/*

* TLS Server

* (C) 2004-2011,2012,2016 Jack Lloyd

*     2016 Matthias Gierlings

*

* Botan is released under the Simplified BSD License (see license.txt)

*/

#include <botan/tls_server.h>

#include <botan/tls_messages.h>

#include <botan/tls_version.h>

#include <botan/ocsp.h>

#include <botan/internal/tls_handshake_state.h>

#include <botan/internal/stl_util.h>

#include <botan/internal/tls_server_impl_12.h>

#include <botan/tls_magic.h>

namespace Botan::TLS {

class Server_Handshake_State final : public Handshake_State

   {

   public:

      Server_Handshake_State(std::unique_ptr<Handshake_IO> io, Callbacks& cb)

         : Handshake_State(std::move(io), cb) {}

      Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key; }

      void set_server_rsa_kex_key(Private_Key* key)

         { m_server_rsa_kex_key = key; }

      bool allow_session_resumption() const

         { return m_allow_session_resumption; }

      void set_allow_session_resumption(bool allow_session_resumption)

         { m_allow_session_resumption = allow_session_resumption; }

      const std::vector<X509_Certificate>& resume_peer_certs() const

         { return m_resume_peer_certs; }

      void set_resume_certs(const std::vector<X509_Certificate>& certs)

         { m_resume_peer_certs = certs; }

      void mark_as_resumption() { m_is_a_resumption = true; }

      bool is_a_resumption() const { return m_is_a_resumption; }

   private:

      // Used by the server only, in case of RSA key exchange. Not owned

      Private_Key* m_server_rsa_kex_key = nullptr;

      /*

      * Used by the server to know if resumption should be allowed on

      * a server-initiated renegotiation

      */

      bool m_allow_session_resumption = true;

      bool m_is_a_resumption = false;

      std::vector<X509_Certificate> m_resume_peer_certs;

   };

namespace {

bool check_for_resume(Session& session_info,

                      Session_Manager& session_manager,

                      Credentials_Manager& credentials,

                      Callbacks& cb,

                      const Client_Hello_12* client_hello,

                      std::chrono::seconds session_ticket_lifetime)

   {

   const std::vector<uint8_t>& client_session_id = client_hello->session_id();

   const std::vector<uint8_t>& session_ticket = client_hello->session_ticket();

   if(session_ticket.empty())

      {

      if(client_session_id.empty()) // not resuming

         return false;

      // not found

      if(!session_manager.load_from_session_id(client_session_id, session_info))

         return false;

      }

   else

      {

      // If a session ticket was sent, ignore client session ID

      try

         {

         session_info = Session::decrypt(

            session_ticket,

            credentials.psk("tls-server", "session-ticket", ""));

         if(session_ticket_lifetime != std::chrono::seconds(0) &&

            cb.tls_current_timestamp() - session_info.start_time() > session_ticket_lifetime)

            return false; // ticket has expired

         }

      catch(...)

         {

         return false;

         }

      }

   // wrong version

   if(client_hello->legacy_version() != session_info.version())

      return false;

   // client didn't send original ciphersuite

   if(!value_exists(client_hello->ciphersuites(),

                    session_info.ciphersuite_code()))

      return false;

   // client sent a different SNI hostname

   if(!client_hello->sni_hostname().empty() &&

       client_hello->sni_hostname() != session_info.server_info().hostname())

      return false;

   // Checking extended_master_secret on resume (RFC 7627 section 5.3)

   if(client_hello->supports_extended_master_secret() != session_info.supports_extended_master_secret())

      {

      if(!session_info.supports_extended_master_secret())

         {

         return false; // force new handshake with extended master secret

         }

      else

         {

         /*

         Client previously negotiated session with extended master secret,

         but has now attempted to resume without the extension: abort

         */

         throw TLS_Exception(Alert::HandshakeFailure,

                             "Client resumed extended ms session without sending extension");

         }

      }

   // Checking encrypt_then_mac on resume (RFC 7366 section 3.1)

   if(!client_hello->supports_encrypt_then_mac() && session_info.supports_encrypt_then_mac())

      {

      /*

      Client previously negotiated session with Encrypt-then-MAC,

      but has now attempted to resume without the extension: abort

      */

      throw TLS_Exception(Alert::HandshakeFailure,

                             "Client resumed Encrypt-then-MAC session without sending extension");

      }

   return true;

