Fix various issues in TLS found using BoGo

 - BoGo sends unparseable OCSP responses, so we have to accomodate for
   this by delaying decoding until verification and simply ignoring
   OCSP responses that we can't parse.
 - Check that there is no trailing garbage at the end of various messages.
 - Don't send empty SNI
 - Check the TLS record header versions (previously ignored)
 - For CBC 1/n-1 splitting split every record instead of just first.
   I think this is not a problem but it is what BoGo expects.
 - New Channel::application_protocol virtual (previously was
   implemented on both Client and Server but not shared).
 - Changes to resumption version handling.
 - Fix server version selection when newer versions are disabled.

New policy hooks added in service of BoGo:
 - maximum_certificate_chain_size gives the maximum cert chain in bytes
   that we'll accept.
 - allow_resumption_for_renegotiation specifies if a renegotiation
   attempt can be simply (re-)resumed instead.
 - abort_handshake_on_undesired_renegotiation - previously we just
   ignored it with a warning alert. Now behavior is configurable.
 - request_client_certificate_authentication
 - require_client_certificate_authentication

1 files changed, 10 insertions, 0 deletions

diff --git a/src/lib/tls/tls_ciphersuite.h b/src/lib/tls/tls_ciphersuite.h
index 2ee3df20e..7ef7623bb 100644
--- a/src/lib/tls/tls_ciphersuite.h
+++ b/src/lib/tls/tls_ciphersuite.h
@@ -10,6 +10,7 @@
 
 #include <botan/types.h>
 #include <botan/tls_algos.h>
+#include <botan/tls_version.h>
 #include <string>
 #include <vector>
 
@@ -31,6 +32,13 @@ class BOTAN_PUBLIC_API(2,0) Ciphersuite final
       static Ciphersuite by_id(uint16_t suite);
 
       /**
+      * Convert an SSL/TLS ciphersuite name to algorithm fields
+      * @param name the IANA name for the desired ciphersuite
+      * @return ciphersuite object
+      */
+      static Ciphersuite from_name(const std::string& name);
+
+      /**
       * Returns true iff this suite is a known SCSV
       */
       static bool is_scsv(uint16_t suite);
@@ -115,6 +123,8 @@ class BOTAN_PUBLIC_API(2,0) Ciphersuite final
       */
       bool valid() const { return m_usable; }
 
+      bool usable_in_version(Protocol_Version version) const;
+
       bool operator<(const Ciphersuite& o) const { return ciphersuite_code() < o.ciphersuite_code(); }
       bool operator<(const uint16_t c) const { return ciphersuite_code() < c; }