12#ifndef __PACKET_TLS_UTILS_H__
13#define __PACKET_TLS_UTILS_H__
27#include <gnutls/x509.h>
28#include <gnutls/pkcs12.h>
32#define SSL_CIPHER_CTX gcry_cipher_hd_t
33#define SSL_DECRYPT_DEBUG
38 SSL_ID_CHG_CIPHER_SPEC = 0x14,
40 SSL_ID_HANDSHAKE = 0x16,
41 SSL_ID_APP_DATA = 0x17,
42 SSL_ID_HEARTBEAT = 0x18,
43 SSL_ID_TLS12_CID = 0x19,
44 SSL_ID_DTLS13_ACK = 0x1A,
48 SSL_HND_HELLO_REQUEST = 0,
49 SSL_HND_CLIENT_HELLO = 1,
50 SSL_HND_SERVER_HELLO = 2,
51 SSL_HND_HELLO_VERIFY_REQUEST = 3,
52 SSL_HND_NEWSESSION_TICKET = 4,
53 SSL_HND_END_OF_EARLY_DATA = 5,
54 SSL_HND_HELLO_RETRY_REQUEST = 6,
55 SSL_HND_ENCRYPTED_EXTENSIONS = 8,
56 SSL_HND_CERTIFICATE = 11,
57 SSL_HND_SERVER_KEY_EXCHG = 12,
58 SSL_HND_CERT_REQUEST = 13,
59 SSL_HND_SVR_HELLO_DONE = 14,
60 SSL_HND_CERT_VERIFY = 15,
61 SSL_HND_CLIENT_KEY_EXCHG = 16,
62 SSL_HND_FINISHED = 20,
63 SSL_HND_CERT_URL = 21,
64 SSL_HND_CERT_STATUS = 22,
65 SSL_HND_SUPPLEMENTAL_DATA = 23,
66 SSL_HND_KEY_UPDATE = 24,
67 SSL_HND_COMPRESSED_CERTIFICATE = 25,
70 SSL_HND_ENCRYPTED_EXTS = 67,
71 SSL_HND_MESSAGE_HASH = 254
74#define SSL2_HND_ERROR 0x00
75#define SSL2_HND_CLIENT_HELLO 0x01
76#define SSL2_HND_CLIENT_MASTER_KEY 0x02
77#define SSL2_HND_CLIENT_FINISHED 0x03
78#define SSL2_HND_SERVER_HELLO 0x04
79#define SSL2_HND_SERVER_VERIFY 0x05
80#define SSL2_HND_SERVER_FINISHED 0x06
81#define SSL2_HND_REQUEST_CERTIFICATE 0x07
82#define SSL2_HND_CLIENT_CERTIFICATE 0x08
84#define SSL_HND_HELLO_EXT_SERVER_NAME 0
85#define SSL_HND_HELLO_EXT_MAX_FRAGMENT_LENGTH 1
86#define SSL_HND_HELLO_EXT_CLIENT_CERTIFICATE_URL 2
87#define SSL_HND_HELLO_EXT_TRUSTED_CA_KEYS 3
88#define SSL_HND_HELLO_EXT_TRUNCATED_HMAC 4
89#define SSL_HND_HELLO_EXT_STATUS_REQUEST 5
90#define SSL_HND_HELLO_EXT_USER_MAPPING 6
91#define SSL_HND_HELLO_EXT_CLIENT_AUTHZ 7
92#define SSL_HND_HELLO_EXT_SERVER_AUTHZ 8
93#define SSL_HND_HELLO_EXT_CERT_TYPE 9
94#define SSL_HND_HELLO_EXT_SUPPORTED_GROUPS 10
95#define SSL_HND_HELLO_EXT_EC_POINT_FORMATS 11
96#define SSL_HND_HELLO_EXT_SRP 12
97#define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS 13
98#define SSL_HND_HELLO_EXT_USE_SRTP 14
99#define SSL_HND_HELLO_EXT_HEARTBEAT 15
100#define SSL_HND_HELLO_EXT_ALPN 16
101#define SSL_HND_HELLO_EXT_STATUS_REQUEST_V2 17
102#define SSL_HND_HELLO_EXT_SIGNED_CERTIFICATE_TIMESTAMP 18
103#define SSL_HND_HELLO_EXT_CLIENT_CERT_TYPE 19
104#define SSL_HND_HELLO_EXT_SERVER_CERT_TYPE 20
105#define SSL_HND_HELLO_EXT_PADDING 21
106#define SSL_HND_HELLO_EXT_ENCRYPT_THEN_MAC 22
107#define SSL_HND_HELLO_EXT_EXTENDED_MASTER_SECRET 23
108#define SSL_HND_HELLO_EXT_TOKEN_BINDING 24
109#define SSL_HND_HELLO_EXT_CACHED_INFO 25
110#define SSL_HND_HELLO_EXT_COMPRESS_CERTIFICATE 27
111#define SSL_HND_HELLO_EXT_RECORD_SIZE_LIMIT 28
113#define SSL_HND_HELLO_EXT_DELEGATED_CREDENTIALS 34
114#define SSL_HND_HELLO_EXT_SESSION_TICKET_TLS 35
116#define SSL_HND_HELLO_EXT_KEY_SHARE_OLD 40
117#define SSL_HND_HELLO_EXT_PRE_SHARED_KEY 41
118#define SSL_HND_HELLO_EXT_EARLY_DATA 42
119#define SSL_HND_HELLO_EXT_SUPPORTED_VERSIONS 43
120#define SSL_HND_HELLO_EXT_COOKIE 44
121#define SSL_HND_HELLO_EXT_PSK_KEY_EXCHANGE_MODES 45
122#define SSL_HND_HELLO_EXT_TICKET_EARLY_DATA_INFO 46
123#define SSL_HND_HELLO_EXT_CERTIFICATE_AUTHORITIES 47
124#define SSL_HND_HELLO_EXT_OID_FILTERS 48
125#define SSL_HND_HELLO_EXT_POST_HANDSHAKE_AUTH 49
126#define SSL_HND_HELLO_EXT_SIGNATURE_ALGORITHMS_CERT 50
127#define SSL_HND_HELLO_EXT_KEY_SHARE 51
128#define SSL_HND_HELLO_EXT_TRANSPARENCY_INFO 52
129#define SSL_HND_HELLO_EXT_CONNECTION_ID_DEPRECATED 53
130#define SSL_HND_HELLO_EXT_CONNECTION_ID 54
131#define SSL_HND_HELLO_EXT_EXTERNAL_ID_HASH 55
132#define SSL_HND_HELLO_EXT_EXTERNAL_SESSION_ID 56
133#define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS_V1 57
134#define SSL_HND_HELLO_EXT_TICKET_REQUEST 58
135#define SSL_HND_HELLO_EXT_DNSSEC_CHAIN 59
136#define SSL_HND_HELLO_EXT_GREASE_0A0A 2570
137#define SSL_HND_HELLO_EXT_GREASE_1A1A 6682
138#define SSL_HND_HELLO_EXT_GREASE_2A2A 10794
139#define SSL_HND_HELLO_EXT_NPN 13172
140#define SSL_HND_HELLO_EXT_GREASE_3A3A 14906
141#define SSL_HND_HELLO_EXT_ALPS_OLD 17513
142#define SSL_HND_HELLO_EXT_ALPS 17613
143#define SSL_HND_HELLO_EXT_GREASE_4A4A 19018
144#define SSL_HND_HELLO_EXT_GREASE_5A5A 23130
145#define SSL_HND_HELLO_EXT_GREASE_6A6A 27242
146#define SSL_HND_HELLO_EXT_CHANNEL_ID_OLD 30031
147#define SSL_HND_HELLO_EXT_CHANNEL_ID 30032
148#define SSL_HND_HELLO_EXT_GREASE_7A7A 31354
149#define SSL_HND_HELLO_EXT_GREASE_8A8A 35466
150#define SSL_HND_HELLO_EXT_GREASE_9A9A 39578
151#define SSL_HND_HELLO_EXT_GREASE_AAAA 43690
152#define SSL_HND_HELLO_EXT_GREASE_BABA 47802
153#define SSL_HND_HELLO_EXT_GREASE_CACA 51914
154#define SSL_HND_HELLO_EXT_GREASE_DADA 56026
155#define SSL_HND_HELLO_EXT_GREASE_EAEA 60138
156#define SSL_HND_HELLO_EXT_GREASE_FAFA 64250
157#define SSL_HND_HELLO_EXT_ECH_OUTER_EXTENSIONS 64768
158#define SSL_HND_HELLO_EXT_ENCRYPTED_CLIENT_HELLO 65037
159#define SSL_HND_HELLO_EXT_RENEGOTIATION_INFO 65281
160#define SSL_HND_HELLO_EXT_QUIC_TRANSPORT_PARAMETERS 65445
161#define SSL_HND_HELLO_EXT_ENCRYPTED_SERVER_NAME 65486
163#define SSL_HND_CERT_URL_TYPE_INDIVIDUAL_CERT 1
164#define SSL_HND_CERT_URL_TYPE_PKIPATH 2
165#define SSL_HND_CERT_STATUS_TYPE_OCSP 1
166#define SSL_HND_CERT_STATUS_TYPE_OCSP_MULTI 2
167#define SSL_HND_CERT_TYPE_RAW_PUBLIC_KEY 2
170#define SSL_HND_QUIC_TP_ORIGINAL_DESTINATION_CONNECTION_ID 0x00
171#define SSL_HND_QUIC_TP_MAX_IDLE_TIMEOUT 0x01
172#define SSL_HND_QUIC_TP_STATELESS_RESET_TOKEN 0x02
173#define SSL_HND_QUIC_TP_MAX_UDP_PAYLOAD_SIZE 0x03
174#define SSL_HND_QUIC_TP_INITIAL_MAX_DATA 0x04
175#define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL 0x05
176#define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE 0x06
177#define SSL_HND_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI 0x07
178#define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_BIDI 0x08
179#define SSL_HND_QUIC_TP_INITIAL_MAX_STREAMS_UNI 0x09
180#define SSL_HND_QUIC_TP_ACK_DELAY_EXPONENT 0x0a
181#define SSL_HND_QUIC_TP_MAX_ACK_DELAY 0x0b
182#define SSL_HND_QUIC_TP_DISABLE_ACTIVE_MIGRATION 0x0c
183#define SSL_HND_QUIC_TP_PREFERRED_ADDRESS 0x0d
184#define SSL_HND_QUIC_TP_ACTIVE_CONNECTION_ID_LIMIT 0x0e
185#define SSL_HND_QUIC_TP_INITIAL_SOURCE_CONNECTION_ID 0x0f
186#define SSL_HND_QUIC_TP_RETRY_SOURCE_CONNECTION_ID 0x10
187#define SSL_HND_QUIC_TP_VERSION_INFORMATION 0x11
188#define SSL_HND_QUIC_TP_MAX_DATAGRAM_FRAME_SIZE 0x20
189#define SSL_HND_QUIC_TP_CIBIR_ENCODING 0x1000
190#define SSL_HND_QUIC_TP_LOSS_BITS 0x1057
191#define SSL_HND_QUIC_TP_GREASE_QUIC_BIT 0x2ab2
192#define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP 0x7157
193#define SSL_HND_QUIC_TP_ENABLE_TIME_STAMP_V2 0x7158
194#define SSL_HND_QUIC_TP_MIN_ACK_DELAY_OLD 0xde1a
196#define SSL_HND_QUIC_TP_GOOGLE_USER_AGENT 0x3129
197#define SSL_HND_QUIC_TP_GOOGLE_KEY_UPDATE_NOT_YET_SUPPORTED 0x312B
198#define SSL_HND_QUIC_TP_GOOGLE_QUIC_VERSION 0x4752
199#define SSL_HND_QUIC_TP_GOOGLE_INITIAL_RTT 0x3127
200#define SSL_HND_QUIC_TP_GOOGLE_SUPPORT_HANDSHAKE_DONE 0x312A
201#define SSL_HND_QUIC_TP_GOOGLE_QUIC_PARAMS 0x4751
202#define SSL_HND_QUIC_TP_GOOGLE_CONNECTION_OPTIONS 0x3128
204#define SSL_HND_QUIC_TP_FACEBOOK_PARTIAL_RELIABILITY 0xFF00
205#define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT_V1 0xFF03DE1A
206#define SSL_HND_QUIC_TP_MIN_ACK_DELAY_DRAFT05 0xff04de1a
207#define SSL_HND_QUIC_TP_MIN_ACK_DELAY 0xff04de1b
208#define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT04 0x0f739bbc1b666d04
209#define SSL_HND_QUIC_TP_ENABLE_MULTIPATH_DRAFT05 0x0f739bbc1b666d05
210#define SSL_HND_QUIC_TP_ENABLE_MULTIPATH 0x0f739bbc1b666d06
211#define SSL_HND_QUIC_TP_INITIAL_MAX_PATHS 0x0f739bbc1b666d07
212#define SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT09 0x0f739bbc1b666d09
213#define SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT11 0x0f739bbc1b666d11
214#define SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID_DRAFT12 0x0f739bbc1b666d0c
215#define SSL_HND_QUIC_TP_INITIAL_MAX_PATH_ID 0x0f739bbc1b666d0d
233extern const value_string ssl_31_key_exchange_algorithm[];
235extern const value_string ssl_31_client_certificate_type[];
236extern const value_string ssl_31_public_value_encoding[];
246extern const value_string ssl_extension_ec_point_formats[];
248extern const value_string tls_hello_ext_server_name_type_vs[];
249extern const value_string tls_hello_ext_max_fragment_length[];
251extern const value_string tls_hello_ext_trusted_ca_key_type[];
253extern const value_string compress_certificate_algorithm_vals[];
256extern const val64_string quic_enable_time_stamp_v2_vals[];
258extern const value_string tls_hello_ext_ech_clienthello_types[];
262extern const value_string token_binding_key_parameter_vals[];
270#define SSL_WRITE_KEY 1
272#define SSL_VER_UNKNOWN 0
273#define SSLV2_VERSION 0x0002
275#define SSLV3_VERSION 0x300
276#define TLSV1_VERSION 0x301
277#define TLCPV1_VERSION 0x101
278#define TLSV1DOT1_VERSION 0x302
279#define TLSV1DOT2_VERSION 0x303
280#define TLSV1DOT3_VERSION 0x304
281#define DTLSV1DOT0_VERSION 0xfeff
282#define DTLSV1DOT0_OPENSSL_VERSION 0x100
283#define DTLSV1DOT2_VERSION 0xfefd
284#define DTLSV1DOT3_VERSION 0xfefc
287static inline uint8_t extract_tls13_draft_version(uint32_t version) {
288 if ((version & 0xff00) == 0x7f00) {
289 return (uint8_t) version;
295#define SSL_CLIENT_RANDOM (1<<0)
296#define SSL_SERVER_RANDOM (1<<1)
297#define SSL_CIPHER (1<<2)
298#define SSL_HAVE_SESSION_KEY (1<<3)
299#define SSL_VERSION (1<<4)
300#define SSL_MASTER_SECRET (1<<5)
301#define SSL_PRE_MASTER_SECRET (1<<6)
302#define SSL_CLIENT_EXTENDED_MASTER_SECRET (1<<7)
303#define SSL_SERVER_EXTENDED_MASTER_SECRET (1<<8)
304#define SSL_NEW_SESSION_TICKET (1<<10)
305#define SSL_ENCRYPT_THEN_MAC (1<<11)
306#define SSL_SEEN_0RTT_APPDATA (1<<12)
307#define SSL_QUIC_RECORD_LAYER (1<<13)
309#define SSL_EXTENDED_MASTER_SECRET_MASK (SSL_CLIENT_EXTENDED_MASTER_SECRET|SSL_SERVER_EXTENDED_MASTER_SECRET)
323#define IMPLICIT_NONCE_LEN 4
324#define EXPLICIT_NONCE_LEN 8
325#define TLS13_AEAD_NONCE_LENGTH 12
330 TLS_SECRET_HANDSHAKE,
334#define SSL_DEBUG_USE_STDERR "-"
336#define SSLV2_MAX_SESSION_ID_LENGTH_IN_BYTES 16
339#define TLS_MAX_RECORD_LENGTH 0x4000
346 ssl_cipher_mode_t mode;
360 unsigned char _mac_key_or_write_iv[48];
363 SSL_CIPHER_CTX sn_evp;
366 uint64_t dtls13_epoch;
374#define KEX_DHE_DSS 0x10
375#define KEX_DHE_PSK 0x11
376#define KEX_DHE_RSA 0x12
377#define KEX_DH_ANON 0x13
378#define KEX_DH_DSS 0x14
379#define KEX_DH_RSA 0x15
380#define KEX_ECDHE_ECDSA 0x16
381#define KEX_ECDHE_PSK 0x17
382#define KEX_ECDHE_RSA 0x18
383#define KEX_ECDH_ANON 0x19
384#define KEX_ECDH_ECDSA 0x1a
385#define KEX_ECDH_RSA 0x1b
389#define KEX_RSA_PSK 0x1f
390#define KEX_SRP_SHA 0x20
391#define KEX_SRP_SHA_DSS 0x21
392#define KEX_SRP_SHA_RSA 0x22
393#define KEX_IS_DH(n) ((n) >= KEX_DHE_DSS && (n) <= KEX_ECDH_RSA)
394#define KEX_TLS13 0x23
395#define KEX_ECJPAKE 0x24
397#define KEX_ECDHE_SM2 0x25
398#define KEX_ECC_SM2 0x26
399#define KEX_IBSDH_SM9 0x27
400#define KEX_IBC_SM9 0x28
404#define ENC_START 0x30
411#define ENC_AES256 0x36
412#define ENC_CAMELLIA128 0x37
413#define ENC_CAMELLIA256 0x38
415#define ENC_CHACHA20 0x3A
423#define DIG_SHA256 0x42
424#define DIG_SHA384 0x43
