/src/botan/src/lib/tls/tls_handshake_state.cpp

Source (jump to first uncovered line)
/*
* TLS Handshaking
* (C) 2004-2006,2011,2012,2015,2016 Jack Lloyd
*     2017 Harry Reimann, Rohde & Schwarz Cybersecurity
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/internal/tls_handshake_state.h>
#include <botan/internal/tls_record.h>
#include <botan/tls_messages.h>
#include <botan/kdf.h>
#include <sstream>

namespace Botan {

namespace TLS {

std::string Handshake_Message::type_string() const
   {
   return handshake_type_to_string(type());
   }

const char* handshake_type_to_string(Handshake_Type type)
   {
   switch(type)
      {
      case HELLO_VERIFY_REQUEST:
         return "hello_verify_request";

      case HELLO_REQUEST:
         return "hello_request";

      case CLIENT_HELLO:
         return "client_hello";

      case SERVER_HELLO:
         return "server_hello";

      case CERTIFICATE:
         return "certificate";

      case CERTIFICATE_URL:
         return "certificate_url";

      case CERTIFICATE_STATUS:
         return "certificate_status";

      case SERVER_KEX:
         return "server_key_exchange";

      case CERTIFICATE_REQUEST:
         return "certificate_request";

      case SERVER_HELLO_DONE:
         return "server_hello_done";

      case CERTIFICATE_VERIFY:
         return "certificate_verify";

      case CLIENT_KEX:
         return "client_key_exchange";

      case NEW_SESSION_TICKET:
         return "new_session_ticket";

      case HANDSHAKE_CCS:
         return "change_cipher_spec";

      case FINISHED:
         return "finished";

      case HANDSHAKE_NONE:
         return "invalid";
      }

   throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
                       "Unknown TLS handshake message type " + std::to_string(type));
   }

namespace {

uint32_t bitmask_for_handshake_type(Handshake_Type type)
   {
   switch(type)
      {
      case HELLO_VERIFY_REQUEST:
         return (1 << 0);

      case HELLO_REQUEST:
         return (1 << 1);

      case CLIENT_HELLO:
         return (1 << 2);

      case SERVER_HELLO:
         return (1 << 3);

      case CERTIFICATE:
         return (1 << 4);

      case CERTIFICATE_URL:
         return (1 << 5);

      case CERTIFICATE_STATUS:
         return (1 << 6);

      case SERVER_KEX:
         return (1 << 7);

      case CERTIFICATE_REQUEST:
         return (1 << 8);

      case SERVER_HELLO_DONE:
         return (1 << 9);

      case CERTIFICATE_VERIFY:
         return (1 << 10);

      case CLIENT_KEX:
         return (1 << 11);

      case NEW_SESSION_TICKET:
         return (1 << 12);

      case HANDSHAKE_CCS:
         return (1 << 13);

      case FINISHED:
         return (1 << 14);

      // allow explicitly disabling new handshakes
      case HANDSHAKE_NONE:
         return 0;
      }

   throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
                       "Unknown TLS handshake message type " + std::to_string(type));
   }

std::string handshake_mask_to_string(uint32_t mask, char combiner)
   {
   const Handshake_Type types[] = {
      HELLO_VERIFY_REQUEST,
      HELLO_REQUEST,
      CLIENT_HELLO,
      SERVER_HELLO,
      CERTIFICATE,
      CERTIFICATE_URL,
      CERTIFICATE_STATUS,
      SERVER_KEX,
      CERTIFICATE_REQUEST,
      SERVER_HELLO_DONE,
      CERTIFICATE_VERIFY,
      CLIENT_KEX,
      NEW_SESSION_TICKET,
      HANDSHAKE_CCS,
      FINISHED
   };

   std::ostringstream o;
   bool empty = true;

   for(auto&& t : types)
      {
      if(mask & bitmask_for_handshake_type(t))
         {
         if(!empty)
            o << combiner;
         o << handshake_type_to_string(t);
         empty = false;
         }
      }

   return o.str();
   }

}

/*
* Initialize the SSL/TLS Handshake State
*/
Handshake_State::Handshake_State(Handshake_IO* io, Callbacks& cb) :
   m_callbacks(cb),
   m_handshake_io(io),
   m_version(m_handshake_io->initial_record_version())
   {
   }

void Handshake_State::note_message(const Handshake_Message& msg)
   {
   m_callbacks.tls_inspect_handshake_msg(msg);
   }

