#include <tls_policy.h>

Inheritance diagram for Botan::TLS::BSI_TR_02102_2:

Public Member Functions
virtual bool	abort_connection_on_undesired_renegotiation () const

virtual std::optional< std::vector< Signature_Scheme > >	acceptable_certificate_signature_schemes () const

virtual bool	acceptable_ciphersuite (const Ciphersuite &suite) const

virtual bool	acceptable_protocol_version (Protocol_Version version) const

virtual std::vector< Signature_Scheme >	acceptable_signature_schemes () const

virtual std::vector< Certificate_Type >	accepted_client_certificate_types () const

virtual std::vector< Certificate_Type >	accepted_server_certificate_types () const

virtual bool	allow_client_initiated_renegotiation () const

bool	allow_dtls12 () const override

virtual bool	allow_dtls_epoch0_restart () const

bool	allow_insecure_renegotiation () const override

virtual bool	allow_resumption_for_renegotiation () const

bool	allow_server_initiated_renegotiation () const override

virtual bool	allow_ssl_key_log_file () const

bool	allow_tls12 () const override

bool	allow_tls13 () const override

std::vector< std::string >	allowed_ciphers () const override

std::vector< std::string >	allowed_key_exchange_methods () const override

std::vector< std::string >	allowed_macs () const override

bool	allowed_signature_hash (std::string_view hash) const

std::vector< std::string >	allowed_signature_hashes () const override

bool	allowed_signature_method (std::string_view sig_method) const

std::vector< std::string >	allowed_signature_methods () const override

virtual std::vector< Signature_Scheme >	allowed_signature_schemes () const

virtual void	check_peer_key_acceptable (const Public_Key &public_key) const

virtual Group_Params	choose_key_exchange_group (const std::vector< Group_Params > &supported_by_peer, const std::vector< Group_Params > &offered_by_peer) const

virtual std::vector< uint16_t >	ciphersuite_list (Protocol_Version version) const

virtual Group_Params	default_dh_group () const

virtual size_t	dtls_default_mtu () const

virtual size_t	dtls_initial_timeout () const

virtual size_t	dtls_maximum_timeout () const

virtual bool	hash_hello_random () const

virtual bool	hide_unknown_users () const

virtual bool	include_time_in_hello_random () const

std::vector< Group_Params >	key_exchange_groups () const override

virtual std::vector< Group_Params >	key_exchange_groups_to_offer () const

virtual Protocol_Version	latest_supported_version (bool datagram) const

virtual size_t	maximum_certificate_chain_size () const

virtual size_t	maximum_session_tickets_per_client_hello () const

size_t	minimum_dh_group_size () const override

size_t	minimum_ecdh_group_size () const override

size_t	minimum_ecdsa_group_size () const override

size_t	minimum_rsa_bits () const override

size_t	minimum_signature_strength () const override

bool	negotiate_encrypt_then_mac () const override

virtual size_t	new_session_tickets_upon_handshake_success () const

virtual bool	only_resume_with_exact_version () const

virtual void	print (std::ostream &o) const

virtual std::optional< uint16_t >	record_size_limit () const

virtual bool	request_client_certificate_authentication () const

virtual bool	require_cert_revocation_info () const

virtual bool	require_client_certificate_authentication () const

virtual bool	reuse_session_tickets () const

bool	server_uses_own_ciphersuite_preferences () const override

virtual std::chrono::seconds	session_ticket_lifetime () const

virtual std::vector< uint16_t >	srtp_profiles () const

virtual bool	support_cert_status_message () const

virtual bool	tls_13_middlebox_compatibility_mode () const

std::string	to_string () const

virtual bool	use_ecc_point_compression () const

Detailed Description

BSI TR-02102-2 Policy

Definition at line 639 of file tls_policy.h.

Member Function Documentation

◆ abort_connection_on_undesired_renegotiation()

bool Botan::TLS::Policy::abort_connection_on_undesired_renegotiation ( ) const

virtualinherited

If true, a request to renegotiate will close the connection with a fatal alert. Otherwise, a warning alert is sent.

See also: allow_client_initiated_renegotiation; allow_server_initiated_renegotiation

Default: false

Note: Has no effect for TLS 1.3 connections.

Definition at line 394 of file tls_policy.cpp.

                                                               {
   return false;
}

◆ acceptable_certificate_signature_schemes()

std::optional< std::vector< Signature_Scheme > > Botan::TLS::Policy::acceptable_certificate_signature_schemes ( ) const

virtualinherited

Return a list of schemes we are willing to accept for signatures in certificates.

By default, the same restrictions as in acceptable_signature_schemes() apply.

Returns: std::nullopt if the same restrictions as defined in acceptable_signature_schemes() should apply

Definition at line 47 of file tls_policy.cpp.

                                                                                                {
   // the restrictions of ::acceptable_signature_schemes() shall apply
   return std::nullopt;
}

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().

◆ acceptable_ciphersuite()

bool Botan::TLS::Policy::acceptable_ciphersuite ( const Ciphersuite & suite ) const

virtualinherited

Allows policy to reject any ciphersuites which are undesirable for whatever reason without having to reimplement ciphersuite_list

Definition at line 305 of file tls_policy.cpp.

                                                                        {
   return value_exists(allowed_ciphers(), ciphersuite.cipher_algo()) &&
          value_exists(allowed_macs(), ciphersuite.mac_algo());
}

References Botan::TLS::Policy::allowed_ciphers(), Botan::TLS::Policy::allowed_macs(), Botan::TLS::Ciphersuite::cipher_algo(), Botan::TLS::Ciphersuite::mac_algo(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::ciphersuite_list().

◆ acceptable_protocol_version()

bool Botan::TLS::Policy::acceptable_protocol_version ( Protocol_Version version ) const

virtualinherited

Returns: true if and only if we are willing to accept this version Default accepts TLS v1.2 and later or DTLS v1.2 or later.

Definition at line 266 of file tls_policy.cpp.