473 unsigned char tls13_draft_version;
474 unsigned char _client_random[32];
475 int8_t client_cert_type;
476 int8_t server_cert_type;
477 uint32_t client_ccs_frame;
478 uint32_t server_ccs_frame;
479 uint32_t first_ch_ech_frame;
482 bool hrr_ech_declined;
483 unsigned char ech_confirmation[8];
484 unsigned char hrr_ech_confirmation[8];
485 unsigned char first_ech_auth_tag[16];
495 const char *alpn_name;
497 const char *client_alpn_name;
498 uint32_t last_nontls_frame;
499 bool is_session_resumed;
502 uint32_t client_hs_reassembly_id;
503 uint32_t server_hs_reassembly_id;
514 uint8_t client_cid_len;
515 bool client_cid_len_present;
516 uint8_t server_cid_len;
517 bool server_cid_len_present;
519 uint64_t dtls13_current_epoch[2];
520 uint64_t dtls13_next_seq_num[2];
524#define SSL_MASTER_SECRET_LENGTH 48
530 unsigned char _master_secret[SSL_MASTER_SECRET_LENGTH];
531 unsigned char _session_id[256];
532 unsigned char _client_random[32];
533 unsigned char _server_random[32];
542 unsigned char _server_data_for_iv[24];
544 unsigned char _client_data_for_iv[24];
553#if defined(HAVE_LIBGNUTLS)
554 struct cert_key_id *cert_key_id;
567 uint64_t sequence_number;
581 const char *keylog_filename;
589 GHashTable *pre_master;
594 GHashTable *tls13_client_early;
595 GHashTable *tls13_client_handshake;
596 GHashTable *tls13_server_handshake;
597 GHashTable *tls13_client_appdata;
598 GHashTable *tls13_server_appdata;
599 GHashTable *tls13_early_exporter;
600 GHashTable *tls13_exporter;
601 GHashTable *ech_secret;
602 GHashTable *ech_config;
610 GHashTable *used_crandom;
613int ssl_get_keyex_alg(
int cipher);
615void quic_transport_parameter_id_base_custom(
char *result, uint64_t parameter_id);
617bool ssldecrypt_uat_fld_ip_chk_cb(
void*,
const char*,
unsigned,
const void*,
const void*,
char** err);
618bool ssldecrypt_uat_fld_port_chk_cb(
void*,
const char*,
unsigned,
const void*,
const void*,
char** err);
619bool ssldecrypt_uat_fld_fileopen_chk_cb(
void*,
const char*,
unsigned,
const void*,
const void*,
char** err);
620bool ssldecrypt_uat_fld_password_chk_cb(
void*,
const char*,
unsigned,
const void*,
const void*,
char** err);
621char* ssl_association_info(
const char* dissector_table_name,
const char* table_protocol);
624void ssl_init_cid_list(
void);
627void ssl_cleanup_cid_list(
void);
652ssl_set_server(
SslSession *session,
address *addr, port_type ptype, uint32_t port);
674WS_DLL_PUBLIC uint32_t
686WS_DLL_PUBLIC uint32_t
691ssl_find_appdata_dissector(
const char *name);
699ssl_data_set(
StringInfo* buf,
const unsigned char* src,
unsigned len);
708ssl_cipher_setiv(SSL_CIPHER_CTX *cipher,
unsigned char* iv,
int iv_len);
714ssl_find_cipher(
int num);
730 uint32_t length,
tvbuff_t *tvb, uint32_t offset,
733 GHashTable *key_hash,
763 bool ignore_mac_failed,
764 const unsigned char *in, uint16_t inl,
const unsigned char *cid, uint8_t cidl,
782tls_add_packet_info(
int proto,
packet_info *pinfo, uint8_t curr_layer_num_ssl);
786ssl_add_record_info(
int proto,
packet_info *pinfo,
const unsigned char *data,
int data_len,
int record_id,
SslFlow *flow, ContentType type, uint8_t curr_layer_num_ssl, uint64_t record_seq);
806tls_get_master_key_map(
bool load_secrets);
814ssl_load_keyfile(
const char *ssl_keylog_filename, FILE **keylog_file,
838 bool is_from_server, TLSRecordType type);
842 bool is_from_server, TLSRecordType type);
848ssl_is_valid_content_type(uint8_t type);
851ssl_is_valid_handshake_type(uint8_t hs_type,
bool is_dtls);
854tls_scan_server_hello(
tvbuff_t *tvb, uint32_t offset, uint32_t offset_end,
855 uint16_t *server_version,
bool *is_hrr);
859 uint8_t content_type, uint8_t handshake_type,
860 bool is_dtls, uint16_t version);
868 int change_cipher_spec;
871 int hs_ext_alpn_list;
873 int hs_ext_alpn_str_len;
874 int hs_ext_cert_url_item;
875 int hs_ext_cert_url_padding;
876 int hs_ext_cert_url_sha1;
877 int hs_ext_cert_url_type;
878 int hs_ext_cert_url_url;
879 int hs_ext_cert_url_url_hash_list_len;
880 int hs_ext_cert_url_url_len;
881 int hs_ext_cert_status_type;
882 int hs_ext_cert_status_request_len;
883 int hs_ext_cert_status_responder_id_list_len;
884 int hs_ext_cert_status_request_extensions_len;
885 int hs_ext_cert_status_request_list_len;
886 int hs_ocsp_response_list_len;
887 int hs_ocsp_response_len;
888 int hs_ext_cert_type;
889 int hs_ext_cert_types;
890 int hs_ext_cert_types_len;
892 int hs_ext_ec_point_format;
893 int hs_ext_ec_point_formats;
894 int hs_ext_ec_point_formats_len;
896 int hs_ext_srp_username;
897 int hs_ext_supported_group;
898 int hs_ext_supported_groups;
899 int hs_ext_supported_groups_len;
900 int hs_ext_ech_outer_ext;
901 int hs_ext_ech_outer_ext_len;
903 int hs_ech_confirm_compute;
904 int hs_ext_heartbeat_mode;
907 int hs_ext_npn_str_len;
908 int hs_ext_reneg_info_len;
909 int hs_ext_reneg_info;
910 int hs_ext_key_share_client_length;
911 int hs_ext_key_share_group;
912 int hs_ext_key_share_key_exchange_length;
913 int hs_ext_key_share_key_exchange;
914 int hs_ext_key_share_selected_group;
915 int hs_ext_psk_identities_length;
916 int hs_ext_psk_identity_identity_length;
917 int hs_ext_psk_identity_identity;
918 int hs_ext_psk_identity_obfuscated_ticket_age;
919 int hs_ext_psk_binders_length;
920 int hs_ext_psk_binders;
921 int hs_ext_psk_binder;
922 int hs_ext_psk_binder_binder_length;
923 int hs_ext_psk_binder_binder;
924 int hs_ext_psk_identity_selected;
925 int hs_ext_session_ticket;
926 int hs_ext_supported_versions_len;
927 int hs_ext_supported_version;
928 int hs_ext_cookie_len;
930 int hs_ext_server_name;
931 int hs_ext_server_name_len;
932 int hs_ext_server_name_list_len;
933 int hs_ext_server_name_type;
934 int hs_ext_max_fragment_length;
935 int hs_ext_padding_data;
938 int hs_ext_connection_id_length;
939 int hs_ext_connection_id;
940 int hs_ext_trusted_ca_keys_len;
941 int hs_ext_trusted_ca_keys_list;
942 int hs_ext_trusted_ca_key;
943 int hs_ext_trusted_ca_key_type;
944 int hs_ext_trusted_ca_key_hash;
945 int hs_ext_trusted_ca_key_dname_len;
946 int hs_ext_trusted_ca_key_dname;
948 int hs_sig_hash_alg_len;
949 int hs_sig_hash_algs;
950 int hs_sig_hash_hash;
952 int hs_client_keyex_epms_len;
953 int hs_client_keyex_epms;
954 int hs_server_keyex_modulus_len;
955 int hs_server_keyex_exponent_len;
956 int hs_server_keyex_sig_len;
957 int hs_server_keyex_p_len;
958 int hs_server_keyex_g_len;
959 int hs_server_keyex_ys_len;
960 int hs_client_keyex_yc_len;
961 int hs_client_keyex_point_len;
962 int hs_server_keyex_point_len;
963 int hs_server_keyex_p;
964 int hs_server_keyex_g;
965 int hs_server_keyex_curve_type;
966 int hs_server_keyex_named_curve;
967 int hs_server_keyex_ys;
968 int hs_client_keyex_yc;
969 int hs_server_keyex_point;
970 int hs_client_keyex_point;
971 int hs_server_keyex_xs_len;
972 int hs_client_keyex_xc_len;
973 int hs_server_keyex_xs;
974 int hs_client_keyex_xc;
975 int hs_server_keyex_vs_len;
976 int hs_client_keyex_vc_len;
977 int hs_server_keyex_vs;
978 int hs_client_keyex_vc;
979 int hs_server_keyex_rs_len;
980 int hs_client_keyex_rc_len;
981 int hs_server_keyex_rs;
982 int hs_client_keyex_rc;
983 int hs_server_keyex_modulus;
984 int hs_server_keyex_exponent;
985 int hs_server_keyex_sig;
986 int hs_server_keyex_hint_len;
987 int hs_server_keyex_hint;
988 int hs_client_keyex_identity_len;
989 int hs_client_keyex_identity;
990 int hs_certificates_len;
992 int hs_certificate_len;
994 int hs_cert_types_count;
999 int hs_dnames_truncated;
1004 int hs_random_bytes;
1006 int hs_session_id_len;
1007 int hs_client_version;
1008 int hs_server_version;
1009 int hs_cipher_suites_len;
1010 int hs_cipher_suites;
1011 int hs_cipher_suite;
1012 int hs_comp_methods_len;
1013 int hs_comp_methods;
1015 int hs_session_ticket_lifetime_hint;
1016 int hs_session_ticket_age_add;
1017 int hs_session_ticket_nonce_len;
1018 int hs_session_ticket_nonce;
1019 int hs_session_ticket_len;
1020 int hs_session_ticket;
1022 int hs_client_cert_vrfy_sig_len;
1023 int hs_client_cert_vrfy_sig;
1032 int hs_ext_psk_ke_modes_length;
1033 int hs_ext_psk_ke_mode;
1034 int hs_certificate_request_context_length;
1035 int hs_certificate_request_context;
1036 int hs_key_update_request_update;
1037 int sct_scts_length;
1039 int sct_sct_version;
1041 int sct_sct_timestamp;
1042 int sct_sct_extensions_length;
1043 int sct_sct_extensions;
1044 int sct_sct_signature;
1045 int sct_sct_signature_length;
1046 int hs_ext_max_early_data_size;
1047 int hs_ext_oid_filters_length;
1048 int hs_ext_oid_filters_oid_length;
1049 int hs_ext_oid_filters_oid;
1050 int hs_ext_oid_filters_values_length;
1051 int hs_cred_valid_time;
1053 int hs_cred_pubkey_len;
1054 int hs_cred_signature;
1055 int hs_cred_signature_len;
1058 int hs_ext_compress_certificate_algorithms_length;
1059 int hs_ext_compress_certificate_algorithm;
1060 int hs_ext_compress_certificate_uncompressed_length;
1061 int hs_ext_compress_certificate_compressed_certificate_message_length;
1062 int hs_ext_compress_certificate_compressed_certificate_message;
1065 int hs_ext_token_binding_version_major;
1066 int hs_ext_token_binding_version_minor;
1067 int hs_ext_token_binding_key_parameters;
1068 int hs_ext_token_binding_key_parameters_length;
1069 int hs_ext_token_binding_key_parameter;
1071 int hs_ext_record_size_limit;
1074 int hs_ext_quictp_len;
1075 int hs_ext_quictp_parameter;
1076 int hs_ext_quictp_parameter_type;
1077 int hs_ext_quictp_parameter_len;
1078 int hs_ext_quictp_parameter_len_old;
1079 int hs_ext_quictp_parameter_value;
1080 int hs_ext_quictp_parameter_original_destination_connection_id;
1081 int hs_ext_quictp_parameter_max_idle_timeout;
1082 int hs_ext_quictp_parameter_stateless_reset_token;
1083 int hs_ext_quictp_parameter_initial_max_data;
1084 int hs_ext_quictp_parameter_initial_max_stream_data_bidi_local;
1085 int hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote;
1086 int hs_ext_quictp_parameter_initial_max_stream_data_uni;
1087 int hs_ext_quictp_parameter_initial_max_streams_bidi;
1088 int hs_ext_quictp_parameter_initial_max_streams_uni;
1089 int hs_ext_quictp_parameter_ack_delay_exponent;
1090 int hs_ext_quictp_parameter_max_ack_delay;
1091 int hs_ext_quictp_parameter_max_udp_payload_size;
1092 int hs_ext_quictp_parameter_pa_ipv4address;
1093 int hs_ext_quictp_parameter_pa_ipv6address;
1094 int hs_ext_quictp_parameter_pa_ipv4port;
1095 int hs_ext_quictp_parameter_pa_ipv6port;
1096 int hs_ext_quictp_parameter_pa_connectionid_length;
1097 int hs_ext_quictp_parameter_pa_connectionid;
1098 int hs_ext_quictp_parameter_pa_statelessresettoken;
1099 int hs_ext_quictp_parameter_active_connection_id_limit;
1100 int hs_ext_quictp_parameter_initial_source_connection_id;
1101 int hs_ext_quictp_parameter_retry_source_connection_id;
1102 int hs_ext_quictp_parameter_max_datagram_frame_size;
1103 int hs_ext_quictp_parameter_cibir_encoding_length;
1104 int hs_ext_quictp_parameter_cibir_encoding_offset;
1105 int hs_ext_quictp_parameter_loss_bits;
1106 int hs_ext_quictp_parameter_enable_time_stamp_v2;
1107 int hs_ext_quictp_parameter_min_ack_delay;
1108 int hs_ext_quictp_parameter_google_user_agent_id;
1109 int hs_ext_quictp_parameter_google_key_update_not_yet_supported;
1110 int hs_ext_quictp_parameter_google_quic_version;
1111 int hs_ext_quictp_parameter_google_initial_rtt;
