Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Member Functions | Public Attributes | List of all members
Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore Class Referenceabstract

Helper class that implements Botan::TLS::Callbacks. More...

`#include <asio_stream.h>`

Inheritance diagram for Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore:

## Public Member Functions
| StreamCore (boost::beast::flat_buffer &receive_buffer, boost::beast::flat_buffer &send_buffer, Context &context)
void | tls_alert (Botan::TLS::Alert alert) override
virtual std::string | tls_decode_group_param (Group_Params group_param)
virtual std::pair< secure_vector< uint8_t >, std::vector< uint8_t > > | tls_dh_agree (const std::vector< uint8_t > &modulus, const std::vector< uint8_t > &generator, const std::vector< uint8_t > &peer_public_value, const Policy &policy, RandomNumberGenerator &rng)
virtual std::pair< secure_vector< uint8_t >, std::vector< uint8_t > > | tls_ecdh_agree (const std::string &curve_name, const std::vector< uint8_t > &peer_public_value, const Policy &policy, RandomNumberGenerator &rng, bool compressed)
virtual void | tls_emit_data (const uint8_t data[], size_t size)=0
void | tls_emit_data (const uint8_t data[], std::size_t size) override
virtual void | tls_examine_extensions (const Extensions &extn, Connection_Side which_side)
virtual void | tls_inspect_handshake_msg (const Handshake_Message &message)
virtual void | tls_log_debug (const char *what)
virtual void | tls_log_debug_bin (const char *descr, const uint8_t val[], size_t val_len)
virtual void | tls_log_error (const char *err)
virtual void | tls_modify_extensions (Extensions &extn, Connection_Side which_side)
virtual std::string | tls_peer_network_identity ()
virtual std::vector< uint8_t > | tls_provide_cert_status (const std::vector< X509_Certificate > &chain, const Certificate_Status_Request &csr)
virtual void | tls_record_received (uint64_t seq_no, const uint8_t data[], size_t size)=0
void | tls_record_received (uint64_t, const uint8_t data[], std::size_t size) override
virtual std::string | tls_server_choose_app_protocol (const std::vector< std::string > &client_protos)
virtual void | tls_session_activated ()
bool | tls_session_established (const Botan::TLS::Session &) override
virtual std::vector< uint8_t > | tls_sign_message (const Private_Key &key, RandomNumberGenerator &rng, const std::string &emsa, Signature_Format format, const std::vector< uint8_t > &msg)
void | tls_verify_cert_chain (const std::vector< X509_Certificate > &cert_chain, const std::vector< std::shared_ptr< const OCSP::Response >> &ocsp_responses, const std::vector< Certificate_Store * > &trusted_roots, Usage_Type usage, const std::string &hostname, const TLS::Policy &policy) override
std::chrono::milliseconds | tls_verify_cert_chain_ocsp_timeout () const override
virtual bool | tls_verify_message (const Public_Key &key, const std::string &emsa, Signature_Format format, const std::vector< uint8_t > &msg, const std::vector< uint8_t > &sig)
virtual | ~StreamCore ()=default

## Public Attributes
boost::beast::flat_buffer & | m_receive_buffer
boost::beast::flat_buffer & | m_send_buffer
Context & | m_tls_context

## Detailed Description

### template<class StreamLayer, class ChannelT = Channel>
class Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore

Helper class that implements Botan::TLS::Callbacks.

This class is provided to the stream's native_handle (Botan::TLS::Channel) and implements the callback functions triggered by the native_handle.

Parameters

  receive_buffer | reference to the buffer where decrypted data should be placed
  send_buffer | reference to the buffer where encrypted data should be placed

Definition at line 533 of file asio_stream.h.

## Constructor & Destructor Documentation

template<class StreamLayer , class ChannelT = Channel>

Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::StreamCore | ( | boost::beast::flat_buffer & | receive_buffer,
|  | boost::beast::flat_buffer & | send_buffer,
|  | Context & | context
| ) |  |
| inline

Definition at line 536 of file asio_stream.h.

