Botan 3.9.0
Crypto and TLS for C&
Botan::TLS::Client_Hello_13 Class Referencefinal

#include <tls_messages.h>

Inheritance diagram for Botan::TLS::Client_Hello_13:
Botan::TLS::Client_Hello Botan::TLS::Handshake_Message

Public Member Functions

std::vector< Signature_Schemecertificate_signature_schemes () const
const std::vector< uint16_t > & ciphersuites () const
 Client_Hello_13 (const Policy &policy, Callbacks &cb, RandomNumberGenerator &rng, std::string_view hostname, const std::vector< std::string > &next_protocols, std::optional< Session_with_Handle > &session, std::vector< ExternalPSK > psks)
const std::vector< uint8_t > & cookie () const
std::vector< uint8_t > cookie_input_data () const
std::set< Extension_Codeextension_types () const
const Extensionsextensions () const
std::optional< Protocol_Versionhighest_supported_version (const Policy &policy) const
Protocol_Version legacy_version () const
std::vector< std::string > next_protocols () const
bool offered_suite (uint16_t ciphersuite) const
const std::vector< uint8_t > & random () const
void retry (const Hello_Retry_Request &hrr, const Transcript_Hash_State &transcript_hash_state, Callbacks &cb, RandomNumberGenerator &rng)
bool sent_signature_algorithms () const
std::vector< uint8_t > serialize () const override
const Session_IDsession_id () const
std::vector< Signature_Schemesignature_schemes () const
std::string sni_hostname () const
std::vector< uint16_t > srtp_profiles () const
std::vector< Group_Paramssupported_dh_groups () const
std::vector< Group_Paramssupported_ecc_curves () const
std::vector< Protocol_Versionsupported_versions () const
bool supports_alpn () const
Handshake_Type type () const override
std::string type_string () const
void validate_updates (const Client_Hello_13 &new_ch)
virtual Handshake_Type wire_type () const

Static Public Member Functions

static std::variant< Client_Hello_13, Client_Hello_12parse (const std::vector< uint8_t > &buf)

Protected Member Functions

const std::vector< uint8_t > & compression_methods () const

Protected Attributes

std::unique_ptr< Client_Hello_Internal > m_data

Detailed Description

Definition at line 218 of file tls_messages.h.

Constructor & Destructor Documentation

◆ Client_Hello_13()

Botan::TLS::Client_Hello_13::Client_Hello_13 ( const Policy & policy,
Callbacks & cb,
RandomNumberGenerator & rng,
std::string_view hostname,
const std::vector< std::string > & next_protocols,
std::optional< Session_with_Handle > & session,
std::vector< ExternalPSK > psks )

Creates a client hello which might optionally use the passed-in session for resumption. In that case, this will "extract" the master secret from the passed-in session.

Definition at line 761 of file msg_client_hello.cpp.