   }

/*

* Choose which ciphersuite to use

*/

uint16_t choose_ciphersuite(

   const Policy& policy,

   Protocol_Version version,

   const std::map<std::string, std::vector<X509_Certificate>>& cert_chains,

   const Client_Hello_12& client_hello)

   {

   const bool our_choice = policy.server_uses_own_ciphersuite_preferences();

   const std::vector<uint16_t>& client_suites = client_hello.ciphersuites();

   const std::vector<uint16_t> server_suites = policy.ciphersuite_list(version);

   if(server_suites.empty())

      throw TLS_Exception(Alert::HandshakeFailure,

                          "Policy forbids us from negotiating any ciphersuite");

   const bool have_shared_ecc_curve =

      (policy.choose_key_exchange_group(client_hello.supported_ecc_curves(), {}) != Group_Params::NONE);

   /*

   Walk down one list in preference order

   */

   std::vector<uint16_t> pref_list = server_suites;

   std::vector<uint16_t> other_list = client_suites;

   if(!our_choice)

      std::swap(pref_list, other_list);

   for(auto suite_id : pref_list)

      {

      if(!value_exists(other_list, suite_id))

         continue;

      const auto suite = Ciphersuite::by_id(suite_id);

      if(!suite.has_value() || !suite->valid())

         {

         continue;

         }

      if(have_shared_ecc_curve == false && suite->ecc_ciphersuite())

         {

         continue;

         }

      // For non-anon ciphersuites

      if(suite->signature_used())

         {

         const std::string sig_algo = suite->sig_algo();

         // Do we have any certificates for this sig?

         if(cert_chains.count(sig_algo) == 0)

            {

            continue;

            }

         const std::vector<Signature_Scheme> allowed =

            policy.allowed_signature_schemes();

         std::vector<Signature_Scheme> client_sig_methods =

            client_hello.signature_schemes();

         /*

         Contrary to the wording of draft-ietf-tls-md5-sha1-deprecate we do

         not enforce that clients do not offer support SHA-1 or MD5

         signatures; we just ignore it.

         */

         bool we_support_some_hash_by_client = false;

         for(Signature_Scheme scheme : client_sig_methods)

            {

            if(!scheme.is_available())

               continue;

            if(scheme.algorithm_name() == suite->sig_algo() &&

               policy.allowed_signature_hash(scheme.hash_function_name()))

               {

               we_support_some_hash_by_client = true;

               }

            }

         if(we_support_some_hash_by_client == false)

            {

            throw TLS_Exception(Alert::HandshakeFailure,

                                "Policy does not accept any hash function supported by client");

            }

         }

      return suite_id;

      }

   throw TLS_Exception(Alert::HandshakeFailure,

                       "Can't agree on a ciphersuite with client");

   }

std::map<std::string, std::vector<X509_Certificate>>

get_server_certs(const std::string& hostname,

                 const std::vector<Signature_Scheme>& cert_sig_schemes,

                 Credentials_Manager& creds)

   {

   const char* cert_types[] = { "RSA", "ECDSA", "DSA", nullptr };

   std::map<std::string, std::vector<X509_Certificate>> cert_chains;

   for(size_t i = 0; cert_types[i]; ++i)

      {

      const std::vector<X509_Certificate> certs =

         creds.cert_chain_single_type(cert_types[i], to_algorithm_identifiers(cert_sig_schemes), "tls-server", hostname);

      if(!certs.empty())

         cert_chains[cert_types[i]] = certs;

      }

   return cert_chains;

   }

}

Server_Impl_12::Server_Impl_12(Callbacks& callbacks,

                               Session_Manager& session_manager,

                               Credentials_Manager& creds,

                               const Policy& policy,

                               RandomNumberGenerator& rng,

                               bool is_datagram,

                               size_t io_buf_sz) :

   Channel_Impl_12(callbacks, session_manager, rng, policy,

                  true, is_datagram, io_buf_sz),

   m_creds(creds)

   {

   }

Server_Impl_12::Server_Impl_12(const Channel_Impl::Downgrade_Information& downgrade_info) :

   Channel_Impl_12(downgrade_info.callbacks,

                   downgrade_info.session_manager,

                   downgrade_info.rng,

                   downgrade_info.policy,

                   true /* is_server*/,

                   false /* TLS 1.3 does not support DTLS yet */,

                   downgrade_info.io_buffer_size),

   m_creds(downgrade_info.creds)