537 : m_receive_buffer(receive_buffer), m_send_buffer(send_buffer), m_tls_context(context) {}
Botan::TLS::Stream::StreamCore::m_send_buffer
boost::beast::flat_buffer & m_send_buffer
Definition: asio_stream.h:590
Botan::TLS::Stream::send_buffer
boost::asio::const_buffer send_buffer() const
Definition: asio_stream.h:595
Botan::TLS::Stream::StreamCore::m_receive_buffer
boost::beast::flat_buffer & m_receive_buffer
Definition: asio_stream.h:589
Botan::TLS::Stream::StreamCore::m_tls_context
Context & m_tls_context
Definition: asio_stream.h:591
template<class StreamLayer , class ChannelT = Channel>

virtual Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::~StreamCore | ( |  | ) |
| virtual default

## Member Function Documentation

template<class StreamLayer , class ChannelT = Channel>

void Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_alert | ( | Botan::TLS::Alert | alert | ) |
| inline override virtual

Mandatory callback: alert received Called when an alert is received from the peer If fatal, the connection is closing. If not fatal, the connection may still be closing (depending on the error and the peer).

Parameters

  alert | the source of the alert

Implements Botan::TLS::Callbacks.

Definition at line 555 of file asio_stream.h.

References BOTAN_UNUSED.

556 {
557 BOTAN_UNUSED(alert);
558 }
BOTAN_UNUSED
#define BOTAN_UNUSED(...)
Definition: assert.h:142

std::string Botan::TLS::Callbacks::tls_decode_group_param | ( | Group_Params | group_param | ) |
| virtual inherited

Optional callback: decode TLS group ID

TLS uses a 16-bit field to identify ECC and DH groups. This callback handles the decoding. You only need to implement this if you are using a custom ECC or DH group (this is extremely uncommon).

Default implementation uses the standard (IETF-defined) mappings.

Definition at line 48 of file tls_callbacks.cpp.

References Botan::TLS::group_param_to_string().

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), and Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

49 {
50 return group_param_to_string(group_param);
51 }
Botan::TLS::group_param_to_string
std::string group_param_to_string(Group_Params group)
Definition: tls_algos.cpp:155

std::pair< secure_vector< uint8_t >, std::vector< uint8_t > > Botan::TLS::Callbacks::tls_dh_agree | ( | const std::vector< uint8_t > & | modulus,
|  | const std::vector< uint8_t > & | generator,
|  | const std::vector< uint8_t > & | peer_public_value,
|  | const Policy & | policy,
|  | RandomNumberGenerator & | rng
| ) |  |
| virtual inherited

Optional callback with default impl: client side DH agreement

Default implementation uses PK_Key_Agreement::derive_key(). Override to provide a different approach, e.g. using an external device.

Parameters

  modulus | the modulus p of the discrete logarithm group
  generator | the generator of the DH subgroup
  peer_public_value | the public value of the peer
  policy | the TLS policy associated with the session being established
  rng | a random number generator

Returns
  a pair consisting of the agreed raw secret and our public value

Definition at line 108 of file tls_callbacks.cpp.

References Botan::TLS::Policy::check_peer_key_acceptable(), Botan::BigInt::decode(), Botan::PK_Key_Agreement::derive_key(), Botan::TLS::Alert::ILLEGAL_PARAMETER, Botan::TLS::Alert::INSUFFICIENT_SECURITY, Botan::DH_PublicKey::public_value(), Botan::DH_PrivateKey::public_value(), Botan::CT::strip_leading_zeros(), Botan::DL_Group::verify_group(), and Y.

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange().