void Handshake_State::hello_verify_request(const Hello_Verify_Request& hello_verify)
   {
   note_message(hello_verify);

   m_client_hello->update_hello_cookie(hello_verify);
   hash().reset();
   hash().update(handshake_io().send(*m_client_hello));
   note_message(*m_client_hello);
   }

void Handshake_State::client_hello(Client_Hello* client_hello)
   {
   if(client_hello == nullptr)
      {
      m_client_hello.reset();
      hash().reset();
      }
   else
      {
      m_client_hello.reset(client_hello);
      note_message(*m_client_hello);
      }
   }

void Handshake_State::server_hello(Server_Hello* server_hello)
   {
   m_server_hello.reset(server_hello);
   m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite());
   note_message(*m_server_hello);
   }

void Handshake_State::server_certs(Certificate* server_certs)
   {
   m_server_certs.reset(server_certs);
   note_message(*m_server_certs);
   }

void Handshake_State::server_cert_status(Certificate_Status* server_cert_status)
   {
   m_server_cert_status.reset(server_cert_status);
   note_message(*m_server_cert_status);
   }

void Handshake_State::server_kex(Server_Key_Exchange* server_kex)
   {
   m_server_kex.reset(server_kex);
   note_message(*m_server_kex);
   }

void Handshake_State::cert_req(Certificate_Req* cert_req)
   {
   m_cert_req.reset(cert_req);
   note_message(*m_cert_req);
   }

void Handshake_State::server_hello_done(Server_Hello_Done* server_hello_done)
   {
   m_server_hello_done.reset(server_hello_done);
   note_message(*m_server_hello_done);
   }

void Handshake_State::client_certs(Certificate* client_certs)
   {
   m_client_certs.reset(client_certs);
   note_message(*m_client_certs);
   }

void Handshake_State::client_kex(Client_Key_Exchange* client_kex)
   {
   m_client_kex.reset(client_kex);
   note_message(*m_client_kex);
   }

void Handshake_State::client_verify(Certificate_Verify* client_verify)
   {
   m_client_verify.reset(client_verify);
   note_message(*m_client_verify);
   }

void Handshake_State::new_session_ticket(New_Session_Ticket* new_session_ticket)
   {
   m_new_session_ticket.reset(new_session_ticket);
   note_message(*m_new_session_ticket);
   }

void Handshake_State::server_finished(Finished* server_finished)
   {
   m_server_finished.reset(server_finished);
   note_message(*m_server_finished);
   }

void Handshake_State::client_finished(Finished* client_finished)
   {
   m_client_finished.reset(client_finished);
   note_message(*m_client_finished);
   }

void Handshake_State::set_version(const Protocol_Version& version)
   {
   m_version = version;
   }

void Handshake_State::compute_session_keys()
   {
   m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false);
   }

void Handshake_State::compute_session_keys(const secure_vector<uint8_t>& resume_master_secret)
   {
   m_session_keys = Session_Keys(this, resume_master_secret, true);
   }

void Handshake_State::confirm_transition_to(Handshake_Type handshake_msg)
   {
   const uint32_t mask = bitmask_for_handshake_type(handshake_msg);

   m_hand_received_mask |= mask;

   const bool ok = (m_hand_expecting_mask & mask) != 0; // overlap?

   if(!ok)
      {
      const uint32_t seen_so_far = m_hand_received_mask & ~mask;

      std::ostringstream msg;

      msg << "Unexpected state transition in handshake got a " << handshake_type_to_string(handshake_msg);

      if(m_hand_expecting_mask == 0)
         msg << " not expecting messages";
      else
         msg << " expected " << handshake_mask_to_string(m_hand_expecting_mask, '|');

      if(seen_so_far != 0)
         msg << " seen " << handshake_mask_to_string(seen_so_far, '+');

      throw Unexpected_Message(msg.str());
      }

   /* We don't know what to expect next, so force a call to
      set_expected_next; if it doesn't happen, the next transition
      check will always fail which is what we want.
   */
   m_hand_expecting_mask = 0;
   }

void Handshake_State::set_expected_next(Handshake_Type handshake_msg)
   {
   m_hand_expecting_mask |= bitmask_for_handshake_type(handshake_msg);
   }

bool Handshake_State::received_handshake_msg(Handshake_Type handshake_msg) const
   {
   const uint32_t mask = bitmask_for_handshake_type(handshake_msg);

