Coverage Report

Created: 2021-05-04 09:02

/src/botan/src/lib/tls/tls_channel.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* TLS Channels
3
* (C) 2011,2012,2014,2015,2016 Jack Lloyd
4
*     2016 Matthias Gierlings
5
*
6
* Botan is released under the Simplified BSD License (see license.txt)
7
*/
8
9
#include <botan/tls_channel.h>
10
#include <botan/tls_policy.h>
11
#include <botan/tls_messages.h>
12
#include <botan/kdf.h>
13
#include <botan/internal/tls_handshake_state.h>
14
#include <botan/internal/tls_record.h>
15
#include <botan/internal/tls_seq_numbers.h>
16
#include <botan/internal/stl_util.h>
17
#include <botan/internal/loadstor.h>
18
19
namespace Botan {
20
21
namespace TLS {
22
23
size_t TLS::Channel::IO_BUF_DEFAULT_SIZE = 10*1024;
24
25
Channel::Channel(Callbacks& callbacks,
26
                 Session_Manager& session_manager,
27
                 RandomNumberGenerator& rng,
28
                 const Policy& policy,
29
                 bool is_server,
30
                 bool is_datagram,
31
                 size_t reserved_io_buffer_size) :
32
   m_is_server(is_server),
33
   m_is_datagram(is_datagram),
34
   m_callbacks(callbacks),
35
   m_session_manager(session_manager),
36
   m_policy(policy),
37
   m_rng(rng),
38
   m_has_been_closed(false)
39
7.58k
   {
40
   /* epoch 0 is plaintext, thus null cipher state */
41
7.58k
   m_write_cipher_states[0] = nullptr;
42
7.58k
   m_read_cipher_states[0] = nullptr;
43
44
7.58k
   m_writebuf.reserve(reserved_io_buffer_size);
45
7.58k
   m_readbuf.reserve(reserved_io_buffer_size);
46
7.58k
   }
47
48
void Channel::reset_state()
49
5.02k
   {
50
5.02k
   m_active_state.reset();
51
5.02k
   m_pending_state.reset();
52
5.02k
   m_readbuf.clear();
53
5.02k
   m_write_cipher_states.clear();
54
5.02k
   m_read_cipher_states.clear();
55
5.02k
   }
56
57
void Channel::reset_active_association_state()
58
0
   {
59
   // This operation only makes sense for DTLS
60
0
   BOTAN_ASSERT_NOMSG(m_is_datagram);
61
0
   m_active_state.reset();
62
0
   m_read_cipher_states.clear();
63
0
   m_write_cipher_states.clear();
64
65
0
   m_write_cipher_states[0] = nullptr;
66
0
   m_read_cipher_states[0] = nullptr;
67
68
0
   if(m_sequence_numbers)
69
0
      m_sequence_numbers->reset();
70
0
   }
71
72
Channel::~Channel()
73
7.58k
   {
74
   // So unique_ptr destructors run correctly
75
7.58k
   }
76
77
Connection_Sequence_Numbers& Channel::sequence_numbers() const
78
176k
   {
79
176k
   BOTAN_ASSERT(m_sequence_numbers, "Have a sequence numbers object");
80
176k
   return *m_sequence_numbers;
81
176k
   }
82
83
std::shared_ptr<Connection_Cipher_State> Channel::read_cipher_state_epoch(uint16_t epoch) const
84
356
   {
85
356
   auto i = m_read_cipher_states.find(epoch);
86
356
   if(i == m_read_cipher_states.end())
87
87
      throw Internal_Error("TLS::Channel No read cipherstate for epoch " + std::to_string(epoch));
88
269
   return i->second;
89
269
   }
90
91
std::shared_ptr<Connection_Cipher_State> Channel::write_cipher_state_epoch(uint16_t epoch) const
