tlsver.c

#include <stdio.h>
#include <ctype.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>
#include <stdarg.h>
#include <signal.h>
#include <string.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <sys/ioctl.h>
#include <netdb.h>
#include <netinet/in.h>
#include <net/if.h>
#include <unistd.h>
#include <ifaddrs.h>
#include <errno.h>

//
// Type definitions --------------------------------------------------------------------------------
//

enum tlsver_result {
  tlsver_result_done,
  tlsver_result_failed,
  tlsver_result_waitformore
};

struct tlsver_numstring {
  unsigned char id;
  const char* text;
};

//
// Protocol constants ------------------------------------------------------------------------------
//

//
// From draft-ietf-tls-tls13-26 and RFC 6066
//
//
// enum {
//   invalid(0),
//   change_cipher_spec(20),
//   alert(21),
//   handshake(22),
//   application_data(23),
//   (255)
// } ContentType;
//

#define TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_INVALID		 0
#define TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_CHANGECIPHERSPEC 20
#define TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_ALERT	 	 21
#define TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_HANDSHAKE	 22
#define TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_APPLICATIONDATA	 23

#define TLSVER_TLS_HANDSHAKETYPE_CLIENT_HELLO		  1
#define TLSVER_TLS_HANDSHAKETYPE_SERVER_HELLO		  2
#define TLSVER_TLS_HANDSHAKETYPE_NEW_SESSION_TICKET		  4
#define TLSVER_TLS_HANDSHAKETYPE_END_OF_EARLY_DATA		  5
#define TLSVER_TLS_HANDSHAKETYPE_ENCRYPTED_EXTENSIONS	  8
#define TLSVER_TLS_HANDSHAKETYPE_CERTIFICATE		 11
#define TLSVER_TLS_HANDSHAKETYPE_CERTIFICATE_REQUEST	 13
#define TLSVER_TLS_HANDSHAKETYPE_CERTIFICATE_VERIFY		 15
#define TLSVER_TLS_HANDSHAKETYPE_FINISHED			 20
#define TLSVER_TLS_HANDSHAKETYPE_CERTIFICATE_URL		 21
#define TLSVER_TLS_HANDSHAKETYPE_CERTIFICATE_STATUS		 22
#define TLSVER_TLS_HANDSHAKETYPE_KEY_UPDATE			 24
#define TLSVER_TLS_HANDSHAKETYPE_MESSAGE_HASH		254

static struct tlsver_numstring tlsver_messages[] = {
  {1, "client_hello"},
  {2, "server_hello"},
  {4, "new_session_ticket"},
  {5, "end_of_early_data"},
  {8, "encrypted_extensions"},
  {11, "certificate"},
  {13, "certificate_request"},
  {15, "certificate_verify"},
  {20, "finished"},
  {21, "certificate_url"},
  {22, "certificate_status"},
  {24, "key_update"},
  {254, "message_hash"},
  {0, 0},
};

#define TLSVER_TLS_HELLO_RANDOM_SIZE		         32
#define TLSVER_TLS_HELLO_SESSION_ID_SIZE_MAX	         32
#define TLSVER_TLS_HELLO_CIPHERSUITE		          0 /* ... */
#define TLSVER_TLS_HELLO_COMPRESSION_NULL			  0

#define TLSVER_EXTENSION_SERVER_NAME				0
#define TLSVER_EXTENSION_MAX_FRAGMENT_LENGTH			1
#define TLSVER_EXTENSION_STATUS_REQUEST				5
#define TLSVER_EXTENSION_SUPPORTED_GROUPS				10
#define TLSVER_EXTENSION_SIGNATURE_ALGORITHMS			13
#define TLSVER_EXTENSION_USE_SRTP					14
#define TLSVER_EXTENSION_HEARTBEAT					15
#define TLSVER_EXTENSION_APPLICATION_LAYER_PROTOCOL_NEGOTIATION	16
#define TLSVER_EXTENSION_SIGNED_CERTIFICATE_TIMESTAMP		18
#define TLSVER_EXTENSION_CLIENT_CERTIFICATE_TYPE			19
#define TLSVER_EXTENSION_SERVER_CERTIFICATE_TYPE			20
#define TLSVER_EXTENSION_PADDING					21
#define TLSVER_EXTENSION_PRE_SHARED_KEY				41
#define TLSVER_EXTENSION_EARLY_DATA					42
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS				43
#define TLSVER_EXTENSION_COOKIE					44
#define TLSVER_EXTENSION_PSK_KEY_EXCHANGE_MODES			45
#define TLSVER_EXTENSION_CERTIFICATE_AUTHORITIES			74
#define TLSVER_EXTENSION_OID_FILTERS				48
#define TLSVER_EXTENSION_POST_HANDSHAKE_AUTH			49
#define TLSVER_EXTENSION_SIGNATURE_ALGORITHMS_CERT			50
#define TLSVER_EXTENSION_KEY_SHARE					51

static struct tlsver_numstring tlsver_extensions[] = {
  {0, "server_name"},
  {1, "max_fragment_length"},
  {5, "status_request"},
  {10, "supported_groups"},
  {13, "signature_algorithms"},	
  {14, "use_srtp"},	
  {15, "heartbeat"},	
  {16, "application_layer_protocol_negotiation"},
  {18, "signed_certificate_timestamp"},
  {19, "client_certificate_type"},	
  {20, "server_certificate_type"},	
  {21, "padding"},	
  {41, "pre_shared_key"},
  {42, "early_data"},	
  {43, "supported_versions"},
  {44, "cookie"},	
  {45, "psk_key_exchange_modes"},	
  {74, "certificate_authorities"},	
  {48, "oid_filters"},
  {49, "post_handshake_auth"},	
  {50, "signature_algorithms_cert"},	
  {51, "key_share"},
  {0, 0},
};
  
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_N			(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET0_COUNT + \
										 TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET1_COUNT + \
										 TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET2_COUNT + \
										 TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET3_COUNT + \
										 TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET4_COUNT + \
										 TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET5_COUNT)
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET0_BASE		0x0303
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET0_COUNT		22
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET1_BASE		0x7f00
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET1_COUNT		27
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET2_BASE		0x0401
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET2_COUNT		4
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET3_BASE		0x0501
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET3_COUNT		4
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET4_BASE		0x0302
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET4_COUNT		1
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET5_BASE		0x0301
#define TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET5_COUNT		1

//
// Suites defined for TLS 1.3:
//

#define TLSVER_CIPHERSUITE_TLS_AES_128_GCM_SHA256			0x1301
#define TLSVER_CIPHERSUITE_TLS_AES_256_GCM_SHA384       		0x1302
#define TLSVER_CIPHERSUITE_TLS_CHACHA20_POLY1305_SHA256 		0x1303
#define TLSVER_CIPHERSUITE_TLS_AES_128_CCM_SHA256       		0x1304
#define TLSVER_CIPHERSUITE_TLS_AES_128_CCM_8_SHA256     		0x1305

//
// Older suites, from the TLS IANA registry. Excludes algorithms
// defined only in drafts, algorithsm with NULL, and some special
// algorithms.
//

