Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-tls-utils.h
1 /* packet-tls-utils.h
2  * ssl manipulation functions
3  * By Paolo Abeni <paolo.abeni@email.com>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_TLS_UTILS_H__
13 #define __PACKET_TLS_UTILS_H__
14 
15 #include <stdio.h> /* some APIs we declare take a stdio stream as an argument */
16 
17 #include <glib.h>
18 #include <epan/packet.h>
19 #include <epan/prefs.h>
20 #include <epan/wmem_scopes.h>
21 #include <epan/expert.h>
22 #include <epan/conversation.h>
23 #include <epan/unit_strings.h>
24 #include <wsutil/wsgcrypt.h>
25 
26 #ifdef HAVE_LIBGNUTLS
27 #include <gnutls/x509.h>
28 #include <gnutls/pkcs12.h>
29 #endif /* HAVE_LIBGNUTLS */
30 
31 /* TODO inline this now that Libgcrypt is mandatory? */
32 #define SSL_CIPHER_CTX gcry_cipher_hd_t
33 #define SSL_DECRYPT_DEBUG
34 
35 
36 /* other defines */
37 typedef enum {
38  SSL_ID_CHG_CIPHER_SPEC = 0x14,
39  SSL_ID_ALERT = 0x15,
40  SSL_ID_HANDSHAKE = 0x16,
41  SSL_ID_APP_DATA = 0x17,
42  SSL_ID_HEARTBEAT = 0x18,
43  SSL_ID_TLS12_CID = 0x19,
44  SSL_ID_DTLS13_ACK = 0x1A,
45 } ContentType;
46 
47 typedef enum {
48  SSL_HND_HELLO_REQUEST = 0,
49  SSL_HND_CLIENT_HELLO = 1,
50  SSL_HND_SERVER_HELLO = 2,
51  SSL_HND_HELLO_VERIFY_REQUEST = 3,
52  SSL_HND_NEWSESSION_TICKET = 4,
53  SSL_HND_END_OF_EARLY_DATA = 5,
54  SSL_HND_HELLO_RETRY_REQUEST = 6,
55  SSL_HND_ENCRYPTED_EXTENSIONS = 8,
56  SSL_HND_CERTIFICATE = 11,
57  SSL_HND_SERVER_KEY_EXCHG = 12,
58  SSL_HND_CERT_REQUEST = 13,
59  SSL_HND_SVR_HELLO_DONE = 14,
60  SSL_HND_CERT_VERIFY = 15,
61  SSL_HND_CLIENT_KEY_EXCHG = 16,
62  SSL_HND_FINISHED = 20,
63  SSL_HND_CERT_URL = 21,
64  SSL_HND_CERT_STATUS = 22,
65  SSL_HND_SUPPLEMENTAL_DATA = 23,
66  SSL_HND_KEY_UPDATE = 24,
67  SSL_HND_COMPRESSED_CERTIFICATE = 25,
68  /* Encrypted Extensions was NextProtocol in draft-agl-tls-nextprotoneg-03
69  * and changed in draft 04. Not to be confused with TLS 1.3 EE. */
70  SSL_HND_ENCRYPTED_EXTS = 67
71 } HandshakeType;
72 
73 #define SSL2_HND_ERROR 0x00
74 #define SSL2_HND_CLIENT_HELLO 0x01
75 #define SSL2_HND_CLIENT_MASTER_KEY 0x02
76 #define SSL2_HND_CLIENT_FINISHED 0x03
77 #define SSL2_HND_SERVER_HELLO 0x04
78 #define SSL2_HND_SERVER_VERIFY 0x05
79 #define SSL2_HND_SERVER_FINISHED 0x06
80 #define SSL2_HND_REQUEST_CERTIFICATE 0x07
81 #define SSL2_HND_CLIENT_CERTIFICATE 0x08
82 
83 #define SSL_HND_HELLO_EXT_SERVER_NAME 0
84 #define SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH 1
85 #define SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL 2
86 #define SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS 3
87 #define SSL_HND_HELLO_EXT_TRUNCATED_HMAC 4
88 #define SSL_HND_HELLO_EXT_STATUS_REQUEST 5
89 #define SSL_HND_HELLO_EXT_USER_MAPPING 6
90 #define SSL_HND_HELLO_EXT_CLIENT_AUTHZ 7
91 #define SSL_HND_HELLO_EXT_SERVER_AUTHZ 8
92 #define SSL_HND_HELLO_EXT_CERT_TYPE 9
93 #define SSL_HND_HELLO_EXT_SUPPORTED_GROUPS 10 /* renamed from "elliptic_curves" (RFC 7919 / TLS 1.3) */
94 #define SSL_HND_HELLO_EXT_EC_POINT_FORMATS 11
95 #define SSL_HND_HELLO_EXT_SRP 12
96 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS 13
97 #define SSL_HND_HELLO_EXT_USE_SRTP 14
98 #define SSL_HND_HELLO_EXT_HEARTBEAT 15
99 #define SSL_HND_HELLO_EXT_ALPN 16
100 #define SSL_HND_HELLO_EXT_STATUS_REQUEST_V2 17
101 #define SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP 18
102 #define SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE 19
103 #define SSL_HND_HELLO_EXT_SERVER_CERT_TYPE 20
104 #define SSL_HND_HELLO_EXT_PADDING 21
105 #define SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC 22
106 #define SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET 23
107 #define SSL_HND_HELLO_EXT_TOKEN_BINDING 24
108 #define SSL_HND_HELLO_EXT_CACHED_INFO 25
109 #define SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE 27
110 #define SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT 28
111 /* 26-33 Unassigned*/
112 #define SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS 34 /* draft-ietf-tls-subcerts-10.txt */
113 #define SSL_HND_HELLO_EXT_SESSION_TICKET_TLS 35
114 /* RFC 8446 (TLS 1.3) */
115 #define SSL_HND_HELLO_EXT_KEY_SHARE_OLD 40 /* draft-ietf-tls-tls13-22 (removed in -23) */
116 #define SSL_HND_HELLO_EXT_PRE_SHARED_KEY 41
117 #define SSL_HND_HELLO_EXT_EARLY_DATA 42
118 #define SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS 43
119 #define SSL_HND_HELLO_EXT_COOKIE 44
120 #define SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES 45
121 #define SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO 46 /* draft-ietf-tls-tls13-18 (removed in -19) */
122 #define SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES 47
123 #define SSL_HND_HELLO_EXT_OID_FILTERS 48
124 #define SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH 49
125 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT 50
126 #define SSL_HND_HELLO_EXT_KEY_SHARE 51
127 #define SSL_HND_HELLO_EXT_TRANSPARENCY_INFO 52 /* draft-ietf-trans-rfc6962-bis-41 */
128 #define SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED 53 /* draft-ietf-tls-dtls-connection-id-07 */
129 #define SSL_HND_HELLO_EXT_CONNECTION_ID 54
130 #define SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH 55 /* RFC 8844 */
131 #define SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID 56 /* RFC 8844 */
132 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1 57 /* draft-ietf-quic-tls-33 */
133 #define SSL_HND_HELLO_EXT_TICKET_REQUEST 58 /* draft-ietf-tls-ticketrequests-07 */
134 #define SSL_HND_HELLO_EXT_DNSSEC_CHAIN 59 /* RFC 9102 */
135 #define SSL_HND_HELLO_EXT_GREASE_0A0A 2570
136 #define SSL_HND_HELLO_EXT_GREASE_1A1A 6682
137 #define SSL_HND_HELLO_EXT_GREASE_2A2A 10794
138 #define SSL_HND_HELLO_EXT_NPN 13172 /* 0x3374 */
139 #define SSL_HND_HELLO_EXT_GREASE_3A3A 14906
140 #define SSL_HND_HELLO_EXT_ALPS 17513 /* draft-vvv-tls-alps-01, temporary value used in BoringSSL implementation */
141 #define SSL_HND_HELLO_EXT_GREASE_4A4A 19018
142 #define SSL_HND_HELLO_EXT_GREASE_5A5A 23130
143 #define SSL_HND_HELLO_EXT_GREASE_6A6A 27242
144 #define SSL_HND_HELLO_EXT_CHANNEL_ID_OLD 30031 /* 0x754f */
145 #define SSL_HND_HELLO_EXT_CHANNEL_ID 30032 /* 0x7550 */
146 #define SSL_HND_HELLO_EXT_GREASE_7A7A 31354
147 #define SSL_HND_HELLO_EXT_GREASE_8A8A 35466
148 #define SSL_HND_HELLO_EXT_GREASE_9A9A 39578
149 #define SSL_HND_HELLO_EXT_GREASE_AAAA 43690
150 #define SSL_HND_HELLO_EXT_GREASE_BABA 47802
151 #define SSL_HND_HELLO_EXT_GREASE_CACA 51914
152 #define SSL_HND_HELLO_EXT_GREASE_DADA 56026
153 #define SSL_HND_HELLO_EXT_GREASE_EAEA 60138
154 #define SSL_HND_HELLO_EXT_GREASE_FAFA 64250
155 #define SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO 65037 /* 0xfe0d draft-ietf-tls-esni-16 */
156 #define SSL_HND_HELLO_EXT_RENEGOTIATION_INFO 65281 /* 0xFF01 */
157 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS 65445 /* 0xffa5 draft-ietf-quic-tls-13 */
158 #define SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME 65486 /* 0xffce draft-ietf-tls-esni-01 */
159 
160 #define SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT 1
161 #define SSL_HND_CERT_URL_TYPE_PKIPATH 2
162 #define SSL_HND_CERT_STATUS_TYPE_OCSP 1
163 #define SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI 2
164 #define SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY 2
165 
166 /* https://github.com/quicwg/base-drafts/wiki/Temporary-IANA-Registry#quic-transport-parameters */
167 #define SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID 0x00
168 #define SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT 0x01
169 #define SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN 0x02
170 #define SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE 0x03
171 #define SSL_HND_QUIC_TP_INITIAL_MAX_DATA 0x04
172 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL 0x05
173 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE 0x06
174 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI 0x07
175 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI 0x08
176 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI 0x09
177 #define SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT 0x0a
178 #define SSL_HND_QUIC_TP_MAX_ACK_DELAY 0x0b
179 #define SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION 0x0c
180 #define SSL_HND_QUIC_TP_PREFERRED_ADDRESS 0x0d
181 #define SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT 0x0e
182 #define SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID 0x0f
183 #define SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID 0x10
184 #define SSL_HND_QUIC_TP_VERSION_INFORMATION 0x11 /* https://tools.ietf.org/html/draft-ietf-quic-version-negotiation-14 */
185 #define SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE 0x20 /* https://datatracker.ietf.org/doc/html/draft-ietf-quic-datagram-06 */
186 #define SSL_HND_QUIC_TP_CIBIR_ENCODING 0x1000 /* https://datatracker.ietf.org/doc/html/draft-banks-quic-cibir-01 */
187 #define SSL_HND_QUIC_TP_LOSS_BITS 0x1057 /* https://tools.ietf.org/html/draft-ferrieuxhamchaoui-quic-lossbits-03 */
188 #define SSL_HND_QUIC_TP_GREASE_QUIC_BIT 0x2ab2 /* RFC 9287 */
189 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP 0x7157 /* https://tools.ietf.org/html/draft-huitema-quic-ts-02 */
190 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2 0x7158 /* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
191 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD 0xde1a /* https://tools.ietf.org/html/draft-iyengar-quic-delayed-ack-00 */
192 /* https://quiche.googlesource.com/quiche/+/refs/heads/master/quic/core/crypto/transport_parameters.cc */
193 #define SSL_HND_QUIC_TP_GOOGLE_USER_AGENT 0x3129
194 #define SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED 0x312B
195 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION 0x4752
196 #define SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT 0x3127
197 #define SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE 0x312A
198 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS 0x4751
199 #define SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS 0x3128
200 /* https://github.com/facebookincubator/mvfst/blob/master/quic/QuicConstants.h */
201 #define SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY 0xFF00
202 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1 0xFF03DE1A /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-01 */
203 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05 0xff04de1a /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-04 / draft-05 */
204 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY 0xff04de1b /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-07 */
205 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04 0x0f739bbc1b666d04 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-04 */
206 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05 0x0f739bbc1b666d05 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-05 */
207 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH 0x0f739bbc1b666d06 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-06 */
208 #define SSL_HND_QUIC_TP_INITIAL_MAX_PATHS 0x0f739bbc1b666d07 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-07 */
209 /*
210  * Lookup tables
211  */
212 extern const value_string ssl_version_short_names[];
213 extern const value_string ssl_20_msg_types[];
214 extern value_string_ext ssl_20_cipher_suites_ext;
215 extern const value_string ssl_20_certificate_type[];
216 extern const value_string ssl_31_content_type[];
217 extern const value_string ssl_versions[];
218 extern const value_string ssl_31_change_cipher_spec[];
219 extern const value_string ssl_31_alert_level[];
220 extern const value_string ssl_31_alert_description[];
221 extern const value_string ssl_31_handshake_type[];
222 extern const value_string tls_heartbeat_type[];
223 extern const value_string tls_heartbeat_mode[];
224 extern const value_string ssl_31_compression_method[];
225 extern const value_string ssl_31_key_exchange_algorithm[];
226 extern const value_string ssl_31_signature_algorithm[];
227 extern const value_string ssl_31_client_certificate_type[];
228 extern const value_string ssl_31_public_value_encoding[];
229 extern value_string_ext ssl_31_ciphersuite_ext;
230 extern const value_string tls_hello_extension_types[];
231 extern const value_string tls_hash_algorithm[];
232 extern const value_string tls_signature_algorithm[];
233 extern const value_string tls13_signature_algorithm[];
234 extern const value_string tls_certificate_type[];
235 extern const value_string tls_cert_chain_type[];
236 extern const value_string tls_cert_status_type[];
237 extern const value_string ssl_extension_curves[];
238 extern const value_string ssl_extension_ec_point_formats[];
239 extern const value_string ssl_curve_types[];
240 extern const value_string tls_hello_ext_server_name_type_vs[];
241 extern const value_string tls_hello_ext_max_fragment_length[];
242 extern const value_string tls_hello_ext_psk_ke_mode[];
243 extern const value_string tls13_key_update_request[];
244 extern const value_string compress_certificate_algorithm_vals[];
245 extern const val64_string quic_transport_parameter_id[];
246 extern const range_string quic_version_vals[];
247 extern const val64_string quic_enable_time_stamp_v2_vals[];
248 extern const val64_string quic_enable_multipath_vals[];
249 extern const value_string tls_hello_ext_ech_clienthello_types[];
250 extern const value_string kem_id_type_vals[];
251 extern const value_string kdf_id_type_vals[];
252 extern const value_string aead_id_type_vals[];
253 extern const value_string token_binding_key_parameter_vals[];
254 
255 /* XXX Should we use GByteArray instead? */
256 typedef struct _StringInfo {
257  guchar *data; /* Backing storage which may be larger than data_len */
258  guint data_len; /* Length of the meaningful part of data */
259 } StringInfo;
260 
261 #define SSL_WRITE_KEY 1
262 
263 #define SSL_VER_UNKNOWN 0
264 #define SSLV2_VERSION 0x0002 /* not in record layer, SSL_CLIENT_SERVER from
265  http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html */
266 #define SSLV3_VERSION 0x300
267 #define TLSV1_VERSION 0x301
268 #define TLCPV1_VERSION 0x101
269 #define TLSV1DOT1_VERSION 0x302
270 #define TLSV1DOT2_VERSION 0x303