92
86.0k
   {
93
86.0k
   auto i = m_write_cipher_states.find(epoch);
94
86.0k
   if(i == m_write_cipher_states.end())
95
0
      throw Internal_Error("TLS::Channel No write cipherstate for epoch " + std::to_string(epoch));
96
86.0k
   return i->second;
97
86.0k
   }
98
99
std::vector<X509_Certificate> Channel::peer_cert_chain() const
100
0
   {
101
0
   if(auto active = active_state())
102
0
      return get_peer_cert_chain(*active);
103
0
   return std::vector<X509_Certificate>();
104
0
   }
105
106
bool Channel::save_session(const Session& session)
107
553
   {
108
553
   return callbacks().tls_session_established(session);
109
553
   }
110
111
Handshake_State& Channel::create_handshake_state(Protocol_Version version)
112
47.8k
   {
113
47.8k
   if(pending_state())
114
0
      throw Internal_Error("create_handshake_state called during handshake");
115
116
47.8k
   if(auto active = active_state())
117
0
      {
118
0
      Protocol_Version active_version = active->version();
119
120
0
      if(active_version.is_datagram_protocol() != version.is_datagram_protocol())
121
0
         {
122
0
         throw TLS_Exception(Alert::PROTOCOL_VERSION,
123
0
                             "Active state using version " + active_version.to_string() +
124
0
                             " cannot change to " + version.to_string() + " in pending");
125
0
         }
126
47.8k
      }
127
128
47.8k
   if(!m_sequence_numbers)
129
7.31k
      {
130
7.31k
      if(version.is_datagram_protocol())
131
659
         m_sequence_numbers.reset(new Datagram_Sequence_Numbers);
132
6.66k
      else
133
6.66k
         m_sequence_numbers.reset(new Stream_Sequence_Numbers);
134
7.31k
      }
135
136
47.8k
   using namespace std::placeholders;
137
138
47.8k
   std::unique_ptr<Handshake_IO> io;
139
47.8k
   if(version.is_datagram_protocol())
140
659
      {
141
659
      io.reset(new Datagram_Handshake_IO(
142
659
                  std::bind(&Channel::send_record_under_epoch, this, _1, _2, _3),
143
659
                  sequence_numbers(),
144
659
                  static_cast<uint16_t>(m_policy.dtls_default_mtu()),
145
659
                  m_policy.dtls_initial_timeout(),
146
659
                  m_policy.dtls_maximum_timeout()));
147
659
      }
148
47.1k
   else
149
47.1k
      {
150
47.1k
      io.reset(new Stream_Handshake_IO(std::bind(&Channel::send_record, this, _1, _2)));
151
47.1k
      }
152
153
47.8k
   m_pending_state = new_handshake_state(std::move(io));
154
155
47.8k
   if(auto active = active_state())
156
0
      m_pending_state->set_version(active->version());
157
158
47.8k
   return *m_pending_state.get();
159
47.8k
   }
160
161
bool Channel::timeout_check()
162
0
   {
163
0
   if(m_pending_state)
164
0
      return m_pending_state->handshake_io().timeout_check();
165
166
   //FIXME: scan cipher suites and remove epochs older than 2*MSL
167
0
   return false;
168
0
   }
169
170
void Channel::renegotiate(bool force_full_renegotiation)
171
0
   {
172
0
   if(pending_state()) // currently in handshake?
