/src/botan/build/include/botan/internal/tls_handshake_state.h
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * TLS Handshake State |
3 | | * (C) 2004-2006,2011,2012 Jack Lloyd |
4 | | * 2017 Harry Reimann, Rohde & Schwarz Cybersecurity |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #ifndef BOTAN_TLS_HANDSHAKE_STATE_H_ |
10 | | #define BOTAN_TLS_HANDSHAKE_STATE_H_ |
11 | | |
12 | | #include <botan/internal/tls_handshake_hash.h> |
13 | | #include <botan/internal/tls_handshake_io.h> |
14 | | #include <botan/internal/tls_handshake_transitions.h> |
15 | | #include <botan/internal/tls_session_key.h> |
16 | | #include <botan/tls_ciphersuite.h> |
17 | | #include <botan/tls_exceptn.h> |
18 | | #include <botan/tls_handshake_msg.h> |
19 | | #include <botan/tls_callbacks.h> |
20 | | #include <botan/pk_keys.h> |
21 | | #include <botan/pubkey.h> |
22 | | #include <functional> |
23 | | #include <optional> |
24 | | |
25 | | namespace Botan { |
26 | | |
27 | | class KDF; |
28 | | |
29 | | namespace TLS { |
30 | | |
31 | | class Callbacks; |
32 | | class Policy; |
33 | | class Signature_Scheme; |
34 | | |
35 | | class Hello_Verify_Request; |
36 | | class Client_Hello_12; |
37 | | class Server_Hello_12; |
38 | | class Certificate_12; |
39 | | class Certificate_Status; |
40 | | class Server_Key_Exchange; |
41 | | class Certificate_Request_12; |
42 | | class Server_Hello_Done; |
43 | | class Client_Key_Exchange; |
44 | | class Certificate_Verify_12; |
45 | | class New_Session_Ticket_12; |
46 | | class Finished_12; |
47 | | |
48 | | /** |
49 | | * SSL/TLS Handshake State |
50 | | * |
51 | | * This is a data holder object for all state aggregated during the handshake, |
52 | | * both on client and server side and across protocol versions. |
53 | | * It does not implement any logic and offers no guarantees regarding state |
54 | | * consistency and legal TLS state transitions. |
55 | | * |
56 | | * TODO: currently it implements some logic for TLS 1.2, which should be removed |
57 | | * TODO: investigate moving the handshake_io to the channel |
58 | | */ |
59 | | class Handshake_State |
60 | | { |
61 | | public: |
62 | | Handshake_State(std::unique_ptr<Handshake_IO> io, Callbacks& callbacks); |
63 | | virtual ~Handshake_State(); |
64 | | |
65 | | Handshake_State(const Handshake_State&) = delete; |
66 | | Handshake_State& operator=(const Handshake_State&) = delete; |
67 | | |
68 | 196k | Handshake_IO& handshake_io() { return *m_handshake_io; } |
69 | | |
70 | | /** |
71 | | * Return true iff we have received a particular message already |
72 | | * @param msg_type the message type |
73 | | */ |
74 | | bool received_handshake_msg(Handshake_Type msg_type) const; |
75 | | |
76 | | /** |
77 | | * Confirm that we were expecting this message type |
78 | | * @param msg_type the message type |
79 | | */ |
80 | | void confirm_transition_to(Handshake_Type msg_type); |
81 | | |
82 | | /** |
83 | | * Record that we are expecting a particular message type next |
84 | | * @param msg_type the message type |
85 | | */ |
86 | | void set_expected_next(Handshake_Type msg_type); |
87 | | |
88 | | std::pair<Handshake_Type, std::vector<uint8_t>> |
89 | | get_next_handshake_msg(); |
90 | | |
91 | | std::vector<uint8_t> session_ticket() const; |
92 | | |
93 | | std::pair<std::string, Signature_Format> |
94 | | parse_sig_format(const Public_Key& key, |
95 | | Signature_Scheme scheme, |
96 | | const std::vector<Signature_Scheme>& offered_schemes, |
97 | | bool for_client_auth, |
98 | | const Policy& policy) const; |
99 | | |
100 | | std::pair<std::string, Signature_Format> |
101 | | choose_sig_format(const Private_Key& key, |
102 | | Signature_Scheme& scheme, |
103 | | bool for_client_auth, |
104 | | const Policy& policy) const; |
105 | | |
106 | | std::unique_ptr<KDF> protocol_specific_prf() const; |
107 | | |
108 | 144k | Protocol_Version version() const { return m_version; } |
109 | | |
110 | | void set_version(const Protocol_Version& version); |
111 | | |
112 | | void hello_verify_request(const Hello_Verify_Request& hello_verify); |
113 | | |
114 | | // TODO: take unique_ptr instead of raw pointers for all of these, as |
115 | | // we're taking the ownership |
116 | | void client_hello(Client_Hello_12* client_hello); |
117 | | void server_hello(Server_Hello_12* server_hello); |