   return (m_hand_received_mask & mask) != 0;
   }

std::pair<Handshake_Type, std::vector<uint8_t>>
Handshake_State::get_next_handshake_msg()
   {
   const bool expecting_ccs =
      (bitmask_for_handshake_type(HANDSHAKE_CCS) & m_hand_expecting_mask) != 0;

   return m_handshake_io->get_next_record(expecting_ccs);
   }

std::string Handshake_State::srp_identifier() const
   {
#if defined(BOTAN_HAS_SRP6)
   // Authenticated via the successful key exchange
   if(ciphersuite().valid() && ciphersuite().kex_method() == Kex_Algo::SRP_SHA)
      return client_hello()->srp_identifier();
#endif

   return "";
   }


std::vector<uint8_t> Handshake_State::session_ticket() const
   {
   if(new_session_ticket() && !new_session_ticket()->ticket().empty())
      return new_session_ticket()->ticket();

   return client_hello()->session_ticket();
   }

KDF* Handshake_State::protocol_specific_prf() const
   {
   if(version().supports_ciphersuite_specific_prf())
      {
      const std::string prf_algo = ciphersuite().prf_algo();

      if(prf_algo == "MD5" || prf_algo == "SHA-1")
         return get_kdf("TLS-12-PRF(SHA-256)");

      return get_kdf("TLS-12-PRF(" + prf_algo + ")");
      }

   // Old PRF used in TLS v1.0, v1.1 and DTLS v1.0
   return get_kdf("TLS-PRF");
   }

std::pair<std::string, Signature_Format>
Handshake_State::choose_sig_format(const Private_Key& key,
                                   Signature_Scheme& chosen_scheme,
                                   bool for_client_auth,
                                   const Policy& policy) const
   {
   const std::string sig_algo = key.algo_name();

   if(this->version().supports_negotiable_signature_algorithms())
      {
      const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();

      std::vector<Signature_Scheme> requested =
         (for_client_auth) ? cert_req()->signature_schemes() : client_hello()->signature_schemes();

      if(requested.empty())
         {
         // Implicit SHA-1
         requested.push_back(Signature_Scheme::RSA_PKCS1_SHA1);
         requested.push_back(Signature_Scheme::ECDSA_SHA1);
         requested.push_back(Signature_Scheme::DSA_SHA1);
         }

      for(Signature_Scheme scheme : allowed)
         {
         if(signature_scheme_is_known(scheme) == false)
            {
            continue;
            }

         if(signature_algorithm_of_scheme(scheme) == sig_algo)
            {
            if(std::find(requested.begin(), requested.end(), scheme) != requested.end())
               {
               chosen_scheme = scheme;
               break;
               }
            }
         }

      const std::string hash = hash_function_of_scheme(chosen_scheme);

      if(!policy.allowed_signature_hash(hash))
         {
         throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
                             "Policy refuses to accept signing with any hash supported by peer");
         }

      if(sig_algo == "RSA")
         {
         return std::make_pair(padding_string_for_scheme(chosen_scheme), IEEE_1363);
         }
      else if(sig_algo == "DSA" || sig_algo == "ECDSA")
         {
         return std::make_pair(padding_string_for_scheme(chosen_scheme), DER_SEQUENCE);
         }
      }
   else
      {
      if(sig_algo == "RSA")
         {
         const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
         return std::make_pair(padding, IEEE_1363);
         }
      else if(sig_algo == "DSA" || sig_algo == "ECDSA")
         {
         const std::string padding = "EMSA1(SHA-1)";
         return std::make_pair(padding, DER_SEQUENCE);
         }
      }

   throw Invalid_Argument(sig_algo + " is invalid/unknown for TLS signatures");
   }

namespace {

bool supported_algos_include(
   const std::vector<Signature_Scheme>& schemes,
   const std::string& key_type,
   const std::string& hash_type)
   {
   for(Signature_Scheme scheme : schemes)
      {
      if(signature_scheme_is_known(scheme) &&
         hash_function_of_scheme(scheme) == hash_type &&
         signature_algorithm_of_scheme(scheme) == key_type)
         {
         return true;
         }
      }

   return false;
   }

}

std::pair<std::string, Signature_Format>
Handshake_State::parse_sig_format(const Public_Key& key,
                                  Signature_Scheme scheme,
                                  bool for_client_auth,
                                  const Policy& policy) const
   {
   const std::string key_type = key.algo_name();

   if(!policy.allowed_signature_method(key_type))
      {
      throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
                          "Rejecting " + key_type + " signature");
      }

   if(this->version().supports_negotiable_signature_algorithms() == false)
      {
      if(scheme != Signature_Scheme::NONE)
         throw Decoding_Error("Counterparty sent hash/sig IDs with old version");