#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_RC4_128_MD5	0x0004	//	[RFC5246][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_RC4_128_SHA	0x0005	//	[RFC5246][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_IDEA_CBC_SHA	0x0007	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_DES_CBC_SHA	0x0009	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_3DES_EDE_CBC_SHA	0x000A	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_DES_CBC_SHA	0x000C	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA	0x000D	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_DES_CBC_SHA	0x000F	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA	0x0010	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_DES_CBC_SHA	0x0012	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA	0x0013	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_DES_CBC_SHA	0x0015	//	[RFC5469]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA	0x0016	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_CBC_SHA	0x002F	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_128_CBC_SHA	0x0030	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_128_CBC_SHA	0x0031	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_128_CBC_SHA	0x0032	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA	0x0033	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_128_CBC_SHA	0x0034	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_CBC_SHA	0x0035	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_256_CBC_SHA	0x0036	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_256_CBC_SHA	0x0037	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_256_CBC_SHA	0x0038	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA	0x0039	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_256_CBC_SHA	0x003A	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_CBC_SHA256	0x003C	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_CBC_SHA256	0x003D	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_128_CBC_SHA256	0x003E	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_128_CBC_SHA256	0x003F	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_128_CBC_SHA256	0x0040	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA	0x0041	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA	0x0042	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA	0x0043	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA	0x0044	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA	0x0045	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA	0x0046	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256	0x0067	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_256_CBC_SHA256	0x0068	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_256_CBC_SHA256	0x0069	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_256_CBC_SHA256	0x006A	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256	0x006B	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_128_CBC_SHA256	0x006C	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_256_CBC_SHA256	0x006D	//	[RFC5246]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA	0x0084	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA	0x0085	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA	0x0086	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA	0x0087	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA	0x0088	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA	0x0089	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_RC4_128_SHA	0x008A	//	[RFC4279][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_3DES_EDE_CBC_SHA	0x008B	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_128_CBC_SHA	0x008C	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_256_CBC_SHA	0x008D	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_RC4_128_SHA	0x008E	//	[RFC4279][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA	0x008F	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA	0x0090	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA	0x0091	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_RC4_128_SHA	0x0092	//	[RFC4279][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA	0x0093	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_128_CBC_SHA	0x0094	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_256_CBC_SHA	0x0095	//	[RFC4279]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_SEED_CBC_SHA	0x0096	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_SEED_CBC_SHA	0x0097	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_SEED_CBC_SHA	0x0098	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_SEED_CBC_SHA	0x0099	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_SEED_CBC_SHA	0x009A	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_SEED_CBC_SHA	0x009B	//	[RFC4162]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_GCM_SHA256	0x009C	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_GCM_SHA384	0x009D	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	0x009E	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	0x009F	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_128_GCM_SHA256	0x00A0	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_AES_256_GCM_SHA384	0x00A1	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_128_GCM_SHA256	0x00A2	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_AES_256_GCM_SHA384	0x00A3	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_128_GCM_SHA256	0x00A4	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_AES_256_GCM_SHA384	0x00A5	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_128_GCM_SHA256	0x00A6	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_256_GCM_SHA384	0x00A7	//	[RFC5288]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_128_GCM_SHA256	0x00A8	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_256_GCM_SHA384	0x00A9	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256	0x00AA	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384	0x00AB	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256	0x00AC	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384	0x00AD	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_128_CBC_SHA256	0x00AE	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_256_CBC_SHA384	0x00AF	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256	0x00B2	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384	0x00B3	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256	0x00B6	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384	0x00B7	//	[RFC5487]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256	0x00BA	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256	0x00BB	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256	0x00BC	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256	0x00BD	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256	0x00BE	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256	0x00BF	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256	0x00C0	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256	0x00C1	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256	0x00C2	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256	0x00C3	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256	0x00C4	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256	0x00C5	//	[RFC5932]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA	0xC002	//	[RFC-ietf-tls-rfc4492bis-17][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA	0xC003	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA	0xC004	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA	0xC005	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA	0xC007	//	[RFC-ietf-tls-rfc4492bis-17][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA	0xC008	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA	0xC009	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA	0xC00A	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_RC4_128_SHA	0xC00C	//	[RFC-ietf-tls-rfc4492bis-17][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA	0xC00D	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA	0xC00E	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA	0xC00F	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_RC4_128_SHA	0xC011	//	[RFC-ietf-tls-rfc4492bis-17][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA	0xC012	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	0xC013	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	0xC014	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_anon_WITH_RC4_128_SHA	0xC016	//	[RFC-ietf-tls-rfc4492bis-17][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA	0xC017	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_anon_WITH_AES_128_CBC_SHA	0xC018	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_anon_WITH_AES_256_CBC_SHA	0xC019	//	[RFC-ietf-tls-rfc4492bis-17]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA	0xC01A	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA	0xC01B	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA	0xC01C	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_WITH_AES_128_CBC_SHA	0xC01D	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA	0xC01E	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA	0xC01F	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_WITH_AES_256_CBC_SHA	0xC020	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA	0xC021	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA	0xC022	//	[RFC5054]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	0xC023	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	0xC024	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256	0xC025	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384	0xC026	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	0xC027	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	0xC028	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256	0xC029	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384	0xC02A	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	0xC02B	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	0xC02C	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256	0xC02D	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384	0xC02E	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	0xC02F	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	0xC030	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256	0xC031	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384	0xC032	//	[RFC5289]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_RC4_128_SHA	0xC033	//	[RFC5489][RFC6347]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA	0xC034	//	[RFC5489]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA	0xC035	//	[RFC5489]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA	0xC036	//	[RFC5489]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256	0xC037	//	[RFC5489]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384	0xC038	//	[RFC5489]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_ARIA_128_CBC_SHA256	0xC03C	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_ARIA_256_CBC_SHA384	0xC03D	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256	0xC03E	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384	0xC03F	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256	0xC040	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384	0xC041	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256	0xC042	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384	0xC043	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256	0xC044	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384	0xC045	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_ARIA_128_CBC_SHA256	0xC046	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_ARIA_256_CBC_SHA384	0xC047	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256	0xC048	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384	0xC049	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256	0xC04A	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384	0xC04B	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256	0xC04C	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384	0xC04D	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256	0xC04E	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384	0xC04F	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_ARIA_128_GCM_SHA256	0xC050	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_ARIA_256_GCM_SHA384	0xC051	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256	0xC052	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384	0xC053	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256	0xC054	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384	0xC055	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256	0xC056	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384	0xC057	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256	0xC058	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384	0xC059	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_ARIA_128_GCM_SHA256	0xC05A	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_ARIA_256_GCM_SHA384	0xC05B	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256	0xC05C	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384	0xC05D	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256	0xC05E	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384	0xC05F	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256	0xC060	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384	0xC061	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256	0xC062	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384	0xC063	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_ARIA_128_CBC_SHA256	0xC064	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_ARIA_256_CBC_SHA384	0xC065	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256	0xC066	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384	0xC067	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256	0xC068	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384	0xC069	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_ARIA_128_GCM_SHA256	0xC06A	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_ARIA_256_GCM_SHA384	0xC06B	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256	0xC06C	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384	0xC06D	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256	0xC06E	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384	0xC06F	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256	0xC070	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384	0xC071	//	[RFC6209]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256	0xC072	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384	0xC073	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256	0xC074	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384	0xC075	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256	0xC076	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384	0xC077	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256	0xC078	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384	0xC079	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256	0xC07A	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384	0xC07B	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256	0xC07C	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384	0xC07D	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256	0xC07E	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384	0xC07F	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256	0xC080	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384	0xC081	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256	0xC082	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384	0xC083	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256	0xC084	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384	0xC085	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256	0xC086	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384	0xC087	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256	0xC088	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384	0xC089	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256	0xC08A	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384	0xC08B	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256	0xC08C	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384	0xC08D	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256	0xC08E	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384	0xC08F	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256	0xC090	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384	0xC091	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256	0xC092	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384	0xC093	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256	0xC094	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384	0xC095	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256	0xC096	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384	0xC097	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256	0xC098	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384	0xC099	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256	0xC09A	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384	0xC09B	//	[RFC6367]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_CCM	0xC09C	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_CCM	0xC09D	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_128_CCM	0xC09E	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_256_CCM	0xC09F	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_CCM_8	0xC0A0	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_CCM_8	0xC0A1	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_128_CCM_8	0xC0A2	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_AES_256_CCM_8	0xC0A3	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_128_CCM	0xC0A4	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_256_CCM	0xC0A5	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_128_CCM	0xC0A6	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_AES_256_CCM	0xC0A7	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_128_CCM_8	0xC0A8	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_AES_256_CCM_8	0xC0A9	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_DHE_WITH_AES_128_CCM_8	0xC0AA	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_DHE_WITH_AES_256_CCM_8	0xC0AB	//	[RFC6655]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM	0xC0AC	//	[RFC7251]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM	0xC0AD	//	[RFC7251]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8	0xC0AE	//	[RFC7251]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8	0xC0AF	//	[RFC7251]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	0xCCA8	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256	0xCCA9	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256	0xCCAA	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256	0xCCAB	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256	0xCCAC	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256	0xCCAD	//	[RFC7905]
#define TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256	0xCCAE	//	[RFC7905]

//
// Supported froups, from draft-ietf-tls-tls13-26:
//

#define TLSVER_SUPPORTED_GROUP_SECP256R1	0x0017
#define TLSVER_SUPPORTED_GROUP_SECP384R1	0x0018
#define TLSVER_SUPPORTED_GROUP_SECP521R1	0x0019
#define TLSVER_SUPPORTED_GROUP_X25519	0x001D
#define TLSVER_SUPPORTED_GROUP_X448		0x001E
#define TLSVER_SUPPORTED_GROUP_FFDHE2048	0x0100
#define TLSVER_SUPPORTED_GROUP_FFDHE3072	0x0101
#define TLSVER_SUPPORTED_GROUP_FFDHE4096	0x0102
#define TLSVER_SUPPORTED_GROUP_FFDHE6144	0x0103
#define TLSVER_SUPPORTED_GROUP_FFDHE8192	0x0104

//
// Signature algorithms, from draft-ietf-tls-tls13-26:
//

#define TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA256		0x0401
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA384		0x0501
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA512		0x0601
#define TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP256R1_SHA256	0x0403
#define TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP384R1_SHA384	0x0503
#define TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP521R1_SHA512	0x0603
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA256	0x0804
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA384	0x0805
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA512	0x0806
#define TLSVER_SIGNATURE_ALGORITHM_ED25519			0x0807
#define TLSVER_SIGNATURE_ALGORITHM_ED448			0x0808
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA256	0x0809
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA384	0x080a
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA512	0x080b
#define TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA1		0x0201
#define TLSVER_SIGNATURE_ALGORITHM_ECDSA_SHA1		0x0203

//
// Version numbers
//

//
// From RFC 5246:
//
//   TLS Version 1.2, which uses the version { 3, 3 }.  The
//   version value 3.3 is historical, deriving from the use of {3, 1}
//   for TLS 1.0.
//
// And from RFC 4346:
//
//   The version of the protocol being employed.  This document
//   describes TLS Version 1.1, which uses the version { 3, 2 }.  The
//   version value 3.2 is historical: TLS version 1.1 is a minor
//   modification to the TLS 1.0 protocol, which was itself a minor
//   modification to the SSL 3.0 protocol, which bears the version
//   value 3.0.
//
// And from draft-ietf-tls-tls13-26:
//
//   While the eventual version indicator for the RFC version of TLS 1.3
//   will be 0x0304, implementations of draft versions of this
//   specification SHOULD instead advertise 0x7f00 | draft_version in the
//   ServerHello and HelloRetryRequest "supported_versions" extension.
//   For instance, draft-17 would be encoded as the 0x7f11.  This allows
//   pre-RFC implementations to safely negotiate with each other, even if
//   they would otherwise be incompatible.
//