1112 int hs_ext_quictp_parameter_google_support_handshake_done;
1113 int hs_ext_quictp_parameter_google_quic_params;
1114 int hs_ext_quictp_parameter_google_quic_params_unknown_field;
1115 int hs_ext_quictp_parameter_google_connection_options;
1116 int hs_ext_quictp_parameter_google_supported_versions_length;
1117 int hs_ext_quictp_parameter_google_supported_version;
1118 int hs_ext_quictp_parameter_facebook_partial_reliability;
1119 int hs_ext_quictp_parameter_chosen_version;
1120 int hs_ext_quictp_parameter_other_version;
1121 int hs_ext_quictp_parameter_enable_multipath;
1122 int hs_ext_quictp_parameter_initial_max_paths;
1123 int hs_ext_quictp_parameter_initial_max_path_id;
1126 int esni_record_digest_length;
1127 int esni_record_digest;
1128 int esni_encrypted_sni_length;
1129 int esni_encrypted_sni;
1132 int ech_echconfiglist_length;
1133 int ech_echconfiglist;
1135 int ech_echconfig_version;
1136 int ech_echconfig_length;
1137 int ech_echconfigcontents_maximum_name_length;
1138 int ech_echconfigcontents_public_name_length;
1139 int ech_echconfigcontents_public_name;
1140 int ech_echconfigcontents_extensions_length;
1141 int ech_echconfigcontents_extensions;
1142 int ech_hpke_keyconfig;
1143 int ech_hpke_keyconfig_config_id;
1144 int ech_hpke_keyconfig_kem_id;
1145 int ech_hpke_keyconfig_public_key_length;
1146 int ech_hpke_keyconfig_public_key;
1147 int ech_hpke_keyconfig_cipher_suites;
1148 int ech_hpke_keyconfig_cipher_suites_length;
1149 int ech_hpke_keyconfig_cipher_suite;
1150 int ech_hpke_keyconfig_cipher_suite_kdf_id;
1151 int ech_hpke_keyconfig_cipher_suite_aead_id;
1152 int ech_clienthello_type;
1153 int ech_cipher_suite;
1157 int ech_payload_length;
1159 int ech_confirmation;
1160 int ech_retry_configs;
1161 int ech_padding_data;
1163 int hs_ext_alps_len;
1164 int hs_ext_alps_alpn_list;
1165 int hs_ext_alps_alpn_str;
1166 int hs_ext_alps_alpn_str_len;
1167 int hs_ext_alps_settings;
1174 int hs_ext_cert_types;
1176 int hs_ext_curves_point_formats;
1178 int hs_ext_reneg_info;
1179 int hs_ext_key_share;
1180 int hs_ext_key_share_ks;
1181 int hs_ext_pre_shared_key;
1182 int hs_ext_psk_identity;
1183 int hs_ext_psk_binders;
1184 int hs_ext_psk_binder;
1185 int hs_ext_server_name;
1186 int hs_ext_oid_filter;
1187 int hs_ext_quictp_parameter;
1188 int hs_ext_trusted_ca_keys;
1189 int hs_ext_trusted_ca_key;
1190 int hs_sig_hash_alg;
1191 int hs_sig_hash_algs;
1204 int uncompressed_certificates;
1206 int ech_echconfiglist;
1208 int ech_retry_configs;
1209 int ech_hpke_keyconfig;
1210 int ech_hpke_cipher_suites;
1211 int ech_hpke_cipher_suite;
1213 int hs_ext_token_binding_key_parameters;
1243 int hf_dtls_handshake_cookie_len;
1244 int hf_dtls_handshake_cookie;
1258 uint32_t max_version;
1259 bool server_name_present;
1260 int num_cipher_suites;
1271#define G_MAXUINT24 ((1U << 24) - 1)
1287 unsigned offset,
unsigned offset_end, uint32_t *ret_length,
1288 int hf_length, uint32_t min_value, uint32_t max_value);
1300 unsigned offset,
unsigned offset_end);
1306 ContentType content_type,
1307 unsigned record_length,
proto_item *length_pi,
1308 uint16_t version,
tvbuff_t *decrypted_tvb);
1314 bool is_from_server,
1326 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1328 bool is_dtls,
bool is_hrr);
1332 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1338 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1344 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1346 bool is_dtls, GHashTable *session_hash);
1350 uint32_t offset, uint32_t offset_end,
packet_info *pinfo,
1352 bool is_from_server,
bool is_dtls);
1356 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1361 proto_tree *tree, uint32_t offset, uint32_t offset_end, uint16_t version);
1365 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1373 proto_tree *tree, uint32_t offset, uint32_t offset_end);
1377 proto_tree *tree, uint32_t offset, uint32_t length,
1382 proto_tree *tree, uint32_t offset, uint32_t offset_end,
1391 uint32_t offset, uint32_t offset_end, uint16_t version);
1394tls13_hkdf_expand_label_context(
int md,
const StringInfo *secret,
1395 const char *label_prefix,
const char *label,
1396 const uint8_t *context, uint8_t context_length,
1397 uint16_t out_len,
unsigned char **out);
1400tls13_hkdf_expand_label(
int md,
const StringInfo *secret,
1401 const char *label_prefix,
const char *label,
1402 uint16_t out_len,
unsigned char **out);
1406 uint32_t offset, uint32_t offset_end,
packet_info *pinfo,
1408 bool is_from_server _U_,
bool is_dtls _U_);
1410#define SSL_COMMON_LIST_T(name) \
1411ssl_common_dissect_t name;
1415#define SSL_COMMON_HF_LIST(name, prefix) \
1416 { & name .hf.change_cipher_spec, \
1417 { "Change Cipher Spec Message", prefix ".change_cipher_spec", \
1418 FT_NONE, BASE_NONE, NULL, 0x0, \
1419 "Signals a change in cipher specifications", HFILL } \
1421 { & name .hf.hs_exts_len, \
1422 { "Extensions Length", prefix ".handshake.extensions_length", \
1423 FT_UINT16, BASE_DEC, NULL, 0x0, \
1424 "Length of hello extensions", HFILL } \
1426 { & name .hf.hs_ext, \
1427 { "Extension", prefix ".handshake.extension", \
1428 FT_NONE, BASE_NONE, NULL, 0x0, \
1429 "Hello extension", HFILL } \
1431 { & name .hf.hs_ext_type, \
1432 { "Type", prefix ".handshake.extension.type", \
1433 FT_UINT16, BASE_DEC, VALS(tls_hello_extension_types), 0x0, \
1434 "Hello extension type", HFILL } \
1436 { & name .hf.hs_ext_len, \
1437 { "Length", prefix ".handshake.extension.len", \
1438 FT_UINT16, BASE_DEC, NULL, 0x0, \
1439 "Length of a hello extension", HFILL } \
1441 { & name .hf.hs_ext_data, \
1442 { "Data", prefix ".handshake.extension.data", \
1443 FT_BYTES, BASE_NONE, NULL, 0x0, \
1444 "Hello Extension data", HFILL } \
1446 { & name .hf.hs_ext_ech_outer_ext_len, \
1447 { "Outer Extensions List Length", prefix ".handshake.extensions_ech_outer_extensions_length", \
1448 FT_UINT8, BASE_DEC, NULL, 0x0, \
1451 { & name .hf.hs_ext_ech_outer_ext, \
1452 { "Outer Extensions List", prefix ".handshake.extensions_ech_outer_extensions", \
1453 FT_NONE, BASE_NONE, NULL, 0x0, \
1454 "List of extensions derived from Outer Client Hello", HFILL } \
1456 { & name .hf.hs_ech_confirm, \
1457 { "ECH Confirmation Bytes", prefix ".handshake.ech_confirm", \
1458 FT_BYTES, BASE_NONE, NULL, 0x0, \
1461 { & name .hf.hs_ech_confirm_compute, \
1462 { "Computed ECH Confirmation Bytes", prefix ".handshake.ech_confirm_compute", \
1463 FT_BYTES, BASE_NONE, NULL, 0x0, \
1466 { & name .hf.hs_ext_supported_groups_len, \
1467 { "Supported Groups List Length", prefix ".handshake.extensions_supported_groups_length", \
1468 FT_UINT16, BASE_DEC, NULL, 0x0, \
1471 { & name .hf.hs_ext_supported_groups, \
1472 { "Supported Groups List", prefix ".handshake.extensions_supported_groups", \
1473 FT_NONE, BASE_NONE, NULL, 0x0, \
1474 "List of supported groups (formerly Supported Elliptic Curves)", HFILL } \
1476 { & name .hf.hs_ext_supported_group, \
1477 { "Supported Group", prefix ".handshake.extensions_supported_group", \
1478 FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1481 { & name .hf.hs_ext_ec_point_formats_len, \
1482 { "EC point formats Length", prefix ".handshake.extensions_ec_point_formats_length", \
1483 FT_UINT8, BASE_DEC, NULL, 0x0, \
1484 "Length of elliptic curves point formats field", HFILL } \
1486 { & name .hf.hs_ext_ec_point_formats, \
1487 { "EC point formats", prefix ".handshake.extensions_ec_point_formats", \
1488 FT_NONE, BASE_NONE, NULL, 0x0, \
1489 "List of elliptic curves point format", HFILL } \
1491 { & name .hf.hs_ext_ec_point_format, \
1492 { "EC point format", prefix ".handshake.extensions_ec_point_format", \
1493 FT_UINT8, BASE_DEC, VALS(ssl_extension_ec_point_formats), 0x0, \
1494 "Elliptic curves point format", HFILL } \
1496 { & name .hf.hs_ext_srp_len, \
1497 { "SRP username length", prefix ".handshake.extensions_srp_len", \
1498 FT_UINT8, BASE_DEC, NULL, 0x0, \
1499 "Length of Secure Remote Password username field", HFILL } \
1501 { & name .hf.hs_ext_srp_username, \
1502 { "SRP username", prefix ".handshake.extensions_srp_username", \
1503 FT_STRING, BASE_NONE, NULL, 0x0, \
1504 "Secure Remote Password username", HFILL } \
1506 { & name .hf.hs_ext_alpn_len, \
1507 { "ALPN Extension Length", prefix ".handshake.extensions_alpn_len", \
1508 FT_UINT16, BASE_DEC, NULL, 0x0, \
1509 "Length of the ALPN Extension", HFILL } \
1511 { & name .hf.hs_ext_alpn_list, \
1512 { "ALPN Protocol", prefix ".handshake.extensions_alpn_list", \
1513 FT_NONE, BASE_NONE, NULL, 0x0, \
1516 { & name .hf.hs_ext_alpn_str_len, \
1517 { "ALPN string length", prefix ".handshake.extensions_alpn_str_len", \
1518 FT_UINT8, BASE_DEC, NULL, 0x0, \
1519 "Length of ALPN string", HFILL } \
1521 { & name .hf.hs_ext_alpn_str, \
1522 { "ALPN Next Protocol", prefix ".handshake.extensions_alpn_str", \
1523 FT_STRING, BASE_NONE, NULL, 0x00, \
1526 { & name .hf.hs_ext_npn_str_len, \
1527 { "Protocol string length", prefix ".handshake.extensions_npn_str_len", \
1528 FT_UINT8, BASE_DEC, NULL, 0x0, \
1529 "Length of next protocol string", HFILL } \
1531 { & name .hf.hs_ext_npn_str, \
1532 { "Next Protocol", prefix ".handshake.extensions_npn", \
1533 FT_STRING, BASE_NONE, NULL, 0x0, \
1536 { & name .hf.hs_ext_reneg_info_len, \
1537 { "Renegotiation info extension length", prefix ".handshake.extensions_reneg_info_len", \
1538 FT_UINT8, BASE_DEC, NULL, 0x0, \
1541 { & name .hf.hs_ext_reneg_info, \
1542 { "Renegotiation info", prefix ".handshake.extensions_reneg_info",\
1543 FT_BYTES, BASE_NONE, NULL, 0x0, \
1546 { & name .hf.hs_ext_key_share_client_length, \
1547 { "Client Key Share Length", prefix ".handshake.extensions_key_share_client_length", \
1548 FT_UINT16, BASE_DEC, NULL, 0x00, \
1551 { & name .hf.hs_ext_key_share_group, \
1552 { "Group", prefix ".handshake.extensions_key_share_group", \
1553 FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1556 { & name .hf.hs_ext_key_share_key_exchange_length, \
1557 { "Key Exchange Length", prefix ".handshake.extensions_key_share_key_exchange_length", \
1558 FT_UINT16, BASE_DEC, NULL, 0x00, \
1561 { & name .hf.hs_ext_key_share_key_exchange, \
1562 { "Key Exchange", prefix ".handshake.extensions_key_share_key_exchange", \
1563 FT_BYTES, BASE_NONE, NULL, 0x0, \
1566 { & name .hf.hs_ext_key_share_selected_group, \
1567 { "Selected Group", prefix ".handshake.extensions_key_share_selected_group", \
1568 FT_UINT16, BASE_DEC, VALS(ssl_extension_curves), 0x00, \
1571 { & name .hf.hs_ext_psk_identities_length, \
1572 { "Identities Length", prefix ".handshake.extensions.psk.identities.length", \
1573 FT_UINT16, BASE_DEC, NULL, 0x0, \
1576 { & name .hf.hs_ext_psk_identity_identity_length, \
1577 { "Identity Length", prefix ".handshake.extensions.psk.identity.identity_length", \
1578 FT_UINT16, BASE_DEC, NULL, 0x0, \
1581 { & name .hf.hs_ext_psk_identity_identity, \
1582 { "Identity", prefix ".handshake.extensions.psk.identity.identity", \
1583 FT_BYTES, BASE_NONE, NULL, 0x0, \
1586 { & name .hf.hs_ext_psk_identity_obfuscated_ticket_age, \
1587 { "Obfuscated Ticket Age", prefix ".handshake.extensions.psk.identity.obfuscated_ticket_age", \
1588 FT_UINT32, BASE_DEC, NULL, 0x0, \
1591 { & name .hf.hs_ext_psk_binders_length, \
1592 { "PSK Binders length", prefix ".handshake.extensions.psk.binders_len", \