173
0
      return;
174
175
0
   if(auto active = active_state())
176
0
      {
177
0
      if(force_full_renegotiation == false)
178
0
         force_full_renegotiation = !policy().allow_resumption_for_renegotiation();
179
180
0
      initiate_handshake(create_handshake_state(active->version()),
181
0
                         force_full_renegotiation);
182
0
      }
183
0
   else
184
0
      throw Invalid_State("Cannot renegotiate on inactive connection");
185
0
   }
186
187
void Channel::change_cipher_spec_reader(Connection_Side side)
188
794
   {
189
794
   auto pending = pending_state();
190
191
794
   BOTAN_ASSERT(pending && pending->server_hello(),
192
794
                "Have received server hello");
193
194
794
   if(pending->server_hello()->compression_method() != 0)
195
0
      throw Internal_Error("Negotiated unknown compression algorithm");
196
197
794
   sequence_numbers().new_read_cipher_state();
198
199
794
   const uint16_t epoch = sequence_numbers().current_read_epoch();
200
201
794
   BOTAN_ASSERT(m_read_cipher_states.count(epoch) == 0,
202
794
                "No read cipher state currently set for next epoch");
203
204
   // flip side as we are reading
205
794
   std::shared_ptr<Connection_Cipher_State> read_state(
206
794
      new Connection_Cipher_State(pending->version(),
207
794
                                  (side == CLIENT) ? SERVER : CLIENT,
208
794
                                  false,
209
794
                                  pending->ciphersuite(),
210
794
                                  pending->session_keys(),
211
794
                                  pending->server_hello()->supports_encrypt_then_mac()));
212
213
794
   m_read_cipher_states[epoch] = read_state;
214
794
   }
215
216
void Channel::change_cipher_spec_writer(Connection_Side side)
217
553
   {
218
553
   auto pending = pending_state();
219
220
553
   BOTAN_ASSERT(pending && pending->server_hello(),
221
553
                "Have received server hello");
222
223
553
   if(pending->server_hello()->compression_method() != 0)
224
0
      throw Internal_Error("Negotiated unknown compression algorithm");
225
226
553
   sequence_numbers().new_write_cipher_state();
227
228
553
   const uint16_t epoch = sequence_numbers().current_write_epoch();
229
230
553
   BOTAN_ASSERT(m_write_cipher_states.count(epoch) == 0,
231
553
                "No write cipher state currently set for next epoch");
232
233
553
   std::shared_ptr<Connection_Cipher_State> write_state(
234
553
      new Connection_Cipher_State(pending->version(),
235
553
                                  side,
236
553
                                  true,
237
553
                                  pending->ciphersuite(),
238
553
                                  pending->session_keys(),
239
553
                                  pending->server_hello()->supports_encrypt_then_mac()));
240
241
553
   m_write_cipher_states[epoch] = write_state;
242
553
   }
243
244
bool Channel::is_active() const
245
0
   {
246
0
   if(is_closed())
247
0
      return false;
248
0
   return (active_state() != nullptr);
249
0
   }
250
251
bool Channel::is_closed() const
252
7.35k
   {
253
7.35k
   return m_has_been_closed;
254
7.35k
   }
255
256
void Channel::activate_session()
257
553
   {
258
553
   std::swap(m_active_state, m_pending_state);
259
553
   m_pending_state.reset();
260
261
553
   if(!m_active_state->version().is_datagram_protocol())
262
553
      {
263
      // TLS is easy just remove all but the current state
264
553
      const uint16_t current_epoch = sequence_numbers().current_write_epoch();
265
266
553
      const auto not_current_epoch =
267
2.21k
         [current_epoch](uint16_t epoch) { return (epoch != current_epoch); };
268
269
553
      map_remove_if(not_current_epoch, m_write_cipher_states);
270
553
      map_remove_if(not_current_epoch, m_read_cipher_states);
271
553
      }
272
273
553
   callbacks().tls_session_activated();
274
553
   }
275
276
size_t Channel::received_data(const std::vector<uint8_t>& buf)
277
0
   {
278
0
   return this->received_data(buf.data(), buf.size());
279
0
   }
280
281
size_t Channel::received_data(const uint8_t input[], size_t input_size)
282
7.58k
   {
283
7.58k
   const bool allow_epoch0_restart = m_is_datagram && m_is_server && policy().allow_dtls_epoch0_restart();
284
285
7.58k
   try
286
7.58k
      {
287
159k
      while(input_size)
288
152k
         {
289
152k
         size_t consumed = 0;
290
291
356
         auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); };
292
293
152k
         const Record_Header record =
294
152k
            read_record(m_is_datagram,
295
152k
                        m_readbuf,
296
152k
                        input,
297
152k
                        input_size,
298
152k
                        consumed,
299
152k
                        m_record_buf,
300
152k
                        m_sequence_numbers.get(),
301
152k
