0 | } |
11218 | 0 | offset += ticket_len; |
11219 | |
|
11220 | 0 | if (is_tls13) { |
11221 | 0 | ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset, |
11222 | 0 | offset_end, SSL_HND_NEWSESSION_TICKET, |
11223 | 0 | session, ssl, is_dtls, NULL, NULL, NULL, 0, 0); |
11224 | 0 | } |
11225 | 0 | } /* }}} */ |
11226 | | |
11227 | | void |
11228 | | ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
11229 | | packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end, |
11230 | | SslSession *session, SslDecryptSession *ssl, |
11231 | | bool is_dtls) |
11232 | 1 | { |
11233 | | /* https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.1.4 |
11234 | | * struct { |
11235 | | * ProtocolVersion server_version; |
11236 | | * CipherSuite cipher_suite; // not before draft -19 |
11237 | | * Extension extensions<2..2^16-1>; |
11238 | | * } HelloRetryRequest; |
11239 | | * Note: no longer used since draft -22 |
11240 | | */ |
11241 | 1 | uint32_t version; |
11242 | 1 | uint8_t draft_version; |
11243 | | |
11244 | 1 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_server_version, tvb, |
11245 | 1 | offset, 2, ENC_BIG_ENDIAN, &version); |
11246 | 1 | draft_version = extract_tls13_draft_version(version); |
11247 | 1 | offset += 2; |
11248 | | |
11249 | 1 | if (draft_version == 0 || draft_version >= 19) { |
11250 | 1 | proto_tree_add_item(tree, hf->hf.hs_cipher_suite, |
11251 | 1 | tvb, offset, 2, ENC_BIG_ENDIAN); |
11252 | 1 | offset += 2; |
11253 | 1 | } |
11254 | | |
11255 | 1 | ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset, |
11256 | 1 | offset_end, SSL_HND_HELLO_RETRY_REQUEST, |
11257 | 1 | session, ssl, is_dtls, NULL, NULL, NULL, 0, 0); |
11258 | 1 | } |
11259 | | |
11260 | | void |
11261 | | ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
11262 | | packet_info* pinfo, proto_tree *tree, uint32_t offset, uint32_t offset_end, |
11263 | | SslSession *session, SslDecryptSession *ssl, |
11264 | | bool is_dtls) |
11265 | 3 | { |
11266 | | /* RFC 8446 Section 4.3.1 |
11267 | | * struct { |
11268 | | * Extension extensions<0..2^16-1>; |
11269 | | * } EncryptedExtensions; |
11270 | | */ |
11271 | 3 | ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset, |
11272 | 3 | offset_end, SSL_HND_ENCRYPTED_EXTENSIONS, |
11273 | 3 | session, ssl, is_dtls, NULL, NULL, NULL, 0, 0); |
11274 | 3 | } |
11275 | | |
11276 | | /* Certificate and Certificate Request dissections. {{{ */ |
11277 | | void |
11278 | | ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, |
11279 | | uint32_t offset, uint32_t offset_end, packet_info *pinfo, |
11280 | | SslSession *session, SslDecryptSession *ssl _U_, |
11281 | | bool is_from_server, bool is_dtls) |
11282 | 0 | { |
11283 | | /* opaque ASN.1Cert<1..2^24-1>; |
11284 | | * |
11285 | | * Before RFC 8446 (TLS <= 1.2): |
11286 | | * struct { |
11287 | | * select(certificate_type) { |
11288 | | * |
11289 | | * // certificate type defined in RFC 7250 |
11290 | | * case RawPublicKey: |
11291 | | * opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>; |
11292 | | * |
11293 | | * // X.509 certificate defined in RFC 5246 |
11294 | | * case X.509: |
11295 | | * ASN.1Cert certificate_list<0..2^24-1>; |
11296 | | * }; |
11297 | | * } Certificate; |
11298 | | * |
11299 | | * RFC 8446 (since draft -20): |
11300 | | * struct { |
11301 | | * select(certificate_type){ |
11302 | | * case RawPublicKey: |
11303 | | * // From RFC 7250 ASN.1_subjectPublicKeyInfo |
11304 | | * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; |
11305 | | * |
11306 | | * case X.509: |
11307 | | * opaque cert_data<1..2^24-1>; |
11308 | | * } |
11309 | | * Extension extensions<0..2^16-1>; |
11310 | | * } CertificateEntry; |
11311 | | * struct { |
11312 | | * opaque certificate_request_context<0..2^8-1>; |
11313 | | * CertificateEntry certificate_list<0..2^24-1>; |
11314 | | * } Certificate; |
11315 | | */ |
11316 | 0 | enum { CERT_X509, CERT_RPK } cert_type; |
11317 | 0 | asn1_ctx_t asn1_ctx; |
11318 | | #if defined(HAVE_LIBGNUTLS) |
11319 | | gnutls_datum_t subjectPublicKeyInfo = { NULL, 0 }; |
11320 | | unsigned certificate_index = 0; |
11321 | | #endif |
11322 | 0 | uint32_t next_offset, certificate_list_length, cert_length; |
11323 | 0 | proto_tree *subtree = tree; |
11324 | |
|
11325 | 0 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
11326 | |
|
11327 | 0 | if ((is_from_server && session->server_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY) || |
11328 | 0 | (!is_from_server && session->client_cert_type == SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY)) { |
11329 | 0 | cert_type = CERT_RPK; |
11330 | 0 | } else { |
11331 | 0 | cert_type = CERT_X509; |
11332 | 0 | } |
11333 | |
|
11334 | | #if defined(HAVE_LIBGNUTLS) |
11335 | | /* Ask the pkcs1 dissector to return the public key details */ |
11336 | | if (ssl) |
11337 | | asn1_ctx.private_data = &subjectPublicKeyInfo; |
11338 | | #endif |
11339 | | |
11340 | | /* TLS 1.3: opaque certificate_request_context<0..2^8-1> */ |
11341 | 0 | if (session->version == TLSV1DOT3_VERSION || session->version == DTLSV1DOT3_VERSION) { |
11342 | 0 | uint32_t context_length; |
11343 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length, |
11344 | 0 | hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX)) { |
11345 | 0 | return; |
11346 | 0 | } |
11347 | 0 | offset++; |
11348 | 0 | if (context_length > 0) { |
11349 | 0 | proto_tree_add_item(tree, hf->hf.hs_certificate_request_context, |
11350 | 0 | tvb, offset, context_length, ENC_NA); |
11351 | 0 | offset += context_length; |
11352 | 0 | } |
11353 | 0 | } |
11354 | | |
11355 | 0 | if ((session->version != TLSV1DOT3_VERSION && session->version != DTLSV1DOT3_VERSION) && cert_type == CERT_RPK) { |
11356 | | /* For RPK before TLS 1.3, the single RPK is stored directly without |
11357 | | * another "certificate_list" field. */ |
11358 | 0 | certificate_list_length = offset_end - offset; |
11359 | 0 | next_offset = offset_end; |
11360 | 0 | } else { |
11361 | | /* CertificateEntry certificate_list<0..2^24-1> */ |
11362 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &certificate_list_length, |
11363 | 0 | hf->hf.hs_certificates_len, 0, G_MAXUINT24)) { |
11364 | 0 | return; |
11365 | 0 | } |
11366 | 0 | offset += 3; /* 24-bit length value */ |
11367 | 0 | next_offset = offset + certificate_list_length; |
11368 | 0 | } |
11369 | | |
11370 | | /* RawPublicKey must have one cert, but X.509 can have multiple. */ |
11371 | 0 | if (certificate_list_length > 0 && cert_type == CERT_X509) { |
11372 | 0 | proto_item *ti; |
11373 | |
|
11374 | 0 | ti = proto_tree_add_none_format(tree, |
11375 | 0 | hf->hf.hs_certificates, |
11376 | 0 | tvb, offset, certificate_list_length, |
11377 | 0 | "Certificates (%u bytes)", |
11378 | 0 | certificate_list_length); |
11379 | | |
11380 | | /* make it a subtree */ |
11381 | 0 | subtree = proto_item_add_subtree(ti, hf->ett.certificates); |
11382 | 0 | } |
11383 | |
|
11384 | 0 | while (offset < next_offset) { |
11385 | 0 | switch (cert_type) { |
11386 | 0 | case CERT_RPK: |
11387 | | /* TODO add expert info if there is more than one RPK entry (certificate_index > 0) */ |
11388 | | /* opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> */ |
11389 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length, |
11390 | 0 | hf->hf.hs_certificate_len, 1, G_MAXUINT24)) { |
11391 | 0 | return; |
11392 | 0 | } |
11393 | 0 | offset += 3; |
11394 | |
|
11395 | 0 | dissect_x509af_SubjectPublicKeyInfo(false, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate); |
11396 | 0 | offset += cert_length; |
11397 | 0 | break; |
11398 | 0 | case CERT_X509: |
11399 | | /* opaque ASN1Cert<1..2^24-1> */ |
11400 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, subtree, offset, next_offset, &cert_length, |
11401 | 0 | hf->hf.hs_certificate_len, 1, G_MAXUINT24)) { |
11402 | 0 | return; |
11403 | 0 | } |
11404 | 0 | offset += 3; |
11405 | |
|
11406 | 0 | dissect_x509af_Certificate(false, tvb, offset, &asn1_ctx, subtree, hf->hf.hs_certificate); |
11407 | | #if defined(HAVE_LIBGNUTLS) |
11408 | | if (is_from_server && ssl && certificate_index == 0) { |
11409 | | ssl_find_private_key_by_pubkey(ssl, &subjectPublicKeyInfo); |
11410 | | /* Only attempt to get the RSA modulus for the first cert. */ |
11411 | | asn1_ctx.private_data = NULL; |
11412 | | } |
11413 | | #endif |
11414 | 0 | offset += cert_length; |
11415 | 0 | break; |
11416 | 0 | } |
11417 | | |
11418 | | /* TLS 1.3: Extension extensions<0..2^16-1> */ |
11419 | 0 | if ((session->version == TLSV1DOT3_VERSION || session->version == DTLSV1DOT3_VERSION)) { |
11420 | 0 | offset = ssl_dissect_hnd_extension(hf, tvb, subtree, pinfo, offset, |
11421 | 0 | next_offset, SSL_HND_CERTIFICATE, |
11422 | 0 | session, ssl, is_dtls, NULL, NULL, NULL, 0, 0); |
11423 | 0 | } |
11424 | |
|
11425 | | #if defined(HAVE_LIBGNUTLS) |
11426 | | certificate_index++; |
11427 | | #endif |
11428 | 0 | } |
11429 | 0 | } |
11430 | | |
11431 | | void |
11432 | | ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
11433 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
11434 | | SslSession *session, bool is_dtls) |
11435 | 2 | { |
11436 | | /* From SSL 3.0 and up (note that since TLS 1.1 certificate_authorities can be empty): |
11437 | | * enum { |
11438 | | * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4), |
11439 | | * (255) |
11440 | | * } ClientCertificateType; |
11441 | | * |
11442 | | * opaque DistinguishedName<1..2^16-1>; |
11443 | | * |