#define TLSVER_TLS_HELLO_LEGACY_VERSION_10			0x0301
#define TLSVER_TLS_HELLO_LEGACY_VERSION_11			0x0302
#define TLSVER_TLS_HELLO_LEGACY_VERSION_12			0x0303
#define TLSVER_TLS_HELLO_TLS_VERSION_13				0x0304
#define TLSVER_TLS_HELLO_TLS_VERSION_13_IS_DRAFT(v)		(((v)&0xff00) == 0x7f00)
#define TLSVER_TLS_HELLO_TLS_VERSION_13_DRAFT_VER(v)		(((v)&0x00ff))
#define TLSVER_TLS_HELLO_TLS_VERSION_IS_VALID(v)		(((v)>>8) >= 0x03 && ((v)&0xFF) >= 0x01)
#define TLSVER_TLS_HELLO_TLS_VERSION_MAJOR(v)			((((v)>>8) == 0x7F) ? 1 : (((v)>>8) - 2))
#define TLSVER_TLS_HELLO_TLS_VERSION_MINOR(v)			((((v)>>8) == 0x7F) ? 3 : (((v)&0xFF) - 1))

//
// TLS alerts, taken from IANA TLS registry
// (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml)
//

static struct tlsver_numstring tlsver_alerts[] = {
  {0, "close_notify"},
  {10, "unexpected_message"},
  {20, "bad_record_mac"},
  {21, "decryption_failed"},
  {22, "record_overflow"},
  {30, "decompression_failure"},
  {40, "handshake_failure"},
  {41, "no_certificate_reserved"},
  {42, "bad_certificate"},
  {43, "unsupported_certificate"},
  {44, "certificate_revoked"},
  {45, "certificate_expired"},
  {46, "certificate_unknown"},
  {47, "illegal_parameter"},
  {48, "unknown_ca"},
  {49, "access_denied"},
  {50, "decode_error"},
  {51, "decrypt_error"},
  {60, "export_restriction_reserved"},
  {70, "protocol_version"},
  {71, "insufficient_security"},
  {80, "internal_error"},
  {86, "inappropriate_fallback"},
  {90, "user_canceled"},
  {100, "no_renegotiation"},
  {109, "missing_extension"},
  {110, "unsupported_extension"},
  {111, "certificate_unobtainable"},
  {112, "unrecognized_name"},
  {113, "bad_certificate_status_response"},
  {114, "bad_certificate_hash_value"},
  {115, "unknown_psk_identity"},
  {116, "certificate_required"},
  {120, "no_application_protocol"},
  {0, 0}
};
  
//
// Capacity, size, etc. definitions -----------------------------------------------------
//

#define TLSVER_MAX_TEST_DESTINATIONS			 100
#define TLSVER_MAXMSGSIZE			       16384
#define TLSVER_MAX_HOSTNAME_LENGTH			 255 // RFC 2181
#define TLSVER_MAXWAIT_USECS		  (10 * 1000 * 1000)
#define TLSVER_MAXWAIT_CONNECT_SECS			   3

//
// Some helper macros -------------------------------------------------------------------
//

#define assert(cond)	if (!(cond)) {                             	\
	                                  fatalf("Assertion failed on %s line %u", 	\
        	                                 __FILE__, __LINE__);		   	\
                	                }
#define compareexpectedresult(got,op,expected,what)				\
  if (!((got) op (expected))) {								\
    warnf("received " what " was unexpected, %u (0x%x) while expecting %u (0x%x)",	\
	  (got), (got),									\
	  (expected), (expected));							\
    return(0);										\
  }
#define compareexpectedresult_cont(got,op,expected,what)			\
  if (!((got) op (expected))) {								\
    warnf("received " what " was unexpected, %u (0x%x) while expecting %u (0x%x)",	\
	  (got), (got),									\
	  (expected), (expected));							\
    return(tlsver_result_failed);						\
  }

//
// Configuration parameters and their defaults --------------------------------------------
//

unsigned int nTestDestinations = 1;
char* testDestinations[TLSVER_MAX_TEST_DESTINATIONS] = {
  "www.google.com"
};

unsigned int port = 443;
int debug = 0;
int quiet = 0;
int draft = 1;
int sni = 1;
int compact = 0;
int detailedReporting = 0;
unsigned long connectSecs = TLSVER_MAXWAIT_CONNECT_SECS;

//
// Other Variables --------------------------------------------------------
//

static int interrupt = 0;
static unsigned short version_record = 0;
static unsigned short version_hello = 0;
static unsigned short version_supported = 0;
static struct timeval startTime;

//
// Prototype definitions of functions ------------------------------------
//

static void
fatalf(const char* format, ...);
static unsigned int
bufferremaining(unsigned int bufferLength,
			    unsigned int* position);
static int
getfrombuffer_u8(unsigned char* result,
			     const unsigned char* buffer,
			     unsigned int bufferLength,
			     unsigned int* position);
static int
getfrombuffer_u16(unsigned short* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position);
static int
getfrombuffer_u24(unsigned int* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position);
static int
getfrombuffer_u32(unsigned int* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position);

//
// Functions -------------------------------------------------------------
//

//
// Debug helper function
//

static void
debugf(const char* format, ...) {

  assert(format != 0);
  
  if (debug) {

    va_list args;

    printf("tlsver: debug: ");
    va_start (args, format);
    vprintf(format, args);
    va_end (args);
    printf("\n");
    
  }
  
}

//
// Display a warning
//

static void
warnf(const char* format, ...) {

  va_list args;
  
  assert(format != 0);

  if (!quiet) {
    
    fprintf(stderr,"tlsver: warning: ");
    va_start (args, format);
    vfprintf(stderr, format, args);
    va_end (args);
    fprintf(stderr,"\n");
    
  }
  
}

//
// Display a fatal error
//

static void
fatalf(const char* format, ...) {
  
  va_list args;
  
  assert(format != 0);
  
  if (!quiet) {
    
    fprintf(stderr,"tlsver: error: ");
    va_start (args, format);
    vfprintf(stderr, format, args);
    va_end (args);
    fprintf(stderr," -- exit\n");
    
  }
  
  exit(1);
}

//
// Display a fatal error a la perror
//

static void
fatalp(const char* message) {
  
  const char* string = strerror(errno);
  assert(message != 0);
  fatalf("system: %s", string);
  
}

//
// Interrupts (Ctrl-C) during program execution should cause the
// current process to end and results printed out.
//

static void
tlsver_interrupt(int dummy) {
  interrupt = 1;
}

//
// Time subtraction
//

static unsigned long long
timediffinusecs(struct timeval* later,
			    struct timeval* earlier) {
  
  assert(earlier != 0);
  assert(later != 0);
  
  if (later->tv_sec < earlier->tv_sec) {
    fatalf("expected later time to be greater, second go back %uls", earlier->tv_sec - later->tv_sec);
  }
  if (later->tv_sec == earlier->tv_sec) {
    if (later->tv_usec < earlier->tv_usec) {
      fatalf("expected later time to be greater, microsecond go back %uls", earlier->tv_usec - later->tv_usec);
    }
    return(later->tv_usec - earlier->tv_usec);
  } else {
    unsigned long long result = 1000 * 1000 * (later->tv_sec - earlier->tv_sec);
    result += (1000*1000) - earlier->tv_usec;
    result += later->tv_usec;
    return(result);
  }
}

//
// Add a byte to the buffer
//

static void
addtobuffer_u8(unsigned char byte,
			   const char* what,
			   unsigned char* buffer,
			   unsigned int bufferLength,
			   unsigned int* messageLength) {
  
  if (*messageLength > bufferLength - 1) fatalf("out of buffer space");
  buffer[(*messageLength)++] = byte;
  debugf("  %s: %02x", what, byte);
  
}

//
// Add an uint16 to the buffer
//

static void
addtobuffer_u16(unsigned short value,
			    const char* what,
			    unsigned char* buffer,
			    unsigned int bufferLength,
			    unsigned int* messageLength) {
  
  if (*messageLength > bufferLength - 2) fatalf("out of buffer space");
  buffer[(*messageLength)++] = (unsigned char)((value >> 8) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 0) & 0xFF);
  debugf("  %s: %04x", what, value);
  
}

//
// Put an uint16 to the buffer at a place previously already
// allocated. This is used for length fields etc that need to
// be put in at the end of constructing the rest of the message.
//

static void
puttobuffer_u16(unsigned short value,
			    unsigned int position,
			    const char* what,
			    unsigned char* buffer,
			    unsigned int bufferLength,
			    unsigned int* messageLength) {
  
  assert(position < (*messageLength) - 2);
  debugf("editing u16 at position %u to be %u", position, value);
  buffer[position] = (unsigned char)((value >> 8) & 0xFF);
  buffer[position+1] = (unsigned char)((value >> 0) & 0xFF);
  