                        get_epoch,
302
152k
                        allow_epoch0_restart);
303
304
152k
         const size_t needed = record.needed();
305
306
152k
         BOTAN_ASSERT(consumed > 0, "Got to eat something");
307
308
152k
         BOTAN_ASSERT(consumed <= input_size,
309
152k
                      "Record reader consumed sane amount");
310
311
152k
         input += consumed;
312
152k
         input_size -= consumed;
313
314
152k
         BOTAN_ASSERT(input_size == 0 || needed == 0,
315
152k
                      "Got a full record or consumed all input");
316
317
152k
         if(input_size == 0 && needed != 0)
318
883
            return needed; // need more data to complete record
319
320
         // Ignore invalid records in DTLS
321
151k
         if(m_is_datagram && record.type() == NO_RECORD)
322
208
            {
323
208
            return 0;
324
208
            }
325
326
151k
         if(m_record_buf.size() > MAX_PLAINTEXT_SIZE)
327
0
            throw TLS_Exception(Alert::RECORD_OVERFLOW,
328
0
                                "TLS plaintext record is larger than allowed maximum");
329
330
331
151k
         const bool epoch0_restart = m_is_datagram && record.epoch() == 0 && active_state();
332
151k
         BOTAN_ASSERT_IMPLICATION(epoch0_restart, allow_epoch0_restart, "Allowed state");
333
334
151k
         const bool initial_record = epoch0_restart || (!pending_state() && !active_state());
335
336
151k
         if(record.type() != ALERT)
337
101k
            {
338
101k
            if(initial_record)
339
45.8k
               {
340
               // For initial records just check for basic sanity
341
45.8k
               if(record.version().major_version() != 3 &&
342
671
                  record.version().major_version() != 0xFE)
343
6
                  {
344
6
                  throw TLS_Exception(Alert::PROTOCOL_VERSION,
345
6
                                      "Received unexpected record version in initial record");
346
6
                  }
347
55.1k
               }
348
55.1k
            else if(auto pending = pending_state())
349
55.1k
               {
350
55.1k
               if(pending->server_hello() != nullptr && record.version() != pending->version())
351
21
                  {
352
21
                  if(record.version() != pending->version())
353
21
                     {
354
21
                     throw TLS_Exception(Alert::PROTOCOL_VERSION,
355
21
                                         "Received unexpected record version");
356
21
                     }
357
0
                  }
358
0
               }
359
0
            else if(auto active = active_state())
360
0
               {
361
0
               if(record.version() != active->version())
362
0
                  {
363
0
                  throw TLS_Exception(Alert::PROTOCOL_VERSION,
364
0
                                      "Received unexpected record version");
365
0
                  }
366
151k
               }
367
101k
            }
368
369
151k
         if(record.type() == HANDSHAKE || record.type() == CHANGE_CIPHER_SPEC)
370
100k
            {
371
100k
            if(m_has_been_closed)
372
2
               throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received handshake data after connection closure");
373
100k
            process_handshake_ccs(m_record_buf, record.sequence(), record.type(), record.version(), epoch0_restart);
374
100k
            }
375
50.7k
         else if(record.type() == APPLICATION_DATA)
376
16
            {
377
16
            if(m_has_been_closed)
378
2
               throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received application data after connection closure");
379
14
            if(pending_state() != nullptr)
380
11
               throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Can't interleave application and handshake data");
381
3
            process_application_data(record.sequence(), m_record_buf);
382
3
            }
383
50.7k
         else if(record.type() == ALERT)
384
49.5k
            {
385
49.5k
            process_alert(m_record_buf);
386
49.5k
            }
387
1.20k
         else if(record.type() != NO_RECORD)
388
144
            throw Unexpected_Message("Unexpected record type " +
389
144
                                     std::to_string(record.type()) +
390
144
                                     " from counterparty");
391
151k
         }
392
393
6.30k
      return 0; // on a record boundary
394
2.07k
      }
395
2.07k
   catch(TLS_Exception& e)
396
2.07k
      {
397
2.07k
      send_fatal_alert(e.type());
398
2.07k
      throw;
399
2.07k
      }
400
163
   catch(Invalid_Authentication_Tag&)
401
163
      {
402
163
      send_fatal_alert(Alert::BAD_RECORD_MAC);
403
163
      throw;
404
163
      }
405
2.62k
   catch(Decoding_Error&)
406
2.62k
      {
407
2.62k
      send_fatal_alert(Alert::DECODE_ERROR);
408
2.62k
      throw;
409
2.62k
      }
410
161
   catch(...)