11444 | | * struct { |
11445 | | * ClientCertificateType certificate_types<1..2^8-1>; |
11446 | | * DistinguishedName certificate_authorities<3..2^16-1>; |
11447 | | * } CertificateRequest; |
11448 | | * |
11449 | | * |
11450 | | * As per TLSv1.2 (RFC 5246) the format has changed to: |
11451 | | * |
11452 | | * enum { |
11453 | | * rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4), |
11454 | | * rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6), |
11455 | | * fortezza_dms_RESERVED(20), (255) |
11456 | | * } ClientCertificateType; |
11457 | | * |
11458 | | * enum { |
11459 | | * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5), |
11460 | | * sha512(6), (255) |
11461 | | * } HashAlgorithm; |
11462 | | * |
11463 | | * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) } |
11464 | | * SignatureAlgorithm; |
11465 | | * |
11466 | | * struct { |
11467 | | * HashAlgorithm hash; |
11468 | | * SignatureAlgorithm signature; |
11469 | | * } SignatureAndHashAlgorithm; |
11470 | | * |
11471 | | * SignatureAndHashAlgorithm |
11472 | | * supported_signature_algorithms<2..2^16-2>; |
11473 | | * |
11474 | | * opaque DistinguishedName<1..2^16-1>; |
11475 | | * |
11476 | | * struct { |
11477 | | * ClientCertificateType certificate_types<1..2^8-1>; |
11478 | | * SignatureAndHashAlgorithm supported_signature_algorithms<2^16-1>; |
11479 | | * DistinguishedName certificate_authorities<0..2^16-1>; |
11480 | | * } CertificateRequest; |
11481 | | * |
11482 | | * draft-ietf-tls-tls13-18: |
11483 | | * struct { |
11484 | | * opaque certificate_request_context<0..2^8-1>; |
11485 | | * SignatureScheme |
11486 | | * supported_signature_algorithms<2..2^16-2>; |
11487 | | * DistinguishedName certificate_authorities<0..2^16-1>; |
11488 | | * CertificateExtension certificate_extensions<0..2^16-1>; |
11489 | | * } CertificateRequest; |
11490 | | * |
11491 | | * RFC 8446 (since draft-ietf-tls-tls13-19): |
11492 | | * |
11493 | | * struct { |
11494 | | * opaque certificate_request_context<0..2^8-1>; |
11495 | | * Extension extensions<2..2^16-1>; |
11496 | | * } CertificateRequest; |
11497 | | */ |
11498 | 2 | proto_item *ti; |
11499 | 2 | proto_tree *subtree; |
11500 | 2 | uint32_t next_offset; |
11501 | 2 | asn1_ctx_t asn1_ctx; |
11502 | 2 | bool is_tls13 = (session->version == TLSV1DOT3_VERSION || session->version == DTLSV1DOT3_VERSION); |
11503 | 2 | unsigned char draft_version = session->tls13_draft_version; |
11504 | | |
11505 | 2 | if (!tree) |
11506 | 0 | return; |
11507 | | |
11508 | 2 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
11509 | | |
11510 | 2 | if (is_tls13) { |
11511 | 0 | uint32_t context_length; |
11512 | | /* opaque certificate_request_context<0..2^8-1> */ |
11513 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &context_length, |
11514 | 0 | hf->hf.hs_certificate_request_context_length, 0, UINT8_MAX)) { |
11515 | 0 | return; |
11516 | 0 | } |
11517 | 0 | offset++; |
11518 | 0 | if (context_length > 0) { |
11519 | 0 | proto_tree_add_item(tree, hf->hf.hs_certificate_request_context, |
11520 | 0 | tvb, offset, context_length, ENC_NA); |
11521 | 0 | offset += context_length; |
11522 | 0 | } |
11523 | 2 | } else { |
11524 | 2 | uint32_t cert_types_count; |
11525 | | /* ClientCertificateType certificate_types<1..2^8-1> */ |
11526 | 2 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &cert_types_count, |
11527 | 2 | hf->hf.hs_cert_types_count, 1, UINT8_MAX)) { |
11528 | 2 | return; |
11529 | 2 | } |
11530 | 0 | offset++; |
11531 | 0 | next_offset = offset + cert_types_count; |
11532 | |
|
11533 | 0 | ti = proto_tree_add_none_format(tree, |
11534 | 0 | hf->hf.hs_cert_types, |
11535 | 0 | tvb, offset, cert_types_count, |
11536 | 0 | "Certificate types (%u type%s)", |
11537 | 0 | cert_types_count, |
11538 | 0 | plurality(cert_types_count, "", "s")); |
11539 | 0 | subtree = proto_item_add_subtree(ti, hf->ett.cert_types); |
11540 | |
|
11541 | 0 | while (offset < next_offset) { |
11542 | 0 | proto_tree_add_item(subtree, hf->hf.hs_cert_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
11543 | 0 | offset++; |
11544 | 0 | } |
11545 | 0 | } |
11546 | | |
11547 | 0 | if (session->version == TLSV1DOT2_VERSION || session->version == DTLSV1DOT2_VERSION || |
11548 | 0 | (is_tls13 && (draft_version > 0 && draft_version < 19))) { |
11549 | 0 | offset = ssl_dissect_hash_alg_list(hf, tvb, tree, pinfo, offset, offset_end, NULL); |
11550 | 0 | } |
11551 | |
|
11552 | 0 | if (is_tls13 && (draft_version == 0 || draft_version >= 19)) { |
11553 | | /* |
11554 | | * TLS 1.3 draft 19 and newer: Extensions. |
11555 | | * SslDecryptSession pointer is NULL because Certificate Extensions |
11556 | | * should not influence decryption state. |
11557 | | */ |
11558 | 0 | ssl_dissect_hnd_extension(hf, tvb, tree, pinfo, offset, |
11559 | 0 | offset_end, SSL_HND_CERT_REQUEST, |
11560 | 0 | session, NULL, is_dtls, NULL, NULL, NULL, 0, 0); |
11561 | 0 | } else if (is_tls13 && draft_version <= 18) { |
11562 | | /* |
11563 | | * TLS 1.3 draft 18 and older: certificate_authorities and |
11564 | | * certificate_extensions (a vector of OID mappings). |
11565 | | */ |
11566 | 0 | offset = tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end); |
11567 | 0 | ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, tree, offset, offset_end); |
11568 | 0 | } else { |
11569 | | /* for TLS 1.2 and older, the certificate_authorities field. */ |
11570 | 0 | tls_dissect_certificate_authorities(hf, tvb, pinfo, tree, offset, offset_end); |
11571 | 0 | } |
11572 | 0 | } |
11573 | | /* Certificate and Certificate Request dissections. }}} */ |
11574 | | |
11575 | | void |
11576 | | ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
11577 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version) |
11578 | 0 | { |
11579 | 0 | ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version, |
11580 | 0 | hf->hf.hs_client_cert_vrfy_sig_len, |
11581 | 0 | hf->hf.hs_client_cert_vrfy_sig); |
11582 | 0 | } |
11583 | | |
11584 | | /* Finished dissection. {{{ */ |
11585 | | void |
11586 | | ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
11587 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
11588 | | const SslSession *session, ssl_hfs_t *ssl_hfs) |
11589 | 0 | { |
11590 | | /* For SSLv3: |
11591 | | * struct { |
11592 | | * opaque md5_hash[16]; |
11593 | | * opaque sha_hash[20]; |
11594 | | * } Finished; |
11595 | | * |
11596 | | * For (D)TLS: |
11597 | | * struct { |
11598 | | * opaque verify_data[12]; |
11599 | | * } Finished; |
11600 | | * |
11601 | | * For TLS 1.3: |
11602 | | * struct { |
11603 | | * opaque verify_data[Hash.length]; |
11604 | | * } |
11605 | | */ |
11606 | 0 | if (!tree) |
11607 | 0 | return; |
11608 | | |
11609 | 0 | if (session->version == SSLV3_VERSION) { |
11610 | 0 | if (ssl_hfs != NULL) { |
11611 | 0 | proto_tree_add_item(tree, ssl_hfs->hs_md5_hash, |
11612 | 0 | tvb, offset, 16, ENC_NA); |
11613 | 0 | proto_tree_add_item(tree, ssl_hfs->hs_sha_hash, |
11614 | 0 | tvb, offset + 16, 20, ENC_NA); |
11615 | 0 | } |
11616 | 0 | } else { |
11617 | | /* Length should be 12 for TLS before 1.3, assume this is the case. */ |
11618 | 0 | proto_tree_add_item(tree, hf->hf.hs_finished, |
11619 | 0 | tvb, offset, offset_end - offset, ENC_NA); |
11620 | 0 | } |
11621 | 0 | } /* }}} */ |
11622 | | |
11623 | | /* RFC 6066 Certificate URL handshake message dissection. {{{ */ |
11624 | | void |
11625 | | ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset) |
11626 | 0 | { |
11627 | 0 | uint16_t url_hash_len; |
11628 | | |
11629 | | /* enum { |
11630 | | * individual_certs(0), pkipath(1), (255) |
11631 | | * } CertChainType; |
11632 | | * |
11633 | | * struct { |
11634 | | * CertChainType type; |
11635 | | * URLAndHash url_and_hash_list<1..2^16-1>; |
11636 | | * } CertificateURL; |
11637 | | * |
11638 | | * struct { |
11639 | | * opaque url<1..2^16-1>; |
11640 | | * uint8 padding; |
11641 | | * opaque SHA1Hash[20]; |
11642 | | * } URLAndHash; |
11643 | | */ |
11644 | |
|
11645 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_type, |
11646 | 0 | tvb, offset, 1, ENC_NA); |
11647 | 0 | offset++; |
11648 | |
|
11649 | 0 | url_hash_len = tvb_get_ntohs(tvb, offset); |
11650 | 0 | proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_url_hash_list_len, |
11651 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
11652 | 0 | offset += 2; |
11653 | 0 | while (url_hash_len-- > 0) { |
11654 | 0 | proto_item *urlhash_item; |
11655 | 0 | proto_tree *urlhash_tree; |
11656 | 0 | uint16_t url_len; |
11657 | |
|
11658 | 0 | urlhash_item = proto_tree_add_item(tree, hf->hf.hs_ext_cert_url_item, |
11659 | 0 | tvb, offset, -1, ENC_NA); |
11660 | 0 | urlhash_tree = proto_item_add_subtree(urlhash_item, hf->ett.urlhash); |
11661 | |
|
11662 | 0 | url_len = tvb_get_ntohs(tvb, offset); |
11663 | 0 | proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url_len, |
11664 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
11665 | 0 | offset += 2; |
11666 | |
|
11667 | 0 | proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_url, |
11668 | 0 | tvb, offset, url_len, ENC_ASCII|ENC_NA); |
11669 | 0 | offset += url_len; |
11670 | |
|
11671 | 0 | proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_padding, |
11672 | 0 | tvb, offset, 1, ENC_NA); |
11673 | 0 | offset++; |
11674 | | /* Note: RFC 6066 says that padding must be 0x01 */ |
11675 | |
|
11676 | 0 | proto_tree_add_item(urlhash_tree, hf->hf.hs_ext_cert_url_sha1, |
11677 | 0 | tvb, offset, 20, ENC_NA); |
