aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/tls
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/tls')
-rw-r--r--src/lib/tls/info.txt1
-rw-r--r--src/lib/tls/msg_cert_req.cpp6
-rw-r--r--src/lib/tls/msg_certificate.cpp6
-rw-r--r--src/lib/tls/msg_client_hello.cpp31
-rw-r--r--src/lib/tls/msg_server_hello.cpp29
-rw-r--r--src/lib/tls/tls_blocking.cpp19
-rw-r--r--src/lib/tls/tls_blocking.h5
-rw-r--r--src/lib/tls/tls_channel.cpp229
-rw-r--r--src/lib/tls/tls_channel.h81
-rw-r--r--src/lib/tls/tls_ciphersuite.h37
-rw-r--r--src/lib/tls/tls_client.cpp87
-rw-r--r--src/lib/tls/tls_client.h95
-rw-r--r--src/lib/tls/tls_extensions.h2
-rw-r--r--src/lib/tls/tls_handshake_msg.h14
-rw-r--r--src/lib/tls/tls_messages.h83
-rw-r--r--src/lib/tls/tls_record.cpp151
-rw-r--r--src/lib/tls/tls_record.h91
-rw-r--r--src/lib/tls/tls_server.cpp822
-rw-r--r--src/lib/tls/tls_server.h52
-rw-r--r--src/lib/tls/tls_server_handshake_state.h47
-rw-r--r--src/lib/tls/tls_session.cpp58
-rw-r--r--src/lib/tls/tls_session.h118
22 files changed, 1172 insertions, 892 deletions
diff --git a/src/lib/tls/info.txt b/src/lib/tls/info.txt
index a43d5619a..de15a65e5 100644
--- a/src/lib/tls/info.txt
+++ b/src/lib/tls/info.txt
@@ -29,6 +29,7 @@ tls_messages.h
tls_reader.h
tls_record.h
tls_seq_numbers.h
+tls_server_handshake_state.h
tls_session_key.h
</header:internal>
diff --git a/src/lib/tls/msg_cert_req.cpp b/src/lib/tls/msg_cert_req.cpp
index 4fd528148..569a5aa63 100644
--- a/src/lib/tls/msg_cert_req.cpp
+++ b/src/lib/tls/msg_cert_req.cpp
@@ -1,6 +1,7 @@
/*
* Certificate Request Message
* (C) 2004-2006,2012 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -51,8 +52,7 @@ byte cert_type_name_to_code(const std::string& name)
/**
* Create a new Certificate Request message
*/
-Certificate_Req::Certificate_Req(Handshake_IO& io,
- Handshake_Hash& hash,
+Certificate_Req::Certificate_Req(Handshake_Info& hs_info,
const Policy& policy,
const std::vector<X509_DN>& ca_certs,
Protocol_Version version) :
@@ -69,7 +69,7 @@ Certificate_Req::Certificate_Req(Handshake_IO& io,
m_supported_algos.push_back(std::make_pair(hashes[i], sigs[j]));
}
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
/**
diff --git a/src/lib/tls/msg_certificate.cpp b/src/lib/tls/msg_certificate.cpp
index 32e3e17f0..a622d8573 100644
--- a/src/lib/tls/msg_certificate.cpp
+++ b/src/lib/tls/msg_certificate.cpp
@@ -1,6 +1,7 @@
/*
* Certificate Message
* (C) 2004-2006,2012 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -20,12 +21,11 @@ namespace TLS {
/**
* Create a new Certificate message
*/
-Certificate::Certificate(Handshake_IO& io,
- Handshake_Hash& hash,
+Certificate::Certificate(Handshake_Info& hs_info,
const std::vector<X509_Certificate>& cert_list) :
m_certs(cert_list)
{
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
/**
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 23807215f..9c080b9a5 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -1,6 +1,7 @@
/*
* TLS Hello Request and Client Hello Messages
* (C) 2004-2011,2015,2016 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -66,24 +67,21 @@ std::vector<byte> Hello_Request::serialize() const
/*
* Create a new Client Hello message
*/
-Client_Hello::Client_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
- Protocol_Version version,
+Client_Hello::Client_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
- const std::vector<std::string>& next_protocols,
- const std::string& hostname,
- const std::string& srp_identifier) :
- m_version(version),
+ const Client_Hello::Settings& client_settings,
+ const std::vector<std::string>& next_protocols) :
+ m_version(client_settings.protocol_version()),
m_random(make_hello_random(rng, policy)),
- m_suites(policy.ciphersuite_list(m_version, (srp_identifier != ""))),
+ m_suites(policy.ciphersuite_list(m_version,
+ client_settings.srp_identifier() != "")),
m_comp_methods(policy.compression())
{
m_extensions.add(new Extended_Master_Secret);
m_extensions.add(new Renegotiation_Extension(reneg_info));
-
- m_extensions.add(new Server_Name_Indicator(hostname));
+ m_extensions.add(new Server_Name_Indicator(client_settings.hostname()));
m_extensions.add(new Session_Ticket());
m_extensions.add(new Supported_Elliptic_Curves(policy.allowed_ecc_curves()));
@@ -98,7 +96,7 @@ Client_Hello::Client_Hello(Handshake_IO& io,
m_extensions.add(new Application_Layer_Protocol_Notification(next_protocols));
#if defined(BOTAN_HAS_SRP6)
- m_extensions.add(new SRP_Identifier(srp_identifier));
+ m_extensions.add(new SRP_Identifier(client_settings.srp_identifier()));
#else
if(!srp_identifier.empty())
{
@@ -106,20 +104,19 @@ Client_Hello::Client_Hello(Handshake_IO& io,
}
#endif
- BOTAN_ASSERT(policy.acceptable_protocol_version(version),
+ BOTAN_ASSERT(policy.acceptable_protocol_version(client_settings.protocol_version()),
"Our policy accepts the version we are offering");
- if(policy.send_fallback_scsv(version))
+ if(policy.send_fallback_scsv(client_settings.protocol_version()))
m_suites.push_back(TLS_FALLBACK_SCSV);
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
/*
* Create a new Client Hello message (session resumption case)
*/
-Client_Hello::Client_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+Client_Hello::Client_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
@@ -165,7 +162,7 @@ Client_Hello::Client_Hello(Handshake_IO& io,
}
#endif
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
void Client_Hello::update_hello_cookie(const Hello_Verify_Request& hello_verify)
diff --git a/src/lib/tls/msg_server_hello.cpp b/src/lib/tls/msg_server_hello.cpp
index f8d0c63c7..2c80ed59a 100644
--- a/src/lib/tls/msg_server_hello.cpp
+++ b/src/lib/tls/msg_server_hello.cpp
@@ -1,6 +1,7 @@
/*
* TLS Server Hello and Server Hello Done
* (C) 2004-2011,2015,2016 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -17,23 +18,18 @@ namespace Botan {
namespace TLS {
// New session case
-Server_Hello::Server_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+Server_Hello::Server_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
const Client_Hello& client_hello,
- const std::vector<byte>& new_session_id,
- Protocol_Version new_session_version,
- u16bit ciphersuite,
- byte compression,
- bool offer_session_ticket,
- const std::string& next_protocol) :
- m_version(new_session_version),
- m_session_id(new_session_id),
+ const Server_Hello::Settings& server_settings,
+ const std::string next_protocol) :
+ m_version(server_settings.protocol_version()),
+ m_session_id(server_settings.session_id()),
m_random(make_hello_random(rng, policy)),
- m_ciphersuite(ciphersuite),
- m_comp_method(compression)
+ m_ciphersuite(server_settings.ciphersuite()),
+ m_comp_method(server_settings.compression())
{
if(client_hello.supports_extended_master_secret())
m_extensions.add(new Extended_Master_Secret);
@@ -41,7 +37,7 @@ Server_Hello::Server_Hello(Handshake_IO& io,
if(client_hello.secure_renegotiation())
m_extensions.add(new Renegotiation_Extension(reneg_info));
- if(client_hello.supports_session_ticket() && offer_session_ticket)
+ if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket())
m_extensions.add(new Session_Ticket());
if(!next_protocol.empty() && client_hello.supports_alpn())
@@ -68,12 +64,11 @@ Server_Hello::Server_Hello(Handshake_IO& io,
}
}
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
// Resuming
-Server_Hello::Server_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+Server_Hello::Server_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
@@ -99,7 +94,7 @@ Server_Hello::Server_Hello(Handshake_IO& io,
if(!next_protocol.empty() && client_hello.supports_alpn())
m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
- hash.update(io.send(*this));
+ hs_info.get_hash().update(hs_info.get_io().send(*this));
}
/*
diff --git a/src/lib/tls/tls_blocking.cpp b/src/lib/tls/tls_blocking.cpp
index a1867b6b5..14e04693d 100644
--- a/src/lib/tls/tls_blocking.cpp
+++ b/src/lib/tls/tls_blocking.cpp
@@ -1,6 +1,7 @@
/*
* TLS Blocking API
* (C) 2013 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -19,21 +20,19 @@ Blocking_Client::Blocking_Client(read_fn reader,
Credentials_Manager& creds,
const Policy& policy,
RandomNumberGenerator& rng,
- const Server_Information& server_info,
- const Protocol_Version& offer_version,
- const std::vector<std::string>& next) :
+ TLS::Client::Properties& properties) :
m_read(reader),
- m_channel(writer,
- std::bind(&Blocking_Client::data_cb, this, _1, _2),
- std::bind(&Blocking_Client::alert_cb, this, _1, _2, _3),
- std::bind(&Blocking_Client::handshake_cb, this, _1),
+ m_channel(TLS::Client::Callbacks(
+ writer,
+ std::bind(&Blocking_Client::data_cb, this, _1, _2),
+ std::bind(&Blocking_Client::alert_cb, this, _1, _2, _3),
+ std::bind(&Blocking_Client::handshake_cb, this, _1)
+ ),
session_manager,
creds,
policy,
rng,
- server_info,
- offer_version,
- next)
+ properties)
{
}
diff --git a/src/lib/tls/tls_blocking.h b/src/lib/tls/tls_blocking.h
index 00e65cbaf..47c5c7483 100644
--- a/src/lib/tls/tls_blocking.h
+++ b/src/lib/tls/tls_blocking.h
@@ -1,6 +1,7 @@
/*
* TLS Blocking API
* (C) 2013 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -38,9 +39,7 @@ class BOTAN_DLL Blocking_Client
Credentials_Manager& creds,
const Policy& policy,
RandomNumberGenerator& rng,
- const Server_Information& server_info = Server_Information(),
- const Protocol_Version& offer_version = Protocol_Version::latest_tls_version(),
- const std::vector<std::string>& next_protos = {});
+ TLS::Client::Properties& properties);
/**
* Completes full handshake then returns
diff --git a/src/lib/tls/tls_channel.cpp b/src/lib/tls/tls_channel.cpp
index f445eef99..2c7e80feb 100644
--- a/src/lib/tls/tls_channel.cpp
+++ b/src/lib/tls/tls_channel.cpp
@@ -1,6 +1,7 @@
/*
* TLS Channels
* (C) 2011,2012,2014,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -18,22 +19,16 @@ namespace Botan {
namespace TLS {
-Channel::Channel(output_fn output_fn,
- data_cb data_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
- handshake_msg_cb handshake_msg_cb,
+size_t TLS::Channel::IO_BUF_DEFAULT_SIZE = 10*1024;
+
+Channel::Channel(const Callbacks& callbacks,
Session_Manager& session_manager,
RandomNumberGenerator& rng,
const Policy& policy,
bool is_datagram,
size_t reserved_io_buffer_size) :
m_is_datagram(is_datagram),
- m_data_cb(data_cb),
- m_alert_cb(alert_cb),
- m_output_fn(output_fn),
- m_handshake_cb(handshake_cb),
- m_handshake_msg_cb(handshake_msg_cb),
+ m_callbacks(callbacks),
m_session_manager(session_manager),
m_policy(policy),
m_rng(rng)
@@ -263,23 +258,19 @@ size_t Channel::received_data(const byte input[], size_t input_size)
{
while(!is_closed() && input_size)
{
- secure_vector<byte> record;
+ secure_vector<byte> record_data;
u64bit record_sequence = 0;
Record_Type record_type = NO_RECORD;
Protocol_Version record_version;
size_t consumed = 0;
+ Record_Raw_Input raw_input(input, input_size, consumed, m_is_datagram);
+ Record record(record_data, &record_sequence, &record_version, &record_type);
const size_t needed =
read_record(m_readbuf,
- input,
- input_size,
- m_is_datagram,
- consumed,
+ raw_input,
record,
- &record_sequence,
- &record_version,
- &record_type,
m_sequence_numbers.get(),
std::bind(&TLS::Channel::read_cipher_state_epoch, this,
std::placeholders::_1));
@@ -298,105 +289,21 @@ size_t Channel::received_data(const byte input[], size_t input_size)
if(input_size == 0 && needed != 0)
return needed; // need more data to complete record
- if(record.size() > MAX_PLAINTEXT_SIZE)
+ if(record_data.size() > MAX_PLAINTEXT_SIZE)
throw TLS_Exception(Alert::RECORD_OVERFLOW,
"TLS plaintext record is larger than allowed maximum");
if(record_type == HANDSHAKE || record_type == CHANGE_CIPHER_SPEC)
{
- if(!m_pending_state)
- {
- // No pending handshake, possibly new:
- if(record_version.is_datagram_protocol())
- {
- if(m_sequence_numbers)
- {
- /*
- * Might be a peer retransmit under epoch - 1 in which
- * case we must retransmit last flight
- */
- sequence_numbers().read_accept(record_sequence);
-
- const u16bit epoch = record_sequence >> 48;
-
- if(epoch == sequence_numbers().current_read_epoch())
- {
- create_handshake_state(record_version);
- }
- else if(epoch == sequence_numbers().current_read_epoch() - 1)
- {
- BOTAN_ASSERT(m_active_state, "Have active state here");
- m_active_state->handshake_io().add_record(unlock(record),
- record_type,
- record_sequence);
- }
- }
- else if(record_sequence == 0)
- {
- create_handshake_state(record_version);
- }
- }
- else
- {
- create_handshake_state(record_version);
- }
- }
-
- // May have been created in above conditional
- if(m_pending_state)
- {
- m_pending_state->handshake_io().add_record(unlock(record),
- record_type,
- record_sequence);
-
- while(auto pending = m_pending_state.get())
- {
- auto msg = pending->get_next_handshake_msg();
-
- if(msg.first == HANDSHAKE_NONE) // no full handshake yet
- break;
-
- process_handshake_msg(active_state(), *pending,
- msg.first, msg.second);
- }
- }
+ process_handshake_ccs(record_data, record_sequence, record_type, record_version);
}
else if(record_type == APPLICATION_DATA)
{
- if(!active_state())
- throw Unexpected_Message("Application data before handshake done");
-
- /*
- * OpenSSL among others sends empty records in versions
- * before TLS v1.1 in order to randomize the IV of the
- * following record. Avoid spurious callbacks.