411
161
      {
412
161
      send_fatal_alert(Alert::INTERNAL_ERROR);
413
161
      throw;
414
161
      }
415
7.58k
   }
416
417
void Channel::process_handshake_ccs(const secure_vector<uint8_t>& record,
418
                                    uint64_t record_sequence,
419
                                    Record_Type record_type,
420
                                    Protocol_Version record_version,
421
                                    bool epoch0_restart)
422
100k
   {
423
100k
   if(!m_pending_state)
424
45.7k
      {
425
      // No pending handshake, possibly new:
426
45.7k
      if(record_version.is_datagram_protocol() && !epoch0_restart)
427
659
         {
428
659
         if(m_sequence_numbers)
429
0
            {
430
            /*
431
            * Might be a peer retransmit under epoch - 1 in which
432
            * case we must retransmit last flight
433
            */
434
0
            sequence_numbers().read_accept(record_sequence);
435
436
0
            const uint16_t epoch = record_sequence >> 48;
437
438
0
            if(epoch == sequence_numbers().current_read_epoch())
439
0
               {
440
0
               create_handshake_state(record_version);
441
0
               }
442
0
            else if(epoch == sequence_numbers().current_read_epoch() - 1)
443
0
               {
444
0
               BOTAN_ASSERT(m_active_state, "Have active state here");
445
0
               m_active_state->handshake_io().add_record(record.data(),
446
0
                                                         record.size(),
447
0
                                                         record_type,
448
0
                                                         record_sequence);
449
0
               }
450
0
            }
451
659
         else
452
659
            {
453
659
            create_handshake_state(record_version);
454
659
            }
455
659
         }
456
45.1k
      else
457
45.1k
         {
458
45.1k
         create_handshake_state(record_version);
459
45.1k
         }
460
45.7k
      }
461
462
   // May have been created in above conditional
463
100k
   if(m_pending_state)
464
100k
      {
465
100k
      m_pending_state->handshake_io().add_record(record.data(),
466
100k
                                                 record.size(),
467
100k
                                                 record_type,
468
100k
                                                 record_sequence);
469
470
148k
      while(auto pending = m_pending_state.get())
471
144k
         {
472
144k
         auto msg = pending->get_next_handshake_msg();
473
474
144k
         if(msg.first == HANDSHAKE_NONE) // no full handshake yet
475
96.6k
            break;
476
477
47.8k
         process_handshake_msg(active_state(), *pending,
478
47.8k
                               msg.first, msg.second, epoch0_restart);
479
480
47.8k
         if(!m_pending_state)
481
553
            break;
482
47.8k
         }
483
100k
      }
484
100k
   }
485
486
void Channel::process_application_data(uint64_t seq_no, const secure_vector<uint8_t>& record)
487
3
   {
488
3
   if(!active_state())
489
3
      throw Unexpected_Message("Application data before handshake done");
490
491
0
   callbacks().tls_record_received(seq_no, record.data(), record.size());
492
0
   }
493
494
void Channel::process_alert(const secure_vector<uint8_t>& record)
495
49.5k
    {
496
49.5k
    Alert alert_msg(record);
497
498
49.5k
    if(alert_msg.type() == Alert::NO_RENEGOTIATION)
499
41.2k
       m_pending_state.reset();
500
501
49.5k
    callbacks().tls_alert(alert_msg);
502
503
49.5k
    if(alert_msg.is_fatal())
504
3.04k
       {
505
3.04k
       if(auto active = active_state())
506
0
          m_session_manager.remove_entry(active->server_hello()->session_id());
507
3.04k
       }
508
509
49.5k
    if(alert_msg.type() == Alert::CLOSE_NOTIFY)
510
2.32k
       send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind
511
512
49.5k
    if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal())
513
3.45k
       {
