aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/tls/c_hello.cpp4
-rw-r--r--src/tls/cert_req.cpp2
-rw-r--r--src/tls/tls_client.cpp2
-rw-r--r--src/tls/tls_client.h2
-rw-r--r--src/tls/tls_handshake_state.cpp2
-rw-r--r--src/tls/tls_policy.cpp43
-rw-r--r--src/tls/tls_policy.h13
-rw-r--r--src/tls/tls_server.h2
8 files changed, 41 insertions, 29 deletions
diff --git a/src/tls/c_hello.cpp b/src/tls/c_hello.cpp
index 919ed93f4..9956c5e28 100644
--- a/src/tls/c_hello.cpp
+++ b/src/tls/c_hello.cpp
@@ -85,7 +85,7 @@ Client_Hello::Client_Hello(Record_Writer& writer,
m_supports_heartbeats(true),
m_peer_can_send_heartbeats(true)
{
- std::vector<std::string> hashes = policy.allowed_hashes();
+ std::vector<std::string> hashes = policy.allowed_signature_hashes();
std::vector<std::string> sigs = policy.allowed_signature_methods();
for(size_t i = 0; i != hashes.size(); ++i)
@@ -128,7 +128,7 @@ Client_Hello::Client_Hello(Record_Writer& writer,
if(!value_exists(m_comp_methods, session.compression_method()))
m_comp_methods.push_back(session.compression_method());
- std::vector<std::string> hashes = policy.allowed_hashes();
+ std::vector<std::string> hashes = policy.allowed_signature_hashes();
std::vector<std::string> sigs = policy.allowed_signature_methods();
for(size_t i = 0; i != hashes.size(); ++i)
diff --git a/src/tls/cert_req.cpp b/src/tls/cert_req.cpp
index 31f4fb1e1..f97238d54 100644
--- a/src/tls/cert_req.cpp
+++ b/src/tls/cert_req.cpp
@@ -66,7 +66,7 @@ Certificate_Req::Certificate_Req(Record_Writer& writer,
if(version >= Protocol_Version::TLS_V12)
{
- std::vector<std::string> hashes = policy.allowed_hashes();
+ std::vector<std::string> hashes = policy.allowed_signature_hashes();
std::vector<std::string> sigs = policy.allowed_signature_methods();
for(size_t i = 0; i != hashes.size(); ++i)
diff --git a/src/tls/tls_client.cpp b/src/tls/tls_client.cpp
index 7dc0c224e..1f427ea14 100644
--- a/src/tls/tls_client.cpp
+++ b/src/tls/tls_client.cpp
@@ -165,7 +165,7 @@ void Client::process_handshake_msg(Handshake_Type type,
return;
}
- renegotiate(false);
+ this->renegotiate(false);
return;
}
diff --git a/src/tls/tls_client.h b/src/tls/tls_client.h
index c85b528d2..fc08ca796 100644
--- a/src/tls/tls_client.h
+++ b/src/tls/tls_client.h
@@ -52,7 +52,7 @@ class BOTAN_DLL Client : public Channel
std::function<std::string (std::vector<std::string>)> next_protocol =
std::function<std::string (std::vector<std::string>)>());
- void renegotiate(bool force_full_renegotiation);
+ void renegotiate(bool force_full_renegotiation = false);
private:
void process_handshake_msg(Handshake_Type type,
const std::vector<byte>& contents) override;
diff --git a/src/tls/tls_handshake_state.cpp b/src/tls/tls_handshake_state.cpp
index 48e587d03..d730bb492 100644
--- a/src/tls/tls_handshake_state.cpp
+++ b/src/tls/tls_handshake_state.cpp
@@ -225,7 +225,7 @@ std::string choose_hash(const std::string& sig_algo,
if(!supported_algos.empty())
{
- const auto hashes = policy.allowed_hashes();
+ const auto hashes = policy.allowed_signature_hashes();
/*
* Choose our most preferred hash that the counterparty supports
diff --git a/src/tls/tls_policy.cpp b/src/tls/tls_policy.cpp
index 87f8b5a14..c48ed274e 100644
--- a/src/tls/tls_policy.cpp
+++ b/src/tls/tls_policy.cpp
@@ -21,15 +21,15 @@ std::vector<std::string> Policy::allowed_ciphers() const
return std::vector<std::string>({
"AES-256",
"AES-128",
- "3DES",
"ARC4",
+ "3DES",
//"Camellia-256",
//"Camellia-128",
//"SEED"
});
}
-std::vector<std::string> Policy::allowed_hashes() const
+std::vector<std::string> Policy::allowed_signature_hashes() const
{
return std::vector<std::string>({
"SHA-512",
@@ -41,6 +41,16 @@ std::vector<std::string> Policy::allowed_hashes() const
});
}
+std::vector<std::string> Policy::allowed_macs() const
+ {
+ return std::vector<std::string>({
+ "SHA-384",
+ "SHA-256",
+ "SHA-1",
+ //"MD5",
