Botan 2.19.5 Crypto and TLS for C&

msg_server_hello.cpp
Go to the documentation of this file.
1/*
2* TLS Server Hello and Server Hello Done
3* (C) 2004-2011,2015,2016,2019 Jack Lloyd
4* 2016 Matthias Gierlings
5* 2017 Harry Reimann, Rohde & Schwarz Cybersecurity
6*
7* Botan is released under the Simplified BSD License (see license.txt)
8*/
9
10#include <botan/tls_messages.h>
11#include <botan/tls_extensions.h>
12#include <botan/tls_callbacks.h>
13#include <botan/internal/tls_reader.h>
14#include <botan/internal/tls_session_key.h>
15#include <botan/internal/tls_handshake_io.h>
16#include <botan/internal/tls_handshake_hash.h>
17#include <botan/internal/stl_util.h>
18
19 namespace Botan {
20
21 namespace TLS {
22
23 namespace {
24
25 const uint64_t DOWNGRADE_TLS11 = 0x444F574E47524400;
26//const uint64_t DOWNGRADE_TLS12 = 0x444F574E47524401;
27
28std::vector<uint8_t>
29make_server_hello_random(RandomNumberGenerator& rng,
30 Protocol_Version offered_version,
31 const Policy& policy)
32 {
33 auto random = make_hello_random(rng, policy);
34
35 if((offered_version == Protocol_Version::TLS_V10 ||
36 offered_version == Protocol_Version::TLS_V11) &&
37 policy.allow_tls12())
38 {
39 store_be(DOWNGRADE_TLS11, &random[24]);
40 }
41
42 if(offered_version == Protocol_Version::DTLS_V10 && policy.allow_dtls12())
43 {
44 store_be(DOWNGRADE_TLS11, &random[24]);
45 }
46
47 return random;
48 }
49
50}
51
52// New session case
53 Server_Hello::Server_Hello(Handshake_IO& io,
54 Handshake_Hash& hash,
55 const Policy& policy,
56 Callbacks& cb,
57 RandomNumberGenerator& rng,
58 const std::vector<uint8_t>& reneg_info,
59 const Client_Hello& client_hello,
60 const Server_Hello::Settings& server_settings,
61 const std::string next_protocol) :
62 m_version(server_settings.protocol_version()),
63 m_session_id(server_settings.session_id()),
64 m_random(make_server_hello_random(rng, m_version, policy)),
65 m_ciphersuite(server_settings.ciphersuite()),
66 m_comp_method(0)
67 {
68 if(client_hello.supports_extended_master_secret())
69 m_extensions.add(new Extended_Master_Secret);
70
71 // Sending the extension back does not commit us to sending a stapled response
72 if(client_hello.supports_cert_status_message() && policy.support_cert_status_message())
73 m_extensions.add(new Certificate_Status_Request);
74
75 Ciphersuite c = Ciphersuite::by_id(m_ciphersuite);
76
77 if(c.cbc_ciphersuite() && client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac())
78 {
79 m_extensions.add(new Encrypt_then_MAC);
80 }
81
82 if(c.ecc_ciphersuite() && client_hello.extension_types().count(TLSEXT_EC_POINT_FORMATS))
83 {
84 m_extensions.add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
85 }
86
87 if(client_hello.secure_renegotiation())
88 m_extensions.add(new Renegotiation_Extension(reneg_info));
89
90 if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket())
91 m_extensions.add(new Session_Ticket());
92
93 if(!next_protocol.empty() && client_hello.supports_alpn())
94 m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
95
96 if(m_version.is_datagram_protocol())
97 {
98 const std::vector<uint16_t> server_srtp = policy.srtp_profiles();
99 const std::vector<uint16_t> client_srtp = client_hello.srtp_profiles();
100
101 if(!server_srtp.empty() && !client_srtp.empty())
102 {
103 uint16_t shared = 0;
104 // always using server preferences for now
105 for(auto s_srtp : server_srtp)
106 for(auto c_srtp : client_srtp)