114 {
115 BigInt p = BigInt::decode(modulus);
116 BigInt g = BigInt::decode(generator);
117 BigInt Y = BigInt::decode(peer_public_value);
118
119 /*
120 * A basic check for key validity. As we do not know q here we
121 * cannot check that Y is in the right subgroup. However since
122 * our key is ephemeral there does not seem to be any
123 * advantage to bogus keys anyway.
124 */
125 if(Y <= 1 || Y >= p - 1)
126 throw TLS_Exception(Alert::ILLEGAL_PARAMETER,
127 "Server sent bad DH key for DHE exchange");
128
129 DL_Group group(p, g);
130
131 if(!group.verify_group(rng, false))
132 throw TLS_Exception(Alert::INSUFFICIENT_SECURITY,
133 "DH group validation failed");
134
135 DH_PublicKey peer_key(group, Y);
136
137 policy.check_peer_key_acceptable(peer_key);
138
139 DH_PrivateKey priv_key(rng, group);
140 PK_Key_Agreement ka(priv_key, rng, "Raw");
141 secure_vector<uint8_t> dh_secret = CT::strip_leading_zeros(
142 ka.derive_key(0, peer_key.public_value()).bits_of());
143
144 return std::make_pair(dh_secret, priv_key.public_value());
145 }
Y
fe Y
Definition: ge.cpp:28
Botan::CT::strip_leading_zeros
secure_vector< uint8_t > strip_leading_zeros(const uint8_t in[], size_t length)
Definition: ct_utils.cpp:65
Botan::TLS::Alert::INSUFFICIENT_SECURITY
Definition: tls_alert.h:48
Botan::BigInt::decode
static BigInt decode(const uint8_t buf[], size_t length)
Definition: bigint.h:798
Botan::TLS::Alert::ILLEGAL_PARAMETER
Definition: tls_alert.h:41

std::pair< secure_vector< uint8_t >, std::vector< uint8_t > > Botan::TLS::Callbacks::tls_ecdh_agree | ( | const std::string & | curve_name,
|  | const std::vector< uint8_t > & | peer_public_value,
|  | const Policy & | policy,
|  | RandomNumberGenerator & | rng,
|  | bool | compressed
| ) |  |
| virtual inherited

Optional callback with default impl: client side ECDH agreement

Default implementation uses PK_Key_Agreement::derive_key(). Override to provide a different approach, e.g. using an external device.

Parameters

  curve_name | the name of the elliptic curve
  peer_public_value | the public value of the peer
  policy | the TLS policy associated with the session being established
  rng | a random number generator
  compressed | the compression preference for our public value

Returns
  a pair consisting of the agreed raw secret and our public value

Definition at line 147 of file tls_callbacks.cpp.

References Botan::TLS::Policy::check_peer_key_acceptable(), Botan::PointGFp::COMPRESSED, Botan::PK_Key_Agreement::derive_key(), Botan::OID::from_string(), Botan::TLS::Alert::HANDSHAKE_FAILURE, Botan::EC_Group::OS2ECP(), Botan::Curve25519_PublicKey::public_value(), Botan::Curve25519_PrivateKey::public_value(), Botan::ECDH_PrivateKey::public_value(), and Botan::PointGFp::UNCOMPRESSED.

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange().

153 {
154 secure_vector<uint8_t> ecdh_secret;
155 std::vector<uint8_t> our_public_value;
156
157 if(curve_name == "x25519")
158 {
159 #if defined(BOTAN_HAS_CURVE_25519)
160 if(peer_public_value.size() != 32)
161 {
162 throw TLS_Exception(Alert::HANDSHAKE_FAILURE, "Invalid X25519 key size");
163 }
164
165 Curve25519_PublicKey peer_key(peer_public_value);
166 policy.check_peer_key_acceptable(peer_key);
167 Curve25519_PrivateKey priv_key(rng);
168 PK_Key_Agreement ka(priv_key, rng, "Raw");
169 ecdh_secret = ka.derive_key(0, peer_key.public_value()).bits_of();
170
171 // X25519 is always compressed but sent as "uncompressed" in TLS
172 our_public_value = priv_key.public_value();
173 #else
174 throw Internal_Error("Negotiated X25519 somehow, but it is disabled");
175 #endif
176 }
177 else
178 {
179 EC_Group group(OID::from_string(curve_name));
180 ECDH_PublicKey peer_key(group, group.OS2ECP(peer_public_value));
181 policy.check_peer_key_acceptable(peer_key);
182 ECDH_PrivateKey priv_key(rng, group);
183 PK_Key_Agreement ka(priv_key, rng, "Raw");
184 ecdh_secret = ka.derive_key(0, peer_key.public_value()).bits_of();
185 our_public_value = priv_key.public_value(compressed ? PointGFp::COMPRESSED : PointGFp::UNCOMPRESSED);
186 }
187
188 return std::make_pair(ecdh_secret, our_public_value);
189 }
Botan::PointGFp::COMPRESSED
Definition: point_gfp.h:52
Botan::PointGFp::UNCOMPRESSED
Definition: point_gfp.h:51
Botan::TLS::Alert::HANDSHAKE_FAILURE
Definition: tls_alert.h:34
Botan::OCSP::Response_Status_Code::Internal_Error
Botan::OID::from_string
static OID from_string(const std::string &str)
Definition: asn1_oid.cpp:62