- */
- if(record.size() > 0)
- m_data_cb(record.data(), record.size());
+ process_application_data(record_data);
}
else if(record_type == ALERT)
{
- Alert alert_msg(record);
-
- if(alert_msg.type() == Alert::NO_RENEGOTIATION)
- m_pending_state.reset();
-
- m_alert_cb(alert_msg, nullptr, 0);
-
- if(alert_msg.is_fatal())
- {
- if(auto active = active_state())
- m_session_manager.remove_entry(active->server_hello()->session_id());
- }
-
- if(alert_msg.type() == Alert::CLOSE_NOTIFY)
- send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind
-
- if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal())
- {
- reset_state();
- return 0;
- }
+ process_alert(record_data);
}
else if(record_type != NO_RECORD)
throw Unexpected_Message("Unexpected record type " +
@@ -428,6 +335,108 @@ size_t Channel::received_data(const byte input[], size_t input_size)
}
}
+void Channel::process_handshake_ccs(secure_vector<byte>& record,
+ u64bit& record_sequence,
+ Record_Type& record_type,
+ Protocol_Version& record_version)
+ {
+ if(!m_pending_state)
+ {
+ // No pending handshake, possibly new:
+ if(record_version.is_datagram_protocol())
+ {
+ if(m_sequence_numbers)
+ {
+ /*
+ * Might be a peer retransmit under epoch - 1 in which
+ * case we must retransmit last flight
+ */
+ sequence_numbers().read_accept(record_sequence);
+
+ const u16bit epoch = record_sequence >> 48;
+
+ if(epoch == sequence_numbers().current_read_epoch())
+ {
+ create_handshake_state(record_version);
+ }
+ else if(epoch == sequence_numbers().current_read_epoch() - 1)
+ {
+ BOTAN_ASSERT(m_active_state, "Have active state here");
+ m_active_state->handshake_io().add_record(unlock(record),
+ record_type,
+ record_sequence);
+ }
+ }
+ else if(record_sequence == 0)
+ {
+ create_handshake_state(record_version);
+ }
+ }
+ else
+ {
+ create_handshake_state(record_version);
+ }
+ }
+
+ // May have been created in above conditional
+ if(m_pending_state)
+ {
+ m_pending_state->handshake_io().add_record(unlock(record),
+ record_type,
+ record_sequence);
+
+ while(auto pending = m_pending_state.get())
+ {
+ auto msg = pending->get_next_handshake_msg();
+
+ if(msg.first == HANDSHAKE_NONE) // no full handshake yet
+ break;
+
+ process_handshake_msg(active_state(), *pending,
+ msg.first, msg.second);
+ }
+ }
+ }
+
+void Channel::process_application_data(secure_vector<byte>& record)
+ {
+ if(!active_state())
+ throw Unexpected_Message("Application data before handshake done");
+
+ /*
+ * OpenSSL among others sends empty records in versions
+ * before TLS v1.1 in order to randomize the IV of the
+ * following record. Avoid spurious callbacks.
+ */
+ if(record.size() > 0)
+ m_callbacks.app_data()(record.data(), record.size());
+ }
+
+void Channel::process_alert(secure_vector<byte>& record)
+ {
+ Alert alert_msg(record);
+
+ if(alert_msg.type() == Alert::NO_RENEGOTIATION)
+ m_pending_state.reset();
+
+ m_callbacks.alert()(alert_msg, nullptr, 0);
+
+ if(alert_msg.is_fatal())
+ {
+ if(auto active = active_state())
+ m_session_manager.remove_entry(active->server_hello()->session_id());
+ }
+
+ if(alert_msg.type() == Alert::CLOSE_NOTIFY)
+ send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind
+
+ if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal())
+ {
+ reset_state();
+ }
+ }
+
+
void Channel::write_record(Connection_Cipher_State* cipher_state, u16bit epoch,
byte record_type, const byte input[], size_t length)
{
@@ -436,16 +445,16 @@ void Channel::write_record(Connection_Cipher_State* cipher_state, u16bit epoch,
Protocol_Version record_version =
(m_pending_state) ? (m_pending_state->version()) : (m_active_state->version());
+ Record_Message record_message(record_type, 0, input, length);
+
TLS::write_record(m_writebuf,
- record_type,
- input,
- length,
+ record_message,
record_version,
sequence_numbers().next_write_sequence(epoch),
cipher_state,
m_rng);
- m_output_fn(m_writebuf.data(), m_writebuf.size());
+ m_callbacks.out_fn()(m_writebuf.data(), m_writebuf.size());
}
void Channel::send_record_array(u16bit epoch, byte type, const byte input[], size_t length)
diff --git a/src/lib/tls/tls_channel.h b/src/lib/tls/tls_channel.h
index e0219c242..c9ea8edde 100644
--- a/src/lib/tls/tls_channel.h
+++ b/src/lib/tls/tls_channel.h
@@ -1,6 +1,7 @@
/*
* TLS Channel
* (C) 2011,2012,2014,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -32,22 +33,58 @@ class Handshake_Message;
class BOTAN_DLL Channel
{
public:
- typedef std::function<void (const byte[], size_t)> output_fn;
- typedef std::function<void (const byte[], size_t)> data_cb;
- typedef std::function<void (Alert, const byte[], size_t)> alert_cb;
- typedef std::function<bool (const Session&)> handshake_cb;
- typedef std::function<void (const Handshake_Message&)> handshake_msg_cb;
-
- Channel(output_fn out,
- data_cb app_data_cb,
- alert_cb alert_cb,
- handshake_cb hs_cb,
- handshake_msg_cb hs_msg_cb,
+ static size_t IO_BUF_DEFAULT_SIZE;
+
+ class Callbacks
+ {
+ public:
+ typedef std::function<void (const byte[], size_t)> output_fn;
+ typedef std::function<void (const byte[], size_t)> data_cb;
+ typedef std::function<void (Alert, const byte[], size_t)> alert_cb;
+ typedef std::function<bool (const Session&)> handshake_cb;
+ typedef std::function<void (const Handshake_Message&)> handshake_msg_cb;
+ /**
+ * Encapsulates a set of callback functions required by a TLS Channel.
+ * @param output_fn is called with data for the outbound socket
+ *
+ * @param app_data_cb is called when new application data is received
+ *
+ * @param alert_cb is called when a TLS alert is received
+ *
+ * @param handshake_cb is called when a handshake is completed
+ */
+ Callbacks(output_fn out, data_cb app_data_cb, alert_cb alert_cb,
+ handshake_cb hs_cb)
+ : m_output_function(out), m_app_data_cb(app_data_cb),
+ m_alert_cb(alert_cb), m_hs_cb(hs_cb), m_hs_msg_cb() {}
+
+ Callbacks(output_fn out, data_cb app_data_cb, alert_cb alert_cb,
+ handshake_cb hs_cb, handshake_msg_cb hs_msg_cb)
+ : m_output_function(out), m_app_data_cb(app_data_cb),
+ m_alert_cb(alert_cb), m_hs_cb(hs_cb), m_hs_msg_cb(hs_msg_cb) {}
+
+ const output_fn& out_fn() const { return m_output_function; }
+ const data_cb& app_data() const { return m_app_data_cb; }
+ const alert_cb& alert() const { return m_alert_cb; }
+ const handshake_cb& handshake() const { return m_hs_cb; }
+ const handshake_msg_cb& handshake_msg() const { return m_hs_msg_cb; }
+
+ private:
+ const output_fn m_output_function;
+ const data_cb m_app_data_cb;
+ const alert_cb m_alert_cb;
+ const handshake_cb m_hs_cb;
+ const handshake_msg_cb m_hs_msg_cb;
+ };
+
+
+
+ Channel(const Callbacks& callbacks,
Session_Manager& session_manager,
RandomNumberGenerator& rng,
const Policy& policy,
bool is_datagram,
- size_t io_buf_sz = 16*1024);
+ size_t io_buf_sz = IO_BUF_DEFAULT_SIZE);
Channel(const Channel&) = delete;
@@ -200,9 +237,9 @@ class BOTAN_DLL Channel
const Policy& policy() const { return m_policy; }
- bool save_session(const Session& session) const { return m_handshake_cb(session); }
+ bool save_session(const Session& session) const { return m_callbacks.handshake()(session); }
- handshake_msg_cb get_handshake_msg_cb() const { return m_handshake_msg_cb; }
+ Callbacks get_callbacks() const { return m_callbacks; }
private:
void send_record(byte record_type, const std::vector<byte>& record);
@@ -227,14 +264,20 @@ class BOTAN_DLL Channel
const Handshake_State* pending_state() const { return m_pending_state.get(); }
+ /* methods to handle incoming traffic through Channel::receive_data. */
+ void process_handshake_ccs(secure_vector<byte>& record,
+ u64bit& record_sequence,
+ Record_Type& record_type,
+ Protocol_Version& record_version);
+
+ void process_application_data(secure_vector<byte>& record);
+
+ void process_alert(secure_vector<byte>& record);
+
bool m_is_datagram;
/* callbacks */
- data_cb m_data_cb;
- alert_cb m_alert_cb;
- output_fn m_output_fn;
- handshake_cb m_handshake_cb;
- handshake_msg_cb m_handshake_msg_cb;
+ Callbacks m_callbacks;
/* external state */
Session_Manager& m_session_manager;
diff --git a/src/lib/tls/tls_ciphersuite.h b/src/lib/tls/tls_ciphersuite.h
index 1f646cc7e..71596897c 100644
--- a/src/lib/tls/tls_ciphersuite.h
+++ b/src/lib/tls/tls_ciphersuite.h
@@ -1,6 +1,7 @@
/*
* TLS Cipher Suites
* (C) 2004-2011,2012 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -116,31 +117,17 @@ class BOTAN_DLL Ciphersuite
private:
-
- Ciphersuite(u16bit ciphersuite_code,
- const char* iana_id,
- const char* sig_algo,
- const char* kex_algo,
- const char* cipher_algo,
- size_t cipher_keylen,
- size_t nonce_bytes_from_handshake,
- size_t nonce_bytes_from_record,
- const char* mac_algo,
- size_t mac_keylen,
- const char* prf_algo) :
- m_ciphersuite_code(ciphersuite_code),
- m_iana_id(iana_id),
- m_sig_algo(sig_algo),
- m_kex_algo(kex_algo),
- m_prf_algo(prf_algo),
- m_cipher_algo(cipher_algo),
- m_mac_algo(mac_algo),
- m_cipher_keylen(cipher_keylen),
- m_nonce_bytes_from_handshake(nonce_bytes_from_handshake),
- m_nonce_bytes_from_record(nonce_bytes_from_record),
- m_mac_keylen(mac_keylen)
- {
- }
+ Ciphersuite(u16bit ciphersuite_code,
+ const char* iana_id,
+ const char* sig_algo,
+ const char* kex_algo,
+ const char* cipher_algo,
+ size_t cipher_keylen,
+ size_t nonce_bytes_from_handshake,
+ size_t nonce_bytes_from_record,
+ const char* mac_algo,
+ size_t mac_keylen,
+ const char* prf_algo = "");
u16bit m_ciphersuite_code = 0;
diff --git a/src/lib/tls/tls_client.cpp b/src/lib/tls/tls_client.cpp
index 301c77c6b..ff4b20bbf 100644
--- a/src/lib/tls/tls_client.cpp
+++ b/src/lib/tls/tls_client.cpp
@@ -1,6 +1,7 @@
/*
* TLS Client
* (C) 2004-2011,2012,2015,2016 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -42,55 +43,28 @@ class Client_Handshake_State : public Handshake_State
/*
* TLS Client Constructor
*/
-Client::Client(output_fn output_fn,
- data_cb proc_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
+Client::Client(const Callbacks& callbacks,
Session_Manager& session_manager,
Credentials_Manager& creds,
const Policy& policy,
RandomNumberGenerator& rng,
- const Server_Information& info,
- const Protocol_Version& offer_version,
- const std::vector<std::string>& next_protos,
+ Properties properties,
size_t io_buf_sz) :
- Channel(output_fn, proc_cb, alert_cb, handshake_cb, Channel::handshake_msg_cb(),
- session_manager, rng, policy, offer_version.is_datagram_protocol(), io_buf_sz),
+ Channel(callbacks, session_manager, rng, policy, properties.get_protocol_version().is_datagram_protocol(),
