Split TLS::Policy::allowed_hashes into allowed_signature_hashes and

allowed_macs. This allows someone to turn on MD5 for message auth,
which is a little sketchy but probably OK, without also (likely
unintentionally) enabling MD5 for TLS v1.2 signatures, which would be
a big problem.

Prioritize RC4 over 3DES in default policy.

Disable ECC curves smaller than 224 bits by default.

More updates to the TLS policy documentation.

8 files changed, 41 insertions, 29 deletions

diff --git a/src/tls/c_hello.cpp b/src/tls/c_hello.cpp
index 919ed93f4..9956c5e28 100644
--- a/src/tls/c_hello.cpp
+++ b/src/tls/c_hello.cpp
@@ -85,7 +85,7 @@ Client_Hello::Client_Hello(Record_Writer& writer,
    m_supports_heartbeats(true),
    m_peer_can_send_heartbeats(true)
    {
-   std::vector<std::string> hashes = policy.allowed_hashes();
+   std::vector<std::string> hashes = policy.allowed_signature_hashes();
    std::vector<std::string> sigs = policy.allowed_signature_methods();
 
    for(size_t i = 0; i != hashes.size(); ++i)
@@ -128,7 +128,7 @@ Client_Hello::Client_Hello(Record_Writer& writer,
    if(!value_exists(m_comp_methods, session.compression_method()))
       m_comp_methods.push_back(session.compression_method());
 
-   std::vector<std::string> hashes = policy.allowed_hashes();
+   std::vector<std::string> hashes = policy.allowed_signature_hashes();
    std::vector<std::string> sigs = policy.allowed_signature_methods();
 
    for(size_t i = 0; i != hashes.size(); ++i)
diff --git a/src/tls/cert_req.cpp b/src/tls/cert_req.cpp
index 31f4fb1e1..f97238d54 100644
--- a/src/tls/cert_req.cpp
+++ b/src/tls/cert_req.cpp
@@ -66,7 +66,7 @@ Certificate_Req::Certificate_Req(Record_Writer& writer,
 
    if(version >= Protocol_Version::TLS_V12)
       {
-      std::vector<std::string> hashes = policy.allowed_hashes();
+      std::vector<std::string> hashes = policy.allowed_signature_hashes();
       std::vector<std::string> sigs = policy.allowed_signature_methods();
 
       for(size_t i = 0; i != hashes.size(); ++i)
diff --git a/src/tls/tls_client.cpp b/src/tls/tls_client.cpp
index 7dc0c224e..1f427ea14 100644
--- a/src/tls/tls_client.cpp
+++ b/src/tls/tls_client.cpp
@@ -165,7 +165,7 @@ void Client::process_handshake_msg(Handshake_Type type,
          return;
          }
 
-      renegotiate(false);
+      this->renegotiate(false);
 
       return;
       }
diff --git a/src/tls/tls_client.h b/src/tls/tls_client.h
index c85b528d2..fc08ca796 100644
--- a/src/tls/tls_client.h
+++ b/src/tls/tls_client.h
@@ -52,7 +52,7 @@ class BOTAN_DLL Client : public Channel
              std::function<std::string (std::vector<std::string>)> next_protocol =
                 std::function<std::string (std::vector<std::string>)>());
 
-      void renegotiate(bool force_full_renegotiation);
+      void renegotiate(bool force_full_renegotiation = false);
    private:
       void process_handshake_msg(Handshake_Type type,
                                  const std::vector<byte>& contents) override;
diff --git a/src/tls/tls_handshake_state.cpp b/src/tls/tls_handshake_state.cpp
index 48e587d03..d730bb492 100644
--- a/src/tls/tls_handshake_state.cpp
+++ b/src/tls/tls_handshake_state.cpp
@@ -225,7 +225,7 @@ std::string choose_hash(const std::string& sig_algo,
 
    if(!supported_algos.empty())
       {
-      const auto hashes = policy.allowed_hashes();
+      const auto hashes = policy.allowed_signature_hashes();
 
       /*
       * Choose our most preferred hash that the counterparty supports
diff --git a/src/tls/tls_policy.cpp b/src/tls/tls_policy.cpp
index 87f8b5a14..c48ed274e 100644
--- a/src/tls/tls_policy.cpp
+++ b/src/tls/tls_policy.cpp
@@ -21,15 +21,15 @@ std::vector<std::string> Policy::allowed_ciphers() const
    return std::vector<std::string>({
       "AES-256",
       "AES-128",
-      "3DES",
       "ARC4",
+      "3DES",
       //"Camellia-256",
       //"Camellia-128",
       //"SEED"
       });
    }
 
-std::vector<std::string> Policy::allowed_hashes() const
+std::vector<std::string> Policy::allowed_signature_hashes() const
    {
    return std::vector<std::string>({
       "SHA-512",
@@ -41,6 +41,16 @@ std::vector<std::string> Policy::allowed_hashes() const
       });
    }
 
