Botan::TLS::PSK Class Reference

#include <tls_extensions_13.h>

Inheritance diagram for Botan::TLS::PSK:

Public Member Functions
void	calculate_binders (const Transcript_Hash_State &truncated_transcript_hash)
bool	empty () const override
void	filter (const Ciphersuite &cipher)
virtual bool	is_implemented () const
	PSK (std::optional< Session_with_Handle > &session_to_resume, std::vector< ExternalPSK > psks, Callbacks &callbacks)
	PSK (TLS_Data_Reader &reader, uint16_t extension_size, Handshake_Type message_type)
std::unique_ptr< PSK >	select_offered_psk (std::string_view host, const Ciphersuite &cipher, Session_Manager &session_mgr, Credentials_Manager &credentials_mgr, Callbacks &callbacks, const Policy &policy)
std::vector< uint8_t >	serialize (Connection_Side side) const override
std::pair< std::optional< std::string >, std::unique_ptr< Cipher_State > >	take_selected_psk_info (const PSK &server_psk, const Ciphersuite &cipher)
std::variant< Session, ExternalPSK >	take_session_to_resume_or_psk ()
Extension_Code	type () const override
bool	validate_binder (const PSK &server_psk, const std::vector< uint8_t > &binder) const
	~PSK () override

Static Public Member Functions
static Extension_Code	static_type ()

Detailed Description

Pre-Shared Key extension from RFC 8446 4.2.11

Definition at line 110 of file tls_extensions_13.h.

Constructor & Destructor Documentation

PSK() [1/2]

Botan::TLS::PSK::PSK	(	TLS_Data_Reader &	reader,
		uint16_t	extension_size,
		Handshake_Type	message_type )

Definition at line 142 of file tls_extensions_psk.cpp.

                                                                                      {
   if(message_type == Handshake_Type::ServerHello) {
      if(extension_size != 2) {
         throw TLS_Exception(Alert::DecodeError, "Server provided a malformed PSK extension");
      }
 
      const uint16_t selected_id = reader.get_uint16_t();
      m_impl = std::make_unique<PSK_Internal>(Server_PSK(selected_id));
   } else if(message_type == Handshake_Type::ClientHello) {
      const auto identities_length = reader.get_uint16_t();
      const auto identities_offset = reader.read_so_far();
 
      std::vector<PskIdentity> psk_identities;
      while(reader.has_remaining() && (reader.read_so_far() - identities_offset) < identities_length) {
         /* Per RFC 8446 PskIdentity is
 
         struct {
            opaque identity<1..2^16-1>;
            uint32 obfuscated_ticket_age;
         } PskIdentity;
 
         so we should reject an empty identity. However BoGo seems to expect
         being able to send us such an identity, so for now we accept it.
         */
 
         auto identity = reader.get_tls_length_value(2);
         const auto obfuscated_ticket_age = reader.get_uint32_t();
         psk_identities.emplace_back(std::move(identity), obfuscated_ticket_age);
      }
 
      if(psk_identities.empty()) {
         throw TLS_Exception(Alert::DecodeError, "Empty PSK list");
      }
 
      if(reader.read_so_far() - identities_offset != identities_length) {
         throw TLS_Exception(Alert::DecodeError, "Inconsistent PSK identity list");
      }
 
      const auto binders_length = reader.get_uint16_t();
      const auto binders_offset = reader.read_so_far();
 
      if(binders_length == 0) {
         throw TLS_Exception(Alert::DecodeError, "Empty PSK binders list");
      }
 
      std::vector<Client_PSK> psks;
      for(auto& psk_identity : psk_identities) {
         if(!reader.has_remaining() || reader.read_so_far() - binders_offset >= binders_length) {
            throw TLS_Exception(Alert::IllegalParameter, "Not enough PSK binders");
         }
 
         // RFC 8446 4.2.11 declares PskBinderEntry opaque<32..255>, but we accept any
         // 0..255 length here and let validate_binder reject, which yields a bad_record_mac
         // alert rather than decode_error. BoringSSL behaves the same way and BoGo has
         // tests that specifically expect this.
 
         psks.emplace_back(std::move(psk_identity), reader.get_tls_length_value(1));
      }
 
      if(reader.read_so_far() - binders_offset != binders_length) {
         throw TLS_Exception(Alert::IllegalParameter, "Too many PSK binders");
      }
 
      m_impl = std::make_unique<PSK_Internal>(std::move(psks));
   } else {
      throw TLS_Exception(Alert::DecodeError, "Found a PSK extension in an unexpected handshake message");
   }
}

References Botan::TLS::ClientHello, Botan::TLS::TLS_Data_Reader::get_tls_length_value(), Botan::TLS::TLS_Data_Reader::get_uint16_t(), Botan::TLS::TLS_Data_Reader::get_uint32_t(), Botan::TLS::TLS_Data_Reader::has_remaining(), Botan::TLS::TLS_Data_Reader::read_so_far(), and Botan::TLS::ServerHello.

Referenced by select_offered_psk(), take_selected_psk_info(), validate_binder(), and ~PSK().

PSK() [2/2]

Botan::TLS::PSK::PSK	(	std::optional< Session_with_Handle > &	session_to_resume,
		std::vector< ExternalPSK >	psks,
		Callbacks &	callbacks )

Creates a PSK extension with a TLS 1.3 session object containing a master_secret. Note that it will extract that secret from the session, and won't create a copy of it.