107 {
108 if(shared == 0 && s_srtp == c_srtp)
109 shared = s_srtp;
110 }
111
112 if(shared)
113 m_extensions.add(new SRTP_Protection_Profiles(shared));
114 }
115 }
116
117 cb.tls_modify_extensions(m_extensions, SERVER);
118
119 hash.update(io.send(*this));
120 }
121
122// Resuming
123 Server_Hello::Server_Hello(Handshake_IO& io,
124 Handshake_Hash& hash,
125 const Policy& policy,
126 Callbacks& cb,
127 RandomNumberGenerator& rng,
128 const std::vector<uint8_t>& reneg_info,
129 const Client_Hello& client_hello,
130 Session& resumed_session,
131 bool offer_session_ticket,
132 const std::string& next_protocol) :
133 m_version(resumed_session.version()),
134 m_session_id(client_hello.session_id()),
135 m_random(make_hello_random(rng, policy)),
136 m_ciphersuite(resumed_session.ciphersuite_code()),
137 m_comp_method(0)
138 {
139 if(client_hello.supports_extended_master_secret())
140 m_extensions.add(new Extended_Master_Secret);
141
142 if(client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac())
143 {
144 Ciphersuite c = resumed_session.ciphersuite();
145 if(c.cbc_ciphersuite())
146 m_extensions.add(new Encrypt_then_MAC);
147 }
148
149 if(resumed_session.ciphersuite().ecc_ciphersuite() && client_hello.extension_types().count(TLSEXT_EC_POINT_FORMATS))
150 {
151 m_extensions.add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
152 }
153
154 if(client_hello.secure_renegotiation())
155 m_extensions.add(new Renegotiation_Extension(reneg_info));
156
157 if(client_hello.supports_session_ticket() && offer_session_ticket)
158 m_extensions.add(new Session_Ticket());
159
160 if(!next_protocol.empty() && client_hello.supports_alpn())
161 m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
162
163 cb.tls_modify_extensions(m_extensions, SERVER);
164
165 hash.update(io.send(*this));
166 }
167
168/*
169* Deserialize a Server Hello message
170*/
171 Server_Hello::Server_Hello(const std::vector<uint8_t>& buf)
172 {
173 if(buf.size() < 38)
174 throw Decoding_Error("Server_Hello: Packet corrupted");
175
176 TLS_Data_Reader reader("ServerHello", buf);
177
178 const uint8_t major_version = reader.get_byte();
179 const uint8_t minor_version = reader.get_byte();
180
181 m_version = Protocol_Version(major_version, minor_version);
182
183 m_random = reader.get_fixed<uint8_t>(32);
184
185 m_session_id = reader.get_range<uint8_t>(1, 0, 32);
186
187 m_ciphersuite = reader.get_uint16_t();
188
189 m_comp_method = reader.get_byte();
190
191 m_extensions.deserialize(reader, Connection_Side::SERVER);
192 }
193
194/*
195* Serialize a Server Hello message
196*/
197std::vector<uint8_t> Server_Hello::serialize() const
198 {
199 std::vector<uint8_t> buf;
200
201 buf.push_back(m_version.major_version());
202 buf.push_back(m_version.minor_version());
203 buf += m_random;
204
205 append_tls_length_value(buf, m_session_id, 1);
206
207 buf.push_back(get_byte(0, m_ciphersuite));
208 buf.push_back(get_byte(1, m_ciphersuite));
209
210 buf.push_back(m_comp_method);
211
212 buf += m_extensions.serialize(Connection_Side::SERVER);
213
214 return buf;
215 }
216
217 bool Server_Hello::random_signals_downgrade() const
218 {
219 const uint64_t last8 = load_be<uint64_t>(m_random.data(), 3);
220 return (last8 == DOWNGRADE_TLS11);
221 }
222
223/*
224* Create a new Server Hello Done message
225*/
226 Server_Hello_Done::Server_Hello_Done(Handshake_IO& io,
227 Handshake_Hash& hash)
228 {
229 hash.update(io.send(*this));
230 }