271 #define TLSV1DOT3_VERSION 0x304
272 #define DTLSV1DOT0_VERSION 0xfeff
273 #define DTLSV1DOT0_OPENSSL_VERSION 0x100
274 #define DTLSV1DOT2_VERSION 0xfefd
275 #define DTLSV1DOT3_VERSION 0xfefc
276 
277 /* Returns the TLS 1.3 draft version or 0 if not applicable. */
278 static inline guint8 extract_tls13_draft_version(guint32 version) {
279  if ((version & 0xff00) == 0x7f00) {
280  return (guint8) version;
281  }
282  return 0;
283 }
284 
285 
286 #define SSL_CLIENT_RANDOM (1<<0)
287 #define SSL_SERVER_RANDOM (1<<1)
288 #define SSL_CIPHER (1<<2)
289 #define SSL_HAVE_SESSION_KEY (1<<3)
290 #define SSL_VERSION (1<<4)
291 #define SSL_MASTER_SECRET (1<<5)
292 #define SSL_PRE_MASTER_SECRET (1<<6)
293 #define SSL_CLIENT_EXTENDED_MASTER_SECRET (1<<7)
294 #define SSL_SERVER_EXTENDED_MASTER_SECRET (1<<8)
295 #define SSL_NEW_SESSION_TICKET (1<<10)
296 #define SSL_ENCRYPT_THEN_MAC (1<<11)
297 #define SSL_SEEN_0RTT_APPDATA (1<<12)
298 #define SSL_QUIC_RECORD_LAYER (1<<13) /* For QUIC (draft >= -13) */
299 
300 #define SSL_EXTENDED_MASTER_SECRET_MASK (SSL_CLIENT_EXTENDED_MASTER_SECRET|SSL_SERVER_EXTENDED_MASTER_SECRET)
301 
302 /* SSL Cipher Suite modes */
303 typedef enum {
304  MODE_STREAM, /* GenericStreamCipher */
305  MODE_CBC, /* GenericBlockCipher */
306  MODE_GCM, /* GenericAEADCipher */
307  MODE_CCM, /* AEAD_AES_{128,256}_CCM with 16 byte auth tag */
308  MODE_CCM_8, /* AEAD_AES_{128,256}_CCM with 8 byte auth tag */
309  MODE_POLY1305, /* AEAD_CHACHA20_POLY1305 with 16 byte auth tag (RFC 7905) */
310 } ssl_cipher_mode_t;
311 
312 /* Explicit and implicit nonce length (RFC 5116 - Section 3.2.1) */
313 #define IMPLICIT_NONCE_LEN 4
314 #define EXPLICIT_NONCE_LEN 8
315 #define TLS13_AEAD_NONCE_LENGTH 12
316 
317 /* TLS 1.3 Record type for selecting the appropriate secret. */
318 typedef enum {
319  TLS_SECRET_0RTT_APP,
320  TLS_SECRET_HANDSHAKE,
321  TLS_SECRET_APP,
322 } TLSRecordType;
323 
324 #define SSL_DEBUG_USE_STDERR "-"
325 
326 #define SSLV2_MAX_SESSION_ID_LENGTH_IN_BYTES 16
327 
328 /* Record fragment lengths MUST NOT exceed 2^14 (= 0x4000) */
329 #define TLS_MAX_RECORD_LENGTH 0x4000
330 
331 typedef struct _SslCipherSuite {
332  gint number;
333  gint kex;
334  gint enc;
335  gint dig;
336  ssl_cipher_mode_t mode;
338 
339 typedef struct _SslFlow {
340  guint32 byte_seq;
341  guint16 flags;
342  wmem_tree_t *multisegment_pdus;
343 } SslFlow;
344 
345 typedef struct _SslDecompress SslDecompress;
346 
347 typedef struct _SslDecoder {
348  const SslCipherSuite *cipher_suite;
349  gint compression;
350  guchar _mac_key_or_write_iv[48];
351  StringInfo mac_key; /* for block and stream ciphers */
352  StringInfo write_iv; /* for AEAD ciphers (at least GCM, CCM) */
353  SSL_CIPHER_CTX evp;
354  SslDecompress *decomp;
355  guint64 seq;
356  guint16 epoch;
357  SslFlow *flow;
359 } SslDecoder;
360 
361 #define KEX_DHE_DSS 0x10
362 #define KEX_DHE_PSK 0x11
363 #define KEX_DHE_RSA 0x12
364 #define KEX_DH_ANON 0x13
365 #define KEX_DH_DSS 0x14
366 #define KEX_DH_RSA 0x15
367 #define KEX_ECDHE_ECDSA 0x16
368 #define KEX_ECDHE_PSK 0x17
369 #define KEX_ECDHE_RSA 0x18
370 #define KEX_ECDH_ANON 0x19
371 #define KEX_ECDH_ECDSA 0x1a
372 #define KEX_ECDH_RSA 0x1b
373 #define KEX_KRB5 0x1c
374 #define KEX_PSK 0x1d
375 #define KEX_RSA 0x1e
376 #define KEX_RSA_PSK 0x1f
377 #define KEX_SRP_SHA 0x20
378 #define KEX_SRP_SHA_DSS 0x21
379 #define KEX_SRP_SHA_RSA 0x22
380 #define KEX_IS_DH(n) ((n) >= KEX_DHE_DSS && (n) <= KEX_ECDH_RSA)
381 #define KEX_TLS13 0x23
382 #define KEX_ECJPAKE 0x24
383 
384 #define KEX_ECDHE_SM2 0x25
385 #define KEX_ECC_SM2 0x26
386 #define KEX_IBSDH_SM9 0x27
387 #define KEX_IBC_SM9 0x28
388 
389 /* Order is significant, must match "ciphers" array in packet-tls-utils.c */
390 
391 #define ENC_START 0x30
392 #define ENC_DES 0x30
393 #define ENC_3DES 0x31
394 #define ENC_RC4 0x32
395 #define ENC_RC2 0x33
396 #define ENC_IDEA 0x34
397 #define ENC_AES 0x35
398 #define ENC_AES256 0x36
399 #define ENC_CAMELLIA128 0x37
400 #define ENC_CAMELLIA256 0x38
401 #define ENC_SEED 0x39
402 #define ENC_CHACHA20 0x3A
403 #define ENC_SM1 0x3B
404 #define ENC_SM4 0x3C
405 #define ENC_NULL 0x3D
406 
407 
408 #define DIG_MD5 0x40
409 #define DIG_SHA 0x41
410 #define DIG_SHA256 0x42
411 #define DIG_SHA384 0x43
412 #define DIG_SM3 0x44
413 #define DIG_NA 0x45 /* Not Applicable */
414 
415 typedef struct {
416  const gchar *name;
417  guint len;
418 } SslDigestAlgo;
419 
420 typedef struct _SslRecordInfo {
421  guchar *plain_data;
422  guint data_len;
423  gint id;
425  ContentType type;
426  SslFlow *flow;
428  guint32 seq;
429  struct _SslRecordInfo* next;
430 } SslRecordInfo;
431 
436 typedef struct _TlsHsFragment {
437  guint record_id;
440  guint32 offset;
441  guint8 type;
442  int is_last : 1;
443  struct _TlsHsFragment *next;
444 } TlsHsFragment;
445 
446 typedef struct {
447  SslRecordInfo *records;
448  TlsHsFragment *hs_fragments;
449  guint32 srcport;
450  guint32 destport;
451  gint cipher;
453 } SslPacketInfo;
454 
455 typedef struct _SslSession {
456  gint cipher;
457  gint compression;
458  guint16 version;
459  guchar tls13_draft_version;
460  gint8 client_cert_type;
461  gint8 server_cert_type;
462  guint32 client_ccs_frame;
463  guint32 server_ccs_frame;
464 
465  /* The address/proto/port of the server as determined from heuristics
466  * (e.g. ClientHello) or set externally (via ssl_set_master_secret()). */
467  address srv_addr;
468  port_type srv_ptype;
469  guint srv_port;
470 
471  /* The Application layer protocol if known (for STARTTLS support) */
472  dissector_handle_t app_handle;
473  const char *alpn_name;
474  /* The ALPN the client requested, not necessarily the one chosen */
475  const char *client_alpn_name;
476  guint32 last_nontls_frame;
477  gboolean is_session_resumed;
478 
479  /* First pass only: track an in-progress handshake reassembly (>0) */
480  guint32 client_hs_reassembly_id;
481  guint32 server_hs_reassembly_id;
482 
483  /* Connection ID extension
484 
485  struct {
486  opaque cid<0..2^8-1>;
487  } ConnectionId;
488  */
489 
490  guint8 *client_cid;
491  guint8 *server_cid;
492  guint8 client_cid_len;
493  gboolean client_cid_len_present;
494  guint8 server_cid_len;
495  gboolean server_cid_len_present;
496  gboolean deprecated_cid; /* Set when handshake is using the deprecated CID extension type */
497 } SslSession;
498 
499 /* RFC 5246, section 8.1 says that the master secret is always 48 bytes */
500 #define SSL_MASTER_SECRET_LENGTH 48
501 
502 struct cert_key_id; /* defined in epan/secrets.h */
503 
504 /* This holds state information for a SSL conversation */
505 typedef struct _SslDecryptSession {
506  guchar _master_secret[SSL_MASTER_SECRET_LENGTH];
507  guchar _session_id[256];
508  guchar _client_random[32];
509  guchar _server_random[32];
510  StringInfo session_id;
511  StringInfo session_ticket;
512  StringInfo server_random;
513  StringInfo client_random;
514  StringInfo master_secret;
515  StringInfo handshake_data;
516  /* the data store for this StringInfo must be allocated explicitly with a capture lifetime scope */
517  StringInfo pre_master_secret;
518  guchar _server_data_for_iv[24];
519  StringInfo server_data_for_iv;
520  guchar _client_data_for_iv[24];
521  StringInfo client_data_for_iv;
522 
523  gint state;
524  const SslCipherSuite *cipher_suite;
525  SslDecoder *server;
526  SslDecoder *client;
527  SslDecoder *server_new;
528  SslDecoder *client_new;
529 #if defined(HAVE_LIBGNUTLS)
530  struct cert_key_id *cert_key_id;
531 #endif
532  StringInfo psk;
533  StringInfo app_data_segment;
534  SslSession session;
535  gboolean has_early_data;
536 
538 
539 /* RecordNumber - RFC 9147 section 4 */
540 typedef struct {
541  guint64 epoch;
542  guint64 sequence_number;
544 
545 /* User Access Table */
546 typedef struct _ssldecrypt_assoc_t {
547  char* ipaddr;
548  char* port;
549  char* protocol;
550  char* keyfile;
551  char* password;
553 
554 typedef struct ssl_common_options {
555  const gchar *psk;
556  const gchar *keylog_filename;
558 
560 typedef struct {
561  GHashTable *session; /* Session ID (1-32 bytes) to master secret. */
562  GHashTable *tickets; /* Session Ticket to master secret. */
563  GHashTable *crandom; /* Client Random to master secret */
564  GHashTable *pre_master; /* First 8 bytes of encrypted pre-master secret to
565  pre-master secret */
566  GHashTable *pms; /* Client Random to unencrypted pre-master secret */
567 
568  /* For TLS 1.3: maps Client Random to derived secret. */
569  GHashTable *tls13_client_early;
570  GHashTable *tls13_client_handshake;
571  GHashTable *tls13_server_handshake;
572  GHashTable *tls13_client_appdata;
573  GHashTable *tls13_server_appdata;
574  GHashTable *tls13_early_exporter;
575  GHashTable *tls13_exporter;
576 
577  /* The hash tables above store the static keylog file contents and secrets
578  * from any DSB, not all of which may be used, in addition to any master
579  * secrets derived at runtime ([D]TLS < 1.3). These store the used
580  * Client Random for exporting master secrets and derived secrets in
581  * TLS Export Sessions or adding a DSB.
582  */
583  GHashTable *used_crandom;
585 
586 gint ssl_get_keyex_alg(gint cipher);
587 
588 void quic_transport_parameter_id_base_custom(gchar *result, guint64 parameter_id);
589 
590 bool ssldecrypt_uat_fld_ip_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
591 bool ssldecrypt_uat_fld_port_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
592 bool ssldecrypt_uat_fld_fileopen_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
593 bool ssldecrypt_uat_fld_password_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
594 gchar* ssl_association_info(const char* dissector_table_name, const char* table_protocol);
595 
597 void ssl_init_cid_list(void);
598 
600 void ssl_cleanup_cid_list(void);
601 
603 void ssl_add_session_by_cid(SslDecryptSession *ssl);
604 
610 SslDecryptSession *ssl_get_session_by_cid(tvbuff_t *tvb, guint32 offset);
611 
616 extern SslDecryptSession *
617 ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle);
618 
620 extern void
621 ssl_reset_session(SslSession *session, SslDecryptSession *ssl, gboolean is_client);
622 
624 extern void
625 ssl_set_server(SslSession *session, address *addr, port_type ptype, guint32 port);
626 
634 WS_DLL_PUBLIC void
635 tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
636  dissector_handle_t app_handle);
637 
647 WS_DLL_PUBLIC guint32
648 ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
649  dissector_handle_t app_handle);
650 
659 WS_DLL_PUBLIC guint32
660 ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
661  dissector_handle_t app_handle);
662 
663 extern dissector_handle_t
664 ssl_find_appdata_dissector(const char *name);
665 
671 extern void
672 ssl_data_set(StringInfo* buf, const guchar* src, guint len);
673 
677 extern gint
678 ssl_data_alloc(StringInfo* str, size_t len);
679 
680 extern gint
681 ssl_cipher_setiv(SSL_CIPHER_CTX *cipher, guchar* iv, gint iv_len);
682 
686 extern const SslCipherSuite *
687 ssl_find_cipher(int num);
688 
689 
691 int
692 ssl_get_cipher_algo(const SslCipherSuite *cipher_suite);
693 
698 guint
699 ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite);
700 
701 gboolean
702 ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
703  guint32 length, tvbuff_t *tvb, guint32 offset,
704  const gchar *ssl_psk, packet_info *pinfo,
705 #ifdef HAVE_LIBGNUTLS
706  GHashTable *key_hash,
707 #endif
708  const ssl_master_key_map_t *mk_map);
709 
714 extern gint
715 ssl_generate_keyring_material(SslDecryptSession*ssl_session);
716 
717 extern void
718 ssl_change_cipher(SslDecryptSession *ssl_session, gboolean server);
719 
734 extern gint
735 ssl_decrypt_record(SslDecryptSession *ssl, SslDecoder *decoder, guint8 ct, guint16 record_version,
736  gboolean ignore_mac_failed,
737  const guchar *in, guint16 inl, const guchar *cid, guint8 cidl,
738  StringInfo *comp_str, StringInfo *out_str, guint *outl);
739 
740 
741 /* Common part between TLS and DTLS dissectors */
742 
743 /* handling of association between tls/dtls ports and clear text protocol */
744 extern void
745 ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
746 
747 extern void
748 ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
749 
750 extern gint
751 ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo);
752 
753 /* Obtain information about the current TLS layer. */
755 tls_add_packet_info(gint proto, packet_info *pinfo, guint8 curr_layer_num_ssl);
756 
757 /* add to packet data a copy of the specified real data */
758 extern void
759 ssl_add_record_info(gint proto, packet_info *pinfo, const guchar *data, gint data_len, gint record_id, SslFlow *flow, ContentType type, guint8 curr_layer_num_ssl);
760 
761 /* search in packet data for the specified id; return a newly created tvb for the associated data */
762 extern tvbuff_t*
763 ssl_get_record_info(tvbuff_t *parent_tvb, gint proto, packet_info *pinfo, gint record_id, guint8 curr_layer_num_ssl, SslRecordInfo **matched_record);
764 
765 /* initialize/reset per capture state data (ssl sessions cache) */
766 extern void
767 ssl_common_init(ssl_master_key_map_t *master_key_map,
768  StringInfo *decrypted_data, StringInfo *compressed_data);
769 extern void
770 ssl_common_cleanup(ssl_master_key_map_t *master_key_map, FILE **ssl_keylog_file,
771  StringInfo *decrypted_data, StringInfo *compressed_data);
772 
778 WS_DLL_PUBLIC ssl_master_key_map_t *
779 tls_get_master_key_map(gboolean load_secrets);
780 
781 /* Process lines from the TLS key log and populate the secrets map. */
782 extern void
783 tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const guint8 *data, guint len);
784 
785 /* tries to update the secrets cache from the given filename */
786 extern void
787 ssl_load_keyfile(const gchar *ssl_keylog_filename, FILE **keylog_file,
788  const ssl_master_key_map_t *mk_map);
789 
790 #ifdef HAVE_LIBGNUTLS
791 /* parse ssl related preferences (private keys and ports association strings) */
792 extern void
793 ssl_parse_key_list(const ssldecrypt_assoc_t * uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, gboolean tcp);
794 #endif
795 
796 extern void
797 ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
798 
803 extern void