}

//
// Put an uint16 to the buffer at a place previously already
// allocated. This is used for length fields etc that need to
// be put in at the end of constructing the rest of the message.
//

static void
puttobuffer_u24(unsigned int value,
			    unsigned int position,
			    const char* what,
			    unsigned char* buffer,
			    unsigned int bufferLength,
			    unsigned int* messageLength) {
  
  assert(position < (*messageLength) - 3);
  debugf("editing u24 at position %u to be %u", position, value);
  buffer[position] = (unsigned char)((value >> 16) & 0xFF);
  buffer[position+1] = (unsigned char)((value >> 8) & 0xFF);
  buffer[position+2] = (unsigned char)((value >> 0) & 0xFF);
  
}

//
// Add an uint24 to the buffer
//

static void
addtobuffer_u24(unsigned int value,
			    const char* what,
			    unsigned char* buffer,
			    unsigned int bufferLength,
			    unsigned int* messageLength) {
  
  if (*messageLength > bufferLength - 3) fatalf("out of buffer space");
  buffer[(*messageLength)++] = (unsigned char)((value >> 16) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 8) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 0) & 0xFF);
  debugf("  %s: %06x", what, value);
  
}

//
// Add an uint32 to the buffer
//

static void
addtobuffer_u32(unsigned int value,
			    const char* what,
			    unsigned char* buffer,
			    unsigned int bufferLength,
			    unsigned int* messageLength) {
  
  if (*messageLength > bufferLength - 3) fatalf("out of buffer space");
  buffer[(*messageLength)++] = (unsigned char)((value >> 24) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 16) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 8) & 0xFF);
  buffer[(*messageLength)++] = (unsigned char)((value >> 0) & 0xFF);
  
  debugf("  %s: %08x", what, value);
}

static void
addtobuffer_data(const char *data,
			     unsigned int dataLength,
			     const char* what,
			     unsigned char* buffer,
			     unsigned int bufferLength,
			     unsigned int* messageLength) {

  if (*messageLength > bufferLength - dataLength) fatalf("out of buffer space");
  memcpy((void*)(buffer + *messageLength),(const void*)data,dataLength);
  *messageLength += dataLength;
  debugf("  %s: %s", what, data);

}

static unsigned int
bufferremaining(unsigned int bufferLength,
			    unsigned int* position) {
  debugf("bufferremaining position %u buffer size %u: %u remains", *position, bufferLength, bufferLength - *position);
  assert(*position <= bufferLength);
  return(bufferLength - *position);
}

//
// Skip data in the buffer
//

static int
getfrombuffer_skipbytes(unsigned int count,
				    const char* what,
				    const unsigned char* buffer,
				    unsigned int bufferLength,
				    unsigned int* position) {
  if (bufferremaining(bufferLength,position) < count) {
    warnf("not enough bytes in message to skip %u bytes for %s", count, what);
    return(0);
  }
  
  *position += count;
  return(1);
  
}

//
// Skip data in the buffer
//

static int
getfrombuffer_skipvector(unsigned int lengthFieldSize,
				     const unsigned char* buffer,
				     unsigned int bufferLength,
				     unsigned int* position) {
  unsigned char len8;
  unsigned short len16;
  unsigned int len32;
  unsigned int len;

  //
  // Get length field, in different ways depending on the size of the length fielfd
  //
  
  switch (lengthFieldSize) {
  case 1:
    if (!getfrombuffer_u8(&len8,buffer,bufferLength,position)) return(0);
    len = (unsigned int)len8;
    break;
  case 2:
    if (!getfrombuffer_u16(&len16,buffer,bufferLength,position)) return(0);
    len = (unsigned int)len16;
    break;
  case 3:
    if (!getfrombuffer_u32(&len32,buffer,bufferLength,position)) return(0);
    len = (unsigned int)len32;
    break;
  case 4:
    if (!getfrombuffer_u32(&len32,buffer,bufferLength,position)) return(0);
    len = (unsigned int)len32;
    break;
  default:
    fatalf("unsupported length size", lengthFieldSize);
    return(0);
  }

  //
  // Get actual contents
  //

  if (!getfrombuffer_skipbytes(len,"a vector",buffer,bufferLength,position)) return(0);

  //
  // Success
  //
  
  return(1);
  
}

//
// Get an u8 from a buffer
//

static int
getfrombuffer_u8(unsigned char* result,
			     const unsigned char* buffer,
			     unsigned int bufferLength,
			     unsigned int* position) {
  if (bufferremaining(bufferLength,position) < 1) {
    warnf("not enough bytes in message to retrieve a byte");
    return(0);
  }
  
  *result = buffer[(*position)++];
  return(1);
  
}

//
// Get an u16 from a buffer
//

static int
getfrombuffer_u16(unsigned short* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position) {
  if (bufferremaining(bufferLength,position) < 2) {
    warnf("not enough bytes in message to retrieve a u16");
    return(0);
  }
  
  *result = ((buffer[(*position)++] << 8) +
 	     (buffer[(*position)++] << 0));
  return(1);
  
}

//
// Get an u24 from a buffer
//

static int
getfrombuffer_u24(unsigned int* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position) {
  if (bufferremaining(bufferLength,position) < 3) {
    warnf("not enough bytes in message to retrieve a u24");
    return(0);
  }
  
  *result = ((buffer[(*position)++] << 16) +
	     (buffer[(*position)++] << 8) +
 	     (buffer[(*position)++] << 0));
  return(1);
  
}

//
// Get an u32 from a buffer
//

static int
getfrombuffer_u32(unsigned int* result,
			      const unsigned char* buffer,
			      unsigned int bufferLength,
			      unsigned int* position) {
  if (bufferremaining(bufferLength,position) < 4) {
    warnf("not enough bytes in message to retrieve a u32");
    return(0);
  }
  
  *result = ((buffer[(*position)++] << 24) +
	     (buffer[(*position)++] << 16) +
	     (buffer[(*position)++] << 8) +
 	     (buffer[(*position)++] << 0));
  return(1);
  
}

//
// Debugging display of messages
//

static void
showbytes(const char* what,
		      const unsigned char* message,
		      unsigned int length) {
  
  if (debug) {
    unsigned int i;
    printf("%s: ", what);
    for (i = 0; i < length; i++) {
      printf("%02x", (unsigned int)message[i]);
    }
    printf("\n");
  }
}

//
// Add a session id to the message
//

static void
tlsver_addsessionid(unsigned char* buffer,
				unsigned int bufferLength,
				unsigned int* messageLength) {

  if (compact) {
    
    addtobuffer_u8(1,"id length",buffer,bufferLength,messageLength);
    addtobuffer_u8(1,"id",buffer,bufferLength,messageLength);
    
  } else {
    
    addtobuffer_u8(TLSVER_TLS_HELLO_SESSION_ID_SIZE_MAX,"id length",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 0-3",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 4-7",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 8-11",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 12-15",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 16-19",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 20-23",buffer,bufferLength,messageLength);
    addtobuffer_u32(0,"id bytes 24-27",buffer,bufferLength,messageLength);
    addtobuffer_u32(1,"id bytes 28-31",buffer,bufferLength,messageLength);
  
  }
}

//
// Add cipher suites to the message
//

static void
tlsver_addciphersuites(unsigned char* buffer,
				   unsigned int bufferLength,
				   unsigned int* messageLength) {

  if (compact) {
    addtobuffer_u16(2*4,"cipher suites length",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_AES_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_RC4_128_MD5,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,"suite",buffer,bufferLength,messageLength);
  } else {
    addtobuffer_u16(2*54,"cipher suites length",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_AES_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_AES_256_GCM_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_AES_128_CCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSUITE_TLS_AES_128_CCM_8_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_GCM_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_256_CCM,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_anon_WITH_AES_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_AES_128_CCM,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_RC4_128_MD5,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_RC4_128_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_IDEA_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_DES_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_DES_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_DES_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
    addtobuffer_u16(TLSVER_CIPHERSHUITE_OLD_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256,"suite",buffer,bufferLength,messageLength);
  }
}

//
// Add compression methods to the message
//

static void
tlsver_addcompressionmethods(unsigned char* buffer,
					 unsigned int bufferLength,
					 unsigned int* messageLength) {
  addtobuffer_u8(1,"compression methods length",buffer,bufferLength,messageLength);
  addtobuffer_u8(TLSVER_TLS_HELLO_COMPRESSION_NULL,"null method",buffer,bufferLength,messageLength);
}

//
// Add a single set of supported versions, e.g., those relating to TLS
// version 1.3 drafts
//

static void
tlsver_addsupportedversionset(unsigned short base,
					  unsigned int count,
					  unsigned char* buffer,
					  unsigned int bufferLength,
					  unsigned int* messageLength) {
  int i;
  
  for (i = count - 1; i >= 0; i--) {
    addtobuffer_u16(base + i,"version",buffer,bufferLength,messageLength);
  }
  
}

//
// Add supported version extension to the message
//

static void
tlsver_addsupportedversionsextension(unsigned char* buffer,
						 unsigned int bufferLength,
						 unsigned int* messageLength) {