514
3.45k
       m_has_been_closed = true;
515
3.45k
       }
516
49.5k
    }
517
518
void Channel::write_record(Connection_Cipher_State* cipher_state, uint16_t epoch,
519
                           uint8_t record_type, const uint8_t input[], size_t length)
520
86.0k
   {
521
86.0k
   BOTAN_ASSERT(m_pending_state || m_active_state, "Some connection state exists");
522
523
86.0k
   const Protocol_Version record_version =
524
85.6k
      (m_pending_state) ? (m_pending_state->version()) : (m_active_state->version());
525
526
86.0k
   const uint64_t next_seq = sequence_numbers().next_write_sequence(epoch);
527
528
86.0k
   if(cipher_state == nullptr)
529
85.1k
      {
530
85.1k
      TLS::write_unencrypted_record(m_writebuf, record_type, record_version, next_seq,
531
85.1k
                                    input, length);
532
85.1k
      }
533
903
   else
534
903
      {
535
903
      TLS::write_record(m_writebuf, record_type, record_version, next_seq,
536
903
                        input, length, *cipher_state, m_rng);
537
903
      }
538
539
86.0k
   callbacks().tls_emit_data(m_writebuf.data(), m_writebuf.size());
540
86.0k
   }
541
542
void Channel::send_record_array(uint16_t epoch, uint8_t type, const uint8_t input[], size_t length)
543
86.0k
   {
544
86.0k
   if(length == 0)
545
0
      return;
546
547
86.0k
   auto cipher_state = write_cipher_state_epoch(epoch);
548
549
172k
   while(length)
550
86.0k
      {
551
86.0k
      const size_t sending = std::min<size_t>(length, MAX_PLAINTEXT_SIZE);
552
86.0k
      write_record(cipher_state.get(), epoch, type, input, sending);
553
554
86.0k
      input += sending;
555
86.0k
      length -= sending;
556
86.0k
      }
557
86.0k
   }
558
559
void Channel::send_record(uint8_t record_type, const std::vector<uint8_t>& record)
560
86.1k
   {
561
86.1k
   send_record_array(sequence_numbers().current_write_epoch(),
562
86.1k
                     record_type, record.data(), record.size());
563
86.1k
   }
564
565
void Channel::send_record_under_epoch(uint16_t epoch, uint8_t record_type,
566
                                      const std::vector<uint8_t>& record)
567
0
   {
568
0
   send_record_array(epoch, record_type, record.data(), record.size());
569
0
   }
570
571
void Channel::send(const uint8_t buf[], size_t buf_size)
572
0
   {
573
0
   if(!is_active())
574
0
      throw Invalid_State("Data cannot be sent on inactive TLS connection");
575
576
0
   send_record_array(sequence_numbers().current_write_epoch(),
577
0
                     APPLICATION_DATA, buf, buf_size);
578
0
   }
579
580
void Channel::send(const std::string& string)
581
0
   {
582
0
   this->send(cast_char_ptr_to_uint8(string.data()), string.size());
583
0
   }
584
585
void Channel::send_alert(const Alert& alert)
586
7.35k
   {
587
7.35k
   if(alert.is_valid() && !is_closed())
588
5.05k
      {
589
5.05k
      try
590
5.05k
         {
591
5.05k
         send_record(ALERT, alert.serialize());
592
5.05k
         }
593
169
      catch(...) { /* swallow it */ }
594
5.05k
      }
595
596
7.35k
   if(alert.type() == Alert::NO_RENEGOTIATION)
597
0
      m_pending_state.reset();
598
599
7.35k
   if(alert.is_fatal())
600
5.02k
   {
601
5.02k
      if(auto active = active_state())
602
318
      {
603
318
         m_session_manager.remove_entry(active->server_hello()->session_id());
604
318
      }
605
5.02k
      reset_state();
606
5.02k
   }
607
608
7.35k
   if(alert.type() == Alert::CLOSE_NOTIFY || alert.is_fatal())
609
7.35k
      {
610
7.35k
      m_has_been_closed = true;
611
7.35k
      }
612
7.35k
   }
613
614
void Channel::secure_renegotiation_check(const Client_Hello* client_hello)
615
24.7k
   {
616
24.7k
   const bool secure_renegotiation = client_hello->secure_renegotiation();
617
618
24.7k
   if(auto active = active_state())
619
0
      {
620
0
      const bool active_sr = active->client_hello()->secure_renegotiation();
621
622
0
      if(active_sr != secure_renegotiation)
623
0
         throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