                                                                       {
#if defined(BOTAN_HAS_TLS_13)
   if(version == Protocol_Version::TLS_V13 && allow_tls13()) {
      return true;
   }
#endif
 
#if defined(BOTAN_HAS_TLS_12)
   if(version == Protocol_Version::TLS_V12 && allow_tls12()) {
      return true;
   }
 
   if(version == Protocol_Version::DTLS_V12 && allow_dtls12()) {
      return true;
   }
#endif
 
   return false;
}

References Botan::TLS::Policy::allow_dtls12(), Botan::TLS::Policy::allow_tls12(), and Botan::TLS::Policy::allow_tls13().

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::highest_supported_version(), and Botan::TLS::Policy::latest_supported_version().

◆ acceptable_signature_schemes()

std::vector< Signature_Scheme > Botan::TLS::Policy::acceptable_signature_schemes ( ) const

virtualinherited

Return a list of schemes we are willing to accept

Definition at line 43 of file tls_policy.cpp.

                                                                       {
   return this->allowed_signature_schemes();
}

References Botan::TLS::Policy::allowed_signature_schemes().

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().

◆ accepted_client_certificate_types()

std::vector< Certificate_Type > Botan::TLS::Policy::accepted_client_certificate_types ( ) const

virtualinherited

Returns a list of accepted certificate types for client authentication in order of preference. See RFC 7250 and RFC 8446 4.4.2 for details. Defaults to X509 only.

Note that it is the application's responsibility to provide public keys and/or certificates according to the specification in this list via the Credentials_Manager.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 398 of file tls_policy.cpp.

                                                                            {
   return {Certificate_Type::X509};
}

References Botan::TLS::X509.

Referenced by Botan::TLS::Text_Policy::accepted_client_certificate_types(), Botan::TLS::Client_Hello_13::Client_Hello_13(), and Botan::TLS::Policy::print().

◆ accepted_server_certificate_types()

std::vector< Certificate_Type > Botan::TLS::Policy::accepted_server_certificate_types ( ) const

virtualinherited

Returns a list of accepted certificate types for server authentication in order of preference. See RFC 7250 and RFC 8446 4.4.2 for details. Defaults to X509 only.

Note that it is the application's responsibility to provide public keys and/or certificates according to the specification in this list via the Credentials_Manager.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 402 of file tls_policy.cpp.

                                                                            {
   return {Certificate_Type::X509};
}

References Botan::TLS::X509.

Referenced by Botan::TLS::Text_Policy::accepted_server_certificate_types(), Botan::TLS::Client_Hello_13::Client_Hello_13(), and Botan::TLS::Policy::print().

◆ allow_client_initiated_renegotiation()

bool Botan::TLS::Policy::allow_client_initiated_renegotiation ( ) const

virtualinherited

Consulted by server side. If true, allows clients to initiate a new handshake

If this function returns true, a server will accept a client-initiated renegotiation attempt. Otherwise it will send the client a non-fatal TLS::AlertType::NoRenegotiation alert.

Default: false

Note: Has no effect for TLS 1.3 connections.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 310 of file tls_policy.cpp.

                                                        {
   return false;
}

Referenced by Botan::TLS::Text_Policy::allow_client_initiated_renegotiation().

◆ allow_dtls12()

bool Botan::TLS::BSI_TR_02102_2::allow_dtls12 ( ) const

inlineoverridevirtual

Allow DTLS v1.2

Reimplemented from Botan::TLS::Policy.

Definition at line 695 of file tls_policy.h.

695{ return false; }

◆ allow_dtls_epoch0_restart()

bool Botan::TLS::Policy::allow_dtls_epoch0_restart ( ) const

virtualinherited

If true, then allow a DTLS client to restart a connection to the same server association as described in section 4.2.8 of the DTLS RFC

Definition at line 406 of file tls_policy.cpp.

                                             {
   return false;
}

Referenced by Botan::TLS::Channel_Impl_12::from_peer().

◆ allow_insecure_renegotiation()

bool Botan::TLS::BSI_TR_02102_2::allow_insecure_renegotiation ( ) const

inlineoverridevirtual

Allow renegotiation even if the counterparty doesn't support the secure renegotiation extension.

Default: false

Warning: Changing this to true exposes you to injected plaintext attacks. Read RFC 5746 for background.

Note: Has no effect for TLS 1.3 connections.

Reimplemented from Botan::TLS::Policy.

Definition at line 675 of file tls_policy.h.

675{ return false; }

◆ allow_resumption_for_renegotiation()

bool Botan::TLS::Policy::allow_resumption_for_renegotiation ( ) const

virtualinherited

Note: Has no effect for TLS 1.3 connections.

Definition at line 370 of file tls_policy.cpp.

                                                      {
   return true;
}

Referenced by Botan::TLS::Channel_Impl_12::renegotiate().

◆ allow_server_initiated_renegotiation()

bool Botan::TLS::BSI_TR_02102_2::allow_server_initiated_renegotiation ( ) const

inlineoverridevirtual

Consulted by client side. If true, allows servers to initiate a new handshake

If this function returns true, a client will accept a server-initiated renegotiation attempt. Otherwise it will send the server a non-fatal TLS::AlertType::NoRenegotiation alert.

Default: false

Note: Has no effect for TLS 1.3 connections.

Reimplemented from Botan::TLS::Policy.

Definition at line 677 of file tls_policy.h.

677{ return true; }

◆ allow_ssl_key_log_file()

bool Botan::TLS::Policy::allow_ssl_key_log_file ( ) const

virtualinherited

Allow ssl key log file

Note: If function returns true, then Callbacks::tls_ssl_key_log_data will be invoked containing secret information for logging purposes

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 24 of file tls_policy.cpp.

                                          {
   return false;
}

Referenced by Botan::TLS::Text_Policy::allow_ssl_key_log_file(), and Botan::TLS::Policy::print().