11678 | 0 | offset += 20; |
11679 | 0 | } |
11680 | 0 | } /* }}} */ |
11681 | | |
11682 | | void |
11683 | | ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, |
11684 | | uint32_t offset, uint32_t offset_end, packet_info *pinfo, |
11685 | | SslSession *session, SslDecryptSession *ssl, |
11686 | | bool is_from_server, bool is_dtls) |
11687 | 0 | { |
11688 | 0 | uint32_t algorithm, uncompressed_length; |
11689 | 0 | uint32_t compressed_certificate_message_length; |
11690 | 0 | tvbuff_t *uncompressed_tvb = NULL; |
11691 | 0 | proto_item *ti; |
11692 | | /* |
11693 | | * enum { |
11694 | | * zlib(1), |
11695 | | * brotli(2), |
11696 | | * zstd(3), |
11697 | | * (65535) |
11698 | | * } CertificateCompressionAlgorithm; |
11699 | | * |
11700 | | * struct { |
11701 | | * CertificateCompressionAlgorithm algorithm; |
11702 | | * uint24 uncompressed_length; |
11703 | | * opaque compressed_certificate_message<1..2^24-1>; |
11704 | | * } CompressedCertificate; |
11705 | | */ |
11706 | |
|
11707 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_algorithm, |
11708 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN, &algorithm); |
11709 | 0 | offset += 2; |
11710 | |
|
11711 | 0 | proto_tree_add_item_ret_uint(tree, hf->hf.hs_ext_compress_certificate_uncompressed_length, |
11712 | 0 | tvb, offset, 3, ENC_BIG_ENDIAN, &uncompressed_length); |
11713 | 0 | offset += 3; |
11714 | | |
11715 | | /* opaque compressed_certificate_message<1..2^24-1>; */ |
11716 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &compressed_certificate_message_length, |
11717 | 0 | hf->hf.hs_ext_compress_certificate_compressed_certificate_message_length, 1, G_MAXUINT24)) { |
11718 | 0 | return; |
11719 | 0 | } |
11720 | 0 | offset += 3; |
11721 | |
|
11722 | 0 | ti = proto_tree_add_item(tree, hf->hf.hs_ext_compress_certificate_compressed_certificate_message, |
11723 | 0 | tvb, offset, compressed_certificate_message_length, ENC_NA); |
11724 | | |
11725 | | /* Certificate decompression following algorithm */ |
11726 | 0 | switch (algorithm) { |
11727 | 0 | case 1: /* zlib */ |
11728 | 0 | uncompressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, compressed_certificate_message_length); |
11729 | 0 | break; |
11730 | 0 | case 2: /* brotli */ |
11731 | 0 | uncompressed_tvb = tvb_child_uncompress_brotli(tvb, tvb, offset, compressed_certificate_message_length); |
11732 | 0 | break; |
11733 | 0 | case 3: /* zstd */ |
11734 | 0 | uncompressed_tvb = tvb_child_uncompress_zstd(tvb, tvb, offset, compressed_certificate_message_length); |
11735 | 0 | break; |
11736 | 0 | } |
11737 | | |
11738 | 0 | if (uncompressed_tvb) { |
11739 | 0 | proto_tree *uncompressed_tree; |
11740 | |
|
11741 | 0 | if (uncompressed_length != tvb_captured_length(uncompressed_tvb)) { |
11742 | 0 | proto_tree_add_expert_format(tree, pinfo, &hf->ei.decompression_error, |
11743 | 0 | tvb, offset, offset_end - offset, |
11744 | 0 | "Invalid uncompressed length %u (expected %u)", |
11745 | 0 | tvb_captured_length(uncompressed_tvb), |
11746 | 0 | uncompressed_length); |
11747 | 0 | } else { |
11748 | 0 | uncompressed_tree = proto_item_add_subtree(ti, hf->ett.uncompressed_certificates); |
11749 | 0 | ssl_dissect_hnd_cert(hf, uncompressed_tvb, uncompressed_tree, |
11750 | 0 | 0, uncompressed_length, pinfo, session, ssl, is_from_server, is_dtls); |
11751 | 0 | add_new_data_source(pinfo, uncompressed_tvb, "Uncompressed certificate(s)"); |
11752 | 0 | } |
11753 | 0 | } |
11754 | 0 | } |
11755 | | |
11756 | | /* Dissection of TLS Extensions in Client Hello, Server Hello, etc. {{{ */ |
11757 | | static int |
11758 | | // NOLINTNEXTLINE(misc-no-recursion) |
11759 | | ssl_dissect_hnd_extension(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, |
11760 | | packet_info* pinfo, uint32_t offset, uint32_t offset_end, uint8_t hnd_type, |
11761 | | SslSession *session, SslDecryptSession *ssl, |
11762 | | bool is_dtls, wmem_strbuf_t *ja3, ja4_data_t *ja4_data, |
11763 | | ssl_master_key_map_t *mk_map, uint32_t initial_offset, uint32_t hello_length) |
11764 | 156 | { |
11765 | 156 | uint32_t exts_len; |
11766 | 156 | uint16_t ext_type; |
11767 | 156 | uint32_t ext_len; |
11768 | 156 | uint32_t next_offset; |
11769 | 156 | proto_item *ext_item; |
11770 | 156 | proto_tree *ext_tree; |
11771 | 156 | bool is_tls13 = session->version == TLSV1DOT3_VERSION; |
11772 | 156 | wmem_strbuf_t *ja3_sg = wmem_strbuf_new(pinfo->pool, ""); |
11773 | 156 | wmem_strbuf_t *ja3_ecpf = wmem_strbuf_new(pinfo->pool, ""); |
11774 | 156 | char *ja3_dash = ""; |
11775 | 156 | unsigned supported_version; |
11776 | | |
11777 | | /* Extension extensions<0..2^16-2> (for TLS 1.3 HRR/CR min-length is 2) */ |
11778 | 156 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &exts_len, |
11779 | 156 | hf->hf.hs_exts_len, 0, UINT16_MAX)) { |
11780 | 12 | return offset_end; |
11781 | 12 | } |
11782 | 144 | offset += 2; |
11783 | 144 | offset_end = offset + exts_len; |
11784 | | |
11785 | 144 | if (ja4_data) { |
11786 | 112 | ja4_data->num_extensions = 0; |
11787 | 112 | } |
11788 | 891 | while (offset_end - offset >= 4) |
11789 | 840 | { |
11790 | 840 | ext_type = tvb_get_ntohs(tvb, offset); |
11791 | 840 | ext_len = tvb_get_ntohs(tvb, offset + 2); |
11792 | | |
11793 | 840 | if (ja4_data && !IS_GREASE_TLS(ext_type)) { |
11794 | 672 | ja4_data->num_extensions += 1; |
11795 | 672 | if (ext_type != SSL_HND_HELLO_EXT_SERVER_NAME && |
11796 | 187 | ext_type != SSL_HND_HELLO_EXT_ALPN) { |
11797 | 185 | wmem_list_insert_sorted(ja4_data->extension_list, GUINT_TO_POINTER(ext_type), wmem_compare_uint); |
11798 | 185 | } |
11799 | 672 | } |
11800 | | |
11801 | 840 | ext_item = proto_tree_add_none_format(tree, hf->hf.hs_ext, tvb, offset, 4 + ext_len, |
11802 | 840 | "Extension: %s (len=%u)", val_to_str(pinfo->pool, ext_type, |
11803 | 840 | tls_hello_extension_types, |
11804 | 840 | "Unknown type %u"), ext_len); |
11805 | 840 | ext_tree = proto_item_add_subtree(ext_item, hf->ett.hs_ext); |
11806 | | |
11807 | 840 | proto_tree_add_uint(ext_tree, hf->hf.hs_ext_type, |
11808 | 840 | tvb, offset, 2, ext_type); |
11809 | 840 | offset += 2; |
11810 | 840 | if (ja3 && !IS_GREASE_TLS(ext_type)) { |
11811 | 828 | wmem_strbuf_append_printf(ja3, "%s%i",ja3_dash, ext_type); |
11812 | 828 | ja3_dash = "-"; |
11813 | 828 | } |
11814 | | |
11815 | | /* opaque extension_data<0..2^16-1> */ |
11816 | 840 | if (!ssl_add_vector(hf, tvb, pinfo, ext_tree, offset, offset_end, &ext_len, |
11817 | 840 | hf->hf.hs_ext_len, 0, UINT16_MAX)) { |
11818 | 41 | return offset_end; |
11819 | 41 | } |
11820 | 799 | offset += 2; |
11821 | 799 | next_offset = offset + ext_len; |
11822 | | |
11823 | 799 | switch (ext_type) { |
11824 | 560 | case SSL_HND_HELLO_EXT_SERVER_NAME: |
11825 | 560 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
11826 | 480 | offset = ssl_dissect_hnd_hello_ext_server_name(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11827 | 480 | if (ja4_data) { |
11828 | 477 | ja4_data->server_name_present = true; |
11829 | 477 | } |
11830 | 480 | } |
11831 | 560 | break; |
11832 | 8 | case SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH: |
11833 | 8 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_max_fragment_length, tvb, offset, 1, ENC_NA); |
11834 | 8 | offset += 1; |
11835 | 8 | break; |
11836 | 2 | case SSL_HND_HELLO_EXT_STATUS_REQUEST: |
11837 | 2 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
11838 | 2 | offset = ssl_dissect_hnd_hello_ext_status_request(hf, tvb, pinfo, ext_tree, offset, next_offset, false); |
11839 | 2 | } else if (is_tls13 && hnd_type == SSL_HND_CERTIFICATE) { |
11840 | 0 | offset = tls_dissect_hnd_certificate_status(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11841 | 0 | } |
11842 | 2 | break; |
11843 | 1 | case SSL_HND_HELLO_EXT_CERT_TYPE: |
11844 | 1 | offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree, |
11845 | 1 | offset, next_offset, |
11846 | 1 | hnd_type, ext_type, |
11847 | 1 | session); |
11848 | 1 | break; |
11849 | 10 | case SSL_HND_HELLO_EXT_SUPPORTED_GROUPS: |
11850 | 10 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
11851 | 6 | offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset, |
11852 | 6 | next_offset, ja3_sg); |
11853 | 6 | } else { |
11854 | 4 | offset = ssl_dissect_hnd_hello_ext_supported_groups(hf, tvb, pinfo, ext_tree, offset, |
11855 | 4 | next_offset, NULL); |
11856 | 4 | } |
11857 | 10 | break; |
11858 | 3 | case SSL_HND_HELLO_EXT_EC_POINT_FORMATS: |
11859 | 3 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
11860 | 3 | offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, ja3_ecpf); |
11861 | 3 | } else { |
11862 | 0 | offset = ssl_dissect_hnd_hello_ext_ec_point_formats(hf, tvb, ext_tree, offset, NULL); |
11863 | 0 | } |
11864 | 3 | break; |
11865 | 0 | break; |
11866 | 1 | case SSL_HND_HELLO_EXT_SRP: |
11867 | 1 | offset = ssl_dissect_hnd_hello_ext_srp(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11868 | 1 | break; |
11869 | 3 | case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS: |
11870 | 3 | offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, ja4_data); |
11871 | 3 | break; |
11872 | 1 | case SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT: /* since TLS 1.3 draft -23 */ |
11873 | 1 | offset = ssl_dissect_hnd_hello_ext_sig_hash_algs(hf, tvb, ext_tree, pinfo, offset, next_offset, NULL); |
11874 | 1 | break; |
11875 | 0 | case SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS: |