   {

   }

std::unique_ptr<Handshake_State> Server_Impl_12::new_handshake_state(std::unique_ptr<Handshake_IO> io)

   {

   std::unique_ptr<Handshake_State> state(new Server_Handshake_State(std::move(io), callbacks()));

   state->set_expected_next(Handshake_Type::ClientHello);

   return state;

   }

std::vector<X509_Certificate>

Server_Impl_12::get_peer_cert_chain(const Handshake_State& state_base) const

   {

   const Server_Handshake_State& state = dynamic_cast<const Server_Handshake_State&>(state_base);

   if(!state.resume_peer_certs().empty())

      return state.resume_peer_certs();

   if(state.client_certs())

      return state.client_certs()->cert_chain();

   return std::vector<X509_Certificate>();

   }

/*

* Send a hello request to the client

*/

void Server_Impl_12::initiate_handshake(Handshake_State& state,

                                        bool force_full_renegotiation)

   {

   dynamic_cast<Server_Handshake_State&>(state).

       set_allow_session_resumption(!force_full_renegotiation);

   Hello_Request hello_req(state.handshake_io());

   }

namespace {

Protocol_Version select_version(const TLS::Policy& policy,

                                Protocol_Version client_offer,

                                Protocol_Version active_version,

                                const std::vector<Protocol_Version>& supported_versions)

   {

   const bool is_datagram = client_offer.is_datagram_protocol();

   const bool initial_handshake = (active_version.valid() == false);

   if(!supported_versions.empty())

      {

      if(is_datagram)

         {

         if(policy.allow_dtls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::DTLS_V12)))

            return Protocol_Version::DTLS_V12;

         throw TLS_Exception(Alert::ProtocolVersion, "No shared DTLS version");

         }

      else

         {

         if(policy.allow_tls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::TLS_V12)))

            return Protocol_Version::TLS_V12;

         throw TLS_Exception(Alert::ProtocolVersion, "No shared TLS version");

         }

      }

   if(!initial_handshake)

      {

      /*

      * If this is a renegotiation, and the client has offered a

      * later version than what it initially negotiated, negotiate

      * the old version. This matches OpenSSL's behavior. If the

      * client is offering a version earlier than what it initially

      * negotiated, reject as a probable attack.

      */

      if(active_version > client_offer)

         {

         throw TLS_Exception(Alert::ProtocolVersion,

                              "Client negotiated " +

                              active_version.to_string() +

                              " then renegotiated with " +

                              client_offer.to_string());

         }

      else

         {

         return active_version;

         }

      }

   if(is_datagram)

      {

      if(policy.allow_dtls12() && client_offer >= Protocol_Version::DTLS_V12)

         return Protocol_Version::DTLS_V12;

      }

   else

      {

      if(policy.allow_tls12() && client_offer >= Protocol_Version::TLS_V12)

         return Protocol_Version::TLS_V12;

      }

   throw TLS_Exception(Alert::ProtocolVersion,

         "Client version " + client_offer.to_string() + " is unacceptable by policy");

   }

}

/*

* Process a Client Hello Message

*/

void Server_Impl_12::process_client_hello_msg(const Handshake_State* active_state,

      Server_Handshake_State& pending_state,

      const std::vector<uint8_t>& contents,

      bool epoch0_restart)

   {

   BOTAN_ASSERT_IMPLICATION(epoch0_restart, active_state != nullptr, "Can't restart with a dead connection");

   const bool initial_handshake = epoch0_restart || !active_state;

   if(initial_handshake == false && policy().allow_client_initiated_renegotiation() == false)

      {

      if(policy().abort_connection_on_undesired_renegotiation())

         throw TLS_Exception(Alert::NoRenegotiation, "Server policy prohibits renegotiation");

      else

         send_warning_alert(Alert::NoRenegotiation);

      return;

      }

   if(!policy().allow_insecure_renegotiation() &&

      !(initial_handshake || secure_renegotiation_supported()))

      {

      send_warning_alert(Alert::NoRenegotiation);

      return;

      }

   if(pending_state.handshake_io().have_more_data())

      throw TLS_Exception(Alert::UnexpectedMessage,

                          "Have data remaining in buffer after ClientHello");

   pending_state.client_hello(new Client_Hello_12(contents));

   const Protocol_Version client_offer = pending_state.client_hello()->legacy_version();

   const bool datagram = client_offer.is_datagram_protocol();

   if(datagram)