1593 FT_UINT16, BASE_DEC, NULL, 0x0, \
1596 { & name .hf.hs_ext_psk_binders, \
1597 { "PSK Binders", prefix ".handshake.extensions.psk.binders", \
1598 FT_NONE, BASE_NONE, NULL, 0x0, \
1601 { & name .hf.hs_ext_psk_binder, \
1602 { "PSK Binder", prefix ".handshake.extensions.psk.binder", \
1603 FT_NONE, BASE_NONE, NULL, 0x0, \
1606 { & name .hf.hs_ext_psk_binder_binder_length, \
1607 { "Binder Length", prefix ".handshake.extensions.psk.binder.binder_length", \
1608 FT_UINT8, BASE_DEC, NULL, 0x0, \
1611 { & name .hf.hs_ext_psk_binder_binder, \
1612 { "Binder", prefix ".handshake.extensions.psk.binder.binder", \
1613 FT_BYTES, BASE_NONE, NULL, 0x0, \
1616 { & name .hf.hs_ext_psk_identity_selected, \
1617 { "Selected Identity", prefix ".handshake.extensions.psk.identity.selected", \
1618 FT_UINT16, BASE_DEC, NULL, 0x0, \
1621 { & name .hf.hs_ext_session_ticket, \
1622 { "Session Ticket", prefix ".handshake.extensions.session_ticket", \
1623 FT_BYTES, BASE_NONE, NULL, 0x0, \
1626 { & name .hf.hs_ext_supported_versions_len, \
1627 { "Supported Versions length", prefix ".handshake.extensions.supported_versions_len", \
1628 FT_UINT8, BASE_DEC, NULL, 0x0, \
1631 { & name .hf.hs_ext_supported_version, \
1632 { "Supported Version", prefix ".handshake.extensions.supported_version", \
1633 FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
1636 { & name .hf.hs_ext_cookie_len, \
1637 { "Cookie length", prefix ".handshake.extensions.cookie_len", \
1638 FT_UINT16, BASE_DEC, NULL, 0x0, \
1641 { & name .hf.hs_ext_cookie, \
1642 { "Cookie", prefix ".handshake.extensions.cookie", \
1643 FT_BYTES, BASE_NONE, NULL, 0x0, \
1646 { & name .hf.hs_ext_server_name_list_len, \
1647 { "Server Name list length", prefix ".handshake.extensions_server_name_list_len", \
1648 FT_UINT16, BASE_DEC, NULL, 0x0, \
1649 "Length of server name list", HFILL } \
1651 { & name .hf.hs_ext_server_name_len, \
1652 { "Server Name length", prefix ".handshake.extensions_server_name_len", \
1653 FT_UINT16, BASE_DEC, NULL, 0x0, \
1654 "Length of server name string", HFILL } \
1656 { & name .hf.hs_ext_server_name_type, \
1657 { "Server Name Type", prefix ".handshake.extensions_server_name_type", \
1658 FT_UINT8, BASE_DEC, VALS(tls_hello_ext_server_name_type_vs), 0x0, \
1661 { & name .hf.hs_ext_server_name, \
1662 { "Server Name", prefix ".handshake.extensions_server_name", \
1663 FT_STRING, BASE_NONE, NULL, 0x0, \
1666 { & name .hf.hs_ext_max_fragment_length, \
1667 { "Maximum Fragment Length", prefix ".handshake.max_fragment_length", \
1668 FT_UINT8, BASE_DEC, VALS(tls_hello_ext_max_fragment_length), 0x00, \
1669 "Maximum fragment length that an endpoint is willing to receive", HFILL } \
1671 { & name .hf.hs_ext_padding_data, \
1672 { "Padding Data", prefix ".handshake.extensions_padding_data", \
1673 FT_BYTES, BASE_NONE, NULL, 0x0, \
1674 "Must be zero", HFILL } \
1676 { & name .hf.hs_ext_cert_url_type, \
1677 { "Certificate Chain Type", prefix ".handshake.cert_url_type", \
1678 FT_UINT8, BASE_DEC, VALS(tls_cert_chain_type), 0x0, \
1679 "Certificate Chain Type for Client Certificate URL", HFILL } \
1681 { & name .hf.hs_ext_cert_url_url_hash_list_len, \
1682 { "URL and Hash list Length", prefix ".handshake.cert_url.url_hash_len", \
1683 FT_UINT16, BASE_DEC, NULL, 0x0, \
1686 { & name .hf.hs_ext_cert_url_item, \
1687 { "URL and Hash", prefix ".handshake.cert_url.url_hash", \
1688 FT_NONE, BASE_NONE, NULL, 0x0, \
1691 { & name .hf.hs_ext_cert_url_url_len, \
1692 { "URL Length", prefix ".handshake.cert_url.url_len", \
1693 FT_UINT16, BASE_DEC, NULL, 0x0, \
1696 { & name .hf.hs_ext_cert_type, \
1697 { "Certificate Type", prefix ".handshake.cert_type.type", \
1698 FT_UINT8, BASE_HEX, VALS(tls_certificate_type), 0x0, \
1701 { & name .hf.hs_ext_cert_types, \
1702 { "Certificate Type List", prefix ".handshake.cert_type.types", \
1703 FT_NONE, BASE_NONE, NULL, 0x0, \
1706 { & name .hf.hs_ext_cert_types_len, \
1707 { "Certificate Type List Length", prefix ".handshake.cert_type.types_len", \
1708 FT_UINT8, BASE_DEC, NULL, 0x0, \
1711 { & name .hf.hs_ext_cert_url_url, \
1712 { "URL", prefix ".handshake.cert_url.url", \
1713 FT_STRING, BASE_NONE, NULL, 0x0, \
1714 "URL used to fetch the certificate(s)", HFILL } \
1716 { & name .hf.hs_ext_cert_url_padding, \
1717 { "Padding", prefix ".handshake.cert_url.padding", \
1718 FT_NONE, BASE_NONE, NULL, 0x0, \
1719 "Padding that MUST be 0x01 for backwards compatibility", HFILL } \
1721 { & name .hf.hs_ext_cert_url_sha1, \
1722 { "SHA1 Hash", prefix ".handshake.cert_url.sha1", \
1723 FT_BYTES, BASE_NONE, NULL, 0x0, \
1724 "SHA1 Hash of the certificate", HFILL } \
1726 { & name .hf.hs_ext_cert_status_type, \
1727 { "Certificate Status Type", prefix ".handshake.extensions_status_request_type", \
1728 FT_UINT8, BASE_DEC, VALS(tls_cert_status_type), 0x0, \
1731 { & name .hf.hs_ext_cert_status_request_len, \
1732 { "Certificate Status Length", prefix ".handshake.extensions_status_request_len", \
1733 FT_UINT16, BASE_DEC, NULL, 0x0, \
1736 { & name .hf.hs_ext_cert_status_responder_id_list_len, \
1737 { "Responder ID list Length", prefix ".handshake.extensions_status_request_responder_ids_len", \
1738 FT_UINT16, BASE_DEC, NULL, 0x0, \
1741 { & name .hf.hs_ext_cert_status_request_extensions_len, \
1742 { "Request Extensions Length", prefix ".handshake.extensions_status_request_exts_len", \
1743 FT_UINT16, BASE_DEC, NULL, 0x0, \
1746 { & name .hf.hs_ext_cert_status_request_list_len, \
1747 { "Certificate Status List Length", prefix ".handshake.extensions_status_request_list_len", \
1748 FT_UINT16, BASE_DEC, NULL, 0x0, \
1749 "CertificateStatusRequestItemV2 list length", HFILL } \
1751 { & name .hf.hs_ocsp_response_list_len, \
1752 { "OCSP Response List Length", prefix ".handshake.ocsp_response_list_len", \
1753 FT_UINT24, BASE_DEC, NULL, 0x0, \
1754 "OCSPResponseList length", HFILL } \
1756 { & name .hf.hs_ocsp_response_len, \
1757 { "OCSP Response Length", prefix ".handshake.ocsp_response_len", \
1758 FT_UINT24, BASE_DEC, NULL, 0x0, \
1761 { & name .hf.hs_sig_hash_alg_len, \
1762 { "Signature Hash Algorithms Length", prefix ".handshake.sig_hash_alg_len", \
1763 FT_UINT16, BASE_DEC, NULL, 0x0, \
1764 "Length of Signature Hash Algorithms", HFILL } \
1766 { & name .hf.hs_sig_hash_algs, \
1767 { "Signature Algorithms", prefix ".handshake.sig_hash_algs", \
1768 FT_NONE, BASE_NONE, NULL, 0x0, \
1769 "List of supported Signature Algorithms", HFILL } \
1771 { & name .hf.hs_sig_hash_alg, \
1772 { "Signature Algorithm", prefix ".handshake.sig_hash_alg", \
1773 FT_UINT16, BASE_HEX, VALS(tls13_signature_algorithm), 0x0, \
1776 { & name .hf.hs_sig_hash_hash, \
1777 { "Signature Hash Algorithm Hash", prefix ".handshake.sig_hash_hash", \
1778 FT_UINT8, BASE_DEC, VALS(tls_hash_algorithm), 0x0, \
1779 "Hash algorithm (TLS 1.2)", HFILL } \
1781 { & name .hf.hs_sig_hash_sig, \
1782 { "Signature Hash Algorithm Signature", prefix ".handshake.sig_hash_sig", \
1783 FT_UINT8, BASE_DEC, VALS(tls_signature_algorithm), 0x0, \
1784 "Signature algorithm (TLS 1.2)", HFILL } \
1786 { & name .hf.hs_client_keyex_epms_len, \
1787 { "Encrypted PreMaster length", prefix ".handshake.epms_len", \
1788 FT_UINT16, BASE_DEC, NULL, 0x0, \
1789 "Length of encrypted PreMaster secret", HFILL } \
1791 { & name .hf.hs_client_keyex_epms, \
1792 { "Encrypted PreMaster", prefix ".handshake.epms", \
1793 FT_BYTES, BASE_NONE, NULL, 0x0, \
1794 "Encrypted PreMaster secret", HFILL } \
1796 { & name .hf.hs_server_keyex_modulus_len, \
1797 { "Modulus Length", prefix ".handshake.modulus_len", \
1798 FT_UINT16, BASE_DEC, NULL, 0x0, \
1799 "Length of RSA-EXPORT modulus", HFILL } \
1801 { & name .hf.hs_server_keyex_exponent_len, \
1802 { "Exponent Length", prefix ".handshake.exponent_len", \
1803 FT_UINT16, BASE_DEC, NULL, 0x0, \
1804 "Length of RSA-EXPORT exponent", HFILL } \
1806 { & name .hf.hs_server_keyex_sig_len, \
1807 { "Signature Length", prefix ".handshake.sig_len", \
1808 FT_UINT16, BASE_DEC, NULL, 0x0, \
1809 "Length of Signature", HFILL } \
1811 { & name .hf.hs_server_keyex_p_len, \
1812 { "p Length", prefix ".handshake.p_len", \
1813 FT_UINT16, BASE_DEC, NULL, 0x0, \
1814 "Length of p", HFILL } \
1816 { & name .hf.hs_server_keyex_g_len, \
1817 { "g Length", prefix ".handshake.g_len", \
1818 FT_UINT16, BASE_DEC, NULL, 0x0, \
1819 "Length of g", HFILL } \
1821 { & name .hf.hs_server_keyex_ys_len, \
1822 { "Pubkey Length", prefix ".handshake.ys_len", \
1823 FT_UINT16, BASE_DEC, NULL, 0x0, \
1824 "Length of server's Diffie-Hellman public key", HFILL } \
1826 { & name .hf.hs_client_keyex_yc_len, \
1827 { "Pubkey Length", prefix ".handshake.yc_len", \
1828 FT_UINT16, BASE_DEC, NULL, 0x0, \
1829 "Length of client's Diffie-Hellman public key", HFILL } \
1831 { & name .hf.hs_client_keyex_point_len, \
1832 { "Pubkey Length", prefix ".handshake.client_point_len", \
1833 FT_UINT8, BASE_DEC, NULL, 0x0, \
1834 "Length of client's EC Diffie-Hellman public key", HFILL } \
1836 { & name .hf.hs_server_keyex_point_len, \
1837 { "Pubkey Length", prefix ".handshake.server_point_len", \
1838 FT_UINT8, BASE_DEC, NULL, 0x0, \
1839 "Length of server's EC Diffie-Hellman public key", HFILL } \
1841 { & name .hf.hs_server_keyex_p, \
1842 { "p", prefix ".handshake.p", \
1843 FT_BYTES, BASE_NONE, NULL, 0x0, \
1844 "Diffie-Hellman p", HFILL } \
1846 { & name .hf.hs_server_keyex_g, \
1847 { "g", prefix ".handshake.g", \
1848 FT_BYTES, BASE_NONE, NULL, 0x0, \
1849 "Diffie-Hellman g", HFILL } \
1851 { & name .hf.hs_server_keyex_curve_type, \
1852 { "Curve Type", prefix ".handshake.server_curve_type", \
1853 FT_UINT8, BASE_HEX, VALS(ssl_curve_types), 0x0, \
1854 "Server curve_type", HFILL } \
1856 { & name .hf.hs_server_keyex_named_curve, \
1857 { "Named Curve", prefix ".handshake.server_named_curve", \
1858 FT_UINT16, BASE_HEX, VALS(ssl_extension_curves), 0x0, \
1859 "Server named_curve", HFILL } \
1861 { & name .hf.hs_server_keyex_ys, \
1862 { "Pubkey", prefix ".handshake.ys", \
1863 FT_BYTES, BASE_NONE, NULL, 0x0, \
1864 "Diffie-Hellman server pubkey", HFILL } \
1866 { & name .hf.hs_client_keyex_yc, \
1867 { "Pubkey", prefix ".handshake.yc", \
1868 FT_BYTES, BASE_NONE, NULL, 0x0, \
1869 "Diffie-Hellman client pubkey", HFILL } \
1871 { & name .hf.hs_server_keyex_point, \
1872 { "Pubkey", prefix ".handshake.server_point", \
1873 FT_BYTES, BASE_NONE, NULL, 0x0, \
1874 "EC Diffie-Hellman server pubkey", HFILL } \
1876 { & name .hf.hs_client_keyex_point, \
1877 { "Pubkey", prefix ".handshake.client_point", \
1878 FT_BYTES, BASE_NONE, NULL, 0x0, \
1879 "EC Diffie-Hellman client pubkey", HFILL } \
1881 { & name .hf.hs_server_keyex_xs_len, \
1882 { "Pubkey Length", prefix ".handshake.xs_len", \
1883 FT_UINT8, BASE_DEC, NULL, 0x0, \
1884 "Length of EC J-PAKE server public key", HFILL } \
1886 { & name .hf.hs_client_keyex_xc_len, \
1887 { "Pubkey Length", prefix ".handshake.xc_len", \
1888 FT_UINT8, BASE_DEC, NULL, 0x0, \
1889 "Length of EC J-PAKE client public key", HFILL } \
1891 { & name .hf.hs_server_keyex_xs, \
1892 { "Pubkey", prefix ".handshake.xs", \
1893 FT_BYTES, BASE_NONE, NULL, 0x0, \
1894 "EC J-PAKE server public key", HFILL } \
1896 { & name .hf.hs_client_keyex_xc, \
1897 { "Pubkey", prefix ".handshake.xc", \
1898 FT_BYTES, BASE_NONE, NULL, 0x0, \