◆ allow_tls12()

bool Botan::TLS::BSI_TR_02102_2::allow_tls12 ( ) const

inlineoverridevirtual

Allow TLS v1.2

Reimplemented from Botan::TLS::Policy.

Definition at line 691 of file tls_policy.h.

691{ return true; }

◆ allow_tls13()

bool Botan::TLS::BSI_TR_02102_2::allow_tls13 ( ) const

inlineoverridevirtual

Allow TLS v1.3

Reimplemented from Botan::TLS::Policy.

Definition at line 693 of file tls_policy.h.

693{ return true; }

◆ allowed_ciphers()

std::vector< std::string > Botan::TLS::BSI_TR_02102_2::allowed_ciphers ( ) const

inlineoverridevirtual

Returns a list of ciphers we are willing to negotiate, in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 641 of file tls_policy.h.

                                                            {
         return std::vector<std::string>(
            {"AES-256/GCM", "AES-128/GCM", "AES-256/CCM", "AES-128/CCM", "AES-256", "AES-128"});
      }

◆ allowed_key_exchange_methods()

std::vector< std::string > Botan::TLS::BSI_TR_02102_2::allowed_key_exchange_methods ( ) const

inlineoverridevirtual

Returns a list of key exchange algorithms we are willing to use, in order of preference. Allowed values: DH, empty string (representing RSA using server certificate key)

Reimplemented from Botan::TLS::Policy.

Definition at line 654 of file tls_policy.h.

                                                                         {
         return std::vector<std::string>({"ECDH", "DH", "ECDHE_PSK"});
      }

◆ allowed_macs()

std::vector< std::string > Botan::TLS::BSI_TR_02102_2::allowed_macs ( ) const

inlineoverridevirtual

Returns a list of MAC algorithms we are willing to use.

Reimplemented from Botan::TLS::Policy.

Definition at line 650 of file tls_policy.h.

                                                         {
         return std::vector<std::string>({"AEAD", "SHA-384", "SHA-256"});
      }

◆ allowed_signature_hash()

bool Botan::TLS::Policy::allowed_signature_hash ( std::string_view hash ) const

inherited

Definition at line 115 of file tls_policy.cpp.

                                                                 {
   return value_exists(allowed_signature_hashes(), sig_hash);
}

References Botan::TLS::Policy::allowed_signature_hashes(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::allowed_signature_schemes(), and Botan::TLS::Handshake_State::choose_sig_format().

◆ allowed_signature_hashes()

std::vector< std::string > Botan::TLS::BSI_TR_02102_2::allowed_signature_hashes ( ) const

inlineoverridevirtual

Returns a list of hash algorithms we are willing to use for signatures, in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 646 of file tls_policy.h.

                                                                     {
         return std::vector<std::string>({"SHA-512", "SHA-384", "SHA-256"});
      }

◆ allowed_signature_method()

bool Botan::TLS::Policy::allowed_signature_method ( std::string_view sig_method ) const

inherited

Definition at line 111 of file tls_policy.cpp.

                                                                     {
   return value_exists(allowed_signature_methods(), sig_method);
}

References Botan::TLS::Policy::allowed_signature_methods(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::allowed_signature_schemes(), Botan::TLS::Certificate_13::Certificate_13(), and Botan::TLS::Handshake_State::parse_sig_format().

◆ allowed_signature_methods()

std::vector< std::string > Botan::TLS::BSI_TR_02102_2::allowed_signature_methods ( ) const

inlineoverridevirtual

Returns a list of signature algorithms we are willing to use, in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 658 of file tls_policy.h.

                                                                      {
         return std::vector<std::string>({"ECDSA", "RSA", "DSA"});
      }

◆ allowed_signature_schemes()

std::vector< Signature_Scheme > Botan::TLS::Policy::allowed_signature_schemes ( ) const

virtualinherited

Definition at line 28 of file tls_policy.cpp.

                                                                    {
   std::vector<Signature_Scheme> schemes;
 
   for(Signature_Scheme scheme : Signature_Scheme::all_available_schemes()) {
      const bool sig_allowed = allowed_signature_method(scheme.algorithm_name());
      const bool hash_allowed = allowed_signature_hash(scheme.hash_function_name());
 
      if(sig_allowed && hash_allowed) {
         schemes.push_back(scheme);
      }
   }
 
   return schemes;
}

References Botan::TLS::Signature_Scheme::all_available_schemes(), Botan::TLS::Policy::allowed_signature_hash(), and Botan::TLS::Policy::allowed_signature_method().

Referenced by Botan::TLS::Policy::acceptable_signature_schemes(), Botan::TLS::Certificate_Verify_13::Certificate_Verify_13(), and Botan::TLS::Handshake_State::choose_sig_format().

◆ check_peer_key_acceptable()

void Botan::TLS::Policy::check_peer_key_acceptable ( const Public_Key & public_key ) const

virtualinherited

Allows the policy to examine peer public keys. Throw an exception if the key should be rejected. Default implementation checks against policy values minimum_dh_group_size(), minimum_rsa_bits(), minimum_ecdsa_group_size(), and minimum_ecdh_group_size().

Override if you'd like to perform some other kind of test on (or logging of) the peer's keys.

Definition at line 224 of file tls_policy.cpp.

                                                                         {
   const std::string algo_name = public_key.algo_name();
 
   const size_t keylength = public_key.key_length();
   size_t expected_keylength = 0;
 
   if(algo_name == "RSA") {
      expected_keylength = minimum_rsa_bits();
   } else if(algo_name == "DH") {
      expected_keylength = minimum_dh_group_size();
   } else if(algo_name == "ECDH" || algo_name == "X25519" || algo_name == "X448") {
      expected_keylength = minimum_ecdh_group_size();
   } else if(algo_name == "ECDSA") {
      expected_keylength = minimum_ecdsa_group_size();
   }
   // else some other algo, so leave expected_keylength as zero and the check is a no-op
 
   if(keylength < expected_keylength) {
      throw TLS_Exception(Alert::InsufficientSecurity,
                          "Peer sent " + std::to_string(keylength) + " bit " + algo_name +
                             " key"
                             ", policy requires at least " +
                             std::to_string(expected_keylength));
   }
}

References Botan::Asymmetric_Key::algo_name(), Botan::Public_Key::key_length(), Botan::TLS::Policy::minimum_dh_group_size(), Botan::TLS::Policy::minimum_ecdh_group_size(), Botan::TLS::Policy::minimum_ecdsa_group_size(), and Botan::TLS::Policy::minimum_rsa_bits().

