aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-24116-4847/+11192
|\ | | | | | | | | | | 494c5d548ce3f370c2b771ca6b11e5f41e720da2) to branch 'net.randombit.botan.tls-state-machine' (head b2cd26ff6f093caa79aecb2d674205f45b6aadff)
| * Various hacks for testing client auth, SRP, etclloyd2012-04-203-10/+37
| |
| * propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-203-0/+14
| |\ | | | | | | | | | | | | | | | fdbd3afd02bcb9b4a7702a922581580297add684) to branch 'net.randombit.botan.tls-state-machine' (head 5f2f96b909365dc6e0faeccc7fa59470721e807a)
| * \ propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-205-11/+21
| |\ \ | | | | | | | | | | | | | | | | | | | | 50fa70d871f837c3c3338fabf5fb45649669aabf) to branch 'net.randombit.botan.tls-state-machine' (head 2358daac57db0411e62da2ef5a484468cb9307b7)
| * | | Compile fixlloyd2012-04-201-1/+1
| | | |
| * | | Put the implementation of Policy::dh_group in source so it's easier tolloyd2012-04-192-1/+6
| | | | | | | | | | | | | | | | | | | | update. Increase DHE group size from 1536 to 2048 bits, which per NIST/ECRYPT should be good to 2030 or so.
| * | | Various dependency/amalgamation fixeslloyd2012-04-195-6/+13
| | | |
| * | | Add a bool param to renegotiate on if we should force a fulllloyd2012-04-189-28/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | renegotiation or not. Save the hostname in the client so we can pull the session from the session manager.
| * | | Send almost all of the extensions on a renegotiation on an existinglloyd2012-04-181-14/+12
| | | | | | | | | | | | | | | | | | | | channel, except NPN which is strictly a per-connection extension. Makes life easier for servers. OpenSSL seems to behave the same way.
| * | | The secure renegotiation state was not updated on a sessionlloyd2012-04-181-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | resumption, which would cause failures if doing a renegotiation under the same session (eg to refresh keys). The peer_certs variable was not set until after the Session object was created, meaning the session (or session ticket) would not include client certs. Worse, they would be included in the next session saved, so if a client presented one cert, then renegotiated and presented another one, the first cert would be associated with the second session!
| * | | Add very basic wildcarding in X509_Certificate::matches_dns_namelloyd2012-04-181-2/+18
| | | |
| * | | Only do the hostname/DNS comparison if it is set. Otherwise, we havelloyd2012-04-171-1/+1
| | | | | | | | | | | | | | | | nothing meaningful to compare to.
| * | | As best I can tell the client is allowed to send a certificate chainlloyd2012-04-161-5/+0
| | | | | | | | | | | | | | | | in response to a certificate request.
| * | | The encoding of Certificate Request messages was wrong, each DERlloyd2012-04-161-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | encoded CA DN has a length field but also the entire block has one. This caused decoding errors if we requested a certificate and sent one or more DNs to request particular CAs. The decoding side had it correct.
| * | | Add support for TLS heartbeats (RFC 6520). Heartbeat initiations fromlloyd2012-04-1617-38/+282
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the peer are automatically responded to. TLS::Channel::heartbeat can initiate a new heartbeat if the peer allows it. Heartbeat replies are passed back to the application processing function with an Alert value of HEARTBEAT_PAYLOAD (a 'fake' value, 256, which is out of range of the valid TLS alert space), along with the sent payload. The RFC requires us to have no more than one heartbeat 'in flight' at a time, ie without getting a response (or a timeout in the case of DTLS). Currently we do not prevent an application from requesting more.
| * | | Add support for the 3 alert types we didn't have codes for.lloyd2012-04-092-32/+38
| | | |
| * | | Finish up server side SRP support, a little ugly but it works.lloyd2012-04-0613-79/+267
| | | | | | | | | | | | | | | | | | | | | | | | Add SRP hooks in the examples Fix next protocol support in the tls_server example.
| * | | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-06115-4848/+10664
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | 058444ec216dd9690938c82922d911df2da535b4) to branch 'net.randombit.botan.tls-state-machine' (head 54985e112aecb7b7c98a7dace924a2f704e6c9c1)
| | * | | Re-enable TLS (was disabled by trunk merge), and require the srp6 modulelloyd2012-04-053-3/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initial outline of server side SRP support. Need to figure out how to transfer the v, b, B params from the server key exchange message to the client key exchange. The DH variants do this by passing a Private_Key via server_kex_key call, but wrapping SRP params in a Private_Key really doesn't feel right. Not sure what to do here. Possibly both SRP and DH should return a Key_Exchange_Material* that a client key exchange knows how to dynamic cast on.
| | * | | Initial client-side support for SRP (finally!). Tested against OpenSSLlloyd2012-04-054-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | 1.0.1, only the certificate versions tested currently as OpenSSL doesn't support anon SRP.
| | * | | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-0526-315/+444
| | |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 91305e3daaae9ea8a1786daf058d961991c68251) to branch 'net.randombit.botan.tls-state-machine' (head 474a00b316f5b21a4e56033d4d990d87d9d3eed6)
| | * | | | Remove Policy::choose_compression and move to tls_serverlloyd2012-04-044-62/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make ciphersuite_list a free standing function Now the Policy interface only contains actual policy hooks (no non-virtual functions). Though choose_curve is a little dubious.
| | * | | | Limit the lifetime of tickets to Policy::session_ticket_lifetime()lloyd2012-04-0415-178/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | seconds and report that value to the client in the NewSessionTicket message. After that point, a session ticket is ignored and a full renegotiation is forced. Only send a new session ticket on a new session, or on a resumed session where the client indicated it supports session tickets but for whatever reason didn't send one in the hello. Perhaps in this case, we should also remove the session from the session manager? Clean up server selection of the ciphersuite a bit, all in an anon function in tls_server instead of scattered over Server, Policy, and Server_Hello. Add Session::session_age and Session_Manager::session_lifetime
| | * | | | Add anonymous DH/ECDH ciphersuites to the cipher list. Interop checkedlloyd2012-04-022-18/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | against OpenSSL. One big issue that needs to be resolved is that with these ciphersuites available to be negotiated, we want to make sure they only are used when the application/user expects them to. Problem is that PSK and SRP are "anonymous" but authenticated via the shared secret. We need to be able to distinguish these on a policy level. Otherwise a MITM could simply offer anon DH, which would be somewhat unfortunate. A client could detect this in the handshake callback, but might not. In the short term to ensure this doesn't occur, disable both anon DH and PSK/SRP in the default policy.
| | * | | | Use SHA-256 when MD5 is negotiated as the HMAC hash in TLS 1.2,lloyd2012-04-022-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | previously negotiating any MD5-based ciphersuite in TLS 1.2 would cause MAC failures as the master secret would come out differently due to using the wrong PRF.
| | * | | | Remove the Ciphersuite_Code enum and move all ciphersuitelloyd2012-03-307-351/+298
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | integer->info mapping to tls_suite_info.cpp which is mostly autogenerated by a Python script from the IANA parameters file. The SRP method now uses kex "SRP_SHA" which is what the RFC calls it. (And hypothetically, SRP_SHA256 might be defined at some point and we'd need to be able to distinguish them). Remove IDEA ciphersuite; we don't want to require IDEA be available due to the European patent still being valid (IIRC), but I didn't want to have to hand-edit the autogenerated switch with an #if check. Not a huge issue though as most sites don't support it anyway.
| | * | | | Rework session crypto code. Drop the 4 bytes of zeros reserved forlloyd2012-03-282-38/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | flags; if params change just regen the magic value and drop old sessions. Check the magic value right from the start. Use constants for internal sizes. Increase default PBKDF2 iterations in the SQLite session manager to 64K.
| | * | | | For unencrypted initial handshake records, copy them to the writebuflloyd2012-03-231-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | anyway so we can output them with a single message. For some network approaches this won't make any difference but it might help with something doing direct writes on each callback. Additionally it seems important for DTLS, where each record must be contained in a single packet.
| | * | | | Revert the session_ticket callback in credentials manager. If a PSKlloyd2012-03-236-57/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | manager is being used, it could be easily used for session tickets as well, and if it's not the generate-on-first-call technique is easy to write. Avoid offering the session ticket extension if we know we don't have a key. For one thing it will cause us to avoid using stateful sessions, but additionally OpenSSL 1.0.1 is very intolerant of empty NewSessionTicket messages so definitely worth avoiding when we can.
| | * | | | Fix depslloyd2012-03-232-0/+6
| | | | | |
| | * | | | Add a special hook in credentials manager for the session ticket key,lloyd2012-03-233-17/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with a default implementation that creates a new random key on the first call.
| | * | | | Include the curves and sig algos list in a session resumption clientlloyd2012-03-233-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hello. Also include a full list of ciphersuites, ensuring that our original session ciphersuite is in the list regardless of policy (maybe it would be better to just not resume in that case, though?). Otherwise, if the server doesn't remember our session (or the session ticket key), it might not be capable of negotiating using the single ciphersuite we sent due to lack of information (allowed curves was a particular issue here). Including the full ciphersuite list also allows for rengotiating the ciphersuite if, for instance, the session can't be resumed because the server used to have an RSA cert but has since replaced it with an ECDSA cert.
| | * | | | Use the SQLite session manager if availablelloyd2012-03-231-0/+11
| | | | | |
| | * | | | Only claim we support session tickets if we actually have a key oflloyd2012-03-232-9/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | some kind. Fix New_Session_Ticket decoding. Apparently when the RFC says that a server that does not want to send a ticket sends "an empty ticket" that means a lifetime value plus an empty ticket, not an actually empty extension.
| | * | | | Call Credentials_Manager::psk for the session ticket key.lloyd2012-03-222-14/+37
| | | | | |
| | * | | | Add encryption for the SQLite sessions databaselloyd2012-03-224-54/+163
| | | | | |
| | * | | | propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-2216-57/+456
| | |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 6bcbae3d22e4d873a8e941d0325ad666482ac4da) to branch 'net.randombit.botan.tls-session-ticket' (head 9048722b5d18b39cf21f8542942dab94a9bd4e6b)
| | | * | | | Server side handling of session tickets, though currently with alloyd2012-03-227-33/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | hard-coded key.
| | | * | | | Working client-side session tickets. Tested against gmail.com andlloyd2012-03-226-17/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.0.1-beta2 running on localhost.
| | | * | | | Correct ticket decoding/encodinglloyd2012-03-221-5/+6
| | | | | | |
| | | * | | | Add missing source file for New_Session_Ticket msglloyd2012-03-221-0/+39
| | | | | | |
| | | * | | | propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-225-3/+313
| | | |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | f761c340d4390c232d1a9896f3fde5c9dec7858b) to branch 'net.randombit.botan.tls-session-ticket' (head bf9feb245aa7185e22948a21a3099acac7237b44)
| | | * | | | | Basic protocol message flow for session ticketslloyd2012-03-2011-64/+120
| | | | | | | |
| | | * | | | | Small fixes, cleanupslloyd2012-03-195-9/+22
| | | | | | | |
| | | * | | | | Various merge fixups.lloyd2012-03-165-47/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use AES-256 so we don't encrypt session tickets with a weaker algo than the ciphersuites.
| | | * | | | | propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-167-4/+190
| | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 9a12f28252f9b0a051a85c4647679a715161d06c) to branch 'net.randombit.botan.tls-session-ticket' (head ebf45d24a44fb4d1e66e59fe8abefe6f8a53cf02)
| | | | * \ \ \ \ propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-1683-2328/+4962
| | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | c24b5d6b012131b177d38bddb8b06d73f81f70c4) to branch 'net.randombit.botan.tls-session-ticket' (head 9977d4c118e1ac26425cef676ebf26cd5b2a470e)
| | | | * | | | | | Build fixeslloyd2012-01-114-11/+20
| | | | | | | | | |
| | | | * | | | | | Outline of RFC 5077 session ticketslloyd2012-01-115-3/+170
| | | | | | | | | |
| | * | | | | | | | Add some helper functions for data accesslloyd2012-03-221-22/+33
| | | |_|_|/ / / / | | |/| | | | | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-28 04:04:16 +0000