1899 "EC J-PAKE client public key", HFILL } \
1901 { & name .hf.hs_server_keyex_vs_len, \
1902 { "Ephemeral Pubkey Length", prefix ".handshake.vs_len", \
1903 FT_UINT8, BASE_DEC, NULL, 0x0, \
1904 "Length of EC J-PAKE server ephemeral public key", HFILL } \
1906 { & name .hf.hs_client_keyex_vc_len, \
1907 { "Ephemeral Pubkey Length", prefix ".handshake.vc_len", \
1908 FT_UINT8, BASE_DEC, NULL, 0x0, \
1909 "Length of EC J-PAKE client ephemeral public key", HFILL } \
1911 { & name .hf.hs_server_keyex_vs, \
1912 { "Ephemeral Pubkey", prefix ".handshake.vs", \
1913 FT_BYTES, BASE_NONE, NULL, 0x0, \
1914 "EC J-PAKE server ephemeral public key", HFILL } \
1916 { & name .hf.hs_client_keyex_vc, \
1917 { "Ephemeral Pubkey", prefix ".handshake.vc", \
1918 FT_BYTES, BASE_NONE, NULL, 0x0, \
1919 "EC J-PAKE client ephemeral public key", HFILL } \
1921 { & name .hf.hs_server_keyex_rs_len, \
1922 { "Schnorr signature Length", prefix ".handshake.rs_len", \
1923 FT_UINT8, BASE_DEC, NULL, 0x0, \
1924 "Length of EC J-PAKE server Schnorr signature", HFILL } \
1926 { & name .hf.hs_client_keyex_rc_len, \
1927 { "Schnorr signature Length", prefix ".handshake.rc_len", \
1928 FT_UINT8, BASE_DEC, NULL, 0x0, \
1929 "Length of EC J-PAKE client Schnorr signature", HFILL } \
1931 { & name .hf.hs_server_keyex_rs, \
1932 { "Schnorr signature", prefix ".handshake.rs", \
1933 FT_BYTES, BASE_NONE, NULL, 0x0, \
1934 "EC J-PAKE server Schnorr signature", HFILL } \
1936 { & name .hf.hs_client_keyex_rc, \
1937 { "Schnorr signature", prefix ".handshake.rc", \
1938 FT_BYTES, BASE_NONE, NULL, 0x0, \
1939 "EC J-PAKE client Schnorr signature", HFILL } \
1941 { & name .hf.hs_server_keyex_modulus, \
1942 { "Modulus", prefix ".handshake.modulus", \
1943 FT_BYTES, BASE_NONE, NULL, 0x0, \
1944 "RSA-EXPORT modulus", HFILL } \
1946 { & name .hf.hs_server_keyex_exponent, \
1947 { "Exponent", prefix ".handshake.exponent", \
1948 FT_BYTES, BASE_NONE, NULL, 0x0, \
1949 "RSA-EXPORT exponent", HFILL } \
1951 { & name .hf.hs_server_keyex_sig, \
1952 { "Signature", prefix ".handshake.sig", \
1953 FT_BYTES, BASE_NONE, NULL, 0x0, \
1954 "Diffie-Hellman server signature", HFILL } \
1956 { & name .hf.hs_server_keyex_hint_len, \
1957 { "Hint Length", prefix ".handshake.hint_len", \
1958 FT_UINT16, BASE_DEC, NULL, 0x0, \
1959 "Length of PSK Hint", HFILL } \
1961 { & name .hf.hs_server_keyex_hint, \
1962 { "Hint", prefix ".handshake.hint", \
1963 FT_BYTES, BASE_NONE, NULL, 0x0, \
1964 "PSK Hint", HFILL } \
1966 { & name .hf.hs_client_keyex_identity_len, \
1967 { "Identity Length", prefix ".handshake.identity_len", \
1968 FT_UINT16, BASE_DEC, NULL, 0x0, \
1969 "Length of PSK Identity", HFILL } \
1971 { & name .hf.hs_client_keyex_identity, \
1972 { "Identity", prefix ".handshake.identity", \
1973 FT_BYTES, BASE_NONE, NULL, 0x0, \
1974 "PSK Identity", HFILL } \
1976 { & name .hf.hs_ext_heartbeat_mode, \
1977 { "Mode", prefix ".handshake.extension.heartbeat.mode", \
1978 FT_UINT8, BASE_DEC, VALS(tls_heartbeat_mode), 0x0, \
1979 "Heartbeat extension mode", HFILL } \
1981 { & name .hf.hs_certificates_len, \
1982 { "Certificates Length", prefix ".handshake.certificates_length", \
1983 FT_UINT24, BASE_DEC, NULL, 0x0, \
1984 "Length of certificates field", HFILL } \
1986 { & name .hf.hs_certificates, \
1987 { "Certificates", prefix ".handshake.certificates", \
1988 FT_NONE, BASE_NONE, NULL, 0x0, \
1989 "List of certificates", HFILL } \
1991 { & name .hf.hs_certificate, \
1992 { "Certificate", prefix ".handshake.certificate", \
1993 FT_BYTES, BASE_NONE, NULL, 0x0, \
1996 { & name .hf.hs_certificate_len, \
1997 { "Certificate Length", prefix ".handshake.certificate_length", \
1998 FT_UINT24, BASE_DEC, NULL, 0x0, \
1999 "Length of certificate", HFILL } \
2001 { & name .hf.hs_cert_types_count, \
2002 { "Certificate types count", prefix ".handshake.cert_types_count",\
2003 FT_UINT8, BASE_DEC, NULL, 0x0, \
2004 "Count of certificate types", HFILL } \
2006 { & name .hf.hs_cert_types, \
2007 { "Certificate types", prefix ".handshake.cert_types", \
2008 FT_NONE, BASE_NONE, NULL, 0x0, \
2009 "List of certificate types", HFILL } \
2011 { & name .hf.hs_cert_type, \
2012 { "Certificate type", prefix ".handshake.cert_type", \
2013 FT_UINT8, BASE_DEC, VALS(ssl_31_client_certificate_type), 0x0, \
2016 { & name .hf.hs_dnames_len, \
2017 { "Distinguished Names Length", prefix ".handshake.dnames_len", \
2018 FT_UINT16, BASE_DEC, NULL, 0x0, \
2019 "Length of list of CAs that server trusts", HFILL } \
2021 { & name .hf.hs_dnames, \
2022 { "Distinguished Names", prefix ".handshake.dnames", \
2023 FT_NONE, BASE_NONE, NULL, 0x0, \
2024 "List of CAs that server trusts", HFILL } \
2026 { & name .hf.hs_dname_len, \
2027 { "Distinguished Name Length", prefix ".handshake.dname_len", \
2028 FT_UINT16, BASE_DEC, NULL, 0x0, \
2029 "Length of distinguished name", HFILL } \
2031 { & name .hf.hs_dnames_truncated, \
2032 { "Tree view truncated", prefix ".handshake.dnames_truncated", \
2033 FT_NONE, BASE_NONE, NULL, 0x00, \
2034 "Some Distinguished Names are not added to tree pane to limit resources", HFILL } \
2036 { & name .hf.hs_dname, \
2037 { "Distinguished Name", prefix ".handshake.dname", \
2038 FT_NONE, BASE_NONE, NULL, 0x0, \
2039 "Distinguished name of a CA that server trusts", HFILL } \
2041 { & name .hf.hs_random, \
2042 { "Random", prefix ".handshake.random", \
2043 FT_BYTES, BASE_NONE, NULL, 0x0, \
2044 "Random values used for deriving keys", HFILL } \
2046 { & name .hf.hs_random_time, \
2047 { "GMT Unix Time", prefix ".handshake.random_time", \
2048 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0, \
2049 "Unix time field of random structure", HFILL } \
2051 { & name .hf.hs_random_bytes, \
2052 { "Random Bytes", prefix ".handshake.random_bytes", \
2053 FT_BYTES, BASE_NONE, NULL, 0x0, \
2054 "Random values used for deriving keys", HFILL } \
2056 { & name .hf.hs_session_id, \
2057 { "Session ID", prefix ".handshake.session_id", \
2058 FT_BYTES, BASE_NONE, NULL, 0x0, \
2059 "Identifies the SSL session, allowing later resumption", HFILL }\
2061 { & name .hf.hs_session_id_len, \
2062 { "Session ID Length", prefix ".handshake.session_id_length", \
2063 FT_UINT8, BASE_DEC, NULL, 0x0, \
2064 "Length of Session ID field", HFILL } \
2066 { & name .hf.hs_client_version, \
2067 { "Version", prefix ".handshake.version", \
2068 FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
2069 "Maximum version supported by client [legacy_version if supported_versions ext is present]", HFILL } \
2071 { & name .hf.hs_server_version, \
2072 { "Version", prefix ".handshake.version", \
2073 FT_UINT16, BASE_HEX, VALS(ssl_versions), 0x0, \
2074 "Version selected by server [legacy_version if supported_versions ext is present]", HFILL } \
2076 { & name .hf.hs_cipher_suites_len, \
2077 { "Cipher Suites Length", prefix ".handshake.cipher_suites_length", \
2078 FT_UINT16, BASE_DEC, NULL, 0x0, \
2079 "Length of cipher suites field", HFILL } \
2081 { & name .hf.hs_cipher_suites, \
2082 { "Cipher Suites", prefix ".handshake.ciphersuites", \
2083 FT_NONE, BASE_NONE, NULL, 0x0, \
2084 "List of cipher suites supported by client", HFILL } \
2086 { & name .hf.hs_cipher_suite, \
2087 { "Cipher Suite", prefix ".handshake.ciphersuite", \
2088 FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2091 { & name .hf.hs_comp_methods_len, \
2092 { "Compression Methods Length", prefix ".handshake.comp_methods_length", \
2093 FT_UINT8, BASE_DEC, NULL, 0x0, \
2094 "Length of compression methods field", HFILL } \
2096 { & name .hf.hs_comp_methods, \
2097 { "Compression Methods", prefix ".handshake.comp_methods", \
2098 FT_NONE, BASE_NONE, NULL, 0x0, \
2099 "List of compression methods supported by client", HFILL } \
2101 { & name .hf.hs_comp_method, \
2102 { "Compression Method", prefix ".handshake.comp_method", \
2103 FT_UINT8, BASE_DEC, VALS(ssl_31_compression_method), 0x0, \
2106 { & name .hf.hs_session_ticket_lifetime_hint, \
2107 { "Session Ticket Lifetime Hint", \
2108 prefix ".handshake.session_ticket_lifetime_hint", \
2109 FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_second_seconds), 0x0, \
2110 "New Session Ticket Lifetime Hint", HFILL } \
2112 { & name .hf.hs_session_ticket_age_add, \
2113 { "Session Ticket Age Add", \
2114 prefix ".handshake.session_ticket_age_add", \
2115 FT_UINT32, BASE_DEC, NULL, 0x0, \
2116 "Random 32-bit value to obscure age of ticket", HFILL } \
2118 { & name .hf.hs_session_ticket_nonce_len, \
2119 { "Session Ticket Nonce Length", prefix ".handshake.session_ticket_nonce_length", \
2120 FT_UINT8, BASE_DEC, NULL, 0x0, \
2123 { & name .hf.hs_session_ticket_nonce, \
2124 { "Session Ticket Nonce", prefix ".handshake.session_ticket_nonce", \
2125 FT_BYTES, BASE_NONE, NULL, 0x0, \
2126 "A unique per-ticket value", HFILL } \
2128 { & name .hf.hs_session_ticket_len, \
2129 { "Session Ticket Length", prefix ".handshake.session_ticket_length", \
2130 FT_UINT16, BASE_DEC, NULL, 0x0, \
2131 "New Session Ticket Length", HFILL } \
2133 { & name .hf.hs_session_ticket, \
2134 { "Session Ticket", prefix ".handshake.session_ticket", \
2135 FT_BYTES, BASE_NONE, NULL, 0x0, \
2136 "New Session Ticket", HFILL } \
2138 { & name .hf.hs_finished, \
2139 { "Verify Data", prefix ".handshake.verify_data", \
2140 FT_BYTES, BASE_NONE, NULL, 0x0, \
2141 "Opaque verification data", HFILL } \
2143 { & name .hf.hs_client_cert_vrfy_sig_len, \
2144 { "Signature length", prefix ".handshake.client_cert_vrfy.sig_len", \
2145 FT_UINT16, BASE_DEC, NULL, 0x0, \
2146 "Length of CertificateVerify's signature", HFILL } \
2148 { & name .hf.hs_client_cert_vrfy_sig, \
2149 { "Signature", prefix ".handshake.client_cert_vrfy.sig", \
2150 FT_BYTES, BASE_NONE, NULL, 0x0, \
2151 "CertificateVerify's signature", HFILL } \
2153 { & name .hf.hs_ja3_full, \
2154 { "JA3 Fullstring", prefix ".handshake.ja3_full", \
2155 FT_STRING, BASE_NONE, NULL, 0x0, \
2158 { & name .hf.hs_ja3_hash, \
2159 { "JA3", prefix ".handshake.ja3", \
2160 FT_STRING, BASE_NONE, NULL, 0x0, \
2163 { & name .hf.hs_ja3s_full, \
2164 { "JA3S Fullstring", prefix ".handshake.ja3s_full", \
2165 FT_STRING, BASE_NONE, NULL, 0x0, \
2168 { & name .hf.hs_ja3s_hash, \
2169 { "JA3S", prefix ".handshake.ja3s", \
2170 FT_STRING, BASE_NONE, NULL, 0x0, \
2173 { & name .hf.hs_ja4, \
2174 { "JA4", prefix ".handshake.ja4", \
2175 FT_STRING, BASE_NONE, NULL, 0x0, \
2178 { & name .hf.hs_ja4_r, \
2179 { "JA4_r", prefix ".handshake.ja4_r", \
2180 FT_STRING, BASE_NONE, NULL, 0x0, \
2183 { & name .hf.hs_ext_psk_ke_modes_length, \
2184 { "PSK Key Exchange Modes Length", prefix ".extension.psk_ke_modes_length", \
2185 FT_UINT8, BASE_DEC, NULL, 0x0, \
2188 { & name .hf.hs_ext_psk_ke_mode, \
2189 { "PSK Key Exchange Mode", prefix ".extension.psk_ke_mode", \
2190 FT_UINT8, BASE_DEC, VALS(tls_hello_ext_psk_ke_mode), 0x0, \
2191 "Key exchange modes where the client supports use of PSKs", HFILL } \
2193 { & name .hf.hs_certificate_request_context_length, \
2194 { "Certificate Request Context Length", prefix ".handshake.certificate_request_context_length", \
2195 FT_UINT8, BASE_DEC, NULL, 0x0, \
2198 { & name .hf.hs_certificate_request_context, \
2199 { "Certificate Request Context", prefix ".handshake.certificate_request_context", \
2200 FT_BYTES, BASE_NONE, NULL, 0x0, \