      {

      if(client_offer.major_version() == 0xFF)

         throw TLS_Exception(Alert::ProtocolVersion, "Client offered DTLS version with major version 0xFF");

      }

   else

      {

      if(client_offer.major_version() < 3)

         throw TLS_Exception(Alert::ProtocolVersion, "Client offered TLS version with major version under 3");

      if(client_offer.major_version() == 3 && client_offer.minor_version() == 0)

         throw TLS_Exception(Alert::ProtocolVersion, "Client offered SSLv3 which is not supported");

      }

   /*

   * BoGo test suite expects that we will send the hello verify with a record

   * version matching the version that is eventually negotiated. This is wrong

   * but harmless, so go with it. Also doing the version negotiation step first

   * allows to immediately close the connection with an alert if the client has

   * offered a version that we are not going to negotiate anyway, instead of

   * making them first do the cookie exchange and then telling them no.

   *

   * There is no issue with amplification here, since the alert is just 2 bytes.

   */

   const Protocol_Version negotiated_version =

      select_version(policy(), client_offer,

                     active_state ? active_state->version() : Protocol_Version(),

                     pending_state.client_hello()->supported_versions());

   pending_state.set_version(negotiated_version);

   const auto compression_methods = pending_state.client_hello()->compression_methods();

   if(!value_exists(compression_methods, uint8_t(0)))

      throw TLS_Exception(Alert::IllegalParameter, "Client did not offer NULL compression");

   if(initial_handshake && datagram)

      {

      SymmetricKey cookie_secret;

      try

         {

         cookie_secret = m_creds.psk("tls-server", "dtls-cookie-secret", "");

         }

      catch(...) {}

      if(cookie_secret.size() > 0)

         {

         const std::string client_identity = callbacks().tls_peer_network_identity();

         Hello_Verify_Request verify(pending_state.client_hello()->cookie_input_data(), client_identity, cookie_secret);

         if(pending_state.client_hello()->cookie() != verify.cookie())

            {

            if(epoch0_restart)

               pending_state.handshake_io().send_under_epoch(verify, 0);

            else

               pending_state.handshake_io().send(verify);

            pending_state.client_hello(static_cast<Client_Hello_12*>(nullptr));

            pending_state.set_expected_next(Handshake_Type::ClientHello);

            return;

            }

         }

      else if(epoch0_restart)

         {

         throw TLS_Exception(Alert::HandshakeFailure, "Reuse of DTLS association requires DTLS cookie secret be set");

         }

      }

   if(epoch0_restart)

      {

      // If we reached here then we were able to verify the cookie

      reset_active_association_state();

      }

   secure_renegotiation_check(pending_state.client_hello());

   callbacks().tls_examine_extensions(pending_state.client_hello()->extensions(), Connection_Side::Client, Handshake_Type::ClientHello);

   Session session_info;

   const bool resuming =

      pending_state.allow_session_resumption() &&

      check_for_resume(session_info,

                       session_manager(),

                       m_creds,

                       callbacks(),

                       pending_state.client_hello(),

                       policy().session_ticket_lifetime());

   bool have_session_ticket_key = false;

   try

      {

      have_session_ticket_key =

         m_creds.psk("tls-server", "session-ticket", "").length() > 0;

      }

   catch(...) {}

   m_next_protocol = "";

   if(pending_state.client_hello()->supports_alpn())

      {

      m_next_protocol = callbacks().tls_server_choose_app_protocol(pending_state.client_hello()->next_protocols());

      }

   if(resuming)

      {

      this->session_resume(pending_state, have_session_ticket_key, session_info);

      }

   else // new session

      {

      this->session_create(pending_state, have_session_ticket_key);

      }

   }

void Server_Impl_12::process_certificate_msg(Server_Handshake_State& pending_state,

      const std::vector<uint8_t>& contents)

   {

   pending_state.client_certs(new Certificate_12(contents, policy()));

   // CERTIFICATE_REQUIRED would make more sense but BoGo expects handshake failure alert

   if(pending_state.client_certs()->empty() && policy().require_client_certificate_authentication())

      throw TLS_Exception(Alert::HandshakeFailure, "Policy requires client send a certificate, but it did not");

   pending_state.set_expected_next(Handshake_Type::ClientKeyExchange);

   }

void Server_Impl_12::process_client_key_exchange_msg(Server_Handshake_State& pending_state,

      const std::vector<uint8_t>& contents)