+ io_buf_sz),
m_creds(creds),
- m_info(info)
+ m_info(properties.get_server_info())
{
const std::string srp_identifier = m_creds.srp_identifier("tls-client", m_info.hostname());
- Handshake_State& state = create_handshake_state(offer_version);
- send_client_hello(state, false, offer_version, srp_identifier, next_protos);
- }
-
-Client::Client(output_fn output_fn,
- data_cb proc_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
- handshake_msg_cb hs_msg_cb,
- Session_Manager& session_manager,
- Credentials_Manager& creds,
- const Policy& policy,
- RandomNumberGenerator& rng,
- const Server_Information& info,
- const Protocol_Version& offer_version,
- const std::vector<std::string>& next_protos) :
- Channel(output_fn, proc_cb, alert_cb, handshake_cb, hs_msg_cb,
- session_manager, rng, policy, offer_version.is_datagram_protocol()),
- m_creds(creds),
- m_info(info)
- {
- const std::string srp_identifier = m_creds.srp_identifier("tls-client", m_info.hostname());
-
- Handshake_State& state = create_handshake_state(offer_version);
- send_client_hello(state, false, offer_version, srp_identifier, next_protos);
+ Handshake_State& state = create_handshake_state(properties.get_protocol_version());
+ send_client_hello(state, false, properties.get_protocol_version(),
+ srp_identifier, properties.get_next_protocol_versions());
}
Handshake_State* Client::new_handshake_state(Handshake_IO* io)
{
- return new Client_Handshake_State(io, get_handshake_msg_cb());
+ return new Client_Handshake_State(io, get_callbacks().handshake_msg());
}
std::vector<X509_Certificate>
@@ -129,9 +103,9 @@ void Client::send_client_hello(Handshake_State& state_base,
{
if(srp_identifier == "" || session_info.srp_identifier() == srp_identifier)
{
+ Client_Hello::Handshake_Info hs_info(state.handshake_io(), state.hash());
state.client_hello(new Client_Hello(
- state.handshake_io(),
- state.hash(),
+ hs_info,
policy(),
rng(),
secure_renegotiation_data_for_client_hello(),
@@ -145,16 +119,16 @@ void Client::send_client_hello(Handshake_State& state_base,
if(!state.client_hello()) // not resuming
{
+ Client_Hello::Handshake_Info hs_info(state.handshake_io(), state.hash());
+
+ Client_Hello::Settings client_settings(version, m_info.hostname(), srp_identifier);
state.client_hello(new Client_Hello(
- state.handshake_io(),
- state.hash(),
- version,
+ hs_info,
policy(),
rng(),
secure_renegotiation_data_for_client_hello(),
- next_protocols,
- m_info.hostname(),
- srp_identifier));
+ client_settings,
+ next_protocols));
}
secure_renegotiation_check(state.client_hello());
@@ -419,11 +393,10 @@ void Client::process_handshake_msg(const Handshake_State* active_state,
"tls-client",
m_info.hostname());
- state.client_certs(
- new Certificate(state.handshake_io(),
- state.hash(),
- client_certs)
- );
+ Certificate::Handshake_Info hs_info(state.handshake_io(),
+ state.hash());
+
+ state.client_certs(new Certificate(hs_info, client_certs));
}
state.client_kex(
@@ -502,20 +475,22 @@ void Client::process_handshake_msg(const Handshake_State* active_state,
if(session_id.empty() && !session_ticket.empty())
session_id = make_hello_random(rng(), policy());
+ Session::Properties session_properties(
+ m_info,
+ "",
+ state.server_hello()->srtp_profile(),
+ state.server_hello()->version(),
+ state.server_hello()->ciphersuite(),
+ state.server_hello()->compression_method());
+
Session session_info(
session_id,
state.session_keys().master_secret(),
- state.server_hello()->version(),
- state.server_hello()->ciphersuite(),
- state.server_hello()->compression_method(),
CLIENT,
state.server_hello()->supports_extended_master_secret(),
get_peer_cert_chain(state),
session_ticket,
- m_info,
- "",
- state.server_hello()->srtp_profile()
- );
+ session_properties);
const bool should_save = save_session(session_info);
diff --git a/src/lib/tls/tls_client.h b/src/lib/tls/tls_client.h
index 45a741878..e80739010 100644
--- a/src/lib/tls/tls_client.h
+++ b/src/lib/tls/tls_client.h
@@ -1,6 +1,7 @@
/*
* TLS Client
* (C) 2004-2011 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -25,13 +26,8 @@ class BOTAN_DLL Client final : public Channel
/**
* Set up a new TLS client session
*
- * @param output_fn is called with data for the outbound socket
- *
- * @param app_data_cb is called when new application data is received
- *
- * @param alert_cb is called when a TLS alert is received
- *
- * @param handshake_cb is called when a handshake is completed
+ * @param callbacks contains a set of callback function references
+ * required by the TLS client.
*
* @param session_manager manages session state
*
@@ -41,44 +37,65 @@ class BOTAN_DLL Client final : public Channel
*
* @param rng a random number generator
*
- * @param server_info is identifying information about the TLS server
- *
- * @param offer_version specifies which version we will offer
- * to the TLS server.
- *
- * @param next_protocols specifies protocols to advertise with ALPN
+ * @param properties holds server information and protocol related
+ * properties.
*
* @param reserved_io_buffer_size This many bytes of memory will
* be preallocated for the read and write buffers. Smaller
* values just mean reallocations and copies are more likely.
*/
- Client(output_fn out,
- data_cb app_data_cb,
- alert_cb alert_cb,
- handshake_cb hs_cb,
- Session_Manager& session_manager,
- Credentials_Manager& creds,
- const Policy& policy,
- RandomNumberGenerator& rng,
- const Server_Information& server_info = Server_Information(),
- const Protocol_Version& offer_version = Protocol_Version::latest_tls_version(),
- const std::vector<std::string>& next_protocols = {},
- size_t reserved_io_buffer_size = 16*1024
- );
-
- Client(output_fn out,
- data_cb app_data_cb,
- alert_cb alert_cb,
- handshake_cb hs_cb,
- handshake_msg_cb hs_msg_cb,
- Session_Manager& session_manager,
- Credentials_Manager& creds,
- const Policy& policy,
- RandomNumberGenerator& rng,
- const Server_Information& server_info = Server_Information(),
- const Protocol_Version& offer_version = Protocol_Version::latest_tls_version(),
- const std::vector<std::string>& next_protocols = {}
+ class Properties
+ {
+ /**
+ * Stores TLS Client properties.
+ *
+ * @param server_info is identifying information about the TLS server
+ *
+ * @param protocol_version specifies which version we will offer
+ * to the TLS server.
+ *
+ * @param next_protocols specifies protocols to advertise with ALPN
+ */
+
+ public:
+ Properties(const Server_Information& server_info
+ = Server_Information(),
+ const Protocol_Version protocol_version
+ = Protocol_Version::latest_tls_version(),
+ const std::vector<std::string>& next_versions
+ = {})
+ : m_server_info(server_info),
+ m_protocol_version(protocol_version),
+ m_next_protocol_versions(next_versions) {}
+
+ const Server_Information& get_server_info()
+ {
+ return m_server_info;
+ }
+
+ const Protocol_Version& get_protocol_version()
+ {
+ return m_protocol_version;
+ }
+
+ const std::vector<std::string>& get_next_protocol_versions()
+ {
+ return m_next_protocol_versions;
+ }
+
+ private:
+ const Server_Information& m_server_info;
+ const Protocol_Version m_protocol_version;
+ const std::vector<std::string>& m_next_protocol_versions;
+ };
+ Client(const Callbacks& callbacks,
+ Session_Manager& session_manager,
+ Credentials_Manager& creds,
+ const Policy& policy,
+ RandomNumberGenerator& rng,
+ Properties properties,
+ size_t reserved_io_buffer_size = 16*1024
);
const std::string& application_protocol() const { return m_application_protocol; }
diff --git a/src/lib/tls/tls_extensions.h b/src/lib/tls/tls_extensions.h
index a5aac0020..cfde0067c 100644
--- a/src/lib/tls/tls_extensions.h
+++ b/src/lib/tls/tls_extensions.h
@@ -1,6 +1,7 @@
/*
* TLS Extensions
* (C) 2011,2012,2016 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -34,7 +35,6 @@ enum Handshake_Extension_Type {
TLSEXT_SRP_IDENTIFIER = 12,
TLSEXT_SIGNATURE_ALGORITHMS = 13,
TLSEXT_USE_SRTP = 14,
- TLSEXT_HEARTBEAT_SUPPORT = 15,
TLSEXT_ALPN = 16,
TLSEXT_EXTENDED_MASTER_SECRET = 23,
diff --git a/src/lib/tls/tls_handshake_msg.h b/src/lib/tls/tls_handshake_msg.h
index 7e527abf4..c53f73a3c 100644
--- a/src/lib/tls/tls_handshake_msg.h
+++ b/src/lib/tls/tls_handshake_msg.h
@@ -1,6 +1,7 @@
/*
* TLS Handshake Message
* (C) 2012 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -22,6 +23,19 @@ namespace TLS {
class BOTAN_DLL Handshake_Message
{
public:
+ class Handshake_Info
+ {
+ public:
+ Handshake_Info(Handshake_IO& io, Handshake_Hash& hash)
+ : m_io(io), m_hash(hash) {};
+
+ Handshake_IO& get_io() { return m_io; };
+ Handshake_Hash& get_hash() {return m_hash; };
+
+ private:
+ Handshake_IO& m_io;
+ Handshake_Hash& m_hash;
+ };
std::string type_string() const;
virtual Handshake_Type type() const = 0;
diff --git a/src/lib/tls/tls_messages.h b/src/lib/tls/tls_messages.h
index 3bee89e13..c6f8f9944 100644
--- a/src/lib/tls/tls_messages.h
+++ b/src/lib/tls/tls_messages.h
@@ -1,6 +1,7 @@
/*
* TLS Messages
* (C) 2004-2011,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -61,6 +62,26 @@ class Hello_Verify_Request final : public Handshake_Message
class Client_Hello final : public Handshake_Message
{
public:
+ class Settings
+ {
+ public:
+ Settings(const Protocol_Version version,
+ const std::string& hostname = "",
+ const std::string& srp_identifier = "")
+ : m_new_session_version(version),
+ m_hostname(hostname),
+ m_srp_identifier(srp_identifier) {};
+
+ const Protocol_Version protocol_version() const { return m_new_session_version; };
+ const std::string& hostname() const { return m_hostname; };
+ const std::string& srp_identifier() const { return m_srp_identifier; }
+
+ private:
+ const Protocol_Version m_new_session_version;
+ const std::string m_hostname;
+ const std::string m_srp_identifier;
+ };
+
Handshake_Type type() const override { return CLIENT_HELLO; }
Protocol_Version version() const { return m_version; }
@@ -160,18 +181,14 @@ class Client_Hello final : public Handshake_Message
std::set<Handshake_Extension_Type> extension_types() const
{ return m_extensions.extension_types(); }
- Client_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
- Protocol_Version version,
+ Client_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
- const std::vector<std::string>& next_protocols,
- const std::string& hostname = "",
- const std::string& srp_identifier = "");
+ const Client_Hello::Settings& client_settings,
+ const std::vector<std::string>& next_protocols);