Referenced by Botan::TLS::Certificate_13::Certificate_13(), Botan::TLS::Callbacks::tls_ephemeral_key_agreement(), Botan::TLS::Callbacks::tls_kem_encapsulate(), Botan::TLS::Certificate_Verify_12::verify(), and Botan::TLS::Server_Key_Exchange::verify().

◆ choose_key_exchange_group()

Group_Params Botan::TLS::Policy::choose_key_exchange_group	(	const std::vector< Group_Params > &	supported_by_peer,
		const std::vector< Group_Params > &	offered_by_peer ) const

virtualinherited

Select a key exchange group to use, from the list of groups sent by the peer. In TLS 1.3 handshakes the peer might have provided cryptographic material for a subset of its available groups. Choosing a group for which no share was provided will result in an additional round trip. If none are acceptable, return Group_Params::NONE.

By default this will try to optimize for less round trips even if this results in the usage of a less preferred group.

Definition at line 123 of file tls_policy.cpp.

                                                                                                     {
   if(supported_by_peer.empty()) {
      return Group_Params::NONE;
   }
 
   const std::vector<Group_Params> our_groups = key_exchange_groups();
 
   // Prefer groups that were offered by the peer for the sake of saving
   // an additional round trip. For TLS 1.2, this won't be used.
   for(auto g : offered_by_peer) {
      if(value_exists(our_groups, g)) {
         return g;
      }
   }
 
   // If no pre-offered groups fit our supported set, we prioritize our
   // own preference.
   for(auto g : our_groups) {
      if(value_exists(supported_by_peer, g)) {
         return g;
      }
   }
 
   return Group_Params::NONE;
}

References Botan::TLS::Policy::key_exchange_groups(), and Botan::value_exists().

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::TLS::Server_Hello_13::create(), and Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

◆ ciphersuite_list()

std::vector< uint16_t > Botan::TLS::Policy::ciphersuite_list ( Protocol_Version version ) const

virtualinherited

Return allowed ciphersuites, in order of preference for the provided protocol version.

Parameters

version the exact protocol version to select supported and allowed ciphersuites for

Definition at line 505 of file tls_policy.cpp.

                                                                           {
   const std::vector<std::string> ciphers = allowed_ciphers();
   const std::vector<std::string> macs = allowed_macs();
   const std::vector<std::string> kex = allowed_key_exchange_methods();
   const std::vector<std::string> sigs = allowed_signature_methods();
 
   std::vector<Ciphersuite> ciphersuites;
 
   for(auto&& suite : Ciphersuite::all_known_ciphersuites()) {
      // Can we use it?
      if(!suite.valid()) {
         continue;
      }
 
      // Can we use it in this version?
      if(!suite.usable_in_version(version)) {
         continue;
      }
 
      // Is it acceptable to the policy?
      if(!this->acceptable_ciphersuite(suite)) {
         continue;
      }
 
      if(!value_exists(ciphers, suite.cipher_algo())) {
         continue;  // unsupported cipher
      }
 
      // these checks are irrelevant for TLS 1.3
      // TODO: consider making a method for this logic
      if(version.is_pre_tls_13()) {
         if(!value_exists(kex, suite.kex_algo())) {
            continue;  // unsupported key exchange
         }
 
         if(!value_exists(macs, suite.mac_algo())) {
            continue;  // unsupported MAC algo
         }
 
         if(!value_exists(sigs, suite.sig_algo())) {
            // allow if it's an empty sig algo and we want to use PSK
            if(suite.auth_method() != Auth_Method::IMPLICIT || !suite.psk_ciphersuite()) {
               continue;
            }
         }
      }
 
      // OK, consider it
      ciphersuites.push_back(suite);
   }
 
   if(ciphersuites.empty()) {
      throw Invalid_State("Policy does not allow any available cipher suite");
   }
 
   Ciphersuite_Preference_Ordering order(ciphers, macs, kex, sigs);
   std::sort(ciphersuites.begin(), ciphersuites.end(), order);
 
   std::vector<uint16_t> ciphersuite_codes;
   ciphersuite_codes.reserve(ciphersuites.size());
   for(auto i : ciphersuites) {
      ciphersuite_codes.push_back(i.ciphersuite_code());
   }
   return ciphersuite_codes;
}

References Botan::TLS::Policy::acceptable_ciphersuite(), Botan::TLS::Ciphersuite::all_known_ciphersuites(), Botan::TLS::Policy::allowed_ciphers(), Botan::TLS::Policy::allowed_key_exchange_methods(), Botan::TLS::Policy::allowed_macs(), Botan::TLS::Policy::allowed_signature_methods(), Botan::TLS::IMPLICIT, Botan::TLS::Protocol_Version::is_pre_tls_13(), and Botan::value_exists().

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().

◆ default_dh_group()

Group_Params Botan::TLS::Policy::default_dh_group ( ) const

virtualinherited

For ephemeral Diffie-Hellman key exchange, the server sends a group parameter. Return the 2 Byte TLS group identifier specifying the group parameter a server should use.

Default: 2048 bit IETF IPsec group ("modp/ietf/2048")

Note: Has no effect for TLS 1.3 connections.

Definition at line 150 of file tls_policy.cpp.

                                            {
   /*
   * Return the first listed or just default to 2048
   */
   for(auto g : key_exchange_groups()) {
      if(g.is_dh_named_group()) {
         return g;
      }
   }
 
   return Group_Params::FFDHE_2048;
}

References Botan::TLS::Policy::key_exchange_groups().