  //
  //  struct {
  //     ExtensionType extension_type;
  //     opaque extension_data<0..2^16-1>;
  // } Extension;
  //
  //  enum {
  //     server_name(0),                             /* RFC 6066 */
  //     max_fragment_length(1),                     /* RFC 6066 */
  //     status_request(5),                          /* RFC 6066 */
  //     supported_groups(10),                       /* RFC 4492, 7919 */
  //     signature_algorithms(13),                   /* [[this document]] */
  //     use_srtp(14),                               /* RFC 5764 */
  //     heartbeat(15),                              /* RFC 6520 */
  //     application_layer_protocol_negotiation(16), /* RFC 7301 */
  //     signed_certificate_timestamp(18),           /* RFC 6962 */
  //     client_certificate_type(19),                /* RFC 7250 */
  //     server_certificate_type(20),                /* RFC 7250 */
  //     padding(21),                                /* RFC 7685 */
  //     pre_shared_key(41),                         /* [[this document]] */
  //     early_data(42),                             /* [[this document]] */
  //     supported_versions(43),                     /* [[this document]] */
  //     cookie(44),                                 /* [[this document]] */
  //     psk_key_exchange_modes(45),                 /* [[this document]] */
  //     certificate_authorities(47),                /* [[this document]] */
  //     oid_filters(48),                            /* [[this document]] */
  //     post_handshake_auth(49),                    /* [[this document]] */
  //     signature_algorithms_cert(50),              /* [[this document]] */
  //     key_share(51),                              /* [[this document]] */
  //     (65535)
  // } ExtensionType;
  //
  //
  //  struct {
  //      select (Handshake.msg_type) {
  //          case client_hello:
  //               ProtocolVersion versions<2..254>;
  //
  //           case server_hello: /* and HelloRetryRequest */
  //               ProtocolVersion selected_version;
  //      };
  //  } SupportedVersions;
  //
  
  addtobuffer_u16(TLSVER_EXTENSION_SUPPORTED_VERSIONS,"supported version extension",buffer,bufferLength,messageLength);
  
  //
  // Sets
  //

  if (compact) {
    addtobuffer_u16(2 * 2 + 1,"versions extension length",buffer,bufferLength,messageLength);
    addtobuffer_u8(2 * 2,"versions length",buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_TLS_HELLO_TLS_VERSION_13,
					      1,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_TLS_HELLO_LEGACY_VERSION_12,
					      1,
					      buffer,bufferLength,messageLength);
  } else {
    if (TLSVER_EXTENSION_SUPPORTED_VERSIONS_N * 2 > 254) fatalf("too many versions to offer");
    addtobuffer_u16(TLSVER_EXTENSION_SUPPORTED_VERSIONS_N * 2 + 1,"versions extension length",buffer,bufferLength,messageLength);
    addtobuffer_u8(TLSVER_EXTENSION_SUPPORTED_VERSIONS_N * 2,"versions length",buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET0_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET0_COUNT,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET1_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET1_COUNT,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET2_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET2_COUNT,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET3_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET3_COUNT,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET4_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET4_COUNT,
					      buffer,bufferLength,messageLength);
    tlsver_addsupportedversionset(TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET5_BASE,
					      TLSVER_EXTENSION_SUPPORTED_VERSIONS_SET5_COUNT,
					      buffer,bufferLength,messageLength);
  }
  
}

//
// Add signature algorithms extension to the message
//

static void
tlsver_addsignaturealgorithmsextension(unsigned char* buffer,
						   unsigned int bufferLength,
						   unsigned int* messageLength) {

  //
  //  enum {
  //      /* RSASSA-PKCS1-v1_5 algorithms */
  //      rsa_pkcs1_sha256(0x0401),
  //      rsa_pkcs1_sha384(0x0501),
  //      rsa_pkcs1_sha512(0x0601),
  //
  //      /* ECDSA algorithms */
  //      ecdsa_secp256r1_sha256(0x0403),
  //      ecdsa_secp384r1_sha384(0x0503),
  //      ecdsa_secp521r1_sha512(0x0603),
  //
  //      /* RSASSA-PSS algorithms with public key OID rsaEncryption */
  //      rsa_pss_rsae_sha256(0x0804),
  //      rsa_pss_rsae_sha384(0x0805),
  //      rsa_pss_rsae_sha512(0x0806),
  //     
  //      /* EdDSA algorithms */
  //      ed25519(0x0807),
  //      ed448(0x0808),
  //
  //      /* RSASSA-PSS algorithms with public key OID RSASSA-PSS */
  //      rsa_pss_pss_sha256(0x0809),
  //      rsa_pss_pss_sha384(0x080a),
  //      rsa_pss_pss_sha512(0x080b),
  //   
  //      /* Legacy algorithms */
  //      rsa_pkcs1_sha1(0x0201),
  //      ecdsa_sha1(0x0203),
  //   
  //      /* Reserved Code Points */
  //      private_use(0xFE00..0xFFFF),
  //      (0xFFFF)
  //  } SignatureScheme;
  //  
  //  struct {
  //      SignatureScheme supported_signature_algorithms<2..2^16-2>;
  //  } SignatureSchemeList;
  //
  
  addtobuffer_u16(TLSVER_EXTENSION_SIGNATURE_ALGORITHMS,"signature algorithms extension",buffer,bufferLength,messageLength);
  addtobuffer_u16(2 * 16 + 2,"signature algorithms extension length",buffer,bufferLength,messageLength);
  addtobuffer_u16(2 * 16,"signature algorithms length",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA256,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA384,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA512,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP256R1_SHA256,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP384R1_SHA384,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ECDSA_SECP521R1_SHA512,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA256,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA384,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_RSAE_SHA512,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ED25519,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ED448,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA256,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA384,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PSS_PSS_SHA512,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_RSA_PKCS1_SHA1,"signature algorithm",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SIGNATURE_ALGORITHM_ECDSA_SHA1,"signature algorithm",buffer,bufferLength,messageLength);
  
}

//
// Add supported groups extension to the message
//

static void
tlsver_addsupportedgroupsextension(unsigned char* buffer,
					       unsigned int bufferLength,
					       unsigned int* messageLength) {
  //     
  //   enum {
  //     
  //      /* Elliptic Curve Groups (ECDHE) */
  //      secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
  //      x25519(0x001D), x448(0x001E),
  //     
  //      /* Finite Field Groups (DHE) */
  //      ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
  //      ffdhe6144(0x0103), ffdhe8192(0x0104),
  //     
  //      /* Reserved Code Points */
  //      ffdhe_private_use(0x01FC..0x01FF),
  //      ecdhe_private_use(0xFE00..0xFEFF),
  //      (0xFFFF)
  //  } NamedGroup;
  //     
  //  struct {
  //      NamedGroup named_group_list<2..2^16-1>;
  //  } NamedGroupList;
  //
  
  addtobuffer_u16(TLSVER_EXTENSION_SUPPORTED_GROUPS,"supported groups extension",buffer,bufferLength,messageLength);
  addtobuffer_u16(2 * 10 + 2,"supported groups extension length",buffer,bufferLength,messageLength);
  addtobuffer_u16(2 * 10,"supported groups length",buffer,bufferLength,messageLength);
  
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_SECP256R1,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_SECP384R1,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_SECP521R1,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_X25519,       "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_X448,	       "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_FFDHE2048,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_FFDHE3072,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_FFDHE4096,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_FFDHE6144,    "supported group",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_SUPPORTED_GROUP_FFDHE8192,    "supported group",buffer,bufferLength,messageLength);
  
}
 
static void
tlsver_addkeyshareextension(unsigned char* buffer,
				      unsigned int bufferLength,
				      unsigned int* messageLength) {

  addtobuffer_u16(TLSVER_EXTENSION_KEY_SHARE,"key share extension",buffer,bufferLength,messageLength);
  addtobuffer_u16(2,"key share extension length",buffer,bufferLength,messageLength);
  addtobuffer_u16(0,"key share list length",buffer,bufferLength,messageLength);

}

static void
tlsver_addservernameextension(const char* destination,
					unsigned char* buffer,
					unsigned int bufferLength,
					unsigned int* messageLength) {

  unsigned short server_name_length = strnlen(destination,TLSVER_MAX_HOSTNAME_LENGTH);

  addtobuffer_u16(TLSVER_EXTENSION_SERVER_NAME,"server name extension",buffer,bufferLength,messageLength);
  addtobuffer_u16(2 + 1 + 2 + server_name_length,"server name extension length",buffer,bufferLength,messageLength);
  addtobuffer_u16(1 + 2 + server_name_length,"server name list length",buffer,bufferLength,messageLength);
  addtobuffer_u8(0,"server name type",buffer,bufferLength,messageLength);
  addtobuffer_u16(server_name_length,"server name length",buffer,bufferLength,messageLength);

  addtobuffer_data(destination,server_name_length,"server name",buffer,bufferLength,messageLength);

}

//
// Add extensions to the message
//

static void
tlsver_addextensions(const char* destination,
				 unsigned char* buffer,
				 unsigned int bufferLength,
				 unsigned int* messageLength) {
  
  unsigned int lengthFieldPosition = *messageLength;
  
  addtobuffer_u16(0,"extensions length",buffer,bufferLength,messageLength);
  tlsver_addsupportedversionsextension(buffer,bufferLength,messageLength);
  tlsver_addsignaturealgorithmsextension(buffer,bufferLength,messageLength);
  tlsver_addsupportedgroupsextension(buffer,bufferLength,messageLength);
  tlsver_addkeyshareextension(buffer,bufferLength,messageLength);
  if (sni) tlsver_addservernameextension(destination,buffer,bufferLength,messageLength);
  