- Client_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+ Client_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& reneg_info,
@@ -199,6 +216,35 @@ class Client_Hello final : public Handshake_Message
class Server_Hello final : public Handshake_Message
{
public:
+ class Settings
+ {
+ public:
+ Settings(const std::vector<byte> new_session_id,
+ Protocol_Version new_session_version,
+ u16bit ciphersuite,
+ byte compression,
+ bool offer_session_ticket)
+ : m_new_session_id(new_session_id),
+ m_new_session_version(new_session_version),
+ m_ciphersuite(ciphersuite),
+ m_compression(compression),
+ m_offer_session_ticket(offer_session_ticket) {};
+
+ const std::vector<byte>& session_id() const { return m_new_session_id; };
+ Protocol_Version protocol_version() const { return m_new_session_version; };
+ u16bit ciphersuite() const { return m_ciphersuite; };
+ byte compression() const { return m_compression; }
+ bool offer_session_ticket() const { return m_offer_session_ticket; }
+
+ private:
+ const std::vector<byte> m_new_session_id;
+ Protocol_Version m_new_session_version;
+ u16bit m_ciphersuite;
+ byte m_compression;
+ bool m_offer_session_ticket;
+ };
+
+
Handshake_Type type() const override { return SERVER_HELLO; }
Protocol_Version version() const { return m_version; }
@@ -256,21 +302,15 @@ class Server_Hello final : public Handshake_Message
std::set<Handshake_Extension_Type> extension_types() const
{ return m_extensions.extension_types(); }
- Server_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+ Server_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& secure_reneg_info,
const Client_Hello& client_hello,
- const std::vector<byte>& new_session_id,
- Protocol_Version new_session_version,
- u16bit ciphersuite,
- byte compression,
- bool offer_session_ticket,
- const std::string& next_protocol);
+ const Server_Hello::Settings& settings,
+ const std::string next_protocol);
- Server_Hello(Handshake_IO& io,
- Handshake_Hash& hash,
+ Server_Hello(Handshake_Info& hs_info,
const Policy& policy,
RandomNumberGenerator& rng,
const std::vector<byte>& secure_reneg_info,
@@ -301,7 +341,6 @@ class Client_Key_Exchange final : public Handshake_Message
const secure_vector<byte>& pre_master_secret() const
{ return m_pre_master; }
-
Client_Key_Exchange(Handshake_IO& io,
Handshake_State& state,
const Policy& policy,
@@ -337,8 +376,7 @@ class Certificate final : public Handshake_Message
size_t count() const { return m_certs.size(); }
bool empty() const { return m_certs.empty(); }
- Certificate(Handshake_IO& io,
- Handshake_Hash& hash,
+ Certificate(Handshake_Info& hs_info,
const std::vector<X509_Certificate>& certs);
explicit Certificate(const std::vector<byte>& buf);
@@ -364,8 +402,7 @@ class Certificate_Req final : public Handshake_Message
std::vector<std::pair<std::string, std::string> > supported_algos() const
{ return m_supported_algos; }
- Certificate_Req(Handshake_IO& io,
- Handshake_Hash& hash,
+ Certificate_Req(Handshake_Info& hs_info,
const Policy& policy,
const std::vector<X509_DN>& allowed_cas,
Protocol_Version version);
diff --git a/src/lib/tls/tls_record.cpp b/src/lib/tls/tls_record.cpp
index eacf313a8..5fda1fbb4 100644
--- a/src/lib/tls/tls_record.cpp
+++ b/src/lib/tls/tls_record.cpp
@@ -1,6 +1,7 @@
/*
* TLS Record Handling
* (C) 2012,2013,2014,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -152,7 +153,7 @@ Connection_Cipher_State::format_ad(u64bit msg_sequence,
}
void write_record(secure_vector<byte>& output,
- byte msg_type, const byte msg[], size_t msg_length,
+ Record_Message msg,
Protocol_Version version,
u64bit seq,
Connection_Cipher_State* cs,
@@ -160,7 +161,7 @@ void write_record(secure_vector<byte>& output,
{
output.clear();
- output.push_back(msg_type);
+ output.push_back(msg.get_type());
output.push_back(version.major_version());
output.push_back(version.minor_version());
@@ -172,17 +173,17 @@ void write_record(secure_vector<byte>& output,
if(!cs) // initial unencrypted handshake records
{
- output.push_back(get_byte(0, static_cast<u16bit>(msg_length)));
- output.push_back(get_byte(1, static_cast<u16bit>(msg_length)));
+ output.push_back(get_byte<u16bit>(0, static_cast<u16bit>(msg.get_size())));
+ output.push_back(get_byte<u16bit>(1, static_cast<u16bit>(msg.get_size())));
- output.insert(output.end(), msg, msg + msg_length);
+ output.insert(output.end(), msg.get_data(), msg.get_data() + msg.get_size());
return;
}
if(AEAD_Mode* aead = cs->aead())
{
- const size_t ctext_size = aead->output_length(msg_length);
+ const size_t ctext_size = aead->output_length(msg.get_size());
const std::vector<byte> nonce = cs->aead_nonce(seq);
@@ -193,17 +194,16 @@ void write_record(secure_vector<byte>& output,
output.push_back(get_byte(0, static_cast<u16bit>(rec_size)));
output.push_back(get_byte(1, static_cast<u16bit>(rec_size)));
- aead->set_ad(cs->format_ad(seq, msg_type, version, static_cast<u16bit>(msg_length)));
+ aead->set_ad(cs->format_ad(seq, msg.get_type(), version, static_cast<u16bit>(msg.get_size())));
if(cs->nonce_bytes_from_record() > 0)
{
output += std::make_pair(&nonce[cs->nonce_bytes_from_handshake()], cs->nonce_bytes_from_record());
}
-
BOTAN_ASSERT(aead->start(nonce).empty(), "AEAD doesn't return anything from start");
const size_t offset = output.size();
- output += std::make_pair(msg, msg_length);
+ output += std::make_pair(msg.get_data(), msg.get_size());
aead->finish(output, offset);
BOTAN_ASSERT(output.size() == offset + ctext_size, "Expected size");
@@ -213,16 +213,16 @@ void write_record(secure_vector<byte>& output,
return;
}
- cs->mac()->update(cs->format_ad(seq, msg_type, version, static_cast<u16bit>(msg_length)));
+ cs->mac()->update(cs->format_ad(seq, msg.get_type(), version, static_cast<u16bit>(msg.get_size())));
- cs->mac()->update(msg, msg_length);
+ cs->mac()->update(msg.get_data(), msg.get_size());
const size_t block_size = cs->block_size();
const size_t iv_size = cs->iv_size();
const size_t mac_size = cs->mac_size();
const size_t buf_size = round_up(
- iv_size + msg_length + mac_size + (block_size ? 1 : 0),
+ iv_size + msg.get_size() + mac_size + (block_size ? 1 : 0),
block_size);
if(buf_size > MAX_CIPHERTEXT_SIZE)
@@ -239,7 +239,7 @@ void write_record(secure_vector<byte>& output,
rng.randomize(&output[output.size() - iv_size], iv_size);
}
- output.insert(output.end(), msg, msg + msg_length);
+ output.insert(output.end(), msg.get_data(), msg.get_data() + msg.get_size());
output.resize(output.size() + mac_size);
cs->mac()->final(&output[output.size() - mac_size]);
@@ -247,7 +247,7 @@ void write_record(secure_vector<byte>& output,
if(block_size)
{
const size_t pad_val =
- buf_size - (iv_size + msg_length + mac_size + 1);
+ buf_size - (iv_size + msg.get_size() + mac_size + 1);
for(size_t i = 0; i != pad_val + 1; ++i)
output.push_back(static_cast<byte>(pad_val));
@@ -461,65 +461,58 @@ void decrypt_record(secure_vector<byte>& output,
}
size_t read_tls_record(secure_vector<byte>& readbuf,
- const byte input[],
- size_t input_sz,
- size_t& consumed,
- secure_vector<byte>& record,
- u64bit* record_sequence,
- Protocol_Version* record_version,
- Record_Type* record_type,
+ Record_Raw_Input& raw_input,
+ Record& rec,
Connection_Sequence_Numbers* sequence_numbers,
get_cipherstate_fn get_cipherstate)
{
- consumed = 0;
-
if(readbuf.size() < TLS_HEADER_SIZE) // header incomplete?
{
if(size_t needed = fill_buffer_to(readbuf,
- input, input_sz, consumed,
+ raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(),
TLS_HEADER_SIZE))
return needed;
BOTAN_ASSERT_EQUAL(readbuf.size(), TLS_HEADER_SIZE, "Have an entire header");
}
- *record_version = Protocol_Version(readbuf[1], readbuf[2]);
+ *rec.get_protocol_version() = Protocol_Version(readbuf[1], readbuf[2]);
- BOTAN_ASSERT(!record_version->is_datagram_protocol(), "Expected TLS");
+ BOTAN_ASSERT(!rec.get_protocol_version()->is_datagram_protocol(), "Expected TLS");
- const size_t record_len = make_u16bit(readbuf[TLS_HEADER_SIZE-2],
+ const size_t record_size = make_u16bit(readbuf[TLS_HEADER_SIZE-2],
readbuf[TLS_HEADER_SIZE-1]);
- if(record_len > MAX_CIPHERTEXT_SIZE)
+ if(record_size > MAX_CIPHERTEXT_SIZE)
throw TLS_Exception(Alert::RECORD_OVERFLOW,
"Received a record that exceeds maximum size");
- if(record_len == 0)
+ if(record_size == 0)
throw TLS_Exception(Alert::DECODE_ERROR,
"Received a completely empty record");
if(size_t needed = fill_buffer_to(readbuf,
- input, input_sz, consumed,
- TLS_HEADER_SIZE + record_len))
+ raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(),
+ TLS_HEADER_SIZE + record_size))
return needed;
- BOTAN_ASSERT_EQUAL(static_cast<size_t>(TLS_HEADER_SIZE) + record_len,
+ BOTAN_ASSERT_EQUAL(static_cast<size_t>(TLS_HEADER_SIZE) + record_size,
readbuf.size(),
"Have the full record");
- *record_type = static_cast<Record_Type>(readbuf[0]);
+ *rec.get_type() = static_cast<Record_Type>(readbuf[0]);
u16bit epoch = 0;
if(sequence_numbers)
{
- *record_sequence = sequence_numbers->next_read_sequence();
+ *rec.get_sequence() = sequence_numbers->next_read_sequence();
epoch = sequence_numbers->current_read_epoch();
}
else
{
// server initial handshake case
- *record_sequence = 0;
+ *rec.get_sequence() = 0;
epoch = 0;
}
@@ -527,7 +520,7 @@ size_t read_tls_record(secure_vector<byte>& readbuf,
if(epoch == 0) // Unencrypted initial handshake
{
- record.assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_len);
+ rec.get_data().assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_size);
readbuf.clear();
return 0; // got a full record
}
@@ -537,37 +530,30 @@ size_t read_tls_record(secure_vector<byte>& readbuf,
BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
- decrypt_record(record,
+ decrypt_record(rec.get_data(),
record_contents,
- record_len,
- *record_sequence,
- *record_version,
- *record_type,
+ record_size,
+ *rec.get_sequence(),
+ *rec.get_protocol_version(),
+ *rec.get_type(),
*cs);
if(sequence_numbers)
- sequence_numbers->read_accept(*record_sequence);
+ sequence_numbers->read_accept(*rec.get_sequence());
readbuf.clear();
return 0;
}
size_t read_dtls_record(secure_vector<byte>& readbuf,
- const byte input[],
- size_t input_sz,
- size_t& consumed,
- secure_vector<byte>& record,
- u64bit* record_sequence,
- Protocol_Version* record_version,
- Record_Type* record_type,
+ Record_Raw_Input& raw_input,
+ Record& rec,
Connection_Sequence_Numbers* sequence_numbers,
get_cipherstate_fn get_cipherstate)
{
- consumed = 0;
-
if(readbuf.size() < DTLS_HEADER_SIZE) // header incomplete?
