1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
|
/*
* TLS Channel
* (C) 2011,2012 Jack Lloyd
*
* Released under the terms of the Botan license
*/
#ifndef BOTAN_TLS_CHANNEL_H__
#define BOTAN_TLS_CHANNEL_H__
#include <botan/tls_policy.h>
#include <botan/tls_record.h>
#include <botan/tls_session.h>
#include <botan/tls_alert.h>
#include <botan/tls_session_manager.h>
#include <botan/x509cert.h>
#include <vector>
#include <string>
namespace Botan {
namespace TLS {
/**
* Generic interface for TLS endpoint
*/
class BOTAN_DLL Channel
{
public:
/**
* Inject TLS traffic received from counterparty
* @return a hint as the how many more bytes we need to process the
* current record (this may be 0 if on a record boundary)
*/
virtual size_t received_data(const byte buf[], size_t buf_size);
/**
* Inject plaintext intended for counterparty
*/
void send(const byte buf[], size_t buf_size);
/**
* Inject plaintext intended for counterparty
*/
void send(const std::string& string);
/**
* Send a close notification alert
*/
void close() { send_alert(Alert(Alert::CLOSE_NOTIFY)); }
/**
* @return true iff the connection is active for sending application data
*/
bool is_active() const { return m_handshake_completed && !is_closed(); }
/**
* @return true iff the connection has been definitely closed
*/
bool is_closed() const { return m_connection_closed; }
/**
* Attempt to renegotiate the session
* @param force_full_renegotiation if true, require a full renegotiation,
* otherwise allow session resumption
*/
virtual void renegotiate(bool force_full_renegotiation = false) = 0;
/**
* Attempt to send a heartbeat message (if negotiated with counterparty)
* @param payload will be echoed back
* @param payload_size size of payload in bytes
*/
void heartbeat(const byte payload[], size_t payload_size);
/**
* Attempt to send a heartbeat message (if negotiated with counterparty)
*/
void heartbeat() { heartbeat(nullptr, 0); }
/**
* @return certificate chain of the peer (may be empty)
*/
std::vector<X509_Certificate> peer_cert_chain() const { return m_peer_certs; }
Channel(std::function<void (const byte[], size_t)> socket_output_fn,
std::function<void (const byte[], size_t, Alert)> proc_fn,
std::function<bool (const Session&)> handshake_complete,
Session_Manager& session_manager,
RandomNumberGenerator& rng);
virtual ~Channel();
protected:
/**
* Send a TLS alert message. If the alert is fatal, the internal
* state (keys, etc) will be reset.
* @param alert the Alert to send
*/
void send_alert(const Alert& alert);
virtual void read_handshake(byte rec_type,
const std::vector<byte>& rec_buf);
virtual void process_handshake_msg(Handshake_Type type,
const std::vector<byte>& contents) = 0;
virtual void alert_notify(const Alert& alert) = 0;
virtual class Handshake_State* new_handshake_state() const = 0;
class Secure_Renegotiation_State
{
public:
Secure_Renegotiation_State() : m_initial_handshake(true),
m_secure_renegotiation(false)
{}
void update(class Client_Hello* client_hello);
void update(class Server_Hello* server_hello);
void update(class Finished* client_finished,
class Finished* server_finished);
const std::vector<byte>& for_client_hello() const
{ return m_client_verify; }
std::vector<byte> for_server_hello() const
{
std::vector<byte> buf = m_client_verify;
buf += m_server_verify;
return buf;
}
bool supported() const
{ return m_secure_renegotiation; }
bool initial_handshake() const { return m_initial_handshake; }
private:
bool m_initial_handshake;
bool m_secure_renegotiation;
std::vector<byte> m_client_verify, m_server_verify;
};
std::function<void (const byte[], size_t, Alert)> m_proc_fn;
std::function<bool (const Session&)> m_handshake_fn;
class Handshake_State* m_state;
Session_Manager& m_session_manager;
Record_Writer m_writer;
Record_Reader m_reader;
std::vector<X509_Certificate> m_peer_certs;
Secure_Renegotiation_State m_secure_renegotiation;
std::vector<byte> m_active_session;
bool m_handshake_completed;
bool m_connection_closed;
bool m_peer_supports_heartbeats;
bool m_heartbeat_sending_allowed;
};
}
}
#endif
|