767 {
768 // RFC 8446 4.1.2
769 // In TLS 1.3, the client indicates its version preferences in the
770 // "supported_versions" extension (Section 4.2.1) and the
771 // legacy_version field MUST be set to 0x0303, which is the version
772 // number for TLS 1.2.
773 m_data->m_legacy_version = Protocol_Version::TLS_V12;
774 m_data->m_random = make_hello_random(rng, cb, policy);
775 m_data->m_suites = policy.ciphersuite_list(Protocol_Version::TLS_V13);
776
777 if(policy.allow_tls12()) {
778 // Note: DTLS 1.3 is NYI, hence dtls_12 is not checked
779 const auto legacy_suites = policy.ciphersuite_list(Protocol_Version::TLS_V12);
780 m_data->m_suites.insert(m_data->m_suites.end(), legacy_suites.cbegin(), legacy_suites.cend());
781 }
782
783 if(policy.tls_13_middlebox_compatibility_mode()) {
784 // RFC 8446 4.1.2
785 // In compatibility mode (see Appendix D.4), this field MUST be non-empty,
786 // so a client not offering a pre-TLS 1.3 session MUST generate a new
787 // 32-byte value.
788 //
789 // Note: we won't ever offer a TLS 1.2 session. In such a case we would
790 // have instantiated a TLS 1.2 client in the first place.
791 m_data->m_session_id = Session_ID(make_hello_random(rng, cb, policy));
792 }
793
794 // NOLINTBEGIN(*-owning-memory)
795 if(hostname_acceptable_for_sni(hostname)) {
796 m_data->extensions().add(new Server_Name_Indicator(hostname));
797 }
798
799 m_data->extensions().add(new Supported_Groups(policy.key_exchange_groups()));
800
801 m_data->extensions().add(new Key_Share(policy, cb, rng));
802
803 m_data->extensions().add(new Supported_Versions(Protocol_Version::TLS_V13, policy));
804
805 m_data->extensions().add(new Signature_Algorithms(policy.acceptable_signature_schemes()));
806 if(auto cert_signing_prefs = policy.acceptable_certificate_signature_schemes()) {
807 // RFC 8446 4.2.3
808 // Implementations which have the same policy in both cases MAY omit
809 // the "signature_algorithms_cert" extension.
810 m_data->extensions().add(new Signature_Algorithms_Cert(std::move(cert_signing_prefs.value())));
811 }
812
813 // TODO: Support for PSK-only mode without a key exchange.
814 // This should be configurable in TLS::Policy and should allow no PSK
815 // support at all (e.g. to disable support for session resumption).
816 m_data->extensions().add(new PSK_Key_Exchange_Modes({PSK_Key_Exchange_Mode::PSK_DHE_KE}));
817
818 if(policy.support_cert_status_message()) {
819 m_data->extensions().add(new Certificate_Status_Request({}, {}));
820 }
821
822 // We currently support "record_size_limit" for TLS 1.3 exclusively. Hence,
823 // when TLS 1.2 is advertised as a supported protocol, we must not offer this
824 // extension.
825 if(policy.record_size_limit().has_value() && !policy.allow_tls12()) {
826 m_data->extensions().add(new Record_Size_Limit(policy.record_size_limit().value()));
827 }
828
829 if(!next_protocols.empty()) {
830 m_data->extensions().add(new Application_Layer_Protocol_Notification(next_protocols));
831 }
832
833 // RFC 7250 4.1
834 // In order to indicate the support of raw public keys, clients include
835 // the client_certificate_type and/or the server_certificate_type
836 // extensions in an extended client hello message.
837 m_data->extensions().add(new Client_Certificate_Type(policy.accepted_client_certificate_types()));
838 m_data->extensions().add(new Server_Certificate_Type(policy.accepted_server_certificate_types()));
839
840 if(policy.allow_tls12()) {
841 m_data->extensions().add(new Renegotiation_Extension());
842 m_data->extensions().add(new Session_Ticket_Extension());
843
844 // EMS must always be used with TLS 1.2, regardless of the policy
845 m_data->extensions().add(new Extended_Master_Secret);
846
847 if(policy.negotiate_encrypt_then_mac()) {
848 m_data->extensions().add(new Encrypt_then_MAC);
849 }
850
851 if(m_data->extensions().has<Supported_Groups>() &&
852 !m_data->extensions().get<Supported_Groups>()->ec_groups().empty()) {
853 m_data->extensions().add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
854 }
855 }
856
857 if(session.has_value() || !psks.empty()) {
858 m_data->extensions().add(new PSK(session, std::move(psks), cb));
859 }
860 // NOLINTEND(*-owning-memory)
861
862 cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Client, type());
863
864 if(m_data->extensions().has<PSK>()) {
865 // RFC 8446 4.2.11
866 // The "pre_shared_key" extension MUST be the last extension in the
867 // ClientHello (this facilitates implementation [...]).
868 if(m_data->extensions().all().back()->type() != Extension_Code::PresharedKey) {
869 throw TLS_Exception(Alert::InternalError,
870 "Application modified extensions of Client Hello, PSK is not last anymore");
871 }
872 calculate_psk_binders({});
873 }
874}
std::unique_ptr< Client_Hello_Internal > m_data
std::vector< std::string > next_protocols() const
virtual Handshake_Type type() const =0
std::vector< uint8_t > make_hello_random(RandomNumberGenerator &rng, Callbacks &cb, const Policy &policy)
Strong< std::vector< uint8_t >, struct Session_ID_ > Session_ID
holds a TLS 1.2 session ID for stateful resumption
Definition tls_session.h:31