  //
  // Now that we are done for the content, go back and put in the appropriate value
  // for the length field
  //
  
  puttobuffer_u16((*messageLength) - 2 - lengthFieldPosition,lengthFieldPosition,
			      "extensions length",
			      buffer,bufferLength,messageLength);
}

//
// Construct a client hello message
//

static void
tlsver_makeclienthello(const char* destination,
				   unsigned char* buffer,
				   unsigned int bufferLength,
				   unsigned int* messageLength) {

  unsigned int handshakeLayerLengthPosition;
  unsigned int recordLayerLengthPosition;
  unsigned int i;
  
  //
  //      enum {
  //          client_hello(1),
  //          server_hello(2),
  //          new_session_ticket(4),
  //          end_of_early_data(5),
  //          encrypted_extensions(8),
  //          certificate(11),
  //          certificate_request(13),
  //          certificate_verify(15),
  //          finished(20),
  //          key_update(24),
  //          message_hash(254),
  //          (255)
  //      } HandshakeType;
  //
  //      struct {
  //          HandshakeType msg_type;    /* handshake type */
  //          uint24 length;             /* bytes in message */
  //          select (Handshake.msg_type) {
  //              case client_hello:          ClientHello;
  //              case server_hello:          ServerHello;
  //              case end_of_early_data:     EndOfEarlyData;
  //              case encrypted_extensions:  EncryptedExtensions;
  //              case certificate_request:   CertificateRequest;
  //              case certificate:           Certificate;
  //              case certificate_verify:    CertificateVerify;
  //              case finished:              Finished;
  //              case new_session_ticket:    NewSessionTicket;
  //              case key_update:            KeyUpdate;
  //          };
  //      } Handshake;
  //
  //
  //
  //   Structure of this message:
  //  
  //      uint16 ProtocolVersion;
  //      opaque Random[32];
  //
  //      uint8 CipherSuite[2];    /* Cryptographic suite selector */
  //
  //      struct {
  //          ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
  //          Random random;
  //          opaque legacy_session_id<0..32>;
  //          CipherSuite cipher_suites<2..2^16-2>;
  //          opaque legacy_compression_methods<1..2^8-1>;
  //          Extension extensions<8..2^16-1>;
  //      } ClientHello;
  //
  
  *messageLength = 0;

  //
  // Record layer: content_type, version, and length
  //
  
  addtobuffer_u8(TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_HANDSHAKE,"record layer content type",buffer,bufferLength,messageLength);
  addtobuffer_u16(TLSVER_TLS_HELLO_LEGACY_VERSION_10,"record layer version",buffer,bufferLength,messageLength);
  recordLayerLengthPosition = *messageLength;
  addtobuffer_u16(0,"record layer length",buffer,bufferLength,messageLength);
  
  //
  // msg_type
  //
  
  addtobuffer_u8(TLSVER_TLS_HANDSHAKETYPE_CLIENT_HELLO,"msg_type",buffer,bufferLength,messageLength);
  
  //
  // length
  //
  
  handshakeLayerLengthPosition = *messageLength;
  addtobuffer_u24(0,"client hello length",buffer,bufferLength,messageLength);
  
  //
  // legacy_version
  //
  
  addtobuffer_u16(TLSVER_TLS_HELLO_LEGACY_VERSION_12,"legacy_version",buffer,bufferLength,messageLength);
  
  //
  // random
  //
  
  for (i = 0; i < TLSVER_TLS_HELLO_RANDOM_SIZE; i++) {
    addtobuffer_u8(rand() & 0xFF,"random",buffer,bufferLength,messageLength);
  }

  //
  // legacy_session_id
  //
  
  tlsver_addsessionid(buffer,bufferLength,messageLength);

  //
  // cipher_suites
  //
  
  tlsver_addciphersuites(buffer,bufferLength,messageLength);

  //
  // legacy_compression_methods
  //
  
  tlsver_addcompressionmethods(buffer,bufferLength,messageLength);
  
  //
  // extensions
  //
  
  tlsver_addextensions(destination,buffer,bufferLength,messageLength);

  //
  // Now that we are done for all content, go back and put in the appropriate length fields
  //
  
  puttobuffer_u16((*messageLength) - 5,recordLayerLengthPosition,
			      "record layer length",
			      buffer,bufferLength,messageLength);
  puttobuffer_u24((*messageLength) - 5 - 4,handshakeLayerLengthPosition,
			      "handshake layer length",
			      buffer,bufferLength,messageLength);
  
  //
  // Done. Return.
  //
}

//
// Fetch a descriptive text relating to the id
// given in a TLS message type.
//

static const char*
tlsver_getmessagetext(unsigned char id) {
  
  unsigned int i;
  
  for (i = 0; tlsver_messages[i].text != 0; i++) {
    if (id == tlsver_messages[i].id) {
      return(tlsver_messages[i].text);
    }
  }
  
  //
  // Not found, return a generic value
  //

  return("unrecognised_extension");
}

//
// Fetch a descriptive text relating to the id
// given in a TLS extension.
//

static const char*
tlsver_getextensiontext(unsigned char id) {
  
  unsigned int i;
  
  for (i = 0; tlsver_extensions[i].text != 0; i++) {
    if (id == tlsver_extensions[i].id) {
      return(tlsver_extensions[i].text);
    }
  }
  
  //
  // Not found, return a generic value
  //

  return("unrecognised_extension");
}

//
// Fetch a descriptive text relating to the "description"
// given in a TLS alert.
//

static const char*
tlsver_getalerttext(unsigned char description) {
  
  unsigned int i;
  
  for (i = 0; tlsver_alerts[i].text != 0; i++) {
    if (description == tlsver_alerts[i].id) {
      return(tlsver_alerts[i].text);
    }
  }

  //
  // Not found, return a generic value
  //

  return("unrecognised_alert");
}

//
// Parse ServerHello extension
//

static int
tlsver_parseextension(const unsigned char* message,
                                  unsigned int messageLength,
                                  unsigned int* position) {

  unsigned short extension;
  unsigned short length;
      
  //
  // Extension ID
  //

  if (!getfrombuffer_u16(&extension,message,messageLength,position)) return(0);
  debugf("parseextension: extension = %x", length);

  //
  // Length
  //
  
  if (!getfrombuffer_u16(&length,message,messageLength,position)) return(0);
  debugf("parseextension: length = %x", length);
  if (bufferremaining(messageLength,position) < length) {
    debugf("parseextension: remaining bytes in message = %u", bufferremaining(messageLength,position));
    warnf("extension extends beyond end of the message");
    return(0);
  }

  //
  // Look at specific extensions
  //

  switch (extension) {

    case TLSVER_EXTENSION_SUPPORTED_VERSIONS:

      //
      // Supported_versions extension
      //
      
      if (length != 2) {
        warnf("ServerHello SupportedVersions extension length %u is incorrect", length);
	return(0);
      }
      
      if (!getfrombuffer_u16(&version_supported,message,messageLength,position)) return(0);
      debugf("parseextension: supported version = %x", version_supported);
      
      break;
      
    default:
      
      //
      // Otherwise, just skip
      //
      
      debugf("skipping %u bytes extension (%s)", length, tlsver_getextensiontext(extension));
      if (!getfrombuffer_skipbytes(length,"unrecognised extension",message,messageLength,position)) return(0);
  }
  
  //
  // Ok
  //
  
  return(1);
}

//
// Parse ServerHello extensions
//

static int
tlsver_parseextensions(const unsigned char* message,
                                   unsigned int messageLength,
                                   unsigned int* position) {

  unsigned short length;
      
  //
  // Length
  //

  if (!getfrombuffer_u16(&length,message,messageLength,position)) return(0);
  debugf("parseextensions: length = %x", length);
  if (length > bufferremaining(messageLength,position)) {
      debugf("parseextensions: remaining bytes in message = %u", bufferremaining(messageLength,position));
      warnf("extensions extend beyond message length");
      return(0);
  }
  
  //
  // Loop through the extensions
  //
  
  while (length >= 4) {
      
      unsigned int positionBefore = *position;
      if (!tlsver_parseextension(message,messageLength,position)) return(0);
      length -= (*position) - positionBefore;
      
  }
  
  if (bufferremaining(messageLength,position) > 0) {
      debugf("remaining bytes after extension -- ignored");
  }
  
  //
  // Ok
  //

  return(1);
}

//
// Parse a server hello message
//

static int
tlsver_parseserverhello(const unsigned char* message,
                                    unsigned int messageLength,
                                    unsigned int recordEndPosition,
	                            unsigned int* position) {
  
  //
  //
  //  struct {
  //      ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
  //      Random random;
  //      opaque legacy_session_id_echo<0..32>;
  //      CipherSuite cipher_suite;
  //      uint8 legacy_compression_method = 0;
  //      Extension extensions<6..2^16-1>;
  //  } ServerHello;
  //
  //
  // legacy_version
  //
  
  unsigned short cipher_suite;
  unsigned char compression_method;

  if (!getfrombuffer_u16(&version_hello,message,messageLength,position)) return(0);
  debugf("parseserverhello: legacy_version = %x", version_hello);
  compareexpectedresult(version_hello,<=,TLSVER_TLS_HELLO_LEGACY_VERSION_12,
				    "legacy version");
  