+std::vector<std::string> Policy::allowed_macs() const
+   {
+   return std::vector<std::string>({
+      "SHA-384",
+      "SHA-256",
+      "SHA-1",
+      //"MD5",
+      });
+   }
+
 std::vector<std::string> Policy::allowed_key_exchange_methods() const
    {
    return std::vector<std::string>({
@@ -73,11 +83,11 @@ std::vector<std::string> Policy::allowed_ecc_curves() const
       "secp256k1",
       "secp224r1",
       "secp224k1",
-      "secp192r1",
-      "secp192k1",
-      "secp160r2",
-      "secp160r1",
-      "secp160k1",
+      //"secp192r1",
+      //"secp192k1",
+      //"secp160r2",
+      //"secp160r1",
+      //"secp160k1",
       });
    }
 
@@ -136,10 +146,10 @@ class Ciphersuite_Preference_Ordering
    {
    public:
       Ciphersuite_Preference_Ordering(const std::vector<std::string>& ciphers,
-                                      const std::vector<std::string>& hashes,
+                                      const std::vector<std::string>& macs,
                                       const std::vector<std::string>& kex,
                                       const std::vector<std::string>& sigs) :
-         m_ciphers(ciphers), m_hashes(hashes), m_kex(kex), m_sigs(sigs) {}
+         m_ciphers(ciphers), m_macs(macs), m_kex(kex), m_sigs(sigs) {}
 
       bool operator()(const Ciphersuite& a, const Ciphersuite& b) const
          {
@@ -186,11 +196,11 @@ class Ciphersuite_Preference_Ordering
 
          if(a.mac_algo() != b.mac_algo())
             {
-            for(size_t i = 0; i != m_hashes.size(); ++i)
+            for(size_t i = 0; i != m_macs.size(); ++i)
                {
-               if(a.mac_algo() == m_hashes[i])
+               if(a.mac_algo() == m_macs[i])
                   return true;
-               if(b.mac_algo() == m_hashes[i])
+               if(b.mac_algo() == m_macs[i])
                   return false;
                }
             }
@@ -198,8 +208,7 @@ class Ciphersuite_Preference_Ordering
          return false; // equal (?!?)
          }
    private:
-      std::vector<std::string> m_ciphers, m_hashes, m_kex, m_sigs;
-
+      std::vector<std::string> m_ciphers, m_macs, m_kex, m_sigs;
    };
 
 }
@@ -208,11 +217,11 @@ std::vector<u16bit> ciphersuite_list(const Policy& policy,
                                      bool have_srp)
    {
    const std::vector<std::string> ciphers = policy.allowed_ciphers();
-   const std::vector<std::string> hashes = policy.allowed_hashes();
+   const std::vector<std::string> macs = policy.allowed_macs();
    const std::vector<std::string> kex = policy.allowed_key_exchange_methods();
    const std::vector<std::string> sigs = policy.allowed_signature_methods();
 
-   Ciphersuite_Preference_Ordering order(ciphers, hashes, kex, sigs);
+   Ciphersuite_Preference_Ordering order(ciphers, macs, kex, sigs);
 
    std::set<Ciphersuite, Ciphersuite_Preference_Ordering> ciphersuites(order);
 
@@ -227,7 +236,7 @@ std::vector<u16bit> ciphersuite_list(const Policy& policy,
       if(!value_exists(ciphers, suite.cipher_algo()))
          continue; // unsupported cipher
 
-      if(!value_exists(hashes, suite.mac_algo()))
+      if(!value_exists(macs, suite.mac_algo()))
          continue; // unsupported MAC algo
 
       if(!value_exists(sigs, suite.sig_algo()))
diff --git a/src/tls/tls_policy.h b/src/tls/tls_policy.h
index c47c45605..f6d276af9 100644
--- a/src/tls/tls_policy.h
+++ b/src/tls/tls_policy.h
@@ -33,12 +33,15 @@ class BOTAN_DLL Policy
       virtual std::vector<std::string> allowed_ciphers() const;
 
       /**
-      * Returns a list of hash algorithms we are willing to use, in
-      * order of preference. This is used for both MACs and signatures.
-      * Allowed values: any hash name, though currently only MD5,
-      * SHA-1, and the SHA-2 variants are used.
+      * Returns a list of hash algorithms we are willing to use for
+      * signatures.
       */
-      virtual std::vector<std::string> allowed_hashes() const;
+      virtual std::vector<std::string> allowed_signature_hashes() const;
+
+      /**
+      * Returns a list of MAC algorithms we are willing to use.
+      */
+      virtual std::vector<std::string> allowed_macs() const;
 
       /**
       * Returns a list of key exchange algorithms we are willing to
diff --git a/src/tls/tls_server.h b/src/tls/tls_server.h
index 9625adcf3..89e27fa92 100644
--- a/src/tls/tls_server.h
+++ b/src/tls/tls_server.h
@@ -35,7 +35,7 @@ class BOTAN_DLL Server : public Channel
              const std::vector<std::string>& protocols =
                 std::vector<std::string>());
 
-      void renegotiate(bool force_full_renegotiation);
+      void renegotiate(bool force_full_renegotiation = false);
 
       /**
       * Return the server name indicator, if sent by the client