11876 | 0 | offset = ssl_dissect_hnd_ext_delegated_credentials(hf, tvb, ext_tree, pinfo, offset, next_offset, hnd_type); |
11877 | 0 | break; |
11878 | 4 | case SSL_HND_HELLO_EXT_USE_SRTP: |
11879 | 4 | if (is_dtls) { |
11880 | 4 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
11881 | 0 | offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, false); |
11882 | 4 | } else if (hnd_type == SSL_HND_SERVER_HELLO) { |
11883 | 4 | offset = dtls_dissect_hnd_hello_ext_use_srtp(pinfo, tvb, ext_tree, offset, next_offset, true); |
11884 | 4 | } |
11885 | 4 | } else { |
11886 | | // XXX expert info: This extension MUST only be used with DTLS, and not with TLS. |
11887 | 0 | } |
11888 | 4 | break; |
11889 | 3 | case SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS: |
11890 | 3 | offset = ssl_dissect_hnd_ech_outer_ext(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11891 | 3 | break; |
11892 | 0 | case SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO: |
11893 | 0 | offset = ssl_dissect_hnd_hello_ext_ech(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, ssl, mk_map, initial_offset, hello_length); |
11894 | 0 | break; |
11895 | 1 | case SSL_HND_HELLO_EXT_HEARTBEAT: |
11896 | 1 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_heartbeat_mode, |
11897 | 1 | tvb, offset, 1, ENC_BIG_ENDIAN); |
11898 | 1 | offset++; |
11899 | 1 | break; |
11900 | 2 | case SSL_HND_HELLO_EXT_ALPN: |
11901 | 2 | offset = ssl_dissect_hnd_hello_ext_alpn(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, session, is_dtls, ja4_data); |
11902 | 2 | break; |
11903 | 0 | case SSL_HND_HELLO_EXT_STATUS_REQUEST_V2: |
11904 | 0 | if (hnd_type == SSL_HND_CLIENT_HELLO) |
11905 | 0 | offset = ssl_dissect_hnd_hello_ext_status_request_v2(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11906 | 0 | break; |
11907 | 1 | case SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP: |
11908 | | // TLS 1.3 note: SCT only appears in EE in draft -16 and before. |
11909 | 1 | if (hnd_type == SSL_HND_SERVER_HELLO || hnd_type == SSL_HND_ENCRYPTED_EXTENSIONS || hnd_type == SSL_HND_CERTIFICATE) |
11910 | 0 | offset = tls_dissect_sct_list(hf, tvb, pinfo, ext_tree, offset, next_offset, session->version); |
11911 | 1 | break; |
11912 | 0 | case SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE: |
11913 | 1 | case SSL_HND_HELLO_EXT_SERVER_CERT_TYPE: |
11914 | 1 | offset = ssl_dissect_hnd_hello_ext_cert_type(hf, tvb, ext_tree, |
11915 | 1 | offset, next_offset, |
11916 | 1 | hnd_type, ext_type, |
11917 | 1 | session); |
11918 | 1 | break; |
11919 | 2 | case SSL_HND_HELLO_EXT_PADDING: |
11920 | 2 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_padding_data, tvb, offset, ext_len, ENC_NA); |
11921 | 2 | offset += ext_len; |
11922 | 2 | break; |
11923 | 6 | case SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC: |
11924 | 6 | if (ssl && hnd_type == SSL_HND_SERVER_HELLO) { |
11925 | 0 | ssl_debug_printf("%s enabling Encrypt-then-MAC\n", G_STRFUNC); |
11926 | 0 | ssl->state |= SSL_ENCRYPT_THEN_MAC; |
11927 | 0 | } |
11928 | 6 | break; |
11929 | 0 | case SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET: |
11930 | 0 | if (ssl) { |
11931 | 0 | switch (hnd_type) { |
11932 | 0 | case SSL_HND_CLIENT_HELLO: |
11933 | 0 | ssl->state |= SSL_CLIENT_EXTENDED_MASTER_SECRET; |
11934 | 0 | break; |
11935 | 0 | case SSL_HND_SERVER_HELLO: |
11936 | 0 | ssl->state |= SSL_SERVER_EXTENDED_MASTER_SECRET; |
11937 | 0 | break; |
11938 | 0 | default: /* no default */ |
11939 | 0 | break; |
11940 | 0 | } |
11941 | 0 | } |
11942 | 0 | break; |
11943 | 3 | case SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE: |
11944 | 3 | offset = ssl_dissect_hnd_hello_ext_compress_certificate(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl); |
11945 | 3 | break; |
11946 | 0 | case SSL_HND_HELLO_EXT_TOKEN_BINDING: |
11947 | 0 | offset = ssl_dissect_hnd_hello_ext_token_binding(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl); |
11948 | 0 | break; |
11949 | 1 | case SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT: |
11950 | 1 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_record_size_limit, |
11951 | 1 | tvb, offset, 2, ENC_BIG_ENDIAN); |
11952 | 1 | offset += 2; |
11953 | 1 | break; |
11954 | 0 | case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS: |
11955 | 1 | case SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1: |
11956 | 1 | offset = ssl_dissect_hnd_hello_ext_quic_transport_parameters(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl); |
11957 | 1 | break; |
11958 | 5 | case SSL_HND_HELLO_EXT_SESSION_TICKET_TLS: |
11959 | 5 | offset = ssl_dissect_hnd_hello_ext_session_ticket(hf, tvb, ext_tree, offset, next_offset, hnd_type, ssl); |
11960 | 5 | break; |
11961 | 3 | case SSL_HND_HELLO_EXT_KEY_SHARE_OLD: /* used before TLS 1.3 draft -23 */ |
11962 | 3 | case SSL_HND_HELLO_EXT_KEY_SHARE: |
11963 | 3 | offset = ssl_dissect_hnd_hello_ext_key_share(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type); |
11964 | 3 | break; |
11965 | 0 | case SSL_HND_HELLO_EXT_PRE_SHARED_KEY: |
11966 | 0 | offset = ssl_dissect_hnd_hello_ext_pre_shared_key(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type); |
11967 | 0 | break; |
11968 | 0 | case SSL_HND_HELLO_EXT_EARLY_DATA: |
11969 | 2 | case SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO: |
11970 | 2 | offset = ssl_dissect_hnd_hello_ext_early_data(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl); |
11971 | 2 | break; |
11972 | 0 | case SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS: |
11973 | 0 | switch (hnd_type) { |
11974 | 0 | case SSL_HND_CLIENT_HELLO: |
11975 | 0 | offset = ssl_dissect_hnd_hello_ext_supported_versions(hf, tvb, pinfo, ext_tree, offset, next_offset, session, is_dtls, ja4_data); |
11976 | 0 | break; |
11977 | 0 | case SSL_HND_SERVER_HELLO: |
11978 | 0 | case SSL_HND_HELLO_RETRY_REQUEST: |
11979 | 0 | proto_tree_add_item_ret_uint(ext_tree, hf->hf.hs_ext_supported_version, tvb, offset, 2, ENC_BIG_ENDIAN, &supported_version); |
11980 | 0 | offset += 2; |
11981 | 0 | proto_item_append_text(ext_tree, " %s", val_to_str(pinfo->pool, supported_version, ssl_versions, "Unknown (0x%04x)")); |
11982 | 0 | break; |
11983 | 0 | } |
11984 | 0 | break; |
11985 | 2 | case SSL_HND_HELLO_EXT_COOKIE: |
11986 | 2 | offset = ssl_dissect_hnd_hello_ext_cookie(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11987 | 2 | break; |
11988 | 5 | case SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES: |
11989 | 5 | offset = ssl_dissect_hnd_hello_ext_psk_key_exchange_modes(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11990 | 5 | break; |
11991 | 0 | case SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES: |
11992 | 0 | offset = ssl_dissect_hnd_hello_ext_certificate_authorities(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11993 | 0 | break; |
11994 | 1 | case SSL_HND_HELLO_EXT_OID_FILTERS: |
11995 | 1 | offset = ssl_dissect_hnd_hello_ext_oid_filters(hf, tvb, pinfo, ext_tree, offset, next_offset); |
11996 | 1 | break; |
11997 | 0 | case SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH: |
11998 | 0 | break; |
11999 | 0 | case SSL_HND_HELLO_EXT_NPN: |
12000 | 0 | offset = ssl_dissect_hnd_hello_ext_npn(hf, tvb, pinfo, ext_tree, offset, next_offset); |
12001 | 0 | break; |
12002 | 0 | case SSL_HND_HELLO_EXT_ALPS_OLD: |
12003 | 0 | offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type); |
12004 | 0 | break; |
12005 | 0 | case SSL_HND_HELLO_EXT_ALPS: |
12006 | 0 | offset = ssl_dissect_hnd_hello_ext_alps(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type); |
12007 | 0 | break; |
12008 | 7 | case SSL_HND_HELLO_EXT_RENEGOTIATION_INFO: |
12009 | 7 | offset = ssl_dissect_hnd_hello_ext_reneg_info(hf, tvb, pinfo, ext_tree, offset, next_offset); |
12010 | 7 | break; |
12011 | 0 | case SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME: |
12012 | 0 | offset = ssl_dissect_hnd_hello_ext_esni(hf, tvb, pinfo, ext_tree, offset, next_offset, hnd_type, ssl); |
12013 | 0 | break; |
12014 | 2 | case SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED: |
12015 | 2 | session->deprecated_cid = true; |
12016 | | /* FALLTHRU */ |
12017 | 3 | case SSL_HND_HELLO_EXT_CONNECTION_ID: |
12018 | 3 | offset = ssl_dissect_hnd_hello_ext_connection_id(hf, tvb, pinfo, ext_tree, offset, hnd_type, session, ssl); |
12019 | 3 | break; |
12020 | 13 | case SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS: |
12021 | 13 | offset = ssl_dissect_hnd_hello_ext_trusted_ca_keys(hf, tvb, pinfo, ext_tree, offset, next_offset); |
12022 | 13 | break; |
12023 | 134 | default: |
12024 | 134 | proto_tree_add_item(ext_tree, hf->hf.hs_ext_data, |
12025 | 134 | tvb, offset, ext_len, ENC_NA); |
12026 | 134 | offset += ext_len; |
12027 | 134 | break; |
12028 | 799 | } |
12029 | | |
12030 | 747 | if (!ssl_end_vector(hf, tvb, pinfo, ext_tree, offset, next_offset)) { |
12031 | | /* Dissection did not end at expected location, fix it. */ |
12032 | 44 | offset = next_offset; |
12033 | 44 | } |
12034 | 747 | } |
12035 | | |
12036 | 51 | if (ja3) { |
12037 | 19 | if (hnd_type == SSL_HND_CLIENT_HELLO) { |
12038 | 17 | if(wmem_strbuf_get_len(ja3_sg) > 0) { |
12039 | 0 | wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_sg)); |
12040 | 17 | } else { |
12041 | 17 | wmem_strbuf_append_c(ja3, ','); |
12042 | 17 | } |
12043 | 17 | if(wmem_strbuf_get_len(ja3_ecpf) > 0) { |
12044 | 0 | wmem_strbuf_append_printf(ja3, "%s", wmem_strbuf_get_str(ja3_ecpf)); |
12045 | 17 | } else { |