231
232/*
233* Deserialize a Server Hello Done message
234*/
235 Server_Hello_Done::Server_Hello_Done(const std::vector<uint8_t>& buf)
236 {
237 if(buf.size())
238 throw Decoding_Error("Server_Hello_Done: Must be empty, and is not");
239 }
240
241/*
242* Serialize a Server Hello Done message
243*/
244std::vector<uint8_t> Server_Hello_Done::serialize() const
245 {
246 return std::vector<uint8_t>();
247 }
248
249}
250
251}
Botan::Decoding_Error
Definition: exceptn.h:200
Botan::RandomNumberGenerator
Definition: rng.h:26
Botan::TLS::Application_Layer_Protocol_Notification
Definition: tls_extensions.h:165
Botan::TLS::Callbacks
Definition: tls_callbacks.h:41
Botan::TLS::Callbacks::tls_modify_extensions
virtual void tls_modify_extensions(Extensions &extn, Connection_Side which_side)
Definition: tls_callbacks.cpp:40
Botan::TLS::Certificate_Status_Request
Definition: tls_extensions.h:395
Botan::TLS::Ciphersuite
Definition: tls_ciphersuite.h:25
Botan::TLS::Ciphersuite::cbc_ciphersuite
bool cbc_ciphersuite() const
Definition: tls_ciphersuite.cpp:96
Botan::TLS::Ciphersuite::ecc_ciphersuite
bool ecc_ciphersuite() const
Definition: tls_ciphersuite.cpp:77
Botan::TLS::Ciphersuite::by_id
static Ciphersuite by_id(uint16_t suite)
Definition: tls_ciphersuite.cpp:107
Botan::TLS::Client_Hello
Definition: tls_messages.h:71
Botan::TLS::Client_Hello::supports_session_ticket
bool supports_session_ticket() const
Definition: msg_client_hello.cpp:411
Botan::TLS::Client_Hello::supports_alpn
bool supports_alpn() const
Definition: msg_client_hello.cpp:423
Botan::TLS::Client_Hello::supports_cert_status_message
bool supports_cert_status_message() const
Definition: msg_client_hello.cpp:433
Botan::TLS::Client_Hello::supports_extended_master_secret
bool supports_extended_master_secret() const
Definition: msg_client_hello.cpp:428
Botan::TLS::Client_Hello::extension_types
std::set< Handshake_Extension_Type > extension_types() const
Definition: tls_messages.h:153
Botan::TLS::Client_Hello::supports_encrypt_then_mac
bool supports_encrypt_then_mac() const
Definition: msg_client_hello.cpp:438
Botan::TLS::Client_Hello::srtp_profiles
std::vector< uint16_t > srtp_profiles() const
Definition: msg_client_hello.cpp:455
Botan::TLS::Client_Hello::secure_renegotiation
bool secure_renegotiation() const
Definition: msg_client_hello.cpp:392
Botan::TLS::Encrypt_then_MAC
Definition: tls_extensions.h:375
Botan::TLS::Extended_Master_Secret
Definition: tls_extensions.h:355
Botan::TLS::Extensions::add
void add(Extension *extn)
Definition: tls_extensions.h:508
Botan::TLS::Extensions::serialize
std::vector< uint8_t > serialize(Connection_Side whoami) const
Definition: tls_extensions.cpp:100
Botan::TLS::Extensions::deserialize
void deserialize(TLS_Data_Reader &reader, Connection_Side from)
Definition: tls_extensions.cpp:72
Botan::TLS::Handshake_Hash
Definition: tls_handshake_hash.h:22
Botan::TLS::Handshake_IO
Definition: tls_handshake_io.h:30
Botan::TLS::Handshake_IO::send
virtual std::vector< uint8_t > send(const Handshake_Message &msg)=0
Botan::TLS::Policy
Definition: tls_policy.h:29
Botan::TLS::Policy::negotiate_encrypt_then_mac
virtual bool negotiate_encrypt_then_mac() const
Definition: tls_policy.cpp:343
Botan::TLS::Policy::srtp_profiles
virtual std::vector< uint16_t > srtp_profiles() const
Definition: tls_policy.cpp:364
Botan::TLS::Policy::support_cert_status_message
virtual bool support_cert_status_message() const
