1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
/*
* TLS Channel
* (C) 2011 Jack Lloyd
*
* Released under the terms of the Botan license
*/
#ifndef BOTAN_TLS_CHANNEL_H__
#define BOTAN_TLS_CHANNEL_H__
#include <botan/tls_policy.h>
#include <botan/tls_record.h>
#include <botan/tls_session.h>
#include <botan/x509cert.h>
#include <vector>
namespace Botan {
/**
* Generic interface for TLS endpoint
*/
class BOTAN_DLL TLS_Channel
{
public:
/**
* Inject TLS traffic received from counterparty
* @return a hint as the how many more bytes we need to process the
current record (this may be 0 if on a record boundary)
*/
virtual size_t received_data(const byte buf[], size_t buf_size);
/**
* Inject plaintext intended for counterparty
*/
virtual void queue_for_sending(const byte buf[], size_t buf_size);
/**
* Send a close notification alert
*/
void close() { alert(WARNING, CLOSE_NOTIFY); }
/**
* Send a TLS alert message. If the alert is fatal, the
* internal state (keys, etc) will be reset
*/
void alert(Alert_Level level, Alert_Type type);
/**
* Is the connection active for sending application data?
*/
bool is_active() const { return handshake_completed && !is_closed(); }
/**
* Has the connection been definitely closed
*/
bool is_closed() const { return connection_closed; }
/**
* Return the negotiated version (if session is currently active)
*/
Version_Code protocol_version() const;
/**
* Attempt to renegotiate the session
*/
virtual void renegotiate() = 0;
/**
* Return the certificates of the peer
*/
std::vector<X509_Certificate> peer_cert_chain() const { return peer_certs; }
TLS_Channel(std::tr1::function<void (const byte[], size_t)> socket_output_fn,
std::tr1::function<void (const byte[], size_t, u16bit)> proc_fn,
std::tr1::function<void (const TLS_Session&)> handshake_complete);
virtual ~TLS_Channel();
protected:
virtual void read_handshake(byte rec_type,
const MemoryRegion<byte>& rec_buf);
virtual void process_handshake_msg(Handshake_Type type,
const MemoryRegion<byte>& contents) = 0;
std::tr1::function<void (const byte[], size_t, u16bit)> proc_fn;
std::tr1::function<void (const TLS_Session&)> handshake_fn;
Record_Writer writer;
Record_Reader reader;
SecureQueue pre_handshake_write_queue;
std::vector<X509_Certificate> peer_certs;
class Handshake_State* state;
class Secure_Renegotiation_State
{
public:
Secure_Renegotiation_State() : initial_handshake(true),
secure_renegotiation(false)
{}
void update(class Client_Hello* client_hello);
void update(class Server_Hello* server_hello);
void update(class Finished* client_finished,
class Finished* server_finished);
const MemoryVector<byte>& for_client_hello() const
{ return client_verify; }
MemoryVector<byte> for_server_hello() const
{
MemoryVector<byte> buf = client_verify;
buf += server_verify;
return buf;
}
bool supported() const { return secure_renegotiation; }
bool renegotiation() const { return !initial_handshake; }
private:
bool initial_handshake;
bool secure_renegotiation;
MemoryVector<byte> client_verify, server_verify;
};
Secure_Renegotiation_State secure_renegotiation;
bool handshake_completed;
bool connection_closed;
};
}
#endif
|
