Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-tls-utils.h
1 /* packet-tls-utils.h
2  * ssl manipulation functions
3  * By Paolo Abeni <paolo.abeni@email.com>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_TLS_UTILS_H__
13 #define __PACKET_TLS_UTILS_H__
14 
15 #include <stdio.h> /* some APIs we declare take a stdio stream as an argument */
16 
17 #include <glib.h>
18 #include <epan/packet.h>
19 #include <epan/prefs.h>
20 #include <epan/wmem_scopes.h>
21 #include <epan/expert.h>
22 #include <epan/conversation.h>
23 #include <epan/unit_strings.h>
24 #include <wsutil/wsgcrypt.h>
25 
26 #ifdef HAVE_LIBGNUTLS
27 #include <gnutls/x509.h>
28 #include <gnutls/pkcs12.h>
29 #endif /* HAVE_LIBGNUTLS */
30 
31 /* TODO inline this now that Libgcrypt is mandatory? */
32 #define SSL_CIPHER_CTX gcry_cipher_hd_t
33 #define SSL_DECRYPT_DEBUG
34 
35 
36 /* other defines */
37 typedef enum {
38  SSL_ID_CHG_CIPHER_SPEC = 0x14,
39  SSL_ID_ALERT = 0x15,
40  SSL_ID_HANDSHAKE = 0x16,
41  SSL_ID_APP_DATA = 0x17,
42  SSL_ID_HEARTBEAT = 0x18,
43  SSL_ID_TLS12_CID = 0x19,
44  SSL_ID_DTLS13_ACK = 0x1A,
45 } ContentType;
46 
47 typedef enum {
48  SSL_HND_HELLO_REQUEST = 0,
49  SSL_HND_CLIENT_HELLO = 1,
50  SSL_HND_SERVER_HELLO = 2,
51  SSL_HND_HELLO_VERIFY_REQUEST = 3,
52  SSL_HND_NEWSESSION_TICKET = 4,
53  SSL_HND_END_OF_EARLY_DATA = 5,
54  SSL_HND_HELLO_RETRY_REQUEST = 6,
55  SSL_HND_ENCRYPTED_EXTENSIONS = 8,
56  SSL_HND_CERTIFICATE = 11,
57  SSL_HND_SERVER_KEY_EXCHG = 12,
58  SSL_HND_CERT_REQUEST = 13,
59  SSL_HND_SVR_HELLO_DONE = 14,
60  SSL_HND_CERT_VERIFY = 15,
61  SSL_HND_CLIENT_KEY_EXCHG = 16,
62  SSL_HND_FINISHED = 20,
63  SSL_HND_CERT_URL = 21,
64  SSL_HND_CERT_STATUS = 22,
65  SSL_HND_SUPPLEMENTAL_DATA = 23,
66  SSL_HND_KEY_UPDATE = 24,
67  SSL_HND_COMPRESSED_CERTIFICATE = 25,
68  /* Encrypted Extensions was NextProtocol in draft-agl-tls-nextprotoneg-03
69  * and changed in draft 04. Not to be confused with TLS 1.3 EE. */
70  SSL_HND_ENCRYPTED_EXTS = 67
71 } HandshakeType;
72 
73 #define SSL2_HND_ERROR 0x00
74 #define SSL2_HND_CLIENT_HELLO 0x01
75 #define SSL2_HND_CLIENT_MASTER_KEY 0x02
76 #define SSL2_HND_CLIENT_FINISHED 0x03
77 #define SSL2_HND_SERVER_HELLO 0x04
78 #define SSL2_HND_SERVER_VERIFY 0x05
79 #define SSL2_HND_SERVER_FINISHED 0x06
80 #define SSL2_HND_REQUEST_CERTIFICATE 0x07
81 #define SSL2_HND_CLIENT_CERTIFICATE 0x08
82 
83 #define SSL_HND_HELLO_EXT_SERVER_NAME 0
84 #define SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH 1
85 #define SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL 2
86 #define SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS 3
87 #define SSL_HND_HELLO_EXT_TRUNCATED_HMAC 4
88 #define SSL_HND_HELLO_EXT_STATUS_REQUEST 5
89 #define SSL_HND_HELLO_EXT_USER_MAPPING 6
90 #define SSL_HND_HELLO_EXT_CLIENT_AUTHZ 7
91 #define SSL_HND_HELLO_EXT_SERVER_AUTHZ 8
92 #define SSL_HND_HELLO_EXT_CERT_TYPE 9
93 #define SSL_HND_HELLO_EXT_SUPPORTED_GROUPS 10 /* renamed from "elliptic_curves" (RFC 7919 / TLS 1.3) */
94 #define SSL_HND_HELLO_EXT_EC_POINT_FORMATS 11
95 #define SSL_HND_HELLO_EXT_SRP 12
96 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS 13
97 #define SSL_HND_HELLO_EXT_USE_SRTP 14
98 #define SSL_HND_HELLO_EXT_HEARTBEAT 15
99 #define SSL_HND_HELLO_EXT_ALPN 16
100 #define SSL_HND_HELLO_EXT_STATUS_REQUEST_V2 17
101 #define SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP 18
102 #define SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE 19
103 #define SSL_HND_HELLO_EXT_SERVER_CERT_TYPE 20
104 #define SSL_HND_HELLO_EXT_PADDING 21
105 #define SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC 22
106 #define SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET 23
107 #define SSL_HND_HELLO_EXT_TOKEN_BINDING 24
108 #define SSL_HND_HELLO_EXT_CACHED_INFO 25
109 #define SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE 27
110 #define SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT 28
111 /* 26-33 Unassigned*/
112 #define SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS 34 /* draft-ietf-tls-subcerts-10.txt */
113 #define SSL_HND_HELLO_EXT_SESSION_TICKET_TLS 35
114 /* RFC 8446 (TLS 1.3) */
115 #define SSL_HND_HELLO_EXT_KEY_SHARE_OLD 40 /* draft-ietf-tls-tls13-22 (removed in -23) */
116 #define SSL_HND_HELLO_EXT_PRE_SHARED_KEY 41
117 #define SSL_HND_HELLO_EXT_EARLY_DATA 42
118 #define SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS 43
119 #define SSL_HND_HELLO_EXT_COOKIE 44
120 #define SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES 45
121 #define SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO 46 /* draft-ietf-tls-tls13-18 (removed in -19) */
122 #define SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES 47
123 #define SSL_HND_HELLO_EXT_OID_FILTERS 48
124 #define SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH 49
125 #define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT 50
126 #define SSL_HND_HELLO_EXT_KEY_SHARE 51
127 #define SSL_HND_HELLO_EXT_TRANSPARENCY_INFO 52 /* draft-ietf-trans-rfc6962-bis-41 */
128 #define SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED 53 /* draft-ietf-tls-dtls-connection-id-07 */
129 #define SSL_HND_HELLO_EXT_CONNECTION_ID 54
130 #define SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH 55 /* RFC 8844 */
131 #define SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID 56 /* RFC 8844 */
132 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1 57 /* draft-ietf-quic-tls-33 */
133 #define SSL_HND_HELLO_EXT_TICKET_REQUEST 58 /* draft-ietf-tls-ticketrequests-07 */
134 #define SSL_HND_HELLO_EXT_DNSSEC_CHAIN 59 /* RFC 9102 */
135 #define SSL_HND_HELLO_EXT_GREASE_0A0A 2570
136 #define SSL_HND_HELLO_EXT_GREASE_1A1A 6682
137 #define SSL_HND_HELLO_EXT_GREASE_2A2A 10794
138 #define SSL_HND_HELLO_EXT_NPN 13172 /* 0x3374 */
139 #define SSL_HND_HELLO_EXT_GREASE_3A3A 14906
140 #define SSL_HND_HELLO_EXT_ALPS 17513 /* draft-vvv-tls-alps-01, temporary value used in BoringSSL implementation */
141 #define SSL_HND_HELLO_EXT_GREASE_4A4A 19018
142 #define SSL_HND_HELLO_EXT_GREASE_5A5A 23130
143 #define SSL_HND_HELLO_EXT_GREASE_6A6A 27242
144 #define SSL_HND_HELLO_EXT_CHANNEL_ID_OLD 30031 /* 0x754f */
145 #define SSL_HND_HELLO_EXT_CHANNEL_ID 30032 /* 0x7550 */
146 #define SSL_HND_HELLO_EXT_GREASE_7A7A 31354
147 #define SSL_HND_HELLO_EXT_GREASE_8A8A 35466
148 #define SSL_HND_HELLO_EXT_GREASE_9A9A 39578
149 #define SSL_HND_HELLO_EXT_GREASE_AAAA 43690
150 #define SSL_HND_HELLO_EXT_GREASE_BABA 47802
151 #define SSL_HND_HELLO_EXT_GREASE_CACA 51914
152 #define SSL_HND_HELLO_EXT_GREASE_DADA 56026
153 #define SSL_HND_HELLO_EXT_GREASE_EAEA 60138
154 #define SSL_HND_HELLO_EXT_GREASE_FAFA 64250
155 #define SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO 65037 /* 0xfe0d draft-ietf-tls-esni-16 */
156 #define SSL_HND_HELLO_EXT_RENEGOTIATION_INFO 65281 /* 0xFF01 */
157 #define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS 65445 /* 0xffa5 draft-ietf-quic-tls-13 */
158 #define SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME 65486 /* 0xffce draft-ietf-tls-esni-01 */
159 
160 #define SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT 1
161 #define SSL_HND_CERT_URL_TYPE_PKIPATH 2
162 #define SSL_HND_CERT_STATUS_TYPE_OCSP 1
163 #define SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI 2
164 #define SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY 2
165 
166 /* https://github.com/quicwg/base-drafts/wiki/Temporary-IANA-Registry#quic-transport-parameters */
167 #define SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID 0x00
168 #define SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT 0x01
169 #define SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN 0x02
170 #define SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE 0x03
171 #define SSL_HND_QUIC_TP_INITIAL_MAX_DATA 0x04
172 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL 0x05
173 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE 0x06
174 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI 0x07
175 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI 0x08
176 #define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI 0x09
177 #define SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT 0x0a
178 #define SSL_HND_QUIC_TP_MAX_ACK_DELAY 0x0b
179 #define SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION 0x0c
180 #define SSL_HND_QUIC_TP_PREFERRED_ADDRESS 0x0d
181 #define SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT 0x0e
182 #define SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID 0x0f
183 #define SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID 0x10
184 #define SSL_HND_QUIC_TP_VERSION_INFORMATION 0x11 /* https://tools.ietf.org/html/draft-ietf-quic-version-negotiation-14 */
185 #define SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE 0x20 /* https://datatracker.ietf.org/doc/html/draft-ietf-quic-datagram-06 */
186 #define SSL_HND_QUIC_TP_CIBIR_ENCODING 0x1000 /* https://datatracker.ietf.org/doc/html/draft-banks-quic-cibir-01 */
187 #define SSL_HND_QUIC_TP_LOSS_BITS 0x1057 /* https://tools.ietf.org/html/draft-ferrieuxhamchaoui-quic-lossbits-03 */
188 #define SSL_HND_QUIC_TP_GREASE_QUIC_BIT 0x2ab2 /* RFC 9287 */
189 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP 0x7157 /* https://tools.ietf.org/html/draft-huitema-quic-ts-02 */
190 #define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2 0x7158 /* https://tools.ietf.org/html/draft-huitema-quic-ts-03 */
191 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD 0xde1a /* https://tools.ietf.org/html/draft-iyengar-quic-delayed-ack-00 */
192 /* https://quiche.googlesource.com/quiche/+/refs/heads/master/quic/core/crypto/transport_parameters.cc */
193 #define SSL_HND_QUIC_TP_GOOGLE_USER_AGENT 0x3129
194 #define SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED 0x312B
195 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION 0x4752
196 #define SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT 0x3127
197 #define SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE 0x312A
198 #define SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS 0x4751
199 #define SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS 0x3128
200 /* https://github.com/facebookincubator/mvfst/blob/master/quic/QuicConstants.h */
201 #define SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY 0xFF00
202 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1 0xFF03DE1A /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-01 */
203 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05 0xff04de1a /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-04 / draft-05 */
204 #define SSL_HND_QUIC_TP_MIN_ACK_DELAY 0xff04de1b /* https://tools.ietf.org/html/draft-ietf-quic-ack-frequency-07 */
205 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04 0x0f739bbc1b666d04 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-04 */
206 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05 0x0f739bbc1b666d05 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-05 */
207 #define SSL_HND_QUIC_TP_ENABLE_MULTIPATH 0x0f739bbc1b666d06 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-06 */
208 #define SSL_HND_QUIC_TP_INITIAL_MAX_PATHS 0x0f739bbc1b666d07 /* https://tools.ietf.org/html/draft-ietf-quic-multipath-07 */
209 /*
210  * Lookup tables
211  */
212 extern const value_string ssl_version_short_names[];
213 extern const value_string ssl_20_msg_types[];
214 extern value_string_ext ssl_20_cipher_suites_ext;
215 extern const value_string ssl_20_certificate_type[];
216 extern const value_string ssl_31_content_type[];
217 extern const value_string ssl_versions[];
218 extern const value_string ssl_31_change_cipher_spec[];
219 extern const value_string ssl_31_alert_level[];
220 extern const value_string ssl_31_alert_description[];
221 extern const value_string ssl_31_handshake_type[];
222 extern const value_string tls_heartbeat_type[];
223 extern const value_string tls_heartbeat_mode[];
224 extern const value_string ssl_31_compression_method[];
225 extern const value_string ssl_31_key_exchange_algorithm[];
226 extern const value_string ssl_31_signature_algorithm[];
227 extern const value_string ssl_31_client_certificate_type[];
228 extern const value_string ssl_31_public_value_encoding[];
229 extern value_string_ext ssl_31_ciphersuite_ext;
230 extern const value_string tls_hello_extension_types[];
231 extern const value_string tls_hash_algorithm[];
232 extern const value_string tls_signature_algorithm[];
233 extern const value_string tls13_signature_algorithm[];
234 extern const value_string tls_certificate_type[];
235 extern const value_string tls_cert_chain_type[];
236 extern const value_string tls_cert_status_type[];
237 extern const value_string ssl_extension_curves[];
238 extern const value_string ssl_extension_ec_point_formats[];
239 extern const value_string ssl_curve_types[];
240 extern const value_string tls_hello_ext_server_name_type_vs[];
241 extern const value_string tls_hello_ext_max_fragment_length[];
242 extern const value_string tls_hello_ext_psk_ke_mode[];
243 extern const value_string tls13_key_update_request[];
244 extern const value_string compress_certificate_algorithm_vals[];
245 extern const val64_string quic_transport_parameter_id[];
246 extern const range_string quic_version_vals[];
247 extern const val64_string quic_enable_time_stamp_v2_vals[];
248 extern const val64_string quic_enable_multipath_vals[];
249 extern const value_string tls_hello_ext_ech_clienthello_types[];
250 extern const value_string kem_id_type_vals[];
251 extern const value_string kdf_id_type_vals[];
252 extern const value_string aead_id_type_vals[];
253 extern const value_string token_binding_key_parameter_vals[];
254 
255 /* XXX Should we use GByteArray instead? */
256 typedef struct _StringInfo {
257  guchar *data; /* Backing storage which may be larger than data_len */
258  guint data_len; /* Length of the meaningful part of data */
259 } StringInfo;
260 
261 #define SSL_WRITE_KEY 1
262 
263 #define SSL_VER_UNKNOWN 0
264 #define SSLV2_VERSION 0x0002 /* not in record layer, SSL_CLIENT_SERVER from
265  http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html */
266 #define SSLV3_VERSION 0x300
267 #define TLSV1_VERSION 0x301
268 #define TLCPV1_VERSION 0x101
269 #define TLSV1DOT1_VERSION 0x302
270 #define TLSV1DOT2_VERSION 0x303
271 #define TLSV1DOT3_VERSION 0x304
272 #define DTLSV1DOT0_VERSION 0xfeff
273 #define DTLSV1DOT0_OPENSSL_VERSION 0x100
274 #define DTLSV1DOT2_VERSION 0xfefd
275 #define DTLSV1DOT3_VERSION 0xfefc