2201 "Value from CertificateRequest or empty for server auth", HFILL } \
2203 { & name .hf.hs_key_update_request_update, \
2204 { "Key Update Request", prefix ".handshake.key_update.request_update", \
2205 FT_UINT8, BASE_DEC, VALS(tls13_key_update_request), 0x00, \
2206 "Whether the receiver should also update its keys", HFILL } \
2208 { & name .hf.sct_scts_length, \
2209 { "Serialized SCT List Length", prefix ".sct.scts_length", \
2210 FT_UINT16, BASE_DEC, NULL, 0x00, \
2213 { & name .hf.sct_sct_length, \
2214 { "Serialized SCT Length", prefix ".sct.sct_length", \
2215 FT_UINT16, BASE_DEC, NULL, 0x00, \
2218 { & name .hf.sct_sct_version, \
2219 { "SCT Version", prefix ".sct.sct_version", \
2220 FT_UINT8, BASE_DEC, NULL, 0x00, \
2221 "SCT Protocol version (v1 (0) is defined in RFC 6962)", HFILL } \
2223 { & name .hf.sct_sct_logid, \
2224 { "Log ID", prefix ".sct.sct_logid", \
2225 FT_BYTES, BASE_NONE, NULL, 0x00, \
2226 "SHA-256 hash of log's public key", HFILL } \
2228 { & name .hf.sct_sct_timestamp, \
2229 { "Timestamp", prefix ".sct.sct_timestamp", \
2230 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x00, \
2231 "Timestamp of issuance", HFILL } \
2233 { & name .hf.sct_sct_extensions_length, \
2234 { "Extensions length", prefix ".sct.sct_extensions_length", \
2235 FT_UINT16, BASE_DEC, NULL, 0x00, \
2236 "Length of future extensions to this protocol (currently none)", HFILL } \
2238 { & name .hf.sct_sct_extensions, \
2239 { "Extensions", prefix ".sct.sct_extensions", \
2240 FT_NONE, BASE_NONE, NULL, 0x00, \
2241 "Future extensions to this protocol (currently none)", HFILL } \
2243 { & name .hf.sct_sct_signature_length, \
2244 { "Signature Length", prefix ".sct.sct_signature_length", \
2245 FT_UINT16, BASE_DEC, NULL, 0x00, \
2248 { & name .hf.sct_sct_signature, \
2249 { "Signature", prefix ".sct.sct_signature", \
2250 FT_BYTES, BASE_NONE, NULL, 0x00, \
2253 { & name .hf.hs_ext_max_early_data_size, \
2254 { "Maximum Early Data Size", prefix ".early_data.max_early_data_size", \
2255 FT_UINT32, BASE_DEC, NULL, 0x00, \
2256 "Maximum amount of 0-RTT data that the client may send", HFILL } \
2258 { & name .hf.hs_ext_oid_filters_length, \
2259 { "OID Filters Length", prefix ".extension.oid_filters_length", \
2260 FT_UINT16, BASE_DEC, NULL, 0x00, \
2263 { & name .hf.hs_ext_oid_filters_oid_length, \
2264 { "Certificate Extension OID Length", prefix ".extension.oid_filters.oid_length", \
2265 FT_UINT8, BASE_DEC, NULL, 0x00, \
2268 { & name .hf.hs_ext_oid_filters_oid, \
2269 { "Certificate Extension OID", prefix ".extension.oid_filters.oid", \
2270 FT_OID, BASE_NONE, NULL, 0x00, \
2273 { & name .hf.hs_ext_oid_filters_values_length, \
2274 { "Certificate Extension Values Length", prefix ".extension.oid_filters.values_length", \
2275 FT_UINT16, BASE_DEC, NULL, 0x00, \
2278 { & name .hf.hs_cred_valid_time, \
2279 { "Valid Time", prefix ".handshake.cred.valid_time", \
2280 FT_UINT16, BASE_DEC, NULL, 0x0, \
2281 "Delegated Credentials Valid Time", HFILL } \
2283 { & name .hf.hs_cred_pubkey, \
2284 { "Subject Public Key Info", prefix ".handshake.cred.pubkey", \
2285 FT_BYTES, BASE_NONE, NULL, 0x0, \
2286 "Delegated Credentials Subject Public Key Info", HFILL } \
2288 { & name .hf.hs_cred_pubkey_len, \
2289 { "Subject Public Key Info Length", prefix ".handshake.cred.pubkey_len", \
2290 FT_UINT24, BASE_DEC, NULL, 0x0, \
2291 "Delegated Credentials Subject Public Key Info Length", HFILL } \
2293 { & name .hf.hs_cred_signature, \
2294 { "Signature", prefix ".handshake.cred.signature", \
2295 FT_BYTES, BASE_NONE, NULL, 0x0, \
2296 "Delegated Credentials Signature", HFILL } \
2298 { & name .hf.hs_cred_signature_len, \
2299 { "Signature Length", prefix ".handshake.cred.signature_len", \
2300 FT_UINT16, BASE_DEC, NULL, 0x0, \
2301 "Delegated Credentials Signature Length", HFILL } \
2303 { & name .hf.hs_ext_compress_certificate_algorithms_length, \
2304 { "Algorithms Length", prefix ".compress_certificate.algorithms_length", \
2305 FT_UINT8, BASE_DEC, NULL, 0x00, \
2308 { & name .hf.hs_ext_compress_certificate_algorithm, \
2309 { "Algorithm", prefix ".compress_certificate.algorithm", \
2310 FT_UINT16, BASE_DEC, VALS(compress_certificate_algorithm_vals), 0x00, \
2313 { & name .hf.hs_ext_compress_certificate_uncompressed_length, \
2314 { "Uncompressed Length", prefix ".compress_certificate.uncompressed_length", \
2315 FT_UINT24, BASE_DEC, NULL, 0x00, \
2318 { & name .hf.hs_ext_compress_certificate_compressed_certificate_message_length, \
2319 { "Length", prefix ".compress_certificate.compressed_certificate_message.length", \
2320 FT_UINT24, BASE_DEC, NULL, 0x00, \
2323 { & name .hf.hs_ext_compress_certificate_compressed_certificate_message, \
2324 { "Compressed Certificate Message", prefix ".compress_certificate.compressed_certificate_message", \
2325 FT_BYTES, BASE_NONE, NULL, 0x00, \
2328 { & name .hf.hs_ext_token_binding_version_major, \
2329 { "Protocol Major Version", prefix ".token_binding.version_major", \
2330 FT_UINT8, BASE_HEX, NULL, 0x00, \
2331 "Major version of the Token Binding protocol", HFILL } \
2333 { & name .hf.hs_ext_token_binding_version_minor, \
2334 { "Protocol Minor Version", prefix ".token_binding.version_minor", \
2335 FT_UINT8, BASE_HEX, NULL, 0x00, \
2336 "Minor version of the Token Binding protocol", HFILL } \
2338 { & name .hf.hs_ext_token_binding_key_parameters, \
2339 { "Key Parameters", prefix ".token_binding.key_parameters", \
2340 FT_NONE, BASE_NONE, NULL, 0x0, \
2343 { & name .hf.hs_ext_token_binding_key_parameters_length, \
2344 { "Key Parameters Length", prefix ".token_binding.key_parameters_length", \
2345 FT_UINT8, BASE_DEC, NULL, 0x00, \
2346 "Length of the key parameters list", HFILL } \
2348 { & name .hf.hs_ext_token_binding_key_parameter, \
2349 { "Key Parameter", prefix ".token_binding.key_parameter", \
2350 FT_UINT8, BASE_DEC, VALS(token_binding_key_parameter_vals), 0x00, \
2351 "Identifier of the Token Binding key parameter", HFILL } \
2353 { & name .hf.hs_ext_record_size_limit, \
2354 { "Record Size Limit", prefix ".record_size_limit", \
2355 FT_UINT16, BASE_DEC, NULL, 0x00, \
2356 "Maximum record size that an endpoint is willing to receive", HFILL } \
2358 { & name .hf.hs_ext_quictp_len, \
2359 { "Parameters Length", prefix ".quic.len", \
2360 FT_UINT16, BASE_DEC, NULL, 0x00, \
2363 { & name .hf.hs_ext_quictp_parameter, \
2364 { "Parameter", prefix ".quic.parameter", \
2365 FT_NONE, BASE_NONE, NULL, 0x00, \
2368 { & name .hf.hs_ext_quictp_parameter_type, \
2369 { "Type", prefix ".quic.parameter.type", \
2370 FT_UINT64, BASE_CUSTOM, CF_FUNC(quic_transport_parameter_id_base_custom), 0x00, \
2373 { & name .hf.hs_ext_quictp_parameter_len, \
2374 { "Length", prefix ".quic.parameter.length", \
2375 FT_UINT64, BASE_DEC, NULL, 0x00, \
2378 { & name .hf.hs_ext_quictp_parameter_len_old, \
2379 { "Length", prefix ".quic.parameter.length.old", \
2380 FT_UINT16, BASE_DEC, NULL, 0x00, \
2383 { & name .hf.hs_ext_quictp_parameter_value, \
2384 { "Value", prefix ".quic.parameter.value", \
2385 FT_BYTES, BASE_NONE, NULL, 0x00, \
2388 { & name .hf.hs_ext_quictp_parameter_original_destination_connection_id, \
2389 { "original_destination_connection_id", prefix ".quic.parameter.original_destination_connection_id", \
2390 FT_BYTES, BASE_NONE, NULL, 0x00, \
2391 "Destination Connection ID from the first Initial packet sent by the client", HFILL } \
2393 { & name .hf.hs_ext_quictp_parameter_max_idle_timeout, \
2394 { "max_idle_timeout", prefix ".quic.parameter.max_idle_timeout", \
2395 FT_UINT64, BASE_DEC, NULL, 0x00, \
2396 "In milliseconds", HFILL } \
2398 { & name .hf.hs_ext_quictp_parameter_stateless_reset_token, \
2399 { "stateless_reset_token", prefix ".quic.parameter.stateless_reset_token", \
2400 FT_BYTES, BASE_NONE, NULL, 0x00, \
2401 "Used in verifying a stateless reset", HFILL } \
2403 { & name .hf.hs_ext_quictp_parameter_max_udp_payload_size, \
2404 { "max_udp_payload_size", prefix ".quic.parameter.max_udp_payload_size", \
2405 FT_UINT64, BASE_DEC, NULL, 0x00, \
2406 "Maximum UDP payload size that the endpoint is willing to receive", HFILL } \
2408 { & name .hf.hs_ext_quictp_parameter_initial_max_data, \
2409 { "initial_max_data", prefix ".quic.parameter.initial_max_data", \
2410 FT_UINT64, BASE_DEC, NULL, 0x00, \
2411 "Contains the initial value for the maximum amount of data that can be sent on the connection", HFILL } \
2413 { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_local, \
2414 { "initial_max_stream_data_bidi_local", prefix ".quic.parameter.initial_max_stream_data_bidi_local", \
2415 FT_UINT64, BASE_DEC, NULL, 0x00, \
2416 "Initial stream maximum data for bidirectional, locally-initiated streams", HFILL } \
2418 { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_bidi_remote, \
2419 { "initial_max_stream_data_bidi_remote", prefix ".quic.parameter.initial_max_stream_data_bidi_remote", \
2420 FT_UINT64, BASE_DEC, NULL, 0x00, \
2421 "Initial stream maximum data for bidirectional, peer-initiated streams", HFILL } \
2423 { & name .hf.hs_ext_quictp_parameter_initial_max_stream_data_uni, \
2424 { "initial_max_stream_data_uni", prefix ".quic.parameter.initial_max_stream_data_uni", \
2425 FT_UINT64, BASE_DEC, NULL, 0x00, \
2426 "Initial stream maximum data for unidirectional streams parameter", HFILL } \
2428 { & name .hf.hs_ext_quictp_parameter_initial_max_streams_bidi, \
2429 { "initial_max_streams_bidi", prefix ".quic.parameter.initial_max_streams_bidi", \
2430 FT_UINT64, BASE_DEC, NULL, 0x00, \
2431 "Initial maximum number of application-owned bidirectional streams", HFILL } \
2433 { & name .hf.hs_ext_quictp_parameter_initial_max_streams_uni, \
2434 { "initial_max_streams_uni", prefix ".quic.parameter.initial_max_streams_uni", \
2435 FT_UINT64, BASE_DEC, NULL, 0x00, \
2436 "Initial maximum number of application-owned unidirectional streams", HFILL } \
2438 { & name .hf.hs_ext_quictp_parameter_ack_delay_exponent, \
2439 { "ack_delay_exponent", prefix ".quic.parameter.ack_delay_exponent", \
2440 FT_UINT64, BASE_DEC, NULL, 0x00, \
2441 "Indicating an exponent used to decode the ACK Delay field in the ACK frame,", HFILL } \
2443 { & name .hf.hs_ext_quictp_parameter_max_ack_delay, \
2444 { "max_ack_delay", prefix ".quic.parameter.max_ack_delay", \
2445 FT_UINT64, BASE_DEC, NULL, 0x00, \
2446 "Indicating the maximum amount of time in milliseconds by which it will delay sending of acknowledgments", HFILL } \
2448 { & name .hf.hs_ext_quictp_parameter_pa_ipv4address, \
2449 { "ipv4Address", prefix ".quic.parameter.preferred_address.ipv4address", \
2450 FT_IPv4, BASE_NONE, NULL, 0x00, \
2453 { & name .hf.hs_ext_quictp_parameter_pa_ipv6address, \
2454 { "ipv6Address", prefix ".quic.parameter.preferred_address.ipv6address", \
2455 FT_IPv6, BASE_NONE, NULL, 0x00, \
2458 { & name .hf.hs_ext_quictp_parameter_pa_ipv4port, \
2459 { "ipv4Port", prefix ".quic.parameter.preferred_address.ipv4port", \
2460 FT_UINT16, BASE_DEC, NULL, 0x00, \
2463 { & name .hf.hs_ext_quictp_parameter_pa_ipv6port, \
2464 { "ipv6Port", prefix ".quic.parameter.preferred_address.ipv6port", \
2465 FT_UINT16, BASE_DEC, NULL, 0x00, \
2468 { & name .hf.hs_ext_quictp_parameter_pa_connectionid_length, \
2469 { "Length", prefix ".quic.parameter.preferred_address.connectionid.length", \