References Botan::TLS::Policy::acceptable_certificate_signature_schemes(), Botan::TLS::Policy::acceptable_signature_schemes(), Botan::TLS::Policy::accepted_client_certificate_types(), Botan::TLS::Policy::accepted_server_certificate_types(), Botan::TLS::Policy::allow_tls12(), Botan::TLS::Policy::ciphersuite_list(), Botan::TLS::Client, Botan::TLS::Supported_Groups::ec_groups(), Botan::TLS::Policy::key_exchange_groups(), Botan::TLS::Client_Hello::m_data, Botan::TLS::make_hello_random(), Botan::TLS::Policy::negotiate_encrypt_then_mac(), Botan::TLS::Client_Hello::next_protocols(), Botan::TLS::PresharedKey, Botan::TLS::PSK, Botan::TLS::PSK_DHE_KE, Botan::TLS::Policy::record_size_limit(), Botan::TLS::Policy::support_cert_status_message(), Botan::TLS::Policy::tls_13_middlebox_compatibility_mode(), Botan::TLS::Callbacks::tls_modify_extensions(), Botan::TLS::Client_Hello::type(), and Botan::TLS::Policy::use_ecc_point_compression().

Referenced by parse(), and validate_updates().

Member Function Documentation

◆ certificate_signature_schemes()

std::vector< Signature_Scheme > Botan::TLS::Client_Hello::certificate_signature_schemes ( ) const
inherited

Definition at line 270 of file msg_client_hello.cpp.

270 {
271 // RFC 8446 4.2.3
272 // If no "signature_algorithms_cert" extension is present, then the
273 // "signature_algorithms" extension also applies to signatures appearing
274 // in certificates.
275 if(Signature_Algorithms_Cert* sigs = m_data->extensions().get<Signature_Algorithms_Cert>()) {
276 return sigs->supported_schemes();
277 } else {
278 return signature_schemes();
279 }
280}
std::vector< Signature_Scheme > signature_schemes() const

References m_data, and signature_schemes().

Referenced by Botan::TLS::Certificate_13::Certificate_13(), and ~Client_Hello().

◆ ciphersuites()

const std::vector< uint16_t > & Botan::TLS::Client_Hello::ciphersuites ( ) const
inherited

Definition at line 200 of file msg_client_hello.cpp.

200 {
201 return m_data->ciphersuites();
202}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::compression_methods(), and ~Client_Hello().

◆ compression_methods()

const std::vector< uint8_t > & Botan::TLS::Client_Hello::compression_methods ( ) const
protectedinherited

Definition at line 196 of file msg_client_hello.cpp.

196 {
197 return m_data->comp_methods();
198}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_13, and ~Client_Hello().

◆ cookie()

const std::vector< uint8_t > & Botan::TLS::Client_Hello::cookie ( ) const
inherited

Definition at line 387 of file msg_client_hello.cpp.

387 {
388 return m_data->hello_cookie();
389}

References m_data.

Referenced by ~Client_Hello().

◆ cookie_input_data()

std::vector< uint8_t > Botan::TLS::Client_Hello::cookie_input_data ( ) const
inherited

Definition at line 249 of file msg_client_hello.cpp.

249 {
250 BOTAN_STATE_CHECK(!m_data->hello_cookie_input_bits().empty());
251
252 return m_data->hello_cookie_input_bits();
253}
#define BOTAN_STATE_CHECK(expr)
Definition assert.h:49

References BOTAN_STATE_CHECK, and m_data.

Referenced by ~Client_Hello().

◆ extension_types()

std::set< Extension_Code > Botan::TLS::Client_Hello::extension_types ( ) const
inherited

Definition at line 204 of file msg_client_hello.cpp.

204 {
205 return m_data->extensions().extension_types();
206}

References m_data.

Referenced by Botan::TLS::Server_Hello_12::Server_Hello_12(), Botan::TLS::Client_Hello_13::validate_updates(), and ~Client_Hello().

◆ extensions()

◆ highest_supported_version()

std::optional< Protocol_Version > Botan::TLS::Client_Hello_13::highest_supported_version ( const Policy & policy) const

Select the highest protocol version from the list of versions supported by the client. If no such version can be determind this returns std::nullopt.

Definition at line 1054 of file msg_client_hello.cpp.