12046 | 17 | wmem_strbuf_append_c(ja3, ','); |
12047 | 17 | } |
12048 | 17 | } |
12049 | 19 | } |
12050 | | |
12051 | | /* Check if Extensions vector is correctly terminated. */ |
12052 | 51 | if (!ssl_end_vector(hf, tvb, pinfo, tree, offset, offset_end)) { |
12053 | 1 | offset = offset_end; |
12054 | 1 | } |
12055 | | |
12056 | 51 | return offset; |
12057 | 144 | } /* }}} */ |
12058 | | |
12059 | | |
12060 | | /* ClientKeyExchange algo-specific dissectors. {{{ */ |
12061 | | |
12062 | | static void |
12063 | | dissect_ssl3_hnd_cli_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12064 | | proto_tree *tree, uint32_t offset, |
12065 | | uint32_t length) |
12066 | 0 | { |
12067 | 0 | int point_len; |
12068 | 0 | proto_tree *ssl_ecdh_tree; |
12069 | |
|
12070 | 0 | ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12071 | 0 | hf->ett.keyex_params, NULL, "EC Diffie-Hellman Client Params"); |
12072 | | |
12073 | | /* point */ |
12074 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12075 | 0 | proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point_len, tvb, |
12076 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12077 | 0 | proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_client_keyex_point, tvb, |
12078 | 0 | offset + 1, point_len, ENC_NA); |
12079 | 0 | } |
12080 | | |
12081 | | static void |
12082 | | dissect_ssl3_hnd_cli_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12083 | | proto_tree *tree, uint32_t offset, uint32_t length) |
12084 | 0 | { |
12085 | 0 | int yc_len; |
12086 | 0 | proto_tree *ssl_dh_tree; |
12087 | |
|
12088 | 0 | ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12089 | 0 | hf->ett.keyex_params, NULL, "Diffie-Hellman Client Params"); |
12090 | | |
12091 | | /* ClientDiffieHellmanPublic.dh_public (explicit) */ |
12092 | 0 | yc_len = tvb_get_ntohs(tvb, offset); |
12093 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc_len, tvb, |
12094 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12095 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_client_keyex_yc, tvb, |
12096 | 0 | offset + 2, yc_len, ENC_NA); |
12097 | 0 | } |
12098 | | |
12099 | | static void |
12100 | | dissect_ssl3_hnd_cli_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12101 | | proto_tree *tree, uint32_t offset, |
12102 | | uint32_t length, const SslSession *session) |
12103 | 0 | { |
12104 | 0 | int epms_len; |
12105 | 0 | proto_tree *ssl_rsa_tree; |
12106 | |
|
12107 | 0 | ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12108 | 0 | hf->ett.keyex_params, NULL, "RSA Encrypted PreMaster Secret"); |
12109 | | |
12110 | | /* EncryptedPreMasterSecret.pre_master_secret */ |
12111 | 0 | switch (session->version) { |
12112 | 0 | case SSLV2_VERSION: |
12113 | 0 | case SSLV3_VERSION: |
12114 | 0 | case DTLSV1DOT0_OPENSSL_VERSION: |
12115 | | /* OpenSSL pre-0.9.8f DTLS and pre-TLS quirk: 2-octet length vector is |
12116 | | * not present. The handshake contents represents the EPMS, see: |
12117 | | * https://gitlab.com/wireshark/wireshark/-/issues/10222 */ |
12118 | 0 | epms_len = length; |
12119 | 0 | break; |
12120 | | |
12121 | 0 | default: |
12122 | | /* TLS and DTLS include vector length before EPMS */ |
12123 | 0 | epms_len = tvb_get_ntohs(tvb, offset); |
12124 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms_len, tvb, |
12125 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12126 | 0 | offset += 2; |
12127 | 0 | break; |
12128 | 0 | } |
12129 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_client_keyex_epms, tvb, |
12130 | 0 | offset, epms_len, ENC_NA); |
12131 | 0 | } |
12132 | | |
12133 | | /* Used in PSK cipher suites */ |
12134 | | static uint32_t |
12135 | | dissect_ssl3_hnd_cli_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12136 | | proto_tree *tree, uint32_t offset) |
12137 | 0 | { |
12138 | 0 | unsigned identity_len; |
12139 | 0 | proto_tree *ssl_psk_tree; |
12140 | |
|
12141 | 0 | ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1, |
12142 | 0 | hf->ett.keyex_params, NULL, "PSK Client Params"); |
12143 | | /* identity */ |
12144 | 0 | identity_len = tvb_get_ntohs(tvb, offset); |
12145 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, tvb, |
12146 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12147 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, tvb, |
12148 | 0 | offset + 2, identity_len, ENC_NA); |
12149 | |
|
12150 | 0 | proto_item_set_len(ssl_psk_tree, 2 + identity_len); |
12151 | 0 | return 2 + identity_len; |
12152 | 0 | } |
12153 | | |
12154 | | /* Used in RSA PSK cipher suites */ |
12155 | | static void |
12156 | | dissect_ssl3_hnd_cli_keyex_rsa_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12157 | | proto_tree *tree, uint32_t offset, |
12158 | | uint32_t length) |
12159 | 0 | { |
12160 | 0 | int identity_len, epms_len; |
12161 | 0 | proto_tree *ssl_psk_tree; |
12162 | |
|
12163 | 0 | ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12164 | 0 | hf->ett.keyex_params, NULL, "RSA PSK Client Params"); |
12165 | | |
12166 | | /* identity */ |
12167 | 0 | identity_len = tvb_get_ntohs(tvb, offset); |
12168 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity_len, |
12169 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
12170 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_identity, |
12171 | 0 | tvb, offset + 2, identity_len, ENC_NA); |
12172 | 0 | offset += 2 + identity_len; |
12173 | | |
12174 | | /* Yc */ |
12175 | 0 | epms_len = tvb_get_ntohs(tvb, offset); |
12176 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms_len, tvb, |
12177 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12178 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_client_keyex_epms, tvb, |
12179 | 0 | offset + 2, epms_len, ENC_NA); |
12180 | 0 | } |
12181 | | |
12182 | | /* Used in Diffie-Hellman PSK cipher suites */ |
12183 | | static void |
12184 | | dissect_ssl3_hnd_cli_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12185 | | proto_tree *tree, uint32_t offset, uint32_t length) |
12186 | 0 | { |
12187 | | /* |
12188 | | * struct { |
12189 | | * select (KeyExchangeAlgorithm) { |
12190 | | * case diffie_hellman_psk: |
12191 | | * opaque psk_identity<0..2^16-1>; |
12192 | | * ClientDiffieHellmanPublic public; |
12193 | | * } exchange_keys; |
12194 | | * } ClientKeyExchange; |
12195 | | */ |
12196 | |
|
12197 | 0 | uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset); |
12198 | 0 | dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset + psk_len, length - psk_len); |
12199 | 0 | } |
12200 | | |
12201 | | /* Used in EC Diffie-Hellman PSK cipher suites */ |
12202 | | static void |
12203 | | dissect_ssl3_hnd_cli_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12204 | | proto_tree *tree, uint32_t offset, uint32_t length) |
12205 | 0 | { |
12206 | | /* |
12207 | | * struct { |
12208 | | * select (KeyExchangeAlgorithm) { |
12209 | | * case ec_diffie_hellman_psk: |
12210 | | * opaque psk_identity<0..2^16-1>; |
12211 | | * ClientECDiffieHellmanPublic public; |
12212 | | * } exchange_keys; |
12213 | | * } ClientKeyExchange; |
12214 | | */ |
12215 | |
|
12216 | 0 | uint32_t psk_len = dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset); |
12217 | 0 | dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset + psk_len, length - psk_len); |
12218 | 0 | } |
12219 | | |
12220 | | /* Used in EC J-PAKE cipher suites */ |
12221 | | static void |
12222 | | dissect_ssl3_hnd_cli_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12223 | | proto_tree *tree, uint32_t offset, |
12224 | | uint32_t length) |
12225 | 0 | { |
12226 | | /* |
12227 | | * struct { |
12228 | | * ECPoint V; |
12229 | | * opaque r<1..2^8-1>; |
12230 | | * } ECSchnorrZKP; |
12231 | | * |
12232 | | * struct { |
12233 | | * ECPoint X; |
12234 | | * ECSchnorrZKP zkp; |
12235 | | * } ECJPAKEKeyKP; |
12236 | | * |
12237 | | * struct { |
12238 | | * ECJPAKEKeyKP ecjpake_key_kp; |
12239 | | * } ClientECJPAKEParams; |
12240 | | * |
12241 | | * select (KeyExchangeAlgorithm) { |
12242 | | * case ecjpake: |
12243 | | * ClientECJPAKEParams params; |
12244 | | * } ClientKeyExchange; |
12245 | | */ |
12246 | |
|
12247 | 0 | int point_len; |
12248 | 0 | proto_tree *ssl_ecjpake_tree; |
12249 | |
|
12250 | 0 | ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12251 | 0 | hf->ett.keyex_params, NULL, |
12252 | 0 | "EC J-PAKE Client Params"); |
12253 | | |
12254 | | /* ECJPAKEKeyKP.X */ |
12255 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12256 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc_len, tvb, |
12257 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12258 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_xc, tvb, |
12259 | 0 | offset + 1, point_len, ENC_NA); |
12260 | 0 | offset += 1 + point_len; |
12261 | | |
12262 | | /* ECJPAKEKeyKP.zkp.V */ |
12263 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12264 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc_len, tvb, |
12265 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12266 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_vc, tvb, |
12267 | 0 | offset + 1, point_len, ENC_NA); |
12268 | 0 | offset += 1 + point_len; |
12269 | | |
12270 | | /* ECJPAKEKeyKP.zkp.r */ |
12271 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12272 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc_len, tvb, |
12273 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12274 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_client_keyex_rc, tvb, |