      /*
      There is no check on the acceptability of a v1.0/v1.1 hash type,
      since it's implicit with use of the protocol
      */

      if(key_type == "RSA")
         {
         const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
         return std::make_pair(padding, IEEE_1363);
         }
      else if(key_type == "DSA" || key_type == "ECDSA")
         {
         const std::string padding = "EMSA1(SHA-1)";
         return std::make_pair(padding, DER_SEQUENCE);
         }
      else
         throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
      }

   if(scheme == Signature_Scheme::NONE)
      throw Decoding_Error("Counterparty did not send hash/sig IDS");

   if(key_type != signature_algorithm_of_scheme(scheme))
      throw Decoding_Error("Counterparty sent inconsistent key and sig types");

   if(for_client_auth && !cert_req())
      {
      throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
                          "No certificate verify set");
      }

   /*
   Confirm the signature type we just received against the
   supported_algos list that we sent; it better be there.
   */

   const std::vector<Signature_Scheme> supported_algos =
      for_client_auth ? cert_req()->signature_schemes() :
      client_hello()->signature_schemes();

   if(!signature_scheme_is_known(scheme))
      throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
                          "Peer sent unknown signature scheme");

   const std::string hash_algo = hash_function_of_scheme(scheme);

   if(!supported_algos_include(supported_algos, key_type, hash_algo))
      {
      throw TLS_Exception(Alert::ILLEGAL_PARAMETER,
                          "TLS signature extension did not allow for " +
                          key_type + "/" + hash_algo + " signature");
      }

   if(key_type == "RSA")
      {
      return std::make_pair(padding_string_for_scheme(scheme), IEEE_1363);
      }
   else if(key_type == "DSA" || key_type == "ECDSA")
      {
      return std::make_pair(padding_string_for_scheme(scheme), DER_SEQUENCE);
      }

   throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
   }

}

}

Coverage Report

Created: 2020-08-01 06:18

Line	Count	Source (jump to first uncovered line)
1		/*
2		* TLS Handshaking
3		* (C) 2004-2006,2011,2012,2015,2016 Jack Lloyd
4		* 2017 Harry Reimann, Rohde & Schwarz Cybersecurity
5		*
6		* Botan is released under the Simplified BSD License (see license.txt)
7		*/
8
9		#include <botan/internal/tls_handshake_state.h>
10		#include <botan/internal/tls_record.h>
11		#include <botan/tls_messages.h>
12		#include <botan/kdf.h>
13		#include <sstream>
14
15		namespace Botan {
16
17		namespace TLS {
18
19		std::string Handshake_Message::type_string() const
20	0	{
21	0	return handshake_type_to_string(type());
22	0	}
23
24		const char* handshake_type_to_string(Handshake_Type type)
25	789	{
26	789	switch(type)
27	789	{
28	9	case HELLO_VERIFY_REQUEST:
29	9	return "hello_verify_request";
30	0
31	101	case HELLO_REQUEST:
32	101	return "hello_request";
33	0
34	168	case CLIENT_HELLO:
35	168	return "client_hello";
36	0
37	94	case SERVER_HELLO:
38	94	return "server_hello";
39	0
40	21	case CERTIFICATE:
41	21	return "certificate";
42	0
43	26	case CERTIFICATE_URL:
44	26	return "certificate_url";
45	0
46	12	case CERTIFICATE_STATUS:
47	12	return "certificate_status";
48	0
49	32	case SERVER_KEX:
50	32	return "server_key_exchange";
51	0
52	10	case CERTIFICATE_REQUEST:
53	10	return "certificate_request";
54	0
55	46	case SERVER_HELLO_DONE:
56	46	return "server_hello_done";
57	0
58	5	case CERTIFICATE_VERIFY:
59	5	return "certificate_verify";
60	0
61	93	case CLIENT_KEX:
62	93	return "client_key_exchange";
63	0
64	11	case NEW_SESSION_TICKET:
65	11	return "new_session_ticket";
66	0
67	117	case HANDSHAKE_CCS:
68	117	return "change_cipher_spec";
69	0
70	44	case FINISHED:
71	44	return "finished";
72	0
73	0	case HANDSHAKE_NONE:
74	0	return "invalid";
75	0	}
76	0
77	0	throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
78	0	"Unknown TLS handshake message type " + std::to_string(type));
79	0	}
80
81		namespace {
82
83		uint32_t bitmask_for_handshake_type(Handshake_Type type)
84	314k	{
85	314k	switch(type)
86	314k	{
87	386	case HELLO_VERIFY_REQUEST:
88	386	return (1 << 0);
89	0
90	478	case HELLO_REQUEST:
91	478	return (1 << 1);
92	0
93	72.9k	case CLIENT_HELLO:
94	72.9k	return (1 << 2);
95	0
96	11.6k	case SERVER_HELLO:
97	11.6k	return (1 << 3);
98	0
99	20.1k	case CERTIFICATE:
100	20.1k	return (1 << 4);
101	0
102	403	case CERTIFICATE_URL:
103	403	return (1 << 5);
104	0
105	533	case CERTIFICATE_STATUS:
106	533	return (1 << 6);
107	0
108	3.68k	case SERVER_KEX:
109	3.68k	return (1 << 7);
110	0
111	4.46k	case CERTIFICATE_REQUEST:
112	4.46k	return (1 << 8);
113	0
114	4.01k	case SERVER_HELLO_DONE:
115	4.01k	return (1 << 9);
116	0
117	382	case CERTIFICATE_VERIFY:
118	382	return (1 << 10);
119	0
120	38.9k	case CLIENT_KEX:
121	38.9k	return (1 << 11);
122	0
123	430	case NEW_SESSION_TICKET:
124	430	return (1 << 12);
125	0
126	152k	case HANDSHAKE_CCS:
127	152k	return (1 << 13);
128	0
129	2.30k	case FINISHED:
130	2.30k	return (1 << 14);
131	0
132	0	// allow explicitly disabling new handshakes
133	414	case HANDSHAKE_NONE:
134	414	return 0;
135	64	}
136	64
137	64	throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
138	64	"Unknown TLS handshake message type " + std::to_string(type));
139	64	}
140
141		std::string handshake_mask_to_string(uint32_t mask, char combiner)
142	377	{
143	377	const Handshake_Type types[] = {
144	377	HELLO_VERIFY_REQUEST,
145	377	HELLO_REQUEST,
146	377	CLIENT_HELLO,
147	377	SERVER_HELLO,
148	377	CERTIFICATE,
149	377	CERTIFICATE_URL,
150	377	CERTIFICATE_STATUS,
151	377	SERVER_KEX,
152	377	CERTIFICATE_REQUEST,
153	377	SERVER_HELLO_DONE,
154	377	CERTIFICATE_VERIFY,
155	377	CLIENT_KEX,
156	377	NEW_SESSION_TICKET,
157	377	HANDSHAKE_CCS,
158	377	FINISHED
159	377	};
160	377
161	377	std::ostringstream o;
162	377	bool empty = true;
163	377
164	377	for(auto&& t : types)
165	5.65k	{
166	5.65k	if(mask & bitmask_for_handshake_type(t))
167	520	{
168	520	if(!empty)
169	143	o << combiner;
170	520	o << handshake_type_to_string(t);
171	520	empty = false;
172	520	}
173	5.65k	}
174	377
175	377	return o.str();
176	377	}
177
178		}
179
180		/*