804 tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
805 
806 extern gboolean
807 tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, gboolean is_from_server);
808 
809 extern StringInfo *
810 tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
811  gboolean is_from_server, TLSRecordType type);
812 
813 extern void
814 tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
815  gboolean is_from_server, TLSRecordType type);
816 
817 extern void
818 tls13_key_update(SslDecryptSession *ssl, gboolean is_from_server);
819 
820 extern gboolean
821 ssl_is_valid_content_type(guint8 type);
822 
823 extern gboolean
824 ssl_is_valid_handshake_type(guint8 hs_type, gboolean is_dtls);
825 
826 extern bool
827 tls_scan_server_hello(tvbuff_t *tvb, guint32 offset, guint32 offset_end,
828  guint16 *server_version, bool *is_hrr);
829 
830 extern void
831 ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
832  guint8 content_type, guint8 handshake_type,
833  gboolean is_dtls, guint16 version);
834 
835 extern void
836 ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, guint32 offset, guint32 length);
837 
838 /* common header fields, subtrees and expert info for SSL and DTLS dissectors */
839 typedef struct ssl_common_dissect {
840  struct {
841  gint change_cipher_spec;
842  gint hs_exts_len;
843  gint hs_ext_alpn_len;
844  gint hs_ext_alpn_list;
845  gint hs_ext_alpn_str;
846  gint hs_ext_alpn_str_len;
847  gint hs_ext_cert_url_item;
848  gint hs_ext_cert_url_padding;
849  gint hs_ext_cert_url_sha1;
850  gint hs_ext_cert_url_type;
851  gint hs_ext_cert_url_url;
852  gint hs_ext_cert_url_url_hash_list_len;
853  gint hs_ext_cert_url_url_len;
854  gint hs_ext_cert_status_type;
855  gint hs_ext_cert_status_request_len;
856  gint hs_ext_cert_status_responder_id_list_len;
857  gint hs_ext_cert_status_request_extensions_len;
858  gint hs_ext_cert_status_request_list_len;
859  gint hs_ocsp_response_list_len;
860  gint hs_ocsp_response_len;
861  gint hs_ext_cert_type;
862  gint hs_ext_cert_types;
863  gint hs_ext_cert_types_len;
864  gint hs_ext_data;
865  gint hs_ext_ec_point_format;
866  gint hs_ext_ec_point_formats;
867  gint hs_ext_ec_point_formats_len;
868  gint hs_ext_srp_len;
869  gint hs_ext_srp_username;
870  gint hs_ext_supported_group;
871  gint hs_ext_supported_groups;
872  gint hs_ext_supported_groups_len;
873  gint hs_ext_heartbeat_mode;
874  gint hs_ext_len;
875  gint hs_ext_npn_str;
876  gint hs_ext_npn_str_len;
877  gint hs_ext_reneg_info_len;
878  gint hs_ext_reneg_info;
879  gint hs_ext_key_share_client_length;
880  gint hs_ext_key_share_group;
881  gint hs_ext_key_share_key_exchange_length;
882  gint hs_ext_key_share_key_exchange;
883  gint hs_ext_key_share_selected_group;
884  gint hs_ext_psk_identities_length;
885  gint hs_ext_psk_identity_identity_length;
886  gint hs_ext_psk_identity_identity;
887  gint hs_ext_psk_identity_obfuscated_ticket_age;
888  gint hs_ext_psk_binders_length;
889  gint hs_ext_psk_binders;
890  gint hs_ext_psk_identity_selected;
891  gint hs_ext_session_ticket;
892  gint hs_ext_supported_versions_len;
893  gint hs_ext_supported_version;
894  gint hs_ext_cookie_len;
895  gint hs_ext_cookie;
896  gint hs_ext_server_name;
897  gint hs_ext_server_name_len;
898  gint hs_ext_server_name_list_len;
899  gint hs_ext_server_name_type;
900  gint hs_ext_max_fragment_length;
901  gint hs_ext_padding_data;
902  gint hs_ext_type;
903  gint hs_ext_connection_id_length;
904  gint hs_ext_connection_id;
905  gint hs_sig_hash_alg;
906  gint hs_sig_hash_alg_len;
907  gint hs_sig_hash_algs;
908  gint hs_sig_hash_hash;
909  gint hs_sig_hash_sig;
910  gint hs_client_keyex_epms_len;
911  gint hs_client_keyex_epms;
912  gint hs_server_keyex_modulus_len;
913  gint hs_server_keyex_exponent_len;
914  gint hs_server_keyex_sig_len;
915  gint hs_server_keyex_p_len;
916  gint hs_server_keyex_g_len;
917  gint hs_server_keyex_ys_len;
918  gint hs_client_keyex_yc_len;
919  gint hs_client_keyex_point_len;
920  gint hs_server_keyex_point_len;
921  gint hs_server_keyex_p;
922  gint hs_server_keyex_g;
923  gint hs_server_keyex_curve_type;
924  gint hs_server_keyex_named_curve;
925  gint hs_server_keyex_ys;
926  gint hs_client_keyex_yc;
927  gint hs_server_keyex_point;
928  gint hs_client_keyex_point;
929  gint hs_server_keyex_xs_len;
930  gint hs_client_keyex_xc_len;
931  gint hs_server_keyex_xs;
932  gint hs_client_keyex_xc;
933  gint hs_server_keyex_vs_len;
934  gint hs_client_keyex_vc_len;
935  gint hs_server_keyex_vs;
936  gint hs_client_keyex_vc;
937  gint hs_server_keyex_rs_len;
938  gint hs_client_keyex_rc_len;
939  gint hs_server_keyex_rs;
940  gint hs_client_keyex_rc;
941  gint hs_server_keyex_modulus;
942  gint hs_server_keyex_exponent;
943  gint hs_server_keyex_sig;
944  gint hs_server_keyex_hint_len;
945  gint hs_server_keyex_hint;
946  gint hs_client_keyex_identity_len;
947  gint hs_client_keyex_identity;
948  gint hs_certificates_len;
949  gint hs_certificates;
950  gint hs_certificate_len;
951  gint hs_certificate;
952  gint hs_cert_types_count;
953  gint hs_cert_types;
954  gint hs_cert_type;
955  gint hs_dnames_len;
956  gint hs_dnames;
957  gint hs_dnames_truncated;
958  gint hs_dname_len;
959  gint hs_dname;
960  gint hs_random;
961  gint hs_random_time;
962  gint hs_random_bytes;
963  gint hs_session_id;
964  gint hs_session_id_len;
965  gint hs_client_version;
966  gint hs_server_version;
967  gint hs_cipher_suites_len;
968  gint hs_cipher_suites;
969  gint hs_cipher_suite;
970  gint hs_comp_methods_len;
971  gint hs_comp_methods;
972  gint hs_comp_method;
973  gint hs_session_ticket_lifetime_hint;
974  gint hs_session_ticket_age_add;
975  gint hs_session_ticket_nonce_len;
976  gint hs_session_ticket_nonce;
977  gint hs_session_ticket_len;
978  gint hs_session_ticket;
979  gint hs_finished;
980  gint hs_client_cert_vrfy_sig_len;
981  gint hs_client_cert_vrfy_sig;
982  gint hs_ja3_full;
983  gint hs_ja3_hash;
984  gint hs_ja3s_full;
985  gint hs_ja3s_hash;
986  gint hs_ja4;
987  gint hs_ja4_r;
988 
989  /* TLS 1.3 */
990  gint hs_ext_psk_ke_modes_length;
991  gint hs_ext_psk_ke_mode;
992  gint hs_certificate_request_context_length;
993  gint hs_certificate_request_context;
994  gint hs_key_update_request_update;
995  gint sct_scts_length;
996  gint sct_sct_length;
997  gint sct_sct_version;
998  gint sct_sct_logid;
999  gint sct_sct_timestamp;
1000  gint sct_sct_extensions_length;
1001  gint sct_sct_extensions;
1002  gint sct_sct_signature;
1003  gint sct_sct_signature_length;
1004  gint hs_ext_max_early_data_size;
1005  gint hs_ext_oid_filters_length;
1006  gint hs_ext_oid_filters_oid_length;
1007  gint hs_ext_oid_filters_oid;
1008  gint hs_ext_oid_filters_values_length;
1009  gint hs_cred_valid_time;
1010  gint hs_cred_pubkey;
1011  gint hs_cred_pubkey_len;
1012  gint hs_cred_signature;
1013  gint hs_cred_signature_len;
1014 
1015  /* compress_certificate */
1016  gint hs_ext_compress_certificate_algorithms_length;
1017  gint hs_ext_compress_certificate_algorithm;
1018  gint hs_ext_compress_certificate_uncompressed_length;
1019  gint hs_ext_compress_certificate_compressed_certificate_message_length;
1020  gint hs_ext_compress_certificate_compressed_certificate_message;
1021 
1022  /* Token Binding Negotiation */
1023  gint hs_ext_token_binding_version_major;
1024  gint hs_ext_token_binding_version_minor;
1025  gint hs_ext_token_binding_key_parameters;
1026  gint hs_ext_token_binding_key_parameters_length;
1027  gint hs_ext_token_binding_key_parameter;
1028 
1029  gint hs_ext_record_size_limit;
1030 
1031  /* QUIC Transport Parameters */
1032  gint hs_ext_quictp_len;
1033  gint hs_ext_quictp_parameter;
1034  gint hs_ext_quictp_parameter_type;
1035  gint hs_ext_quictp_parameter_len;
1036  gint hs_ext_quictp_parameter_len_old;
1037  gint hs_ext_quictp_parameter_value;
1038  gint hs_ext_quictp_parameter_original_destination_connection_id;
1039  gint hs_ext_quictp_parameter_max_idle_timeout;
1040  gint hs_ext_quictp_parameter_stateless_reset_token;
1041  gint hs_ext_quictp_parameter_initial_max_data;
1042  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_local;
1043  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote;
1044  gint hs_ext_quictp_parameter_initial_max_stream_data_uni;
1045  gint hs_ext_quictp_parameter_initial_max_streams_bidi;
1046  gint hs_ext_quictp_parameter_initial_max_streams_uni;
1047  gint hs_ext_quictp_parameter_ack_delay_exponent;
1048  gint hs_ext_quictp_parameter_max_ack_delay;
1049  gint hs_ext_quictp_parameter_max_udp_payload_size;
1050  gint hs_ext_quictp_parameter_pa_ipv4address;
1051  gint hs_ext_quictp_parameter_pa_ipv6address;
1052  gint hs_ext_quictp_parameter_pa_ipv4port;
1053  gint hs_ext_quictp_parameter_pa_ipv6port;
1054  gint hs_ext_quictp_parameter_pa_connectionid_length;
1055  gint hs_ext_quictp_parameter_pa_connectionid;
1056  gint hs_ext_quictp_parameter_pa_statelessresettoken;
1057  gint hs_ext_quictp_parameter_active_connection_id_limit;
1058  gint hs_ext_quictp_parameter_initial_source_connection_id;
1059  gint hs_ext_quictp_parameter_retry_source_connection_id;
1060  gint hs_ext_quictp_parameter_max_datagram_frame_size;
1061  gint hs_ext_quictp_parameter_cibir_encoding_length;
1062  gint hs_ext_quictp_parameter_cibir_encoding_offset;
1063  gint hs_ext_quictp_parameter_loss_bits;
1064  gint hs_ext_quictp_parameter_enable_time_stamp_v2;
1065  gint hs_ext_quictp_parameter_min_ack_delay;
1066  gint hs_ext_quictp_parameter_google_user_agent_id;
1067  gint hs_ext_quictp_parameter_google_key_update_not_yet_supported;
1068  gint hs_ext_quictp_parameter_google_quic_version;
1069  gint hs_ext_quictp_parameter_google_initial_rtt;
1070  gint hs_ext_quictp_parameter_google_support_handshake_done;
1071  gint hs_ext_quictp_parameter_google_quic_params;
1072  gint hs_ext_quictp_parameter_google_quic_params_unknown_field;
1073  gint hs_ext_quictp_parameter_google_connection_options;
1074  gint hs_ext_quictp_parameter_google_supported_versions_length;
1075  gint hs_ext_quictp_parameter_google_supported_version;
1076  gint hs_ext_quictp_parameter_facebook_partial_reliability;
1077  gint hs_ext_quictp_parameter_chosen_version;
1078  gint hs_ext_quictp_parameter_other_version;
1079  gint hs_ext_quictp_parameter_enable_multipath;
1080  gint hs_ext_quictp_parameter_initial_max_paths;
1081 
1082  gint esni_suite;
1083  gint esni_record_digest_length;
1084  gint esni_record_digest;
1085  gint esni_encrypted_sni_length;
1086  gint esni_encrypted_sni;
1087  gint esni_nonce;
1088 
1089  gint ech_echconfiglist_length;
1090  gint ech_echconfiglist;
1091  gint ech_echconfig;
1092  gint ech_echconfig_version;
1093  gint ech_echconfig_length;
1094  gint ech_echconfigcontents_maximum_name_length;
1095  gint ech_echconfigcontents_public_name_length;
1096  gint ech_echconfigcontents_public_name;
1097  gint ech_echconfigcontents_extensions_length;
1098  gint ech_echconfigcontents_extensions;
1099  gint ech_hpke_keyconfig;
1100  gint ech_hpke_keyconfig_config_id;
1101  gint ech_hpke_keyconfig_kem_id;
1102  gint ech_hpke_keyconfig_public_key_length;
1103  gint ech_hpke_keyconfig_public_key;
1104  gint ech_hpke_keyconfig_cipher_suites;
1105  gint ech_hpke_keyconfig_cipher_suites_length;
1106  gint ech_hpke_keyconfig_cipher_suite;
1107  gint ech_hpke_keyconfig_cipher_suite_kdf_id;
1108  gint ech_hpke_keyconfig_cipher_suite_aead_id;
1109  gint ech_clienthello_type;
1110  gint ech_cipher_suite;
1111  gint ech_config_id;
1112  gint ech_enc_length;
1113  gint ech_enc;
1114  gint ech_payload_length;
1115  gint ech_payload;
1116  gint ech_confirmation;
1117  gint ech_retry_configs;
1118 
1119  gint hs_ext_alps_len;
1120  gint hs_ext_alps_alpn_list;
1121  gint hs_ext_alps_alpn_str;
1122  gint hs_ext_alps_alpn_str_len;
1123  gint hs_ext_alps_settings;
1124 
1125  /* do not forget to update SSL_COMMON_HF_LIST! */
1126  } hf;
1127  struct {
1128  gint hs_ext;
1129  gint hs_ext_alpn;
1130  gint hs_ext_cert_types;
1131  gint hs_ext_groups;
1132  gint hs_ext_curves_point_formats;
1133  gint hs_ext_npn;
1134  gint hs_ext_reneg_info;
1135  gint hs_ext_key_share;
1136  gint hs_ext_key_share_ks;
1137  gint hs_ext_pre_shared_key;
1138  gint hs_ext_psk_identity;
1139  gint hs_ext_server_name;
1140  gint hs_ext_oid_filter;
1141  gint hs_ext_quictp_parameter;
1142  gint hs_sig_hash_alg;
1143  gint hs_sig_hash_algs;
1144  gint urlhash;
1145  gint keyex_params;
1146  gint certificates;
1147  gint cert_types;
1148  gint dnames;
1149  gint hs_random;
1150  gint cipher_suites;
1151  gint comp_methods;
1152  gint session_ticket;
1153  gint sct;
1154  gint cert_status;
1155  gint ocsp_response;
1156  gint uncompressed_certificates;
1157  gint hs_ext_alps;
1158  gint ech_echconfiglist;
1159  gint ech_echconfig;
1160  gint ech_retry_configs;
1161  gint ech_hpke_keyconfig;
1162  gint ech_hpke_cipher_suites;
1163  gint ech_hpke_cipher_suite;
1164  gint hs_ext_token_binding_key_parameters;
1165 
1166  /* do not forget to update SSL_COMMON_ETT_LIST! */
1167  } ett;
1168  struct {
1169  /* Generic expert info for malformed packets. */
1170  expert_field client_version_error;
1171  expert_field server_version_error;
1172  expert_field legacy_version;
1173  expert_field malformed_vector_length;
1174  expert_field malformed_buffer_too_small;
1175  expert_field malformed_trailing_data;
1176 
1177  expert_field hs_ext_cert_status_undecoded;
1178  expert_field hs_ciphersuite_undecoded;
1179  expert_field hs_srv_keyex_illegal;
1180  expert_field resumed;
1181  expert_field record_length_invalid;
1182  expert_field decompression_error;
1183 
1184  expert_field ech_echconfig_invalid_version;
1185 
1186  /* do not forget to update SSL_COMMON_EI_LIST! */
1187  } ei;
1189 
1190 /* Header fields specific to DTLS. See packet-dtls.c */
1191 typedef struct {
1192  gint hf_dtls_handshake_cookie_len;
1193  gint hf_dtls_handshake_cookie;
1194 
1195  /* Do not forget to initialize dtls_hfs to -1 in packet-dtls.c! */
1196 } dtls_hfs_t;
1197 
1198 /* Header fields specific to SSL. See packet-tls.c */
1199 typedef struct {
1200  gint hs_md5_hash;
1201  gint hs_sha_hash;
1202 
1203  /* Do not forget to initialize ssl_hfs to -1 in packet-tls.c! */
1204 } ssl_hfs_t;
1206 typedef struct {
1207  guint32 max_version;
1208  gboolean server_name_present;