276 
277 /* Returns the TLS 1.3 draft version or 0 if not applicable. */
278 static inline guint8 extract_tls13_draft_version(guint32 version) {
279  if ((version & 0xff00) == 0x7f00) {
280  return (guint8) version;
281  }
282  return 0;
283 }
284 
285 
286 #define SSL_CLIENT_RANDOM (1<<0)
287 #define SSL_SERVER_RANDOM (1<<1)
288 #define SSL_CIPHER (1<<2)
289 #define SSL_HAVE_SESSION_KEY (1<<3)
290 #define SSL_VERSION (1<<4)
291 #define SSL_MASTER_SECRET (1<<5)
292 #define SSL_PRE_MASTER_SECRET (1<<6)
293 #define SSL_CLIENT_EXTENDED_MASTER_SECRET (1<<7)
294 #define SSL_SERVER_EXTENDED_MASTER_SECRET (1<<8)
295 #define SSL_NEW_SESSION_TICKET (1<<10)
296 #define SSL_ENCRYPT_THEN_MAC (1<<11)
297 #define SSL_SEEN_0RTT_APPDATA (1<<12)
298 #define SSL_QUIC_RECORD_LAYER (1<<13) /* For QUIC (draft >= -13) */
299 
300 #define SSL_EXTENDED_MASTER_SECRET_MASK (SSL_CLIENT_EXTENDED_MASTER_SECRET|SSL_SERVER_EXTENDED_MASTER_SECRET)
301 
302 /* SSL Cipher Suite modes */
303 typedef enum {
304  MODE_STREAM, /* GenericStreamCipher */
305  MODE_CBC, /* GenericBlockCipher */
306  MODE_GCM, /* GenericAEADCipher */
307  MODE_CCM, /* AEAD_AES_{128,256}_CCM with 16 byte auth tag */
308  MODE_CCM_8, /* AEAD_AES_{128,256}_CCM with 8 byte auth tag */
309  MODE_POLY1305, /* AEAD_CHACHA20_POLY1305 with 16 byte auth tag (RFC 7905) */
310  MODE_ECB, /* ECB: used to perfrom record seq number encryption in DTLSv1.3 */
311 } ssl_cipher_mode_t;
312 
313 /* Explicit and implicit nonce length (RFC 5116 - Section 3.2.1) */
314 #define IMPLICIT_NONCE_LEN 4
315 #define EXPLICIT_NONCE_LEN 8
316 #define TLS13_AEAD_NONCE_LENGTH 12
317 
318 /* TLS 1.3 Record type for selecting the appropriate secret. */
319 typedef enum {
320  TLS_SECRET_0RTT_APP,
321  TLS_SECRET_HANDSHAKE,
322  TLS_SECRET_APP,
323 } TLSRecordType;
324 
325 #define SSL_DEBUG_USE_STDERR "-"
326 
327 #define SSLV2_MAX_SESSION_ID_LENGTH_IN_BYTES 16
328 
329 /* Record fragment lengths MUST NOT exceed 2^14 (= 0x4000) */
330 #define TLS_MAX_RECORD_LENGTH 0x4000
331 
332 typedef struct _SslCipherSuite {
333  gint number;
334  gint kex;
335  gint enc;
336  gint dig;
337  ssl_cipher_mode_t mode;
339 
340 typedef struct _SslFlow {
341  guint32 byte_seq;
342  guint16 flags;
343  wmem_tree_t *multisegment_pdus;
344 } SslFlow;
345 
346 typedef struct _SslDecompress SslDecompress;
347 
348 typedef struct _SslDecoder {
349  const SslCipherSuite *cipher_suite;
350  gint compression;
351  guchar _mac_key_or_write_iv[48];
352  StringInfo mac_key; /* for block and stream ciphers */
353  StringInfo write_iv; /* for AEAD ciphers (at least GCM, CCM) */
354  SSL_CIPHER_CTX sn_evp; /* used to decrypt serial number in DTLSv1.3 */
355  SSL_CIPHER_CTX evp;
356  SslDecompress *decomp;
357  guint64 dtls13_epoch;
358  guint64 seq;
360  guint16 epoch;
361  SslFlow *flow;
363 } SslDecoder;
364 
365 #define KEX_DHE_DSS 0x10
366 #define KEX_DHE_PSK 0x11
367 #define KEX_DHE_RSA 0x12
368 #define KEX_DH_ANON 0x13
369 #define KEX_DH_DSS 0x14
370 #define KEX_DH_RSA 0x15
371 #define KEX_ECDHE_ECDSA 0x16
372 #define KEX_ECDHE_PSK 0x17
373 #define KEX_ECDHE_RSA 0x18
374 #define KEX_ECDH_ANON 0x19
375 #define KEX_ECDH_ECDSA 0x1a
376 #define KEX_ECDH_RSA 0x1b
377 #define KEX_KRB5 0x1c
378 #define KEX_PSK 0x1d
379 #define KEX_RSA 0x1e
380 #define KEX_RSA_PSK 0x1f
381 #define KEX_SRP_SHA 0x20
382 #define KEX_SRP_SHA_DSS 0x21
383 #define KEX_SRP_SHA_RSA 0x22
384 #define KEX_IS_DH(n) ((n) >= KEX_DHE_DSS && (n) <= KEX_ECDH_RSA)
385 #define KEX_TLS13 0x23
386 #define KEX_ECJPAKE 0x24
387 
388 #define KEX_ECDHE_SM2 0x25
389 #define KEX_ECC_SM2 0x26
390 #define KEX_IBSDH_SM9 0x27
391 #define KEX_IBC_SM9 0x28
392 
393 /* Order is significant, must match "ciphers" array in packet-tls-utils.c */
394 
395 #define ENC_START 0x30
396 #define ENC_DES 0x30
397 #define ENC_3DES 0x31
398 #define ENC_RC4 0x32
399 #define ENC_RC2 0x33
400 #define ENC_IDEA 0x34
401 #define ENC_AES 0x35
402 #define ENC_AES256 0x36
403 #define ENC_CAMELLIA128 0x37
404 #define ENC_CAMELLIA256 0x38
405 #define ENC_SEED 0x39
406 #define ENC_CHACHA20 0x3A
407 #define ENC_SM1 0x3B
408 #define ENC_SM4 0x3C
409 #define ENC_NULL 0x3D
410 
411 
412 #define DIG_MD5 0x40
413 #define DIG_SHA 0x41
414 #define DIG_SHA256 0x42
415 #define DIG_SHA384 0x43
416 #define DIG_SM3 0x44
417 #define DIG_NA 0x45 /* Not Applicable */
418 
419 typedef struct {
420  const gchar *name;
421  guint len;
422 } SslDigestAlgo;
423 
424 typedef struct _SslRecordInfo {
425  guchar *plain_data;
426  guint data_len;
427  gint id;
429  ContentType type;
430  SslFlow *flow;
432  guint32 seq;
433  guint16 dtls13_seq_suffix; /* < decrypted dtlsv1.3 record number suffix */
434  struct _SslRecordInfo* next;
435 } SslRecordInfo;
436 
441 typedef struct _TlsHsFragment {
442  guint record_id;
445  guint32 offset;
446  guint8 type;
447  int is_last : 1;
448  struct _TlsHsFragment *next;
449 } TlsHsFragment;
450 
451 typedef struct {
452  SslRecordInfo *records;
453  TlsHsFragment *hs_fragments;
454  guint32 srcport;
455  guint32 destport;
456  gint cipher;
458 } SslPacketInfo;
459 
460 typedef struct _SslSession {
461  gint cipher;
462  gint compression;
463  guint16 version;
464  guchar tls13_draft_version;
465  gint8 client_cert_type;
466  gint8 server_cert_type;
467  guint32 client_ccs_frame;
468  guint32 server_ccs_frame;
469 
470  /* The address/proto/port of the server as determined from heuristics
471  * (e.g. ClientHello) or set externally (via ssl_set_master_secret()). */
472  address srv_addr;
473  port_type srv_ptype;
474  guint srv_port;
475 
476  /* The Application layer protocol if known (for STARTTLS support) */
477  dissector_handle_t app_handle;
478  const char *alpn_name;
479  /* The ALPN the client requested, not necessarily the one chosen */
480  const char *client_alpn_name;
481  guint32 last_nontls_frame;
482  gboolean is_session_resumed;
483 
484  /* First pass only: track an in-progress handshake reassembly (>0) */
485  guint32 client_hs_reassembly_id;
486  guint32 server_hs_reassembly_id;
487 
488  /* Connection ID extension
489 
490  struct {
491  opaque cid<0..2^8-1>;
492  } ConnectionId;
493  */
494 
495  guint8 *client_cid;
496  guint8 *server_cid;
497  guint8 client_cid_len;
498  gboolean client_cid_len_present;
499  guint8 server_cid_len;
500  gboolean server_cid_len_present;
501  gboolean deprecated_cid; /* Set when handshake is using the deprecated CID extension type */
502  guint64 dtls13_current_epoch[2]; /* max epoch (for server and client respectively) */
503  guint64 dtls13_next_seq_num[2]; /* DTLSv1.3 next expected seq number (for server and client respectively) */
504 } SslSession;
505 
506 /* RFC 5246, section 8.1 says that the master secret is always 48 bytes */
507 #define SSL_MASTER_SECRET_LENGTH 48
508 
509 struct cert_key_id; /* defined in epan/secrets.h */
510 
511 /* This holds state information for a SSL conversation */
512 typedef struct _SslDecryptSession {
513  guchar _master_secret[SSL_MASTER_SECRET_LENGTH];
514  guchar _session_id[256];
515  guchar _client_random[32];
516  guchar _server_random[32];
517  StringInfo session_id;
518  StringInfo session_ticket;
519  StringInfo server_random;
520  StringInfo client_random;
521  StringInfo master_secret;
522  StringInfo handshake_data;
523  /* the data store for this StringInfo must be allocated explicitly with a capture lifetime scope */
524  StringInfo pre_master_secret;
525  guchar _server_data_for_iv[24];
526  StringInfo server_data_for_iv;
527  guchar _client_data_for_iv[24];
528  StringInfo client_data_for_iv;
529 
530  gint state;
531  const SslCipherSuite *cipher_suite;
532  SslDecoder *server;
533  SslDecoder *client;
534  SslDecoder *server_new;
535  SslDecoder *client_new;
536 #if defined(HAVE_LIBGNUTLS)
537  struct cert_key_id *cert_key_id;
538 #endif
539  StringInfo psk;
540  StringInfo app_data_segment;
541  SslSession session;
542  gboolean has_early_data;
543 
545 
546 /* RecordNumber - RFC 9147 section 4 */
547 typedef struct {
548  guint64 epoch;
549  guint64 sequence_number;
551 
552 /* User Access Table */
553 typedef struct _ssldecrypt_assoc_t {
554  char* ipaddr;
555  char* port;
556  char* protocol;
557  char* keyfile;
558  char* password;
560 
561 typedef struct ssl_common_options {
562  const gchar *psk;
563  const gchar *keylog_filename;
565 
567 typedef struct {
568  GHashTable *session; /* Session ID (1-32 bytes) to master secret. */
569  GHashTable *tickets; /* Session Ticket to master secret. */
570  GHashTable *crandom; /* Client Random to master secret */
571  GHashTable *pre_master; /* First 8 bytes of encrypted pre-master secret to
572  pre-master secret */
573  GHashTable *pms; /* Client Random to unencrypted pre-master secret */
574 
575  /* For TLS 1.3: maps Client Random to derived secret. */
576  GHashTable *tls13_client_early;
577  GHashTable *tls13_client_handshake;
578  GHashTable *tls13_server_handshake;
579  GHashTable *tls13_client_appdata;
580  GHashTable *tls13_server_appdata;
581  GHashTable *tls13_early_exporter;
582  GHashTable *tls13_exporter;
583 
584  /* The hash tables above store the static keylog file contents and secrets
585  * from any DSB, not all of which may be used, in addition to any master
586  * secrets derived at runtime ([D]TLS < 1.3). These store the used
587  * Client Random for exporting master secrets and derived secrets in
588  * TLS Export Sessions or adding a DSB.
589  */
590  GHashTable *used_crandom;
592 
593 gint ssl_get_keyex_alg(gint cipher);
594 
595 void quic_transport_parameter_id_base_custom(gchar *result, guint64 parameter_id);
596 
597 bool ssldecrypt_uat_fld_ip_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
598 bool ssldecrypt_uat_fld_port_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
599 bool ssldecrypt_uat_fld_fileopen_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
600 bool ssldecrypt_uat_fld_password_chk_cb(void*, const char*, unsigned, const void*, const void*, char** err);
601 gchar* ssl_association_info(const char* dissector_table_name, const char* table_protocol);
602 
604 void ssl_init_cid_list(void);
605 
607 void ssl_cleanup_cid_list(void);
608 
610 void ssl_add_session_by_cid(SslDecryptSession *ssl);
611 
617 SslDecryptSession *ssl_get_session_by_cid(tvbuff_t *tvb, guint32 offset);
618 
623 extern SslDecryptSession *
624 ssl_get_session(conversation_t *conversation, dissector_handle_t tls_handle);
625 
627 extern void
628 ssl_reset_session(SslSession *session, SslDecryptSession *ssl, gboolean is_client);
629 
631 extern void
632 ssl_set_server(SslSession *session, address *addr, port_type ptype, guint32 port);
633 
641 WS_DLL_PUBLIC void
642 tls_set_appdata_dissector(dissector_handle_t tls_handle, packet_info *pinfo,
643  dissector_handle_t app_handle);
644 
654 WS_DLL_PUBLIC guint32
655 ssl_starttls_ack(dissector_handle_t tls_handle, packet_info *pinfo,
656  dissector_handle_t app_handle);
657 
666 WS_DLL_PUBLIC guint32
667 ssl_starttls_post_ack(dissector_handle_t tls_handle, packet_info *pinfo,
668  dissector_handle_t app_handle);
669 
670 extern dissector_handle_t
671 ssl_find_appdata_dissector(const char *name);
672 
678 extern void
679 ssl_data_set(StringInfo* buf, const guchar* src, guint len);
680 
684 extern gint
685 ssl_data_alloc(StringInfo* str, size_t len);
686 
687 extern gint
688 ssl_cipher_setiv(SSL_CIPHER_CTX *cipher, guchar* iv, gint iv_len);
689 
693 extern const SslCipherSuite *
694 ssl_find_cipher(int num);
695 
696 
698 int
699 ssl_get_cipher_algo(const SslCipherSuite *cipher_suite);
700 
705 guint
706 ssl_get_cipher_blocksize(const SslCipherSuite *cipher_suite);
707 
708 gboolean
709 ssl_generate_pre_master_secret(SslDecryptSession *ssl_session,
710  guint32 length, tvbuff_t *tvb, guint32 offset,
711  const gchar *ssl_psk, packet_info *pinfo,
712 #ifdef HAVE_LIBGNUTLS
713  GHashTable *key_hash,
714 #endif
715  const ssl_master_key_map_t *mk_map);
716 
721 extern gint
722 ssl_generate_keyring_material(SslDecryptSession*ssl_session);
723 
724 extern void
725 ssl_change_cipher(SslDecryptSession *ssl_session, gboolean server);
726 
741 extern gint
742 ssl_decrypt_record(SslDecryptSession *ssl, SslDecoder *decoder, guint8 ct, guint16 record_version,
743  gboolean ignore_mac_failed,
744  const guchar *in, guint16 inl, const guchar *cid, guint8 cidl,
745  StringInfo *comp_str, StringInfo *out_str, guint *outl);
746 
747 
748 /* Common part between TLS and DTLS dissectors */
749 
750 /* handling of association between tls/dtls ports and clear text protocol */
751 extern void
752 ssl_association_add(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
753 
754 extern void
755 ssl_association_remove(const char* dissector_table_name, dissector_handle_t main_handle, dissector_handle_t subdissector_handle, guint port, gboolean tcp);
756 
757 extern gint
758 ssl_packet_from_server(SslSession *session, dissector_table_t table, const packet_info *pinfo);
759 
760 /* Obtain information about the current TLS layer. */
762 tls_add_packet_info(gint proto, packet_info *pinfo, guint8 curr_layer_num_ssl);
763 
764 /* add to packet data a copy of the specified real data */
765 extern void
766 ssl_add_record_info(gint proto, packet_info *pinfo, const guchar *data, gint data_len, gint record_id, SslFlow *flow, ContentType type, guint8 curr_layer_num_ssl);
767 
768 /* search in packet data for the specified id; return a newly created tvb for the associated data */
769 extern tvbuff_t*
770 ssl_get_record_info(tvbuff_t *parent_tvb, gint proto, packet_info *pinfo, gint record_id, guint8 curr_layer_num_ssl, SslRecordInfo **matched_record);
771 
772 /* initialize/reset per capture state data (ssl sessions cache) */
773 extern void
774 ssl_common_init(ssl_master_key_map_t *master_key_map,
775  StringInfo *decrypted_data, StringInfo *compressed_data);
776 extern void
777 ssl_common_cleanup(ssl_master_key_map_t *master_key_map, FILE **ssl_keylog_file,
778  StringInfo *decrypted_data, StringInfo *compressed_data);
779 
785 WS_DLL_PUBLIC ssl_master_key_map_t *
786 tls_get_master_key_map(gboolean load_secrets);
787 
788 /* Process lines from the TLS key log and populate the secrets map. */
789 extern void
790 tls_keylog_process_lines(const ssl_master_key_map_t *mk_map, const guint8 *data, guint len);
791 
792 /* tries to update the secrets cache from the given filename */
793 extern void
794 ssl_load_keyfile(const gchar *ssl_keylog_filename, FILE **keylog_file,
795  const ssl_master_key_map_t *mk_map);
796 
797 #ifdef HAVE_LIBGNUTLS