181		* Initialize the SSL/TLS Handshake State
182		*/
183		Handshake_State::Handshake_State(Handshake_IO* io, Callbacks& cb) :
184		m_callbacks(cb),
185		m_handshake_io(io),
186		m_version(m_handshake_io->initial_record_version())
187	47.7k	{
188	47.7k	}
189
190		void Handshake_State::note_message(const Handshake_Message& msg)
191	137k	{
192	137k	m_callbacks.tls_inspect_handshake_msg(msg);
193	137k	}
194
195		void Handshake_State::hello_verify_request(const Hello_Verify_Request& hello_verify)
196	0	{
197	0	note_message(hello_verify);
198	0
199	0	m_client_hello->update_hello_cookie(hello_verify);
200	0	hash().reset();
201	0	hash().update(handshake_io().send(*m_client_hello));
202	0	note_message(*m_client_hello);
203	0	}
204
205		void Handshake_State::client_hello(Client_Hello* client_hello)
206	44.6k	{
207	44.6k	if(client_hello == nullptr)
208	6.85k	{
209	6.85k	m_client_hello.reset();
210	6.85k	hash().reset();
211	6.85k	}
212	37.7k	else
213	37.7k	{
214	37.7k	m_client_hello.reset(client_hello);
215	37.7k	note_message(*m_client_hello);
216	37.7k	}
217	44.6k	}
218
219		void Handshake_State::server_hello(Server_Hello* server_hello)
220	29.3k	{
221	29.3k	m_server_hello.reset(server_hello);
222	29.3k	m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite());
223	29.3k	note_message(*m_server_hello);
224	29.3k	}
225
226		void Handshake_State::server_certs(Certificate* server_certs)
227	1.50k	{
228	1.50k	m_server_certs.reset(server_certs);
229	1.50k	note_message(*m_server_certs);
230	1.50k	}
231
232		void Handshake_State::server_cert_status(Certificate_Status* server_cert_status)
233	1	{
234	1	m_server_cert_status.reset(server_cert_status);
235	1	note_message(*m_server_cert_status);
236	1	}
237
238		void Handshake_State::server_kex(Server_Key_Exchange* server_kex)
239	25.5k	{
240	25.5k	m_server_kex.reset(server_kex);
241	25.5k	note_message(*m_server_kex);
242	25.5k	}
243
244		void Handshake_State::cert_req(Certificate_Req* cert_req)
245	10	{
246	10	m_cert_req.reset(cert_req);
247	10	note_message(*m_cert_req);
248	10	}
249
250		void Handshake_State::server_hello_done(Server_Hello_Done* server_hello_done)
251	26.0k	{
252	26.0k	m_server_hello_done.reset(server_hello_done);
253	26.0k	note_message(*m_server_hello_done);
254	26.0k	}
255
256		void Handshake_State::client_certs(Certificate* client_certs)
257	6	{
258	6	m_client_certs.reset(client_certs);
259	6	note_message(*m_client_certs);
260	6	}
261
262		void Handshake_State::client_kex(Client_Key_Exchange* client_kex)
263	14.7k	{
264	14.7k	m_client_kex.reset(client_kex);
265	14.7k	note_message(*m_client_kex);
266	14.7k	}
267
268		void Handshake_State::client_verify(Certificate_Verify* client_verify)
269	0	{
270	0	m_client_verify.reset(client_verify);
271	0	note_message(*m_client_verify);
272	0	}
273
274		void Handshake_State::new_session_ticket(New_Session_Ticket* new_session_ticket)
275	281	{
276	281	m_new_session_ticket.reset(new_session_ticket);
277	281	note_message(*m_new_session_ticket);
278	281	}
279
280		void Handshake_State::server_finished(Finished* server_finished)
281	505	{
282	505	m_server_finished.reset(server_finished);
283	505	note_message(*m_server_finished);
284	505	}
285
286		void Handshake_State::client_finished(Finished* client_finished)
287	1.62k	{
288	1.62k	m_client_finished.reset(client_finished);
289	1.62k	note_message(*m_client_finished);
290	1.62k	}
291
292		void Handshake_State::set_version(const Protocol_Version& version)
293	36.3k	{
294	36.3k	m_version = version;
295	36.3k	}
296
297		void Handshake_State::compute_session_keys()
298	14.7k	{
299	14.7k	m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false);
300	14.7k	}
301
302		void Handshake_State::compute_session_keys(const secure_vector<uint8_t>& resume_master_secret)
303	0	{
304	0	m_session_keys = Session_Keys(this, resume_master_secret, true);
305	0	}
306
307		void Handshake_State::confirm_transition_to(Handshake_Type handshake_msg)
308	59.8k	{
309	59.8k	const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
310	59.8k
311	59.8k	m_hand_received_mask \|= mask;
312	59.8k
313	59.8k	const bool ok = (m_hand_expecting_mask & mask) != 0; // overlap?
314	59.8k
315	59.8k	if(!ok)
316	269	{