2470 FT_UINT8, BASE_DEC, NULL, 0x00, \
2471 "Length of connectionId Field", HFILL } \
2473 { & name .hf.hs_ext_quictp_parameter_pa_connectionid, \
2474 { "connectionId", prefix ".quic.parameter.preferred_address.connectionid", \
2475 FT_BYTES, BASE_NONE, NULL, 0x00, \
2478 { & name .hf.hs_ext_quictp_parameter_pa_statelessresettoken, \
2479 { "statelessResetToken", prefix ".quic.parameter.preferred_address.statelessresettoken", \
2480 FT_BYTES, BASE_NONE, NULL, 0x00, \
2483 { & name .hf.hs_ext_quictp_parameter_active_connection_id_limit, \
2484 { "Active Connection ID Limit", prefix ".quic.parameter.active_connection_id_limit", \
2485 FT_UINT64, BASE_DEC, NULL, 0x00, \
2488 { & name .hf.hs_ext_quictp_parameter_initial_source_connection_id, \
2489 { "Initial Source Connection ID", prefix ".quic.parameter.initial_source_connection_id", \
2490 FT_BYTES, BASE_NONE, NULL, 0x00, \
2493 { & name .hf.hs_ext_quictp_parameter_retry_source_connection_id, \
2494 { "Retry Source Connection ID", prefix ".quic.parameter.retry_source_connection_id", \
2495 FT_BYTES, BASE_NONE, NULL, 0x00, \
2498 { & name .hf.hs_ext_quictp_parameter_max_datagram_frame_size, \
2499 { "max_datagram_frame_size", prefix ".quic.parameter.max_datagram_frame_size", \
2500 FT_UINT64, BASE_DEC, NULL, 0x00, \
2503 { & name .hf.hs_ext_quictp_parameter_cibir_encoding_length, \
2504 { "length", prefix ".quic.parameter.cibir_encoding.length", \
2505 FT_UINT64, BASE_DEC, NULL, 0x00, \
2508 { & name .hf.hs_ext_quictp_parameter_cibir_encoding_offset, \
2509 { "offset", prefix ".quic.parameter.cibir_encoding.offset", \
2510 FT_UINT64, BASE_DEC, NULL, 0x00, \
2513 { & name .hf.hs_ext_quictp_parameter_loss_bits, \
2514 { "loss_bits", prefix ".quic.parameter.loss_bits", \
2515 FT_UINT64, BASE_DEC, NULL, 0x00, \
2518 { & name .hf.hs_ext_quictp_parameter_enable_time_stamp_v2, \
2519 { "Enable TimestampV2", prefix ".quic.parameter.enable_time_stamp_v2", \
2520 FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_time_stamp_v2_vals), 0x00, \
2523 { & name .hf.hs_ext_quictp_parameter_min_ack_delay, \
2524 { "min_ack_delay", prefix ".quic.parameter.min_ack_delay", \
2525 FT_UINT64, BASE_DEC, NULL, 0x00, \
2528 { & name .hf.hs_ext_quictp_parameter_google_user_agent_id, \
2529 { "Google UserAgent", prefix ".quic.parameter.google.user_agent", \
2530 FT_STRING, BASE_NONE, NULL, 0x00, \
2533 { & name .hf.hs_ext_quictp_parameter_google_key_update_not_yet_supported, \
2534 { "Google Key Update not yet supported", prefix ".quic.parameter.google.key_update_not_yet_supported", \
2535 FT_NONE, BASE_NONE, NULL, 0x00, \
2538 { & name .hf.hs_ext_quictp_parameter_google_quic_version, \
2539 { "Google QUIC version", prefix ".quic.parameter.google.quic_version", \
2540 FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2543 { & name .hf.hs_ext_quictp_parameter_google_initial_rtt, \
2544 { "Google Initial RTT", prefix ".quic.parameter.google.initial_rtt", \
2545 FT_UINT64, BASE_DEC, NULL, 0x00, \
2548 { & name .hf.hs_ext_quictp_parameter_google_support_handshake_done, \
2549 { "Google Support Handshake Done", prefix ".quic.parameter.google.support_handshake_done", \
2550 FT_NONE, BASE_NONE, NULL, 0x00, \
2553 { & name .hf.hs_ext_quictp_parameter_google_quic_params, \
2554 { "Google QUIC parameters", prefix ".quic.parameter.google.quic_params", \
2555 FT_BYTES, BASE_NONE, NULL, 0x00, \
2558 { & name .hf.hs_ext_quictp_parameter_google_quic_params_unknown_field, \
2559 { "Google Unknown Field", prefix ".quic.parameter.google.quic_params_unknown_field", \
2560 FT_BYTES, BASE_NONE, NULL, 0x00, \
2563 { & name .hf.hs_ext_quictp_parameter_google_connection_options, \
2564 { "Google Connection options", prefix ".quic.parameter.google.connection_options", \
2565 FT_BYTES, BASE_NONE, NULL, 0x00, \
2568 { & name .hf.hs_ext_quictp_parameter_google_supported_versions_length, \
2569 { "Google Supported Versions Length", prefix ".quic.parameter.google.supported_versions_length", \
2570 FT_UINT8, BASE_DEC, NULL, 0x00, \
2573 { & name .hf.hs_ext_quictp_parameter_google_supported_version, \
2574 { "Google Supported Version", prefix ".quic.parameter.google.supported_version", \
2575 FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2578 { & name .hf.hs_ext_quictp_parameter_facebook_partial_reliability, \
2579 { "Facebook Partial Reliability", prefix ".quic.parameter.facebook.partial_reliability", \
2580 FT_UINT64, BASE_DEC, NULL, 0x00, \
2583 { & name .hf.hs_ext_quictp_parameter_chosen_version, \
2584 { "Chosen Version", prefix ".quic.parameter.vi.chosen_version", \
2585 FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2588 { & name .hf.hs_ext_quictp_parameter_other_version, \
2589 { "Other Version", prefix ".quic.parameter.vi.other_version", \
2590 FT_UINT32, BASE_RANGE_STRING | BASE_HEX, RVALS(quic_version_vals), 0x00, \
2593 { & name .hf.hs_ext_quictp_parameter_enable_multipath, \
2594 { "Enable Multipath", prefix ".quic.parameter.enable_multipath", \
2595 FT_UINT64, BASE_DEC|BASE_VAL64_STRING, VALS64(quic_enable_multipath_vals), 0x00, \
2598 { & name .hf.hs_ext_quictp_parameter_initial_max_paths, \
2599 { "Initial Max Paths", prefix ".quic.parameter.initial_max_paths", \
2600 FT_UINT64, BASE_DEC, NULL, 0x00, \
2603 { & name .hf.hs_ext_quictp_parameter_initial_max_path_id, \
2604 { "Initial Max Path ID", prefix ".quic.parameter.initial_max_path_id", \
2605 FT_UINT64, BASE_DEC, NULL, 0x00, \
2608 { & name .hf.hs_ext_connection_id_length, \
2609 { "Connection ID length", prefix ".connection_id_length", \
2610 FT_UINT8, BASE_DEC, NULL, 0x00, \
2613 { & name .hf.hs_ext_connection_id, \
2614 { "Connection ID", prefix ".connection_id", \
2615 FT_BYTES, BASE_NONE, NULL, 0x00, \
2618 { & name .hf.hs_ext_trusted_ca_keys_len, \
2619 { "Trusted CA keys length", prefix ".handshake.trusted_ca.keys_length", \
2620 FT_UINT16, BASE_DEC, NULL, 0x00, \
2621 "Length of Trusted CA keys extension", HFILL } \
2623 { & name .hf.hs_ext_trusted_ca_keys_list, \
2624 { "Trusted CA keys", prefix ".handshake.trusted_ca.keys", \
2625 FT_NONE, BASE_NONE, NULL, 0x00, \
2626 "List of Trusted CA keys", HFILL } \
2628 { & name .hf.hs_ext_trusted_ca_key, \
2629 { "Trusted CA key", prefix ".handshake.trusted_ca.key", \
2630 FT_NONE, BASE_NONE, NULL, 0x0, \
2633 { & name .hf.hs_ext_trusted_ca_key_type, \
2634 { "Trusted CA key type", prefix ".handshake.trusted_ca.key_type", \
2635 FT_UINT8, BASE_DEC, VALS(tls_hello_ext_trusted_ca_key_type), 0x00, \
2636 "Type of Trusted CA key", HFILL } \
2638 { & name .hf.hs_ext_trusted_ca_key_hash, \
2639 { "Trusted CA key hash", prefix ".handshake.trusted_ca.key_hash", \
2640 FT_BYTES, BASE_NONE, NULL, 0x00, \
2643 { & name .hf.hs_ext_trusted_ca_key_dname_len, \
2644 { "Distinguished Name Length", prefix ".handshake.trusted_ca.key_dname_len", \
2645 FT_UINT16, BASE_DEC, NULL, 0x0, \
2646 "Length of distinguished name", HFILL } \
2648 { & name .hf.hs_ext_trusted_ca_key_dname, \
2649 { "Distinguished Name", prefix ".handshake.trusted_ca.key_dname", \
2650 FT_NONE, BASE_NONE, NULL, 0x0, \
2651 "Distinguished name of a CA that the client trusts", HFILL } \
2653 { & name .hf.esni_suite, \
2654 { "Cipher Suite", prefix ".esni.suite", \
2655 FT_UINT16, BASE_HEX|BASE_EXT_STRING, &ssl_31_ciphersuite_ext, 0x0, \
2656 "Cipher suite used to encrypt the SNI", HFILL } \
2658 { & name .hf.esni_record_digest_length, \
2659 { "Record Digest Length", prefix ".esni.record_digest_length", \
2660 FT_UINT16, BASE_DEC, NULL, 0x00, \
2663 { & name .hf.esni_record_digest, \
2664 { "Record Digest", prefix ".esni.record_digest", \
2665 FT_BYTES, BASE_NONE, NULL, 0x00, \
2666 "Cryptographic hash of the ESNIKeys from which the ESNI key was obtained", HFILL } \
2668 { & name .hf.esni_encrypted_sni_length, \
2669 { "Encrypted SNI Length", prefix ".esni.encrypted_sni_length", \
2670 FT_UINT16, BASE_DEC, NULL, 0x00, \
2673 { & name .hf.esni_encrypted_sni, \
2674 { "Encrypted SNI", prefix ".esni.encrypted_sni", \
2675 FT_BYTES, BASE_NONE, NULL, 0x00, \
2676 "The encrypted ClientESNIInner structure", HFILL } \
2678 { & name .hf.esni_nonce, \
2679 { "Nonce", prefix ".esni.nonce", \
2680 FT_BYTES, BASE_NONE, NULL, 0x00, \
2681 "Contents of ClientESNIInner.nonce", HFILL } \
2683 { & name .hf.ech_echconfiglist_length, \
2684 { "ECHConfigList length", prefix ".ech.echconfiglist_length", \
2685 FT_UINT16, BASE_DEC, NULL, 0x0, \
2686 "Encrypted ClientHello (ECH) Configurations length", HFILL } \
2688 { & name .hf.ech_echconfiglist, \
2689 { "ECHConfigList", prefix ".ech.echconfiglist", \
2690 FT_NONE, BASE_NONE, NULL, 0x0, \
2691 "Encrypted ClientHello (ECH) Configurations", HFILL } \
2693 { & name .hf.ech_echconfig, \
2694 { "ECHConfig", prefix ".ech.echconfig", \
2695 FT_NONE, BASE_NONE, NULL, 0x0, \
2696 "Encrypted ClientHello (ECH) Configuration", HFILL } \
2698 { & name .hf.ech_echconfig_version, \
2699 { "Version", prefix ".ech.echconfig.version", \
2700 FT_UINT16, BASE_HEX, NULL, 0x0, \
2701 "Encrypted ClientHello: ECHConfig version", HFILL } \
2703 { & name .hf.ech_echconfig_length, \
2704 { "Length", prefix ".ech.echconfig.length", \
2705 FT_UINT16, BASE_DEC, NULL, 0x0, \
2706 "Encrypted ClientHello: ECHConfig length", HFILL } \
2708 { & name .hf.ech_echconfigcontents_maximum_name_length, \
2709 { "Maximum Name Length", prefix ".ech.echconfigcontents.maximum_name_length", \
2710 FT_UINT8, BASE_DEC, NULL, 0x0, \
2711 "The longest name of a backend server, if known", HFILL } \
2713 { & name .hf.ech_echconfigcontents_public_name_length, \
2714 { "Public Name length", prefix ".ech.echconfigcontents.public_name_length", \
2715 FT_UINT8, BASE_DEC, NULL, 0x0, \
2716 "Length of the Public Name field", HFILL } \
2718 { & name .hf.ech_echconfigcontents_public_name, \
2719 { "Public Name", prefix ".ech.echconfigcontents.public_name", \
2720 FT_STRING, BASE_NONE, NULL, 0x0, \
2721 "The DNS name of the client-facing server, i.e., the entity trusted to update the ECH configuration", HFILL } \
2723 { & name .hf.ech_echconfigcontents_extensions_length, \
2724 { "Extensions length", prefix ".ech.echconfigcontents.extensions_length", \
2725 FT_UINT16, BASE_DEC, NULL, 0x0, \
2726 "Length of the Extensions field", HFILL } \
2728 { & name .hf.ech_echconfigcontents_extensions, \
2729 { "Extensions", prefix ".ech.echconfigcontents.extensions", \
2730 FT_BYTES, BASE_NONE, NULL, 0x0, \
2731 "A list of extensions that the client must take into consideration when generating a ClientHello message", HFILL } \
2733 { & name .hf.ech_hpke_keyconfig, \
2734 { "HPKE Key Config", prefix ".ech.hpke.keyconfig", \
2735 FT_NONE, BASE_NONE, NULL, 0x0, \
2736 "HPKE Key Config", HFILL } \
2738 { & name .hf.ech_hpke_keyconfig_config_id, \
2739 { "Config Id", prefix ".ech.hpke.keyconfig.config_id", \
2740 FT_UINT8, BASE_DEC, NULL, 0x0, \
2741 "HPKE Config Id", HFILL } \
2743 { & name .hf.ech_hpke_keyconfig_kem_id, \
2744 { "KEM Id", prefix ".ech.hpke.keyconfig.kem_id", \
2745 FT_UINT16, BASE_DEC, VALS(kem_id_type_vals), 0x0, \
2746 "HPKE KEM Id", HFILL } \
2748 { & name .hf.ech_hpke_keyconfig_public_key_length, \
2749 { "Public Key length", prefix ".ech.hpke.keyconfig.public_key_length", \
2750 FT_UINT16, BASE_DEC, NULL, 0x0, \
2751 "HPKE Public Key length", HFILL } \