virtual void Botan::TLS::Callbacks::tls_emit_data | ( | const uint8_t | data[],
|  | size_t | size
| ) |  |
| pure virtual inherited

Mandatory callback: output function The channel will call this with data which needs to be sent to the peer (eg, over a socket or some other form of IPC). The array will be overwritten when the function returns so a copy must be made if the data cannot be sent immediately.

Parameters

  data | the vector of data to send
  size | the number of bytes to send

Implemented in Botan::TLS::Compat_Callbacks.

template<class StreamLayer , class ChannelT = Channel>

void Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_emit_data | ( | const uint8_t | data[],
|  | std::size_t | size
| ) |  |
| inline override

Definition at line 541 of file asio_stream.h.

References Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_send_buffer.

542 {
543 m_send_buffer.commit(
544 boost::asio::buffer_copy(m_send_buffer.prepare(size), boost::asio::buffer(data, size))
545 );
546 }
Botan::TLS::Stream::StreamCore::m_send_buffer
boost::beast::flat_buffer & m_send_buffer
Definition: asio_stream.h:590

void Botan::TLS::Callbacks::tls_examine_extensions | ( | const Extensions & | extn,
|  | Connection_Side | which_side
| ) |  |
| virtual inherited

Optional callback: examine peer extensions.

Both client and server will call this callback with the Extensions object after receiving it from the peer. This allows examining the Extensions, for example to implement a custom extension. It also allows an application to require that a particular extension be implemented; throw an exception from this function to abort the handshake.

Default implementation does nothing.

Parameters

  extn | the extensions
  which_side | will be CLIENT if these are are the clients extensions (ie we are the server) or SERVER if these are the server extensions (we are the client).

Definition at line 44 of file tls_callbacks.cpp.

45 {
46 }

void Botan::TLS::Callbacks::tls_inspect_handshake_msg | ( | const Handshake_Message & | message | ) |
| virtual inherited

Optional callback: inspect handshake message Throw an exception to abort the handshake. Default simply ignores the message.

Parameters

  message | the handshake message

Reimplemented in Botan::TLS::Compat_Callbacks.

Definition at line 25 of file tls_callbacks.cpp.

Referenced by Botan::TLS::Handshake_State::note_message().

26 {
27 // default is no op
28 }

virtual void Botan::TLS::Callbacks::tls_log_debug | ( | const char * | what | ) |
| inline virtual inherited

Optional callback: debug logging. (not currently called)

Parameters

  what | Some hopefully informative string

Definition at line 344 of file tls_callbacks.h.

References BOTAN_UNUSED.

345 {
346 BOTAN_UNUSED(what);
347 }
BOTAN_UNUSED
#define BOTAN_UNUSED(...)
Definition: assert.h:142

virtual void Botan::TLS::Callbacks::tls_log_debug_bin | ( | const char * | descr,
|  | const uint8_t | val[],
|  | size_t | val_len
| ) |  |
| inline virtual inherited

Optional callback: debug logging taking a buffer. (not currently called)

Parameters

  descr | What this buffer is
  val | the bytes
  val_len | length of val

Definition at line 355 of file tls_callbacks.h.