1054 {
1055 // RFC 8446 4.2.1
1056 // The "supported_versions" extension is used by the client to indicate
1057 // which versions of TLS it supports and by the server to indicate which
1058 // version it is using. The extension contains a list of supported
1059 // versions in preference order, with the most preferred version first.
1060 auto* const supvers = m_data->extensions().get<Supported_Versions>();
1061 BOTAN_ASSERT_NONNULL(supvers);
1062
1063 std::optional<Protocol_Version> result;
1064
1065 for(const auto& v : supvers->versions()) {
1066 // RFC 8446 4.2.1
1067 // Servers MUST only select a version of TLS present in that extension
1068 // and MUST ignore any unknown versions that are present in that
1069 // extension.
1070 if(!v.known_version() || !policy.acceptable_protocol_version(v)) {
1071 continue;
1072 }
1073
1074 result = (result.has_value()) ? std::optional(std::max(result.value(), v)) : std::optional(v);
1075 }
1076
1077 return result;
1078}
#define BOTAN_ASSERT_NONNULL(ptr)
Definition assert.h:114

References Botan::TLS::Policy::acceptable_protocol_version(), BOTAN_ASSERT_NONNULL, and Botan::TLS::Client_Hello::m_data.

◆ legacy_version()

Protocol_Version Botan::TLS::Client_Hello::legacy_version ( ) const
inherited

Return the version indicated in the ClientHello. This may differ from the version indicated in the supported_versions extension.

See RFC 8446 4.1.2: TLS 1.3, the client indicates its version preferences in the "supported_versions" extension (Section 4.2.1) and the legacy_version field MUST be set to 0x0303, which is the version number for TLS 1.2.

Definition at line 184 of file msg_client_hello.cpp.

184 {
185 return m_data->legacy_version();
186}

References m_data.

Referenced by ~Client_Hello().

◆ next_protocols()

std::vector< std::string > Botan::TLS::Client_Hello::next_protocols ( ) const
inherited

Definition at line 373 of file msg_client_hello.cpp.

373 {
374 if(auto* alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
375 return alpn->protocols();
376 }
377 return {};
378}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::Client_Hello_13(), and ~Client_Hello().

◆ offered_suite()

bool Botan::TLS::Client_Hello::offered_suite ( uint16_t ciphersuite) const
inherited

Definition at line 258 of file msg_client_hello.cpp.

258 {
259 return std::find(m_data->ciphersuites().cbegin(), m_data->ciphersuites().cend(), ciphersuite) !=
260 m_data->ciphersuites().cend();
261}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), and ~Client_Hello().

◆ parse()

std::variant< Client_Hello_13, Client_Hello_12 > Botan::TLS::Client_Hello_13::parse ( const std::vector< uint8_t > & buf)
static

Definition at line 876 of file msg_client_hello.cpp.

876 {
877 auto data = std::make_unique<Client_Hello_Internal>(buf);
878 const auto version = data->version();
879
880 if(version.is_pre_tls_13()) {
881 return Client_Hello_12(std::move(data));
882 } else {
883 return Client_Hello_13(std::move(data));
884 }
885}
Client_Hello_13(const Policy &policy, Callbacks &cb, RandomNumberGenerator &rng, std::string_view hostname, const std::vector< std::string > &next_protocols, std::optional< Session_with_Handle > &session, std::vector< ExternalPSK > psks)

References Client_Hello_13().

◆ random()

const std::vector< uint8_t > & Botan::TLS::Client_Hello::random ( ) const
inherited

Definition at line 188 of file msg_client_hello.cpp.

188 {
189 return m_data->random();
190}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_13, and ~Client_Hello().

◆ retry()

void Botan::TLS::Client_Hello_13::retry ( const Hello_Retry_Request & hrr,
const Transcript_Hash_State & transcript_hash_state,
Callbacks & cb,
RandomNumberGenerator & rng )

Definition at line 887 of file msg_client_hello.cpp.