Definition: tls_policy.cpp:344
Botan::TLS::Policy::use_ecc_point_compression
virtual bool use_ecc_point_compression() const
Definition: tls_policy.cpp:127
Botan::TLS::Protocol_Version
Definition: tls_version.h:22
Botan::TLS::Protocol_Version::TLS_V10
@ TLS_V10
Definition: tls_version.h:25
Botan::TLS::Protocol_Version::DTLS_V10
@ DTLS_V10
Definition: tls_version.h:29
Botan::TLS::Protocol_Version::TLS_V11
@ TLS_V11
Definition: tls_version.h:26
Botan::TLS::Protocol_Version::major_version
uint8_t major_version() const
Definition: tls_version.h:79
Botan::TLS::Protocol_Version::is_datagram_protocol
bool is_datagram_protocol() const
Definition: tls_version.cpp:33
Botan::TLS::Protocol_Version::minor_version
uint8_t minor_version() const
Definition: tls_version.h:84
Botan::TLS::Renegotiation_Extension
Definition: tls_extensions.h:136
Botan::TLS::SRTP_Protection_Profiles
Definition: tls_extensions.h:329
Botan::TLS::Server_Hello::Settings
Definition: tls_messages.h:198
Botan::TLS::Server_Hello::Settings::offer_session_ticket
bool offer_session_ticket() const
Definition: tls_messages.h:212
Botan::TLS::Server_Hello_Done::Server_Hello_Done
Server_Hello_Done(Handshake_IO &io, Handshake_Hash &hash)
Definition: msg_server_hello.cpp:226
Botan::TLS::Server_Hello::next_protocol
std::string next_protocol() const
Definition: tls_messages.h:279
Botan::TLS::Server_Hello::Server_Hello
Server_Hello(Handshake_IO &io, Handshake_Hash &hash, const Policy &policy, Callbacks &cb, RandomNumberGenerator &rng, const std::vector< uint8_t > &secure_reneg_info, const Client_Hello &client_hello, const Server_Hello::Settings &settings, const std::string next_protocol)
Definition: msg_server_hello.cpp:53
Botan::TLS::Server_Hello::random_signals_downgrade
bool random_signals_downgrade() const
Definition: msg_server_hello.cpp:217
Botan::TLS::Session_Ticket
Definition: tls_extensions.h:201
Botan::TLS::Session
Definition: tls_session.h:28
Botan::TLS::Supported_Point_Formats
Definition: tls_extensions.h:270
Botan::TLS::TLS_Data_Reader
Definition: tls_reader.h:25
Botan::TLS::TLS_Data_Reader::get_byte
uint8_t get_byte()
Definition: tls_reader.h:70
Botan::TLS::TLS_Data_Reader::get_range
std::vector< T > get_range(size_t len_bytes, size_t min_elems, size_t max_elems)
Definition: tls_reader.h:94
Botan::TLS::TLS_Data_Reader::get_fixed
std::vector< T > get_fixed(size_t size)
Definition: tls_reader.h:126
Botan::TLS::TLS_Data_Reader::get_uint16_t
uint16_t get_uint16_t()
Definition: tls_reader.h:62
Botan::TLS::append_tls_length_value
void append_tls_length_value(std::vector< uint8_t, Alloc > &buf, const T *vals, size_t vals_size, size_t tag_size)
Definition: tls_reader.h:185
Botan::TLS::make_hello_random
std::vector< uint8_t > make_hello_random(RandomNumberGenerator &rng, const Policy &policy)
Definition: msg_client_hello.cpp:33
Botan::TLS::SERVER
@ SERVER
Definition: tls_magic.h:32
Botan::TLS::TLSEXT_EC_POINT_FORMATS
@ TLSEXT_EC_POINT_FORMATS
Definition: tls_extensions.h:38
Botan
Definition: alg_id.cpp:13
Botan::store_be
void store_be(uint16_t in, uint8_t out[2])
Definition: loadstor.h:438
Botan::load_be< uint64_t >
uint64_t load_be< uint64_t >(const uint8_t in[], size_t off)
Definition: loadstor.h:217
Botan::get_byte
constexpr uint8_t get_byte(size_t byte_num, T input)
Definition: loadstor.h:41
hash
MechanismType hash
Definition: p11_mechanism.cpp:64
resumed_session
std::unique_ptr< Session > resumed_session
Definition: tls_client.cpp:55