{
- if(fill_buffer_to(readbuf, input, input_sz, consumed, DTLS_HEADER_SIZE))
+ if(fill_buffer_to(readbuf, raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(), DTLS_HEADER_SIZE))
{
readbuf.clear();
return 0;
@@ -576,38 +562,35 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
BOTAN_ASSERT_EQUAL(readbuf.size(), DTLS_HEADER_SIZE, "Have an entire header");
}
- *record_version = Protocol_Version(readbuf[1], readbuf[2]);
+ *rec.get_protocol_version() = Protocol_Version(readbuf[1], readbuf[2]);
- BOTAN_ASSERT(record_version->is_datagram_protocol(), "Expected DTLS");
+ BOTAN_ASSERT(rec.get_protocol_version()->is_datagram_protocol(), "Expected DTLS");
- const size_t record_len = make_u16bit(readbuf[DTLS_HEADER_SIZE-2],
+ const size_t record_size = make_u16bit(readbuf[DTLS_HEADER_SIZE-2],
readbuf[DTLS_HEADER_SIZE-1]);
- // Invalid packet:
- if(record_len == 0 || record_len > MAX_CIPHERTEXT_SIZE)
- {
- readbuf.clear();
- return 0;
- }
+ if(record_size > MAX_CIPHERTEXT_SIZE)
+ throw TLS_Exception(Alert::RECORD_OVERFLOW,
+ "Got message that exceeds maximum size");
- if(fill_buffer_to(readbuf, input, input_sz, consumed, DTLS_HEADER_SIZE + record_len))
+ if(fill_buffer_to(readbuf, raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(), DTLS_HEADER_SIZE + record_size))
{
// Truncated packet?
readbuf.clear();
return 0;
}
- BOTAN_ASSERT_EQUAL(static_cast<size_t>(DTLS_HEADER_SIZE) + record_len, readbuf.size(),
+ BOTAN_ASSERT_EQUAL(static_cast<size_t>(DTLS_HEADER_SIZE) + record_size, readbuf.size(),
"Have the full record");
- *record_type = static_cast<Record_Type>(readbuf[0]);
+ *rec.get_type() = static_cast<Record_Type>(readbuf[0]);
u16bit epoch = 0;
- *record_sequence = load_be<u64bit>(&readbuf[3], 0);
- epoch = (*record_sequence >> 48);
+ *rec.get_sequence() = load_be<u64bit>(&readbuf[3], 0);
+ epoch = (*rec.get_sequence() >> 48);
- if(sequence_numbers && sequence_numbers->already_seen(*record_sequence))
+ if(sequence_numbers && sequence_numbers->already_seen(*rec.get_sequence()))
{
readbuf.clear();
return 0;
@@ -617,7 +600,7 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
if(epoch == 0) // Unencrypted initial handshake
{
- record.assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_len);
+ rec.get_data().assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_size);
readbuf.clear();
return 0; // got a full record
}
@@ -629,23 +612,23 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
- decrypt_record(record,
+ decrypt_record(rec.get_data(),
record_contents,
- record_len,
- *record_sequence,
- *record_version,
- *record_type,
+ record_size,
+ *rec.get_sequence(),
+ *rec.get_protocol_version(),
+ *rec.get_type(),
*cs);
}
catch(std::exception)
{
readbuf.clear();
- *record_type = NO_RECORD;
+ *rec.get_type() = NO_RECORD;
return 0;
}
if(sequence_numbers)
- sequence_numbers->read_accept(*record_sequence);
+ sequence_numbers->read_accept(*rec.get_sequence());
readbuf.clear();
return 0;
@@ -654,24 +637,16 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
}
size_t read_record(secure_vector<byte>& readbuf,
- const byte input[],
- size_t input_sz,
- bool is_datagram,
- size_t& consumed,
- secure_vector<byte>& record,
- u64bit* record_sequence,
- Protocol_Version* record_version,
- Record_Type* record_type,
+ Record_Raw_Input& raw_input,
+ Record& rec,
Connection_Sequence_Numbers* sequence_numbers,
get_cipherstate_fn get_cipherstate)
{
- if(is_datagram)
- return read_dtls_record(readbuf, input, input_sz, consumed,
- record, record_sequence, record_version, record_type,
+ if(raw_input.is_datagram())
+ return read_dtls_record(readbuf, raw_input, rec,
sequence_numbers, get_cipherstate);
else
- return read_tls_record(readbuf, input, input_sz, consumed,
- record, record_sequence, record_version, record_type,
+ return read_tls_record(readbuf, raw_input, rec,
sequence_numbers, get_cipherstate);
}
diff --git a/src/lib/tls/tls_record.h b/src/lib/tls/tls_record.h
index e3b0b9b58..53e447af6 100644
--- a/src/lib/tls/tls_record.h
+++ b/src/lib/tls/tls_record.h
@@ -1,6 +1,7 @@
/*
* TLS Record Handling
* (C) 2004-2012 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -90,6 +91,84 @@ class Connection_Cipher_State
size_t m_iv_size = 0;
};
+class Record
+ {
+ public:
+ Record(secure_vector<byte>& data,
+ u64bit* sequence,
+ Protocol_Version* protocol_version,
+ Record_Type* type)
+ : m_data(data), m_sequence(sequence), m_protocol_version(protocol_version),
+ m_type(type), m_size(data.size()) {};
+
+ secure_vector<byte>& get_data() { return m_data; }
+ void set_data(secure_vector<byte> data)
+ {
+ m_data.swap(data);
+ }
+
+ Protocol_Version* get_protocol_version() { return m_protocol_version; }
+
+ u64bit* get_sequence() { return m_sequence; }
+
+ Record_Type* get_type() { return m_type; }
+
+ size_t& get_size() { return m_size; }
+
+ private:
+ secure_vector<byte>& m_data;
+ u64bit* m_sequence;
+ Protocol_Version* m_protocol_version;
+ Record_Type* m_type;
+ size_t m_size;
+ };
+
+class Record_Message
+ {
+ public:
+ Record_Message(const byte* data, size_t size)
+ : m_type(0), m_sequence(0), m_data(data), m_size(size) {};
+ Record_Message(byte type, u64bit sequence, const byte* data, size_t size)
+ : m_type(type), m_sequence(sequence), m_data(data),
+ m_size(size) {};
+
+ byte& get_type() { return m_type; };
+ u64bit& get_sequence() { return m_sequence; };
+ const byte* get_data() { return m_data; };
+ size_t& get_size() { return m_size; };
+
+ private:
+ byte m_type;
+ u64bit m_sequence;
+ const byte* m_data;
+ size_t m_size;
+};
+
+class Record_Raw_Input
+ {
+ public:
+ Record_Raw_Input(const byte* data, size_t size, size_t& consumed,
+ bool is_datagram)
+ : m_data(data), m_size(size), m_consumed(consumed),
+ m_is_datagram(is_datagram) {};
+
+ const byte*& get_data() { return m_data; };
+
+ size_t& get_size() { return m_size; };
+
+ size_t& get_consumed() { return m_consumed; };
+ void set_consumed(size_t consumed) { m_consumed = consumed; }
+
+ bool is_datagram() { return m_is_datagram; };
+
+ private:
+ const byte* m_data;
+ size_t m_size;
+ size_t& m_consumed;
+ bool m_is_datagram;
+ };
+
+
/**
* Create a TLS record
* @param write_buffer the output record is placed here
@@ -103,7 +182,7 @@ class Connection_Cipher_State
* @return number of bytes written to write_buffer
*/
void write_record(secure_vector<byte>& write_buffer,
- byte msg_type, const byte msg[], size_t msg_length,
+ Record_Message rec_msg,
Protocol_Version version,
u64bit msg_sequence,
Connection_Cipher_State* cipherstate,
@@ -117,14 +196,8 @@ typedef std::function<std::shared_ptr<Connection_Cipher_State> (u16bit)> get_cip
* @return zero if full message, else number of bytes still needed
*/
size_t read_record(secure_vector<byte>& read_buffer,
- const byte input[],
- size_t input_length,
- bool is_datagram,
- size_t& input_consumed,
- secure_vector<byte>& record,
- u64bit* record_sequence,
- Protocol_Version* record_version,
- Record_Type* record_type,
+ Record_Raw_Input& raw_input,
+ Record& rec,
Connection_Sequence_Numbers* sequence_numbers,
get_cipherstate_fn get_cipherstate);
diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp
index 41b14ae08..de1e8668d 100644
--- a/src/lib/tls/tls_server.cpp
+++ b/src/lib/tls/tls_server.cpp
@@ -1,6 +1,7 @@
/*
* TLS Server
* (C) 2004-2011,2012,2016 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -9,6 +10,7 @@
#include <botan/internal/tls_handshake_state.h>
#include <botan/internal/tls_messages.h>
#include <botan/internal/stl_util.h>
+#include "tls_magic.h"
namespace Botan {
@@ -16,22 +18,7 @@ namespace TLS {
namespace {
-class Server_Handshake_State : public Handshake_State
- {
- public:
- // using Handshake_State::Handshake_State;
-
- Server_Handshake_State(Handshake_IO* io, handshake_msg_cb cb) : Handshake_State(io, cb) {}
- // Used by the server only, in case of RSA key exchange. Not owned
- Private_Key* server_rsa_kex_key = nullptr;
-
- /*
- * Used by the server to know if resumption should be allowed on
- * a server-initiated renegotiation
- */
- bool allow_session_resumption = true;
- };
bool check_for_resume(Session& session_info,
Session_Manager& session_manager,
@@ -225,10 +212,7 @@ get_server_certs(const std::string& hostname,
/*
* TLS Server Constructor
*/
-Server::Server(output_fn output,
- data_cb data_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
+Server::Server(const Callbacks& callbacks,
Session_Manager& session_manager,
Credentials_Manager& creds,
const Policy& policy,
@@ -236,26 +220,8 @@ Server::Server(output_fn output,
next_protocol_fn next_proto,
bool is_datagram,
size_t io_buf_sz) :
- Channel(output, data_cb, alert_cb, handshake_cb, Channel::handshake_msg_cb(),
- session_manager, rng, policy, is_datagram, io_buf_sz),
- m_creds(creds),
- m_choose_next_protocol(next_proto)
- {
- }
-
-Server::Server(output_fn output,
- data_cb data_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
- handshake_msg_cb hs_msg_cb,
- Session_Manager& session_manager,
- Credentials_Manager& creds,
- const Policy& policy,
- RandomNumberGenerator& rng,
- next_protocol_fn next_proto,
- bool is_datagram) :
- Channel(output, data_cb, alert_cb, handshake_cb, hs_msg_cb,
- session_manager, rng, policy, is_datagram),
+ Channel(callbacks, session_manager, rng, policy,
+ is_datagram, io_buf_sz),
m_creds(creds),
m_choose_next_protocol(next_proto)
{
@@ -264,7 +230,7 @@ Server::Server(output_fn output,
Handshake_State* Server::new_handshake_state(Handshake_IO* io)
{
std::unique_ptr<Handshake_State> state(
- new Server_Handshake_State(io, get_handshake_msg_cb()));
+ new Server_Handshake_State(io, get_callbacks().handshake_msg()));
state->set_expected_next(CLIENT_HELLO);
return state.release();
@@ -284,441 +250,513 @@ Server::get_peer_cert_chain(const Handshake_State& state) const
void Server::initiate_handshake(Handshake_State& state,
bool force_full_renegotiation)
{
- dynamic_cast<Server_Handshake_State&>(state).allow_session_resumption =
- !force_full_renegotiation;
+ dynamic_cast<Server_Handshake_State&>(state).
+ set_allow_session_resumption(!force_full_renegotiation);
Hello_Request hello_req(state.handshake_io());
}
/*
-* Process a handshake message
+* Process a CLIENT HELLO Message
*/
-void Server::process_handshake_msg(const Handshake_State* active_state,
- Handshake_State& state_base,
- Handshake_Type type,
- const std::vector<byte>& contents)
- {
- Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
-
- state.confirm_transition_to(type);
-
- /*
- * The change cipher spec message isn't technically a handshake
- * message so it's not included in the hash. The finished and
- * certificate verify messages are verified based on the current
- * state of the hash *before* this message so we delay adding them
- * to the hash computation until we've processed them below.
- */
- if(type != HANDSHAKE_CCS && type != FINISHED && type != CERTIFICATE_VERIFY)
+void Server::process_client_hello_msg(const Handshake_State* active_state,
+ Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents)
+{
+ const bool initial_handshake = !active_state;
+
+ if(!policy().allow_insecure_renegotiation() &&
+ !(initial_handshake || secure_renegotiation_supported()))
{
- state.hash().update(state.handshake_io().format(contents, type));
+ send_warning_alert(Alert::NO_RENEGOTIATION);
+ return;
}
- if(type == CLIENT_HELLO)
+ pending_state.client_hello(new Client_Hello(contents));
+ const Protocol_Version client_version = pending_state.client_hello()->version();
+
+ Protocol_Version negotiated_version;
+
+ const Protocol_Version latest_supported =
+ policy().latest_supported_version(client_version.is_datagram_protocol());
+
+ if((initial_handshake && client_version.known_version()) ||
+ (!initial_handshake && client_version == active_state->version()))
{
- const bool initial_handshake = !active_state;
+ /*
+ Common cases: new client hello with some known version, or a
+ renegotiation using the same version as previously
+ negotiated.
+ */
- if(!policy().allow_insecure_renegotiation() &&
- !(initial_handshake || secure_renegotiation_supported()))
+ negotiated_version = client_version;
+ }
+ else if(!initial_handshake && (client_version != active_state->version()))
+ {
+ /*
+ * If this is a renegotiation, and the client has offered a
+ * later version than what it initially negotiated, negotiate
+ * the old version. This matches OpenSSL's behavior. If the
+ * client is offering a version earlier than what it initially
+ * negotiated, reject as a probable attack.
+ */
+ if(active_state->version() > client_version)
{
- send_warning_alert(Alert::NO_RENEGOTIATION);
- return;
+ throw TLS_Exception(Alert::PROTOCOL_VERSION,
+ "Client negotiated " +
+ active_state->version().to_string() +
+ " then renegotiated with " +
+ client_version.to_string());
}
+ else
+ negotiated_version = active_state->version();
+ }
+ else
+ {
+ /*
+ New negotiation using a version we don't know. Offer them the
+ best we currently know and support
+ */
+ negotiated_version = latest_supported;
+ }
- state.client_hello(new Client_Hello(contents));
+ if(!policy().acceptable_protocol_version(negotiated_version))
+ {
+ throw TLS_Exception(Alert::PROTOCOL_VERSION,
+ "Client version " + negotiated_version.to_string() +
+ " is unacceptable by policy");
+ }
- const Protocol_Version client_version = state.client_hello()->version();
+ if(pending_state.client_hello()->sent_fallback_scsv())
+ {
+ if(latest_supported > client_version)
+ throw TLS_Exception(Alert::INAPPROPRIATE_FALLBACK,
+ "Client signalled fallback SCSV, possible attack");
+ }
- Protocol_Version negotiated_version;
+ secure_renegotiation_check(pending_state.client_hello());
- const Protocol_Version latest_supported =
- policy().latest_supported_version(client_version.is_datagram_protocol());
+ pending_state.set_version(negotiated_version);
- if((initial_handshake && client_version.known_version()) ||
- (!initial_handshake && client_version == active_state->version()))
- {
- /*
- Common cases: new client hello with some known version, or a
- renegotiation using the same version as previously
- negotiated.