890 {
891 BOTAN_STATE_CHECK(m_data->extensions().has<Supported_Groups>());
892 BOTAN_STATE_CHECK(m_data->extensions().has<Key_Share>());
893
894 auto* hrr_ks = hrr.extensions().get<Key_Share>();
895 const auto& supported_groups = m_data->extensions().get<Supported_Groups>()->groups();
896
897 if(hrr.extensions().has<Key_Share>()) {
898 m_data->extensions().get<Key_Share>()->retry_offer(*hrr_ks, supported_groups, cb, rng);
899 }
900
901 // RFC 8446 4.2.2
902 // When sending the new ClientHello, the client MUST copy
903 // the contents of the extension received in the HelloRetryRequest into
904 // a "cookie" extension in the new ClientHello.
905 //
906 // RFC 8446 4.2.2
907 // Clients MUST NOT use cookies in their initial ClientHello in subsequent
908 // connections.
909 if(hrr.extensions().has<Cookie>()) {
910 BOTAN_STATE_CHECK(!m_data->extensions().has<Cookie>());
911 m_data->extensions().add(new Cookie(hrr.extensions().get<Cookie>()->get_cookie())); // NOLINT(*-owning-memory)
912 }
913
914 // Note: the consumer of the TLS implementation won't be able to distinguish
915 // invocations to this callback due to the first Client_Hello or the
916 // retried Client_Hello after receiving a Hello_Retry_Request. We assume
917 // that the user keeps and detects this state themselves.
918 cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Client, type());
919
920 auto* psk = m_data->extensions().get<PSK>();
921 if(psk != nullptr) {
922 // Cipher suite should always be a known suite as this is checked upstream
923 const auto cipher = Ciphersuite::by_id(hrr.ciphersuite());
924 BOTAN_ASSERT_NOMSG(cipher.has_value());
925
926 // RFC 8446 4.1.4
927 // In [...] its updated ClientHello, the client SHOULD NOT offer
928 // any pre-shared keys associated with a hash other than that of the
929 // selected cipher suite.
930 psk->filter(cipher.value());
931
932 // RFC 8446 4.2.11.2
933 // If the server responds with a HelloRetryRequest and the client
934 // then sends ClientHello2, its binder will be computed over: [...].
935 calculate_psk_binders(transcript_hash_state.clone());
936 }
937}
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:75
static std::optional< Ciphersuite > by_id(uint16_t suite)

References BOTAN_ASSERT_NOMSG, BOTAN_STATE_CHECK, Botan::TLS::Ciphersuite::by_id(), Botan::TLS::Server_Hello::ciphersuite(), Botan::TLS::Client, Botan::TLS::Transcript_Hash_State::clone(), Botan::TLS::Cookie, Botan::TLS::Server_Hello::extensions(), Botan::TLS::Extensions::get(), Botan::TLS::Cookie::get_cookie(), Botan::TLS::Extensions::has(), Botan::TLS::Client_Hello::m_data, Botan::TLS::Callbacks::tls_modify_extensions(), and Botan::TLS::Client_Hello::type().

◆ sent_signature_algorithms()

bool Botan::TLS::Client_Hello::sent_signature_algorithms ( ) const
inherited

Definition at line 369 of file msg_client_hello.cpp.

369 {
370 return m_data->extensions().has<Signature_Algorithms>();
371}

References m_data.

Referenced by ~Client_Hello().

◆ serialize()

std::vector< uint8_t > Botan::TLS::Client_Hello::serialize ( ) const
overridevirtualinherited
Returns
DER representation of this message

Implements Botan::TLS::Handshake_Message.

Definition at line 221 of file msg_client_hello.cpp.

221 {
222 std::vector<uint8_t> buf;
223 buf.reserve(1024); // working around GCC warning
224
225 buf.push_back(m_data->legacy_version().major_version());
226 buf.push_back(m_data->legacy_version().minor_version());
227 buf += m_data->random();
228
229 append_tls_length_value(buf, m_data->session_id().get(), 1);
230
231 if(m_data->legacy_version().is_datagram_protocol()) {
232 append_tls_length_value(buf, m_data->hello_cookie(), 1);
233 }
234
235 append_tls_length_value(buf, m_data->ciphersuites(), 2);
236 append_tls_length_value(buf, m_data->comp_methods(), 1);
237
238 /*
239 * May not want to send extensions at all in some cases. If so,
240 * should include SCSV value (if reneg info is empty, if not we are
241 * renegotiating with a modern server)
242 */
243
244 buf += m_data->extensions().serialize(Connection_Side::Client);
245
246 return buf;
247}
void append_tls_length_value(std::vector< uint8_t, Alloc > &buf, const T *vals, size_t vals_size, size_t tag_size)
Definition tls_reader.h:184

References Botan::TLS::append_tls_length_value(), Botan::TLS::Client, and m_data.

Referenced by ~Client_Hello().

◆ session_id()

const Session_ID & Botan::TLS::Client_Hello::session_id ( ) const
inherited

Definition at line 192 of file msg_client_hello.cpp.

192 {
193 return m_data->session_id();
194}

References m_data.

Referenced by Botan::TLS::Client_Hello_12::session_handle(), and ~Client_Hello().