1209  gint num_cipher_suites;
1210  gint num_extensions;
1211  wmem_strbuf_t *alpn;
1212  wmem_list_t *cipher_list;
1213  wmem_list_t *extension_list;
1214  wmem_list_t *sighash_list;
1215 } ja4_data_t;
1216 
1217 
1218 /* Helpers for dissecting Variable-Length Vectors. {{{ */
1219 /* Largest value that fits in a 24-bit number (2^24-1). */
1220 #define G_MAXUINT24 ((1U << 24) - 1)
1221 
1234 extern gboolean
1235 ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1236  guint offset, guint offset_end, guint32 *ret_length,
1237  int hf_length, guint32 min_value, guint32 max_value);
1238 
1247 extern gboolean
1248 ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1249  guint offset, guint offset_end);
1250 /* }}} */
1251 
1252 
1253 extern void
1254 ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
1255  ContentType content_type,
1256  guint record_length, proto_item *length_pi,
1257  guint16 version, tvbuff_t *decrypted_tvb);
1258 
1259 void
1260 ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1261  packet_info *pinfo, proto_tree *tree,
1262  guint32 offset, SslSession *session,
1263  gboolean is_from_server,
1264  const SslDecryptSession *ssl);
1265 
1266 extern void
1267 ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1268  packet_info *pinfo, proto_tree *tree, guint32 offset,
1269  guint32 offset_end, SslSession *session,
1270  SslDecryptSession *ssl,
1271  dtls_hfs_t *dtls_hfs);
1272 
1273 extern void
1274 ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1275  proto_tree *tree, guint32 offset, guint32 offset_end,
1276  SslSession *session, SslDecryptSession *ssl,
1277  gboolean is_dtls, gboolean is_hrr);
1278 
1279 extern void
1280 ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1281  proto_tree *tree, guint32 offset, guint32 offset_end,
1282  SslSession *session, SslDecryptSession *ssl,
1283  gboolean is_dtls);
1284 
1285 extern void
1286 ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1287  proto_tree *tree, guint32 offset, guint32 offset_end,
1288  SslSession *session, SslDecryptSession *ssl,
1289  gboolean is_dtls);
1290 
1291 extern void
1292 ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1293  proto_tree *tree, guint32 offset, guint32 offset_end,
1294  SslSession *session, SslDecryptSession *ssl,
1295  gboolean is_dtls, GHashTable *session_hash);
1296 
1297 extern void
1298 ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1299  guint32 offset, guint32 offset_end, packet_info *pinfo,
1300  SslSession *session, SslDecryptSession *ssl,
1301  gboolean is_from_server, gboolean is_dtls);
1302 
1303 extern void
1304 ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1305  proto_tree *tree, guint32 offset, guint32 offset_end,
1306  SslSession *session, gboolean is_dtls);
1307 
1308 extern void
1309 ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1310  proto_tree *tree, guint32 offset, guint32 offset_end, guint16 version);
1311 
1312 extern void
1313 ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1314  proto_tree *tree, guint32 offset, guint32 offset_end,
1315  const SslSession *session, ssl_hfs_t *ssl_hfs);
1316 
1317 extern void
1318 ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, guint32 offset);
1319 
1320 extern guint32
1321 tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1322  proto_tree *tree, guint32 offset, guint32 offset_end);
1323 
1324 extern void
1325 ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1326  proto_tree *tree, guint32 offset, guint32 length,
1327  const SslSession *session);
1328 
1329 extern void
1330 ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1331  proto_tree *tree, guint32 offset, guint32 offset_end,
1332  const SslSession *session);
1333 
1334 extern void
1335 tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1336  proto_tree *tree, guint32 offset);
1337 
1338 extern guint32
1339 tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1340  guint32 offset, guint32 offset_end, guint16 version);
1341 
1342 extern gboolean
1343 tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
1344  const char *label_prefix, const char *label,
1345  const guint8 *context, guint8 context_length,
1346  guint16 out_len, guchar **out);
1347 
1348 extern gboolean
1349 tls13_hkdf_expand_label(int md, const StringInfo *secret,
1350  const char *label_prefix, const char *label,
1351  guint16 out_len, guchar **out);
1352 
1353 extern void
1354 ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1355  guint32 offset, guint32 offset_end, packet_info *pinfo,
1356  SslSession *session _U_, SslDecryptSession *ssl _U_,
1357  gboolean is_from_server _U_, gboolean is_dtls _U_);
1358 /* {{{ */
1359 #define SSL_COMMON_LIST_T(name) \
1360 ssl_common_dissect_t name;
1361 /* }}} */
1362 
1363 /* {{{ */
1364 #define SSL_COMMON_HF_LIST(name, prefix) \
1365  { & name .hf.change_cipher_spec, \
1366  { "Change Cipher Spec Message", prefix ".change_cipher_spec", \
1367  FT_NONE, BASE_NONE, NULL, 0x0, \
1368  "Signals a change in cipher specifications", HFILL } \
1369  }, \
1370  { & name .hf.hs_exts_len, \
1371  { "Extensions Length", prefix ".handshake.extensions_length", \
1372  FT_UINT16, BASE_DEC, NULL, 0x0, \
1373  "Length of hello extensions", HFILL } \
1374  }, \
1375  { & name .hf.hs_ext_type, \
1376  { "Type", prefix ".handshake.extension.type", \
1377  FT_UINT16, BASE_DEC, VALS(tls_hello_extension_types), 0x0, \
1378  "Hello extension type", HFILL } \
1379  }, \
1380  { & name .hf.hs_ext_len, \
1381  { "Length", prefix ".handshake.extension.len", \
1382  FT_UINT16, BASE_DEC, NULL, 0x0, \
1383  "Length of a hello extension", HFILL } \
1384  }, \
1385  { & name .hf.hs_ext_data, \
1386  { "Data", prefix ".handshake.extension.data", \
1387  FT_BYTES, BASE_NONE, NULL, 0x0, \
1388  "Hello Extension data", HFILL } \
1389  }, \
1390  { & name .hf.hs_ext_supported_groups_len, \
1391  { "Supported Groups List Length", prefix ".handshake.extensions_supported_groups_length", \
1392  FT_UINT16, BASE_DEC, NULL, 0x0, \
1393  NULL, HFILL } \
1394  }, \
1395  { & name .hf.hs_ext_supported_groups, \
1396  { "Supported Groups List", prefix ".handshake.extensions_supported_groups", \
1397  FT_NONE, BASE_NONE, NULL, 0x0, \
1398  "List of supported groups (formerly Supported Elliptic Curves)", HFILL } \
1399  }, \
1400  { & name .hf.hs_ext_supported_group, \
1401  { "Supported Group", prefix ".handshake.extensions_supported_group", \
1402  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1403  NULL, HFILL } \
1404  }, \
1405  { & name .hf.hs_ext_ec_point_formats_len, \
1406  { "EC point formats Length", prefix ".handshake.extensions_ec_point_formats_length", \
1407  FT_UINT8, BASE_DEC, NULL, 0x0, \
1408  "Length of elliptic curves point formats field", HFILL } \
1409  }, \
1410  { & name .hf.hs_ext_ec_point_formats, \
1411  { "EC point formats", prefix ".handshake.extensions_ec_point_formats", \
1412  FT_NONE, BASE_NONE, NULL, 0x0, \
1413  "List of elliptic curves point format", HFILL } \
1414  }, \
1415  { & name .hf.hs_ext_ec_point_format, \
1416  { "EC point format", prefix ".handshake.extensions_ec_point_format", \
1417  FT_UINT8, BASE_DEC, VALS(ssl_extension_ec_point_formats), 0x0, \
1418  "Elliptic curves point format", HFILL } \
1419  }, \
1420  { & name .hf.hs_ext_srp_len, \
1421  { "SRP username length", prefix ".handshake.extensions_srp_len", \
1422  FT_UINT8, BASE_DEC, NULL, 0x0, \
1423  "Length of Secure Remote Password username field", HFILL } \
1424  }, \
1425  { & name .hf.hs_ext_srp_username, \
1426  { "SRP username", prefix ".handshake.extensions_srp_username", \
1427  FT_STRING, BASE_NONE, NULL, 0x0, \
1428  "Secure Remote Password username", HFILL } \
1429  }, \
1430  { & name .hf.hs_ext_alpn_len, \
1431  { "ALPN Extension Length", prefix ".handshake.extensions_alpn_len", \
1432  FT_UINT16, BASE_DEC, NULL, 0x0, \
1433  "Length of the ALPN Extension", HFILL } \
1434  }, \
1435  { & name .hf.hs_ext_alpn_list, \
1436  { "ALPN Protocol", prefix ".handshake.extensions_alpn_list", \
1437  FT_NONE, BASE_NONE, NULL, 0x0, \
1438  NULL, HFILL } \
1439  }, \
1440  { & name .hf.hs_ext_alpn_str_len, \
1441  { "ALPN string length", prefix ".handshake.extensions_alpn_str_len", \
1442  FT_UINT8, BASE_DEC, NULL, 0x0, \
1443  "Length of ALPN string", HFILL } \
1444  }, \
1445  { & name .hf.hs_ext_alpn_str, \
1446  { "ALPN Next Protocol", prefix ".handshake.extensions_alpn_str", \
1447  FT_STRING, BASE_NONE, NULL, 0x00, \
1448  NULL, HFILL } \
1449  }, \
1450  { & name .hf.hs_ext_npn_str_len, \
1451  { "Protocol string length", prefix ".handshake.extensions_npn_str_len", \
1452  FT_UINT8, BASE_DEC, NULL, 0x0, \
1453  "Length of next protocol string", HFILL } \
1454  }, \
1455  { & name .hf.hs_ext_npn_str, \
1456  { "Next Protocol", prefix ".handshake.extensions_npn", \
1457  FT_STRING, BASE_NONE, NULL, 0x0, \
1458  NULL, HFILL } \
1459  }, \
1460  { & name .hf.hs_ext_reneg_info_len, \
1461  { "Renegotiation info extension length", prefix ".handshake.extensions_reneg_info_len", \
1462  FT_UINT8, BASE_DEC, NULL, 0x0, \
1463  NULL, HFILL } \
1464  }, \
1465  { & name .hf.hs_ext_reneg_info, \
1466  { "Renegotiation info", prefix ".handshake.extensions_reneg_info",\
1467  FT_BYTES, BASE_NONE, NULL, 0x0, \
1468  NULL, HFILL } \
1469  }, \
1470  { & name .hf.hs_ext_key_share_client_length, \
1471  { "Client Key Share Length", prefix ".handshake.extensions_key_share_client_length", \
1472  FT_UINT16, BASE_DEC, NULL, 0x00, \
1473  NULL, HFILL } \
1474  }, \
1475  { & name .hf.hs_ext_key_share_group, \
1476  { "Group", prefix ".handshake.extensions_key_share_group", \
1477  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1478  NULL, HFILL } \
1479  }, \
1480  { & name .hf.hs_ext_key_share_key_exchange_length, \
1481  { "Key Exchange Length", prefix ".handshake.extensions_key_share_key_exchange_length", \
1482  FT_UINT16, BASE_DEC, NULL, 0x00, \
1483  NULL, HFILL } \
1484  }, \
1485  { & name .hf.hs_ext_key_share_key_exchange, \
1486  { "Key Exchange", prefix ".handshake.extensions_key_share_key_exchange", \
1487  FT_BYTES, BASE_NONE, NULL, 0x0, \
1488  NULL, HFILL } \
1489  }, \
1490  { & name .hf.hs_ext_key_share_selected_group, \
1491  { "Selected Group", prefix ".handshake.extensions_key_share_selected_group", \
1492  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1493  NULL, HFILL } \
1494  }, \
1495  { & name .hf.hs_ext_psk_identities_length, \
1496  { "Identities Length", prefix ".handshake.extensions.psk.identities.length", \
1497  FT_UINT16, BASE_DEC, NULL, 0x0, \
1498  NULL, HFILL } \
1499  }, \
1500  { & name .hf.hs_ext_psk_identity_identity_length, \
1501  { "Identity Length", prefix ".handshake.extensions.psk.identity.identity_length", \
1502  FT_UINT16, BASE_DEC, NULL, 0x0, \
1503  NULL, HFILL } \
1504  }, \
1505  { & name .hf.hs_ext_psk_identity_identity, \
1506  { "Identity", prefix ".handshake.extensions.psk.identity.identity", \
1507  FT_BYTES, BASE_NONE, NULL, 0x0, \
1508  NULL, HFILL } \
1509  }, \
1510  { & name .hf.hs_ext_psk_identity_obfuscated_ticket_age, \
1511  { "Obfuscated Ticket Age", prefix ".handshake.extensions.psk.identity.obfuscated_ticket_age", \
1512  FT_UINT32, BASE_DEC, NULL, 0x0, \
1513  NULL, HFILL } \
1514  }, \
1515  { & name .hf.hs_ext_psk_binders_length, \
1516  { "PSK Binders length", prefix ".handshake.extensions.psk.binders_len", \
1517  FT_UINT16, BASE_DEC, NULL, 0x0, \
1518  NULL, HFILL } \
1519  }, \
1520  { & name .hf.hs_ext_psk_binders, \
1521  { "PSK Binders", prefix ".handshake.extensions.psk.binders", \
1522  FT_NONE, BASE_NONE, NULL, 0x0, \
1523  NULL, HFILL } \
1524  }, \
1525  { & name .hf.hs_ext_psk_identity_selected, \
1526  { "Selected Identity", prefix ".handshake.extensions.psk.identity.selected", \
1527  FT_UINT16, BASE_DEC, NULL, 0x0, \
1528  NULL, HFILL } \
1529  }, \
1530  { & name .hf.hs_ext_session_ticket, \
1531  { "Session Ticket", prefix ".handshake.extensions.session_ticket", \
1532  FT_BYTES, BASE_NONE, NULL, 0x0, \
1533  NULL, HFILL } \
1534  }, \
1535  { & name .hf.hs_ext_supported_versions_len, \
1536  { "Supported Versions length", prefix ".handshake.extensions.supported_versions_len", \
1537  FT_UINT8, BASE_DEC, NULL, 0x0, \
1538  NULL, HFILL } \
1539  }, \
1540  { & name .hf.hs_ext_supported_version, \
1541  { "Supported Version", prefix ".handshake.extensions.supported_version", \
1542  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1543  NULL, HFILL } \
1544  }, \
1545  { & name .hf.hs_ext_cookie_len, \
1546  { "Cookie length", prefix ".handshake.extensions.cookie_len", \
1547  FT_UINT16, BASE_DEC, NULL, 0x0, \
1548  NULL, HFILL } \
1549  }, \
1550  { & name .hf.hs_ext_cookie, \
1551  { "Cookie", prefix ".handshake.extensions.cookie", \
1552  FT_BYTES, BASE_NONE, NULL, 0x0, \
1553  NULL, HFILL } \
1554  }, \
1555  { & name .hf.hs_ext_server_name_list_len, \
1556  { "Server Name list length", prefix ".handshake.extensions_server_name_list_len", \
1557  FT_UINT16, BASE_DEC, NULL, 0x0, \
1558  "Length of server name list", HFILL } \
1559  }, \
1560  { & name .hf.hs_ext_server_name_len, \
1561  { "Server Name length", prefix ".handshake.extensions_server_name_len", \
1562  FT_UINT16, BASE_DEC, NULL, 0x0, \
1563  "Length of server name string", HFILL } \
1564  }, \
1565  { & name .hf.hs_ext_server_name_type, \
1566  { "Server Name Type", prefix ".handshake.extensions_server_name_type", \
1567  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_server_name_type_vs), 0x0, \
1568  NULL, HFILL } \
1569  }, \
1570  { & name .hf.hs_ext_server_name, \
1571  { "Server Name", prefix ".handshake.extensions_server_name", \
1572  FT_STRING, BASE_NONE, NULL, 0x0, \
1573  NULL, HFILL } \
1574  }, \
1575  { & name .hf.hs_ext_max_fragment_length, \
1576  { "Maximum Fragment Length", prefix ".handshake.max_fragment_length", \
1577  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_max_fragment_length), 0x00, \
1578  "Maximum fragment length that an endpoint is willing to receive", HFILL } \
1579  }, \
1580  { & name .hf.hs_ext_padding_data, \
1581  { "Padding Data", prefix ".handshake.extensions_padding_data", \
1582  FT_BYTES, BASE_NONE, NULL, 0x0, \
1583  "Must be zero", HFILL } \
1584  }, \
1585  { & name .hf.hs_ext_cert_url_type, \
1586  { "Certificate Chain Type", prefix ".handshake.cert_url_type", \