798 /* parse ssl related preferences (private keys and ports association strings) */
799 extern void
800 ssl_parse_key_list(const ssldecrypt_assoc_t * uats, GHashTable *key_hash, const char* dissector_table_name, dissector_handle_t main_handle, gboolean tcp);
801 #endif
802 
803 extern void
804 ssl_finalize_decryption(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
805 
810 extern void
811 tls_save_crandom(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map);
812 
813 extern gboolean
814 tls13_generate_keys(SslDecryptSession *ssl_session, const StringInfo *secret, gboolean is_from_server);
815 
816 extern StringInfo *
817 tls13_load_secret(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
818  gboolean is_from_server, TLSRecordType type);
819 
820 extern void
821 tls13_change_key(SslDecryptSession *ssl, ssl_master_key_map_t *mk_map,
822  gboolean is_from_server, TLSRecordType type);
823 
824 extern int
825 dtls13_generate_key_for_epoch(SslDecryptSession *ssl, gboolean is_from_server, guint64 epoch);
826 
827 extern void
828 tls13_key_update(SslDecryptSession *ssl, gboolean is_from_server);
829 
830 extern gboolean
831 ssl_is_valid_content_type(guint8 type);
832 
833 extern gboolean
834 ssl_is_valid_handshake_type(guint8 hs_type, gboolean is_dtls);
835 
836 extern bool
837 tls_scan_server_hello(tvbuff_t *tvb, guint32 offset, guint32 offset_end,
838  guint16 *server_version, bool *is_hrr);
839 
840 extern void
841 ssl_try_set_version(SslSession *session, SslDecryptSession *ssl,
842  guint8 content_type, guint8 handshake_type,
843  gboolean is_dtls, guint16 version);
844 
845 extern void
846 ssl_calculate_handshake_hash(SslDecryptSession *ssl_session, tvbuff_t *tvb, guint32 offset, guint32 length);
847 
848 /* common header fields, subtrees and expert info for SSL and DTLS dissectors */
849 typedef struct ssl_common_dissect {
850  struct {
851  gint change_cipher_spec;
852  gint hs_exts_len;
853  gint hs_ext_alpn_len;
854  gint hs_ext_alpn_list;
855  gint hs_ext_alpn_str;
856  gint hs_ext_alpn_str_len;
857  gint hs_ext_cert_url_item;
858  gint hs_ext_cert_url_padding;
859  gint hs_ext_cert_url_sha1;
860  gint hs_ext_cert_url_type;
861  gint hs_ext_cert_url_url;
862  gint hs_ext_cert_url_url_hash_list_len;
863  gint hs_ext_cert_url_url_len;
864  gint hs_ext_cert_status_type;
865  gint hs_ext_cert_status_request_len;
866  gint hs_ext_cert_status_responder_id_list_len;
867  gint hs_ext_cert_status_request_extensions_len;
868  gint hs_ext_cert_status_request_list_len;
869  gint hs_ocsp_response_list_len;
870  gint hs_ocsp_response_len;
871  gint hs_ext_cert_type;
872  gint hs_ext_cert_types;
873  gint hs_ext_cert_types_len;
874  gint hs_ext_data;
875  gint hs_ext_ec_point_format;
876  gint hs_ext_ec_point_formats;
877  gint hs_ext_ec_point_formats_len;
878  gint hs_ext_srp_len;
879  gint hs_ext_srp_username;
880  gint hs_ext_supported_group;
881  gint hs_ext_supported_groups;
882  gint hs_ext_supported_groups_len;
883  gint hs_ext_heartbeat_mode;
884  gint hs_ext_len;
885  gint hs_ext_npn_str;
886  gint hs_ext_npn_str_len;
887  gint hs_ext_reneg_info_len;
888  gint hs_ext_reneg_info;
889  gint hs_ext_key_share_client_length;
890  gint hs_ext_key_share_group;
891  gint hs_ext_key_share_key_exchange_length;
892  gint hs_ext_key_share_key_exchange;
893  gint hs_ext_key_share_selected_group;
894  gint hs_ext_psk_identities_length;
895  gint hs_ext_psk_identity_identity_length;
896  gint hs_ext_psk_identity_identity;
897  gint hs_ext_psk_identity_obfuscated_ticket_age;
898  gint hs_ext_psk_binders_length;
899  gint hs_ext_psk_binders;
900  gint hs_ext_psk_identity_selected;
901  gint hs_ext_session_ticket;
902  gint hs_ext_supported_versions_len;
903  gint hs_ext_supported_version;
904  gint hs_ext_cookie_len;
905  gint hs_ext_cookie;
906  gint hs_ext_server_name;
907  gint hs_ext_server_name_len;
908  gint hs_ext_server_name_list_len;
909  gint hs_ext_server_name_type;
910  gint hs_ext_max_fragment_length;
911  gint hs_ext_padding_data;
912  gint hs_ext_type;
913  gint hs_ext_connection_id_length;
914  gint hs_ext_connection_id;
915  gint hs_sig_hash_alg;
916  gint hs_sig_hash_alg_len;
917  gint hs_sig_hash_algs;
918  gint hs_sig_hash_hash;
919  gint hs_sig_hash_sig;
920  gint hs_client_keyex_epms_len;
921  gint hs_client_keyex_epms;
922  gint hs_server_keyex_modulus_len;
923  gint hs_server_keyex_exponent_len;
924  gint hs_server_keyex_sig_len;
925  gint hs_server_keyex_p_len;
926  gint hs_server_keyex_g_len;
927  gint hs_server_keyex_ys_len;
928  gint hs_client_keyex_yc_len;
929  gint hs_client_keyex_point_len;
930  gint hs_server_keyex_point_len;
931  gint hs_server_keyex_p;
932  gint hs_server_keyex_g;
933  gint hs_server_keyex_curve_type;
934  gint hs_server_keyex_named_curve;
935  gint hs_server_keyex_ys;
936  gint hs_client_keyex_yc;
937  gint hs_server_keyex_point;
938  gint hs_client_keyex_point;
939  gint hs_server_keyex_xs_len;
940  gint hs_client_keyex_xc_len;
941  gint hs_server_keyex_xs;
942  gint hs_client_keyex_xc;
943  gint hs_server_keyex_vs_len;
944  gint hs_client_keyex_vc_len;
945  gint hs_server_keyex_vs;
946  gint hs_client_keyex_vc;
947  gint hs_server_keyex_rs_len;
948  gint hs_client_keyex_rc_len;
949  gint hs_server_keyex_rs;
950  gint hs_client_keyex_rc;
951  gint hs_server_keyex_modulus;
952  gint hs_server_keyex_exponent;
953  gint hs_server_keyex_sig;
954  gint hs_server_keyex_hint_len;
955  gint hs_server_keyex_hint;
956  gint hs_client_keyex_identity_len;
957  gint hs_client_keyex_identity;
958  gint hs_certificates_len;
959  gint hs_certificates;
960  gint hs_certificate_len;
961  gint hs_certificate;
962  gint hs_cert_types_count;
963  gint hs_cert_types;
964  gint hs_cert_type;
965  gint hs_dnames_len;
966  gint hs_dnames;
967  gint hs_dnames_truncated;
968  gint hs_dname_len;
969  gint hs_dname;
970  gint hs_random;
971  gint hs_random_time;
972  gint hs_random_bytes;
973  gint hs_session_id;
974  gint hs_session_id_len;
975  gint hs_client_version;
976  gint hs_server_version;
977  gint hs_cipher_suites_len;
978  gint hs_cipher_suites;
979  gint hs_cipher_suite;
980  gint hs_comp_methods_len;
981  gint hs_comp_methods;
982  gint hs_comp_method;
983  gint hs_session_ticket_lifetime_hint;
984  gint hs_session_ticket_age_add;
985  gint hs_session_ticket_nonce_len;
986  gint hs_session_ticket_nonce;
987  gint hs_session_ticket_len;
988  gint hs_session_ticket;
989  gint hs_finished;
990  gint hs_client_cert_vrfy_sig_len;
991  gint hs_client_cert_vrfy_sig;
992  gint hs_ja3_full;
993  gint hs_ja3_hash;
994  gint hs_ja3s_full;
995  gint hs_ja3s_hash;
996  gint hs_ja4;
997  gint hs_ja4_r;
998 
999  /* TLS 1.3 */
1000  gint hs_ext_psk_ke_modes_length;
1001  gint hs_ext_psk_ke_mode;
1002  gint hs_certificate_request_context_length;
1003  gint hs_certificate_request_context;
1004  gint hs_key_update_request_update;
1005  gint sct_scts_length;
1006  gint sct_sct_length;
1007  gint sct_sct_version;
1008  gint sct_sct_logid;
1009  gint sct_sct_timestamp;
1010  gint sct_sct_extensions_length;
1011  gint sct_sct_extensions;
1012  gint sct_sct_signature;
1013  gint sct_sct_signature_length;
1014  gint hs_ext_max_early_data_size;
1015  gint hs_ext_oid_filters_length;
1016  gint hs_ext_oid_filters_oid_length;
1017  gint hs_ext_oid_filters_oid;
1018  gint hs_ext_oid_filters_values_length;
1019  gint hs_cred_valid_time;
1020  gint hs_cred_pubkey;
1021  gint hs_cred_pubkey_len;
1022  gint hs_cred_signature;
1023  gint hs_cred_signature_len;
1024 
1025  /* compress_certificate */
1026  gint hs_ext_compress_certificate_algorithms_length;
1027  gint hs_ext_compress_certificate_algorithm;
1028  gint hs_ext_compress_certificate_uncompressed_length;
1029  gint hs_ext_compress_certificate_compressed_certificate_message_length;
1030  gint hs_ext_compress_certificate_compressed_certificate_message;
1031 
1032  /* Token Binding Negotiation */
1033  gint hs_ext_token_binding_version_major;
1034  gint hs_ext_token_binding_version_minor;
1035  gint hs_ext_token_binding_key_parameters;
1036  gint hs_ext_token_binding_key_parameters_length;
1037  gint hs_ext_token_binding_key_parameter;
1038 
1039  gint hs_ext_record_size_limit;
1040 
1041  /* QUIC Transport Parameters */
1042  gint hs_ext_quictp_len;
1043  gint hs_ext_quictp_parameter;
1044  gint hs_ext_quictp_parameter_type;
1045  gint hs_ext_quictp_parameter_len;
1046  gint hs_ext_quictp_parameter_len_old;
1047  gint hs_ext_quictp_parameter_value;
1048  gint hs_ext_quictp_parameter_original_destination_connection_id;
1049  gint hs_ext_quictp_parameter_max_idle_timeout;
1050  gint hs_ext_quictp_parameter_stateless_reset_token;
1051  gint hs_ext_quictp_parameter_initial_max_data;
1052  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_local;
1053  gint hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote;
1054  gint hs_ext_quictp_parameter_initial_max_stream_data_uni;
1055  gint hs_ext_quictp_parameter_initial_max_streams_bidi;
1056  gint hs_ext_quictp_parameter_initial_max_streams_uni;
1057  gint hs_ext_quictp_parameter_ack_delay_exponent;
1058  gint hs_ext_quictp_parameter_max_ack_delay;
1059  gint hs_ext_quictp_parameter_max_udp_payload_size;
1060  gint hs_ext_quictp_parameter_pa_ipv4address;
1061  gint hs_ext_quictp_parameter_pa_ipv6address;
1062  gint hs_ext_quictp_parameter_pa_ipv4port;
1063  gint hs_ext_quictp_parameter_pa_ipv6port;
1064  gint hs_ext_quictp_parameter_pa_connectionid_length;
1065  gint hs_ext_quictp_parameter_pa_connectionid;
1066  gint hs_ext_quictp_parameter_pa_statelessresettoken;
1067  gint hs_ext_quictp_parameter_active_connection_id_limit;
1068  gint hs_ext_quictp_parameter_initial_source_connection_id;
1069  gint hs_ext_quictp_parameter_retry_source_connection_id;
1070  gint hs_ext_quictp_parameter_max_datagram_frame_size;
1071  gint hs_ext_quictp_parameter_cibir_encoding_length;
1072  gint hs_ext_quictp_parameter_cibir_encoding_offset;
1073  gint hs_ext_quictp_parameter_loss_bits;
1074  gint hs_ext_quictp_parameter_enable_time_stamp_v2;
1075  gint hs_ext_quictp_parameter_min_ack_delay;
1076  gint hs_ext_quictp_parameter_google_user_agent_id;
1077  gint hs_ext_quictp_parameter_google_key_update_not_yet_supported;
1078  gint hs_ext_quictp_parameter_google_quic_version;
1079  gint hs_ext_quictp_parameter_google_initial_rtt;
1080  gint hs_ext_quictp_parameter_google_support_handshake_done;
1081  gint hs_ext_quictp_parameter_google_quic_params;
1082  gint hs_ext_quictp_parameter_google_quic_params_unknown_field;
1083  gint hs_ext_quictp_parameter_google_connection_options;
1084  gint hs_ext_quictp_parameter_google_supported_versions_length;
1085  gint hs_ext_quictp_parameter_google_supported_version;
1086  gint hs_ext_quictp_parameter_facebook_partial_reliability;
1087  gint hs_ext_quictp_parameter_chosen_version;
1088  gint hs_ext_quictp_parameter_other_version;
1089  gint hs_ext_quictp_parameter_enable_multipath;
1090  gint hs_ext_quictp_parameter_initial_max_paths;
1091 
1092  gint esni_suite;
1093  gint esni_record_digest_length;
1094  gint esni_record_digest;
1095  gint esni_encrypted_sni_length;
1096  gint esni_encrypted_sni;
1097  gint esni_nonce;
1098 
1099  gint ech_echconfiglist_length;
1100  gint ech_echconfiglist;
1101  gint ech_echconfig;
1102  gint ech_echconfig_version;
1103  gint ech_echconfig_length;
1104  gint ech_echconfigcontents_maximum_name_length;
1105  gint ech_echconfigcontents_public_name_length;
1106  gint ech_echconfigcontents_public_name;
1107  gint ech_echconfigcontents_extensions_length;
1108  gint ech_echconfigcontents_extensions;
1109  gint ech_hpke_keyconfig;
1110  gint ech_hpke_keyconfig_config_id;
1111  gint ech_hpke_keyconfig_kem_id;
1112  gint ech_hpke_keyconfig_public_key_length;
1113  gint ech_hpke_keyconfig_public_key;
1114  gint ech_hpke_keyconfig_cipher_suites;
1115  gint ech_hpke_keyconfig_cipher_suites_length;
1116  gint ech_hpke_keyconfig_cipher_suite;
1117  gint ech_hpke_keyconfig_cipher_suite_kdf_id;
1118  gint ech_hpke_keyconfig_cipher_suite_aead_id;
1119  gint ech_clienthello_type;
1120  gint ech_cipher_suite;
1121  gint ech_config_id;
1122  gint ech_enc_length;
1123  gint ech_enc;
1124  gint ech_payload_length;
1125  gint ech_payload;
1126  gint ech_confirmation;
1127  gint ech_retry_configs;
1128 
1129  gint hs_ext_alps_len;
1130  gint hs_ext_alps_alpn_list;
1131  gint hs_ext_alps_alpn_str;
1132  gint hs_ext_alps_alpn_str_len;
1133  gint hs_ext_alps_settings;
1134 
1135  /* do not forget to update SSL_COMMON_HF_LIST! */
1136  } hf;
1137  struct {
1138  gint hs_ext;
1139  gint hs_ext_alpn;
1140  gint hs_ext_cert_types;
1141  gint hs_ext_groups;
1142  gint hs_ext_curves_point_formats;
1143  gint hs_ext_npn;
1144  gint hs_ext_reneg_info;
1145  gint hs_ext_key_share;
1146  gint hs_ext_key_share_ks;
1147  gint hs_ext_pre_shared_key;
1148  gint hs_ext_psk_identity;
1149  gint hs_ext_server_name;
1150  gint hs_ext_oid_filter;
1151  gint hs_ext_quictp_parameter;
1152  gint hs_sig_hash_alg;
1153  gint hs_sig_hash_algs;
1154  gint urlhash;
1155  gint keyex_params;
1156  gint certificates;
1157  gint cert_types;
1158  gint dnames;
1159  gint hs_random;
1160  gint cipher_suites;
1161  gint comp_methods;
1162  gint session_ticket;
1163  gint sct;
1164  gint cert_status;
1165  gint ocsp_response;
1166  gint uncompressed_certificates;
1167  gint hs_ext_alps;
1168  gint ech_echconfiglist;
1169  gint ech_echconfig;
1170  gint ech_retry_configs;
1171  gint ech_hpke_keyconfig;
1172  gint ech_hpke_cipher_suites;
1173  gint ech_hpke_cipher_suite;
1174  gint hs_ext_token_binding_key_parameters;
1175 
1176  /* do not forget to update SSL_COMMON_ETT_LIST! */
1177  } ett;
1178  struct {
1179  /* Generic expert info for malformed packets. */
1180  expert_field client_version_error;
1181  expert_field server_version_error;
1182  expert_field legacy_version;
1183  expert_field malformed_vector_length;
1184  expert_field malformed_buffer_too_small;
1185  expert_field malformed_trailing_data;
1186 
1187  expert_field hs_ext_cert_status_undecoded;
1188  expert_field hs_ciphersuite_undecoded;
1189  expert_field hs_srv_keyex_illegal;
1190  expert_field resumed;
1191  expert_field record_length_invalid;
1192  expert_field decompression_error;
1193 
1194  expert_field ech_echconfig_invalid_version;
1195 
1196  /* do not forget to update SSL_COMMON_EI_LIST! */
1197  } ei;
1199 
1200 /* Header fields specific to DTLS. See packet-dtls.c */
1201 typedef struct {
1202  gint hf_dtls_handshake_cookie_len;
1203  gint hf_dtls_handshake_cookie;