12275 | 0 | offset + 1, point_len, ENC_NA); |
12276 | 0 | } |
12277 | | |
12278 | | static void |
12279 | | dissect_ssl3_hnd_cli_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12280 | | proto_tree *tree, uint32_t offset, |
12281 | | uint32_t length) |
12282 | 0 | { |
12283 | 0 | int epms_len; |
12284 | 0 | proto_tree *ssl_ecc_sm2_tree; |
12285 | |
|
12286 | 0 | ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, length, |
12287 | 0 | hf->ett.keyex_params, NULL, |
12288 | 0 | "ECC-SM2 Encrypted PreMaster Secret"); |
12289 | |
|
12290 | 0 | epms_len = tvb_get_ntohs(tvb, offset); |
12291 | 0 | proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms_len, tvb, |
12292 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12293 | 0 | offset += 2; |
12294 | 0 | proto_tree_add_item(ssl_ecc_sm2_tree, hf->hf.hs_client_keyex_epms, tvb, |
12295 | 0 | offset, epms_len, ENC_NA); |
12296 | 0 | } |
12297 | | /* ClientKeyExchange algo-specific dissectors. }}} */ |
12298 | | |
12299 | | |
12300 | | /* Dissects DigitallySigned (see RFC 5246 4.7 Cryptographic Attributes). {{{ */ |
12301 | | static uint32_t |
12302 | | ssl_dissect_digitally_signed(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12303 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12304 | | uint16_t version, int hf_sig_len, int hf_sig) |
12305 | 0 | { |
12306 | 0 | uint32_t sig_len; |
12307 | |
|
12308 | 0 | switch (version) { |
12309 | 0 | case TLSV1DOT2_VERSION: |
12310 | 0 | case DTLSV1DOT2_VERSION: |
12311 | 0 | case TLSV1DOT3_VERSION: |
12312 | 0 | case DTLSV1DOT3_VERSION: |
12313 | 0 | tls_dissect_signature_algorithm(hf, tvb, tree, offset, NULL); |
12314 | 0 | offset += 2; |
12315 | 0 | break; |
12316 | | |
12317 | 0 | default: |
12318 | 0 | break; |
12319 | 0 | } |
12320 | | |
12321 | | /* Sig */ |
12322 | 0 | if (!ssl_add_vector(hf, tvb, pinfo, tree, offset, offset_end, &sig_len, |
12323 | 0 | hf_sig_len, 0, UINT16_MAX)) { |
12324 | 0 | return offset_end; |
12325 | 0 | } |
12326 | 0 | offset += 2; |
12327 | 0 | proto_tree_add_item(tree, hf_sig, tvb, offset, sig_len, ENC_NA); |
12328 | 0 | offset += sig_len; |
12329 | 0 | return offset; |
12330 | 0 | } /* }}} */ |
12331 | | |
12332 | | /* ServerKeyExchange algo-specific dissectors. {{{ */ |
12333 | | |
12334 | | /* dissects signed_params inside a ServerKeyExchange for some keyex algos */ |
12335 | | static void |
12336 | | dissect_ssl3_hnd_srv_keyex_sig(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12337 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12338 | | uint16_t version) |
12339 | 0 | { |
12340 | | /* |
12341 | | * TLSv1.2 (RFC 5246 sec 7.4.8) |
12342 | | * struct { |
12343 | | * digitally-signed struct { |
12344 | | * opaque handshake_messages[handshake_messages_length]; |
12345 | | * } |
12346 | | * } CertificateVerify; |
12347 | | * |
12348 | | * TLSv1.0/TLSv1.1 (RFC 5436 sec 7.4.8 and 7.4.3) works essentially the same |
12349 | | * as TLSv1.2, but the hash algorithms are not explicit in digitally-signed. |
12350 | | * |
12351 | | * SSLv3 (RFC 6101 sec 5.6.8) essentially works the same as TLSv1.0 but it |
12352 | | * does more hashing including the master secret and padding. |
12353 | | */ |
12354 | 0 | ssl_dissect_digitally_signed(hf, tvb, pinfo, tree, offset, offset_end, version, |
12355 | 0 | hf->hf.hs_server_keyex_sig_len, |
12356 | 0 | hf->hf.hs_server_keyex_sig); |
12357 | 0 | } |
12358 | | |
12359 | | static uint32_t |
12360 | | dissect_tls_ecparameters(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, uint32_t offset, uint32_t offset_end) |
12361 | 0 | { |
12362 | | /* |
12363 | | * RFC 4492 ECC cipher suites for TLS |
12364 | | * |
12365 | | * struct { |
12366 | | * ECCurveType curve_type; |
12367 | | * select (curve_type) { |
12368 | | * case explicit_prime: |
12369 | | * ... |
12370 | | * case explicit_char2: |
12371 | | * ... |
12372 | | * case named_curve: |
12373 | | * NamedCurve namedcurve; |
12374 | | * }; |
12375 | | * } ECParameters; |
12376 | | */ |
12377 | |
|
12378 | 0 | int curve_type; |
12379 | | |
12380 | | /* ECParameters.curve_type */ |
12381 | 0 | curve_type = tvb_get_uint8(tvb, offset); |
12382 | 0 | proto_tree_add_item(tree, hf->hf.hs_server_keyex_curve_type, tvb, |
12383 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12384 | 0 | offset++; |
12385 | |
|
12386 | 0 | if (curve_type != 3) |
12387 | 0 | return offset_end; /* only named_curves are supported */ |
12388 | | |
12389 | | /* case curve_type == named_curve; ECParameters.namedcurve */ |
12390 | 0 | proto_tree_add_item(tree, hf->hf.hs_server_keyex_named_curve, tvb, |
12391 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12392 | 0 | offset += 2; |
12393 | |
|
12394 | 0 | return offset; |
12395 | 0 | } |
12396 | | |
12397 | | static void |
12398 | | dissect_ssl3_hnd_srv_keyex_ecdh(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12399 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12400 | | uint16_t version, bool anon) |
12401 | 0 | { |
12402 | | /* |
12403 | | * RFC 4492 ECC cipher suites for TLS |
12404 | | * |
12405 | | * struct { |
12406 | | * opaque point <1..2^8-1>; |
12407 | | * } ECPoint; |
12408 | | * |
12409 | | * struct { |
12410 | | * ECParameters curve_params; |
12411 | | * ECPoint public; |
12412 | | * } ServerECDHParams; |
12413 | | * |
12414 | | * select (KeyExchangeAlgorithm) { |
12415 | | * case ec_diffie_hellman: |
12416 | | * ServerECDHParams params; |
12417 | | * Signature signed_params; |
12418 | | * } ServerKeyExchange; |
12419 | | */ |
12420 | |
|
12421 | 0 | int point_len; |
12422 | 0 | proto_tree *ssl_ecdh_tree; |
12423 | |
|
12424 | 0 | ssl_ecdh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
12425 | 0 | hf->ett.keyex_params, NULL, "EC Diffie-Hellman Server Params"); |
12426 | |
|
12427 | 0 | offset = dissect_tls_ecparameters(hf, tvb, ssl_ecdh_tree, offset, offset_end); |
12428 | 0 | if (offset >= offset_end) |
12429 | 0 | return; /* only named_curves are supported */ |
12430 | | |
12431 | | /* ECPoint.point */ |
12432 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12433 | 0 | proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point_len, tvb, |
12434 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12435 | 0 | proto_tree_add_item(ssl_ecdh_tree, hf->hf.hs_server_keyex_point, tvb, |
12436 | 0 | offset + 1, point_len, ENC_NA); |
12437 | 0 | offset += 1 + point_len; |
12438 | | |
12439 | | /* Signature (if non-anonymous KEX) */ |
12440 | 0 | if (!anon) { |
12441 | 0 | dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecdh_tree, offset, offset_end, version); |
12442 | 0 | } |
12443 | 0 | } |
12444 | | |
12445 | | static void |
12446 | | dissect_ssl3_hnd_srv_keyex_dhe(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12447 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12448 | | uint16_t version, bool anon) |
12449 | 0 | { |
12450 | 0 | int p_len, g_len, ys_len; |
12451 | 0 | proto_tree *ssl_dh_tree; |
12452 | |
|
12453 | 0 | ssl_dh_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
12454 | 0 | hf->ett.keyex_params, NULL, "Diffie-Hellman Server Params"); |
12455 | | |
12456 | | /* p */ |
12457 | 0 | p_len = tvb_get_ntohs(tvb, offset); |
12458 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p_len, tvb, |
12459 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12460 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_p, tvb, |
12461 | 0 | offset + 2, p_len, ENC_NA); |
12462 | 0 | offset += 2 + p_len; |
12463 | | |
12464 | | /* g */ |
12465 | 0 | g_len = tvb_get_ntohs(tvb, offset); |
12466 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g_len, tvb, |
12467 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12468 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_g, tvb, |
12469 | 0 | offset + 2, g_len, ENC_NA); |
12470 | 0 | offset += 2 + g_len; |
12471 | | |
12472 | | /* Ys */ |
12473 | 0 | ys_len = tvb_get_ntohs(tvb, offset); |
12474 | 0 | proto_tree_add_uint(ssl_dh_tree, hf->hf.hs_server_keyex_ys_len, tvb, |
12475 | 0 | offset, 2, ys_len); |
12476 | 0 | proto_tree_add_item(ssl_dh_tree, hf->hf.hs_server_keyex_ys, tvb, |
12477 | 0 | offset + 2, ys_len, ENC_NA); |
12478 | 0 | offset += 2 + ys_len; |
12479 | | |
12480 | | /* Signature (if non-anonymous KEX) */ |
12481 | 0 | if (!anon) { |
12482 | 0 | dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_dh_tree, offset, offset_end, version); |
12483 | 0 | } |
12484 | 0 | } |
12485 | | |
12486 | | /* Only used in RSA-EXPORT cipher suites */ |
12487 | | static void |
12488 | | dissect_ssl3_hnd_srv_keyex_rsa(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12489 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12490 | | uint16_t version) |
12491 | 0 | { |
12492 | 0 | int modulus_len, exponent_len; |
12493 | 0 | proto_tree *ssl_rsa_tree; |
12494 | |
|
12495 | 0 | ssl_rsa_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
12496 | 0 | hf->ett.keyex_params, NULL, "RSA-EXPORT Server Params"); |
12497 | | |
12498 | | /* modulus */ |
12499 | 0 | modulus_len = tvb_get_ntohs(tvb, offset); |
12500 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus_len, tvb, |
12501 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12502 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_modulus, tvb, |
12503 | 0 | offset + 2, modulus_len, ENC_NA); |
12504 | 0 | offset += 2 + modulus_len; |
12505 | | |
12506 | | /* exponent */ |
12507 | 0 | exponent_len = tvb_get_ntohs(tvb, offset); |
12508 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent_len, |