317	269	const uint32_t seen_so_far = m_hand_received_mask & ~mask;
318	269
319	269	std::ostringstream msg;
320	269
321	269	msg << "Unexpected state transition in handshake got a " << handshake_type_to_string(handshake_msg);
322	269
323	269	if(m_hand_expecting_mask == 0)
324	27	msg << " not expecting messages";
325	242	else
326	242	msg << " expected " << handshake_mask_to_string(m_hand_expecting_mask, '\|');
327	269
328	269	if(seen_so_far != 0)
329	135	msg << " seen " << handshake_mask_to_string(seen_so_far, '+');
330	269
331	269	throw Unexpected_Message(msg.str());
332	269	}
333	59.6k
334	59.6k	/* We don't know what to expect next, so force a call to
335	59.6k	set_expected_next; if it doesn't happen, the next transition
336	59.6k	check will always fail which is what we want.
337	59.6k	*/
338	59.6k	m_hand_expecting_mask = 0;
339	59.6k	}
340
341		void Handshake_State::set_expected_next(Handshake_Type handshake_msg)
342	96.0k	{
343	96.0k	m_hand_expecting_mask \|= bitmask_for_handshake_type(handshake_msg);
344	96.0k	}
345
346		bool Handshake_State::received_handshake_msg(Handshake_Type handshake_msg) const
347	16.7k	{
348	16.7k	const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
349	16.7k
350	16.7k	return (m_hand_received_mask & mask) != 0;
351	16.7k	}
352
353		std::pair<Handshake_Type, std::vector<uint8_t>>
354		Handshake_State::get_next_handshake_msg()
355	135k	{
356	135k	const bool expecting_ccs =
357	135k	(bitmask_for_handshake_type(HANDSHAKE_CCS) & m_hand_expecting_mask) != 0;
358	135k
359	135k	return m_handshake_io->get_next_record(expecting_ccs);
360	135k	}
361
362		std::string Handshake_State::srp_identifier() const
363	414	{
364	414	#if defined(BOTAN_HAS_SRP6)
365	414	// Authenticated via the successful key exchange
366	414	if(ciphersuite().valid() && ciphersuite().kex_method() == Kex_Algo::SRP_SHA)
367	0	return client_hello()->srp_identifier();
368	414	#endif
369	414
370	414	return "";
371	414	}
372
373
374		std::vector<uint8_t> Handshake_State::session_ticket() const
375	91	{
376	91	if(new_session_ticket() && !new_session_ticket()->ticket().empty())
377	0	return new_session_ticket()->ticket();
378	91
379	91	return client_hello()->session_ticket();
380	91	}
381
382		KDF* Handshake_State::protocol_specific_prf() const
383	16.8k	{
384	16.8k	if(version().supports_ciphersuite_specific_prf())
385	16.8k	{
386	16.8k	const std::string prf_algo = ciphersuite().prf_algo();
387	16.8k
388	16.8k	if(prf_algo == "MD5" \|\| prf_algo == "SHA-1")
389	5.59k	return get_kdf("TLS-12-PRF(SHA-256)");
390	11.2k
391	11.2k	return get_kdf("TLS-12-PRF(" + prf_algo + ")");
392	11.2k	}
393	0
394	0	// Old PRF used in TLS v1.0, v1.1 and DTLS v1.0
395	0	return get_kdf("TLS-PRF");
396	0	}
397
398		std::pair<std::string, Signature_Format>
399		Handshake_State::choose_sig_format(const Private_Key& key,
400		Signature_Scheme& chosen_scheme,
401		bool for_client_auth,
402		const Policy& policy) const
403	0	{
404	0	const std::string sig_algo = key.algo_name();
405	0
406	0	if(this->version().supports_negotiable_signature_algorithms())
407	0	{
408	0	const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();
409	0
410	0	std::vector<Signature_Scheme> requested =
411	0	(for_client_auth) ? cert_req()->signature_schemes() : client_hello()->signature_schemes();
412	0
413	0	if(requested.empty())
414	0	{
415	0	// Implicit SHA-1
416	0	requested.push_back(Signature_Scheme::RSA_PKCS1_SHA1);
417	0	requested.push_back(Signature_Scheme::ECDSA_SHA1);
418	0	requested.push_back(Signature_Scheme::DSA_SHA1);
419	0	}
420	0
421	0	for(Signature_Scheme scheme : allowed)
422	0	{
423	0	if(signature_scheme_is_known(scheme) == false)
424	0	{
425	0	continue;
426	0	}
427	0
428	0	if(signature_algorithm_of_scheme(scheme) == sig_algo)
429	0	{
430	0	if(std::find(requested.begin(), requested.end(), scheme) != requested.end())
431	0	{
432	0	chosen_scheme = scheme;
433	0	break;
434	0	}
435	0	}
436	0	}
437	0
438	0	const std::string hash = hash_function_of_scheme(chosen_scheme);
439	0
440	0	if(!policy.allowed_signature_hash(hash))
441	0	{
442	0	throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
443	0	"Policy refuses to accept signing with any hash supported by peer");
444	0	}