1204 
1205  /* Do not forget to initialize dtls_hfs to -1 in packet-dtls.c! */
1206 } dtls_hfs_t;
1207 
1208 /* Header fields specific to SSL. See packet-tls.c */
1209 typedef struct {
1210  gint hs_md5_hash;
1211  gint hs_sha_hash;
1212 
1213  /* Do not forget to initialize ssl_hfs to -1 in packet-tls.c! */
1214 } ssl_hfs_t;
1216 typedef struct {
1217  guint32 max_version;
1218  gboolean server_name_present;
1219  gint num_cipher_suites;
1220  gint num_extensions;
1221  wmem_strbuf_t *alpn;
1222  wmem_list_t *cipher_list;
1223  wmem_list_t *extension_list;
1224  wmem_list_t *sighash_list;
1225 } ja4_data_t;
1226 
1227 
1228 /* Helpers for dissecting Variable-Length Vectors. {{{ */
1229 /* Largest value that fits in a 24-bit number (2^24-1). */
1230 #define G_MAXUINT24 ((1U << 24) - 1)
1231 
1244 extern gboolean
1245 ssl_add_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1246  guint offset, guint offset_end, guint32 *ret_length,
1247  int hf_length, guint32 min_value, guint32 max_value);
1248 
1257 extern gboolean
1258 ssl_end_vector(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1259  guint offset, guint offset_end);
1260 /* }}} */
1261 
1262 
1263 extern void
1264 ssl_check_record_length(ssl_common_dissect_t *hf, packet_info *pinfo,
1265  ContentType content_type,
1266  guint record_length, proto_item *length_pi,
1267  guint16 version, tvbuff_t *decrypted_tvb);
1268 
1269 void
1270 ssl_dissect_change_cipher_spec(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1271  packet_info *pinfo, proto_tree *tree,
1272  guint32 offset, SslSession *session,
1273  gboolean is_from_server,
1274  const SslDecryptSession *ssl);
1275 
1276 extern void
1277 ssl_dissect_hnd_cli_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1278  packet_info *pinfo, proto_tree *tree, guint32 offset,
1279  guint32 offset_end, SslSession *session,
1280  SslDecryptSession *ssl,
1281  dtls_hfs_t *dtls_hfs);
1282 
1283 extern void
1284 ssl_dissect_hnd_srv_hello(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1285  proto_tree *tree, guint32 offset, guint32 offset_end,
1286  SslSession *session, SslDecryptSession *ssl,
1287  gboolean is_dtls, gboolean is_hrr);
1288 
1289 extern void
1290 ssl_dissect_hnd_hello_retry_request(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1291  proto_tree *tree, guint32 offset, guint32 offset_end,
1292  SslSession *session, SslDecryptSession *ssl,
1293  gboolean is_dtls);
1294 
1295 extern void
1296 ssl_dissect_hnd_encrypted_extensions(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info* pinfo,
1297  proto_tree *tree, guint32 offset, guint32 offset_end,
1298  SslSession *session, SslDecryptSession *ssl,
1299  gboolean is_dtls);
1300 
1301 extern void
1302 ssl_dissect_hnd_new_ses_ticket(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1303  proto_tree *tree, guint32 offset, guint32 offset_end,
1304  SslSession *session, SslDecryptSession *ssl,
1305  gboolean is_dtls, GHashTable *session_hash);
1306 
1307 extern void
1308 ssl_dissect_hnd_cert(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1309  guint32 offset, guint32 offset_end, packet_info *pinfo,
1310  SslSession *session, SslDecryptSession *ssl,
1311  gboolean is_from_server, gboolean is_dtls);
1312 
1313 extern void
1314 ssl_dissect_hnd_cert_req(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1315  proto_tree *tree, guint32 offset, guint32 offset_end,
1316  SslSession *session, gboolean is_dtls);
1317 
1318 extern void
1319 ssl_dissect_hnd_cli_cert_verify(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1320  proto_tree *tree, guint32 offset, guint32 offset_end, guint16 version);
1321 
1322 extern void
1323 ssl_dissect_hnd_finished(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1324  proto_tree *tree, guint32 offset, guint32 offset_end,
1325  const SslSession *session, ssl_hfs_t *ssl_hfs);
1326 
1327 extern void
1328 ssl_dissect_hnd_cert_url(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree, guint32 offset);
1329 
1330 extern guint32
1331 tls_dissect_hnd_certificate_status(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1332  proto_tree *tree, guint32 offset, guint32 offset_end);
1333 
1334 extern void
1335 ssl_dissect_hnd_cli_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1336  proto_tree *tree, guint32 offset, guint32 length,
1337  const SslSession *session);
1338 
1339 extern void
1340 ssl_dissect_hnd_srv_keyex(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
1341  proto_tree *tree, guint32 offset, guint32 offset_end,
1342  const SslSession *session);
1343 
1344 extern void
1345 tls13_dissect_hnd_key_update(ssl_common_dissect_t *hf, tvbuff_t *tvb,
1346  proto_tree *tree, guint32 offset);
1347 
1348 extern guint32
1349 tls_dissect_sct_list(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1350  guint32 offset, guint32 offset_end, guint16 version);
1351 
1352 extern gboolean
1353 tls13_hkdf_expand_label_context(int md, const StringInfo *secret,
1354  const char *label_prefix, const char *label,
1355  const guint8 *context, guint8 context_length,
1356  guint16 out_len, guchar **out);
1357 
1358 extern gboolean
1359 tls13_hkdf_expand_label(int md, const StringInfo *secret,
1360  const char *label_prefix, const char *label,
1361  guint16 out_len, guchar **out);
1362 
1363 extern void
1364 ssl_dissect_hnd_compress_certificate(ssl_common_dissect_t *hf, tvbuff_t *tvb, proto_tree *tree,
1365  guint32 offset, guint32 offset_end, packet_info *pinfo,
1366  SslSession *session _U_, SslDecryptSession *ssl _U_,
1367  gboolean is_from_server _U_, gboolean is_dtls _U_);
1368 /* {{{ */
1369 #define SSL_COMMON_LIST_T(name) \
1370 ssl_common_dissect_t name;
1371 /* }}} */
1372 
1373 /* {{{ */
1374 #define SSL_COMMON_HF_LIST(name, prefix) \
1375  { & name .hf.change_cipher_spec, \
1376  { "Change Cipher Spec Message", prefix ".change_cipher_spec", \
1377  FT_NONE, BASE_NONE, NULL, 0x0, \
1378  "Signals a change in cipher specifications", HFILL } \
1379  }, \
1380  { & name .hf.hs_exts_len, \
1381  { "Extensions Length", prefix ".handshake.extensions_length", \
1382  FT_UINT16, BASE_DEC, NULL, 0x0, \
1383  "Length of hello extensions", HFILL } \
1384  }, \
1385  { & name .hf.hs_ext_type, \
1386  { "Type", prefix ".handshake.extension.type", \
1387  FT_UINT16, BASE_DEC, VALS(tls_hello_extension_types), 0x0, \
1388  "Hello extension type", HFILL } \
1389  }, \
1390  { & name .hf.hs_ext_len, \
1391  { "Length", prefix ".handshake.extension.len", \
1392  FT_UINT16, BASE_DEC, NULL, 0x0, \
1393  "Length of a hello extension", HFILL } \
1394  }, \
1395  { & name .hf.hs_ext_data, \
1396  { "Data", prefix ".handshake.extension.data", \
1397  FT_BYTES, BASE_NONE, NULL, 0x0, \
1398  "Hello Extension data", HFILL } \
1399  }, \
1400  { & name .hf.hs_ext_supported_groups_len, \
1401  { "Supported Groups List Length", prefix ".handshake.extensions_supported_groups_length", \
1402  FT_UINT16, BASE_DEC, NULL, 0x0, \
1403  NULL, HFILL } \
1404  }, \
1405  { & name .hf.hs_ext_supported_groups, \
1406  { "Supported Groups List", prefix ".handshake.extensions_supported_groups", \
1407  FT_NONE, BASE_NONE, NULL, 0x0, \
1408  "List of supported groups (formerly Supported Elliptic Curves)", HFILL } \
1409  }, \
1410  { & name .hf.hs_ext_supported_group, \
1411  { "Supported Group", prefix ".handshake.extensions_supported_group", \
1412  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1413  NULL, HFILL } \
1414  }, \
1415  { & name .hf.hs_ext_ec_point_formats_len, \
1416  { "EC point formats Length", prefix ".handshake.extensions_ec_point_formats_length", \
1417  FT_UINT8, BASE_DEC, NULL, 0x0, \
1418  "Length of elliptic curves point formats field", HFILL } \
1419  }, \
1420  { & name .hf.hs_ext_ec_point_formats, \
1421  { "EC point formats", prefix ".handshake.extensions_ec_point_formats", \
1422  FT_NONE, BASE_NONE, NULL, 0x0, \
1423  "List of elliptic curves point format", HFILL } \
1424  }, \
1425  { & name .hf.hs_ext_ec_point_format, \
1426  { "EC point format", prefix ".handshake.extensions_ec_point_format", \
1427  FT_UINT8, BASE_DEC, VALS(ssl_extension_ec_point_formats), 0x0, \
1428  "Elliptic curves point format", HFILL } \
1429  }, \
1430  { & name .hf.hs_ext_srp_len, \
1431  { "SRP username length", prefix ".handshake.extensions_srp_len", \
1432  FT_UINT8, BASE_DEC, NULL, 0x0, \
1433  "Length of Secure Remote Password username field", HFILL } \
1434  }, \
1435  { & name .hf.hs_ext_srp_username, \
1436  { "SRP username", prefix ".handshake.extensions_srp_username", \
1437  FT_STRING, BASE_NONE, NULL, 0x0, \
1438  "Secure Remote Password username", HFILL } \
1439  }, \
1440  { & name .hf.hs_ext_alpn_len, \
1441  { "ALPN Extension Length", prefix ".handshake.extensions_alpn_len", \
1442  FT_UINT16, BASE_DEC, NULL, 0x0, \
1443  "Length of the ALPN Extension", HFILL } \
1444  }, \
1445  { & name .hf.hs_ext_alpn_list, \
1446  { "ALPN Protocol", prefix ".handshake.extensions_alpn_list", \
1447  FT_NONE, BASE_NONE, NULL, 0x0, \
1448  NULL, HFILL } \
1449  }, \
1450  { & name .hf.hs_ext_alpn_str_len, \
1451  { "ALPN string length", prefix ".handshake.extensions_alpn_str_len", \
1452  FT_UINT8, BASE_DEC, NULL, 0x0, \
1453  "Length of ALPN string", HFILL } \
1454  }, \
1455  { & name .hf.hs_ext_alpn_str, \
1456  { "ALPN Next Protocol", prefix ".handshake.extensions_alpn_str", \
1457  FT_STRING, BASE_NONE, NULL, 0x00, \
1458  NULL, HFILL } \
1459  }, \
1460  { & name .hf.hs_ext_npn_str_len, \
1461  { "Protocol string length", prefix ".handshake.extensions_npn_str_len", \
1462  FT_UINT8, BASE_DEC, NULL, 0x0, \
1463  "Length of next protocol string", HFILL } \
1464  }, \
1465  { & name .hf.hs_ext_npn_str, \
1466  { "Next Protocol", prefix ".handshake.extensions_npn", \
1467  FT_STRING, BASE_NONE, NULL, 0x0, \
1468  NULL, HFILL } \
1469  }, \
1470  { & name .hf.hs_ext_reneg_info_len, \
1471  { "Renegotiation info extension length", prefix ".handshake.extensions_reneg_info_len", \
1472  FT_UINT8, BASE_DEC, NULL, 0x0, \
1473  NULL, HFILL } \
1474  }, \
1475  { & name .hf.hs_ext_reneg_info, \
1476  { "Renegotiation info", prefix ".handshake.extensions_reneg_info",\
1477  FT_BYTES, BASE_NONE, NULL, 0x0, \
1478  NULL, HFILL } \
1479  }, \
1480  { & name .hf.hs_ext_key_share_client_length, \
1481  { "Client Key Share Length", prefix ".handshake.extensions_key_share_client_length", \
1482  FT_UINT16, BASE_DEC, NULL, 0x00, \
1483  NULL, HFILL } \
1484  }, \
1485  { & name .hf.hs_ext_key_share_group, \
1486  { "Group", prefix ".handshake.extensions_key_share_group", \
1487  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1488  NULL, HFILL } \
1489  }, \
1490  { & name .hf.hs_ext_key_share_key_exchange_length, \
1491  { "Key Exchange Length", prefix ".handshake.extensions_key_share_key_exchange_length", \
1492  FT_UINT16, BASE_DEC, NULL, 0x00, \
1493  NULL, HFILL } \
1494  }, \
1495  { & name .hf.hs_ext_key_share_key_exchange, \
1496  { "Key Exchange", prefix ".handshake.extensions_key_share_key_exchange", \
1497  FT_BYTES, BASE_NONE, NULL, 0x0, \
1498  NULL, HFILL } \
1499  }, \
1500  { & name .hf.hs_ext_key_share_selected_group, \
1501  { "Selected Group", prefix ".handshake.extensions_key_share_selected_group", \
1502  FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1503  NULL, HFILL } \
1504  }, \
1505  { & name .hf.hs_ext_psk_identities_length, \
1506  { "Identities Length", prefix ".handshake.extensions.psk.identities.length", \
1507  FT_UINT16, BASE_DEC, NULL, 0x0, \
1508  NULL, HFILL } \
1509  }, \
1510  { & name .hf.hs_ext_psk_identity_identity_length, \
1511  { "Identity Length", prefix ".handshake.extensions.psk.identity.identity_length", \
1512  FT_UINT16, BASE_DEC, NULL, 0x0, \
1513  NULL, HFILL } \
1514  }, \
1515  { & name .hf.hs_ext_psk_identity_identity, \
1516  { "Identity", prefix ".handshake.extensions.psk.identity.identity", \
1517  FT_BYTES, BASE_NONE, NULL, 0x0, \
1518  NULL, HFILL } \
1519  }, \
1520  { & name .hf.hs_ext_psk_identity_obfuscated_ticket_age, \
1521  { "Obfuscated Ticket Age", prefix ".handshake.extensions.psk.identity.obfuscated_ticket_age", \
1522  FT_UINT32, BASE_DEC, NULL, 0x0, \
1523  NULL, HFILL } \
1524  }, \
1525  { & name .hf.hs_ext_psk_binders_length, \
1526  { "PSK Binders length", prefix ".handshake.extensions.psk.binders_len", \
1527  FT_UINT16, BASE_DEC, NULL, 0x0, \
1528  NULL, HFILL } \
1529  }, \
1530  { & name .hf.hs_ext_psk_binders, \
1531  { "PSK Binders", prefix ".handshake.extensions.psk.binders", \
1532  FT_NONE, BASE_NONE, NULL, 0x0, \
1533  NULL, HFILL } \
1534  }, \
1535  { & name .hf.hs_ext_psk_identity_selected, \
1536  { "Selected Identity", prefix ".handshake.extensions.psk.identity.selected", \
1537  FT_UINT16, BASE_DEC, NULL, 0x0, \
1538  NULL, HFILL } \
1539  }, \
1540  { & name .hf.hs_ext_session_ticket, \
1541  { "Session Ticket", prefix ".handshake.extensions.session_ticket", \
1542  FT_BYTES, BASE_NONE, NULL, 0x0, \
1543  NULL, HFILL } \
1544  }, \
1545  { & name .hf.hs_ext_supported_versions_len, \
1546  { "Supported Versions length", prefix ".handshake.extensions.supported_versions_len", \
1547  FT_UINT8, BASE_DEC, NULL, 0x0, \
1548  NULL, HFILL } \
1549  }, \
1550  { & name .hf.hs_ext_supported_version, \
1551  { "Supported Version", prefix ".handshake.extensions.supported_version", \
1552  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1553  NULL, HFILL } \
1554  }, \
1555  { & name .hf.hs_ext_cookie_len, \
1556  { "Cookie length", prefix ".handshake.extensions.cookie_len", \
1557  FT_UINT16, BASE_DEC, NULL, 0x0, \
1558  NULL, HFILL } \
1559  }, \
1560  { & name .hf.hs_ext_cookie, \
1561  { "Cookie", prefix ".handshake.extensions.cookie", \
1562  FT_BYTES, BASE_NONE, NULL, 0x0, \
1563  NULL, HFILL } \
1564  }, \
1565  { & name .hf.hs_ext_server_name_list_len, \
1566  { "Server Name list length", prefix ".handshake.extensions_server_name_list_len", \
1567  FT_UINT16, BASE_DEC, NULL, 0x0, \
1568  "Length of server name list", HFILL } \
1569  }, \
1570  { & name .hf.hs_ext_server_name_len, \
1571  { "Server Name length", prefix ".handshake.extensions_server_name_len", \
1572  FT_UINT16, BASE_DEC, NULL, 0x0, \
1573  "Length of server name string", HFILL } \
1574  }, \
1575  { & name .hf.hs_ext_server_name_type, \
1576  { "Server Name Type", prefix ".handshake.extensions_server_name_type", \
1577  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_server_name_type_vs), 0x0, \
1578  NULL, HFILL } \
1579  }, \
1580  { & name .hf.hs_ext_server_name, \