Referenced by Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

◆ dtls_default_mtu()

size_t Botan::TLS::Policy::dtls_default_mtu ( ) const

virtualinherited

Returns: the default MTU for DTLS

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 423 of file tls_policy.cpp.

                                      {
   // default MTU is IPv6 min MTU minus UDP/IP headers
   return 1280 - 40 - 8;
}

Referenced by Botan::TLS::Text_Policy::dtls_default_mtu().

◆ dtls_initial_timeout()

size_t Botan::TLS::Policy::dtls_initial_timeout ( ) const

virtualinherited

Returns: the initial timeout for DTLS

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 415 of file tls_policy.cpp.

                                          {
   return 1 * 1000;
}

Referenced by Botan::TLS::Text_Policy::dtls_initial_timeout().

◆ dtls_maximum_timeout()

size_t Botan::TLS::Policy::dtls_maximum_timeout ( ) const

virtualinherited

Returns: the maximum timeout for DTLS

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 419 of file tls_policy.cpp.

                                          {
   return 60 * 1000;
}

Referenced by Botan::TLS::Text_Policy::dtls_maximum_timeout().

◆ hash_hello_random()

bool Botan::TLS::Policy::hash_hello_random ( ) const

virtualinherited

Hash the RNG output for the client/server hello random. This is a pre-caution to avoid writing "raw" RNG output to the wire.

There's not normally a reason to disable this, except when deterministic output is required for testing.

Default: true

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 378 of file tls_policy.cpp.

                                     {
   return true;
}

Referenced by Botan::TLS::Text_Policy::hash_hello_random(), Botan::TLS::make_hello_random(), and Botan::TLS::Policy::print().

◆ hide_unknown_users()

bool Botan::TLS::Policy::hide_unknown_users ( ) const

virtualinherited

The PSK suites work using an identifier along with a shared secret. If this function returns true, when an identifier that the server does not recognize is provided by a client, a random shared secret will be generated in such a way that a client should not be able to tell the difference between the identifier not being known and the secret being wrong. This can help protect against some username probing attacks. If it returns false, the server will instead send an TLS::AlertType::UnknownPSKIdentity alert when an unknown identifier is used.

Default: false

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 350 of file tls_policy.cpp.

                                      {
   return false;
}

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::TLS::Text_Policy::hide_unknown_users(), and Botan::TLS::Policy::print().

◆ include_time_in_hello_random()

bool Botan::TLS::Policy::include_time_in_hello_random ( ) const

virtualinherited

The protocol dictates that the first 32 bits of the random field are the current time in seconds. However this allows client fingerprinting attacks. Set to false to disable, in which case random bytes will be used instead.

Default: true

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 346 of file tls_policy.cpp.

                                                {
   return true;
}

Referenced by Botan::TLS::Text_Policy::include_time_in_hello_random(), Botan::TLS::make_hello_random(), and Botan::TLS::Policy::print().

◆ key_exchange_groups()

std::vector< Group_Params > Botan::TLS::BSI_TR_02102_2::key_exchange_groups ( ) const

inlineoverridevirtual

Return a list of ECC curve and DH group TLS identifiers we are willing to use, in order of preference. The default ordering puts the best performing ECC first.

Default: Group_Params::X25519, Group_Params::SECP256R1, Group_Params::BRAINPOOL256R1, Group_Params::SECP384R1, Group_Params::BRAINPOOL384R1, Group_Params::SECP521R1, Group_Params::BRAINPOOL512R1, Group_Params::FFDHE_2048, Group_Params::FFDHE_3072, Group_Params::FFDHE_4096, Group_Params::FFDHE_6144, Group_Params::FFDHE_8192

No other values are currently defined.

Reimplemented from Botan::TLS::Policy.

Definition at line 662 of file tls_policy.h.

                                                                   {
         return std::vector<Group_Params>({Group_Params::BRAINPOOL512R1,
                                           Group_Params::BRAINPOOL384R1,
                                           Group_Params::BRAINPOOL256R1,
                                           Group_Params::SECP521R1,
                                           Group_Params::SECP384R1,
                                           Group_Params::SECP256R1,
                                           Group_Params::FFDHE_4096,
                                           Group_Params::FFDHE_3072});
      }

◆ key_exchange_groups_to_offer()

std::vector< Group_Params > Botan::TLS::Policy::key_exchange_groups_to_offer ( ) const

virtualinherited

Return a list of groups to provide prepared key share offers in the initial client hello for. Groups in this list must be reflected in key_exchange_groups() and in the same order. If an empty list is returned, no prepared key share offers are sent and the decision of the group to use is left to the server.

Default: the most preferred group from key_exchange_groups().

Note: Has an effect on TLS 1.3 clients, only.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 181 of file tls_policy.cpp.

                                                                   {
   // by default, we offer a key share for the most-preferred group, only
   std::vector<Group_Params> groups_to_offer;
   const auto supported_groups = key_exchange_groups();
   if(!supported_groups.empty()) {
      groups_to_offer.push_back(supported_groups.front());
   }
   return groups_to_offer;
}

References Botan::TLS::Policy::key_exchange_groups().

Referenced by Botan::TLS::Text_Policy::key_exchange_groups_to_offer(), and Botan::TLS::Policy::print().

◆ latest_supported_version()

Protocol_Version Botan::TLS::Policy::latest_supported_version ( bool datagram ) const

virtualinherited

Returns the most recent protocol version we are willing to use, for either TLS or DTLS depending on datagram param. Shouldn't ever need to override this unless you want to allow a user to disable specific TLS versions.

Definition at line 286 of file tls_policy.cpp.