   {

   if(pending_state.received_handshake_msg(Handshake_Type::Certificate) && !pending_state.client_certs()->empty())

      pending_state.set_expected_next(Handshake_Type::CertificateVerify);

   else

      pending_state.set_expected_next(Handshake_Type::HandshakeCCS);

   pending_state.client_kex(new Client_Key_Exchange(contents, pending_state,

                                                    pending_state.server_rsa_kex_key(),

                                                    m_creds, policy(), rng()));

   pending_state.compute_session_keys();

   }

void Server_Impl_12::process_change_cipher_spec_msg(Server_Handshake_State& pending_state)

   {

   pending_state.set_expected_next(Handshake_Type::Finished);

   change_cipher_spec_reader(Connection_Side::Server);

   }

void Server_Impl_12::process_certificate_verify_msg(Server_Handshake_State& pending_state,

      Handshake_Type type,

      const std::vector<uint8_t>& contents)

   {

   pending_state.client_verify(new Certificate_Verify_12(contents));

   const std::vector<X509_Certificate>& client_certs =

      pending_state.client_certs()->cert_chain();

   if(client_certs.empty())

      throw TLS_Exception(Alert::DecodeError, "No client certificate sent");

   if(!client_certs[0].allowed_usage(Key_Constraints::DigitalSignature))

      throw TLS_Exception(Alert::BadCertificate, "Client certificate does not support signing");

   const bool sig_valid =

      pending_state.client_verify()->verify(client_certs[0], pending_state, policy());

   pending_state.hash().update(pending_state.handshake_io().format(contents, type));

   /*

   * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for

   * "A handshake cryptographic operation failed, including being

   * unable to correctly verify a signature, ..."

   */

   if(!sig_valid)

      throw TLS_Exception(Alert::DecryptError, "Client cert verify failed");

   try

      {

      const std::string sni_hostname = pending_state.client_hello()->sni_hostname();

      auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);

      callbacks().tls_verify_cert_chain(client_certs,

                                        {}, // ocsp

                                        trusted_CAs,

                                        Usage_Type::TLS_CLIENT_AUTH,

                                        sni_hostname,

                                        policy());

      }

   catch(std::exception& e)

      {

      throw TLS_Exception(Alert::BadCertificate, e.what());

      }

   pending_state.set_expected_next(Handshake_Type::HandshakeCCS);

   }

void Server_Impl_12::process_finished_msg(Server_Handshake_State& pending_state,

      Handshake_Type type,

      const std::vector<uint8_t>& contents)

   {

   pending_state.set_expected_next(Handshake_Type::None);

   if(pending_state.handshake_io().have_more_data())

      throw TLS_Exception(Alert::UnexpectedMessage,

                          "Have data remaining in buffer after Finished");

   pending_state.client_finished(new Finished_12(contents));

   if(!pending_state.client_finished()->verify(pending_state, Connection_Side::Client))

      throw TLS_Exception(Alert::DecryptError,

                          "Finished message didn't verify");

   if(!pending_state.server_finished())

      {

      // already sent finished if resuming, so this is a new session

      pending_state.hash().update(pending_state.handshake_io().format(contents, type));

      Session session_info(

         pending_state.server_hello()->session_id(),

         pending_state.session_keys().master_secret(),

         pending_state.server_hello()->legacy_version(),

         pending_state.server_hello()->ciphersuite(),

         Connection_Side::Server,

         pending_state.server_hello()->supports_extended_master_secret(),

         pending_state.server_hello()->supports_encrypt_then_mac(),

         get_peer_cert_chain(pending_state),

         std::vector<uint8_t>(),

         Server_Information(pending_state.client_hello()->sni_hostname()),

         pending_state.server_hello()->srtp_profile(),

         callbacks().tls_current_timestamp());

      if(save_session(session_info))

         {

         if(pending_state.server_hello()->supports_session_ticket())

            {

            try

               {

               const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");

               pending_state.new_session_ticket(

                  new New_Session_Ticket_12(pending_state.handshake_io(),

                                         pending_state.hash(),

                                         session_info.encrypt(ticket_key, rng()),

                                         policy().session_ticket_lifetime()));

               }

            catch(...) {}

            }

         else

            session_manager().save(session_info);

         }

      if(!pending_state.new_session_ticket() &&

         pending_state.server_hello()->supports_session_ticket())

         {

         pending_state.new_session_ticket(

            new New_Session_Ticket_12(pending_state.handshake_io(), pending_state.hash()));