12509 | 0 | tvb, offset, 2, ENC_BIG_ENDIAN); |
12510 | 0 | proto_tree_add_item(ssl_rsa_tree, hf->hf.hs_server_keyex_exponent, |
12511 | 0 | tvb, offset + 2, exponent_len, ENC_NA); |
12512 | 0 | offset += 2 + exponent_len; |
12513 | | |
12514 | | /* Signature */ |
12515 | 0 | dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_rsa_tree, offset, offset_end, version); |
12516 | 0 | } |
12517 | | |
12518 | | /* Used in RSA PSK and PSK cipher suites */ |
12519 | | static uint32_t |
12520 | | dissect_ssl3_hnd_srv_keyex_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12521 | | proto_tree *tree, uint32_t offset) |
12522 | 0 | { |
12523 | 0 | unsigned hint_len; |
12524 | 0 | proto_tree *ssl_psk_tree; |
12525 | |
|
12526 | 0 | ssl_psk_tree = proto_tree_add_subtree(tree, tvb, offset, -1, |
12527 | 0 | hf->ett.keyex_params, NULL, "PSK Server Params"); |
12528 | | |
12529 | | /* hint */ |
12530 | 0 | hint_len = tvb_get_ntohs(tvb, offset); |
12531 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint_len, tvb, |
12532 | 0 | offset, 2, ENC_BIG_ENDIAN); |
12533 | 0 | proto_tree_add_item(ssl_psk_tree, hf->hf.hs_server_keyex_hint, tvb, |
12534 | 0 | offset + 2, hint_len, ENC_NA); |
12535 | |
|
12536 | 0 | proto_item_set_len(ssl_psk_tree, 2 + hint_len); |
12537 | 0 | return 2 + hint_len; |
12538 | 0 | } |
12539 | | |
12540 | | /* Used in Diffie-Hellman PSK cipher suites */ |
12541 | | static void |
12542 | | dissect_ssl3_hnd_srv_keyex_dhe_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12543 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
12544 | 0 | { |
12545 | | /* |
12546 | | * struct { |
12547 | | * select (KeyExchangeAlgorithm) { |
12548 | | * case diffie_hellman_psk: |
12549 | | * opaque psk_identity_hint<0..2^16-1>; |
12550 | | * ServerDHParams params; |
12551 | | * }; |
12552 | | * } ServerKeyExchange; |
12553 | | */ |
12554 | |
|
12555 | 0 | uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset); |
12556 | 0 | dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true); |
12557 | 0 | } |
12558 | | |
12559 | | /* Used in EC Diffie-Hellman PSK cipher suites */ |
12560 | | static void |
12561 | | dissect_ssl3_hnd_srv_keyex_ecdh_psk(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12562 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
12563 | 0 | { |
12564 | | /* |
12565 | | * struct { |
12566 | | * select (KeyExchangeAlgorithm) { |
12567 | | * case ec_diffie_hellman_psk: |
12568 | | * opaque psk_identity_hint<0..2^16-1>; |
12569 | | * ServerECDHParams params; |
12570 | | * }; |
12571 | | * } ServerKeyExchange; |
12572 | | */ |
12573 | |
|
12574 | 0 | uint32_t psk_len = dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset); |
12575 | 0 | dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset + psk_len, offset_end, 0, true); |
12576 | 0 | } |
12577 | | |
12578 | | /* Used in EC J-PAKE cipher suites */ |
12579 | | static void |
12580 | | dissect_ssl3_hnd_srv_keyex_ecjpake(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12581 | | proto_tree *tree, uint32_t offset, uint32_t offset_end) |
12582 | 0 | { |
12583 | | /* |
12584 | | * struct { |
12585 | | * ECPoint V; |
12586 | | * opaque r<1..2^8-1>; |
12587 | | * } ECSchnorrZKP; |
12588 | | * |
12589 | | * struct { |
12590 | | * ECPoint X; |
12591 | | * ECSchnorrZKP zkp; |
12592 | | * } ECJPAKEKeyKP; |
12593 | | * |
12594 | | * struct { |
12595 | | * ECParameters curve_params; |
12596 | | * ECJPAKEKeyKP ecjpake_key_kp; |
12597 | | * } ServerECJPAKEParams; |
12598 | | * |
12599 | | * select (KeyExchangeAlgorithm) { |
12600 | | * case ecjpake: |
12601 | | * ServerECJPAKEParams params; |
12602 | | * } ServerKeyExchange; |
12603 | | */ |
12604 | |
|
12605 | 0 | int point_len; |
12606 | 0 | proto_tree *ssl_ecjpake_tree; |
12607 | |
|
12608 | 0 | ssl_ecjpake_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
12609 | 0 | hf->ett.keyex_params, NULL, |
12610 | 0 | "EC J-PAKE Server Params"); |
12611 | |
|
12612 | 0 | offset = dissect_tls_ecparameters(hf, tvb, ssl_ecjpake_tree, offset, offset_end); |
12613 | 0 | if (offset >= offset_end) |
12614 | 0 | return; /* only named_curves are supported */ |
12615 | | |
12616 | | /* ECJPAKEKeyKP.X */ |
12617 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12618 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs_len, tvb, |
12619 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12620 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_xs, tvb, |
12621 | 0 | offset + 1, point_len, ENC_NA); |
12622 | 0 | offset += 1 + point_len; |
12623 | | |
12624 | | /* ECJPAKEKeyKP.zkp.V */ |
12625 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12626 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs_len, tvb, |
12627 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12628 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_vs, tvb, |
12629 | 0 | offset + 1, point_len, ENC_NA); |
12630 | 0 | offset += 1 + point_len; |
12631 | | |
12632 | | /* ECJPAKEKeyKP.zkp.r */ |
12633 | 0 | point_len = tvb_get_uint8(tvb, offset); |
12634 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs_len, tvb, |
12635 | 0 | offset, 1, ENC_BIG_ENDIAN); |
12636 | 0 | proto_tree_add_item(ssl_ecjpake_tree, hf->hf.hs_server_keyex_rs, tvb, |
12637 | 0 | offset + 1, point_len, ENC_NA); |
12638 | 0 | } |
12639 | | |
12640 | | /* Only used in ECC-SM2-EXPORT cipher suites */ |
12641 | | static void |
12642 | | dissect_ssl3_hnd_srv_keyex_ecc_sm2(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12643 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12644 | | uint16_t version) |
12645 | 0 | { |
12646 | 0 | proto_tree *ssl_ecc_sm2_tree; |
12647 | |
|
12648 | 0 | ssl_ecc_sm2_tree = proto_tree_add_subtree(tree, tvb, offset, offset_end - offset, |
12649 | 0 | hf->ett.keyex_params, NULL, "ECC-SM2-EXPORT Server Params"); |
12650 | | |
12651 | | /* Signature */ |
12652 | 0 | dissect_ssl3_hnd_srv_keyex_sig(hf, tvb, pinfo, ssl_ecc_sm2_tree, offset, offset_end, version); |
12653 | 0 | } |
12654 | | /* ServerKeyExchange algo-specific dissectors. }}} */ |
12655 | | |
12656 | | /* Client Key Exchange and Server Key Exchange handshake dissections. {{{ */ |
12657 | | void |
12658 | | ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12659 | | proto_tree *tree, uint32_t offset, uint32_t length, |
12660 | | const SslSession *session) |
12661 | 3 | { |
12662 | 3 | switch (ssl_get_keyex_alg(session->cipher)) { |
12663 | 0 | case KEX_DH_ANON: /* RFC 5246; DHE_DSS, DHE_RSA, DH_DSS, DH_RSA, DH_ANON: ClientDiffieHellmanPublic */ |
12664 | 0 | case KEX_DH_DSS: |
12665 | 0 | case KEX_DH_RSA: |
12666 | 0 | case KEX_DHE_DSS: |
12667 | 0 | case KEX_DHE_RSA: |
12668 | 0 | dissect_ssl3_hnd_cli_keyex_dhe(hf, tvb, tree, offset, length); |
12669 | 0 | break; |
12670 | 0 | case KEX_DHE_PSK: /* RFC 4279; diffie_hellman_psk: psk_identity, ClientDiffieHellmanPublic */ |
12671 | 0 | dissect_ssl3_hnd_cli_keyex_dhe_psk(hf, tvb, tree, offset, length); |
12672 | 0 | break; |
12673 | 0 | case KEX_ECDH_ANON: /* RFC 4492; ec_diffie_hellman: ClientECDiffieHellmanPublic */ |
12674 | 0 | case KEX_ECDH_ECDSA: |
12675 | 0 | case KEX_ECDH_RSA: |
12676 | 0 | case KEX_ECDHE_ECDSA: |
12677 | 0 | case KEX_ECDHE_RSA: |
12678 | 0 | dissect_ssl3_hnd_cli_keyex_ecdh(hf, tvb, tree, offset, length); |
12679 | 0 | break; |
12680 | 0 | case KEX_ECDHE_PSK: /* RFC 5489; ec_diffie_hellman_psk: psk_identity, ClientECDiffieHellmanPublic */ |
12681 | 0 | dissect_ssl3_hnd_cli_keyex_ecdh_psk(hf, tvb, tree, offset, length); |
12682 | 0 | break; |
12683 | 0 | case KEX_KRB5: /* RFC 2712; krb5: KerberosWrapper */ |
12684 | | /* XXX: implement support for KRB5 */ |
12685 | 0 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12686 | 0 | tvb, offset, length, |
12687 | 0 | "Kerberos ciphersuites (RFC 2712) are not implemented, contact Wireshark" |
12688 | 0 | " developers if you want them to be supported"); |
12689 | 0 | break; |
12690 | 0 | case KEX_PSK: /* RFC 4279; psk: psk_identity */ |
12691 | 0 | dissect_ssl3_hnd_cli_keyex_psk(hf, tvb, tree, offset); |
12692 | 0 | break; |
12693 | 0 | case KEX_RSA: /* RFC 5246; rsa: EncryptedPreMasterSecret */ |
12694 | 0 | dissect_ssl3_hnd_cli_keyex_rsa(hf, tvb, tree, offset, length, session); |
12695 | 0 | break; |
12696 | 0 | case KEX_RSA_PSK: /* RFC 4279; rsa_psk: psk_identity, EncryptedPreMasterSecret */ |
12697 | 0 | dissect_ssl3_hnd_cli_keyex_rsa_psk(hf, tvb, tree, offset, length); |
12698 | 0 | break; |
12699 | 0 | case KEX_SRP_SHA: /* RFC 5054; srp: ClientSRPPublic */ |
12700 | 0 | case KEX_SRP_SHA_DSS: |
12701 | 0 | case KEX_SRP_SHA_RSA: |
12702 | | /* XXX: implement support for SRP_SHA* */ |
12703 | 0 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12704 | 0 | tvb, offset, length, |
12705 | 0 | "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark" |
12706 | 0 | " developers if you want them to be supported"); |
12707 | 0 | break; |
12708 | 0 | case KEX_ECJPAKE: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */ |
12709 | 0 | dissect_ssl3_hnd_cli_keyex_ecjpake(hf, tvb, tree, offset, length); |
12710 | 0 | break; |
12711 | 0 | case KEX_ECC_SM2: /* GB/T 38636 */ |
12712 | 0 | dissect_ssl3_hnd_cli_keyex_ecc_sm2(hf, tvb, tree, offset, length); |
12713 | 0 | break; |
12714 | 3 | default: |
12715 | 3 | if (session->cipher == 0) { |
12716 | 1 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12717 | 1 | tvb, offset, length, |
12718 | 1 | "Cipher Suite not found"); |
12719 | 2 | } else { |
12720 | 2 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12721 | 2 | tvb, offset, length, |