                                                                     {
   if(datagram) {
      if(acceptable_protocol_version(Protocol_Version::DTLS_V12)) {
         return Protocol_Version::DTLS_V12;
      }
      throw Invalid_State("Policy forbids all available DTLS version");
   } else {
#if defined(BOTAN_HAS_TLS_13)
      if(acceptable_protocol_version(Protocol_Version::TLS_V13)) {
         return Protocol_Version::TLS_V13;
      }
#endif
      if(acceptable_protocol_version(Protocol_Version::TLS_V12)) {
         return Protocol_Version::TLS_V12;
      }
      throw Invalid_State("Policy forbids all available TLS version");
   }
}

References Botan::TLS::Policy::acceptable_protocol_version().

◆ maximum_certificate_chain_size()

size_t Botan::TLS::Policy::maximum_certificate_chain_size ( ) const

virtualinherited

Returns: the maximum size of the certificate chain, in bytes. Return 0 to disable this and accept any size.

Definition at line 410 of file tls_policy.cpp.

                                                    {
   return 0;
}

Referenced by Botan::TLS::Certificate_12::Certificate_12(), and Botan::TLS::Certificate_13::Certificate_13().

◆ maximum_session_tickets_per_client_hello()

size_t Botan::TLS::Policy::maximum_session_tickets_per_client_hello ( ) const

virtualinherited

Defines the maximum number of session tickets a client might offer in a single resumption attempt. Must be greater than 0.

TODO: Currently, the TLS 1.3 client implementation supports exactly one ticket per handshake. RFC 8446 allows for an arbitrary amount, though.

Default: 1

Note: Has an effect on TLS 1.3 connections, only.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 250 of file tls_policy.cpp.

                                                              {
   return 1;
}

Referenced by Botan::TLS::Session_Manager::find(), Botan::TLS::Text_Policy::maximum_session_tickets_per_client_hello(), and Botan::TLS::Policy::print().

◆ minimum_dh_group_size()

size_t Botan::TLS::BSI_TR_02102_2::minimum_dh_group_size ( ) const

inlineoverridevirtual

Return the minimum DH group size we're willing to use

Return the minimum size in bits for a Diffie-Hellman group that a client will accept. Due to the design of the protocol the client has only two options - accept the group, or reject it with a fatal alert then attempt to reconnect after disabling ephemeral Diffie-Hellman.

Default: 2048 bits

Reimplemented from Botan::TLS::Policy.

Definition at line 685 of file tls_policy.h.

685{ return 3000; }

◆ minimum_ecdh_group_size()

size_t Botan::TLS::BSI_TR_02102_2::minimum_ecdh_group_size ( ) const

inlineoverridevirtual

Return the minimum ECDH group size we're willing to use for key exchange

Default 255, allowing x25519 and larger x25519 is the smallest curve we will negotiate P-521 is the largest

Reimplemented from Botan::TLS::Policy.

Definition at line 687 of file tls_policy.h.

687{ return 250; }

◆ minimum_ecdsa_group_size()

size_t Botan::TLS::BSI_TR_02102_2::minimum_ecdsa_group_size ( ) const

inlineoverridevirtual

For ECDSA authenticated ciphersuites, the smallest key size the client will accept. This policy is currently only enforced on the server by the client.

Default: 256

Reimplemented from Botan::TLS::Policy.

Definition at line 689 of file tls_policy.h.

689{ return 250; }

◆ minimum_rsa_bits()

size_t Botan::TLS::BSI_TR_02102_2::minimum_rsa_bits ( ) const

inlineoverridevirtual

Return the minimum bit size we're willing to accept for RSA key exchange or server signatures.

It does not place any requirements on the size of any RSA signature(s) which were used to check the server certificate. This is only concerned with the server's public key.

Default is 2048 which is smallest RSA key size still secure for medium term security.

Reimplemented from Botan::TLS::Policy.

Definition at line 683 of file tls_policy.h.

683{ return 3000; }

◆ minimum_signature_strength()

size_t Botan::TLS::BSI_TR_02102_2::minimum_signature_strength ( ) const

inlineoverridevirtual

The minimum signature strength we will accept

Returning 80 allows RSA 1024 and SHA-1. Values larger than 80 disable SHA-1 support. Returning 110 allows RSA 2048. Return 128 to force ECC (P-256) or large (~3000 bit) RSA keys.

Default is 110

Reimplemented from Botan::TLS::Policy.

Definition at line 673 of file tls_policy.h.

673{ return 120; }

◆ negotiate_encrypt_then_mac()

bool Botan::TLS::BSI_TR_02102_2::negotiate_encrypt_then_mac ( ) const

inlineoverridevirtual

Indicates whether the encrypt-then-MAC extension should be negotiated (RFC 7366)

Note: Has no effect for TLS 1.3 connections.

Reimplemented from Botan::TLS::Policy.

Definition at line 681 of file tls_policy.h.

681{ return true; }

◆ new_session_tickets_upon_handshake_success()

size_t Botan::TLS::Policy::new_session_tickets_upon_handshake_success ( ) const

virtualinherited

Return the number of new session tickets a TLS 1.3 server should issue automatically upon a successful handshake. Note that applications can use TLS::Server::send_new_session_tickets() regardless of this policy.

For convenience (and compatibility with the TLS 1.2 behaviour), this returns '1' by default.

Note: Has an effect on TLS 1.3 connections, only.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 262 of file tls_policy.cpp.

                                                                {
   return 1;
}

Referenced by Botan::TLS::Text_Policy::new_session_tickets_upon_handshake_success(), and Botan::TLS::Policy::print().

◆ only_resume_with_exact_version()

bool Botan::TLS::Policy::only_resume_with_exact_version ( ) const

virtualinherited

Only resume sessions when their original protocol version matches the current version exactly.

Default: true

Definition at line 382 of file tls_policy.cpp.

                                                  {
   return true;
}

◆ print()

void Botan::TLS::Policy::print ( std::ostream & o ) const

virtualinherited

Convert this policy to a printable format.

Parameters

o	stream to be printed to

Definition at line 621 of file tls_policy.cpp.