         }

      pending_state.handshake_io().send(Change_Cipher_Spec());

      change_cipher_spec_writer(Connection_Side::Server);

      pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));

      }

   activate_session();

   }

/*

* Process a handshake message

*/

void Server_Impl_12::process_handshake_msg(const Handshake_State* active_state,

      Handshake_State& state_base,

      Handshake_Type type,

      const std::vector<uint8_t>& contents,

      bool epoch0_restart)

   {

   Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);

   state.confirm_transition_to(type);

   /*

   * The change cipher spec message isn't technically a handshake

   * message so it's not included in the hash. The finished and

   * certificate verify messages are verified based on the current

   * state of the hash *before* this message so we delay adding them

   * to the hash computation until we've processed them below.

   */

   if(type != Handshake_Type::HandshakeCCS &&

      type != Handshake_Type::Finished &&

      type != Handshake_Type::CertificateVerify)

      {

      state.hash().update(state.handshake_io().format(contents, type));

      }

   switch(type)

      {

      case Handshake_Type::ClientHello:

         return this->process_client_hello_msg(active_state, state, contents, epoch0_restart);

      case Handshake_Type::Certificate:

         return this->process_certificate_msg(state, contents);

      case Handshake_Type::ClientKeyExchange:

         return this->process_client_key_exchange_msg(state, contents);

      case Handshake_Type::CertificateVerify:

         return this->process_certificate_verify_msg(state, type, contents);

      case Handshake_Type::HandshakeCCS:

         return this->process_change_cipher_spec_msg(state);

      case Handshake_Type::Finished:

         return this->process_finished_msg(state, type, contents);

      default:

         throw Unexpected_Message("Unknown handshake message received");

      }

   }

void Server_Impl_12::session_resume(Server_Handshake_State& pending_state,

                                    bool have_session_ticket_key,

                                    Session& session_info)

   {

   // Only offer a resuming client a new ticket if they didn't send one this time,

   // ie, resumed via server-side resumption. TODO: also send one if expiring soon?

   const bool offer_new_session_ticket =

      (pending_state.client_hello()->supports_session_ticket() &&

       pending_state.client_hello()->session_ticket().empty() &&

       have_session_ticket_key);

   pending_state.server_hello(new Server_Hello_12(

                                 pending_state.handshake_io(),

                                 pending_state.hash(),

                                 policy(),

                                 callbacks(),

                                 rng(),

                                 secure_renegotiation_data_for_server_hello(),

                                 *pending_state.client_hello(),

                                 session_info,

                                 offer_new_session_ticket,

                                 m_next_protocol));

   secure_renegotiation_check(pending_state.server_hello());

   pending_state.mark_as_resumption();

   pending_state.compute_session_keys(session_info.master_secret());

   pending_state.set_resume_certs(session_info.peer_certs());

   if(!save_session(session_info))

      {

      session_manager().remove_entry(session_info.session_id());

      if(pending_state.server_hello()->supports_session_ticket()) // send an empty ticket

         {

         pending_state.new_session_ticket(

            new New_Session_Ticket_12(pending_state.handshake_io(),

                                      pending_state.hash()));

         }

      }

   if(pending_state.server_hello()->supports_session_ticket() && !pending_state.new_session_ticket())

      {

      try

         {

         const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");

         pending_state.new_session_ticket(

            new New_Session_Ticket_12(pending_state.handshake_io(),

                                      pending_state.hash(),

                                      session_info.encrypt(ticket_key, rng()),

                                      policy().session_ticket_lifetime()));

         }

      catch(...) {}

      if(!pending_state.new_session_ticket())

         {

         pending_state.new_session_ticket(

            new New_Session_Ticket_12(pending_state.handshake_io(), pending_state.hash()));

         }

      }

   pending_state.handshake_io().send(Change_Cipher_Spec());

   change_cipher_spec_writer(Connection_Side::Server);

   pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));

   pending_state.set_expected_next(Handshake_Type::HandshakeCCS);

   }

void Server_Impl_12::session_create(Server_Handshake_State& pending_state,

                                    bool have_session_ticket_key)

   {

   std::map<std::string, std::vector<X509_Certificate>> cert_chains;

   const std::string sni_hostname = pending_state.client_hello()->sni_hostname();

   // RFC 8446 1.3

   //    The "signature_algorithms_cert" extension allows a client to indicate

   //    which signature algorithms it can validate in X.509 certificates.