624
0
                             "Client changed its mind about secure renegotiation");
625
24.7k
      }
626
627
24.7k
   if(secure_renegotiation)
628
15.8k
      {
629
15.8k
      const std::vector<uint8_t>& data = client_hello->renegotiation_info();
630
631
15.8k
      if(data != secure_renegotiation_data_for_client_hello())
632
1
         throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
633
1
                             "Client sent bad values for secure renegotiation");
634
15.8k
      }
635
24.7k
   }
636
637
void Channel::secure_renegotiation_check(const Server_Hello* server_hello)
638
22.3k
   {
639
22.3k
   const bool secure_renegotiation = server_hello->secure_renegotiation();
640
641
22.3k
   if(auto active = active_state())
642
0
      {
643
0
      const bool active_sr = active->server_hello()->secure_renegotiation();
644
645
0
      if(active_sr != secure_renegotiation)
646
0
         throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
647
0
                             "Server changed its mind about secure renegotiation");
648
22.3k
      }
649
650
22.3k
   if(secure_renegotiation)
651
13.7k
      {
652
13.7k
      const std::vector<uint8_t>& data = server_hello->renegotiation_info();
653
654
13.7k
      if(data != secure_renegotiation_data_for_server_hello())
655
0
         throw TLS_Exception(Alert::HANDSHAKE_FAILURE,
656
0
                             "Server sent bad values for secure renegotiation");
657
13.7k
      }
658
22.3k
   }
659
660
std::vector<uint8_t> Channel::secure_renegotiation_data_for_client_hello() const
661
17.9k
   {
662
17.9k
   if(auto active = active_state())
663
0
      return active->client_finished()->verify_data();
664
17.9k
   return std::vector<uint8_t>();
665
17.9k
   }
666
667
std::vector<uint8_t> Channel::secure_renegotiation_data_for_server_hello() const
668
36.0k
   {
669
36.0k
   if(auto active = active_state())
670
0
      {
671
0
      std::vector<uint8_t> buf = active->client_finished()->verify_data();
672
0
      buf += active->server_finished()->verify_data();
673
0
      return buf;
674
0
      }
675
676
36.0k
   return std::vector<uint8_t>();
677
36.0k
   }
678
679
bool Channel::secure_renegotiation_supported() const
680
0
   {
681
0
   if(auto active = active_state())
682
0
      return active->server_hello()->secure_renegotiation();
683
684
0
   if(auto pending = pending_state())
685
0
      if(auto hello = pending->server_hello())
686
0
         return hello->secure_renegotiation();
687
688
0
   return false;
689
0
   }
690
691
SymmetricKey Channel::key_material_export(const std::string& label,
692
                                          const std::string& context,
693
                                          size_t length) const
694
0
   {
695
0
   if(auto active = active_state())
696
0
      {
697
0
      if(pending_state() != nullptr)
698
0
         throw Invalid_State("Channel::key_material_export cannot export during renegotiation");
699
700
0
      auto prf = active->protocol_specific_prf();
701
702
0
      const secure_vector<uint8_t>& master_secret =
703
0
         active->session_keys().master_secret();
704
705
0
      std::vector<uint8_t> salt;
706
0
      salt += active->client_hello()->random();
707
0
      salt += active->server_hello()->random();
708
709
0
      if(context != "")
710
0
         {
711
0
         size_t context_size = context.length();
712
0
         if(context_size > 0xFFFF)
713
0
            throw Invalid_Argument("key_material_export context is too long");
714
0
         salt.push_back(get_byte<0>(static_cast<uint16_t>(context_size)));
715
0
         salt.push_back(get_byte<1>(static_cast<uint16_t>(context_size)));
716
0
         salt += to_byte_vector(context);
717
0
         }
718
719
0
      return prf->derive_key(length, master_secret, salt, to_byte_vector(label));
720
0
      }
721
0
   else
722
0
      {
723
0
      throw Invalid_State("Channel::key_material_export connection not active");
724
0
      }
725
0
   }
726
727
}
728
729
}