◆ signature_schemes()

std::vector< Signature_Scheme > Botan::TLS::Client_Hello::signature_schemes ( ) const
inherited

Definition at line 263 of file msg_client_hello.cpp.

263 {
264 if(Signature_Algorithms* sigs = m_data->extensions().get<Signature_Algorithms>()) {
265 return sigs->supported_schemes();
266 }
267 return {};
268}

References m_data.

Referenced by Botan::TLS::Certificate_13::Certificate_13(), certificate_signature_schemes(), Botan::TLS::Handshake_State::choose_sig_format(), and ~Client_Hello().

◆ sni_hostname()

std::string Botan::TLS::Client_Hello::sni_hostname ( ) const
inherited

Definition at line 303 of file msg_client_hello.cpp.

303 {
304 if(Server_Name_Indicator* sni = m_data->extensions().get<Server_Name_Indicator>()) {
305 return sni->host_name();
306 }
307 return "";
308}

References m_data.

Referenced by Botan::TLS::Certificate_13::Certificate_13(), Botan::TLS::Certificate_Request_13::maybe_create(), and ~Client_Hello().

◆ srtp_profiles()

std::vector< uint16_t > Botan::TLS::Client_Hello::srtp_profiles ( ) const
inherited

Definition at line 380 of file msg_client_hello.cpp.

380 {
381 if(SRTP_Protection_Profiles* srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
382 return srtp->profiles();
383 }
384 return {};
385}

References m_data.

Referenced by ~Client_Hello().

◆ supported_dh_groups()

std::vector< Group_Params > Botan::TLS::Client_Hello::supported_dh_groups ( ) const
inherited

Definition at line 289 of file msg_client_hello.cpp.

289 {
290 if(Supported_Groups* groups = m_data->extensions().get<Supported_Groups>()) {
291 return groups->dh_groups();
292 }
293 return std::vector<Group_Params>();
294}

References m_data.

Referenced by ~Client_Hello().

◆ supported_ecc_curves()

std::vector< Group_Params > Botan::TLS::Client_Hello::supported_ecc_curves ( ) const
inherited

Definition at line 282 of file msg_client_hello.cpp.

282 {
283 if(Supported_Groups* groups = m_data->extensions().get<Supported_Groups>()) {
284 return groups->ec_groups();
285 }
286 return {};
287}

References m_data.

Referenced by ~Client_Hello().

◆ supported_versions()

std::vector< Protocol_Version > Botan::TLS::Client_Hello::supported_versions ( ) const
inherited

Definition at line 321 of file msg_client_hello.cpp.

321 {
322 if(Supported_Versions* versions = m_data->extensions().get<Supported_Versions>()) {
323 return versions->versions();
324 }
325 return {};
326}

References m_data.

Referenced by ~Client_Hello().

◆ supports_alpn()

bool Botan::TLS::Client_Hello::supports_alpn ( ) const
inherited

Definition at line 353 of file msg_client_hello.cpp.

353 {
354 return m_data->extensions().has<Application_Layer_Protocol_Notification>();
355}

References m_data.

Referenced by Botan::TLS::Server_Hello_12::Server_Hello_12(), Botan::TLS::Server_Hello_12::Server_Hello_12(), and ~Client_Hello().

◆ type()

◆ type_string()

std::string Botan::TLS::Handshake_Message::type_string ( ) const
inherited
Returns
string representation of this message type

Definition at line 19 of file tls_handshake_state.cpp.

19 {
21}
const char * handshake_type_to_string(Handshake_Type type)

References Botan::TLS::handshake_type_to_string(), and type().

◆ validate_updates()

void Botan::TLS::Client_Hello_13::validate_updates ( const Client_Hello_13 & new_ch)

This validates that a Client Hello received after sending a Hello Retry Request was updated in accordance with RFC 8446 4.1.2. If issues are found, this method throws accordingly.

Definition at line 939 of file msg_client_hello.cpp.