1587  FT_UINT8, BASE_DEC, VALS(tls_cert_chain_type), 0x0, \
1588  "Certificate Chain Type for Client Certificate URL", HFILL } \
1589  }, \
1590  { & name .hf.hs_ext_cert_url_url_hash_list_len, \
1591  { "URL and Hash list Length", prefix ".handshake.cert_url.url_hash_len", \
1592  FT_UINT16, BASE_DEC, NULL, 0x0, \
1593  NULL, HFILL } \
1594  }, \
1595  { & name .hf.hs_ext_cert_url_item, \
1596  { "URL and Hash", prefix ".handshake.cert_url.url_hash", \
1597  FT_NONE, BASE_NONE, NULL, 0x0, \
1598  NULL, HFILL } \
1599  }, \
1600  { & name .hf.hs_ext_cert_url_url_len, \
1601  { "URL Length", prefix ".handshake.cert_url.url_len", \
1602  FT_UINT16, BASE_DEC, NULL, 0x0, \
1603  NULL, HFILL } \
1604  }, \
1605  { & name .hf.hs_ext_cert_type, \
1606  { "Certificate Type", prefix ".handshake.cert_type.type", \
1607  FT_UINT8, BASE_HEX, VALS(tls_certificate_type), 0x0, \
1608  NULL, HFILL } \
1609  }, \
1610  { & name .hf.hs_ext_cert_types, \
1611  { "Certificate Type List", prefix ".handshake.cert_type.types", \
1612  FT_NONE, BASE_NONE, NULL, 0x0, \
1613  NULL, HFILL } \
1614  }, \
1615  { & name .hf.hs_ext_cert_types_len, \
1616  { "Certificate Type List Length", prefix ".handshake.cert_type.types_len", \
1617  FT_UINT8, BASE_DEC, NULL, 0x0, \
1618  NULL, HFILL } \
1619  }, \
1620  { & name .hf.hs_ext_cert_url_url, \
1621  { "URL", prefix ".handshake.cert_url.url", \
1622  FT_STRING, BASE_NONE, NULL, 0x0, \
1623  "URL used to fetch the certificate(s)", HFILL } \
1624  }, \
1625  { & name .hf.hs_ext_cert_url_padding, \
1626  { "Padding", prefix ".handshake.cert_url.padding", \
1627  FT_NONE, BASE_NONE, NULL, 0x0, \
1628  "Padding that MUST be 0x01 for backwards compatibility", HFILL } \
1629  }, \
1630  { & name .hf.hs_ext_cert_url_sha1, \
1631  { "SHA1 Hash", prefix ".handshake.cert_url.sha1", \
1632  FT_BYTES, BASE_NONE, NULL, 0x0, \
1633  "SHA1 Hash of the certificate", HFILL } \
1634  }, \
1635  { & name .hf.hs_ext_cert_status_type, \
1636  { "Certificate Status Type", prefix ".handshake.extensions_status_request_type", \
1637  FT_UINT8, BASE_DEC, VALS(tls_cert_status_type), 0x0, \
1638  NULL, HFILL } \
1639  }, \
1640  { & name .hf.hs_ext_cert_status_request_len, \
1641  { "Certificate Status Length", prefix ".handshake.extensions_status_request_len", \
1642  FT_UINT16, BASE_DEC, NULL, 0x0, \
1643  NULL, HFILL } \
1644  }, \
1645  { & name .hf.hs_ext_cert_status_responder_id_list_len, \
1646  { "Responder ID list Length", prefix ".handshake.extensions_status_request_responder_ids_len", \
1647  FT_UINT16, BASE_DEC, NULL, 0x0, \
1648  NULL, HFILL } \
1649  }, \
1650  { & name .hf.hs_ext_cert_status_request_extensions_len, \
1651  { "Request Extensions Length", prefix ".handshake.extensions_status_request_exts_len", \
1652  FT_UINT16, BASE_DEC, NULL, 0x0, \
1653  NULL, HFILL } \
1654  }, \
1655  { & name .hf.hs_ext_cert_status_request_list_len, \
1656  { "Certificate Status List Length", prefix ".handshake.extensions_status_request_list_len", \
1657  FT_UINT16, BASE_DEC, NULL, 0x0, \
1658  "CertificateStatusRequestItemV2 list length", HFILL } \
1659  }, \
1660  { & name .hf.hs_ocsp_response_list_len, \
1661  { "OCSP Response List Length", prefix ".handshake.ocsp_response_list_len", \
1662  FT_UINT24, BASE_DEC, NULL, 0x0, \
1663  "OCSPResponseList length", HFILL } \
1664  }, \
1665  { & name .hf.hs_ocsp_response_len, \
1666  { "OCSP Response Length", prefix ".handshake.ocsp_response_len", \
1667  FT_UINT24, BASE_DEC, NULL, 0x0, \
1668  NULL, HFILL } \
1669  }, \
1670  { & name .hf.hs_sig_hash_alg_len, \
1671  { "Signature Hash Algorithms Length", prefix ".handshake.sig_hash_alg_len", \
1672  FT_UINT16, BASE_DEC, NULL, 0x0, \
1673  "Length of Signature Hash Algorithms", HFILL } \
1674  }, \
1675  { & name .hf.hs_sig_hash_algs, \
1676  { "Signature Algorithms", prefix ".handshake.sig_hash_algs", \
1677  FT_NONE, BASE_NONE, NULL, 0x0, \
1678  "List of supported Signature Algorithms", HFILL } \
1679  }, \
1680  { & name .hf.hs_sig_hash_alg, \
1681  { "Signature Algorithm", prefix ".handshake.sig_hash_alg", \
1682  FT_UINT16, BASE_HEX, VALS(tls13_signature_algorithm), 0x0, \
1683  NULL, HFILL } \
1684  }, \
1685  { & name .hf.hs_sig_hash_hash, \
1686  { "Signature Hash Algorithm Hash", prefix ".handshake.sig_hash_hash", \
1687  FT_UINT8, BASE_DEC, VALS(tls_hash_algorithm), 0x0, \
1688  "Hash algorithm (TLS 1.2)", HFILL } \
1689  }, \
1690  { & name .hf.hs_sig_hash_sig, \
1691  { "Signature Hash Algorithm Signature", prefix ".handshake.sig_hash_sig", \
1692  FT_UINT8, BASE_DEC, VALS(tls_signature_algorithm), 0x0, \
1693  "Signature algorithm (TLS 1.2)", HFILL } \
1694  }, \
1695  { & name .hf.hs_client_keyex_epms_len, \
1696  { "Encrypted PreMaster length", prefix ".handshake.epms_len", \
1697  FT_UINT16, BASE_DEC, NULL, 0x0, \
1698  "Length of encrypted PreMaster secret", HFILL } \
1699  }, \
1700  { & name .hf.hs_client_keyex_epms, \
1701  { "Encrypted PreMaster", prefix ".handshake.epms", \
1702  FT_BYTES, BASE_NONE, NULL, 0x0, \
1703  "Encrypted PreMaster secret", HFILL } \
1704  }, \
1705  { & name .hf.hs_server_keyex_modulus_len, \
1706  { "Modulus Length", prefix ".handshake.modulus_len", \
1707  FT_UINT16, BASE_DEC, NULL, 0x0, \
1708  "Length of RSA-EXPORT modulus", HFILL } \
1709  }, \
1710  { & name .hf.hs_server_keyex_exponent_len, \
1711  { "Exponent Length", prefix ".handshake.exponent_len", \
1712  FT_UINT16, BASE_DEC, NULL, 0x0, \
1713  "Length of RSA-EXPORT exponent", HFILL } \
1714  }, \
1715  { & name .hf.hs_server_keyex_sig_len, \
1716  { "Signature Length", prefix ".handshake.sig_len", \
1717  FT_UINT16, BASE_DEC, NULL, 0x0, \
1718  "Length of Signature", HFILL } \
1719  }, \
1720  { & name .hf.hs_server_keyex_p_len, \
1721  { "p Length", prefix ".handshake.p_len", \
1722  FT_UINT16, BASE_DEC, NULL, 0x0, \
1723  "Length of p", HFILL } \
1724  }, \
1725  { & name .hf.hs_server_keyex_g_len, \
1726  { "g Length", prefix ".handshake.g_len", \
1727  FT_UINT16, BASE_DEC, NULL, 0x0, \
1728  "Length of g", HFILL } \
1729  }, \
1730  { & name .hf.hs_server_keyex_ys_len, \
1731  { "Pubkey Length", prefix ".handshake.ys_len", \
1732  FT_UINT16, BASE_DEC, NULL, 0x0, \
1733  "Length of server's Diffie-Hellman public key", HFILL } \
1734  }, \
1735  { & name .hf.hs_client_keyex_yc_len, \
1736  { "Pubkey Length", prefix ".handshake.yc_len", \
1737  FT_UINT16, BASE_DEC, NULL, 0x0, \
1738  "Length of client's Diffie-Hellman public key", HFILL } \
1739  }, \
1740  { & name .hf.hs_client_keyex_point_len, \
1741  { "Pubkey Length", prefix ".handshake.client_point_len", \
1742  FT_UINT8, BASE_DEC, NULL, 0x0, \
1743  "Length of client's EC Diffie-Hellman public key", HFILL } \
1744  }, \
1745  { & name .hf.hs_server_keyex_point_len, \
1746  { "Pubkey Length", prefix ".handshake.server_point_len", \
1747  FT_UINT8, BASE_DEC, NULL, 0x0, \
1748  "Length of server's EC Diffie-Hellman public key", HFILL } \
1749  }, \
1750  { & name .hf.hs_server_keyex_p, \
1751  { "p", prefix ".handshake.p", \
1752  FT_BYTES, BASE_NONE, NULL, 0x0, \
1753  "Diffie-Hellman p", HFILL } \
1754  }, \
1755  { & name .hf.hs_server_keyex_g, \
1756  { "g", prefix ".handshake.g", \
1757  FT_BYTES, BASE_NONE, NULL, 0x0, \
1758  "Diffie-Hellman g", HFILL } \
1759  }, \
1760  { & name .hf.hs_server_keyex_curve_type, \
1761  { "Curve Type", prefix ".handshake.server_curve_type", \
1762  FT_UINT8, BASE_HEX, VALS(ssl_curve_types), 0x0, \
1763  "Server curve_type", HFILL } \
1764  }, \
1765  { & name .hf.hs_server_keyex_named_curve, \
1766  { "Named Curve", prefix ".handshake.server_named_curve", \
1767  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1768  "Server named_curve", HFILL } \
1769  }, \
1770  { & name .hf.hs_server_keyex_ys, \
1771  { "Pubkey", prefix ".handshake.ys", \
1772  FT_BYTES, BASE_NONE, NULL, 0x0, \
1773  "Diffie-Hellman server pubkey", HFILL } \
1774  }, \
1775  { & name .hf.hs_client_keyex_yc, \
1776  { "Pubkey", prefix ".handshake.yc", \
1777  FT_BYTES, BASE_NONE, NULL, 0x0, \
1778  "Diffie-Hellman client pubkey", HFILL } \
1779  }, \
1780  { & name .hf.hs_server_keyex_point, \
1781  { "Pubkey", prefix ".handshake.server_point", \
1782  FT_BYTES, BASE_NONE, NULL, 0x0, \
1783  "EC Diffie-Hellman server pubkey", HFILL } \
1784  }, \
1785  { & name .hf.hs_client_keyex_point, \
1786  { "Pubkey", prefix ".handshake.client_point", \
1787  FT_BYTES, BASE_NONE, NULL, 0x0, \
1788  "EC Diffie-Hellman client pubkey", HFILL } \
1789  }, \
1790  { & name .hf.hs_server_keyex_xs_len, \
1791  { "Pubkey Length", prefix ".handshake.xs_len", \
1792  FT_UINT8, BASE_DEC, NULL, 0x0, \
1793  "Length of EC J-PAKE server public key", HFILL } \
1794  }, \
1795  { & name .hf.hs_client_keyex_xc_len, \
1796  { "Pubkey Length", prefix ".handshake.xc_len", \
1797  FT_UINT8, BASE_DEC, NULL, 0x0, \
1798  "Length of EC J-PAKE client public key", HFILL } \
1799  }, \
1800  { & name .hf.hs_server_keyex_xs, \
1801  { "Pubkey", prefix ".handshake.xs", \
1802  FT_BYTES, BASE_NONE, NULL, 0x0, \
1803  "EC J-PAKE server public key", HFILL } \
1804  }, \
1805  { & name .hf.hs_client_keyex_xc, \
1806  { "Pubkey", prefix ".handshake.xc", \
1807  FT_BYTES, BASE_NONE, NULL, 0x0, \
1808  "EC J-PAKE client public key", HFILL } \
1809  }, \
1810  { & name .hf.hs_server_keyex_vs_len, \
1811  { "Ephemeral Pubkey Length", prefix ".handshake.vs_len", \
1812  FT_UINT8, BASE_DEC, NULL, 0x0, \
1813  "Length of EC J-PAKE server ephemeral public key", HFILL } \
1814  }, \
1815  { & name .hf.hs_client_keyex_vc_len, \
1816  { "Ephemeral Pubkey Length", prefix ".handshake.vc_len", \
1817  FT_UINT8, BASE_DEC, NULL, 0x0, \
1818  "Length of EC J-PAKE client ephemeral public key", HFILL } \
1819  }, \
1820  { & name .hf.hs_server_keyex_vs, \
1821  { "Ephemeral Pubkey", prefix ".handshake.vs", \
1822  FT_BYTES, BASE_NONE, NULL, 0x0, \
1823  "EC J-PAKE server ephemeral public key", HFILL } \
1824  }, \
1825  { & name .hf.hs_client_keyex_vc, \
1826  { "Ephemeral Pubkey", prefix ".handshake.vc", \
1827  FT_BYTES, BASE_NONE, NULL, 0x0, \
1828  "EC J-PAKE client ephemeral public key", HFILL } \
1829  }, \
1830  { & name .hf.hs_server_keyex_rs_len, \
1831  { "Schnorr signature Length", prefix ".handshake.rs_len", \
1832  FT_UINT8, BASE_DEC, NULL, 0x0, \
1833  "Length of EC J-PAKE server Schnorr signature", HFILL } \
1834  }, \
1835  { & name .hf.hs_client_keyex_rc_len, \
1836  { "Schnorr signature Length", prefix ".handshake.rc_len", \
1837  FT_UINT8, BASE_DEC, NULL, 0x0, \
1838  "Length of EC J-PAKE client Schnorr signature", HFILL } \
1839  }, \
1840  { & name .hf.hs_server_keyex_rs, \
1841  { "Schnorr signature", prefix ".handshake.rs", \
1842  FT_BYTES, BASE_NONE, NULL, 0x0, \
1843  "EC J-PAKE server Schnorr signature", HFILL } \
1844  }, \
1845  { & name .hf.hs_client_keyex_rc, \
1846  { "Schnorr signature", prefix ".handshake.rc", \
1847  FT_BYTES, BASE_NONE, NULL, 0x0, \
1848  "EC J-PAKE client Schnorr signature", HFILL } \
1849  }, \
1850  { & name .hf.hs_server_keyex_modulus, \
1851  { "Modulus", prefix ".handshake.modulus", \
1852  FT_BYTES, BASE_NONE, NULL, 0x0, \
1853  "RSA-EXPORT modulus", HFILL } \
1854  }, \
1855  { & name .hf.hs_server_keyex_exponent, \
1856  { "Exponent", prefix ".handshake.exponent", \
1857  FT_BYTES, BASE_NONE, NULL, 0x0, \
1858  "RSA-EXPORT exponent", HFILL } \
1859  }, \
1860  { & name .hf.hs_server_keyex_sig, \
1861  { "Signature", prefix ".handshake.sig", \
1862  FT_BYTES, BASE_NONE, NULL, 0x0, \
1863  "Diffie-Hellman server signature", HFILL } \
1864  }, \
1865  { & name .hf.hs_server_keyex_hint_len, \
1866  { "Hint Length", prefix ".handshake.hint_len", \
1867  FT_UINT16, BASE_DEC, NULL, 0x0, \
1868  "Length of PSK Hint", HFILL } \
1869  }, \
1870  { & name .hf.hs_server_keyex_hint, \
1871  { "Hint", prefix ".handshake.hint", \
1872  FT_BYTES, BASE_NONE, NULL, 0x0, \
1873  "PSK Hint", HFILL } \
1874  }, \
1875  { & name .hf.hs_client_keyex_identity_len, \
1876  { "Identity Length", prefix ".handshake.identity_len", \
1877  FT_UINT16, BASE_DEC, NULL, 0x0, \
1878  "Length of PSK Identity", HFILL } \
1879  }, \
1880  { & name .hf.hs_client_keyex_identity, \
1881  { "Identity", prefix ".handshake.identity", \
1882  FT_BYTES, BASE_NONE, NULL, 0x0, \
1883  "PSK Identity", HFILL } \
1884  }, \
1885  { & name .hf.hs_ext_heartbeat_mode, \
1886  { "Mode", prefix ".handshake.extension.heartbeat.mode", \
1887  FT_UINT8, BASE_DEC, VALS(tls_heartbeat_mode), 0x0, \
1888  "Heartbeat extension mode", HFILL } \
1889  }, \
1890  { & name .hf.hs_certificates_len, \
1891  { "Certificates Length", prefix ".handshake.certificates_length", \
1892  FT_UINT24, BASE_DEC, NULL, 0x0, \
1893  "Length of certificates field", HFILL } \
1894  }, \
1895  { & name .hf.hs_certificates, \
1896  { "Certificates", prefix ".handshake.certificates", \
1897  FT_NONE, BASE_NONE, NULL, 0x0, \
1898  "List of certificates", HFILL } \
1899  }, \
1900  { & name .hf.hs_certificate, \
1901  { "Certificate", prefix ".handshake.certificate", \
1902  FT_BYTES, BASE_NONE, NULL, 0x0, \
1903  NULL, HFILL } \
1904  }, \
1905  { & name .hf.hs_certificate_len, \
1906  { "Certificate Length", prefix ".handshake.certificate_length", \
1907  FT_UINT24, BASE_DEC, NULL, 0x0, \
1908  "Length of certificate", HFILL } \
1909  }, \
1910  { & name .hf.hs_cert_types_count, \
1911  { "Certificate types count", prefix ".handshake.cert_types_count",\
1912  FT_UINT8, BASE_DEC, NULL, 0x0, \
1913  "Count of certificate types", HFILL } \
1914  }, \
1915  { & name .hf.hs_cert_types, \
1916  { "Certificate types", prefix ".handshake.cert_types", \
1917  FT_NONE, BASE_NONE, NULL, 0x0, \
1918  "List of certificate types", HFILL } \
1919  }, \
1920  { & name .hf.hs_cert_type, \
1921  { "Certificate type", prefix ".handshake.cert_type", \
1922  FT_UINT8, BASE_DEC, VALS(ssl_31_client_certificate_type), 0x0, \
1923  NULL, HFILL } \
1924  }, \
1925  { & name .hf.hs_dnames_len, \
1926  { "Distinguished Names Length", prefix ".handshake.dnames_len", \
1927  FT_UINT16, BASE_DEC, NULL, 0x0, \
1928  "Length of list of CAs that server trusts", HFILL } \
1929  }, \
1930  { & name .hf.hs_dnames, \
1931  { "Distinguished Names", prefix ".handshake.dnames", \
1932  FT_NONE, BASE_NONE, NULL, 0x0, \
1933  "List of CAs that server trusts", HFILL } \
1934  }, \