                                      {
   print_bool(o, "allow_tls12", allow_tls12());
   print_bool(o, "allow_tls13", allow_tls13());
   print_bool(o, "allow_dtls12", allow_dtls12());
   print_bool(o, "allow_ssl_key_log_file", allow_ssl_key_log_file());
   print_vec(o, "ciphers", allowed_ciphers());
   print_vec(o, "macs", allowed_macs());
   print_vec(o, "signature_hashes", allowed_signature_hashes());
   print_vec(o, "signature_methods", allowed_signature_methods());
   print_vec(o, "key_exchange_methods", allowed_key_exchange_methods());
   print_vec(o, "key_exchange_groups", key_exchange_groups());
   const auto groups_to_offer = key_exchange_groups_to_offer();
   if(groups_to_offer.empty()) {
      print_vec(o, "key_exchange_groups_to_offer", {std::string("none")});
   } else {
      print_vec(o, "key_exchange_groups_to_offer", groups_to_offer);
   }
   print_bool(o, "allow_insecure_renegotiation", allow_insecure_renegotiation());
   print_bool(o, "include_time_in_hello_random", include_time_in_hello_random());
   print_bool(o, "allow_server_initiated_renegotiation", allow_server_initiated_renegotiation());
   print_bool(o, "hide_unknown_users", hide_unknown_users());
   print_bool(o, "server_uses_own_ciphersuite_preferences", server_uses_own_ciphersuite_preferences());
   print_bool(o, "negotiate_encrypt_then_mac", negotiate_encrypt_then_mac());
   print_bool(o, "support_cert_status_message", support_cert_status_message());
   print_bool(o, "tls_13_middlebox_compatibility_mode", tls_13_middlebox_compatibility_mode());
   print_vec(o, "accepted_client_certificate_types", accepted_client_certificate_types());
   print_vec(o, "accepted_server_certificate_types", accepted_server_certificate_types());
   print_bool(o, "hash_hello_random", hash_hello_random());
   if(record_size_limit().has_value()) {
      o << "record_size_limit = " << record_size_limit().value() << '\n';
   }
   o << "maximum_session_tickets_per_client_hello = " << maximum_session_tickets_per_client_hello() << '\n';
   o << "session_ticket_lifetime = " << session_ticket_lifetime().count() << '\n';
   o << "reuse_session_tickets = " << reuse_session_tickets() << '\n';
   o << "new_session_tickets_upon_handshake_success = " << new_session_tickets_upon_handshake_success() << '\n';
   o << "minimum_dh_group_size = " << minimum_dh_group_size() << '\n';
   o << "minimum_ecdh_group_size = " << minimum_ecdh_group_size() << '\n';
   o << "minimum_rsa_bits = " << minimum_rsa_bits() << '\n';
   o << "minimum_signature_strength = " << minimum_signature_strength() << '\n';
}

Referenced by Botan::TLS::Policy::to_string().

◆ record_size_limit()

std::optional< uint16_t > Botan::TLS::Policy::record_size_limit ( ) const

virtualinherited

Defines the maximum TLS record length for TLS connections. This is based on the Record Size Limit extension described in RFC 8449. By default (i.e. if std::nullopt is returned), TLS clients will omit this extension altogether.

This value may be between 64 and 16385 (TLS 1.3) or 16384 (TLS 1.2).

Note: This is currently not implemented for TLS 1.2, hence the limit won't be negotiated by TLS 1.3 clients that support downgrading to TLS 1.2 (i.e. allow_tls12() returning true).

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 362 of file tls_policy.cpp.

                                                      {
   return std::nullopt;
}

Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Encrypted_Extensions::Encrypted_Extensions(), and Botan::TLS::Policy::print().

◆ request_client_certificate_authentication()

bool Botan::TLS::Policy::request_client_certificate_authentication ( ) const

virtualinherited

Indicate if client certificate authentication is requested. If true, then a cert will be requested.

Definition at line 390 of file tls_policy.cpp.

                                                             {
   return require_client_certificate_authentication();
}

References Botan::TLS::Policy::require_client_certificate_authentication().

Referenced by Botan::TLS::Encrypted_Extensions::Encrypted_Extensions(), and Botan::TLS::Certificate_Request_13::maybe_create().

◆ require_cert_revocation_info()

bool Botan::TLS::Policy::require_cert_revocation_info ( ) const

virtualinherited

Return if certificate revocation info (CRL/OCSP) is required

If true, certificates won't be trusted unless a valid CRL or OCSP response was examined.

Default: true

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 209 of file tls_policy.cpp.

                                                {
   return true;
}

Referenced by Botan::TLS::Text_Policy::require_cert_revocation_info(), and Botan::TLS::Callbacks::tls_verify_cert_chain().

◆ require_client_certificate_authentication()

bool Botan::TLS::Policy::require_client_certificate_authentication ( ) const

virtualinherited

Indicate if client certificate authentication is required. If true, then a cert will be requested and if the client does not send a certificate the connection will be closed.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 386 of file tls_policy.cpp.

                                                             {
   return false;
}

Referenced by Botan::TLS::Policy::request_client_certificate_authentication(), and Botan::TLS::Text_Policy::require_client_certificate_authentication().

◆ reuse_session_tickets()

bool Botan::TLS::Policy::reuse_session_tickets ( ) const

virtualinherited

Decides whether stored session tickets should be used multiple times (until their lifetime runs out). This might allow passive observers to correlate connections (RFC 8446 Appendix C.4). This has no effect on TLS 1.2 resumptions based on session IDs as those are negotiated in the clear anyway.

Default: false

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 258 of file tls_policy.cpp.

                                         {
   return false;
}

Referenced by Botan::TLS::Session_Manager::find(), Botan::TLS::Policy::print(), and Botan::TLS::Text_Policy::reuse_session_tickets().

◆ server_uses_own_ciphersuite_preferences()

bool Botan::TLS::BSI_TR_02102_2::server_uses_own_ciphersuite_preferences ( ) const

inlineoverridevirtual

Default: true

Returns: true if servers should choose the ciphersuite matching their highest preference, rather than the clients. Has no effect on client side.