- */
+ Session session_info;
+ const bool resuming =
+ pending_state.allow_session_resumption() &&
+ check_for_resume(session_info,
+ session_manager(),
+ m_creds,
+ pending_state.client_hello(),
+ std::chrono::seconds(policy().session_ticket_lifetime()));
- negotiated_version = client_version;
- }
- else if(!initial_handshake && (client_version != active_state->version()))
- {
- /*
- * If this is a renegotiation, and the client has offered a
- * later version than what it initially negotiated, negotiate
- * the old version. This matches OpenSSL's behavior. If the
- * client is offering a version earlier than what it initially
- * negotiated, reject as a probable attack.
- */
- if(active_state->version() > client_version)
- {
- throw TLS_Exception(Alert::PROTOCOL_VERSION,
- "Client negotiated " +
- active_state->version().to_string() +
- " then renegotiated with " +
- client_version.to_string());
- }
- else
- negotiated_version = active_state->version();
- }
- else
- {
- /*
- New negotiation using a version we don't know. Offer them the
- best we currently know and support
- */
- negotiated_version = latest_supported;
- }
+ bool have_session_ticket_key = false;
- if(!policy().acceptable_protocol_version(negotiated_version))
- {
- throw TLS_Exception(Alert::PROTOCOL_VERSION,
- "Client version " + negotiated_version.to_string() +
- " is unacceptable by policy");
- }
+ try
+ {
+ have_session_ticket_key =
+ m_creds.psk("tls-server", "session-ticket", "").length() > 0;
+ }
+ catch(...) {}
- if(state.client_hello()->sent_fallback_scsv())
- {
- if(latest_supported > client_version)
- throw TLS_Exception(Alert::INAPPROPRIATE_FALLBACK,
- "Client signalled fallback SCSV, possible attack");
- }
+ m_next_protocol = "";
+ if(m_choose_next_protocol && pending_state.client_hello()->supports_alpn())
+ m_next_protocol = m_choose_next_protocol(pending_state.client_hello()->next_protocols());
- secure_renegotiation_check(state.client_hello());
+ if(resuming)
+ {
+ this->session_resume(pending_state, have_session_ticket_key, session_info);
+ }
+ else // new session
+ {
+ this->session_create(pending_state, have_session_ticket_key);
+ }
+}
- state.set_version(negotiated_version);
+void Server::process_certificate_msg(Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents)
+{
+ pending_state.client_certs(new Certificate(contents));
+ pending_state.set_expected_next(CLIENT_KEX);
+}
- Session session_info;
- const bool resuming =
- state.allow_session_resumption &&
- check_for_resume(session_info,
- session_manager(),
- m_creds,
- state.client_hello(),
- std::chrono::seconds(policy().session_ticket_lifetime()));
+void Server::process_client_key_exchange_msg(Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents)
+{
+ if(pending_state.received_handshake_msg(CERTIFICATE) && !pending_state.client_certs()->empty())
+ pending_state.set_expected_next(CERTIFICATE_VERIFY);
+ else
+ pending_state.set_expected_next(HANDSHAKE_CCS);
- bool have_session_ticket_key = false;
+ pending_state.client_kex(
+ new Client_Key_Exchange(contents, pending_state,
+ pending_state.server_rsa_kex_key(),
+ m_creds, policy(), rng())
+ );
- try
- {
- have_session_ticket_key =
- m_creds.psk("tls-server", "session-ticket", "").length() > 0;
- }
- catch(...) {}
+ pending_state.compute_session_keys();
+}
- m_next_protocol = "";
- if(m_choose_next_protocol && state.client_hello()->supports_alpn())
- m_next_protocol = m_choose_next_protocol(state.client_hello()->next_protocols());
+void Server::process_change_cipher_spec_msg(Server_Handshake_State& pending_state)
+{
+ pending_state.set_expected_next(FINISHED);
+ change_cipher_spec_reader(SERVER);
+}
- if(resuming)
- {
- // Only offer a resuming client a new ticket if they didn't send one this time,
- // ie, resumed via server-side resumption. TODO: also send one if expiring soon?
-
- const bool offer_new_session_ticket =
- (state.client_hello()->supports_session_ticket() &&
- state.client_hello()->session_ticket().empty() &&
- have_session_ticket_key);
-
- state.server_hello(new Server_Hello(
- state.handshake_io(),
- state.hash(),
- policy(),
- rng(),
- secure_renegotiation_data_for_server_hello(),
- *state.client_hello(),
- session_info,
- offer_new_session_ticket,
- m_next_protocol
- ));
-
- secure_renegotiation_check(state.server_hello());
-
- state.compute_session_keys(session_info.master_secret());
-
- if(!save_session(session_info))
+void Server::process_certificate_verify_msg(Server_Handshake_State& pending_state,
+ Handshake_Type type,
+ const std::vector<byte>& contents)
+{
+ pending_state.client_verify ( new Certificate_Verify ( contents, pending_state.version() ) );
+
+ const std::vector<X509_Certificate>& client_certs =
+ pending_state.client_certs()->cert_chain();
+
+ const bool sig_valid =
+ pending_state.client_verify()->verify ( client_certs[0], pending_state, policy() );
+
+ pending_state.hash().update ( pending_state.handshake_io().format ( contents, type ) );
+
+ /*
+ * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for
+ * "A handshake cryptographic operation failed, including being
+ * unable to correctly verify a signature, ..."
+ */
+ if ( !sig_valid )
+ throw TLS_Exception ( Alert::DECRYPT_ERROR, "Client cert verify failed" );
+
+ try
+ {
+ m_creds.verify_certificate_chain ( "tls-server", "", client_certs );
+ }
+ catch ( std::exception& e )
+ {
+ throw TLS_Exception ( Alert::BAD_CERTIFICATE, e.what() );
+ }
+
+ pending_state.set_expected_next ( HANDSHAKE_CCS );
+}
+
+void Server::process_finished_msg(Server_Handshake_State& pending_state,
+ Handshake_Type type,
+ const std::vector<byte>& contents)
+{
+ pending_state.set_expected_next ( HANDSHAKE_NONE );
+
+ pending_state.client_finished ( new Finished ( contents ) );
+
+ if ( !pending_state.client_finished()->verify ( pending_state, CLIENT ) )
+ throw TLS_Exception ( Alert::DECRYPT_ERROR,
+ "Finished message didn't verify" );
+
+ if ( !pending_state.server_finished() )
+ {
+ // already sent finished if resuming, so this is a new session
+
+ pending_state.hash().update ( pending_state.handshake_io().format ( contents, type ) );
+
+ Session::Properties session_properties(
+ Server_Information(pending_state.client_hello()->sni_hostname()),
+ "",
+ pending_state.server_hello()->srtp_profile(),
+ pending_state.server_hello()->version(),
+ pending_state.server_hello()->ciphersuite(),
+ pending_state.server_hello()->compression_method());
+
+
+ Session session_info(
+ pending_state.server_hello()->session_id(),
+ pending_state.session_keys().master_secret(),
+ SERVER,
+ pending_state.server_hello()->supports_extended_master_secret(),
+ get_peer_cert_chain ( pending_state ),
+ std::vector<byte>(),
+ session_properties);
+
+ if ( save_session ( session_info ) )
{
- session_manager().remove_entry(session_info.session_id());
-
- if(state.server_hello()->supports_session_ticket()) // send an empty ticket
- {
- state.new_session_ticket(
- new New_Session_Ticket(state.handshake_io(),
- state.hash())
- );
- }
+ if ( pending_state.server_hello()->supports_session_ticket() )
+ {
+ try
+ {
+ const SymmetricKey ticket_key = m_creds.psk ( "tls-server", "session-ticket", "" );
+
+ pending_state.new_session_ticket (
+ new New_Session_Ticket ( pending_state.handshake_io(),
+ pending_state.hash(),
+ session_info.encrypt ( ticket_key, rng() ),
+ policy().session_ticket_lifetime() )
+ );
+ }
+ catch ( ... ) {}
+ }
+ else
+ session_manager().save ( session_info );
}
- if(state.server_hello()->supports_session_ticket() && !state.new_session_ticket())
+ if ( !pending_state.new_session_ticket() &&
+ pending_state.server_hello()->supports_session_ticket() )
{
- try
- {
- const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
-
- state.new_session_ticket(
- new New_Session_Ticket(state.handshake_io(),
- state.hash(),
- session_info.encrypt(ticket_key, rng()),
- policy().session_ticket_lifetime())
- );
- }
- catch(...) {}
-
- if(!state.new_session_ticket())
- {
- state.new_session_ticket(
- new New_Session_Ticket(state.handshake_io(), state.hash())
- );
- }
+ pending_state.new_session_ticket (
+ new New_Session_Ticket ( pending_state.handshake_io(), pending_state.hash() )
+ );
}
- state.handshake_io().send(Change_Cipher_Spec());
+ pending_state.handshake_io().send ( Change_Cipher_Spec() );
- change_cipher_spec_writer(SERVER);
+ change_cipher_spec_writer ( SERVER );
- state.server_finished(new Finished(state.handshake_io(), state, SERVER));
- state.set_expected_next(HANDSHAKE_CCS);
- }
- else // new session
- {
- std::map<std::string, std::vector<X509_Certificate> > cert_chains;
+ pending_state.server_finished ( new Finished ( pending_state.handshake_io(), pending_state, SERVER ) );
+ }
- const std::string sni_hostname = state.client_hello()->sni_hostname();
+ activate_session();
- cert_chains = get_server_certs(sni_hostname, m_creds);
+}
- if(sni_hostname != "" && cert_chains.empty())
- {
- cert_chains = get_server_certs("", m_creds);
-
- /*
- * Only send the unrecognized_name alert if we couldn't
- * find any certs for the requested name but did find at
- * least one cert to use in general. That avoids sending an
- * unrecognized_name when a server is configured for purely
- * anonymous operation.
- */
- if(!cert_chains.empty())
- send_alert(Alert(Alert::UNRECOGNIZED_NAME));
- }
+/*
+* Process a handshake message
+*/
+void Server::process_handshake_msg(const Handshake_State* active_state,
+ Handshake_State& state_base,
+ Handshake_Type type,
+ const std::vector<byte>& contents)
+ {
+ Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
+ state.confirm_transition_to(type);
- state.server_hello(new Server_Hello(
- state.handshake_io(),
- state.hash(),
- policy(),
- rng(),
- secure_renegotiation_data_for_server_hello(),
- *state.client_hello(),
- make_hello_random(rng(), policy()), // new session ID
- state.version(),
- choose_ciphersuite(policy(), state.version(), m_creds, cert_chains, state.client_hello()),
- choose_compression(policy(), state.client_hello()->compression_methods()),
- have_session_ticket_key,
- m_next_protocol)
- );
+ /*
+ * The change cipher spec message isn't technically a handshake
+ * message so it's not included in the hash. The finished and
+ * certificate verify messages are verified based on the current
+ * state of the hash *before* this message so we delay adding them
+ * to the hash computation until we've processed them below.
+ */
+ if(type != HANDSHAKE_CCS && type != FINISHED && type != CERTIFICATE_VERIFY)
+ {
+ state.hash().update(state.handshake_io().format(contents, type));
+ }
- secure_renegotiation_check(state.server_hello());
+ switch(type)
+ {
+ case CLIENT_HELLO:
+ this->process_client_hello_msg(active_state, state, contents);
+ break;
- const std::string sig_algo = state.ciphersuite().sig_algo();
- const std::string kex_algo = state.ciphersuite().kex_algo();
+ case CERTIFICATE:
+ this->process_certificate_msg(state, contents);
+ break;
- if(sig_algo != "")
- {
- BOTAN_ASSERT(!cert_chains[sig_algo].empty(),
- "Attempting to send empty certificate chain");
+ case CLIENT_KEX:
+ this->process_client_key_exchange_msg(state, contents);
+ break;
- state.server_certs(new Certificate(state.handshake_io(),
- state.hash(),
- cert_chains[sig_algo]));
- }
+ case CERTIFICATE_VERIFY:
+ this->process_certificate_verify_msg(state, type, contents);
+ break;
- Private_Key* private_key = nullptr;
+ case HANDSHAKE_CCS:
+ this->process_change_cipher_spec_msg(state);
+ break;
- if(kex_algo == "RSA" || sig_algo != "")
- {
- private_key = m_creds.private_key_for(
- state.server_certs()->cert_chain()[0],
- "tls-server",
- sni_hostname);
+ case FINISHED:
+ this->process_finished_msg(state, type, contents);
+ break;
+
+ default:
+ throw Unexpected_Message("Unknown handshake message received");
+ break;
+ }
+ }
+
+void Server::session_resume(Server_Handshake_State& pending_state,
+ bool have_session_ticket_key,
+ Session& session_info)
+ {
+ // Only offer a resuming client a new ticket if they didn't send one this time,
+ // ie, resumed via server-side resumption. TODO: also send one if expiring soon?