1581  { "Server Name", prefix ".handshake.extensions_server_name", \
1582  FT_STRING, BASE_NONE, NULL, 0x0, \
1583  NULL, HFILL } \
1584  }, \
1585  { & name .hf.hs_ext_max_fragment_length, \
1586  { "Maximum Fragment Length", prefix ".handshake.max_fragment_length", \
1587  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_max_fragment_length), 0x00, \
1588  "Maximum fragment length that an endpoint is willing to receive", HFILL } \
1589  }, \
1590  { & name .hf.hs_ext_padding_data, \
1591  { "Padding Data", prefix ".handshake.extensions_padding_data", \
1592  FT_BYTES, BASE_NONE, NULL, 0x0, \
1593  "Must be zero", HFILL } \
1594  }, \
1595  { & name .hf.hs_ext_cert_url_type, \
1596  { "Certificate Chain Type", prefix ".handshake.cert_url_type", \
1597  FT_UINT8, BASE_DEC, VALS(tls_cert_chain_type), 0x0, \
1598  "Certificate Chain Type for Client Certificate URL", HFILL } \
1599  }, \
1600  { & name .hf.hs_ext_cert_url_url_hash_list_len, \
1601  { "URL and Hash list Length", prefix ".handshake.cert_url.url_hash_len", \
1602  FT_UINT16, BASE_DEC, NULL, 0x0, \
1603  NULL, HFILL } \
1604  }, \
1605  { & name .hf.hs_ext_cert_url_item, \
1606  { "URL and Hash", prefix ".handshake.cert_url.url_hash", \
1607  FT_NONE, BASE_NONE, NULL, 0x0, \
1608  NULL, HFILL } \
1609  }, \
1610  { & name .hf.hs_ext_cert_url_url_len, \
1611  { "URL Length", prefix ".handshake.cert_url.url_len", \
1612  FT_UINT16, BASE_DEC, NULL, 0x0, \
1613  NULL, HFILL } \
1614  }, \
1615  { & name .hf.hs_ext_cert_type, \
1616  { "Certificate Type", prefix ".handshake.cert_type.type", \
1617  FT_UINT8, BASE_HEX, VALS(tls_certificate_type), 0x0, \
1618  NULL, HFILL } \
1619  }, \
1620  { & name .hf.hs_ext_cert_types, \
1621  { "Certificate Type List", prefix ".handshake.cert_type.types", \
1622  FT_NONE, BASE_NONE, NULL, 0x0, \
1623  NULL, HFILL } \
1624  }, \
1625  { & name .hf.hs_ext_cert_types_len, \
1626  { "Certificate Type List Length", prefix ".handshake.cert_type.types_len", \
1627  FT_UINT8, BASE_DEC, NULL, 0x0, \
1628  NULL, HFILL } \
1629  }, \
1630  { & name .hf.hs_ext_cert_url_url, \
1631  { "URL", prefix ".handshake.cert_url.url", \
1632  FT_STRING, BASE_NONE, NULL, 0x0, \
1633  "URL used to fetch the certificate(s)", HFILL } \
1634  }, \
1635  { & name .hf.hs_ext_cert_url_padding, \
1636  { "Padding", prefix ".handshake.cert_url.padding", \
1637  FT_NONE, BASE_NONE, NULL, 0x0, \
1638  "Padding that MUST be 0x01 for backwards compatibility", HFILL } \
1639  }, \
1640  { & name .hf.hs_ext_cert_url_sha1, \
1641  { "SHA1 Hash", prefix ".handshake.cert_url.sha1", \
1642  FT_BYTES, BASE_NONE, NULL, 0x0, \
1643  "SHA1 Hash of the certificate", HFILL } \
1644  }, \
1645  { & name .hf.hs_ext_cert_status_type, \
1646  { "Certificate Status Type", prefix ".handshake.extensions_status_request_type", \
1647  FT_UINT8, BASE_DEC, VALS(tls_cert_status_type), 0x0, \
1648  NULL, HFILL } \
1649  }, \
1650  { & name .hf.hs_ext_cert_status_request_len, \
1651  { "Certificate Status Length", prefix ".handshake.extensions_status_request_len", \
1652  FT_UINT16, BASE_DEC, NULL, 0x0, \
1653  NULL, HFILL } \
1654  }, \
1655  { & name .hf.hs_ext_cert_status_responder_id_list_len, \
1656  { "Responder ID list Length", prefix ".handshake.extensions_status_request_responder_ids_len", \
1657  FT_UINT16, BASE_DEC, NULL, 0x0, \
1658  NULL, HFILL } \
1659  }, \
1660  { & name .hf.hs_ext_cert_status_request_extensions_len, \
1661  { "Request Extensions Length", prefix ".handshake.extensions_status_request_exts_len", \
1662  FT_UINT16, BASE_DEC, NULL, 0x0, \
1663  NULL, HFILL } \
1664  }, \
1665  { & name .hf.hs_ext_cert_status_request_list_len, \
1666  { "Certificate Status List Length", prefix ".handshake.extensions_status_request_list_len", \
1667  FT_UINT16, BASE_DEC, NULL, 0x0, \
1668  "CertificateStatusRequestItemV2 list length", HFILL } \
1669  }, \
1670  { & name .hf.hs_ocsp_response_list_len, \
1671  { "OCSP Response List Length", prefix ".handshake.ocsp_response_list_len", \
1672  FT_UINT24, BASE_DEC, NULL, 0x0, \
1673  "OCSPResponseList length", HFILL } \
1674  }, \
1675  { & name .hf.hs_ocsp_response_len, \
1676  { "OCSP Response Length", prefix ".handshake.ocsp_response_len", \
1677  FT_UINT24, BASE_DEC, NULL, 0x0, \
1678  NULL, HFILL } \
1679  }, \
1680  { & name .hf.hs_sig_hash_alg_len, \
1681  { "Signature Hash Algorithms Length", prefix ".handshake.sig_hash_alg_len", \
1682  FT_UINT16, BASE_DEC, NULL, 0x0, \
1683  "Length of Signature Hash Algorithms", HFILL } \
1684  }, \
1685  { & name .hf.hs_sig_hash_algs, \
1686  { "Signature Algorithms", prefix ".handshake.sig_hash_algs", \
1687  FT_NONE, BASE_NONE, NULL, 0x0, \
1688  "List of supported Signature Algorithms", HFILL } \
1689  }, \
1690  { & name .hf.hs_sig_hash_alg, \
1691  { "Signature Algorithm", prefix ".handshake.sig_hash_alg", \
1692  FT_UINT16, BASE_HEX, VALS(tls13_signature_algorithm), 0x0, \
1693  NULL, HFILL } \
1694  }, \
1695  { & name .hf.hs_sig_hash_hash, \
1696  { "Signature Hash Algorithm Hash", prefix ".handshake.sig_hash_hash", \
1697  FT_UINT8, BASE_DEC, VALS(tls_hash_algorithm), 0x0, \
1698  "Hash algorithm (TLS 1.2)", HFILL } \
1699  }, \
1700  { & name .hf.hs_sig_hash_sig, \
1701  { "Signature Hash Algorithm Signature", prefix ".handshake.sig_hash_sig", \
1702  FT_UINT8, BASE_DEC, VALS(tls_signature_algorithm), 0x0, \
1703  "Signature algorithm (TLS 1.2)", HFILL } \
1704  }, \
1705  { & name .hf.hs_client_keyex_epms_len, \
1706  { "Encrypted PreMaster length", prefix ".handshake.epms_len", \
1707  FT_UINT16, BASE_DEC, NULL, 0x0, \
1708  "Length of encrypted PreMaster secret", HFILL } \
1709  }, \
1710  { & name .hf.hs_client_keyex_epms, \
1711  { "Encrypted PreMaster", prefix ".handshake.epms", \
1712  FT_BYTES, BASE_NONE, NULL, 0x0, \
1713  "Encrypted PreMaster secret", HFILL } \
1714  }, \
1715  { & name .hf.hs_server_keyex_modulus_len, \
1716  { "Modulus Length", prefix ".handshake.modulus_len", \
1717  FT_UINT16, BASE_DEC, NULL, 0x0, \
1718  "Length of RSA-EXPORT modulus", HFILL } \
1719  }, \
1720  { & name .hf.hs_server_keyex_exponent_len, \
1721  { "Exponent Length", prefix ".handshake.exponent_len", \
1722  FT_UINT16, BASE_DEC, NULL, 0x0, \
1723  "Length of RSA-EXPORT exponent", HFILL } \
1724  }, \
1725  { & name .hf.hs_server_keyex_sig_len, \
1726  { "Signature Length", prefix ".handshake.sig_len", \
1727  FT_UINT16, BASE_DEC, NULL, 0x0, \
1728  "Length of Signature", HFILL } \
1729  }, \
1730  { & name .hf.hs_server_keyex_p_len, \
1731  { "p Length", prefix ".handshake.p_len", \
1732  FT_UINT16, BASE_DEC, NULL, 0x0, \
1733  "Length of p", HFILL } \
1734  }, \
1735  { & name .hf.hs_server_keyex_g_len, \
1736  { "g Length", prefix ".handshake.g_len", \
1737  FT_UINT16, BASE_DEC, NULL, 0x0, \
1738  "Length of g", HFILL } \
1739  }, \
1740  { & name .hf.hs_server_keyex_ys_len, \
1741  { "Pubkey Length", prefix ".handshake.ys_len", \
1742  FT_UINT16, BASE_DEC, NULL, 0x0, \
1743  "Length of server's Diffie-Hellman public key", HFILL } \
1744  }, \
1745  { & name .hf.hs_client_keyex_yc_len, \
1746  { "Pubkey Length", prefix ".handshake.yc_len", \
1747  FT_UINT16, BASE_DEC, NULL, 0x0, \
1748  "Length of client's Diffie-Hellman public key", HFILL } \
1749  }, \
1750  { & name .hf.hs_client_keyex_point_len, \
1751  { "Pubkey Length", prefix ".handshake.client_point_len", \
1752  FT_UINT8, BASE_DEC, NULL, 0x0, \
1753  "Length of client's EC Diffie-Hellman public key", HFILL } \
1754  }, \
1755  { & name .hf.hs_server_keyex_point_len, \
1756  { "Pubkey Length", prefix ".handshake.server_point_len", \
1757  FT_UINT8, BASE_DEC, NULL, 0x0, \
1758  "Length of server's EC Diffie-Hellman public key", HFILL } \
1759  }, \
1760  { & name .hf.hs_server_keyex_p, \
1761  { "p", prefix ".handshake.p", \
1762  FT_BYTES, BASE_NONE, NULL, 0x0, \
1763  "Diffie-Hellman p", HFILL } \
1764  }, \
1765  { & name .hf.hs_server_keyex_g, \
1766  { "g", prefix ".handshake.g", \
1767  FT_BYTES, BASE_NONE, NULL, 0x0, \
1768  "Diffie-Hellman g", HFILL } \
1769  }, \
1770  { & name .hf.hs_server_keyex_curve_type, \
1771  { "Curve Type", prefix ".handshake.server_curve_type", \
1772  FT_UINT8, BASE_HEX, VALS(ssl_curve_types), 0x0, \
1773  "Server curve_type", HFILL } \
1774  }, \
1775  { & name .hf.hs_server_keyex_named_curve, \
1776  { "Named Curve", prefix ".handshake.server_named_curve", \
1777  FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1778  "Server named_curve", HFILL } \
1779  }, \
1780  { & name .hf.hs_server_keyex_ys, \
1781  { "Pubkey", prefix ".handshake.ys", \
1782  FT_BYTES, BASE_NONE, NULL, 0x0, \
1783  "Diffie-Hellman server pubkey", HFILL } \
1784  }, \
1785  { & name .hf.hs_client_keyex_yc, \
1786  { "Pubkey", prefix ".handshake.yc", \
1787  FT_BYTES, BASE_NONE, NULL, 0x0, \
1788  "Diffie-Hellman client pubkey", HFILL } \
1789  }, \
1790  { & name .hf.hs_server_keyex_point, \
1791  { "Pubkey", prefix ".handshake.server_point", \
1792  FT_BYTES, BASE_NONE, NULL, 0x0, \
1793  "EC Diffie-Hellman server pubkey", HFILL } \
1794  }, \
1795  { & name .hf.hs_client_keyex_point, \
1796  { "Pubkey", prefix ".handshake.client_point", \
1797  FT_BYTES, BASE_NONE, NULL, 0x0, \
1798  "EC Diffie-Hellman client pubkey", HFILL } \
1799  }, \
1800  { & name .hf.hs_server_keyex_xs_len, \
1801  { "Pubkey Length", prefix ".handshake.xs_len", \
1802  FT_UINT8, BASE_DEC, NULL, 0x0, \
1803  "Length of EC J-PAKE server public key", HFILL } \
1804  }, \
1805  { & name .hf.hs_client_keyex_xc_len, \
1806  { "Pubkey Length", prefix ".handshake.xc_len", \
1807  FT_UINT8, BASE_DEC, NULL, 0x0, \
1808  "Length of EC J-PAKE client public key", HFILL } \
1809  }, \
1810  { & name .hf.hs_server_keyex_xs, \
1811  { "Pubkey", prefix ".handshake.xs", \
1812  FT_BYTES, BASE_NONE, NULL, 0x0, \
1813  "EC J-PAKE server public key", HFILL } \
1814  }, \
1815  { & name .hf.hs_client_keyex_xc, \
1816  { "Pubkey", prefix ".handshake.xc", \
1817  FT_BYTES, BASE_NONE, NULL, 0x0, \
1818  "EC J-PAKE client public key", HFILL } \
1819  }, \
1820  { & name .hf.hs_server_keyex_vs_len, \
1821  { "Ephemeral Pubkey Length", prefix ".handshake.vs_len", \
1822  FT_UINT8, BASE_DEC, NULL, 0x0, \
1823  "Length of EC J-PAKE server ephemeral public key", HFILL } \
1824  }, \
1825  { & name .hf.hs_client_keyex_vc_len, \
1826  { "Ephemeral Pubkey Length", prefix ".handshake.vc_len", \
1827  FT_UINT8, BASE_DEC, NULL, 0x0, \
1828  "Length of EC J-PAKE client ephemeral public key", HFILL } \
1829  }, \
1830  { & name .hf.hs_server_keyex_vs, \
1831  { "Ephemeral Pubkey", prefix ".handshake.vs", \
1832  FT_BYTES, BASE_NONE, NULL, 0x0, \
1833  "EC J-PAKE server ephemeral public key", HFILL } \
1834  }, \
1835  { & name .hf.hs_client_keyex_vc, \
1836  { "Ephemeral Pubkey", prefix ".handshake.vc", \
1837  FT_BYTES, BASE_NONE, NULL, 0x0, \
1838  "EC J-PAKE client ephemeral public key", HFILL } \
1839  }, \
1840  { & name .hf.hs_server_keyex_rs_len, \
1841  { "Schnorr signature Length", prefix ".handshake.rs_len", \
1842  FT_UINT8, BASE_DEC, NULL, 0x0, \
1843  "Length of EC J-PAKE server Schnorr signature", HFILL } \
1844  }, \
1845  { & name .hf.hs_client_keyex_rc_len, \
1846  { "Schnorr signature Length", prefix ".handshake.rc_len", \
1847  FT_UINT8, BASE_DEC, NULL, 0x0, \
1848  "Length of EC J-PAKE client Schnorr signature", HFILL } \
1849  }, \
1850  { & name .hf.hs_server_keyex_rs, \
1851  { "Schnorr signature", prefix ".handshake.rs", \
1852  FT_BYTES, BASE_NONE, NULL, 0x0, \
1853  "EC J-PAKE server Schnorr signature", HFILL } \
1854  }, \
1855  { & name .hf.hs_client_keyex_rc, \
1856  { "Schnorr signature", prefix ".handshake.rc", \
1857  FT_BYTES, BASE_NONE, NULL, 0x0, \
1858  "EC J-PAKE client Schnorr signature", HFILL } \
1859  }, \
1860  { & name .hf.hs_server_keyex_modulus, \
1861  { "Modulus", prefix ".handshake.modulus", \
1862  FT_BYTES, BASE_NONE, NULL, 0x0, \
1863  "RSA-EXPORT modulus", HFILL } \
1864  }, \
1865  { & name .hf.hs_server_keyex_exponent, \
1866  { "Exponent", prefix ".handshake.exponent", \
1867  FT_BYTES, BASE_NONE, NULL, 0x0, \
1868  "RSA-EXPORT exponent", HFILL } \
1869  }, \
1870  { & name .hf.hs_server_keyex_sig, \
1871  { "Signature", prefix ".handshake.sig", \
1872  FT_BYTES, BASE_NONE, NULL, 0x0, \
1873  "Diffie-Hellman server signature", HFILL } \
1874  }, \
1875  { & name .hf.hs_server_keyex_hint_len, \
1876  { "Hint Length", prefix ".handshake.hint_len", \
1877  FT_UINT16, BASE_DEC, NULL, 0x0, \
1878  "Length of PSK Hint", HFILL } \
1879  }, \
1880  { & name .hf.hs_server_keyex_hint, \
1881  { "Hint", prefix ".handshake.hint", \
1882  FT_BYTES, BASE_NONE, NULL, 0x0, \
1883  "PSK Hint", HFILL } \
1884  }, \
1885  { & name .hf.hs_client_keyex_identity_len, \
1886  { "Identity Length", prefix ".handshake.identity_len", \
1887  FT_UINT16, BASE_DEC, NULL, 0x0, \
1888  "Length of PSK Identity", HFILL } \
1889  }, \
1890  { & name .hf.hs_client_keyex_identity, \
1891  { "Identity", prefix ".handshake.identity", \
1892  FT_BYTES, BASE_NONE, NULL, 0x0, \
1893  "PSK Identity", HFILL } \
1894  }, \
1895  { & name .hf.hs_ext_heartbeat_mode, \
1896  { "Mode", prefix ".handshake.extension.heartbeat.mode", \
1897  FT_UINT8, BASE_DEC, VALS(tls_heartbeat_mode), 0x0, \
1898  "Heartbeat extension mode", HFILL } \
1899  }, \
1900  { & name .hf.hs_certificates_len, \
1901  { "Certificates Length", prefix ".handshake.certificates_length", \
1902  FT_UINT24, BASE_DEC, NULL, 0x0, \
1903  "Length of certificates field", HFILL } \
1904  }, \
1905  { & name .hf.hs_certificates, \
1906  { "Certificates", prefix ".handshake.certificates", \
1907  FT_NONE, BASE_NONE, NULL, 0x0, \
1908  "List of certificates", HFILL } \
1909  }, \
1910  { & name .hf.hs_certificate, \
1911  { "Certificate", prefix ".handshake.certificate", \
1912  FT_BYTES, BASE_NONE, NULL, 0x0, \
1913  NULL, HFILL } \
1914  }, \
1915  { & name .hf.hs_certificate_len, \
1916  { "Certificate Length", prefix ".handshake.certificate_length", \
1917  FT_UINT24, BASE_DEC, NULL, 0x0, \
1918  "Length of certificate", HFILL } \
1919  }, \
1920  { & name .hf.hs_cert_types_count, \
1921  { "Certificate types count", prefix ".handshake.cert_types_count",\
1922  FT_UINT8, BASE_DEC, NULL, 0x0, \
1923  "Count of certificate types", HFILL } \
1924  }, \
1925  { & name .hf.hs_cert_types, \
1926  { "Certificate types", prefix ".handshake.cert_types", \
1927  FT_NONE, BASE_NONE, NULL, 0x0, \
1928  "List of certificate types", HFILL } \
1929  }, \
1930  { & name .hf.hs_cert_type, \
1931  { "Certificate type", prefix ".handshake.cert_type", \