   //

   // RFC 8446 4.2.3

   //     TLS 1.2 implementations SHOULD also process this extension.

   const auto cert_signature_schemes = pending_state.client_hello()->certificate_signature_schemes();

   cert_chains = get_server_certs(sni_hostname, cert_signature_schemes, m_creds);

   if(!sni_hostname.empty() && cert_chains.empty())

      {

      cert_chains = get_server_certs("", cert_signature_schemes, m_creds);

      /*

      * Only send the unrecognized_name alert if we couldn't

      * find any certs for the requested name but did find at

      * least one cert to use in general. That avoids sending an

      * unrecognized_name when a server is configured for purely

      * anonymous/PSK operation.

      */

      if(!cert_chains.empty())

         send_warning_alert(Alert::UnrecognizedName);

      }

   const uint16_t ciphersuite = choose_ciphersuite(policy(), pending_state.version(),

                                                   cert_chains,

                                                   *pending_state.client_hello());

   Server_Hello_12::Settings srv_settings(

      make_hello_random(rng(), callbacks(), policy()), // new session ID

      pending_state.version(),

      ciphersuite,

      have_session_ticket_key);

   pending_state.server_hello(new Server_Hello_12(

                                 pending_state.handshake_io(),

                                 pending_state.hash(),

                                 policy(),

                                 callbacks(),

                                 rng(),

                                 secure_renegotiation_data_for_server_hello(),

                                 *pending_state.client_hello(),

                                 srv_settings,

                                 m_next_protocol));

   secure_renegotiation_check(pending_state.server_hello());

   const Ciphersuite& pending_suite = pending_state.ciphersuite();

   Private_Key* private_key = nullptr;

   if(pending_suite.signature_used() || pending_suite.kex_method() == Kex_Algo::STATIC_RSA)

      {

      const std::string algo_used =

         pending_suite.signature_used() ? pending_suite.sig_algo() : "RSA";

      BOTAN_ASSERT(!cert_chains[algo_used].empty(),

                     "Attempting to send empty certificate chain");

      pending_state.server_certs(new Certificate_12(pending_state.handshake_io(),

                                                 pending_state.hash(),

                                                 cert_chains[algo_used]));

      if(pending_state.client_hello()->supports_cert_status_message() && pending_state.is_a_resumption() == false)

         {

         auto csr = pending_state.client_hello()->extensions().get<Certificate_Status_Request>();

         // csr is non-null if client_hello()->supports_cert_status_message()

         BOTAN_ASSERT_NOMSG(csr != nullptr);

         const auto resp_bytes = callbacks().tls_provide_cert_status(cert_chains[algo_used], *csr);

         if(!resp_bytes.empty())

            {

            pending_state.server_cert_status(new Certificate_Status(

                                                pending_state.handshake_io(),

                                                pending_state.hash(),

                                                resp_bytes

                                                ));

            }

         }

      private_key = m_creds.private_key_for(

         pending_state.server_certs()->cert_chain()[0],

         "tls-server",

         sni_hostname);

      if(!private_key)

         throw Internal_Error("No private key located for associated server cert");

      }

   if(pending_suite.kex_method() == Kex_Algo::STATIC_RSA)

      {

      pending_state.set_server_rsa_kex_key(private_key);

      }

   else

      {

      pending_state.server_kex(new Server_Key_Exchange(pending_state.handshake_io(),

                                                       pending_state, policy(),

                                                       m_creds, rng(), private_key));

      }

   auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);

   std::vector<X509_DN> client_auth_CAs;

   for(auto store : trusted_CAs)

      {

      auto subjects = store->all_subjects();

      client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());

      }

   const bool request_cert =

      (client_auth_CAs.empty() == false) ||

      policy().request_client_certificate_authentication();

   if(request_cert && pending_state.ciphersuite().signature_used())

      {

      pending_state.cert_req(

         new Certificate_Request_12(pending_state.handshake_io(),

                             pending_state.hash(),

                             policy(),

                             client_auth_CAs));

      /*

      SSLv3 allowed clients to skip the Certificate message entirely

      if they wanted. In TLS v1.0 and later clients must send a

      (possibly empty) Certificate message

      */

      pending_state.set_expected_next(Handshake_Type::Certificate);

      }

   else

      {

      pending_state.set_expected_next(Handshake_Type::ClientKeyExchange);

      }

   pending_state.server_hello_done(new Server_Hello_Done(pending_state.handshake_io(), pending_state.hash()));

   }

}