+
+ const bool offer_new_session_ticket =
+ (pending_state.client_hello()->supports_session_ticket() &&
+ pending_state.client_hello()->session_ticket().empty() &&
+ have_session_ticket_key);
+
+ Server_Hello::Handshake_Info hs_info(pending_state.handshake_io(),
+ pending_state.hash());
+ pending_state.server_hello(new Server_Hello(
+ hs_info,
+ policy(),
+ rng(),
+ secure_renegotiation_data_for_server_hello(),
+ *pending_state.client_hello(),
+ session_info,
+ offer_new_session_ticket,
+ m_next_protocol
+ ));
+
+ secure_renegotiation_check(pending_state.server_hello());
+
+ pending_state.compute_session_keys(session_info.master_secret());
+
+ if(!save_session(session_info))
+ {
+ session_manager().remove_entry(session_info.session_id());
- if(!private_key)
- throw Internal_Error("No private key located for associated server cert");
+ if(pending_state.server_hello()->supports_session_ticket()) // send an empty ticket
+ {
+ pending_state.new_session_ticket(
+ new New_Session_Ticket(pending_state.handshake_io(),
+ pending_state.hash())
+ );
}
+ }
- if(kex_algo == "RSA")
+ if(pending_state.server_hello()->supports_session_ticket() && !pending_state.new_session_ticket())
+ {
+ try
{
- state.server_rsa_kex_key = private_key;
+ const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
+
+ pending_state.new_session_ticket(
+ new New_Session_Ticket(pending_state.handshake_io(),
+ pending_state.hash(),
+ session_info.encrypt(ticket_key, rng()),
+ policy().session_ticket_lifetime())
+ );
}
- else
+ catch(...) {}
+
+ if(!pending_state.new_session_ticket())
{
- state.server_kex(new Server_Key_Exchange(state.handshake_io(),
- state, policy(),
- m_creds, rng(), private_key));
+ pending_state.new_session_ticket(
+ new New_Session_Ticket(pending_state.handshake_io(), pending_state.hash())
+ );
}
+ }
- auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);
+ pending_state.handshake_io().send(Change_Cipher_Spec());
- std::vector<X509_DN> client_auth_CAs;
+ change_cipher_spec_writer(SERVER);
- for(auto store : trusted_CAs)
- {
- auto subjects = store->all_subjects();
- client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
- }
+ pending_state.server_finished(new Finished(pending_state.handshake_io(), pending_state, SERVER));
+ pending_state.set_expected_next(HANDSHAKE_CCS);
+ }
- if(!client_auth_CAs.empty() && state.ciphersuite().sig_algo() != "")
- {
- state.cert_req(
- new Certificate_Req(state.handshake_io(), state.hash(),
- policy(), client_auth_CAs, state.version()));
+void Server::session_create(Server_Handshake_State& pending_state,
+ bool have_session_ticket_key)
+ {
+ std::map<std::string, std::vector<X509_Certificate> > cert_chains;
- state.set_expected_next(CERTIFICATE);
- }
+ const std::string sni_hostname = pending_state.client_hello()->sni_hostname();
- /*
- * If the client doesn't have a cert they want to use they are
- * allowed to send either an empty cert message or proceed
- * directly to the client key exchange, so allow either case.
- */
- state.set_expected_next(CLIENT_KEX);
+ cert_chains = get_server_certs(sni_hostname, m_creds);
- state.server_hello_done(new Server_Hello_Done(state.handshake_io(), state.hash()));
- }
- }
- else if(type == CERTIFICATE)
+ if(sni_hostname != "" && cert_chains.empty())
{
- state.client_certs(new Certificate(contents));
+ cert_chains = get_server_certs("", m_creds);
- state.set_expected_next(CLIENT_KEX);
+ /*
+ * Only send the unrecognized_name alert if we couldn't
+ * find any certs for the requested name but did find at
+ * least one cert to use in general. That avoids sending an
+ * unrecognized_name when a server is configured for purely
+ * anonymous operation.
+ */
+ if(!cert_chains.empty())
+ send_alert(Alert(Alert::UNRECOGNIZED_NAME));
}
- else if(type == CLIENT_KEX)
- {
- if(state.received_handshake_msg(CERTIFICATE) && !state.client_certs()->empty())
- state.set_expected_next(CERTIFICATE_VERIFY);
- else
- state.set_expected_next(HANDSHAKE_CCS);
-
- state.client_kex(
- new Client_Key_Exchange(contents, state,
- state.server_rsa_kex_key,
- m_creds, policy(), rng())
- );
- state.compute_session_keys();
- }
- else if(type == CERTIFICATE_VERIFY)
+ Server_Hello::Settings srv_settings(
+ make_hello_random(rng(), policy()), // new session ID
+ pending_state.version(),
+ choose_ciphersuite(policy(),
+ pending_state.version(),
+ m_creds,
+ cert_chains,
+ pending_state.client_hello()),
+ choose_compression(policy(),
+ pending_state.client_hello()->compression_methods()),
+ have_session_ticket_key);
+
+ Server_Hello::Handshake_Info hs_info(pending_state.handshake_io(),
+ pending_state.hash());
+ pending_state.server_hello(new Server_Hello(
+ hs_info,
+ policy(),
+ rng(),
+ secure_renegotiation_data_for_server_hello(),
+ *pending_state.client_hello(),
+ srv_settings,
+ m_next_protocol)
+ );
+
+ secure_renegotiation_check(pending_state.server_hello());
+
+ const std::string sig_algo = pending_state.ciphersuite().sig_algo();
+ const std::string kex_algo = pending_state.ciphersuite().kex_algo();
+
+ if(sig_algo != "")
{
- state.client_verify(new Certificate_Verify(contents, state.version()));
+ BOTAN_ASSERT(!cert_chains[sig_algo].empty(),
+ "Attempting to send empty certificate chain");
- const std::vector<X509_Certificate>& client_certs =
- state.client_certs()->cert_chain();
+ Certificate::Handshake_Info hs_info(pending_state.handshake_io(),
+ pending_state.hash());
- const bool sig_valid =
- state.client_verify()->verify(client_certs[0], state, policy());
+ pending_state.server_certs(new Certificate(hs_info, cert_chains[sig_algo]));
+ }
- state.hash().update(state.handshake_io().format(contents, type));
+ Private_Key* private_key = nullptr;
- /*
- * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for
- * "A handshake cryptographic operation failed, including being
- * unable to correctly verify a signature, ..."
- */
- if(!sig_valid)
- throw TLS_Exception(Alert::DECRYPT_ERROR, "Client cert verify failed");
-
- try
- {
- m_creds.verify_certificate_chain("tls-server", "", client_certs);
- }
- catch(std::exception& e)
- {
- throw TLS_Exception(Alert::BAD_CERTIFICATE, e.what());
- }
+ if(kex_algo == "RSA" || sig_algo != "")
+ {
+ private_key = m_creds.private_key_for(
+ pending_state.server_certs()->cert_chain()[0],
+ "tls-server",
+ sni_hostname);
- state.set_expected_next(HANDSHAKE_CCS);
+ if(!private_key)
+ throw Internal_Error("No private key located for associated server cert");
}
- else if(type == HANDSHAKE_CCS)
+
+ if(kex_algo == "RSA")
{
- state.set_expected_next(FINISHED);
- change_cipher_spec_reader(SERVER);
+ pending_state.set_server_rsa_kex_key(private_key);
}
- else if(type == FINISHED)
+ else
{
- state.set_expected_next(HANDSHAKE_NONE);
-
- state.client_finished(new Finished(contents));
- if(!state.client_finished()->verify(state, CLIENT))
- throw TLS_Exception(Alert::DECRYPT_ERROR,
- "Finished message didn't verify");
+ pending_state.server_kex(new Server_Key_Exchange(pending_state.handshake_io(),
+ pending_state, policy(),
+ m_creds, rng(), private_key));
+ }
- if(!state.server_finished())
- {
- // already sent finished if resuming, so this is a new session
+ auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);
- state.hash().update(state.handshake_io().format(contents, type));
+ std::vector<X509_DN> client_auth_CAs;
- Session session_info(
- state.server_hello()->session_id(),
- state.session_keys().master_secret(),
- state.server_hello()->version(),
- state.server_hello()->ciphersuite(),
- state.server_hello()->compression_method(),
- SERVER,
- state.server_hello()->supports_extended_master_secret(),
- get_peer_cert_chain(state),
- std::vector<byte>(),
- Server_Information(state.client_hello()->sni_hostname()),
- state.srp_identifier(),
- state.server_hello()->srtp_profile()
- );
-
- if(save_session(session_info))
- {
- if(state.server_hello()->supports_session_ticket())
- {
- try
- {
- const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
-
- state.new_session_ticket(
- new New_Session_Ticket(state.handshake_io(),
- state.hash(),
- session_info.encrypt(ticket_key, rng()),
- policy().session_ticket_lifetime())
- );
- }
- catch(...) {}
- }
- else
- session_manager().save(session_info);
- }
-
- if(!state.new_session_ticket() &&
- state.server_hello()->supports_session_ticket())
- {
- state.new_session_ticket(
- new New_Session_Ticket(state.handshake_io(), state.hash())
- );
- }
+ for(auto store : trusted_CAs)
+ {
+ auto subjects = store->all_subjects();
+ client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
+ }
- state.handshake_io().send(Change_Cipher_Spec());
+ if(!client_auth_CAs.empty() && pending_state.ciphersuite().sig_algo() != "")
+ {
+ Certificate_Req::Handshake_Info hs_info(pending_state.handshake_io(),
+ pending_state.hash());
+ pending_state.cert_req(
+ new Certificate_Req(hs_info, policy(), client_auth_CAs,
+ pending_state.version()));
- change_cipher_spec_writer(SERVER);
+ pending_state.set_expected_next(CERTIFICATE);
+ }
- state.server_finished(new Finished(state.handshake_io(), state, SERVER));
- }
+ /*
+ * If the client doesn't have a cert they want to use they are
+ * allowed to send either an empty cert message or proceed
+ * directly to the client key exchange, so allow either case.