1932  FT_UINT8, BASE_DEC, VALS(ssl_31_client_certificate_type), 0x0, \
1933  NULL, HFILL } \
1934  }, \
1935  { & name .hf.hs_dnames_len, \
1936  { "Distinguished Names Length", prefix ".handshake.dnames_len", \
1937  FT_UINT16, BASE_DEC, NULL, 0x0, \
1938  "Length of list of CAs that server trusts", HFILL } \
1939  }, \
1940  { & name .hf.hs_dnames, \
1941  { "Distinguished Names", prefix ".handshake.dnames", \
1942  FT_NONE, BASE_NONE, NULL, 0x0, \
1943  "List of CAs that server trusts", HFILL } \
1944  }, \
1945  { & name .hf.hs_dname_len, \
1946  { "Distinguished Name Length", prefix ".handshake.dname_len", \
1947  FT_UINT16, BASE_DEC, NULL, 0x0, \
1948  "Length of distinguished name", HFILL } \
1949  }, \
1950  { & name .hf.hs_dnames_truncated, \
1951  { "Tree view truncated", prefix ".handshake.dnames_truncated", \
1952  FT_NONE, BASE_NONE, NULL, 0x00, \
1953  "Some Distinguished Names are not added to tree pane to limit resources", HFILL } \
1954  }, \
1955  { & name .hf.hs_dname, \
1956  { "Distinguished Name", prefix ".handshake.dname", \
1957  FT_NONE, BASE_NONE, NULL, 0x0, \
1958  "Distinguished name of a CA that server trusts", HFILL } \
1959  }, \
1960  { & name .hf.hs_random, \
1961  { "Random", prefix ".handshake.random", \
1962  FT_BYTES, BASE_NONE, NULL, 0x0, \
1963  "Random values used for deriving keys", HFILL } \
1964  }, \
1965  { & name .hf.hs_random_time, \
1966  { "GMT Unix Time", prefix ".handshake.random_time", \
1967  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0, \
1968  "Unix time field of random structure", HFILL } \
1969  }, \
1970  { & name .hf.hs_random_bytes, \
1971  { "Random Bytes", prefix ".handshake.random_bytes", \
1972  FT_BYTES, BASE_NONE, NULL, 0x0, \
1973  "Random values used for deriving keys", HFILL } \
1974  }, \
1975  { & name .hf.hs_session_id, \
1976  { "Session ID", prefix ".handshake.session_id", \
1977  FT_BYTES, BASE_NONE, NULL, 0x0, \
1978  "Identifies the SSL session, allowing later resumption", HFILL }\
1979  }, \
1980  { & name .hf.hs_session_id_len, \
1981  { "Session ID Length", prefix ".handshake.session_id_length", \
1982  FT_UINT8, BASE_DEC, NULL, 0x0, \
1983  "Length of Session ID field", HFILL } \
1984  }, \
1985  { & name .hf.hs_client_version, \
1986  { "Version", prefix ".handshake.version", \
1987  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1988  "Maximum version supported by client [legacy_version if supported_versions ext is present]", HFILL } \
1989  }, \
1990  { & name .hf.hs_server_version, \
1991  { "Version", prefix ".handshake.version", \
1992  FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1993  "Version selected by server [legacy_version if supported_versions ext is present]", HFILL } \
1994  }, \
1995  { & name .hf.hs_cipher_suites_len, \
1996  { "Cipher Suites Length", prefix ".handshake.cipher_suites_length", \
1997  FT_UINT16, BASE_DEC, NULL, 0x0, \
1998  "Length of cipher suites field", HFILL } \
1999  }, \
2000  { & name .hf.hs_cipher_suites, \
2001  { "Cipher Suites", prefix ".handshake.ciphersuites", \
2002  FT_NONE, BASE_NONE, NULL, 0x0, \
2003  "List of cipher suites supported by client", HFILL } \
2004  }, \
2005  { & name .hf.hs_cipher_suite, \
2006  { "Cipher Suite", prefix ".handshake.ciphersuite", \
2007  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2008  NULL, HFILL } \
2009  }, \
2010  { & name .hf.hs_comp_methods_len, \
2011  { "Compression Methods Length", prefix ".handshake.comp_methods_length", \
2012  FT_UINT8, BASE_DEC, NULL, 0x0, \
2013  "Length of compression methods field", HFILL } \
2014  }, \
2015  { & name .hf.hs_comp_methods, \
2016  { "Compression Methods", prefix ".handshake.comp_methods", \
2017  FT_NONE, BASE_NONE, NULL, 0x0, \
2018  "List of compression methods supported by client", HFILL } \
2019  }, \
2020  { & name .hf.hs_comp_method, \
2021  { "Compression Method", prefix ".handshake.comp_method", \
2022  FT_UINT8, BASE_DEC, VALS(ssl_31_compression_method), 0x0, \
2023  NULL, HFILL } \
2024  }, \
2025  { & name .hf.hs_session_ticket_lifetime_hint, \
2026  { "Session Ticket Lifetime Hint", \
2027  prefix ".handshake.session_ticket_lifetime_hint", \
2028  FT_UINT32, BASE_DEC|BASE_UNIT_STRING, &units_second_seconds, 0x0, \
2029  "New Session Ticket Lifetime Hint", HFILL } \
2030  }, \
2031  { & name .hf.hs_session_ticket_age_add, \
2032  { "Session Ticket Age Add", \
2033  prefix ".handshake.session_ticket_age_add", \
2034  FT_UINT32, BASE_DEC, NULL, 0x0, \
2035  "Random 32-bit value to obscure age of ticket", HFILL } \
2036  }, \
2037  { & name .hf.hs_session_ticket_nonce_len, \
2038  { "Session Ticket Nonce Length", prefix ".handshake.session_ticket_nonce_length", \
2039  FT_UINT8, BASE_DEC, NULL, 0x0, \
2040  NULL, HFILL } \
2041  }, \
2042  { & name .hf.hs_session_ticket_nonce, \
2043  { "Session Ticket Nonce", prefix ".handshake.session_ticket_nonce", \
2044  FT_BYTES, BASE_NONE, NULL, 0x0, \
2045  "A unique per-ticket value", HFILL } \
2046  }, \
2047  { & name .hf.hs_session_ticket_len, \
2048  { "Session Ticket Length", prefix ".handshake.session_ticket_length", \
2049  FT_UINT16, BASE_DEC, NULL, 0x0, \
2050  "New Session Ticket Length", HFILL } \
2051  }, \
2052  { & name .hf.hs_session_ticket, \
2053  { "Session Ticket", prefix ".handshake.session_ticket", \
2054  FT_BYTES, BASE_NONE, NULL, 0x0, \
2055  "New Session Ticket", HFILL } \
2056  }, \
2057  { & name .hf.hs_finished, \
2058  { "Verify Data", prefix ".handshake.verify_data", \
2059  FT_NONE, BASE_NONE, NULL, 0x0, \
2060  "Opaque verification data", HFILL } \
2061  }, \
2062  { & name .hf.hs_client_cert_vrfy_sig_len, \
2063  { "Signature length", prefix ".handshake.client_cert_vrfy.sig_len", \
2064  FT_UINT16, BASE_DEC, NULL, 0x0, \
2065  "Length of CertificateVerify's signature", HFILL } \
2066  }, \
2067  { & name .hf.hs_client_cert_vrfy_sig, \
2068  { "Signature", prefix ".handshake.client_cert_vrfy.sig", \
2069  FT_BYTES, BASE_NONE, NULL, 0x0, \
2070  "CertificateVerify's signature", HFILL } \
2071  }, \
2072  { & name .hf.hs_ja3_full, \
2073  { "JA3 Fullstring", prefix ".handshake.ja3_full", \
2074  FT_STRING, BASE_NONE, NULL, 0x0, \
2075  NULL, HFILL } \
2076  }, \
2077  { & name .hf.hs_ja3_hash, \
2078  { "JA3", prefix ".handshake.ja3", \
2079  FT_STRING, BASE_NONE, NULL, 0x0, \
2080  NULL, HFILL } \
2081  }, \
2082  { & name .hf.hs_ja3s_full, \
2083  { "JA3S Fullstring", prefix ".handshake.ja3s_full", \
2084  FT_STRING, BASE_NONE, NULL, 0x0, \
2085  NULL, HFILL } \
2086  }, \
2087  { & name .hf.hs_ja3s_hash, \
2088  { "JA3S", prefix ".handshake.ja3s", \
2089  FT_STRING, BASE_NONE, NULL, 0x0, \
2090  NULL, HFILL } \
2091  }, \
2092  { & name .hf.hs_ja4, \
2093  { "JA4", prefix ".handshake.ja4", \
2094  FT_STRING, BASE_NONE, NULL, 0x0, \
2095  NULL, HFILL } \
2096  }, \
2097  { & name .hf.hs_ja4_r, \
2098  { "JA4_r", prefix ".handshake.ja4_r", \
2099  FT_STRING, BASE_NONE, NULL, 0x0, \
2100  NULL, HFILL } \
2101  }, \
2102  { & name .hf.hs_ext_psk_ke_modes_length, \
2103  { "PSK Key Exchange Modes Length", prefix ".extension.psk_ke_modes_length", \
2104  FT_UINT8, BASE_DEC, NULL, 0x0, \
2105  NULL, HFILL } \
2106  }, \
2107  { & name .hf.hs_ext_psk_ke_mode, \
2108  { "PSK Key Exchange Mode", prefix ".extension.psk_ke_mode", \
2109  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_psk_ke_mode), 0x0, \
2110  "Key exchange modes where the client supports use of PSKs", HFILL } \
2111  }, \
2112  { & name .hf.hs_certificate_request_context_length, \
2113  { "Certificate Request Context Length", prefix ".handshake.certificate_request_context_length", \
2114  FT_UINT8, BASE_DEC, NULL, 0x0, \
2115  NULL, HFILL } \
2116  }, \
2117  { & name .hf.hs_certificate_request_context, \
2118  { "Certificate Request Context", prefix ".handshake.certificate_request_context", \
2119  FT_BYTES, BASE_NONE, NULL, 0x0, \
2120  "Value from CertificateRequest or empty for server auth", HFILL } \
2121  }, \
2122  { & name .hf.hs_key_update_request_update, \
2123  { "Key Update Request", prefix ".handshake.key_update.request_update", \
2124  FT_UINT8, BASE_DEC, VALS(tls13_key_update_request), 0x00, \
2125  "Whether the receiver should also update its keys", HFILL } \
2126  }, \
2127  { & name .hf.sct_scts_length, \
2128  { "Serialized SCT List Length", prefix ".sct.scts_length", \
2129  FT_UINT16, BASE_DEC, NULL, 0x00, \
2130  NULL, HFILL } \
2131  }, \
2132  { & name .hf.sct_sct_length, \
2133  { "Serialized SCT Length", prefix ".sct.sct_length", \
2134  FT_UINT16, BASE_DEC, NULL, 0x00, \
2135  NULL, HFILL } \
2136  }, \
2137  { & name .hf.sct_sct_version, \
2138  { "SCT Version", prefix ".sct.sct_version", \
2139  FT_UINT8, BASE_DEC, NULL, 0x00, \
2140  "SCT Protocol version (v1 (0) is defined in RFC 6962)", HFILL } \
2141  }, \
2142  { & name .hf.sct_sct_logid, \
2143  { "Log ID", prefix ".sct.sct_logid", \
2144  FT_BYTES, BASE_NONE, NULL, 0x00, \
2145  "SHA-256 hash of log's public key", HFILL } \
2146  }, \
2147  { & name .hf.sct_sct_timestamp, \
2148  { "Timestamp", prefix ".sct.sct_timestamp", \
2149  FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x00, \
2150  "Timestamp of issuance", HFILL } \
2151  }, \
2152  { & name .hf.sct_sct_extensions_length, \
2153  { "Extensions length", prefix ".sct.sct_extensions_length", \
2154  FT_UINT16, BASE_DEC, NULL, 0x00, \
2155  "Length of future extensions to this protocol (currently none)", HFILL } \
2156  }, \
2157  { & name .hf.sct_sct_extensions, \
2158  { "Extensions", prefix ".sct.sct_extensions", \
2159  FT_NONE, BASE_NONE, NULL, 0x00, \
2160  "Future extensions to this protocol (currently none)", HFILL } \
2161  }, \
2162  { & name .hf.sct_sct_signature_length, \
2163  { "Signature Length", prefix ".sct.sct_signature_length", \
2164  FT_UINT16, BASE_DEC, NULL, 0x00, \
2165  NULL, HFILL } \
2166  }, \
2167  { & name .hf.sct_sct_signature, \
2168  { "Signature", prefix ".sct.sct_signature", \
2169  FT_BYTES, BASE_NONE, NULL, 0x00, \
2170  NULL, HFILL } \
2171  }, \
2172  { & name .hf.hs_ext_max_early_data_size, \
2173  { "Maximum Early Data Size", prefix ".early_data.max_early_data_size", \
2174  FT_UINT32, BASE_DEC, NULL, 0x00, \
2175  "Maximum amount of 0-RTT data that the client may send", HFILL } \
2176  }, \
2177  { & name .hf.hs_ext_oid_filters_length, \
2178  { "OID Filters Length", prefix ".extension.oid_filters_length", \
2179  FT_UINT16, BASE_DEC, NULL, 0x00, \
2180  NULL, HFILL } \
2181  }, \
2182  { & name .hf.hs_ext_oid_filters_oid_length, \
2183  { "Certificate Extension OID Length", prefix ".extension.oid_filters.oid_length", \
2184  FT_UINT8, BASE_DEC, NULL, 0x00, \
2185  NULL, HFILL } \
2186  }, \
2187  { & name .hf.hs_ext_oid_filters_oid, \
2188  { "Certificate Extension OID", prefix ".extension.oid_filters.oid", \
2189  FT_OID, BASE_NONE, NULL, 0x00, \
2190  NULL, HFILL } \
2191  }, \
2192  { & name .hf.hs_ext_oid_filters_values_length, \
2193  { "Certificate Extension Values Length", prefix ".extension.oid_filters.values_length", \
2194  FT_UINT16, BASE_DEC, NULL, 0x00, \
2195  NULL, HFILL } \
2196  }, \
2197  { & name .hf.hs_cred_valid_time, \
2198  { "Valid Time", prefix ".handshake.cred.valid_time", \
2199  FT_UINT16, BASE_DEC, NULL, 0x0, \
2200  "Delegated Credentials Valid Time", HFILL } \
2201  }, \
2202  { & name .hf.hs_cred_pubkey, \
2203  { "Subject Public Key Info", prefix ".handshake.cred.pubkey", \
2204  FT_BYTES, BASE_NONE, NULL, 0x0, \
2205  "Delegated Credentials Subject Public Key Info", HFILL } \
2206  }, \
2207  { & name .hf.hs_cred_pubkey_len, \
2208  { "Subject Public Key Info Length", prefix ".handshake.cred.pubkey_len", \
2209  FT_UINT24, BASE_DEC, NULL, 0x0, \
2210  "Delegated Credentials Subject Public Key Info Length", HFILL } \
2211  }, \
2212  { & name .hf.hs_cred_signature, \
2213  { "Signature", prefix ".handshake.cred.signature", \
2214  FT_BYTES, BASE_NONE, NULL, 0x0, \
2215  "Delegated Credentials Signature", HFILL } \
2216  }, \
2217  { & name .hf.hs_cred_signature_len, \
2218  { "Signature Length", prefix ".handshake.cred.signature_len", \
2219  FT_UINT16, BASE_DEC, NULL, 0x0, \
2220  "Delegated Credentials Signature Length", HFILL } \
2221  }, \
2222  { & name .hf.hs_ext_compress_certificate_algorithms_length, \
2223  { "Algorithms Length", prefix ".compress_certificate.algorithms_length", \
2224  FT_UINT8, BASE_DEC, NULL, 0x00, \
2225  NULL, HFILL } \
2226  }, \
2227  { & name .hf.hs_ext_compress_certificate_algorithm, \
2228  { "Algorithm", prefix ".compress_certificate.algorithm", \
2229  FT_UINT16, BASE_DEC, VALS(compress_certificate_algorithm_vals), 0x00, \
2230  NULL, HFILL } \
2231  }, \
2232  { & name .hf.hs_ext_compress_certificate_uncompressed_length, \
2233  { "Uncompressed Length", prefix ".compress_certificate.uncompressed_length", \
2234  FT_UINT24, BASE_DEC, NULL, 0x00, \
2235  NULL, HFILL } \
2236  }, \
2237  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message_length, \
2238  { "Length", prefix ".compress_certificate.compressed_certificate_message.length", \
2239  FT_UINT24, BASE_DEC, NULL, 0x00, \
2240  NULL, HFILL } \
2241  }, \
2242  { & name .hf.hs_ext_compress_certificate_compressed_certificate_message, \
2243  { "Compressed Certificate Message", prefix ".compress_certificate.compressed_certificate_message", \
2244  FT_BYTES, BASE_NONE, NULL, 0x00, \
2245  NULL, HFILL } \
2246  }, \
2247  { & name .hf.hs_ext_token_binding_version_major, \
2248  { "Protocol Major Version", prefix ".token_binding.version_major", \
2249  FT_UINT8, BASE_HEX, NULL, 0x00, \
2250  "Major version of the Token Binding protocol", HFILL } \
2251  }, \
2252  { & name .hf.hs_ext_token_binding_version_minor, \
2253  { "Protocol Minor Version", prefix ".token_binding.version_minor", \
2254  FT_UINT8, BASE_HEX, NULL, 0x00, \
2255  "Minor version of the Token Binding protocol", HFILL } \
2256  }, \
2257  { & name .hf.hs_ext_token_binding_key_parameters, \
2258  { "Key Parameters", prefix ".token_binding.key_parameters", \
2259  FT_NONE, BASE_NONE, NULL, 0x0, \
2260  NULL, HFILL } \
2261  }, \
2262  { & name .hf.hs_ext_token_binding_key_parameters_length, \
2263  { "Key Parameters Length", prefix ".token_binding.key_parameters_length", \
2264  FT_UINT8, BASE_DEC, NULL, 0x00, \
2265  "Length of the key parameters list", HFILL } \
2266  }, \
2267  { & name .hf.hs_ext_token_binding_key_parameter, \
2268  { "Key Parameter", prefix ".token_binding.key_parameter", \
2269  FT_UINT8, BASE_DEC, VALS(token_binding_key_parameter_vals), 0x00, \