References BOTAN_UNUSED.

356 {
357 BOTAN_UNUSED(descr, val, val_len);
358 }
BOTAN_UNUSED
#define BOTAN_UNUSED(...)
Definition: assert.h:142

virtual void Botan::TLS::Callbacks::tls_log_error | ( | const char * | err | ) |
| inline virtual inherited

Optional callback: error logging. (not currently called)

Parameters

  err | An error message related to this connection.

Definition at line 335 of file tls_callbacks.h.

References BOTAN_UNUSED.

336 {
337 BOTAN_UNUSED(err);
338 }
BOTAN_UNUSED
#define BOTAN_UNUSED(...)
Definition: assert.h:142

void Botan::TLS::Callbacks::tls_modify_extensions | ( | Extensions & | extn,
|  | Connection_Side | which_side
| ) |  |
| virtual inherited

Optional callback: examine/modify Extensions before sending.

Both client and server will call this callback on the Extensions object before serializing it in the client/server hellos. This allows an application to modify which extensions are sent during the handshake.

Default implementation does nothing.

Parameters

  extn | the extensions
  which_side | will be CLIENT or SERVER which is the current applications role in the exchange.

Definition at line 40 of file tls_callbacks.cpp.

Referenced by Botan::TLS::Client_Hello::Client_Hello(), and Botan::TLS::Server_Hello::Server_Hello().

41 {
42 }

std::string Botan::TLS::Callbacks::tls_peer_network_identity | ( |  | ) |
| virtual inherited

Optional callback: return peer network identity

There is no expected or specified format. The only expectation is this function will return a unique value. For example returning the peer host IP and port.

This is used to bind the DTLS cookie to a particular network identity. It is only called if the dtls-cookie-secret PSK is also defined.

Definition at line 35 of file tls_callbacks.cpp.

36 {
37 return "";
38 }

virtual std::vector<uint8_t> Botan::TLS::Callbacks::tls_provide_cert_status | ( | const std::vector< X509_Certificate > & | chain,
|  | const Certificate_Status_Request & | csr
| ) |  |
| inline virtual inherited

Called by the TLS server whenever the client included the status_request extension (see RFC 6066, a.k.a OCSP stapling) in the ClientHello.

Returns
  the encoded OCSP response to be sent to the client which indicates the revocation status of the server certificate. Return an empty vector to indicate that no response is available, and thus suppress the Certificate_Status message.

Definition at line 159 of file tls_callbacks.h.

References BOTAN_UNUSED.

161 {
162 BOTAN_UNUSED(chain);
163 BOTAN_UNUSED(csr);
164 return std::vector<uint8_t>();
165 }
BOTAN_UNUSED
#define BOTAN_UNUSED(...)
Definition: assert.h:142

virtual void Botan::TLS::Callbacks::tls_record_received | ( | uint64_t | seq_no,
|  | const uint8_t | data[],
|  | size_t | size
| ) |  |
| pure virtual inherited

Mandatory callback: process application data Called when application data record is received from the peer. Again the array is overwritten immediately after the function returns.

Parameters

  seq_no | the underlying TLS/DTLS record sequence number
  data | the vector containing the received record
  size | the length of the received record, in bytes

Implemented in Botan::TLS::Compat_Callbacks.

template<class StreamLayer , class ChannelT = Channel>

void Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_record_received | ( | uint64_t | ,
|  | const uint8_t | data[],
|  | std::size_t | size
| ) |  |
| inline override

Definition at line 548 of file asio_stream.h.

References Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_receive_buffer.