939 {
940 // RFC 8446 4.1.2
941 // The client will also send a ClientHello when the server has responded
942 // to its ClientHello with a HelloRetryRequest. In that case, the client
943 // MUST send the same ClientHello without modification, except as follows:
944
945 if(m_data->session_id() != new_ch.m_data->session_id() || m_data->random() != new_ch.m_data->random() ||
946 m_data->ciphersuites() != new_ch.m_data->ciphersuites() ||
947 m_data->comp_methods() != new_ch.m_data->comp_methods()) {
948 throw TLS_Exception(Alert::IllegalParameter, "Client Hello core values changed after Hello Retry Request");
949 }
950
951 const auto oldexts = extension_types();
952 const auto newexts = new_ch.extension_types();
953
954 // Check that extension omissions are justified
955 for(const auto oldext : oldexts) {
956 if(!newexts.contains(oldext)) {
957 auto* const ext = extensions().get(oldext);
958
959 // We don't make any assumptions about unimplemented extensions.
960 if(!ext->is_implemented()) {
961 continue;
962 }
963
964 // RFC 8446 4.1.2
965 // Removing the "early_data" extension (Section 4.2.10) if one was
966 // present. Early data is not permitted after a HelloRetryRequest.
967 if(oldext == EarlyDataIndication::static_type()) {
968 continue;
969 }
970
971 // RFC 8446 4.1.2
972 // Optionally adding, removing, or changing the length of the
973 // "padding" extension.
974 //
975 // TODO: implement the Padding extension
976 // if(oldext == Padding::static_type())
977 // continue;
978
979 throw TLS_Exception(Alert::IllegalParameter, "Extension removed in updated Client Hello");
980 }
981 }
982
983 // Check that extension additions are justified
984 for(const auto newext : newexts) {
985 if(!oldexts.contains(newext)) {
986 auto* const ext = new_ch.extensions().get(newext);
987
988 // We don't make any assumptions about unimplemented extensions.
989 if(!ext->is_implemented()) {
990 continue;
991 }
992
993 // RFC 8446 4.1.2
994 // Including a "cookie" extension if one was provided in the
995 // HelloRetryRequest.
996 if(newext == Cookie::static_type()) {
997 continue;
998 }
999
1000 // RFC 8446 4.1.2
1001 // Optionally adding, removing, or changing the length of the
1002 // "padding" extension.
1003 //
1004 // TODO: implement the Padding extension
1005 // if(newext == Padding::static_type())
1006 // continue;
1007
1008 throw TLS_Exception(Alert::UnsupportedExtension, "Added an extension in updated Client Hello");
1009 }
1010 }
1011
1012 // RFC 8446 4.1.2
1013 // Removing the "early_data" extension (Section 4.2.10) if one was
1014 // present. Early data is not permitted after a HelloRetryRequest.
1015 if(new_ch.extensions().has<EarlyDataIndication>()) {
1016 throw TLS_Exception(Alert::IllegalParameter, "Updated Client Hello indicates early data");
1017 }
1018
1019 // TODO: Contents of extensions are not checked for update compatibility, see:
1020 //
1021 // RFC 8446 4.1.2
1022 // If a "key_share" extension was supplied in the HelloRetryRequest,
1023 // replacing the list of shares with a list containing a single
1024 // KeyShareEntry from the indicated group.
1025 //
1026 // Updating the "pre_shared_key" extension if present by recomputing
1027 // the "obfuscated_ticket_age" and binder values and (optionally)
1028 // removing any PSKs which are incompatible with the server's
1029 // indicated cipher suite.
1030 //
1031 // Optionally adding, removing, or changing the length of the
1032 // "padding" extension.
1033}
const Extensions & extensions() const
std::set< Extension_Code > extension_types() const
static Extension_Code static_type()
static Extension_Code static_type()

References Client_Hello_13(), Botan::TLS::Client_Hello::extension_types(), Botan::TLS::Client_Hello::extensions(), Botan::TLS::Extensions::get(), Botan::TLS::Extensions::has(), Botan::TLS::Client_Hello::m_data, Botan::TLS::Cookie::static_type(), and Botan::TLS::EarlyDataIndication::static_type().

◆ wire_type()

virtual Handshake_Type Botan::TLS::Handshake_Message::wire_type ( ) const
inlinevirtualinherited
Returns
the wire representation of the message's type

Reimplemented in Botan::TLS::Hello_Retry_Request.

Definition at line 39 of file tls_handshake_msg.h.

39 {
40 // Usually equal to the Handshake_Type enum value,
41 // with the exception of TLS 1.3 Hello Retry Request.
42 return type();
43 }

References type().

Referenced by Botan::TLS::Stream_Handshake_IO::send().

Member Data Documentation

◆ m_data


The documentation for this class was generated from the following files: