diff options
author | Jack Lloyd <[email protected]> | 2019-05-20 14:44:08 -0400 |
---|---|---|
committer | Jack Lloyd <[email protected]> | 2019-05-20 15:11:05 -0400 |
commit | 67df17d31d61f013d537abc7744f707435351125 (patch) | |
tree | cde44420bdcf69fccf8f79123479b6ef0a2712d0 /src/lib/tls/tls_channel.h | |
parent | 8e781e5a1be3ecc456c8e109571a084ec8bb792e (diff) |
Fix various issues in TLS found using BoGo
- BoGo sends unparseable OCSP responses, so we have to accomodate for
this by delaying decoding until verification and simply ignoring
OCSP responses that we can't parse.
- Check that there is no trailing garbage at the end of various messages.
- Don't send empty SNI
- Check the TLS record header versions (previously ignored)
- For CBC 1/n-1 splitting split every record instead of just first.
I think this is not a problem but it is what BoGo expects.
- New Channel::application_protocol virtual (previously was
implemented on both Client and Server but not shared).
- Changes to resumption version handling.
- Fix server version selection when newer versions are disabled.
New policy hooks added in service of BoGo:
- maximum_certificate_chain_size gives the maximum cert chain in bytes
that we'll accept.
- allow_resumption_for_renegotiation specifies if a renegotiation
attempt can be simply (re-)resumed instead.
- abort_handshake_on_undesired_renegotiation - previously we just
ignored it with a warning alert. Now behavior is configurable.
- request_client_certificate_authentication
- require_client_certificate_authentication
Diffstat (limited to 'src/lib/tls/tls_channel.h')
-rw-r--r-- | src/lib/tls/tls_channel.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/lib/tls/tls_channel.h b/src/lib/tls/tls_channel.h index 0362faaa8..63cbcf0fc 100644 --- a/src/lib/tls/tls_channel.h +++ b/src/lib/tls/tls_channel.h @@ -198,6 +198,8 @@ class BOTAN_PUBLIC_API(2,0) Channel */ bool timeout_check(); + virtual std::string application_protocol() const = 0; + protected: virtual void process_handshake_msg(const Handshake_State* active_state, |