549 {
550 m_receive_buffer.commit(
551 boost::asio::buffer_copy(m_receive_buffer.prepare(size), boost::asio::const_buffer(data, size))
552 );
553 }
Botan::TLS::Stream::StreamCore::m_receive_buffer
boost::beast::flat_buffer & m_receive_buffer
Definition: asio_stream.h:589

std::string Botan::TLS::Callbacks::tls_server_choose_app_protocol | ( | const std::vector< std::string > & | client_protos | ) |
| virtual inherited

Optional callback for server: choose ALPN protocol ALPN (RFC 7301) works by the client sending a list of application protocols it is willing to negotiate. The server then selects which protocol to use, which is not necessarily even on the list that the client sent.

Parameters

  client_protos | the vector of protocols the client is willing to negotiate

Returns
  the protocol selected by the server, which need not be on the list that the client sent; if this is the empty string, the server ignores the client ALPN extension. Default return value is empty string.

Reimplemented in Botan::TLS::Compat_Callbacks.

Definition at line 30 of file tls_callbacks.cpp.

31 {
32 return "";
33 }

virtual void Botan::TLS::Callbacks::tls_session_activated | ( |  | ) |
| inline virtual inherited

Optional callback: session activated Called when a session is active and can be written to

Definition at line 97 of file tls_callbacks.h.

Referenced by Botan::TLS::Channel::activate_session().

97 {}
template<class StreamLayer , class ChannelT = Channel>

bool Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_session_established | ( | const Botan::TLS::Session & | session | ) |
| inline override virtual

Mandatory callback: session established Called when a session is established. Throw an exception to abort the connection.

Parameters

  session | the session descriptor

Returns
  return false to prevent the session from being cached, return true to cache the session in the configured session manager

Implements Botan::TLS::Callbacks.

Definition at line 565 of file asio_stream.h.

566 {
567 // TODO: it should be possible to configure this in the using application (via callback?)
568 return true;
569 }

std::vector< uint8_t > Botan::TLS::Callbacks::tls_sign_message | ( | const Private_Key & | key,
|  | RandomNumberGenerator & | rng,
|  | const std::string & | emsa,
|  | Signature_Format | format,
|  | const std::vector< uint8_t > & | msg
| ) |  |
| virtual inherited

Optional callback with default impl: sign a message

Default implementation uses PK_Signer::sign_message(). Override to provide a different approach, e.g. using an external device.

Parameters

  key | the private key of the signer
  rng | a random number generator
  emsa | the encoding method to be applied to the message
  format | the signature format
  msg | the input data for the signature

Returns
  the signature

Definition at line 84 of file tls_callbacks.cpp.

References Botan::PK_Signer::sign_message().

Referenced by Botan::TLS::Certificate_Verify::Certificate_Verify(), and Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

90 {
91 PK_Signer signer(key, rng, emsa, format);
92
93 return signer.sign_message(msg, rng);
94 }
template<class StreamLayer , class ChannelT = Channel>

void Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_verify_cert_chain | ( | const std::vector< X509_Certificate > & | cert_chain,
|  | const std::vector< std::shared_ptr< const OCSP::Response >> & | ocsp_responses,
|  | const std::vector< Certificate_Store * > & | trusted_roots,
|  | Usage_Type | usage,
|  | const std::string & | hostname,
|  | const TLS::Policy & | policy
| ) |  |
| inline override virtual

Optional callback with default impl: verify cert chain

Default implementation performs a standard PKIX validation and initiates network OCSP request for end-entity cert. Override to provide different behavior.

Check the certificate chain is valid up to a trusted root, and optionally (if hostname != "") that the hostname given is consistent with the leaf certificate.

This function should throw an exception derived from std::exception with an informative what() result if the certificate chain cannot be verified.

Parameters

  cert_chain | specifies a certificate chain leading to a trusted root CA certificate.
  ocsp_responses | the server may have provided some
  trusted_roots | the list of trusted certificates
  usage | what this cert chain is being used for Usage_Type::TLS_SERVER_AUTH for server chains, Usage_Type::TLS_CLIENT_AUTH for client chains, Usage_Type::UNSPECIFIED for other uses
  hostname | when authenticating a server, this is the hostname the client requested (eg via SNI). When authenticating a client, this is the server name the client is authenticating to. Empty in other cases or if no hostname was used.
  policy | the TLS policy associated with the session being authenticated using the certificate chain

Reimplemented from Botan::TLS::Callbacks.