2270  "Identifier of the Token Binding key parameter", HFILL } \
2271  }, \
2272  { & name .hf.hs_ext_record_size_limit, \
2273  { "Record Size Limit", prefix ".record_size_limit", \
2274  FT_UINT16, BASE_DEC, NULL, 0x00, \
2275  "Maximum record size that an endpoint is willing to receive", HFILL } \
2276  }, \
2277  { & name .hf.hs_ext_quictp_len, \
2278  { "Parameters Length", prefix ".quic.len", \
2279  FT_UINT16, BASE_DEC, NULL, 0x00, \
2280  NULL, HFILL } \
2281  }, \
2282  { & name .hf.hs_ext_quictp_parameter, \
2283  { "Parameter", prefix ".quic.parameter", \
2284  FT_NONE, BASE_NONE, NULL, 0x00, \
2285  NULL, HFILL } \
2286  }, \
2287  { & name .hf.hs_ext_quictp_parameter_type, \
2288  { "Type", prefix ".quic.parameter.type", \
2289  FT_UINT64, BASE_CUSTOM, CF_FUNC(quic_transport_parameter_id_base_custom), 0x00, \
2290  NULL, HFILL } \
2291  }, \
2292  { & name .hf.hs_ext_quictp_parameter_len, \
2293  { "Length", prefix ".quic.parameter.length", \
2294  FT_UINT64, BASE_DEC, NULL, 0x00, \
2295  NULL, HFILL } \
2296  }, \
2297  { & name .hf.hs_ext_quictp_parameter_len_old, \
2298  { "Length", prefix ".quic.parameter.lengt.old", \
2299  FT_UINT16, BASE_DEC, NULL, 0x00, \
2300  NULL, HFILL } \
2301  }, \
2302  { & name .hf.hs_ext_quictp_parameter_value, \
2303  { "Value", prefix ".quic.parameter.value", \
2304  FT_BYTES, BASE_NONE, NULL, 0x00, \
2305  NULL, HFILL } \
2306  }, \
2307  { & name .hf.hs_ext_quictp_parameter_original_destination_connection_id, \
2308  { "original_destination_connection_id", prefix ".quic.parameter.original_destination_connection_id", \
2309  FT_BYTES, BASE_NONE, NULL, 0x00, \
2310  "Destination Connection ID from the first Initial packet sent by the client", HFILL } \
2311  }, \
2312  { & name .hf.hs_ext_quictp_parameter_max_idle_timeout, \
2313  { "max_idle_timeout", prefix ".quic.parameter.max_idle_timeout", \
2314  FT_UINT64, BASE_DEC, NULL, 0x00, \
2315  "In milliseconds", HFILL } \
2316  }, \
2317  { & name .hf.hs_ext_quictp_parameter_stateless_reset_token, \
2318  { "stateless_reset_token", prefix ".quic.parameter.stateless_reset_token", \
2319  FT_BYTES, BASE_NONE, NULL, 0x00, \
2320  "Used in verifying a stateless reset", HFILL } \
2321  }, \
2322  { & name .hf.hs_ext_quictp_parameter_max_udp_payload_size, \
2323  { "max_udp_payload_size", prefix ".quic.parameter.max_udp_payload_size", \
2324  FT_UINT64, BASE_DEC, NULL, 0x00, \
2325  "Maximum UDP payload size that the endpoint is willing to receive", HFILL } \
2326  }, \
2327  { & name .hf.hs_ext_quictp_parameter_initial_max_data, \
2328  { "initial_max_data", prefix ".quic.parameter.initial_max_data", \
2329  FT_UINT64, BASE_DEC, NULL, 0x00, \
2330  "Contains the initial value for the maximum amount of data that can be sent on the connection", HFILL } \
2331  }, \
2332  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local, \
2333  { "initial_max_stream_data_bidi_local", prefix ".quic.parameter.initial_max_stream_data_bidi_local", \
2334  FT_UINT64, BASE_DEC, NULL, 0x00, \
2335  "Initial stream maximum data for bidirectional, locally-initiated streams", HFILL } \
2336  }, \
2337  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote, \
2338  { "initial_max_stream_data_bidi_remote", prefix ".quic.parameter.initial_max_stream_data_bidi_remote", \
2339  FT_UINT64, BASE_DEC, NULL, 0x00, \
2340  "Initial stream maximum data for bidirectional, peer-initiated streams", HFILL } \
2341  }, \
2342  { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_uni, \
2343  { "initial_max_stream_data_uni", prefix ".quic.parameter.initial_max_stream_data_uni", \
2344  FT_UINT64, BASE_DEC, NULL, 0x00, \
2345  "Initial stream maximum data for unidirectional streams parameter", HFILL } \
2346  }, \
2347  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_bidi, \
2348  { "initial_max_streams_bidi", prefix ".quic.parameter.initial_max_streams_bidi", \
2349  FT_UINT64, BASE_DEC, NULL, 0x00, \
2350  "Initial maximum number of application-owned bidirectional streams", HFILL } \
2351  }, \
2352  { & name .hf.hs_ext_quictp_parameter_initial_max_streams_uni, \
2353  { "initial_max_streams_uni", prefix ".quic.parameter.initial_max_streams_uni", \
2354  FT_UINT64, BASE_DEC, NULL, 0x00, \
2355  "Initial maximum number of application-owned unidirectional streams", HFILL } \
2356  }, \
2357  { & name .hf.hs_ext_quictp_parameter_ack_delay_exponent, \
2358  { "ack_delay_exponent", prefix ".quic.parameter.ack_delay_exponent", \
2359  FT_UINT64, BASE_DEC, NULL, 0x00, \
2360  "Indicating an exponent used to decode the ACK Delay field in the ACK frame,", HFILL } \
2361  }, \
2362  { & name .hf.hs_ext_quictp_parameter_max_ack_delay, \
2363  { "max_ack_delay", prefix ".quic.parameter.max_ack_delay", \
2364  FT_UINT64, BASE_DEC, NULL, 0x00, \
2365  "Indicating the maximum amount of time in milliseconds by which it will delay sending of acknowledgments", HFILL } \
2366  }, \
2367  { & name .hf.hs_ext_quictp_parameter_pa_ipv4address, \
2368  { "ipv4Address", prefix ".quic.parameter.preferred_address.ipv4address", \
2369  FT_IPv4, BASE_NONE, NULL, 0x00, \
2370  NULL, HFILL } \
2371  }, \
2372  { & name .hf.hs_ext_quictp_parameter_pa_ipv6address, \
2373  { "ipv6Address", prefix ".quic.parameter.preferred_address.ipv6address", \
2374  FT_IPv6, BASE_NONE, NULL, 0x00, \
2375  NULL, HFILL } \
2376  }, \
2377  { & name .hf.hs_ext_quictp_parameter_pa_ipv4port, \
2378  { "ipv4Port", prefix ".quic.parameter.preferred_address.ipv4port", \
2379  FT_UINT16, BASE_DEC, NULL, 0x00, \
2380  NULL, HFILL } \
2381  }, \
2382  { & name .hf.hs_ext_quictp_parameter_pa_ipv6port, \
2383  { "ipv6Port", prefix ".quic.parameter.preferred_address.ipv6port", \
2384  FT_UINT16, BASE_DEC, NULL, 0x00, \
2385  NULL, HFILL } \
2386  }, \
2387  { & name .hf.hs_ext_quictp_parameter_pa_connectionid_length, \
2388  { "Length", prefix ".quic.parameter.preferred_address.connectionid.length", \
2389  FT_UINT8, BASE_DEC, NULL, 0x00, \
2390  "Length of connectionId Field", HFILL } \
2391  }, \
2392  { & name .hf.hs_ext_quictp_parameter_pa_connectionid, \
2393  { "connectionId", prefix ".quic.parameter.preferred_address.connectionid", \
2394  FT_BYTES, BASE_NONE, NULL, 0x00, \
2395  NULL, HFILL } \
2396  }, \
2397  { & name .hf.hs_ext_quictp_parameter_pa_statelessresettoken, \
2398  { "statelessResetToken", prefix ".quic.parameter.preferred_address.statelessresettoken", \
2399  FT_BYTES, BASE_NONE, NULL, 0x00, \
2400  NULL, HFILL } \
2401  }, \
2402  { & name .hf.hs_ext_quictp_parameter_active_connection_id_limit, \
2403  { "Active Connection ID Limit", prefix ".quic.parameter.active_connection_id_limit", \
2404  FT_UINT64, BASE_DEC, NULL, 0x00, \
2405  NULL, HFILL } \
2406  }, \
2407  { & name .hf.hs_ext_quictp_parameter_initial_source_connection_id, \
2408  { "Initial Source Connection ID", prefix ".quic.parameter.initial_source_connection_id", \
2409  FT_BYTES, BASE_NONE, NULL, 0x00, \
2410  NULL, HFILL } \
2411  }, \
2412  { & name .hf.hs_ext_quictp_parameter_retry_source_connection_id, \
2413  { "Retry Source Connection ID", prefix ".quic.parameter.retry_source_connection_id", \
2414  FT_BYTES, BASE_NONE, NULL, 0x00, \
2415  NULL, HFILL } \
2416  }, \
2417  { & name .hf.hs_ext_quictp_parameter_max_datagram_frame_size, \
2418  { "max_datagram_frame_size", prefix ".quic.parameter.max_datagram_frame_size", \
2419  FT_UINT64, BASE_DEC, NULL, 0x00, \
2420  NULL, HFILL } \
2421  }, \
2422  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_length, \
2423  { "length", prefix ".quic.parameter.cibir_encoding.length", \
2424  FT_UINT64, BASE_DEC, NULL, 0x00, \
2425  NULL, HFILL } \
2426  }, \
2427  { & name .hf.hs_ext_quictp_parameter_cibir_encoding_offset, \
2428  { "offset", prefix ".quic.parameter.cibir_encoding.offset", \
2429  FT_UINT64, BASE_DEC, NULL, 0x00, \
2430  NULL, HFILL } \
2431  }, \
2432  { & name .hf.hs_ext_quictp_parameter_loss_bits, \
2433  { "loss_bits", prefix ".quic.parameter.loss_bits", \
2434  FT_UINT64, BASE_DEC, NULL, 0x00, \
2435  NULL, HFILL } \
2436  }, \
2437  { & name .hf.hs_ext_quictp_parameter_enable_time_stamp_v2, \
2438  { "Enable TimestampV2", prefix ".quic.parameter.enable_time_stamp_v2", \
2439  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_time_stamp_v2_vals), 0x00, \
2440  NULL, HFILL } \
2441  }, \
2442  { & name .hf.hs_ext_quictp_parameter_min_ack_delay, \
2443  { "min_ack_delay", prefix ".quic.parameter.min_ack_delay", \
2444  FT_UINT64, BASE_DEC, NULL, 0x00, \
2445  NULL, HFILL } \
2446  }, \
2447  { & name .hf.hs_ext_quictp_parameter_google_user_agent_id, \
2448  { "Google UserAgent", prefix ".quic.parameter.google.user_agent", \
2449  FT_STRING, BASE_NONE, NULL, 0x00, \
2450  NULL, HFILL } \
2451  }, \
2452  { & name .hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported, \
2453  { "Google Key Update not yet supported", prefix ".quic.parameter.google.key_update_not_yet_supported", \
2454  FT_NONE, BASE_NONE, NULL, 0x00, \
2455  NULL, HFILL } \
2456  }, \
2457  { & name .hf.hs_ext_quictp_parameter_google_quic_version, \
2458  { "Google QUIC version", prefix ".quic.parameter.google.quic_version", \
2459  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2460  NULL, HFILL } \
2461  }, \
2462  { & name .hf.hs_ext_quictp_parameter_google_initial_rtt, \
2463  { "Google Initial RTT", prefix ".quic.parameter.google.initial_rtt", \
2464  FT_UINT64, BASE_DEC, NULL, 0x00, \
2465  NULL, HFILL } \
2466  }, \
2467  { & name .hf.hs_ext_quictp_parameter_google_support_handshake_done, \
2468  { "Google Support Handshake Done", prefix ".quic.parameter.google.support_handshake_done", \
2469  FT_NONE, BASE_NONE, NULL, 0x00, \
2470  NULL, HFILL } \
2471  }, \
2472  { & name .hf.hs_ext_quictp_parameter_google_quic_params, \
2473  { "Google QUIC parameters", prefix ".quic.parameter.google.quic_params", \
2474  FT_BYTES, BASE_NONE, NULL, 0x00, \
2475  NULL, HFILL } \
2476  }, \
2477  { & name .hf.hs_ext_quictp_parameter_google_quic_params_unknown_field, \
2478  { "Google Unknown Field", prefix ".quic.parameter.google.quic_params_unknown_field", \
2479  FT_BYTES, BASE_NONE, NULL, 0x00, \
2480  NULL, HFILL } \
2481  }, \
2482  { & name .hf.hs_ext_quictp_parameter_google_connection_options, \
2483  { "Google Connection options", prefix ".quic.parameter.google.connection_options", \
2484  FT_BYTES, BASE_NONE, NULL, 0x00, \
2485  NULL, HFILL } \
2486  }, \
2487  { & name .hf.hs_ext_quictp_parameter_google_supported_versions_length, \
2488  { "Google Supported Versions Length", prefix ".quic.parameter.google.supported_versions_length", \
2489  FT_UINT8, BASE_DEC, NULL, 0x00, \
2490  NULL, HFILL } \
2491  }, \
2492  { & name .hf.hs_ext_quictp_parameter_google_supported_version, \
2493  { "Google Supported Version", prefix ".quic.parameter.google.supported_version", \
2494  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2495  NULL, HFILL } \
2496  }, \
2497  { & name .hf.hs_ext_quictp_parameter_facebook_partial_reliability, \
2498  { "Facebook Partial Reliability", prefix ".quic.parameter.facebook.partial_reliability", \
2499  FT_UINT64, BASE_DEC, NULL, 0x00, \
2500  NULL, HFILL } \
2501  }, \
2502  { & name .hf.hs_ext_quictp_parameter_chosen_version, \
2503  { "Chosen Version", prefix ".quic.parameter.vi.chosen_version", \
2504  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2505  NULL, HFILL } \
2506  }, \
2507  { & name .hf.hs_ext_quictp_parameter_other_version, \
2508  { "Other Version", prefix ".quic.parameter.vi.other_version", \
2509  FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2510  NULL, HFILL } \
2511  }, \
2512  { & name .hf.hs_ext_quictp_parameter_enable_multipath, \
2513  { "Enable Multipath", prefix ".quic.parameter.enable_multipath", \
2514  FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_multipath_vals), 0x00, \
2515  NULL, HFILL } \
2516  }, \
2517  { & name .hf.hs_ext_quictp_parameter_initial_max_paths, \
2518  { "Initial Max Paths", prefix ".quic.parameter.initial_max_paths", \
2519  FT_UINT64, BASE_DEC, NULL, 0x00, \
2520  NULL, HFILL } \
2521  }, \
2522  { & name .hf.hs_ext_connection_id_length, \
2523  { "Connection ID length", prefix ".connection_id_length", \
2524  FT_UINT8, BASE_DEC, NULL, 0x00, \
2525  NULL, HFILL } \
2526  }, \
2527  { & name .hf.hs_ext_connection_id, \
2528  { "Connection ID", prefix ".connection_id", \
2529  FT_BYTES, BASE_NONE, NULL, 0x00, \
2530  NULL, HFILL } \
2531  }, \
2532  { & name .hf.esni_suite, \
2533  { "Cipher Suite", prefix ".esni.suite", \
2534  FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2535  "Cipher suite used to encrypt the SNI", HFILL } \
2536  }, \
2537  { & name .hf.esni_record_digest_length, \
2538  { "Record Digest Length", prefix ".esni.record_digest_length", \
2539  FT_UINT16, BASE_DEC, NULL, 0x00, \
2540  NULL, HFILL } \
2541  }, \
2542  { & name .hf.esni_record_digest, \
2543  { "Record Digest", prefix ".esni.record_digest", \
2544  FT_BYTES, BASE_NONE, NULL, 0x00, \
2545  "Cryptographic hash of the ESNIKeys from which the ESNI key was obtained", HFILL } \
2546  }, \
2547  { & name .hf.esni_encrypted_sni_length, \
2548  { "Encrypted SNI Length", prefix ".esni.encrypted_sni_length", \
2549  FT_UINT16, BASE_DEC, NULL, 0x00, \
2550  NULL, HFILL } \
2551  }, \
2552  { & name .hf.esni_encrypted_sni, \
2553  { "Encrypted SNI", prefix ".esni.encrypted_sni", \
2554  FT_BYTES, BASE_NONE, NULL, 0x00, \
2555  "The encrypted ClientESNIInner structure", HFILL } \
2556  }, \
2557  { & name .hf.esni_nonce, \
2558  { "Nonce", prefix ".esni.nonce", \
2559  FT_BYTES, BASE_NONE, NULL, 0x00, \
2560  "Contents of ClientESNIInner.nonce", HFILL } \
2561  }, \
2562  { & name .hf.ech_echconfiglist_length, \
2563  { "ECHConfigList length", prefix ".ech.echconfiglist_length", \
2564  FT_UINT16, BASE_DEC, NULL, 0x0, \
2565  "Encrypted ClientHello (ECH) Configurations length", HFILL } \
2566  }, \
2567  { & name .hf.ech_echconfiglist, \
2568  { "ECHConfigList", prefix ".ech.echconfiglist", \
2569  FT_NONE, BASE_NONE, NULL, 0x0, \
2570  "Encrypted ClientHello (ECH) Configurations", HFILL } \
2571  }, \
2572  { & name .hf.ech_echconfig, \
2573  { "ECHConfig", prefix ".ech.echconfig", \
2574  FT_NONE, BASE_NONE, NULL, 0x0, \
2575  "Encrypted ClientHello (ECH) Configuration", HFILL } \
2576  }, \
2577  { & name .hf.ech_echconfig_version, \
2578  { "Version", prefix ".ech.echconfig.version", \
2579  FT_UINT16, BASE_HEX, NULL, 0x0, \
2580  "Encrypted ClientHello: ECHConfig version", HFILL } \