2753 { & name .hf.ech_hpke_keyconfig_public_key, \
2754 { "Public Key", prefix ".ech.hpke.keyconfig.public_key", \
2755 FT_BYTES, BASE_NONE, NULL, 0x0, \
2756 "HPKE Public Key", HFILL } \
2758 { & name .hf.ech_hpke_keyconfig_cipher_suites, \
2759 { "Cipher Suites", prefix ".ech.hpke.keyconfig.cipher_suites", \
2760 FT_NONE, BASE_NONE, NULL, 0x0, \
2761 "HPKE Cipher Suites", HFILL } \
2763 { & name .hf.ech_hpke_keyconfig_cipher_suites_length, \
2764 { "Cipher Suites length", prefix ".ech.hpke.keyconfig.cipher_suites_length", \
2765 FT_UINT16, BASE_DEC, NULL, 0x0, \
2766 "HPKE Cipher Suites length", HFILL } \
2768 { & name .hf.ech_hpke_keyconfig_cipher_suite, \
2769 { "Cipher Suite", prefix ".ech.hpke.keyconfig.cipher_suite", \
2770 FT_NONE, BASE_NONE, NULL, 0x0, \
2771 "HPKE Cipher Suite", HFILL } \
2773 { & name .hf.ech_hpke_keyconfig_cipher_suite_kdf_id, \
2774 { "KDF Id", prefix ".ech.hpke.keyconfig.cipher_suite.kdf_id", \
2775 FT_UINT16, BASE_DEC, VALS(kdf_id_type_vals), 0x0, \
2776 "HPKE KDF Id", HFILL } \
2778 { & name .hf.ech_hpke_keyconfig_cipher_suite_aead_id, \
2779 { "AEAD Id", prefix ".ech.hpke.keyconfig.cipher_suite.aead_id", \
2780 FT_UINT16, BASE_DEC, VALS(aead_id_type_vals), 0x0, \
2781 "HPKE AEAD Id", HFILL } \
2783 { & name .hf.ech_clienthello_type, \
2784 { "Client Hello type", prefix ".ech.client_hello_type", \
2785 FT_UINT8, BASE_DEC, VALS(tls_hello_ext_ech_clienthello_types), 0x0, \
2786 "Client Hello type", HFILL } \
2788 { & name .hf.ech_cipher_suite, \
2789 { "Cipher Suite", prefix ".ech.cipher_suite", \
2790 FT_NONE, BASE_NONE, NULL, 0x0, \
2791 "The cipher suite used to encrypt ClientHelloInner", HFILL } \
2793 { & name .hf.ech_config_id, \
2794 { "Config Id", prefix ".ech.config_id", \
2795 FT_UINT8, BASE_DEC, NULL, 0x0, \
2796 "The ECHConfigContents.key_config.config_id for the chosen ECHConfig", HFILL } \
2798 { & name .hf.ech_enc_length, \
2799 { "Enc length", prefix ".ech.enc_length", \
2800 FT_UINT16, BASE_DEC, NULL, 0x0, \
2803 { & name .hf.ech_enc, \
2804 { "Enc", prefix ".ech.enc", \
2805 FT_BYTES, BASE_NONE, NULL, 0x0, \
2806 "The HPKE encapsulated key, used by servers to decrypt the corresponding payload field", HFILL } \
2808 { & name .hf.ech_payload_length, \
2809 { "Payload length", prefix ".ech.payload_length", \
2810 FT_UINT16, BASE_DEC, NULL, 0x0, \
2811 "Payload Length", HFILL } \
2813 { & name .hf.ech_payload, \
2814 { "Payload", prefix ".ech.payload", \
2815 FT_BYTES, BASE_NONE, NULL, 0x0, \
2816 "The serialized and encrypted ClientHelloInner structure", HFILL } \
2818 { & name .hf.ech_confirmation, \
2819 { "Confirmation", prefix ".ech.confirmation", \
2820 FT_BYTES, BASE_NONE, NULL, 0x0, \
2821 "Confirmation of ECH acceptance in a HelloRetryRequest", HFILL } \
2823 { & name .hf.ech_retry_configs, \
2824 { "Retry Configs", prefix ".ech.retry_configs", \
2825 FT_NONE, BASE_NONE, NULL, 0x0, \
2826 "ECHConfig structures for one-time use by the client in a retry connection", HFILL } \
2828 { & name .hf.ech_padding_data, \
2829 { "ECH Encrypted Padding", prefix ".ech.encrypted_padding", \
2830 FT_BYTES, BASE_NONE, NULL, 0x0, \
2831 "Must be zero", HFILL } \
2833 { & name .hf.hs_ext_alps_len, \
2834 { "ALPS Extension Length", prefix ".handshake.extensions_alps_len", \
2835 FT_UINT16, BASE_DEC, NULL, 0x0, \
2836 "Length of the ALPS Extension", HFILL } \
2838 { & name .hf.hs_ext_alps_alpn_list, \
2839 { "Supported ALPN List", prefix ".handshake.extensions_alps_alpn_list", \
2840 FT_NONE, BASE_NONE, NULL, 0x0, \
2841 "List of supported ALPN by ALPS", HFILL } \
2843 { & name .hf.hs_ext_alps_alpn_str_len, \
2844 { "Supported ALPN Length", prefix ".handshake.extensions_alps_alpn_str_len", \
2845 FT_UINT8, BASE_DEC, NULL, 0x0, \
2846 "Length of ALPN string", HFILL } \
2848 { & name .hf.hs_ext_alps_alpn_str, \
2849 { "Supported ALPN", prefix ".handshake.extensions_alps_alpn_str", \
2850 FT_STRING, BASE_NONE, NULL, 0x00, \
2851 "ALPN supported by ALPS", HFILL } \
2853 { & name .hf.hs_ext_alps_settings, \
2854 { "ALPN Opaque Settings", prefix ".handshake.extensions_alps.settings", \
2855 FT_BYTES, BASE_NONE, NULL, 0x00, \
2856 "ALPN Opaque Settings", HFILL } \
2861#define SSL_COMMON_ETT_LIST(name) \
2862 & name .ett.hs_ext, \
2863 & name .ett.hs_ext_alpn, \
2864 & name .ett.hs_ext_cert_types, \
2865 & name .ett.hs_ext_groups, \
2866 & name .ett.hs_ext_curves_point_formats, \
2867 & name .ett.hs_ext_npn, \
2868 & name .ett.hs_ext_reneg_info, \
2869 & name .ett.hs_ext_key_share, \
2870 & name .ett.hs_ext_key_share_ks, \
2871 & name .ett.hs_ext_pre_shared_key, \
2872 & name .ett.hs_ext_psk_identity, \
2873 & name .ett.hs_ext_psk_binders, \
2874 & name .ett.hs_ext_psk_binder, \
2875 & name .ett.hs_ext_server_name, \
2876 & name .ett.hs_ext_oid_filter, \
2877 & name .ett.hs_ext_quictp_parameter, \
2878 & name .ett.hs_ext_trusted_ca_keys, \
2879 & name .ett.hs_ext_trusted_ca_key, \
2880 & name .ett.hs_sig_hash_alg, \
2881 & name .ett.hs_sig_hash_algs, \
2882 & name .ett.urlhash, \
2883 & name .ett.keyex_params, \
2884 & name .ett.certificates, \
2885 & name .ett.cert_types, \
2886 & name .ett.dnames, \
2887 & name .ett.hs_random, \
2888 & name .ett.cipher_suites, \
2889 & name .ett.comp_methods, \
2890 & name .ett.session_ticket, \
2892 & name .ett.cert_status, \
2893 & name .ett.ocsp_response, \
2894 & name .ett.uncompressed_certificates, \
2895 & name .ett.hs_ext_alps, \
2896 & name .ett.ech_echconfiglist, \
2897 & name .ett.ech_echconfig, \
2898 & name .ett.ech_retry_configs, \
2899 & name .ett.ech_hpke_keyconfig, \
2900 & name .ett.ech_hpke_cipher_suites, \
2901 & name .ett.ech_hpke_cipher_suite, \
2902 & name .ett.ech_decrypt, \
2903 & name .ett.hs_ext_token_binding_key_parameters, \
2908#define SSL_COMMON_EI_LIST(name, prefix) \
2909 { & name .ei.client_version_error, \
2910 { prefix ".handshake.client_version_error", PI_PROTOCOL, PI_WARN, \
2911 "Client Hello legacy version field specifies version 1.3, not version 1.2; some servers may not be able to handle that.", EXPFILL } \
2913 { & name .ei.server_version_error, \
2914 { prefix ".handshake.server_version_error", PI_PROTOCOL, PI_WARN, \
2915 "Server Hello legacy version field specifies version 1.3, not version 1.2; some middleboxes may not be able to handle that.", EXPFILL } \
2917 { & name .ei.legacy_version, \
2918 { prefix ".handshake.legacy_version", PI_DEPRECATED, PI_CHAT, \
2919 "This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.", EXPFILL } \
2921 { & name .ei.malformed_vector_length, \
2922 { prefix ".malformed.vector_length", PI_PROTOCOL, PI_WARN, \
2923 "Variable vector length is outside the permitted range", EXPFILL } \
2925 { & name .ei.malformed_buffer_too_small, \
2926 { prefix ".malformed.buffer_too_small", PI_MALFORMED, PI_ERROR, \
2927 "Malformed message, not enough data is available", EXPFILL } \
2929 { & name .ei.malformed_trailing_data, \
2930 { prefix ".malformed.trailing_data", PI_PROTOCOL, PI_WARN, \
2931 "Undecoded trailing data is present", EXPFILL } \
2933 { & name .ei.hs_ext_cert_status_undecoded, \
2934 { prefix ".handshake.status_request.undecoded", PI_UNDECODED, PI_NOTE, \
2935 "Responder ID list or Request Extensions are not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2937 { & name .ei.hs_ciphersuite_undecoded, \
2938 { prefix ".handshake.ciphersuite.undecoded", PI_UNDECODED, PI_NOTE, \
2939 "Ciphersuite not implemented, contact Wireshark developers if you want this to be supported", EXPFILL } \
2941 { & name .ei.hs_srv_keyex_illegal, \
2942 { prefix ".handshake.server_keyex_illegal", PI_PROTOCOL, PI_WARN, \
2943 "It is not legal to send the ServerKeyExchange message for this ciphersuite", EXPFILL } \
2945 { & name .ei.resumed, \
2946 { prefix ".resumed", PI_SEQUENCE, PI_NOTE, \
2947 "This session reuses previously negotiated keys (Session resumption)", EXPFILL } \
2949 { & name .ei.record_length_invalid, \
2950 { prefix ".record.length.invalid", PI_PROTOCOL, PI_ERROR, \
2951 "Record fragment length is too small or too large", EXPFILL } \
2953 { & name .ei.decompression_error, \
2954 { prefix ".decompression_error", PI_PROTOCOL, PI_ERROR, \
2955 "Decompression error", EXPFILL } \
2957 { & name .ei.ech_echconfig_invalid_version, \
2958 { prefix ".ech_echconfig_invalid_version", PI_PROTOCOL, PI_ERROR, \
2959 "Invalid/unknown ECHConfig version", EXPFILL } \
2961 { & name .ei.ech_accepted, \
2962 { prefix ".ech_accepted", PI_PROTOCOL, PI_NOTE, \
2963 "Calculated ECH Confirmation matches Server Random bytes, ECH was accepted", EXPFILL } \
2965 { & name .ei.ech_rejected, \
2966 { prefix ".ech_rejected", PI_PROTOCOL, PI_WARN, \
2967 "Calculated ECH Confirmation does not match Server Random bytes, ECH was rejected", EXPFILL } \
2972ssl_common_register_ssl_alpn_dissector_table(
const char *name,
2973 const char *ui_name,
const int proto);
2976ssl_common_register_dtls_alpn_dissector_table(
const char *name,
2977 const char *ui_name,
const int proto);
2982#ifdef SSL_DECRYPT_DEBUG
2984ssl_debug_printf(
const char* fmt,...) G_GNUC_PRINTF(1,2);
2986ssl_print_data(const
char* name, const
unsigned char* data,
size_t len);
2988ssl_print_string(const
char* name, const
StringInfo* data);
2990ssl_set_debug(const
char* name);
2992ssl_debug_flush(
void);
2996static inline void G_GNUC_PRINTF(1,2)
2997ssl_debug_printf(const
char* fmt _U_,...)
3000#define ssl_print_data(a, b, c)
3001#define ssl_print_string(a, b)
3002#define ssl_set_debug(name)
3003#define ssl_debug_flush()
3010 proto_tree *tree, uint32_t offset, uint32_t offset_end);
Definition packet-tls-utils.h:340
Definition packet-tls-utils.h:356
StringInfo dtls13_aad
Definition packet-tls-utils.h:367
StringInfo app_traffic_secret
Definition packet-tls-utils.h:370
uint64_t seq
Definition packet-tls-utils.h:366
Definition packet-tls-utils.c:2787
Definition packet-tls-utils.h:528
Definition packet-tls-utils.h:348
Definition packet-tls-utils.h:432
SslFlow * flow
Definition packet-tls-utils.h:438
uint64_t record_seq
Definition packet-tls-utils.h:440
unsigned data_len
Definition packet-tls-utils.h:434
uint32_t seq
Definition packet-tls-utils.h:441
int id
Definition packet-tls-utils.h:435
ContentType type
Definition packet-tls-utils.h:437
unsigned char * plain_data
Definition packet-tls-utils.h:433
Definition packet-tls-utils.h:468
Definition packet-tls-utils.h:265
Definition packet-tls-utils.h:449
unsigned reassembly_id
Definition packet-tls-utils.h:452
uint8_t type
Definition packet-tls-utils.h:454
int is_last
Definition packet-tls-utils.h:455
uint32_t offset
Definition packet-tls-utils.h:453
unsigned record_id
Definition packet-tls-utils.h:450
Definition packet_info.h:43
Definition value_string.h:298
Definition packet-tls-utils.h:570
Definition value_string.h:134
Definition value_string.h:171
Definition value_string.h:27
Definition wmem_list.c:23
Definition wmem_strbuf.h:42
Definition wmem_tree-int.h:48
Definition packet-tls-utils.h:427
Definition packet-tls-utils.h:459
Definition packet-tls-utils.h:564
Definition conversation.h:228
Definition packet-tls-utils.h:1241
Definition packet-tls-utils.h:1256
Definition prefs-int.h:27
Definition packet-tls-utils.h:865
Definition packet-tls-utils.h:578
Definition packet-tls-utils.h:1249
Definition packet-tls-utils.h:584
Definition tvbuff-int.h:35