Reimplemented from Botan::TLS::Policy.

Definition at line 679 of file tls_policy.h.

679{ return true; }

◆ session_ticket_lifetime()

std::chrono::seconds Botan::TLS::Policy::session_ticket_lifetime ( ) const

virtualinherited

Return the allowed lifetime of a session ticket. If 0, session tickets do not expire until the session ticket key rolls over. For TLS 1.3 session tickets the lifetime must not be longer than seven days. Expired session tickets cannot be used to resume a session.

Default: 1 day

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 254 of file tls_policy.cpp.

                                                       {
   return std::chrono::days(1);
}

Referenced by Botan::TLS::Policy::print(), Botan::TLS::Session_Manager::retrieve(), and Botan::TLS::Text_Policy::session_ticket_lifetime().

◆ srtp_profiles()

std::vector< uint16_t > Botan::TLS::Policy::srtp_profiles ( ) const

virtualinherited

If this returns a non-empty vector, and DTLS is negotiated, then we will also attempt to negotiate the SRTP extension from RFC 5764 using the returned values as the profile ids.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 428 of file tls_policy.cpp.

                                                {
   return std::vector<uint16_t>();
}

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12().

◆ support_cert_status_message()

bool Botan::TLS::Policy::support_cert_status_message ( ) const

virtualinherited

Indicates whether certificate status messages should be supported

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 366 of file tls_policy.cpp.

                                               {
   return true;
}

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Policy::print(), Botan::TLS::Server_Hello_12::Server_Hello_12(), and Botan::TLS::Text_Policy::support_cert_status_message().

◆ tls_13_middlebox_compatibility_mode()

bool Botan::TLS::Policy::tls_13_middlebox_compatibility_mode ( ) const

virtualinherited

Defines whether or not the middlebox compatibility mode should be used. Enabled by default.

RFC 8446 Appendix D.4 [This makes] the TLS 1.3 handshake resemble TLS 1.2 session resumption, which improves the chance of successfully connecting through middleboxes.

Default: true

Note: Has an effect on TLS 1.3 connections, only.

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 374 of file tls_policy.cpp.

                                                       {
   return true;
}

Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Client_Impl_13::Client_Impl_13(), Botan::TLS::Policy::print(), and Botan::TLS::Text_Policy::tls_13_middlebox_compatibility_mode().

◆ to_string()

std::string Botan::TLS::Policy::to_string ( ) const

inherited

Convert this policy to a printable format. Same as calling print on a ostringstream and reading o.str()

Definition at line 662 of file tls_policy.cpp.

                                  {
   std::ostringstream oss;
   this->print(oss);
   return oss.str();
}

References Botan::TLS::Policy::print().

◆ use_ecc_point_compression()

bool Botan::TLS::Policy::use_ecc_point_compression ( ) const

virtualinherited

Request that ECC curve points are sent compressed

Signals that we prefer ECC points to be compressed when transmitted to us. The other party may not support ECC point compression and therefore may still send points uncompressed.

Note that the certificate used during authentication must also follow the other party's preference.

Note: Support for EC point compression is deprecated and will be removed in a future major release. TLS 1.3 does not support point compression at all (see RFC 8446 4.2.8.2)

Reimplemented in Botan::TLS::Text_Policy.

Definition at line 119 of file tls_policy.cpp.

                                             {
   return false;
}

Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), and Botan::TLS::Text_Policy::use_ecc_point_compression().

The documentation for this class was generated from the following file:

src/lib/tls/tls_policy.h

Public Member Functions

Detailed Description

Member Function Documentation

◆ abort_connection_on_undesired_renegotiation()

◆ acceptable_certificate_signature_schemes()

◆ acceptable_ciphersuite()

◆ acceptable_protocol_version()

◆ acceptable_signature_schemes()

◆ accepted_client_certificate_types()

◆ accepted_server_certificate_types()

◆ allow_client_initiated_renegotiation()

◆ allow_dtls12()

◆ allow_dtls_epoch0_restart()

◆ allow_insecure_renegotiation()

◆ allow_resumption_for_renegotiation()

◆ allow_server_initiated_renegotiation()

◆ allow_ssl_key_log_file()

◆ allow_tls12()

◆ allow_tls13()

◆ allowed_ciphers()

◆ allowed_key_exchange_methods()

◆ allowed_macs()

◆ allowed_signature_hash()

◆ allowed_signature_hashes()

◆ allowed_signature_method()

◆ allowed_signature_methods()

◆ allowed_signature_schemes()

◆ check_peer_key_acceptable()

◆ choose_key_exchange_group()

◆ ciphersuite_list()

◆ default_dh_group()

◆ dtls_default_mtu()

◆ dtls_initial_timeout()

◆ dtls_maximum_timeout()

◆ hash_hello_random()

◆ hide_unknown_users()

◆ include_time_in_hello_random()

◆ key_exchange_groups()

◆ key_exchange_groups_to_offer()

◆ latest_supported_version()

◆ maximum_certificate_chain_size()

◆ maximum_session_tickets_per_client_hello()

◆ minimum_dh_group_size()

◆ minimum_ecdh_group_size()

◆ minimum_ecdsa_group_size()

◆ minimum_rsa_bits()

◆ minimum_signature_strength()

◆ negotiate_encrypt_then_mac()

◆ new_session_tickets_upon_handshake_success()

◆ only_resume_with_exact_version()

◆ print()

◆ record_size_limit()

◆ request_client_certificate_authentication()

◆ require_cert_revocation_info()

◆ require_client_certificate_authentication()

◆ reuse_session_tickets()

◆ server_uses_own_ciphersuite_preferences()

◆ session_ticket_lifetime()

◆ srtp_profiles()

◆ support_cert_status_message()

◆ tls_13_middlebox_compatibility_mode()

◆ to_string()

◆ use_ecc_point_compression()