445	0
446	0	if(sig_algo == "RSA")
447	0	{
448	0	return std::make_pair(padding_string_for_scheme(chosen_scheme), IEEE_1363);
449	0	}
450	0	else if(sig_algo == "DSA" \|\| sig_algo == "ECDSA")
451	0	{
452	0	return std::make_pair(padding_string_for_scheme(chosen_scheme), DER_SEQUENCE);
453	0	}
454	0	}
455	0	else
456	0	{
457	0	if(sig_algo == "RSA")
458	0	{
459	0	const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
460	0	return std::make_pair(padding, IEEE_1363);
461	0	}
462	0	else if(sig_algo == "DSA" \|\| sig_algo == "ECDSA")
463	0	{
464	0	const std::string padding = "EMSA1(SHA-1)";
465	0	return std::make_pair(padding, DER_SEQUENCE);
466	0	}
467	0	}
468	0
469	0	throw Invalid_Argument(sig_algo + " is invalid/unknown for TLS signatures");
470	0	}
471
472		namespace {
473
474		bool supported_algos_include(
475		const std::vector<Signature_Scheme>& schemes,
476		const std::string& key_type,
477		const std::string& hash_type)
478	227	{
479	227	for(Signature_Scheme scheme : schemes)
480	1.70k	{
481	1.70k	if(signature_scheme_is_known(scheme) &&
482	1.70k	hash_function_of_scheme(scheme) == hash_type &&
483	1.70k	signature_algorithm_of_scheme(scheme) == key_type)
484	225	{
485	225	return true;
486	225	}
487	1.70k	}
488	227
489	227	return false;
490	227	}
491
492		}
493
494		std::pair<std::string, Signature_Format>
495		Handshake_State::parse_sig_format(const Public_Key& key,
496		Signature_Scheme scheme,
497		bool for_client_auth,
498		const Policy& policy) const
499	295	{
500	295	const std::string key_type = key.algo_name();
501	295
502	295	if(!policy.allowed_signature_method(key_type))
503	0	{
504	0	throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
505	0	"Rejecting " + key_type + " signature");
506	0	}
507	295
508	295	if(this->version().supports_negotiable_signature_algorithms() == false)
509	0	{
510	0	if(scheme != Signature_Scheme::NONE)
511	0	throw Decoding_Error("Counterparty sent hash/sig IDs with old version");
512	0
513	0	/*
514	0	There is no check on the acceptability of a v1.0/v1.1 hash type,
515	0	since it's implicit with use of the protocol
516	0	*/
517	0
518	0	if(key_type == "RSA")
519	0	{
520	0	const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
521	0	return std::make_pair(padding, IEEE_1363);
522	0	}
523	0	else if(key_type == "DSA" \|\| key_type == "ECDSA")
524	0	{
525	0	const std::string padding = "EMSA1(SHA-1)";
526	0	return std::make_pair(padding, DER_SEQUENCE);
527	0	}
528	0	else
529	0	throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
530	295	}
531	295
532	295	if(scheme == Signature_Scheme::NONE)
533	1	throw Decoding_Error("Counterparty did not send hash/sig IDS");
534	294
535	294	if(key_type != signature_algorithm_of_scheme(scheme))
536	10	throw Decoding_Error("Counterparty sent inconsistent key and sig types");
537	284
538	284	if(for_client_auth && !cert_req())
539	0	{
540	0	throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
541	0	"No certificate verify set");
542	0	}
543	284
544	284	/*
545	284	Confirm the signature type we just received against the
546	284	supported_algos list that we sent; it better be there.
547	284	*/
548	284
549	284	const std::vector<Signature_Scheme> supported_algos =
550	284	for_client_auth ? cert_req()->signature_schemes() :
551	284	client_hello()->signature_schemes();
552	284
553	284	if(!signature_scheme_is_known(scheme))
554	0	throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
555	0	"Peer sent unknown signature scheme");
556	284
557	284	const std::string hash_algo = hash_function_of_scheme(scheme);
558	284
559	284	if(!supported_algos_include(supported_algos, key_type, hash_algo))
560	2	{
561	2	throw TLS_Exception(Alert::ILLEGAL_PARAMETER,
562	2	"TLS signature extension did not allow for " +
563	2	key_type + "/" + hash_algo + " signature");
564	2	}
565	282
566	282	if(key_type == "RSA")
567	33	{
568	33	return std::make_pair(padding_string_for_scheme(scheme), IEEE_1363);
569	33	}
570	249	else if(key_type == "DSA" \|\| key_type == "ECDSA")
571	192	{
572	192	return std::make_pair(padding_string_for_scheme(scheme), DER_SEQUENCE);
573	192	}
574	57
575	57	throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
576	57	}
577
578		}
579
580		}