12722 | 2 | "Cipher Suite 0x%04x is not implemented, " |
12723 | 2 | "contact Wireshark developers if you want this to be supported", |
12724 | 2 | session->cipher); |
12725 | 2 | } |
12726 | 3 | break; |
12727 | 3 | } |
12728 | 3 | } |
12729 | | |
12730 | | void |
12731 | | ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, |
12732 | | proto_tree *tree, uint32_t offset, uint32_t offset_end, |
12733 | | const SslSession *session) |
12734 | 0 | { |
12735 | 0 | switch (ssl_get_keyex_alg(session->cipher)) { |
12736 | 0 | case KEX_DH_ANON: /* RFC 5246; ServerDHParams */ |
12737 | 0 | dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, true); |
12738 | 0 | break; |
12739 | 0 | case KEX_DH_DSS: /* RFC 5246; not allowed */ |
12740 | 0 | case KEX_DH_RSA: |
12741 | 0 | proto_tree_add_expert(tree, NULL, &hf->ei.hs_srv_keyex_illegal, |
12742 | 0 | tvb, offset, offset_end - offset); |
12743 | 0 | break; |
12744 | 0 | case KEX_DHE_DSS: /* RFC 5246; dhe_dss, dhe_rsa: ServerDHParams, Signature */ |
12745 | 0 | case KEX_DHE_RSA: |
12746 | 0 | dissect_ssl3_hnd_srv_keyex_dhe(hf, tvb, pinfo, tree, offset, offset_end, session->version, false); |
12747 | 0 | break; |
12748 | 0 | case KEX_DHE_PSK: /* RFC 4279; diffie_hellman_psk: psk_identity_hint, ServerDHParams */ |
12749 | 0 | dissect_ssl3_hnd_srv_keyex_dhe_psk(hf, tvb, pinfo, tree, offset, offset_end); |
12750 | 0 | break; |
12751 | 0 | case KEX_ECDH_ANON: /* RFC 4492; ec_diffie_hellman: ServerECDHParams (without signature for anon) */ |
12752 | 0 | dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, true); |
12753 | 0 | break; |
12754 | 0 | case KEX_ECDHE_PSK: /* RFC 5489; psk_identity_hint, ServerECDHParams */ |
12755 | 0 | dissect_ssl3_hnd_srv_keyex_ecdh_psk(hf, tvb, pinfo, tree, offset, offset_end); |
12756 | 0 | break; |
12757 | 0 | case KEX_ECDH_ECDSA: /* RFC 4492; ec_diffie_hellman: ServerECDHParams, Signature */ |
12758 | 0 | case KEX_ECDH_RSA: |
12759 | 0 | case KEX_ECDHE_ECDSA: |
12760 | 0 | case KEX_ECDHE_RSA: |
12761 | 0 | dissect_ssl3_hnd_srv_keyex_ecdh(hf, tvb, pinfo, tree, offset, offset_end, session->version, false); |
12762 | 0 | break; |
12763 | 0 | case KEX_KRB5: /* RFC 2712; not allowed */ |
12764 | 0 | proto_tree_add_expert(tree, NULL, &hf->ei.hs_srv_keyex_illegal, |
12765 | 0 | tvb, offset, offset_end - offset); |
12766 | 0 | break; |
12767 | 0 | case KEX_PSK: /* RFC 4279; psk, rsa: psk_identity */ |
12768 | 0 | case KEX_RSA_PSK: |
12769 | 0 | dissect_ssl3_hnd_srv_keyex_psk(hf, tvb, tree, offset); |
12770 | 0 | break; |
12771 | 0 | case KEX_RSA: /* only allowed if the public key in the server certificate is longer than 512 bits */ |
12772 | 0 | dissect_ssl3_hnd_srv_keyex_rsa(hf, tvb, pinfo, tree, offset, offset_end, session->version); |
12773 | 0 | break; |
12774 | 0 | case KEX_ECC_SM2: /* GB/T 38636 */ |
12775 | 0 | dissect_ssl3_hnd_srv_keyex_ecc_sm2(hf, tvb, pinfo, tree, offset, offset_end, session->version); |
12776 | 0 | break; |
12777 | 0 | case KEX_SRP_SHA: /* RFC 5054; srp: ServerSRPParams, Signature */ |
12778 | 0 | case KEX_SRP_SHA_DSS: |
12779 | 0 | case KEX_SRP_SHA_RSA: |
12780 | | /* XXX: implement support for SRP_SHA* */ |
12781 | 0 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12782 | 0 | tvb, offset, offset_end - offset, |
12783 | 0 | "SRP_SHA ciphersuites (RFC 5054) are not implemented, contact Wireshark" |
12784 | 0 | " developers if you want them to be supported"); |
12785 | 0 | break; |
12786 | 0 | case KEX_ECJPAKE: /* https://tools.ietf.org/html/draft-cragie-tls-ecjpake-01 used in Thread Commissioning */ |
12787 | 0 | dissect_ssl3_hnd_srv_keyex_ecjpake(hf, tvb, tree, offset, offset_end); |
12788 | 0 | break; |
12789 | 0 | default: |
12790 | 0 | if (session->cipher == 0) { |
12791 | 0 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12792 | 0 | tvb, offset, offset_end - offset, |
12793 | 0 | "Cipher Suite not found"); |
12794 | 0 | } else { |
12795 | 0 | proto_tree_add_expert_format(tree, NULL, &hf->ei.hs_ciphersuite_undecoded, |
12796 | 0 | tvb, offset, offset_end - offset, |
12797 | 0 | "Cipher Suite 0x%04x is not implemented, " |
12798 | 0 | "contact Wireshark developers if you want this to be supported", |
12799 | 0 | session->cipher); |
12800 | 0 | } |
12801 | 0 | break; |
12802 | 0 | } |
12803 | 0 | } |
12804 | | /* Client Key Exchange and Server Key Exchange handshake dissections. }}} */ |
12805 | | |
12806 | | void |
12807 | | tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb, |
12808 | | proto_tree *tree, uint32_t offset) |
12809 | 4 | { |
12810 | | /* RFC 8446 Section 4.6.3 |
12811 | | * enum { |
12812 | | * update_not_requested(0), update_requested(1), (255) |
12813 | | * } KeyUpdateRequest; |
12814 | | * |
12815 | | * struct { |
12816 | | * KeyUpdateRequest request_update; |
12817 | | * } KeyUpdate; |
12818 | | */ |
12819 | 4 | proto_tree_add_item(tree, hf->hf.hs_key_update_request_update, tvb, offset, 1, ENC_NA); |
12820 | 4 | } |
12821 | | |
12822 | | void |
12823 | | ssl_common_register_ssl_alpn_dissector_table(const char *name, |
12824 | | const char *ui_name, const int proto) |
12825 | 14 | { |
12826 | 14 | ssl_alpn_dissector_table = register_dissector_table(name, ui_name, |
12827 | 14 | proto, FT_STRING, STRING_CASE_SENSITIVE); |
12828 | 14 | register_dissector_table_alias(ssl_alpn_dissector_table, "ssl.handshake.extensions_alpn_str"); |
12829 | 14 | } |
12830 | | |
12831 | | void |
12832 | | ssl_common_register_dtls_alpn_dissector_table(const char *name, |
12833 | | const char *ui_name, const int proto) |
12834 | 14 | { |
12835 | 14 | dtls_alpn_dissector_table = register_dissector_table(name, ui_name, |
12836 | 14 | proto, FT_STRING, STRING_CASE_SENSITIVE); |
12837 | 14 | register_dissector_table_alias(ssl_alpn_dissector_table, "dtls.handshake.extensions_alpn_str"); |
12838 | 14 | } |
12839 | | |
12840 | | void |
12841 | | ssl_common_register_options(module_t *module, ssl_common_options_t *options, bool is_dtls) |
12842 | 28 | { |
12843 | 28 | prefs_register_string_preference(module, "psk", "Pre-Shared Key", |
12844 | 28 | "Pre-Shared Key as HEX string. Should be 0 to 16 bytes.", |
12845 | 28 | &(options->psk)); |
12846 | | |
12847 | 28 | if (is_dtls) { |
12848 | 14 | prefs_register_obsolete_preference(module, "keylog_file"); |
12849 | 14 | prefs_register_static_text_preference(module, "keylog_file_removed", |
12850 | 14 | "The (Pre)-Master-Secret log filename preference can be configured in the TLS protocol preferences.", |
12851 | 14 | "Use the TLS protocol preference to configure the keylog file for both DTLS and TLS."); |
12852 | 14 | return; |
12853 | 14 | } |
12854 | | |
12855 | 14 | prefs_register_filename_preference(module, "keylog_file", "(Pre)-Master-Secret log filename", |
12856 | 14 | "The name of a file which contains a list of \n" |
12857 | 14 | "(pre-)master secrets in one of the following formats:\n" |
12858 | 14 | "\n" |
12859 | 14 | "RSA <EPMS> <PMS>\n" |
12860 | 14 | "RSA Session-ID:<SSLID> Master-Key:<MS>\n" |
12861 | 14 | "CLIENT_RANDOM <CRAND> <MS>\n" |
12862 | 14 | "PMS_CLIENT_RANDOM <CRAND> <PMS>\n" |
12863 | 14 | "\n" |
12864 | 14 | "Where:\n" |
12865 | 14 | "<EPMS> = First 8 bytes of the Encrypted PMS\n" |
12866 | 14 | "<PMS> = The Pre-Master-Secret (PMS) used to derive the MS\n" |
12867 | 14 | "<SSLID> = The SSL Session ID\n" |
12868 | 14 | "<MS> = The Master-Secret (MS)\n" |
12869 | 14 | "<CRAND> = The Client's random number from the ClientHello message\n" |
12870 | 14 | "\n" |
12871 | 14 | "(All fields are in hex notation)", |
12872 | 14 | &(options->keylog_filename), false); |
12873 | 14 | } |
12874 | | |
12875 | | void |
12876 | | ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, uint32_t offset, uint32_t length) |
12877 | 524 | { |
12878 | 524 | if (ssl_session && ssl_session->session.version != TLSV1DOT3_VERSION && !(ssl_session->state & SSL_MASTER_SECRET)) { |
12879 | 524 | uint32_t old_length = ssl_session->handshake_data.data_len; |
12880 | 524 | ssl_debug_printf("Calculating hash with offset %d %d\n", offset, length); |
12881 | 524 | if (tvb) { |
12882 | 524 | if (tvb_bytes_exist(tvb, offset, length)) { |
12883 | 286 | ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length); |
12884 | 286 | tvb_memcpy(tvb, ssl_session->handshake_data.data + old_length, offset, length); |
12885 | 286 | ssl_session->handshake_data.data_len += length; |
12886 | 286 | } |
12887 | 524 | } else { |
12888 | | /* DTLS calculates the hash as if each handshake message had been |
12889 | | * sent as a single fragment (RFC 6347, section 4.2.6) and passes |
12890 | | * in a null tvbuff to add 3 bytes for a zero fragment offset. |
12891 | | */ |
12892 | 0 | DISSECTOR_ASSERT_CMPINT(length, <, 4); |
12893 | 0 | ssl_session->handshake_data.data = (unsigned char *)wmem_realloc(wmem_file_scope(), ssl_session->handshake_data.data, old_length + length); |
12894 | 0 | memset(ssl_session->handshake_data.data + old_length, 0, length); |
12895 | 0 | ssl_session->handshake_data.data_len += length; |
12896 | 0 | } |
12897 | 524 | } |
12898 | 524 | } |
12899 | | |
12900 | | |
12901 | | /* |
12902 | | * Editor modelines - https://www.wireshark.org/tools/modelines.html |
12903 | | * |
12904 | | * Local variables: |
12905 | | * c-basic-offset: 4 |
12906 | | * tab-width: 8 |
12907 | | * indent-tabs-mode: nil |
12908 | | * End: |
12909 | | * |
12910 | | * vi: set shiftwidth=4 tabstop=8 expandtab: |
12911 | | * :indentSize=4:tabSize=8:noTabs=true: |
12912 | | */ |