1935  { & name .hf.hs_dname_len, \
1936  { "Distinguished Name Length", prefix ".handshake.dname_len", \
1937  FT_UINT16, BASE_DEC, NULL, 0x0, \
1938  "Length of distinguished name", HFILL } \
1939  }, \
1940  { & name .hf.hs_dnames_truncated, \
1941  { "Tree view truncated", prefix ".handshake.dnames_truncated", \
1942  FT_NONE, BASE_NONE, NULL, 0x00, \
1943  "Some Distinguished Names are not added to tree pane to limit resources", HFILL } \
1944  }, \
1945  { & name .hf.hs_dname, \
1946  { "Distinguished Name", prefix ".handshake.dname", \
1947  FT_NONE, BASE_NONE, NULL, 0x0, \
1948  "Distinguished name of a CA that server trusts", HFILL } \
1949  }, \
1950  { & name .hf.hs_random, \
1951  { "Random", prefix ".handshake.random", \
1952  FT_BYTES, BASE_NONE, NULL, 0x0, \
1953  "Random values used for deriving keys", HFILL } \
1954  }, \
1955  { & name .hf.hs_random_time, \
1956  { "GMT Unix Time", prefix ".handshake.random_time", \
1957  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0, \
1958  "Unix time field of random structure", HFILL } \
1959  }, \
1960  { & name .hf.hs_random_bytes, \
1961  { "Random Bytes", prefix ".handshake.random_bytes", \
1962  FT_BYTES, BASE_NONE, NULL, 0x0, \
1963  "Random values used for deriving keys", HFILL } \
1964  }, \
1965  { & name .hf.hs_session_id, \
1966  { "Session ID", prefix ".handshake.session_id", \
1967  FT_BYTES, BASE_NONE, NULL, 0x0, \
1968  "Identifies the SSL session, allowing later resumption", HFILL }\
1969  }, \
1970  { & name .hf.hs_session_id_len, \
1971  { "Session ID Length", prefix ".handshake.session_id_length", \
1972  FT_UINT8, BASE_DEC, NULL, 0x0, \
1973  "Length of Session ID field", HFILL } \
1974  }, \
1975  { & name .hf.hs_client_version, \
1976  { "Version", prefix ".handshake.version", \
1977  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1978  "Maximum version supported by client [legacy_version if supported_versions ext is present]", HFILL } \
1979  }, \
1980  { & name .hf.hs_server_version, \
1981  { "Version", prefix ".handshake.version", \
1982  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1983  "Version selected by server [legacy_version if supported_versions ext is present]", HFILL } \
1984  }, \
1985  { & name .hf.hs_cipher_suites_len, \
1986  { "Cipher Suites Length", prefix ".handshake.cipher_suites_length", \
1987  FT_UINT16, BASE_DEC, NULL, 0x0, \
1988  "Length of cipher suites field", HFILL } \
1989  }, \
1990  { & name .hf.hs_cipher_suites, \
1991  { "Cipher Suites", prefix ".handshake.ciphersuites", \
1992  FT_NONE, BASE_NONE, NULL, 0x0, \
1993  "List of cipher suites supported by client", HFILL } \
1994  }, \
1995  { & name .hf.hs_cipher_suite, \
1996  { "Cipher Suite", prefix ".handshake.ciphersuite", \
1997  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
1998  NULL, HFILL } \
1999  }, \
2000  { & name .hf.hs_comp_methods_len, \
2001  { "Compression Methods Length", prefix ".handshake.comp_methods_length", \
2002  FT_UINT8, BASE_DEC, NULL, 0x0, \
2003  "Length of compression methods field", HFILL } \
2004  }, \
2005  { & name .hf.hs_comp_methods, \
2006  { "Compression Methods", prefix ".handshake.comp_methods", \
2007  FT_NONE, BASE_NONE, NULL, 0x0, \
2008  "List of compression methods supported by client", HFILL } \
2009  }, \
2010  { & name .hf.hs_comp_method, \
2011  { "Compression Method", prefix ".handshake.comp_method", \
2012  FT_UINT8, BASE_DEC, VALS(ssl_31_compression_method), 0x0, \
2013  NULL, HFILL } \
2014  }, \
2015  { & name .hf.hs_session_ticket_lifetime_hint, \
2016  { "Session Ticket Lifetime Hint", \
2017  prefix ".handshake.session_ticket_lifetime_hint", \
2018  FT_UINT32, BASE_DEC|BASE_UNIT_STRING, &units_second_seconds, 0x0, \
2019  "New Session Ticket Lifetime Hint", HFILL } \
2020  }, \
2021  { & name .hf.hs_session_ticket_age_add, \
2022  { "Session Ticket Age Add", \
2023  prefix ".handshake.session_ticket_age_add", \
2024  FT_UINT32, BASE_DEC, NULL, 0x0, \
2025  "Random 32-bit value to obscure age of ticket", HFILL } \
2026  }, \
2027  { & name .hf.hs_session_ticket_nonce_len, \
2028  { "Session Ticket Nonce Length", prefix ".handshake.session_ticket_nonce_length", \
2029  FT_UINT8, BASE_DEC, NULL, 0x0, \
2030  NULL, HFILL } \
2031  }, \
2032  { & name .hf.hs_session_ticket_nonce, \
2033  { "Session Ticket Nonce", prefix ".handshake.session_ticket_nonce", \
2034  FT_BYTES, BASE_NONE, NULL, 0x0, \
2035  "A unique per-ticket value", HFILL } \
2036  }, \
2037  { & name .hf.hs_session_ticket_len, \
2038  { "Session Ticket Length", prefix ".handshake.session_ticket_length", \
2039  FT_UINT16, BASE_DEC, NULL, 0x0, \
2040  "New Session Ticket Length", HFILL } \
2041  }, \
2042  { & name .hf.hs_session_ticket, \
2043  { "Session Ticket", prefix ".handshake.session_ticket", \
2044  FT_BYTES, BASE_NONE, NULL, 0x0, \
2045  "New Session Ticket", HFILL } \
2046  }, \
2047  { & name .hf.hs_finished, \
2048  { "Verify Data", prefix ".handshake.verify_data", \
2049  FT_NONE, BASE_NONE, NULL, 0x0, \
2050  "Opaque verification data", HFILL } \
2051  }, \
2052  { & name .hf.hs_client_cert_vrfy_sig_len, \
2053  { "Signature length", prefix ".handshake.client_cert_vrfy.sig_len", \
2054  FT_UINT16, BASE_DEC, NULL, 0x0, \
2055  "Length of CertificateVerify's signature", HFILL } \
2056  }, \
2057  { & name .hf.hs_client_cert_vrfy_sig, \
2058  { "Signature", prefix ".handshake.client_cert_vrfy.sig", \
2059  FT_BYTES, BASE_NONE, NULL, 0x0, \
2060  "CertificateVerify's signature", HFILL } \
2061  }, \
2062  { & name .hf.hs_ja3_full, \
2063  { "JA3 Fullstring", prefix ".handshake.ja3_full", \
2064  FT_STRING, BASE_NONE, NULL, 0x0, \
2065  NULL, HFILL } \
2066  }, \
2067  { & name .hf.hs_ja3_hash, \
2068  { "JA3", prefix ".handshake.ja3", \
2069  FT_STRING, BASE_NONE, NULL, 0x0, \
2070  NULL, HFILL } \
2071  }, \
2072  { & name .hf.hs_ja3s_full, \
2073  { "JA3S Fullstring", prefix ".handshake.ja3s_full", \
2074  FT_STRING, BASE_NONE, NULL, 0x0, \
2075  NULL, HFILL } \
2076  }, \
2077  { & name .hf.hs_ja3s_hash, \
2078  { "JA3S", prefix ".handshake.ja3s", \
2079  FT_STRING, BASE_NONE, NULL, 0x0, \
2080  NULL, HFILL } \
2081  }, \
2082  { & name .hf.hs_ja4, \
2083  { "JA4", prefix ".handshake.ja4", \
2084  FT_STRING, BASE_NONE, NULL, 0x0, \
2085  NULL, HFILL } \
2086  }, \
2087  { & name .hf.hs_ja4_r, \
2088  { "JA4_r", prefix ".handshake.ja4_r", \
2089  FT_STRING, BASE_NONE, NULL, 0x0, \
2090  NULL, HFILL } \
2091  }, \
2092  { & name .hf.hs_ext_psk_ke_modes_length, \
2093  { "PSK Key Exchange Modes Length", prefix ".extension.psk_ke_modes_length", \
2094  FT_UINT8, BASE_DEC, NULL, 0x0, \
2095  NULL, HFILL } \
2096  }, \
2097  { & name .hf.hs_ext_psk_ke_mode, \
2098  { "PSK Key Exchange Mode", prefix ".extension.psk_ke_mode", \
2099  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_psk_ke_mode), 0x0, \
2100  "Key exchange modes where the client supports use of PSKs", HFILL } \
2101  }, \
2102  { & name .hf.hs_certificate_request_context_length, \
2103  { "Certificate Request Context Length", prefix ".handshake.certificate_request_context_length", \
2104  FT_UINT8, BASE_DEC, NULL, 0x0, \
2105  NULL, HFILL } \
2106  }, \
2107  { & name .hf.hs_certificate_request_context, \
2108  { "Certificate Request Context", prefix ".handshake.certificate_request_context", \
2109  FT_BYTES, BASE_NONE, NULL, 0x0, \
2110  "Value from CertificateRequest or empty for server auth", HFILL } \
2111  }, \
2112  { & name .hf.hs_key_update_request_update, \
2113  { "Key Update Request", prefix ".handshake.key_update.request_update", \
2114  FT_UINT8, BASE_DEC, VALS(tls13_key_update_request), 0x00, \
2115  "Whether the receiver should also update its keys", HFILL } \
2116  }, \
2117  { & name .hf.sct_scts_length, \
2118  { "Serialized SCT List Length", prefix ".sct.scts_length", \
2119  FT_UINT16, BASE_DEC, NULL, 0x00, \
2120  NULL, HFILL } \
2121  }, \
2122  { & name .hf.sct_sct_length, \
2123  { "Serialized SCT Length", prefix ".sct.sct_length", \
2124  FT_UINT16, BASE_DEC, NULL, 0x00, \
2125  NULL, HFILL } \
2126  }, \
2127  { & name .hf.sct_sct_version, \
2128  { "SCT Version", prefix ".sct.sct_version", \
2129  FT_UINT8, BASE_DEC, NULL, 0x00, \
2130  "SCT Protocol version (v1 (0) is defined in RFC 6962)", HFILL } \
2131  }, \
2132  { & name .hf.sct_sct_logid, \
2133  { "Log ID", prefix ".sct.sct_logid", \
2134  FT_BYTES, BASE_NONE, NULL, 0x00, \
2135  "SHA-256 hash of log's public key", HFILL } \
2136  }, \
2137  { & name .hf.sct_sct_timestamp, \
2138  { "Timestamp", prefix ".sct.sct_timestamp", \
2139  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x00, \
2140  "Timestamp of issuance", HFILL } \
2141  }, \
2142  { & name .hf.sct_sct_extensions_length, \
2143  { "Extensions length", prefix ".sct.sct_extensions_length", \
2144  FT_UINT16, BASE_DEC, NULL, 0x00, \
2145  "Length of future extensions to this protocol (currently none)", HFILL } \
2146  }, \
2147  { & name .hf.sct_sct_extensions, \
2148  { "Extensions", prefix ".sct.sct_extensions", \
2149  FT_NONE, BASE_NONE, NULL, 0x00, \
2150  "Future extensions to this protocol (currently none)", HFILL } \
2151  }, \
2152  { & name .hf.sct_sct_signature_length, \
2153  { "Signature Length", prefix ".sct.sct_signature_length", \
2154  FT_UINT16, BASE_DEC, NULL, 0x00, \
2155  NULL, HFILL } \
2156  }, \
2157  { & name .hf.sct_sct_signature, \
2158  { "Signature", prefix ".sct.sct_signature", \
2159  FT_BYTES, BASE_NONE, NULL, 0x00, \
2160  NULL, HFILL } \
2161  }, \
2162  { & name .hf.hs_ext_max_early_data_size, \
2163  { "Maximum Early Data Size", prefix ".early_data.max_early_data_size", \
2164  FT_UINT32, BASE_DEC, NULL, 0x00, \
2165  "Maximum amount of 0-RTT data that the client may send", HFILL } \
2166  }, \
2167  { & name .hf.hs_ext_oid_filters_length, \
2168  { "OID Filters Length", prefix ".extension.oid_filters_length", \
2169  FT_UINT16, BASE_DEC, NULL, 0x00, \
2170  NULL, HFILL } \
2171  }, \
2172  { & name .hf.hs_ext_oid_filters_oid_length, \
2173  { "Certificate Extension OID Length", prefix ".extension.oid_filters.oid_length", \
2174  FT_UINT8, BASE_DEC, NULL, 0x00, \
2175  NULL, HFILL } \
2176  }, \
2177  { & name .hf.hs_ext_oid_filters_oid, \
2178  { "Certificate Extension OID", prefix ".extension.oid_filters.oid", \
2179  FT_OID, BASE_NONE, NULL, 0x00, \
2180  NULL, HFILL } \
2181  }, \
2182  { & name .hf.hs_ext_oid_filters_values_length, \
2183  { "Certificate Extension Values Length", prefix ".extension.oid_filters.values_length", \
2184  FT_UINT16, BASE_DEC, NULL, 0x00, \
2185  NULL, HFILL } \
2186  }, \
2187  { & name .hf.hs_cred_valid_time, \
2188  { "Valid Time", prefix ".handshake.cred.valid_time", \
2189  FT_UINT16, BASE_DEC, NULL, 0x0, \
2190  "Delegated Credentials Valid Time", HFILL } \
2191  }, \
2192  { & name .hf.hs_cred_pubkey, \
2193  { "Subject Public Key Info", prefix ".handshake.cred.pubkey", \
2194  FT_BYTES, BASE_NONE, NULL, 0x0, \
2195  "Delegated Credentials Subject Public Key Info", HFILL } \
2196  }, \
2197  { & name .hf.hs_cred_pubkey_len, \
2198  { "Subject Public Key Info Length", prefix ".handshake.cred.pubkey_len", \
2199  FT_UINT24, BASE_DEC, NULL, 0x0, \
2200  "Delegated Credentials Subject Public Key Info Length", HFILL } \
2201  }, \
2202  { & name .hf.hs_cred_signature, \
2203  { "Signature", prefix ".handshake.cred.signature", \
2204  FT_BYTES, BASE_NONE, NULL, 0x0, \
2205  "Delegated Credentials Signature", HFILL } \
2206  }, \
2207  { & name .hf.hs_cred_signature_len, \
2208  { "Signature Length", prefix ".handshake.cred.signature_len", \
2209  FT_UINT16, BASE_DEC, NULL, 0x0, \
2210  "Delegated Credentials Signature Length", HFILL } \
2211  }, \
2212  { & name .hf.hs_ext_compress_certificate_algorithms_length, \
2213  { "Algorithms Length", prefix ".compress_certificate.algorithms_length", \
2214  FT_UINT8, BASE_DEC, NULL, 0x00, \
2215  NULL, HFILL } \
2216  }, \
2217  { & name .hf.hs_ext_compress_certificate_algorithm, \
2218  { "Algorithm", prefix ".compress_certificate.algorithm", \
2219  FT_UINT16, BASE_DEC, VALS(compress_certificate_algorithm_vals), 0x00, \
2220  NULL, HFILL } \
2221  }, \
2222  { & name .hf.hs_ext_compress_certificate_uncompressed_length, \
2223  { "Uncompressed Length", prefix ".compress_certificate.uncompressed_length", \
2224  FT_UINT24, BASE_DEC, NULL, 0x00, \
2225  NULL, HFILL } \
2226  }, \
2227  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message_length, \
2228  { "Length", prefix ".compress_certificate.compressed_certificate_message.length", \
2229  FT_UINT24, BASE_DEC, NULL, 0x00, \
2230  NULL, HFILL } \
2231  }, \
2232  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message, \
2233  { "Compressed Certificate Message", prefix ".compress_certificate.compressed_certificate_message", \
2234  FT_BYTES, BASE_NONE, NULL, 0x00, \
2235  NULL, HFILL } \
2236  }, \
2237  { & name .hf.hs_ext_token_binding_version_major, \
2238  { "Protocol Major Version", prefix ".token_binding.version_major", \
2239  FT_UINT8, BASE_HEX, NULL, 0x00, \
2240  "Major version of the Token Binding protocol", HFILL } \
2241  }, \
2242  { & name .hf.hs_ext_token_binding_version_minor, \
2243  { "Protocol Minor Version", prefix ".token_binding.version_minor", \
2244  FT_UINT8, BASE_HEX, NULL, 0x00, \
2245  "Minor version of the Token Binding protocol", HFILL } \
2246  }, \
2247  { & name .hf.hs_ext_token_binding_key_parameters, \
2248  { "Key Parameters", prefix ".token_binding.key_parameters", \
2249  FT_NONE, BASE_NONE, NULL, 0x0, \
2250  NULL, HFILL } \
2251  }, \
2252  { & name .hf.hs_ext_token_binding_key_parameters_length, \
2253  { "Key Parameters Length", prefix ".token_binding.key_parameters_length", \
2254  FT_UINT8, BASE_DEC, NULL, 0x00, \
2255  "Length of the key parameters list", HFILL } \
2256  }, \
2257  { & name .hf.hs_ext_token_binding_key_parameter, \
2258  { "Key Parameter", prefix ".token_binding.key_parameter", \
2259  FT_UINT8, BASE_DEC, VALS(token_binding_key_parameter_vals), 0x00, \
2260  "Identifier of the Token Binding key parameter", HFILL } \
2261  }, \
2262  { & name .hf.hs_ext_record_size_limit, \
2263  { "Record Size Limit", prefix ".record_size_limit", \
2264  FT_UINT16, BASE_DEC, NULL, 0x00, \
2265  "Maximum record size that an endpoint is willing to receive", HFILL } \