2581  }, \
2582  { & name .hf.ech_echconfig_length, \
2583  { "Length", prefix ".ech.echconfig.length", \
2584  FT_UINT16, BASE_DEC, NULL, 0x0, \
2585  "Encrypted ClientHello: ECHConfig length", HFILL } \
2586  }, \
2587  { & name .hf.ech_echconfigcontents_maximum_name_length, \
2588  { "Maximum Name Length", prefix ".ech.echconfigcontents.maximum_name_length", \
2589  FT_UINT8, BASE_DEC, NULL, 0x0, \
2590  "The longest name of a backend server, if known", HFILL } \
2591  }, \
2592  { & name .hf.ech_echconfigcontents_public_name_length, \
2593  { "Public Name length", prefix ".ech.echconfigcontents.public_name_length", \
2594  FT_UINT8, BASE_DEC, NULL, 0x0, \
2595  "Length of the Public Name field", HFILL } \
2596  }, \
2597  { & name .hf.ech_echconfigcontents_public_name, \
2598  { "Public Name", prefix ".ech.echconfigcontents.public_name", \
2599  FT_STRING, BASE_NONE, NULL, 0x0, \
2600  "The DNS name of the client-facing server, i.e., the entity trusted to update the ECH configuration", HFILL } \
2601  }, \
2602  { & name .hf.ech_echconfigcontents_extensions_length, \
2603  { "Extensions length", prefix ".ech.echconfigcontents.extensions_length", \
2604  FT_UINT16, BASE_DEC, NULL, 0x0, \
2605  "Length of the Extensions field", HFILL } \
2606  }, \
2607  { & name .hf.ech_echconfigcontents_extensions, \
2608  { "Extensions", prefix ".ech.echconfigcontents.extensions", \
2609  FT_BYTES, BASE_NONE, NULL, 0x0, \
2610  "A list of extensions that the client must take into consideration when generating a ClientHello message", HFILL } \
2611  }, \
2612  { & name .hf.ech_hpke_keyconfig, \
2613  { "HKPE Key Config", prefix ".ech.hpke.keyconfig", \
2614  FT_NONE, BASE_NONE, NULL, 0x0, \
2615  "HPKE Key Config", HFILL } \
2616  }, \
2617  { & name .hf.ech_hpke_keyconfig_config_id, \
2618  { "Config Id", prefix ".ech.hpke.keyconfig.config_id", \
2619  FT_UINT8, BASE_DEC, NULL, 0x0, \
2620  "HPKE Config Id", HFILL } \
2621  }, \
2622  { & name .hf.ech_hpke_keyconfig_kem_id, \
2623  { "KEM Id", prefix ".ech.hpke.keyconfig.kem_id", \
2624  FT_UINT16, BASE_DEC, VALS(kem_id_type_vals), 0x0, \
2625  "HPKE KEM Id", HFILL } \
2626  }, \
2627  { & name .hf.ech_hpke_keyconfig_public_key_length, \
2628  { "Public Key length", prefix ".ech.hpke.keyconfig.public_key_length", \
2629  FT_UINT16, BASE_DEC, NULL, 0x0, \
2630  "HPKE Public Key length", HFILL } \
2631  }, \
2632  { & name .hf.ech_hpke_keyconfig_public_key, \
2633  { "Public Key", prefix ".ech.hpke.keyconfig.public_key", \
2634  FT_BYTES, BASE_NONE, NULL, 0x0, \
2635  "HPKE Public Key", HFILL } \
2636  }, \
2637  { & name .hf.ech_hpke_keyconfig_cipher_suites, \
2638  { "Cipher Suites", prefix ".ech.hpke.keyconfig.cipher_suites", \
2639  FT_NONE, BASE_NONE, NULL, 0x0, \
2640  "HPKE Cipher Suites", HFILL } \
2641  }, \
2642  { & name .hf.ech_hpke_keyconfig_cipher_suites_length, \
2643  { "Cipher Suites length", prefix ".ech.hpke.keyconfig.cipher_suites_length", \
2644  FT_UINT16, BASE_DEC, NULL, 0x0, \
2645  "HPKE Cipher Suites length", HFILL } \
2646  }, \
2647  { & name .hf.ech_hpke_keyconfig_cipher_suite, \
2648  { "Cipher Suite", prefix ".ech.hpke.keyconfig.cipher_suite", \
2649  FT_NONE, BASE_NONE, NULL, 0x0, \
2650  "HPKE Cipher Suite", HFILL } \
2651  }, \
2652  { & name .hf.ech_hpke_keyconfig_cipher_suite_kdf_id, \
2653  { "KDF Id", prefix ".ech.hpke.keyconfig.cipher_suite.kdf_id", \
2654  FT_UINT16, BASE_DEC, VALS(kdf_id_type_vals), 0x0, \
2655  "HKPE KDF Id", HFILL } \
2656  }, \
2657  { & name .hf.ech_hpke_keyconfig_cipher_suite_aead_id, \
2658  { "AEAD Id", prefix ".ech.hpke.keyconfig.cipher_suite.aead_id", \
2659  FT_UINT16, BASE_DEC, VALS(aead_id_type_vals), 0x0, \
2660  "HKPE AEAD Id", HFILL } \
2661  }, \
2662  { & name .hf.ech_clienthello_type, \
2663  { "Client Hello type", prefix ".ech.client_hello_type", \
2664  FT_UINT8, BASE_DEC, VALS(tls_hello_ext_ech_clienthello_types), 0x0, \
2665  "Client Hello type", HFILL } \
2666  }, \
2667  { & name .hf.ech_cipher_suite, \
2668  { "Cipher Suite", prefix ".ech.cipher_suite", \
2669  FT_NONE, BASE_NONE, NULL, 0x0, \
2670  "The cipher suite used to encrypt ClientHelloInner", HFILL } \
2671  }, \
2672  { & name .hf.ech_config_id, \
2673  { "Config Id", prefix ".ech.config_id", \
2674  FT_UINT8, BASE_DEC, NULL, 0x0, \
2675  "The ECHConfigContents.key_config.config_id for the chosen ECHConfig", HFILL } \
2676  }, \
2677  { & name .hf.ech_enc_length, \
2678  { "Enc length", prefix ".ech.enc_length", \
2679  FT_UINT16, BASE_DEC, NULL, 0x0, \
2680  NULL, HFILL } \
2681  }, \
2682  { & name .hf.ech_enc, \
2683  { "Enc", prefix ".ech.enc", \
2684  FT_BYTES, BASE_NONE, NULL, 0x0, \
2685  "The HPKE encapsulated key, used by servers to decrypt the corresponding payload field", HFILL } \
2686  }, \
2687  { & name .hf.ech_payload_length, \
2688  { "Payload length", prefix ".ech.payload_length", \
2689  FT_UINT16, BASE_DEC, NULL, 0x0, \
2690  "Payload Length", HFILL } \
2691  }, \
2692  { & name .hf.ech_payload, \
2693  { "Payload", prefix ".ech.payload", \
2694  FT_BYTES, BASE_NONE, NULL, 0x0, \
2695  "The serialized and encrypted ClientHelloInner structure", HFILL } \
2696  }, \
2697  { & name .hf.ech_confirmation, \
2698  { "Confirmation", prefix ".ech.confirmation", \
2699  FT_BYTES, BASE_NONE, NULL, 0x0, \
2700  "Confirmation of ECH acceptance in a HelloRetryRequest", HFILL } \
2701  }, \
2702  { & name .hf.ech_retry_configs, \
2703  { "Retry Configs", prefix ".ech.retry_configs", \
2704  FT_NONE, BASE_NONE, NULL, 0x0, \
2705  "ECHConfig structures for one-time use by the client in a retry connection", HFILL } \
2706  }, \
2707  { & name .hf.hs_ext_alps_len, \
2708  { "ALPS Extension Length", prefix ".handshake.extensions_alps_len", \
2709  FT_UINT16, BASE_DEC, NULL, 0x0, \
2710  "Length of the ALPS Extension", HFILL } \
2711  }, \
2712  { & name .hf.hs_ext_alps_alpn_list, \
2713  { "Supported ALPN List", prefix ".handshake.extensions_alps_alpn_list", \
2714  FT_NONE, BASE_NONE, NULL, 0x0, \
2715  "List of supported ALPN by ALPS", HFILL } \
2716  }, \
2717  { & name .hf.hs_ext_alps_alpn_str_len, \
2718  { "Supported ALPN Length", prefix ".handshake.extensions_alps_alpn_str_len", \
2719  FT_UINT8, BASE_DEC, NULL, 0x0, \
2720  "Length of ALPN string", HFILL } \
2721  }, \
2722  { & name .hf.hs_ext_alps_alpn_str, \
2723  { "Supported ALPN", prefix ".handshake.extensions_alps_alpn_str", \
2724  FT_STRING, BASE_NONE, NULL, 0x00, \
2725  "ALPN supported by ALPS", HFILL } \
2726  }, \
2727  { & name .hf.hs_ext_alps_settings, \
2728  { "ALPN Opaque Settings", prefix ".handshake.extensions_alps.settings", \
2729  FT_BYTES, BASE_NONE, NULL, 0x00, \
2730  "ALPN Opaque Settings", HFILL } \
2731  }
2732 /* }}} */
2733 
2734 /* {{{ */
2735 #define SSL_COMMON_ETT_LIST(name) \
2736  & name .ett.hs_ext, \
2737  & name .ett.hs_ext_alpn, \
2738  & name .ett.hs_ext_cert_types, \
2739  & name .ett.hs_ext_groups, \
2740  & name .ett.hs_ext_curves_point_formats, \
2741  & name .ett.hs_ext_npn, \
2742  & name .ett.hs_ext_reneg_info, \
2743  & name .ett.hs_ext_key_share, \
2744  & name .ett.hs_ext_key_share_ks, \
2745  & name .ett.hs_ext_pre_shared_key, \
2746  & name .ett.hs_ext_psk_identity, \
2747  & name .ett.hs_ext_server_name, \
2748  & name .ett.hs_ext_oid_filter, \
2749  & name .ett.hs_ext_quictp_parameter, \
2750  & name .ett.hs_sig_hash_alg, \
2751  & name .ett.hs_sig_hash_algs, \
2752  & name .ett.urlhash, \
2753  & name .ett.keyex_params, \
2754  & name .ett.certificates, \
2755  & name .ett.cert_types, \
2756  & name .ett.dnames, \
2757  & name .ett.hs_random, \
2758  & name .ett.cipher_suites, \
2759  & name .ett.comp_methods, \
2760  & name .ett.session_ticket, \
2761  & name .ett.sct, \
2762  & name .ett.cert_status, \
2763  & name .ett.ocsp_response, \
2764  & name .ett.uncompressed_certificates, \
2765  & name .ett.hs_ext_alps, \
2766  & name .ett.ech_echconfiglist, \
2767  & name .ett.ech_echconfig, \
2768  & name .ett.ech_retry_configs, \
2769  & name .ett.ech_hpke_keyconfig, \
2770  & name .ett.ech_hpke_cipher_suites, \
2771  & name .ett.ech_hpke_cipher_suite, \
2772  & name .ett.hs_ext_token_binding_key_parameters, \
2773 
2774 /* }}} */
2775 
2776 /* {{{ */
2777 #define SSL_COMMON_EI_LIST(name, prefix) \
2778  { & name .ei.client_version_error, \
2779  { prefix ".handshake.client_version_error", PI_PROTOCOL, PI_WARN, \
2780  "Client Hello legacy version field specifies version 1.3, not version 1.2; some servers may not be able to handle that.", EXPFILL } \
2781  }, \
2782  { & name .ei.server_version_error, \
2783  { prefix ".handshake.server_version_error", PI_PROTOCOL, PI_WARN, \
2784  "Server Hello legacy version field specifies version 1.3, not version 1.2; some middleboxes may not be able to handle that.", EXPFILL } \
2785  }, \
2786  { & name .ei.legacy_version, \
2787  { prefix ".handshake.legacy_version", PI_DEPRECATED, PI_CHAT, \
2788  "This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.", EXPFILL } \
2789  }, \
2790  { & name .ei.malformed_vector_length, \
2791  { prefix ".malformed.vector_length", PI_PROTOCOL, PI_WARN, \
2792  "Variable vector length is outside the permitted range", EXPFILL } \
2793  }, \
2794  { & name .ei.malformed_buffer_too_small, \
2795  { prefix ".malformed.buffer_too_small", PI_MALFORMED, PI_ERROR, \
2796  "Malformed message, not enough data is available", EXPFILL } \
2797  }, \
2798  { & name .ei.malformed_trailing_data, \
2799  { prefix ".malformed.trailing_data", PI_PROTOCOL, PI_WARN, \
2800  "Undecoded trailing data is present", EXPFILL } \
2801  }, \
2802  { & name .ei.hs_ext_cert_status_undecoded, \
2803  { prefix ".handshake.status_request.undecoded", PI_UNDECODED, PI_NOTE, \
2804  "Responder ID list or Request Extensions are not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2805  }, \
2806  { & name .ei.hs_ciphersuite_undecoded, \
2807  { prefix ".handshake.ciphersuite.undecoded", PI_UNDECODED, PI_NOTE, \
2808  "Ciphersuite not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2809  }, \
2810  { & name .ei.hs_srv_keyex_illegal, \
2811  { prefix ".handshake.server_keyex_illegal", PI_PROTOCOL, PI_WARN, \
2812  "It is not legal to send the ServerKeyExchange message for this ciphersuite", EXPFILL } \
2813  }, \
2814  { & name .ei.resumed, \
2815  { prefix ".resumed", PI_SEQUENCE, PI_NOTE, \
2816  "This session reuses previously negotiated keys (Session resumption)", EXPFILL } \
2817  }, \
2818  { & name .ei.record_length_invalid, \
2819  { prefix ".record.length.invalid", PI_PROTOCOL, PI_ERROR, \
2820  "Record fragment length is too small or too large", EXPFILL } \
2821  }, \
2822  { & name .ei.decompression_error, \
2823  { prefix ".decompression_error", PI_PROTOCOL, PI_ERROR, \
2824  "Decompression error", EXPFILL } \
2825  }, \
2826  { & name .ei.ech_echconfig_invalid_version, \
2827  { prefix ".ech_echconfig_invalid_version", PI_PROTOCOL, PI_ERROR, \
2828  "Invalid/unknown ECHConfig version", EXPFILL } \
2829  }
2830 /* }}} */
2831 
2832 extern void
2833 ssl_common_register_ssl_alpn_dissector_table(const char *name,
2834  const char *ui_name, const int proto);
2835 
2836 extern void
2837 ssl_common_register_dtls_alpn_dissector_table(const char *name,
2838  const char *ui_name, const int proto);
2839 
2840 extern void
2841 ssl_common_register_options(module_t *module, ssl_common_options_t *options, gboolean is_dtls);
2842 
2843 #ifdef SSL_DECRYPT_DEBUG
2844 extern void
2845 ssl_debug_printf(const gchar* fmt,...) G_GNUC_PRINTF(1,2);
2846 extern void
2847 ssl_print_data(const gchar* name, const guchar* data, size_t len);
2848 extern void
2849 ssl_print_string(const gchar* name, const StringInfo* data);
2850 extern void
2851 ssl_set_debug(const gchar* name);
2852 extern void
2853 ssl_debug_flush(void);
2854 #else
2855 
2856 /* No debug: nullify debug operation*/
2857 static inline void G_GNUC_PRINTF(1,2)
2858 ssl_debug_printf(const gchar* fmt _U_,...)
2859 {
2860 }
2861 #define ssl_print_data(a, b, c)
2862 #define ssl_print_string(a, b)
2863 #define ssl_set_debug(name)
2864 #define ssl_debug_flush()
2865 
2866 #endif /* SSL_DECRYPT_DEBUG */
2867 
2868 
2869 guint32
2870 ssl_dissect_ext_ech_echconfiglist(ssl_common_dissect_t *hf, tvbuff_t *tvb, packet_info *pinfo,
2871  proto_tree *tree, guint32 offset, guint32 offset_end);
2872 
2873 #endif /* __PACKET_TLS_UTILS_H__ */
2874 
2875 /*
2876  * Editor modelines - https://www.wireshark.org/tools/modelines.html
2877  *
2878  * Local variables:
2879  * c-basic-offset: 4
2880  * tab-width: 8
2881  * indent-tabs-mode: nil
2882  * End:
2883  *
2884  * vi: set shiftwidth=4 tabstop=8 expandtab:
2885  * :indentSize=4:tabSize=8:noTabs=true:
2886  */
Definition: packet-tls-utils.h:331
Definition: packet-tls-utils.h:347
StringInfo dtls13_aad
Definition: packet-tls-utils.h:358
StringInfo app_traffic_secret
Definition: packet-tls-utils.h:361
guint64 seq
Definition: packet-tls-utils.h:357
Definition: packet-tls-utils.c:2547
Definition: packet-tls-utils.h:511
Definition: packet-tls-utils.h:339
Definition: packet-tls-utils.h:423
SslFlow * flow
Definition: packet-tls-utils.h:429
guint32 seq
Definition: packet-tls-utils.h:431
gint id
Definition: packet-tls-utils.h:426
guint data_len
Definition: packet-tls-utils.h:425
guchar * plain_data
Definition: packet-tls-utils.h:424
ContentType type
Definition: packet-tls-utils.h:428
Definition: packet-tls-utils.h:459
Definition: packet-tls-utils.h:256
Definition: packet-tls-utils.h:440
guint record_id
Definition: packet-tls-utils.h:441
int is_last
Definition: packet-tls-utils.h:446
guint32 offset
Definition: packet-tls-utils.h:444
guint8 type
Definition: packet-tls-utils.h:445
guint reassembly_id
Definition: packet-tls-utils.h:443
Definition: address.h:56
Definition: packet_info.h:44
Definition: proto.h:904
Definition: value_string.h:293
Definition: packet-tls-utils.h:552
Definition: value_string.h:133
Definition: value_string.h:170
Definition: value_string.h:26
Definition: wmem_list.c:23
Definition: wmem_strbuf.h:42
Definition: wmem_tree-int.h:48
Definition: packet-tls-utils.h:418
Definition: packet-tls-utils.h:450
Definition: packet-tls-utils.h:546
Definition: conversation.h:220
Definition: packet.c:763
Definition: packet.c:86
Definition: packet-tls-utils.h:1200
Definition: expert.h:39
Definition: packet-tls-utils.h:1215
Definition: prefs-int.h:27
Definition: packet-tls-utils.h:848
Definition: packet-tls-utils.h:560
Definition: packet-tls-utils.h:1208
Definition: packet-tls-utils.h:566
Definition: tvbuff-int.h:35