  //
  // random
  //
  
  if (!getfrombuffer_skipbytes(TLSVER_TLS_HELLO_RANDOM_SIZE,"random",message,messageLength,position)) return(0);
  
  //
  // userid
  //
  
  if (!getfrombuffer_skipvector(1,message,messageLength,position)) return(0);

  //
  // cipher_suite
  //
  
  if (!getfrombuffer_u16(&cipher_suite,message,messageLength,position)) return(0);
  debugf("parseserverhello: cipher suite = %x", cipher_suite);
  
  //
  // compression_method
  //
  
  if (!getfrombuffer_u8(&compression_method,message,messageLength,position)) return(0);
  debugf("parseserverhello: compression_method = %x", compression_method);

  //
  // extensions
  //

  debugf("seeing if there are extensions, position %u record end position %u", *position, recordEndPosition);
  if ((*position) < recordEndPosition) {
    if (!tlsver_parseextensions(message,messageLength,position)) return(0);
  }
  
  //
  // Success
  //
  
  return(1);
}

//
// Parse a server TLS record layer message
//
  
static enum tlsver_result
tlsver_parseservermessage(const unsigned char* message,
                                      unsigned int messageLength,
	                              unsigned int* position) {
  
  //
  //
  //  struct {
  //      ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
  //      Random random;
  //      opaque legacy_session_id_echo<0..32>;
  //      CipherSuite cipher_suite;
  //      uint8 legacy_compression_method = 0;
  //      Extension extensions<6..2^16-1>;
  //  } ServerHello;
  //

  unsigned int remainingMessageLength = bufferremaining(messageLength,position);
  unsigned char record_layer_content_type;
  unsigned short record_layer_length;
  unsigned char msg_type;
  unsigned int length;
  unsigned char alert_level;
  unsigned char alert_description;
  unsigned int recordEndPosition;
  
  debugf("position %u messageLength %u", *position, messageLength);
  assert(*position <= messageLength);
  
  //
  // Record layer: content_type, version, and length
  //
  
  if (remainingMessageLength < 5) {
      debugf("not enough bytes for TLS record layer header");
      return(tlsver_result_waitformore);
  }
  
  if (!getfrombuffer_u8(&record_layer_content_type,message,messageLength,position)) return(tlsver_result_failed);
  debugf("parseservermessage: content_type = %x", record_layer_content_type);

  if (!getfrombuffer_u16(&version_record,message,messageLength,position)) return(tlsver_result_failed);
  debugf("parseservermessage: record layer version = %x", version_record);
  
  if (!getfrombuffer_u16(&record_layer_length,message,messageLength,position)) return(tlsver_result_failed);
  debugf("parseservermessage: record layer length = %x", record_layer_length);
  
  assert(*position <= messageLength);
  
  if (record_layer_length > bufferremaining(messageLength,position)) {
    debugf("have to wait for more, record is %u bytes but only %u bytes remaining in buffer",
	   record_layer_length, bufferremaining(messageLength,position));
    assert(*position >= 5);
    *position -= 5;
    assert(*position <= messageLength);
    return(tlsver_result_waitformore);
  }
  
  assert(*position <= messageLength);
  
  switch (record_layer_content_type) {
      
  case TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_ALERT:
    if (!getfrombuffer_u8(&alert_level,message,messageLength,position)) return(0);
    if (!getfrombuffer_u8(&alert_description,message,messageLength,position)) return(0);
    fatalf("TLS Alert %u.%u (%s) received", alert_level, alert_description, tlsver_getalerttext(alert_description));
    break;
    
  case TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_CHANGECIPHERSPEC:
    debugf("change cipher spec, record_layer_length %u", record_layer_length);
    debugf("position %u messageLength %u", *position, messageLength);
    if (getfrombuffer_skipbytes(record_layer_length,"change_cipher_spec",message,messageLength,position)) {
      debugf("done, position %u messageLength %u", *position, messageLength);
      return(tlsver_result_done);
    } else {
      debugf("failed, position %u messageLength %u", *position, messageLength);
      return(tlsver_result_failed);
    }
      
  default:
    compareexpectedresult_cont(record_layer_content_type,==,TLSVER_TLS_RECORDLAYER_CONTENT_TYPE_HANDSHAKE,
				           "record layer content type");
    
  }
  
  compareexpectedresult_cont(record_layer_length,<=,remainingMessageLength - 5,
				         "record layer length");
  
  //
  // msg_type
  //
  
  if (!getfrombuffer_u8(&msg_type,message,messageLength,position)) return(0);
  debugf("parseservermessage: msg_type = %x (%s)", msg_type, tlsver_getmessagetext(msg_type));
  
  //
  // length
  //
  
  if (!getfrombuffer_u24(&length,message,messageLength,position)) return(tlsver_result_failed);
  debugf("parseservermessage: length = %u", length);
  compareexpectedresult_cont(length,<=,messageLength,
				         "message length");
  recordEndPosition = (*position) + length;
  debugf("parseservermessage: record end position = %u", recordEndPosition);
  
  switch (msg_type) {
      
    case TLSVER_TLS_HANDSHAKETYPE_SERVER_HELLO:
      debugf("processing a server_hello");
      if (tlsver_parseserverhello(message,
                                              messageLength,
                                              recordEndPosition,
                                              position))
	return(tlsver_result_done);
      else
	return(tlsver_result_failed);
      
    default:
      debugf("skipping message %u (%s)", msg_type, tlsver_getmessagetext(msg_type));
      if (getfrombuffer_skipbytes(length,"unrecognised extension",message,recordEndPosition,position))
	return(tlsver_result_done);
      else
	return(tlsver_result_failed);
      
    }
}

//
// Parse a server messages (maybe several in one chunk of data)
//

static enum tlsver_result
tlsver_parseservermessages(const unsigned char* message,
 	                               unsigned int messageLength,
	                               unsigned int* position) {

  while (1) {
      
    switch (tlsver_parseservermessage(message,messageLength,position)) {
      
    case tlsver_result_done:
      if (bufferremaining(messageLength,position) > 0)
	continue;
      else
	return(tlsver_result_done);
      
    case tlsver_result_failed:
      return(tlsver_result_failed);
      
    case tlsver_result_waitformore:
      return(tlsver_result_waitformore);
      
    default:
      fatalf("unrecognised internal answer");
    }
    
  }

}

//
// Get current time
//

static void
tlsver_getcurrenttime(struct timeval* result) {
  
  assert(result != 0);
  if (gettimeofday(result, 0) < 0) {
    fatalp("cannot determine current time via gettimeofday");
  }
  
}

//
// Map a DNS name to an address
//

static void
getdestinationaddress(const char* destination,
		      struct sockaddr_in* address) {
  
  struct addrinfo hints, *res;
  struct sockaddr_in *addr;
  int rcode;
  
  assert(destination != 0);
  assert(address != 0);
  
  memset(&hints,0,sizeof(hints));
  hints.ai_family = AF_INET;
  hints.ai_socktype = SOCK_STREAM;
  hints.ai_flags = hints.ai_flags | AI_CANONNAME;
  
  if ((rcode = getaddrinfo(destination, NULL, &hints, &res)) != 0) {
    fatalf("cannot resolve address %s: %s", destination, gai_strerror (rcode));
    exit(1);
  }
  
  *address = *(struct sockaddr_in*)res->ai_addr;
}

//
// Map a DNS name to an IPv6 address
//

static int
getdestinationaddress6(const char* destination,
		       struct sockaddr_in6* address) {
  
  struct addrinfo hints, *res;
  struct sockaddr_in6 *addr;
  int rcode;
  
  assert(destination != 0);
  assert(address != 0);
  
  memset(&hints,0,sizeof(hints));
  hints.ai_family = AF_INET6;
  hints.ai_socktype = SOCK_STREAM;
  hints.ai_flags = hints.ai_flags | AI_CANONNAME;
  
  if ((rcode = getaddrinfo(destination, NULL, &hints, &res)) != 0) {
    debugf("cannot resolve address %s: %s for IPv6", destination, gai_strerror (rcode));
    return(0);
  }
  
  *address = *(struct sockaddr_in6*)res->ai_addr;
  return(1);
}

//
// Convert an IPv4 address to string
//

static const char*
addrtostring(struct in_addr* addr) {
  assert(addr != 0);
  return(inet_ntoa(*addr));
}

static const char*
tlsver_versiontostring(unsigned short version) {
  static char buf[40];
  
  if (version == 0) {
      
    sprintf(buf,"unknown");

  } else if (!TLSVER_TLS_HELLO_TLS_VERSION_IS_VALID(version)) {

    sprintf(buf,"unknown");

  } else if (TLSVER_TLS_HELLO_TLS_VERSION_13_IS_DRAFT(version)) {
    
    if (draft) {
      sprintf(buf,"1.3 draft %u", TLSVER_TLS_HELLO_TLS_VERSION_13_DRAFT_VER(version));
    } else {
      sprintf(buf,"1.3");
    }
    