2266  }, \
2267  { & name .hf.hs_ext_quictp_len, \
2268  { "Parameters Length", prefix ".quic.len", \
2269  FT_UINT16, BASE_DEC, NULL, 0x00, \
2270  NULL, HFILL } \
2271  }, \
2272  { & name .hf.hs_ext_quictp_parameter, \
2273  { "Parameter", prefix ".quic.parameter", \
2274  FT_NONE, BASE_NONE, NULL, 0x00, \
2275  NULL, HFILL } \
2276  }, \
2277  { & name .hf.hs_ext_quictp_parameter_type, \
2278  { "Type", prefix ".quic.parameter.type", \
2279  FT_UINT64, BASE_CUSTOM, CF_FUNC(quic_transport_parameter_id_base_custom), 0x00, \
2280  NULL, HFILL } \
2281  }, \
2282  { & name .hf.hs_ext_quictp_parameter_len, \
2283  { "Length", prefix ".quic.parameter.length", \
2284  FT_UINT64, BASE_DEC, NULL, 0x00, \
2285  NULL, HFILL } \
2286  }, \
2287  { & name .hf.hs_ext_quictp_parameter_len_old, \
2288  { "Length", prefix ".quic.parameter.lengt.old", \
2289  FT_UINT16, BASE_DEC, NULL, 0x00, \
2290  NULL, HFILL } \
2291  }, \
2292  { & name .hf.hs_ext_quictp_parameter_value, \
2293  { "Value", prefix ".quic.parameter.value", \
2294  FT_BYTES, BASE_NONE, NULL, 0x00, \
2295  NULL, HFILL } \
2296  }, \
2297  { & name .hf.hs_ext_quictp_parameter_original_destination_connection_id, \
2298  { "original_destination_connection_id", prefix ".quic.parameter.original_destination_connection_id", \
2299  FT_BYTES, BASE_NONE, NULL, 0x00, \
2300  "Destination Connection ID from the first Initial packet sent by the client", HFILL } \
2301  }, \
2302  { & name .hf.hs_ext_quictp_parameter_max_idle_timeout, \
2303  { "max_idle_timeout", prefix ".quic.parameter.max_idle_timeout", \
2304  FT_UINT64, BASE_DEC, NULL, 0x00, \
2305  "In milliseconds", HFILL } \
2306  }, \
2307  { & name .hf.hs_ext_quictp_parameter_stateless_reset_token, \
2308  { "stateless_reset_token", prefix ".quic.parameter.stateless_reset_token", \
2309  FT_BYTES, BASE_NONE, NULL, 0x00, \
2310  "Used in verifying a stateless reset", HFILL } \
2311  }, \
2312  { & name .hf.hs_ext_quictp_parameter_max_udp_payload_size, \
2313  { "max_udp_payload_size", prefix ".quic.parameter.max_udp_payload_size", \
2314  FT_UINT64, BASE_DEC, NULL, 0x00, \
2315  "Maximum UDP payload size that the endpoint is willing to receive", HFILL } \
2316  }, \
2317  { & name .hf.hs_ext_quictp_parameter_initial_max_data, \
2318  { "initial_max_data", prefix ".quic.parameter.initial_max_data", \
2319  FT_UINT64, BASE_DEC, NULL, 0x00, \
2320  "Contains the initial value for the maximum amount of data that can be sent on the connection", HFILL } \
2321  }, \
2322  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local, \
2323  { "initial_max_stream_data_bidi_local", prefix ".quic.parameter.initial_max_stream_data_bidi_local", \
2324  FT_UINT64, BASE_DEC, NULL, 0x00, \
2325  "Initial stream maximum data for bidirectional, locally-initiated streams", HFILL } \
2326  }, \
2327  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote, \
2328  { "initial_max_stream_data_bidi_remote", prefix ".quic.parameter.initial_max_stream_data_bidi_remote", \
2329  FT_UINT64, BASE_DEC, NULL, 0x00, \
2330  "Initial stream maximum data for bidirectional, peer-initiated streams", HFILL } \
2331  }, \
2332  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_uni, \
2333  { "initial_max_stream_data_uni", prefix ".quic.parameter.initial_max_stream_data_uni", \
2334  FT_UINT64, BASE_DEC, NULL, 0x00, \
2335  "Initial stream maximum data for unidirectional streams parameter", HFILL } \
2336  }, \
2337  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_bidi, \
2338  { "initial_max_streams_bidi", prefix ".quic.parameter.initial_max_streams_bidi", \
2339  FT_UINT64, BASE_DEC, NULL, 0x00, \
2340  "Initial maximum number of application-owned bidirectional streams", HFILL } \
2341  }, \
2342  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_uni, \
2343  { "initial_max_streams_uni", prefix ".quic.parameter.initial_max_streams_uni", \
2344  FT_UINT64, BASE_DEC, NULL, 0x00, \
2345  "Initial maximum number of application-owned unidirectional streams", HFILL } \
2346  }, \
2347  { & name .hf.hs_ext_quictp_parameter_ack_delay_exponent, \
2348  { "ack_delay_exponent", prefix ".quic.parameter.ack_delay_exponent", \
2349  FT_UINT64, BASE_DEC, NULL, 0x00, \
2350  "Indicating an exponent used to decode the ACK Delay field in the ACK frame,", HFILL } \
2351  }, \
2352  { & name .hf.hs_ext_quictp_parameter_max_ack_delay, \
2353  { "max_ack_delay", prefix ".quic.parameter.max_ack_delay", \
2354  FT_UINT64, BASE_DEC, NULL, 0x00, \
2355  "Indicating the maximum amount of time in milliseconds by which it will delay sending of acknowledgments", HFILL } \
2356  }, \
2357  { & name .hf.hs_ext_quictp_parameter_pa_ipv4address, \
2358  { "ipv4Address", prefix ".quic.parameter.preferred_address.ipv4address", \
2359  FT_IPv4, BASE_NONE, NULL, 0x00, \
2360  NULL, HFILL } \
2361  }, \
2362  { & name .hf.hs_ext_quictp_parameter_pa_ipv6address, \
2363  { "ipv6Address", prefix ".quic.parameter.preferred_address.ipv6address", \
2364  FT_IPv6, BASE_NONE, NULL, 0x00, \
2365  NULL, HFILL } \
2366  }, \
2367  { & name .hf.hs_ext_quictp_parameter_pa_ipv4port, \
2368  { "ipv4Port", prefix ".quic.parameter.preferred_address.ipv4port", \
2369  FT_UINT16, BASE_DEC, NULL, 0x00, \
2370  NULL, HFILL } \
2371  }, \
2372  { & name .hf.hs_ext_quictp_parameter_pa_ipv6port, \
2373  { "ipv6Port", prefix ".quic.parameter.preferred_address.ipv6port", \
2374  FT_UINT16, BASE_DEC, NULL, 0x00, \
2375  NULL, HFILL } \
2376  }, \
2377  { & name .hf.hs_ext_quictp_parameter_pa_connectionid_length, \
2378  { "Length", prefix ".quic.parameter.preferred_address.connectionid.length", \
2379  FT_UINT8, BASE_DEC, NULL, 0x00, \
2380  "Length of connectionId Field", HFILL } \
2381  }, \
2382  { & name .hf.hs_ext_quictp_parameter_pa_connectionid, \
2383  { "connectionId", prefix ".quic.parameter.preferred_address.connectionid", \
2384  FT_BYTES, BASE_NONE, NULL, 0x00, \
2385  NULL, HFILL } \
2386  }, \
2387  { & name .hf.hs_ext_quictp_parameter_pa_statelessresettoken, \
2388  { "statelessResetToken", prefix ".quic.parameter.preferred_address.statelessresettoken", \
2389  FT_BYTES, BASE_NONE, NULL, 0x00, \
2390  NULL, HFILL } \
2391  }, \
2392  { & name .hf.hs_ext_quictp_parameter_active_connection_id_limit, \
2393  { "Active Connection ID Limit", prefix ".quic.parameter.active_connection_id_limit", \
2394  FT_UINT64, BASE_DEC, NULL, 0x00, \
2395  NULL, HFILL } \
2396  }, \
2397  { & name .hf.hs_ext_quictp_parameter_initial_source_connection_id, \
2398  { "Initial Source Connection ID", prefix ".quic.parameter.initial_source_connection_id", \
2399  FT_BYTES, BASE_NONE, NULL, 0x00, \
2400  NULL, HFILL } \
2401  }, \
2402  { & name .hf.hs_ext_quictp_parameter_retry_source_connection_id, \
2403  { "Retry Source Connection ID", prefix ".quic.parameter.retry_source_connection_id", \
2404  FT_BYTES, BASE_NONE, NULL, 0x00, \
2405  NULL, HFILL } \
2406  }, \
2407  { & name .hf.hs_ext_quictp_parameter_max_datagram_frame_size, \
2408  { "max_datagram_frame_size", prefix ".quic.parameter.max_datagram_frame_size", \
2409  FT_UINT64, BASE_DEC, NULL, 0x00, \
2410  NULL, HFILL } \
2411  }, \
2412  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_length, \
2413  { "length", prefix ".quic.parameter.cibir_encoding.length", \
2414  FT_UINT64, BASE_DEC, NULL, 0x00, \
2415  NULL, HFILL } \
2416  }, \
2417  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_offset, \
2418  { "offset", prefix ".quic.parameter.cibir_encoding.offset", \
2419  FT_UINT64, BASE_DEC, NULL, 0x00, \
2420  NULL, HFILL } \
2421  }, \
2422  { & name .hf.hs_ext_quictp_parameter_loss_bits, \
2423  { "loss_bits", prefix ".quic.parameter.loss_bits", \
2424  FT_UINT64, BASE_DEC, NULL, 0x00, \
2425  NULL, HFILL } \
2426  }, \
2427  { & name .hf.hs_ext_quictp_parameter_enable_time_stamp_v2, \
2428  { "Enable TimestampV2", prefix ".quic.parameter.enable_time_stamp_v2", \
2429  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_time_stamp_v2_vals), 0x00, \
2430  NULL, HFILL } \
2431  }, \
2432  { & name .hf.hs_ext_quictp_parameter_min_ack_delay, \
2433  { "min_ack_delay", prefix ".quic.parameter.min_ack_delay", \
2434  FT_UINT64, BASE_DEC, NULL, 0x00, \
2435  NULL, HFILL } \
2436  }, \
2437  { & name .hf.hs_ext_quictp_parameter_google_user_agent_id, \
2438  { "Google UserAgent", prefix ".quic.parameter.google.user_agent", \
2439  FT_STRING, BASE_NONE, NULL, 0x00, \
2440  NULL, HFILL } \
2441  }, \
2442  { & name .hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported, \
2443  { "Google Key Update not yet supported", prefix ".quic.parameter.google.key_update_not_yet_supported", \
2444  FT_NONE, BASE_NONE, NULL, 0x00, \
2445  NULL, HFILL } \
2446  }, \
2447  { & name .hf.hs_ext_quictp_parameter_google_quic_version, \
2448  { "Google QUIC version", prefix ".quic.parameter.google.quic_version", \
2449  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2450  NULL, HFILL } \
2451  }, \
2452  { & name .hf.hs_ext_quictp_parameter_google_initial_rtt, \
2453  { "Google Initial RTT", prefix ".quic.parameter.google.initial_rtt", \
2454  FT_UINT64, BASE_DEC, NULL, 0x00, \
2455  NULL, HFILL } \
2456  }, \
2457  { & name .hf.hs_ext_quictp_parameter_google_support_handshake_done, \
2458  { "Google Support Handshake Done", prefix ".quic.parameter.google.support_handshake_done", \
2459  FT_NONE, BASE_NONE, NULL, 0x00, \
2460  NULL, HFILL } \
2461  }, \
2462  { & name .hf.hs_ext_quictp_parameter_google_quic_params, \
2463  { "Google QUIC parameters", prefix ".quic.parameter.google.quic_params", \
2464  FT_BYTES, BASE_NONE, NULL, 0x00, \
2465  NULL, HFILL } \
2466  }, \
2467  { & name .hf.hs_ext_quictp_parameter_google_quic_params_unknown_field, \
2468  { "Google Unknown Field", prefix ".quic.parameter.google.quic_params_unknown_field", \
2469  FT_BYTES, BASE_NONE, NULL, 0x00, \
2470  NULL, HFILL } \
2471  }, \
2472  { & name .hf.hs_ext_quictp_parameter_google_connection_options, \
2473  { "Google Connection options", prefix ".quic.parameter.google.connection_options", \
2474  FT_BYTES, BASE_NONE, NULL, 0x00, \
2475  NULL, HFILL } \
2476  }, \
2477  { & name .hf.hs_ext_quictp_parameter_google_supported_versions_length, \
2478  { "Google Supported Versions Length", prefix ".quic.parameter.google.supported_versions_length", \
2479  FT_UINT8, BASE_DEC, NULL, 0x00, \
2480  NULL, HFILL } \
2481  }, \
2482  { & name .hf.hs_ext_quictp_parameter_google_supported_version, \
2483  { "Google Supported Version", prefix ".quic.parameter.google.supported_version", \
2484  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2485  NULL, HFILL } \
2486  }, \
2487  { & name .hf.hs_ext_quictp_parameter_facebook_partial_reliability, \
2488  { "Facebook Partial Reliability", prefix ".quic.parameter.facebook.partial_reliability", \
2489  FT_UINT64, BASE_DEC, NULL, 0x00, \
2490  NULL, HFILL } \
2491  }, \
2492  { & name .hf.hs_ext_quictp_parameter_chosen_version, \
2493  { "Chosen Version", prefix ".quic.parameter.vi.chosen_version", \
2494  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2495  NULL, HFILL } \
2496  }, \
2497  { & name .hf.hs_ext_quictp_parameter_other_version, \
2498  { "Other Version", prefix ".quic.parameter.vi.other_version", \
2499  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2500  NULL, HFILL } \
2501  }, \
2502  { & name .hf.hs_ext_quictp_parameter_enable_multipath, \
2503  { "Enable Multipath", prefix ".quic.parameter.enable_multipath", \
2504  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_multipath_vals), 0x00, \
2505  NULL, HFILL } \
2506  }, \
2507  { & name .hf.hs_ext_quictp_parameter_initial_max_paths, \
2508  { "Initial Max Paths", prefix ".quic.parameter.initial_max_paths", \
2509  FT_UINT64, BASE_DEC, NULL, 0x00, \
2510  NULL, HFILL } \
2511  }, \
2512  { & name .hf.hs_ext_connection_id_length, \
2513  { "Connection ID length", prefix ".connection_id_length", \
2514  FT_UINT8, BASE_DEC, NULL, 0x00, \
2515  NULL, HFILL } \
2516  }, \
2517  { & name .hf.hs_ext_connection_id, \
2518  { "Connection ID", prefix ".connection_id", \
2519  FT_BYTES, BASE_NONE, NULL, 0x00, \
2520  NULL, HFILL } \
2521  }, \
2522  { & name .hf.esni_suite, \
2523  { "Cipher Suite", prefix ".esni.suite", \
2524  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2525  "Cipher suite used to encrypt the SNI", HFILL } \
2526  }, \
2527  { & name .hf.esni_record_digest_length, \
2528  { "Record Digest Length", prefix ".esni.record_digest_length", \
2529  FT_UINT16, BASE_DEC, NULL, 0x00, \
2530  NULL, HFILL } \
2531  }, \
2532  { & name .hf.esni_record_digest, \
2533  { "Record Digest", prefix ".esni.record_digest", \
2534  FT_BYTES, BASE_NONE, NULL, 0x00, \
2535  "Cryptographic hash of the ESNIKeys from which the ESNI key was obtained", HFILL } \
2536  }, \
2537  { & name .hf.esni_encrypted_sni_length, \
2538  { "Encrypted SNI Length", prefix ".esni.encrypted_sni_length", \
2539  FT_UINT16, BASE_DEC, NULL, 0x00, \
2540  NULL, HFILL } \
2541  }, \
2542  { & name .hf.esni_encrypted_sni, \
2543  { "Encrypted SNI", prefix ".esni.encrypted_sni", \
2544  FT_BYTES, BASE_NONE, NULL, 0x00, \
2545  "The encrypted ClientESNIInner structure", HFILL } \
2546  }, \
2547  { & name .hf.esni_nonce, \
2548  { "Nonce", prefix ".esni.nonce", \
2549  FT_BYTES, BASE_NONE, NULL, 0x00, \
2550  "Contents of ClientESNIInner.nonce", HFILL } \
2551  }, \
2552  { & name .hf.ech_echconfiglist_length, \
2553  { "ECHConfigList length", prefix ".ech.echconfiglist_length", \
2554  FT_UINT16, BASE_DEC, NULL, 0x0, \
2555  "Encrypted ClientHello (ECH) Configurations length", HFILL } \
2556  }, \
2557  { & name .hf.ech_echconfiglist, \
2558  { "ECHConfigList", prefix ".ech.echconfiglist", \
2559  FT_NONE, BASE_NONE, NULL, 0x0, \
2560  "Encrypted ClientHello (ECH) Configurations", HFILL } \
2561  }, \
2562  { & name .hf.ech_echconfig, \
2563  { "ECHConfig", prefix ".ech.echconfig", \
2564  FT_NONE, BASE_NONE, NULL, 0x0, \
2565  "Encrypted ClientHello (ECH) Configuration", HFILL } \
2566  }, \
2567  { & name .hf.ech_echconfig_version, \
2568  { "Version", prefix ".ech.echconfig.version", \
2569  FT_UINT16, BASE_HEX, NULL, 0x0, \
2570  "Encrypted ClientHello: ECHConfig version", HFILL } \
2571  }, \
2572  { & name .hf.ech_echconfig_length, \
2573  { "Length", prefix ".ech.echconfig.length", \
