TLS client features

Add flags --policy, --print-certs, --tls1.0, --tls1.1, --tls1.2

Update todo

3 files changed, 63 insertions, 12 deletions

diff --git a/doc/todo.rst b/doc/todo.rst
index a98ec9f76..32927e6d7 100644
--- a/doc/todo.rst
+++ b/doc/todo.rst
@@ -3,18 +3,21 @@ Projects
 
 Request a new feature by opening a pull request to update this file.
 
-Commands
+CLI
 ----------------------------------------
 
+* Rewrite `tls_client` and `tls_server` to use asio. See `tls_proxy`
+  for an example
 * `encrypt` / `decrypt` tools providing password and/or public key
   based file encryption
 
 TLS
 ----------------------------------------
 
-* Make DTLS and SRP6 support optional in build
+* Make DTLS support optional at build time
+* Make TLS v1.0 and v1.1 optional at build time
 * Curve25519 key exchange
-* Support for server key stored in TPM
+* IETF standard ChaCha20Poly1305
 * TLS OCSP stapling (RFC 6066)
 * Encrypt-then-MAC extension (RFC 7366)
 * Authentication using TOFU (sqlite3 storage)
@@ -23,6 +26,7 @@ TLS
 * OpenPGP authentication (RFC 5081)
 * DTLS-SCTP (RFC 6083)
 * Perspectives (http://perspectives-project.org/)
+* Support for server key stored in TPM
 
 PKIX
 ----------------------------------------
@@ -57,6 +61,7 @@ FFI (Python, OCaml)
 
 * Expose certificates
 * Expose TLS
+* Write a CLI in Python
 
 Symmetric Algorithms, Hashes, ...
 ----------------------------------------
diff --git a/src/cli/tls_client.cpp b/src/cli/tls_client.cpp
index 62c909d5d..6af2f56f8 100644
--- a/src/cli/tls_client.cpp
+++ b/src/cli/tls_client.cpp
@@ -38,31 +38,53 @@ namespace Botan_CLI {
 class TLS_Client final : public Command
    {
    public:
-      TLS_Client() : Command("tls_client host --port=443 --type=tcp "
-                             "--session-db= --session-db-pass= --next-protocols=") {}
+      TLS_Client() : Command("tls_client host --port=443 --print-certs --policy= "
+                             "--tls1.0 --tls1.1 --tls1.2 "
+                             "--session-db= --session-db-pass= --next-protocols= --type=tcp") {}
 
       void go() override
          {
-         Botan::TLS::Policy policy; // TODO read from a file
-
          // TODO client cert auth
 
          std::unique_ptr<Botan::TLS::Session_Manager> session_mgr;
 
-#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
-         const std::string sessions_passphrase = get_arg("session-db-pass");
          const std::string sessions_db = get_arg("session-db");
 
          if(!sessions_db.empty())
             {
+#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
+            const std::string sessions_passphrase = get_arg("session-db-pass");
             session_mgr.reset(new Botan::TLS::Session_Manager_SQLite(sessions_passphrase, rng(), sessions_db));
-            }
+#else
+            error_output() << "Ignoring session DB file, sqlite not enabled\n";
 #endif
+            }
+
          if(!session_mgr)
             {
             session_mgr.reset(new Botan::TLS::Session_Manager_In_Memory(rng()));
             }
 
+         std::string policy_file = get_arg("policy");
+
+         std::unique_ptr<Botan::TLS::Policy> policy;
+
+         if(policy_file.size() > 0)
+            {
+            std::ifstream policy_stream(policy_file);
+            if(!policy_stream.good())
+               {
+               error_output() << "Failed reading policy file\n";
+               return;
+               }
+            policy.reset(new Botan::TLS::Text_Policy(policy_stream));
+            }
+
+         if(!policy)
+            {
+            policy.reset(new Botan::TLS::Policy);
+            }
+
          Basic_Credentials_Manager creds;
 
          const std::string host = get_arg("host");
@@ -85,7 +107,16 @@ class TLS_Client final : public Command
             std::bind(stream_socket_write, sockfd, _1, _2) :
             std::bind(dgram_socket_write, sockfd, _1, _2);
 
-         auto version = policy.latest_supported_version(!use_tcp);
+         auto version = policy->latest_supported_version(!use_tcp);
+
+         if(flag_set("tls1.0"))
+            {
+            version = Botan::TLS::Protocol_Version::TLS_V10;
+            }
+         else if(flag_set("tls1.1"))
+            {
+            version = Botan::TLS::Protocol_Version::TLS_V11;
+            }
 
          Botan::TLS::Client client(socket_write,
                                    std::bind(&TLS_Client::process_data, this, _1, _2),
@@ -93,7 +124,7 @@ class TLS_Client final : public Command
                                    std::bind(&TLS_Client::handshake_complete, this, _1),
                                    *session_mgr,
                                    creds,
-                                   policy,
+                                   *policy,
                                    rng(),
                                    Botan::TLS::Server_Information(host, port),
                                    version,
@@ -236,6 +267,18 @@ class TLS_Client final : public Command
          if(!session.session_ticket().empty())
             output() << "Session ticket " << Botan::hex_encode(session.session_ticket()) << "\n";
 
+         if(flag_set("print-certs"))
+            {
+            const std::vector<Botan::X509_Certificate>& certs = session.peer_certs();
+
+            for(size_t i = 0; i != certs.size(); ++i)
+               {
+               output() << "Certificate " << i+1 << "/" << certs.size() << "\n";
+               output() << certs[i].to_string();
+               output() << certs[i].PEM_encode();
+               }
+            }
+
          return true;
          }
 
diff --git a/src/lib/tls/tls_policy.h b/src/lib/tls/tls_policy.h
index 67388b115..769bb8eeb 100644
--- a/src/lib/tls/tls_policy.h
+++ b/src/lib/tls/tls_policy.h
@@ -290,6 +290,9 @@ class BOTAN_DLL Text_Policy : public Policy
       u32bit session_ticket_lifetime() const override
          { return get_len("session_ticket_lifetime", Policy::session_ticket_lifetime()); }
 
+      bool send_fallback_scsv(Protocol_Version version) const override
+         { return get_bool("send_fallback_scsv", false) ? Policy::send_fallback_scsv(version) : false; }
+
       std::vector<u16bit> srtp_profiles() const override
          {
          std::vector<u16bit> r;