aboutsummaryrefslogtreecommitdiffstats
path: root/src/tls/tls_policy.h
Commit message (Collapse)AuthorAgeFilesLines
* Fix DTLS version string.lloyd2012-07-281-0/+1
| | | | | | Pass version to ciphersuite_list, avoid negotiating RC4 with DTLS Disable ECC <= 192 bits.
* Changes to version handling in support of DTLS work.lloyd2012-07-121-2/+2
| | | | | | | | | | | | | | | Add a few 'feature tests' to Protocol_Version which helps avoid some explicit comparisons. Additionally, remove the relational comparisons, except for operator> which is still used in a few locations. TLS::Policy has changed and no longer has min_version. The new hook that replaces it is acceptable_protocol_version, which should return true if and only if we are willing to negotiate the version returned. This leads to a somewhat cleaner result and additionally allows one to do maybe interesting though mostly useless things like allowing TLS 1.0 or 1.2 but not 1.1. Fix the version sent in the (unused) DTLS hello verify message.
* Split TLS::Policy::allowed_hashes into allowed_signature_hashes andlloyd2012-06-291-5/+8
| | | | | | | | | | | | | allowed_macs. This allows someone to turn on MD5 for message auth, which is a little sketchy but probably OK, without also (likely unintentionally) enabling MD5 for TLS v1.2 signatures, which would be a big problem. Prioritize RC4 over 3DES in default policy. Disable ECC curves smaller than 224 bits by default. More updates to the TLS policy documentation.
* Add TLS::Policy::minimum_dh_group_size, default 1024. Send anlloyd2012-06-251-0/+5
| | | | | | | | insufficient_security alert if the server tries to give us a DH group smaller than that. Also check to make sure the key isn't obviously bogus (<=1 || >= p-1), though as the key is purely ephemeral it doesn't seem like a small subgroup attack would provide much advantage anyway.
* Invert the policy setting as I think it makes it more obvious thatlloyd2012-06-081-5/+5
| | | | enabling this is a bad idea.
* Put the implementation of Policy::dh_group in source so it's easier tolloyd2012-04-191-1/+1
| | | | | update. Increase DHE group size from 1536 to 2048 bits, which per NIST/ECRYPT should be good to 2030 or so.
* Remove Policy::choose_compression and move to tls_serverlloyd2012-04-041-14/+8
| | | | | | | Make ciphersuite_list a free standing function Now the Policy interface only contains actual policy hooks (no non-virtual functions). Though choose_curve is a little dubious.
* Limit the lifetime of tickets to Policy::session_ticket_lifetime()lloyd2012-04-041-0/+7
| | | | | | | | | | | | | | | | | seconds and report that value to the client in the NewSessionTicket message. After that point, a session ticket is ignored and a full renegotiation is forced. Only send a new session ticket on a new session, or on a resumed session where the client indicated it supports session tickets but for whatever reason didn't send one in the hello. Perhaps in this case, we should also remove the session from the session manager? Clean up server selection of the ciphersuite a bit, all in an anon function in tls_server instead of scattered over Server, Policy, and Server_Hello. Add Session::session_age and Session_Manager::session_lifetime
* Move min_version and pref_version to the source file so they can belloyd2012-03-021-4/+2
| | | | | overridden easily in a new release without changing binaries linked against an earlier version.
* Go back to choosing the ciphersuite based on the server's preferences.lloyd2012-01-251-5/+7
| | | | | | | | | The client can constrain their offering if they want to. Add identifiers for PSK suites (not implemented) Rename hide_unknown_srp_users to hide_unknown_users as it can be used for PSK as well.
* Hiding SRP users or not is policy. Not sure what the default should be for thislloyd2012-01-251-2/+10
|
* We can now actually handle multiple certificate types in the serverlloyd2012-01-241-2/+1
| | | | | and will choose one depending on which ciphersuites the client offered.
* Send the supported elliptic curves extension. Instead of hardcodinglloyd2012-01-241-0/+10
| | | | | | | the values let policy specify them. Also choose an ECC curve for server kex from the client hello. Choice is via policy, default implementation is to choose the first curve the client supports out of the server's preference list.
* Get the list of supported ECC curves out of the client hello, andlloyd2012-01-241-0/+1
| | | | | avoid negotiating an ECDH key exchange if the client didn't send any curves that we know about.
* Add comments for the Policy class. Make the allowed_* calls virtual solloyd2012-01-241-16/+42
| | | | an application can actually override them.
* The credentials manager interface seems a much better place for certlloyd2012-01-231-10/+1
| | | | | | | | | checking, allowed client auth CAs, etc than the policy class. With this change, most users won't ever need to modify the default policy which is likely a good thing. Remove copy and paste of the credentials manager implemenation in the examples.
* Make the version number a proper class, makes many things much easierlloyd2012-01-231-4/+6
| | | | for such a minor change.
* Since this branch is hugely API breaking already, go ahead and putlloyd2012-01-231-2/+6
| | | | | everything into a new namespace (Botan::TLS), removing the TLS_ prefixes on everything.
* When generating a signature in TLS 1.2, respect the request of thelloyd2012-01-201-1/+1
| | | | | | | | | | | | | counterparty by using the highest preference hash they have available for the signature type we are generating. This does mean we will do stupid things, if the counterparty is stupid (for instance some versions of GnuTLS will prefer SHA-1 over the SHA-2s - likely someone misread the spec and ordered the list backwards). But because we filter out MD5 we'll never use that; even in the worst case, if someone requests only MD5, we'll skip over it and use SHA-1 as the fallback algorithm. Theoretically this is against the spec because we "MUST" send something compatible, but seriously, fuck em. Right in the eye.
* New policy methods. User provides lists of ciphers, hashes, etc theylloyd2012-01-201-21/+37
| | | | | | | | | | | | | would like to use, in order of preference. Client sorts list of known ciphersuites by those preferences and sends them. Server now picks the first client method it knows and that it can use (previously, it would choose the one it liked the best out of what the client sent). New policy callback returns list of CAs allowed for client auth. Don't send certificate request unless we have at least one CA we want signatures from. OpenSSL has a behavior (bug?) in TLS 1.2 mode such that it will reject a connection if a certificate request is sent without any names included.
* Many fixes for TLS 1.2 though some things in particular client authlloyd2012-01-201-1/+1
| | | | | | remain broken. New interface for querying the TLS extensions, much cleaner.
* Various and sundry bug fixeslloyd2012-01-191-1/+1
|
* Some basic infrastructure pieces for SRP (policy, etc)lloyd2011-12-311-3/+7
|
* Many renegotiation fixes. Add support for the secure renegotiationlloyd2011-12-301-0/+2
| | | | | extension (client side only at the moment). Add an interface that allows applications to request renegotiation.
* Rename ssl module to tlslloyd2011-12-231-0/+63
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 04:10:33 +0000