2574  FT_UINT16, BASE_DEC, NULL, 0x0, \
2575  "Encrypted ClientHello: ECHConfig length", HFILL } \
2576  }, \
2577  { & name .hf.ech_echconfigcontents_maximum_name_length, \
2578  { "Maximum Name Length", prefix ".ech.echconfigcontents.maximum_name_length", \
2579  FT_UINT8, BASE_DEC, NULL, 0x0, \
2580  "The longest name of a backend server, if known", HFILL } \
2581  }, \
2582  { & name .hf.ech_echconfigcontents_public_name_length, \
2583  { "Public Name length", prefix ".ech.echconfigcontents.public_name_length", \
2584  FT_UINT8, BASE_DEC, NULL, 0x0, \
2585  "Length of the Public Name field", HFILL } \
2586  }, \
2587  { & name .hf.ech_echconfigcontents_public_name, \
2588  { "Public Name", prefix ".ech.echconfigcontents.public_name", \
2589  FT_STRING, BASE_NONE, NULL, 0x0, \
2590  "The DNS name of the client-facing server, i.e., the entity trusted to update the ECH configuration", HFILL } \
2591  }, \
2592  { & name .hf.ech_echconfigcontents_extensions_length, \
2593  { "Extensions length", prefix ".ech.echconfigcontents.extensions_length", \
2594  FT_UINT16, BASE_DEC, NULL, 0x0, \
2595  "Length of the Extensions field", HFILL } \
2596  }, \
2597  { & name .hf.ech_echconfigcontents_extensions, \
2598  { "Extensions", prefix ".ech.echconfigcontents.extensions", \
2599  FT_BYTES, BASE_NONE, NULL, 0x0, \
2600  "A list of extensions that the client must take into consideration when generating a ClientHello message", HFILL } \
2601  }, \
2602  { & name .hf.ech_hpke_keyconfig, \
2603  { "HKPE Key Config", prefix ".ech.hpke.keyconfig", \
2604  FT_NONE, BASE_NONE, NULL, 0x0, \
2605  "HPKE Key Config", HFILL } \
2606  }, \
2607  { & name .hf.ech_hpke_keyconfig_config_id, \
2608  { "Config Id", prefix ".ech.hpke.keyconfig.config_id", \
2609  FT_UINT8, BASE_DEC, NULL, 0x0, \
2610  "HPKE Config Id", HFILL } \
2611  }, \
2612  { & name .hf.ech_hpke_keyconfig_kem_id, \
2613  { "KEM Id", prefix ".ech.hpke.keyconfig.kem_id", \
2614  FT_UINT16, BASE_DEC, VALS(kem_id_type_vals), 0x0, \
2615  "HPKE KEM Id", HFILL } \
2616  }, \
2617  { & name .hf.ech_hpke_keyconfig_public_key_length, \
2618  { "Public Key length", prefix ".ech.hpke.keyconfig.public_key_length", \
2619  FT_UINT16, BASE_DEC, NULL, 0x0, \
2620  "HPKE Public Key length", HFILL } \
2621  }, \
2622  { & name .hf.ech_hpke_keyconfig_public_key, \
2623  { "Public Key", prefix ".ech.hpke.keyconfig.public_key", \
2624  FT_BYTES, BASE_NONE, NULL, 0x0, \
2625  "HPKE Public Key", HFILL } \
2626  }, \
2627  { & name .hf.ech_hpke_keyconfig_cipher_suites, \
2628  { "Cipher Suites", prefix ".ech.hpke.keyconfig.cipher_suites", \
2629  FT_NONE, BASE_NONE, NULL, 0x0, \
2630  "HPKE Cipher Suites", HFILL } \
2631  }, \
2632  { & name .hf.ech_hpke_keyconfig_cipher_suites_length, \
2633  { "Cipher Suites length", prefix ".ech.hpke.keyconfig.cipher_suites_length", \
2634  FT_UINT16, BASE_DEC, NULL, 0x0, \
2635  "HPKE Cipher Suites length", HFILL } \
2636  }, \
2637  { & name .hf.ech_hpke_keyconfig_cipher_suite, \
2638  { "Cipher Suite", prefix ".ech.hpke.keyconfig.cipher_suite", \
2639  FT_NONE, BASE_NONE, NULL, 0x0, \
2640  "HPKE Cipher Suite", HFILL } \
2641  }, \
2642  { & name .hf.ech_hpke_keyconfig_cipher_suite_kdf_id, \
2643  { "KDF Id", prefix ".ech.hpke.keyconfig.cipher_suite.kdf_id", \
2644  FT_UINT16, BASE_DEC, VALS(kdf_id_type_vals), 0x0, \
2645  "HKPE KDF Id", HFILL } \
2646  }, \
2647  { & name .hf.ech_hpke_keyconfig_cipher_suite_aead_id, \
2648  { "AEAD Id", prefix ".ech.hpke.keyconfig.cipher_suite.aead_id", \
2649  FT_UINT16, BASE_DEC, VALS(aead_id_type_vals), 0x0, \
2650  "HKPE AEAD Id", HFILL } \
2651  }, \
2652  { & name .hf.ech_clienthello_type, \
2653  { "Client Hello type", prefix ".ech.client_hello_type", \
2654  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_ech_clienthello_types), 0x0, \
2655  "Client Hello type", HFILL } \
2656  }, \
2657  { & name .hf.ech_cipher_suite, \
2658  { "Cipher Suite", prefix ".ech.cipher_suite", \
2659  FT_NONE, BASE_NONE, NULL, 0x0, \
2660  "The cipher suite used to encrypt ClientHelloInner", HFILL } \
2661  }, \
2662  { & name .hf.ech_config_id, \
2663  { "Config Id", prefix ".ech.config_id", \
2664  FT_UINT8, BASE_DEC, NULL, 0x0, \
2665  "The ECHConfigContents.key_config.config_id for the chosen ECHConfig", HFILL } \
2666  }, \
2667  { & name .hf.ech_enc_length, \
2668  { "Enc length", prefix ".ech.enc_length", \
2669  FT_UINT16, BASE_DEC, NULL, 0x0, \
2670  NULL, HFILL } \
2671  }, \
2672  { & name .hf.ech_enc, \
2673  { "Enc", prefix ".ech.enc", \
2674  FT_BYTES, BASE_NONE, NULL, 0x0, \
2675  "The HPKE encapsulated key, used by servers to decrypt the corresponding payload field", HFILL } \
2676  }, \
2677  { & name .hf.ech_payload_length, \
2678  { "Payload length", prefix ".ech.payload_length", \
2679  FT_UINT16, BASE_DEC, NULL, 0x0, \
2680  "Payload Length", HFILL } \
2681  }, \
2682  { & name .hf.ech_payload, \
2683  { "Payload", prefix ".ech.payload", \
2684  FT_BYTES, BASE_NONE, NULL, 0x0, \
2685  "The serialized and encrypted ClientHelloInner structure", HFILL } \
2686  }, \
2687  { & name .hf.ech_confirmation, \
2688  { "Confirmation", prefix ".ech.confirmation", \
2689  FT_BYTES, BASE_NONE, NULL, 0x0, \
2690  "Confirmation of ECH acceptance in a HelloRetryRequest", HFILL } \
2691  }, \
2692  { & name .hf.ech_retry_configs, \
2693  { "Retry Configs", prefix ".ech.retry_configs", \
2694  FT_NONE, BASE_NONE, NULL, 0x0, \
2695  "ECHConfig structures for one-time use by the client in a retry connection", HFILL } \
2696  }, \
2697  { & name .hf.hs_ext_alps_len, \
2698  { "ALPS Extension Length", prefix ".handshake.extensions_alps_len", \
2699  FT_UINT16, BASE_DEC, NULL, 0x0, \
2700  "Length of the ALPS Extension", HFILL } \
2701  }, \
2702  { & name .hf.hs_ext_alps_alpn_list, \
2703  { "Supported ALPN List", prefix ".handshake.extensions_alps_alpn_list", \
2704  FT_NONE, BASE_NONE, NULL, 0x0, \
2705  "List of supported ALPN by ALPS", HFILL } \
2706  }, \
2707  { & name .hf.hs_ext_alps_alpn_str_len, \
2708  { "Supported ALPN Length", prefix ".handshake.extensions_alps_alpn_str_len", \
2709  FT_UINT8, BASE_DEC, NULL, 0x0, \
2710  "Length of ALPN string", HFILL } \
2711  }, \
2712  { & name .hf.hs_ext_alps_alpn_str, \
2713  { "Supported ALPN", prefix ".handshake.extensions_alps_alpn_str", \
2714  FT_STRING, BASE_NONE, NULL, 0x00, \
2715  "ALPN supported by ALPS", HFILL } \
2716  }, \
2717  { & name .hf.hs_ext_alps_settings, \
2718  { "ALPN Opaque Settings", prefix ".handshake.extensions_alps.settings", \
2719  FT_BYTES, BASE_NONE, NULL, 0x00, \
2720  "ALPN Opaque Settings", HFILL } \
2721  }
2722 /* }}} */
2723 
2724 /* {{{ */
2725 #define SSL_COMMON_ETT_LIST(name) \
2726  & name .ett.hs_ext, \
2727  & name .ett.hs_ext_alpn, \
2728  & name .ett.hs_ext_cert_types, \
2729  & name .ett.hs_ext_groups, \
2730  & name .ett.hs_ext_curves_point_formats, \
2731  & name .ett.hs_ext_npn, \
2732  & name .ett.hs_ext_reneg_info, \
2733  & name .ett.hs_ext_key_share, \
2734  & name .ett.hs_ext_key_share_ks, \
2735  & name .ett.hs_ext_pre_shared_key, \
2736  & name .ett.hs_ext_psk_identity, \
2737  & name .ett.hs_ext_server_name, \
2738  & name .ett.hs_ext_oid_filter, \
2739  & name .ett.hs_ext_quictp_parameter, \
2740  & name .ett.hs_sig_hash_alg, \
2741  & name .ett.hs_sig_hash_algs, \
2742  & name .ett.urlhash, \
2743  & name .ett.keyex_params, \
2744  & name .ett.certificates, \
2745  & name .ett.cert_types, \
2746  & name .ett.dnames, \
2747  & name .ett.hs_random, \
2748  & name .ett.cipher_suites, \
2749  & name .ett.comp_methods, \
2750  & name .ett.session_ticket, \
2751  & name .ett.sct, \
2752  & name .ett.cert_status, \
2753  & name .ett.ocsp_response, \
2754  & name .ett.uncompressed_certificates, \
2755  & name .ett.hs_ext_alps, \
2756  & name .ett.ech_echconfiglist, \
2757  & name .ett.ech_echconfig, \
2758  & name .ett.ech_retry_configs, \
2759  & name .ett.ech_hpke_keyconfig, \
2760  & name .ett.ech_hpke_cipher_suites, \
2761  & name .ett.ech_hpke_cipher_suite, \
2762  & name .ett.hs_ext_token_binding_key_parameters, \
2763 
2764 /* }}} */
2765 
2766 /* {{{ */
2767 #define SSL_COMMON_EI_LIST(name, prefix) \
2768  { & name .ei.client_version_error, \
2769  { prefix ".handshake.client_version_error", PI_PROTOCOL, PI_WARN, \
2770  "Client Hello legacy version field specifies version 1.3, not version 1.2; some servers may not be able to handle that.", EXPFILL } \
2771  }, \
2772  { & name .ei.server_version_error, \
2773  { prefix ".handshake.server_version_error", PI_PROTOCOL, PI_WARN, \
2774  "Server Hello legacy version field specifies version 1.3, not version 1.2; some middleboxes may not be able to handle that.", EXPFILL } \
2775  }, \
2776  { & name .ei.legacy_version, \
2777  { prefix ".handshake.legacy_version", PI_DEPRECATED, PI_CHAT, \
2778  "This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.", EXPFILL } \
2779  }, \
2780  { & name .ei.malformed_vector_length, \
2781  { prefix ".malformed.vector_length", PI_PROTOCOL, PI_WARN, \
2782  "Variable vector length is outside the permitted range", EXPFILL } \
2783  }, \
2784  { & name .ei.malformed_buffer_too_small, \
2785  { prefix ".malformed.buffer_too_small", PI_MALFORMED, PI_ERROR, \
2786  "Malformed message, not enough data is available", EXPFILL } \
2787  }, \
2788  { & name .ei.malformed_trailing_data, \
2789  { prefix ".malformed.trailing_data", PI_PROTOCOL, PI_WARN, \
2790  "Undecoded trailing data is present", EXPFILL } \
2791  }, \
2792  { & name .ei.hs_ext_cert_status_undecoded, \
2793  { prefix ".handshake.status_request.undecoded", PI_UNDECODED, PI_NOTE, \
2794  "Responder ID list or Request Extensions are not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2795  }, \
2796  { & name .ei.hs_ciphersuite_undecoded, \
2797  { prefix ".handshake.ciphersuite.undecoded", PI_UNDECODED, PI_NOTE, \
2798  "Ciphersuite not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2799  }, \
2800  { & name .ei.hs_srv_keyex_illegal, \
2801  { prefix ".handshake.server_keyex_illegal", PI_PROTOCOL, PI_WARN, \
2802  "It is not legal to send the ServerKeyExchange message for this ciphersuite", EXPFILL } \
2803  }, \
2804  { & name .ei.resumed, \
2805  { prefix ".resumed", PI_SEQUENCE, PI_NOTE, \
2806  "This session reuses previously negotiated keys (Session resumption)", EXPFILL } \
2807  }, \
2808  { & name .ei.record_length_invalid, \
2809  { prefix ".record.length.invalid", PI_PROTOCOL, PI_ERROR, \
2810  "Record fragment length is too small or too large", EXPFILL } \
2811  }, \
2812  { & name .ei.decompression_error, \
2813  { prefix ".decompression_error", PI_PROTOCOL, PI_ERROR, \
2814  "Decompression error", EXPFILL } \
2815  }, \
2816  { & name .ei.ech_echconfig_invalid_version, \
2817  { prefix ".ech_echconfig_invalid_version", PI_PROTOCOL, PI_ERROR, \
2818  "Invalid/unknown ECHConfig version", EXPFILL } \
2819  }
2820 /* }}} */
2821 
2822 extern void
2823 ssl_common_register_ssl_alpn_dissector_table(const char *name,
2824  const char *ui_name, const int proto);
2825 
2826 extern void
2827 ssl_common_register_dtls_alpn_dissector_table(const char *name,
2828  const char *ui_name, const int proto);
2829 
2830 extern void
2831 ssl_common_register_options(module_t *module, ssl_common_options_t *options, gboolean is_dtls);
2832 
2833 #ifdef SSL_DECRYPT_DEBUG
2834 extern void
2835 ssl_debug_printf(const gchar* fmt,...) G_GNUC_PRINTF(1,2);
2836 extern void
2837 ssl_print_data(const gchar* name, const guchar* data, size_t len);
2838 extern void
2839 ssl_print_string(const gchar* name, const StringInfo* data);
2840 extern void
2841 ssl_set_debug(const gchar* name);
2842 extern void
2843 ssl_debug_flush(void);
2844 #else
2845 
2846 /* No debug: nullify debug operation*/
2847 static inline void G_GNUC_PRINTF(1,2)
2848 ssl_debug_printf(const gchar* fmt _U_,...)
2849 {
2850 }
2851 #define ssl_print_data(a, b, c)
2852 #define ssl_print_string(a, b)
2853 #define ssl_set_debug(name)
2854 #define ssl_debug_flush()
2855 
2856 #endif /* SSL_DECRYPT_DEBUG */
2857 
2858 
2859 guint32
2860 ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
2861  proto_tree *tree, guint32 offset, guint32 offset_end);
2862 
2863 #endif /* __PACKET_TLS_UTILS_H__ */
2864 
2865 /*
2866  * Editor modelines - https://www.wireshark.org/tools/modelines.html
2867  *
2868  * Local variables:
2869  * c-basic-offset: 4
2870  * tab-width: 8
2871  * indent-tabs-mode: nil
2872  * End:
2873  *
2874  * vi: set shiftwidth=4 tabstop=8 expandtab:
2875  * :indentSize=4:tabSize=8:noTabs=true:
2876  */
Definition: packet-tls-utils.h:330
Definition: packet-tls-utils.h:346
StringInfo app_traffic_secret
Definition: packet-tls-utils.h:357
guint64 seq
Definition: packet-tls-utils.h:354
Definition: packet-tls-utils.c:2542
Definition: packet-tls-utils.h:504
Definition: packet-tls-utils.h:338
Definition: packet-tls-utils.h:419
SslFlow * flow
Definition: packet-tls-utils.h:425
guint32 seq
Definition: packet-tls-utils.h:427
gint id
Definition: packet-tls-utils.h:422
guint data_len
Definition: packet-tls-utils.h:421
guchar * plain_data
Definition: packet-tls-utils.h:420
ContentType type
Definition: packet-tls-utils.h:424
Definition: packet-tls-utils.h:454
Definition: packet-tls-utils.h:256
Definition: packet-tls-utils.h:435
guint record_id
Definition: packet-tls-utils.h:436
int is_last
Definition: packet-tls-utils.h:441
guint32 offset
Definition: packet-tls-utils.h:439
guint8 type
Definition: packet-tls-utils.h:440
guint reassembly_id
Definition: packet-tls-utils.h:438
Definition: address.h:56
Definition: packet_info.h:44
Definition: proto.h:898
Definition: value_string.h:293
Definition: packet-tls-utils.h:545
Definition: value_string.h:133
Definition: value_string.h:170
Definition: value_string.h:26
Definition: wmem_list.c:23
Definition: wmem_strbuf.h:42
Definition: wmem_tree-int.h:48
Definition: packet-tls-utils.h:414
Definition: packet-tls-utils.h:445
Definition: packet-tls-utils.h:539
Definition: conversation.h:220
Definition: packet.c:763
Definition: packet.c:86
Definition: packet-tls-utils.h:1190
Definition: expert.h:39
Definition: packet-tls-utils.h:1205
Definition: prefs-int.h:27
Definition: packet-tls-utils.h:838
Definition: packet-tls-utils.h:553
Definition: packet-tls-utils.h:1198
Definition: packet-tls-utils.h:559
Definition: tvbuff-int.h:35