Definition at line 571 of file asio_stream.h.

References Botan::TLS::Context::get_verify_callback(), Botan::TLS::Context::has_verify_callback(), Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_tls_context, and Botan::TLS::Callbacks::tls_verify_cert_chain().

578 {
579 if(m_tls_context.has_verify_callback())
580 {
581 m_tls_context.get_verify_callback()(cert_chain, ocsp_responses, trusted_roots, usage, hostname, policy);
582 }
583 else
584 {
585 Callbacks::tls_verify_cert_chain(cert_chain, ocsp_responses, trusted_roots, usage, hostname, policy);
586 }
587 }
Botan::TLS::Callbacks::tls_verify_cert_chain
virtual void tls_verify_cert_chain(const std::vector< X509_Certificate > &cert_chain, const std::vector< std::shared_ptr< const OCSP::Response >> &ocsp_responses, const std::vector< Certificate_Store * > &trusted_roots, Usage_Type usage, const std::string &hostname, const TLS::Policy &policy)
Definition: tls_callbacks.cpp:53
Botan::TLS::Context::get_verify_callback
const Verify_Callback & get_verify_callback() const
Definition: asio_context.h:94
Botan::TLS::Context::has_verify_callback
bool has_verify_callback() const
Definition: asio_context.h:89
Botan::TLS::Stream::StreamCore::m_tls_context
Context & m_tls_context
Definition: asio_stream.h:591
template<class StreamLayer , class ChannelT = Channel>

std::chrono::milliseconds Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_verify_cert_chain_ocsp_timeout | ( |  | ) | const
| inline override virtual

Called by default `tls_verify_cert_chain` to get the timeout to use for OCSP requests. Return 0 to disable online OCSP checks.

This function should not be "const" since the implementation might need to perform some side effecting operation to compute the result.

Reimplemented from Botan::TLS::Callbacks.

Definition at line 560 of file asio_stream.h.

561 {
562 return std::chrono::milliseconds(1000);
563 }

bool Botan::TLS::Callbacks::tls_verify_message | ( | const Public_Key & | key,
|  | const std::string & | emsa,
|  | Signature_Format | format,
|  | const std::vector< uint8_t > & | msg,
|  | const std::vector< uint8_t > & | sig
| ) |  |
| virtual inherited

Optional callback with default impl: verify a message signature

Default implementation uses PK_Verifier::verify_message(). Override to provide a different approach, e.g. using an external device.

Parameters

  key | the public key of the signer
  emsa | the encoding method to be applied to the message
  format | the signature format
  msg | the input data for the signature
  sig | the signature to be checked

Returns
  true if the signature is valid, false otherwise

Definition at line 96 of file tls_callbacks.cpp.

References Botan::PK_Verifier::verify_message().

Referenced by Botan::TLS::Certificate_Verify::verify(), and Botan::TLS::Server_Key_Exchange::verify().

102 {
103 PK_Verifier verifier(key, emsa, format);
104
105 return verifier.verify_message(msg, sig);
106 }

## Member Data Documentation

template<class StreamLayer , class ChannelT = Channel>

boost::beast::flat_buffer& Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_receive_buffer

Definition at line 589 of file asio_stream.h.

Referenced by Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_record_received().

template<class StreamLayer , class ChannelT = Channel>

boost::beast::flat_buffer& Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_send_buffer

Definition at line 590 of file asio_stream.h.

Referenced by Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_emit_data().

template<class StreamLayer , class ChannelT = Channel>

Context& Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::m_tls_context

Definition at line 591 of file asio_stream.h.

Referenced by Botan::TLS::Stream< StreamLayer, ChannelT >::StreamCore::tls_verify_cert_chain().

The documentation for this class was generated from the following file:

- src/lib/tls/asio/asio_stream.h