+ */
+ pending_state.set_expected_next(CLIENT_KEX);
- activate_session();
- }
- else
- throw Unexpected_Message("Unknown handshake message received");
+ pending_state.server_hello_done(new Server_Hello_Done(pending_state.handshake_io(), pending_state.hash()));
}
-
}
}
diff --git a/src/lib/tls/tls_server.h b/src/lib/tls/tls_server.h
index 5ea2a1318..72834785e 100644
--- a/src/lib/tls/tls_server.h
+++ b/src/lib/tls/tls_server.h
@@ -1,6 +1,7 @@
/*
* TLS Server
* (C) 2004-2011 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -10,8 +11,11 @@
#include <botan/tls_channel.h>
#include <botan/credentials_manager.h>
+#include <botan/internal/tls_server_handshake_state.h>
#include <vector>
+
+
namespace Botan {
namespace TLS {
@@ -27,32 +31,15 @@ class BOTAN_DLL Server final : public Channel
/**
* Server initialization
*/
- Server(output_fn output,
- data_cb data_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
+ Server(const Callbacks& callbacks,
Session_Manager& session_manager,
Credentials_Manager& creds,
const Policy& policy,
RandomNumberGenerator& rng,
next_protocol_fn next_proto = next_protocol_fn(),
bool is_datagram = false,
- size_t reserved_io_buffer_size = 16*1024
- );
-
- Server(output_fn output,
- data_cb data_cb,
- alert_cb alert_cb,
- handshake_cb handshake_cb,
- handshake_msg_cb hs_msg_cb,
- Session_Manager& session_manager,
- Credentials_Manager& creds,
- const Policy& policy,
- RandomNumberGenerator& rng,
- next_protocol_fn next_proto = next_protocol_fn(),
- bool is_datagram = false
+ size_t reserved_io_buffer_size = TLS::Server::IO_BUF_DEFAULT_SIZE
);
-
/**
* Return the protocol notification set by the client (using the
* NPN extension) for this connection, if any. This value is not
@@ -73,6 +60,33 @@ class BOTAN_DLL Server final : public Channel
Handshake_Type type,
const std::vector<byte>& contents) override;
+ void process_client_hello_msg(const Handshake_State* active_state,
+ Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents);
+
+ void process_certificate_msg(Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents);
+
+ void process_client_key_exchange_msg(Server_Handshake_State& pending_state,
+ const std::vector<byte>& contents);
+
+ void process_change_cipher_spec_msg(Server_Handshake_State& pending_state);
+
+ void process_certificate_verify_msg(Server_Handshake_State& pending_state,
+ Handshake_Type type,
+ const std::vector<byte>& contents);
+
+ void process_finished_msg(Server_Handshake_State& pending_state,
+ Handshake_Type type,
+ const std::vector<byte>& contents);
+
+ void session_resume(Server_Handshake_State& pending_state,
+ bool have_session_ticket_key,
+ Session& session_info);
+
+ void session_create(Server_Handshake_State& pending_state,
+ bool have_session_ticket_key);
+
Handshake_State* new_handshake_state(Handshake_IO* io) override;
Credentials_Manager& m_creds;
diff --git a/src/lib/tls/tls_server_handshake_state.h b/src/lib/tls/tls_server_handshake_state.h
new file mode 100644
index 000000000..281dd82df
--- /dev/null
+++ b/src/lib/tls/tls_server_handshake_state.h
@@ -0,0 +1,47 @@
+/*
+* TLS Server
+* (C) 2004-2011,2012,2016 Jack Lloyd
+* 2016 Matthias Gierlings
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_TLS_SERVER_HANDSHAKE_STATE_H__
+#define BOTAN_TLS_SERVER_HANDSHAKE_STATE_H__
+
+#include <botan/internal/tls_handshake_state.h>
+namespace Botan {
+
+namespace TLS {
+
+class Server_Handshake_State : public Handshake_State
+ {
+ public:
+ Server_Handshake_State(Handshake_IO* io, handshake_msg_cb cb)
+ : Handshake_State(io, cb) {}
+
+ Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key; }
+ void set_server_rsa_kex_key(Private_Key* key)
+ { m_server_rsa_kex_key = key; }
+
+ bool allow_session_resumption() const
+ { return m_allow_session_resumption; }
+ void set_allow_session_resumption(bool allow_session_resumption)
+ { m_allow_session_resumption = allow_session_resumption; }
+
+
+ private:
+ // Used by the server only, in case of RSA key exchange. Not owned
+ Private_Key* m_server_rsa_kex_key = nullptr;
+
+ /*
+ * Used by the server to know if resumption should be allowed on
+ * a server-initiated renegotiation
+ */
+ bool m_allow_session_resumption = true;
+ };
+
+}
+
+}
+#endif //BOTAN_TLS_SERVER_HANDSHAKE_STATE_H__
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 18c9b357c..bcbac10af 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -1,6 +1,7 @@
/*
* TLS Session State
* (C) 2011-2012,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -19,29 +20,19 @@ namespace TLS {
Session::Session(const std::vector<byte>& session_identifier,
const secure_vector<byte>& master_secret,
- Protocol_Version version,
- u16bit ciphersuite,
- byte compression_method,
Connection_Side side,
bool extended_master_secret,
const std::vector<X509_Certificate>& certs,
const std::vector<byte>& ticket,
- const Server_Information& server_info,
- const std::string& srp_identifier,
- u16bit srtp_profile) :
+ Properties properties) :
m_start_time(std::chrono::system_clock::now()),
m_identifier(session_identifier),
m_session_ticket(ticket),
m_master_secret(master_secret),
- m_version(version),
- m_ciphersuite(ciphersuite),
- m_compression_method(compression_method),
m_connection_side(side),
- m_srtp_profile(srtp_profile),
m_extended_master_secret(extended_master_secret),
m_peer_certs(certs),
- m_server_info(server_info),
- m_srp_identifier(srp_identifier)
+ m_properties(properties)
{
}
@@ -69,6 +60,9 @@ Session::Session(const byte ber[], size_t ber_len)
size_t srtp_profile = 0;
size_t fragment_size = 0;
+ u16bit cs = m_properties.get_ciphersuite();
+ byte compr = compression_method();
+
BER_Decoder(ber, ber_len)
.start_cons(SEQUENCE)
.decode_and_check(static_cast<size_t>(TLS_SESSION_PARAM_STRUCT_VERSION),
@@ -78,10 +72,9 @@ Session::Session(const byte ber[], size_t ber_len)
.decode_integer_type(minor_version)
.decode(m_identifier, OCTET_STRING)
.decode(m_session_ticket, OCTET_STRING)
- .decode_integer_type(m_ciphersuite)
- .decode_integer_type(m_compression_method)
+ .decode_integer_type(cs)
+ .decode_integer_type(compr)
.decode_integer_type(side_code)
- .decode_integer_type(fragment_size)
.decode(m_extended_master_secret)
.decode(m_master_secret, OCTET_STRING)
.decode(peer_cert_bits, OCTET_STRING)
@@ -103,16 +96,17 @@ Session::Session(const byte ber[], size_t ber_len)
" no longer supported");
}
- m_version = Protocol_Version(major_version, minor_version);
+ m_properties.set_ciphersuite(cs);
+ m_properties.set_compression_method(compr);
+ m_properties.set_protocol_version(Protocol_Version(major_version, minor_version));
m_start_time = std::chrono::system_clock::from_time_t(start_time);
m_connection_side = static_cast<Connection_Side>(side_code);
- m_srtp_profile = static_cast<u16bit>(srtp_profile);
-
- m_server_info = Server_Information(server_hostname.value(),
- server_service.value(),
- static_cast<u16bit>(server_port));
-
- m_srp_identifier = srp_identifier_str.value();
+ m_properties.set_srtp_profile(static_cast<u16bit>(srtp_profile));
+ m_properties.set_server_info(
+ Server_Information(server_hostname.value(),
+ server_service.value(),
+ static_cast<u16bit>(server_port)));
+ m_properties.set_srp_identifier(srp_identifier_str.value());
if(!peer_cert_bits.empty())
{
@@ -133,22 +127,22 @@ secure_vector<byte> Session::DER_encode() const
.start_cons(SEQUENCE)
.encode(static_cast<size_t>(TLS_SESSION_PARAM_STRUCT_VERSION))
.encode(static_cast<size_t>(std::chrono::system_clock::to_time_t(m_start_time)))
- .encode(static_cast<size_t>(m_version.major_version()))
- .encode(static_cast<size_t>(m_version.minor_version()))
+ .encode(static_cast<size_t>(version().major_version()))
+ .encode(static_cast<size_t>(version().minor_version()))
.encode(m_identifier, OCTET_STRING)
.encode(m_session_ticket, OCTET_STRING)
- .encode(static_cast<size_t>(m_ciphersuite))
- .encode(static_cast<size_t>(m_compression_method))
+ .encode(static_cast<size_t>(ciphersuite_code()))
+ .encode(static_cast<size_t>(compression_method()))
.encode(static_cast<size_t>(m_connection_side))
.encode(static_cast<size_t>(/*old fragment size*/0))
.encode(m_extended_master_secret)
.encode(m_master_secret, OCTET_STRING)
.encode(peer_cert_bits, OCTET_STRING)
- .encode(ASN1_String(m_server_info.hostname(), UTF8_STRING))
- .encode(ASN1_String(m_server_info.service(), UTF8_STRING))
- .encode(static_cast<size_t>(m_server_info.port()))
- .encode(ASN1_String(m_srp_identifier, UTF8_STRING))
- .encode(static_cast<size_t>(m_srtp_profile))
+ .encode(ASN1_String(m_properties.get_server_info().hostname(), UTF8_STRING))
+ .encode(ASN1_String(m_properties.get_server_info().service(), UTF8_STRING))
+ .encode(static_cast<size_t>(m_properties.get_server_info().port()))
+ .encode(ASN1_String(srp_identifier(), UTF8_STRING))
+ .encode(static_cast<size_t>(dtls_srtp_profile()))
.end_cons()
.get_contents();
}
diff --git a/src/lib/tls/tls_session.h b/src/lib/tls/tls_session.h
index 8ca646cf2..600aa0a10 100644
--- a/src/lib/tls/tls_session.h
+++ b/src/lib/tls/tls_session.h
@@ -1,6 +1,7 @@
/*
* TLS Session
* (C) 2011-2012,2015 Jack Lloyd
+* 2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
@@ -27,35 +28,106 @@ namespace TLS {
class BOTAN_DLL Session
{
public:
+ class Properties
+ {
+ public:
+ Properties() : m_srtp_profile(0), m_protocol_version(),
+ m_ciphersuite(), m_compression_method(0) {}
+
+ Properties(const Server_Information& server_info,
+ const std::string& srp_identifier,
+ u16bit srtp_profile,
+ Protocol_Version protocol_version,
+ u16bit ciphersuite,
+ byte compression_method)
+ : m_server_info(server_info),
+ m_srp_identifier(srp_identifier),
+ m_srtp_profile(srtp_profile),
+ m_protocol_version(protocol_version),
+ m_ciphersuite(ciphersuite),
+ m_compression_method(compression_method) {}
+
+ const Server_Information& get_server_info() const
+ {
+ return m_server_info;
+ }
+
+ void set_server_info(Server_Information server_info)
+ {
+ m_server_info = server_info;
+ }
+
+ const std::string& get_srp_identifier() const
+ {
+ return m_srp_identifier;
+ }
+
+ void set_srp_identifier(const std::string& srp_identifier)
+ {
+ m_srp_identifier = srp_identifier;
+ }
+
+ u16bit get_srtp_profile() const { return m_srtp_profile; }
+ void set_srtp_profile(u16bit srtp_profile)
+ {
+ m_srtp_profile = srtp_profile;
+ }
+
+ Protocol_Version get_protocol_version() const
+ {
+ return m_protocol_version;
+ }
+
+ void set_protocol_version(Protocol_Version protocol_version)
+ {
+ m_protocol_version = protocol_version;
+ }
+
+ u16bit get_ciphersuite() const { return m_ciphersuite; }
+
+ void set_ciphersuite(u16bit ciphersuite)
+ {
+ m_ciphersuite = ciphersuite;
+ }
+
+ byte get_compression_method() const
+ {
+ return m_compression_method;
+ }
+
+ void set_compression_method(byte compression_method)
+ {
+ m_compression_method = compression_method;
+ }
+
+ private:
+ Server_Information m_server_info;
+ std::string m_srp_identifier;
+ u16bit m_srtp_profile;
+ Protocol_Version m_protocol_version;
+ u16bit m_ciphersuite;
+ byte m_compression_method;
+ };
/**
* Uninitialized session
*/
Session() :
m_start_time(std::chrono::system_clock::time_point::min()),
- m_version(),
- m_ciphersuite(0),
- m_compression_method(0),
m_connection_side(static_cast<Connection_Side>(0)),
- m_srtp_profile(0),
- m_extended_master_secret(false)
- {}
+ m_extended_master_secret(false),
+ m_properties() {}
/**
* New session (sets session start time)
*/
Session(const std::vector<byte>& session_id,
const secure_vector<byte>& master_secret,
- Protocol_Version version,
- u16bit ciphersuite,
- byte compression_method,
Connection_Side side,
bool supports_extended_master_secret,
const std::vector<X509_Certificate>& peer_certs,
const std::vector<byte>& session_ticket,
- const Server_Information& server_info,
- const std::string& srp_identifier,
- u16bit srtp_profile);
+ Properties properties);
/**
* Load a session from DER representation (created by DER_encode)
@@ -112,22 +184,22 @@ class BOTAN_DLL Session
/**
* Get the version of the saved session
*/
- Protocol_Version version() const { return m_version; }
+ Protocol_Version version() const { return m_properties.get_protocol_version(); }
/**
* Get the ciphersuite code of the saved session
*/
- u16bit ciphersuite_code() const { return m_ciphersuite; }
+ u16bit ciphersuite_code() const { return m_properties.get_ciphersuite(); }
/**
* Get the ciphersuite info of the saved session
*/
- Ciphersuite ciphersuite() const { return Ciphersuite::by_id(m_ciphersuite); }
+ Ciphersuite ciphersuite() const { return Ciphersuite::by_id(ciphersuite_code()); }
/**
* Get the compression method used in the saved session
*/
- byte compression_method() const { return m_compression_method; }
+ byte compression_method() const { return m_properties.get_compression_method(); }
/**
* Get which side of the connection the resumed session we are/were
@@ -138,7 +210,7 @@ class BOTAN_DLL Session
/**
* Get the SRP identity (if sent by the client in the initial handshake)
*/
- const std::string& srp_identifier() const { return m_srp_identifier; }
+ const std::string& srp_identifier() const { return m_properties.get_srp_identifier(); }
/**
* Get the saved master secret
@@ -153,7 +225,7 @@ class BOTAN_DLL Session
/**
* Get the negotiated DTLS-SRTP algorithm (RFC 5764)
*/
- u16bit dtls_srtp_profile() const { return m_srtp_profile; }
+ u16bit dtls_srtp_profile() const { return m_properties.get_srtp_profile(); }
bool supports_extended_master_secret() const { return m_extended_master_secret; }
@@ -177,7 +249,7 @@ class BOTAN_DLL Session
*/
const std::vector<byte>& session_ticket() const { return m_session_ticket; }
- const Server_Information& server_info() const { return m_server_info; }
+ const Server_Information& server_info() const { return m_properties.get_server_info(); }
private:
enum { TLS_SESSION_PARAM_STRUCT_VERSION = 20160103 };
@@ -188,16 +260,10 @@ class BOTAN_DLL Session
std::vector<byte> m_session_ticket; // only used by client side
secure_vector<byte> m_master_secret;
- Protocol_Version m_version;
- u16bit m_ciphersuite;
- byte m_compression_method;
Connection_Side m_connection_side;
- u16bit m_srtp_profile;
bool m_extended_master_secret;
-
std::vector<X509_Certificate> m_peer_certs;
- Server_Information m_server_info; // optional
- std::string m_srp_identifier; // optional
+ Properties m_properties;
};
}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 15:05:33 +0000