+ });
+ }
+
std::vector<std::string> Policy::allowed_key_exchange_methods() const
{
return std::vector<std::string>({
@@ -73,11 +83,11 @@ std::vector<std::string> Policy::allowed_ecc_curves() const
"secp256k1",
"secp224r1",
"secp224k1",
- "secp192r1",
- "secp192k1",
- "secp160r2",
- "secp160r1",
- "secp160k1",
+ //"secp192r1",
+ //"secp192k1",
+ //"secp160r2",
+ //"secp160r1",
+ //"secp160k1",
});
}
@@ -136,10 +146,10 @@ class Ciphersuite_Preference_Ordering
{
public:
Ciphersuite_Preference_Ordering(const std::vector<std::string>& ciphers,
- const std::vector<std::string>& hashes,
+ const std::vector<std::string>& macs,
const std::vector<std::string>& kex,
const std::vector<std::string>& sigs) :
- m_ciphers(ciphers), m_hashes(hashes), m_kex(kex), m_sigs(sigs) {}
+ m_ciphers(ciphers), m_macs(macs), m_kex(kex), m_sigs(sigs) {}
bool operator()(const Ciphersuite& a, const Ciphersuite& b) const
{
@@ -186,11 +196,11 @@ class Ciphersuite_Preference_Ordering
if(a.mac_algo() != b.mac_algo())
{
- for(size_t i = 0; i != m_hashes.size(); ++i)
+ for(size_t i = 0; i != m_macs.size(); ++i)
{
- if(a.mac_algo() == m_hashes[i])
+ if(a.mac_algo() == m_macs[i])
return true;
- if(b.mac_algo() == m_hashes[i])
+ if(b.mac_algo() == m_macs[i])
return false;
}
}
@@ -198,8 +208,7 @@ class Ciphersuite_Preference_Ordering
return false; // equal (?!?)
}
private:
- std::vector<std::string> m_ciphers, m_hashes, m_kex, m_sigs;
-
+ std::vector<std::string> m_ciphers, m_macs, m_kex, m_sigs;
};
}
@@ -208,11 +217,11 @@ std::vector<u16bit> ciphersuite_list(const Policy& policy,
bool have_srp)
{
const std::vector<std::string> ciphers = policy.allowed_ciphers();
- const std::vector<std::string> hashes = policy.allowed_hashes();
+ const std::vector<std::string> macs = policy.allowed_macs();
const std::vector<std::string> kex = policy.allowed_key_exchange_methods();
const std::vector<std::string> sigs = policy.allowed_signature_methods();
- Ciphersuite_Preference_Ordering order(ciphers, hashes, kex, sigs);
+ Ciphersuite_Preference_Ordering order(ciphers, macs, kex, sigs);
std::set<Ciphersuite, Ciphersuite_Preference_Ordering> ciphersuites(order);
@@ -227,7 +236,7 @@ std::vector<u16bit> ciphersuite_list(const Policy& policy,
if(!value_exists(ciphers, suite.cipher_algo()))
continue; // unsupported cipher
- if(!value_exists(hashes, suite.mac_algo()))
+ if(!value_exists(macs, suite.mac_algo()))
continue; // unsupported MAC algo
if(!value_exists(sigs, suite.sig_algo()))
diff --git a/src/tls/tls_policy.h b/src/tls/tls_policy.h
index c47c45605..f6d276af9 100644
--- a/src/tls/tls_policy.h
+++ b/src/tls/tls_policy.h
@@ -33,12 +33,15 @@ class BOTAN_DLL Policy
virtual std::vector<std::string> allowed_ciphers() const;
/**
- * Returns a list of hash algorithms we are willing to use, in
- * order of preference. This is used for both MACs and signatures.
- * Allowed values: any hash name, though currently only MD5,
- * SHA-1, and the SHA-2 variants are used.
+ * Returns a list of hash algorithms we are willing to use for
+ * signatures.
*/
- virtual std::vector<std::string> allowed_hashes() const;
+ virtual std::vector<std::string> allowed_signature_hashes() const;
+
+ /**
+ * Returns a list of MAC algorithms we are willing to use.
+ */
+ virtual std::vector<std::string> allowed_macs() const;
/**
* Returns a list of key exchange algorithms we are willing to
diff --git a/src/tls/tls_server.h b/src/tls/tls_server.h
index 9625adcf3..89e27fa92 100644
--- a/src/tls/tls_server.h
+++ b/src/tls/tls_server.h
@@ -35,7 +35,7 @@ class BOTAN_DLL Server : public Channel
const std::vector<std::string>& protocols =
std::vector<std::string>());
- void renegotiate(bool force_full_renegotiation);
+ void renegotiate(bool force_full_renegotiation = false);
/**
* Return the server name indicator, if sent by the client
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 07:11:47 +0000