  } else {
    
    unsigned char majorver = TLSVER_TLS_HELLO_TLS_VERSION_MAJOR(version);
    unsigned char minorver = TLSVER_TLS_HELLO_TLS_VERSION_MINOR(version);
    sprintf(buf,"%u.%u", majorver, minorver);
    
  }
  
  return(buf);
}
 
static unsigned short
tlsver_getversion() {
  if (version_supported != 0) return(version_supported);
  if (version_hello != 0) return(version_hello);
  if (version_record != 0) return(version_record);
  return(0);
}
 
static int
connect_withtimeout(int sock,
		    struct sockaddr* address,
		    size_t asize,
		    struct timeval* timeout) {
  
  fd_set writes;

  fcntl(sock, F_SETFL, O_NONBLOCK);
  debugf("doing non-blocking connect");
  connect(sock, address, asize);

  FD_ZERO(&writes);
  FD_SET(sock, &writes);

  debugf("doing a select to wait for the connect to complete");
  
  if (select(sock + 1, 0, &writes, 0, timeout) == 1) {
    int so_error;
    socklen_t len = sizeof so_error;
	
    getsockopt(sock, SOL_SOCKET, SO_ERROR, &so_error, &len);
    if (so_error == 0) {
      debugf("socket is open");
      return(0);
    }
  }
  
  debugf("either timeout or other error");
  return(-1);
}

//
// Run the actual probing
//

static unsigned short
tlsver_runtest(const char* destination) {
  
  int sock;
  struct timeval timeout;
  struct sockaddr_in server;
  struct sockaddr_in6 server6;
  unsigned char sentMessage[TLSVER_MAXMSGSIZE];
  unsigned int sentMessageSize;
  unsigned char receivedMessage[TLSVER_MAXMSGSIZE];
  int receivedMessageSize;
  unsigned int position = 0;
  unsigned int currentLength = 0;
  
  //
  // Create socket
  //
  
  sock = socket(AF_INET, SOCK_STREAM, 0);
  if (sock == -1) {
    fatalf("could not create socket");
  }
  
  getdestinationaddress(destination,&server);
  server.sin_port = htons(port);
  debugf("connecting to %s (%s):%u",
	 destination,
	 addrtostring(&server.sin_addr),
	 port);

  //
  // Connect to remote server
  //
  
  timeout.tv_sec = connectSecs;
  timeout.tv_usec = 0;
  if (connect_withtimeout(sock , (struct sockaddr *)&server , sizeof(server), &timeout) < 0) {
    debugf("connect failed to %s", destination);
    close(sock);
    sock = socket(AF_INET6, SOCK_STREAM, 0);
    if (sock == -1) {
      fatalf("could not create ipv6 socket");
    }
  
    if (!getdestinationaddress6(destination,&server6)) {
      debugf("no ipv6 address");
      return(0);
    }
    server6.sin6_port = htons(port);
    debugf("connecting to IPv6 address of %s:%u",
	   destination,
	   port);
    timeout.tv_sec = connectSecs;
    timeout.tv_usec = 0;
    if (connect_withtimeout(sock , (struct sockaddr *)&server6 , sizeof(server6), &timeout) < 0) {
      debugf("connect failed to %s", destination);
      return(0);
    }
  }
  
  //
  // Communicate with the server
  //
  
  tlsver_makeclienthello(destination,sentMessage,sizeof(sentMessage),&sentMessageSize);
  showbytes("sending",sentMessage,sentMessageSize);
  if (send(sock,
	   (const char*)sentMessage,
	   sentMessageSize,
	   0) < 0) {
    fatalf("send failed to %s", destination);
  }

  do {

    //
    // Receive a reply from the server
    //

    struct timeval now;
    fd_set reads;
    int selres;
    unsigned long long diff;
    
    if (interrupt) exit(1);
    
    tlsver_getcurrenttime(&now);
    diff = timediffinusecs(&now,&startTime);
    if (diff >= TLSVER_MAXWAIT_USECS)
      fatalf("timed out to %s", destination);
    
    timeout.tv_sec = 0;
    timeout.tv_usec = 50 * 1000;
    
    FD_ZERO(&reads);
    FD_SET(sock,&reads);
    debugf("going into select for %lu s %lu us", timeout.tv_sec, timeout.tv_usec);
    selres = select(1, &reads, 0, 0, &timeout);
    
    debugf("going to read more from socket (already %u bytes)", currentLength);
    if ((receivedMessageSize = recv(sock,
	                            (void*)&receivedMessage[currentLength],
				    TLSVER_MAXMSGSIZE - currentLength,
				    MSG_DONTWAIT)) < 0) {
      if (errno == EAGAIN || errno == EWOULDBLOCK) continue;
      else fatalf("recv failed to %s", destination);
    }

    currentLength += receivedMessageSize;
    showbytes("received",receivedMessage,currentLength);
    
  } while (tlsver_parseservermessages(receivedMessage,currentLength,&position) ==
	   tlsver_result_waitformore);
  
  close(sock);

  //
  // Return with knowledge of what version this was
  //
  
  return(tlsver_getversion());
}

//
// Report result
//

static void
tlsver_report(const char* result) {
  if (result == 0) printf("unknown\n");
  else printf("%s\n", result);
}

//
// Report result per individual site
//

static void
tlsver_report_detailed(const char* destination,
		       const char* result) {
  printf("%s:", destination);
  tlsver_report(result);
}

//
// Main program ------------------------------------------------
//

int
main(int argc,
     char** argv) {

  const char* resultstring;
  unsigned short result;
  
  //
  // Process arguments
  //
  
  argc--; argv++;
  while (argc > 0) {
    
    if (strcmp(argv[0],"-version") == 0) {
      
      printf("version 0.2\n");
      exit(0);
      
    } else if (strcmp(argv[0],"-quiet") == 0) {
      
      quiet = 1;
      
    } else if (strcmp(argv[0],"-not-quiet") == 0) {
      
      quiet = 0;
      
    } else if (strcmp(argv[0],"-debug") == 0) {
      
      debug = 1;
      
    } else if (strcmp(argv[0],"-no-debug") == 0) {
      
      debug = 0;
      
    } else if (strcmp(argv[0],"-compact") == 0) {
      
      compact = 1;
      
    } else if (strcmp(argv[0],"-no-compact") == 0) {
      
      compact = 0;
      
    } else if (strcmp(argv[0],"-draft") == 0) {
      
      draft = 1;
      
    } else if (strcmp(argv[0],"-rfc") == 0) {
      
      draft = 0;
      
    } else if (strcmp(argv[0],"-no-sni") == 0) {

      sni = 0;

    } else if (strcmp(argv[0],"-sni") == 0) {

      sni = 1;

    } else if (strcmp(argv[0],"-no-detailed-reporting") == 0) {
      
      detailedReporting = 0;
      
    } else if (strcmp(argv[0],"-detailed-reporting") == 0) {
      
      detailedReporting = 1;
      
    } else if (strcmp(argv[0],"-port") == 0 && argc > 1 && isdigit(argv[1][0])) {

      port = atoi(argv[1]);
      argc--; argv++;
      
    } else if (strcmp(argv[0],"-timeout") == 0 && argc > 1 && isdigit(argv[1][0])) {

      connectSecs = atoi(argv[1]);
      argc--; argv++;
      
    } else if (argv[0][0] == '-') {
      
      fatalf("unrecognised option %s", argv[0]);
      
    } else if (argc >= 1) {

      unsigned int j;
      
      if (argc > TLSVER_MAX_TEST_DESTINATIONS) {
	fatalf("too many test destinations, max %u allowed",
	       TLSVER_MAX_TEST_DESTINATIONS);
      }
      
      nTestDestinations = argc;
      
      for (j = 0; j < argc; j++) {
	testDestinations[j] = argv[j];
      }
      
      argc = 0;
      
    }
    
    argc--; argv++;
    
  }
  
  signal(SIGINT, tlsver_interrupt);

  if (nTestDestinations == 1) {
    
    tlsver_getcurrenttime(&startTime);
    result = tlsver_runtest(testDestinations[0]);
    resultstring = tlsver_versiontostring(result);
    
  } else {

    unsigned int countsubstract = 0;
    unsigned int k;
    double versionsum = 0.0;
    
    for (k = 0; k < nTestDestinations; k++) {

      const char* dest = testDestinations[k];
      draft = 0;
      tlsver_getcurrenttime(&startTime);
      version_record = version_hello = version_supported = 0;
      result = tlsver_runtest(dest);
      if (detailedReporting) {
	resultstring = tlsver_versiontostring(result);
	tlsver_report_detailed(dest,resultstring);
      }
      if (result == 0) {
	countsubstract++;
	continue;
      }
      
      versionsum +=
	TLSVER_TLS_HELLO_TLS_VERSION_MAJOR(result) * 100.0 +
	TLSVER_TLS_HELLO_TLS_VERSION_MINOR(result) * 10;
      
    }
    
    if (countsubstract == nTestDestinations) {
      resultstring = 0;
    } else {
      static char buf[30];
      if (nTestDestinations >= 10)
	sprintf(buf,"%.4f", (versionsum / (nTestDestinations - countsubstract)) / 100.0);
      else
	sprintf(buf,"%.2f", (versionsum / (nTestDestinations - countsubstract)) / 100.0);
      resultstring = buf;
    }
  }
  
  tlsver_report(resultstring);
  
  //
  // Done
  //
  
  exit(0);
  
}