118 | | void server_cert_status(Certificate_Status* server_cert_status); |
119 | | void server_kex(Server_Key_Exchange* server_kex); |
120 | | void cert_req(Certificate_Request_12* cert_req); |
121 | | void server_hello_done(Server_Hello_Done* server_hello_done); |
122 | | void client_kex(Client_Key_Exchange* client_kex); |
123 | | |
124 | | void client_certs(Certificate_12* client_certs); |
125 | | void server_certs(Certificate_12* server_certs); |
126 | | |
127 | | void client_verify(Certificate_Verify_12* client_verify); |
128 | | void server_verify(Certificate_Verify_12* server_verify); |
129 | | |
130 | | void server_finished(Finished_12* server_finished); |
131 | | void client_finished(Finished_12* client_finished); |
132 | | |
133 | | void new_session_ticket(New_Session_Ticket_12* new_session_ticket); |
134 | | |
135 | | const Client_Hello_12* client_hello() const |
136 | 355k | { return m_client_hello.get(); } |
137 | | |
138 | | const Server_Hello_12* server_hello() const |
139 | 97.7k | { return m_server_hello.get(); } |
140 | | |
141 | | const Certificate_12* server_certs() const |
142 | 145 | { return m_server_certs.get(); } |
143 | | |
144 | | const Server_Key_Exchange* server_kex() const |
145 | 14.9k | { return m_server_kex.get(); } |
146 | | |
147 | | const Certificate_Request_12* cert_req() const |
148 | 0 | { return m_cert_req.get(); } |
149 | | |
150 | | const Server_Hello_Done* server_hello_done() const |
151 | 0 | { return m_server_hello_done.get(); } |
152 | | |
153 | | const Certificate_12* client_certs() const |
154 | 377 | { return m_client_certs.get(); } |
155 | | |
156 | | const Client_Key_Exchange* client_kex() const |
157 | 14.9k | { return m_client_kex.get(); } |
158 | | |
159 | | const Certificate_Verify_12* client_verify() const |
160 | 0 | { return m_client_verify.get(); } |
161 | | |
162 | | const Certificate_Verify_12* server_verify() const |
163 | 0 | { return m_server_verify.get(); } |
164 | | |
165 | | const Certificate_Status* server_cert_status() const |
166 | 0 | { return m_server_cert_status.get(); } |
167 | | |
168 | | const New_Session_Ticket_12* new_session_ticket() const |
169 | 377 | { return m_new_session_ticket.get(); } |
170 | | |
171 | | const Finished_12* server_finished() const |
172 | 377 | { return m_server_finished.get(); } |
173 | | |
174 | | const Finished_12* client_finished() const |
175 | 377 | { return m_client_finished.get(); } |
176 | | |
177 | | const Ciphersuite& ciphersuite() const; |
178 | | |
179 | 2.16k | const Session_Keys& session_keys() const { return m_session_keys; } |
180 | | |
181 | 20.2k | Callbacks& callbacks() const { return m_callbacks; } |
182 | | |
183 | | void compute_session_keys(); |
184 | | |
185 | | void compute_session_keys(const secure_vector<uint8_t>& resume_master_secret); |
186 | | |
187 | 117k | Handshake_Hash& hash() { return m_handshake_hash; } |
188 | | |
189 | 1.78k | const Handshake_Hash& hash() const { return m_handshake_hash; } |
190 | | |
191 | | void note_message(const Handshake_Message& msg); |
192 | | private: |
193 | | |
194 | | Callbacks& m_callbacks; |
195 | | |
196 | | std::unique_ptr<Handshake_IO> m_handshake_io; |
197 | | |
198 | | Handshake_Transitions m_transitions; |
199 | | Protocol_Version m_version; |
200 | | std::optional<Ciphersuite> m_ciphersuite; |
201 | | Session_Keys m_session_keys; |
202 | | Handshake_Hash m_handshake_hash; |
203 | | |
204 | | std::unique_ptr<Client_Hello_12> m_client_hello; |
205 | | std::unique_ptr<Server_Hello_12> m_server_hello; |
206 | | |
207 | | std::unique_ptr<Certificate_12> m_server_certs; |
208 | | std::unique_ptr<Certificate_Status> m_server_cert_status; |
209 | | std::unique_ptr<Server_Key_Exchange> m_server_kex; |
210 | | std::unique_ptr<Certificate_Request_12> m_cert_req; |
211 | | std::unique_ptr<Server_Hello_Done> m_server_hello_done; |
212 | | std::unique_ptr<Certificate_12> m_client_certs; |
213 | | std::unique_ptr<Client_Key_Exchange> m_client_kex; |
214 | | std::unique_ptr<Certificate_Verify_12> m_client_verify; |
215 | | std::unique_ptr<Certificate_Verify_12> m_server_verify; |
216 | | std::unique_ptr<New_Session_Ticket_12> m_new_session_ticket; |
217 | | std::unique_ptr<Finished_12> m_server_finished; |
218 | | std::unique_ptr<Finished_12> m_client_finished; |
219 | | }; |
220 | | |
221 | | } |
222 | | |
223 | | } |
224 | | |
225 | | #endif |