Parameters

session_to_resume	the session to be resumed; note that the master secret will be taken away from the session object.
psks	a list of non-resumption PSKs that should be offered to the server
callbacks	the application's callbacks

Definition at line 211 of file tls_extensions_psk.cpp.

                                                                                                               {
   std::vector<Client_PSK> cpsk;
 
   if(session_to_resume.has_value()) {
      cpsk.emplace_back(session_to_resume.value(), callbacks.tls_current_timestamp());
   }
 
   for(auto&& psk : psks) {
      cpsk.emplace_back(std::move(psk));
   }
 
   m_impl = std::make_unique<PSK_Internal>(std::move(cpsk));
}

References Botan::TLS::Callbacks::tls_current_timestamp().

~PSK()

Botan::TLS::PSK::~PSK ( )

overridedefault

References calculate_binders(), PSK(), and validate_binder().

Member Function Documentation

calculate_binders()

void Botan::TLS::PSK::calculate_binders

(

const Transcript_Hash_State &

truncated_transcript_hash

)

Definition at line 435 of file tls_extensions_psk.cpp.

                                                                                  {
   BOTAN_ASSERT_NOMSG(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
   for(auto& psk : std::get<std::vector<Client_PSK>>(m_impl->psk)) {
      auto tth = truncated_transcript_hash.clone();
      const auto& cipher_state = psk.cipher_state();
      tth.set_algorithm(cipher_state.hash_algorithm());
      psk.set_binder(cipher_state.psk_binder_mac(tth.truncated()));
   }
}

References BOTAN_ASSERT_NOMSG, Botan::TLS::Transcript_Hash_State::clone(), and Botan::TLS::Transcript_Hash_State::set_algorithm().

Referenced by ~PSK().

empty()

bool Botan::TLS::PSK::empty ( ) const

overridevirtual

Returns

if we should encode this extension or not

Implements Botan::TLS::Extension.

Definition at line 233 of file tls_extensions_psk.cpp.

                      {
   if(std::holds_alternative<Server_PSK>(m_impl->psk)) {
      return false;
   }
 
   BOTAN_ASSERT_NOMSG(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
   return std::get<std::vector<Client_PSK>>(m_impl->psk).empty();
}

References BOTAN_ASSERT_NOMSG, and empty().

Referenced by empty().

filter()

void Botan::TLS::PSK::filter

(

const Ciphersuite &

cipher

)

Remove PSK identities from the list in m_psk that are not compatible with the passed in cipher suite. This is useful to react to Hello Retry Requests. See RFC 8446 4.1.4.

Definition at line 371 of file tls_extensions_psk.cpp.

                                          {
   BOTAN_STATE_CHECK(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
   auto& psks = std::get<std::vector<Client_PSK>>(m_impl->psk);
 
   const auto r = std::remove_if(psks.begin(), psks.end(), [&](const auto& psk) {
      const auto& cipher_state = psk.cipher_state();
      return !cipher_state.is_compatible_with(cipher);
   });
   psks.erase(r, psks.end());
}

References BOTAN_STATE_CHECK.

is_implemented()

virtual bool Botan::TLS::Extension::is_implemented ( ) const

inlinevirtualinherited

Returns

true if this extension is known and implemented by Botan

Reimplemented in Botan::TLS::Unknown_Extension.

Definition at line 100 of file tls_extensions.h.

{ return true; }

select_offered_psk()

std::unique_ptr< PSK > Botan::TLS::PSK::select_offered_psk	(	std::string_view	host,
		const Ciphersuite &	cipher,
		Session_Manager &	session_mgr,
		Credentials_Manager &	credentials_mgr,
		Callbacks &	callbacks,
		const Policy &	policy )

Selects one of the offered PSKs that is compatible with cipher.

Return values

PSK	extension object that can be added to the Server Hello response
std::nullptr	if no PSK offered by the client is convenient

Definition at line 286 of file tls_extensions_psk.cpp.

                                                                   {
   BOTAN_STATE_CHECK(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
 
   auto& psks = std::get<std::vector<Client_PSK>>(m_impl->psk);
 
   //
   // PSK for Session Resumption
   //
   std::vector<PskIdentity> psk_identities;
   std::transform(
      psks.begin(), psks.end(), std::back_inserter(psk_identities), [&](const auto& psk) { return psk.identity(); });
   if(auto selected_session =
         session_mgr.choose_from_offered_tickets(psk_identities, cipher.prf_algo(), callbacks, policy)) {
      auto& [session, psk_index] = selected_session.value();
 
      // Refuse to resume a ticket across SNI: a session minted for one
      // virtual host must not be presentable against another. Treat as a
      // cache miss and fall through to the external PSK path rather than
      // failing the connection.
      if(session.server_info().hostname() == host) {
         // RFC 8446 4.6.1
         //    Any ticket MUST only be resumed with a cipher suite that has the
         //    same KDF hash algorithm as that used to establish the original
         //    connection.
         if(session.ciphersuite().prf_algo() != cipher.prf_algo()) {
            throw TLS_Exception(Alert::InternalError,
                                "Application chose a ticket that is not compatible with the negotiated ciphersuite");
         }
 
         return std::unique_ptr<PSK>(new PSK(std::move(session), psk_index));
      }
   }
 
   //
   // Externally provided PSKs
   //
   std::vector<std::string> psk_ids;
   std::transform(psks.begin(), psks.end(), std::back_inserter(psk_ids), [&](const auto& psk) {
      return psk.identity().identity_as_string();
   });
   if(auto selected_psk =
         credentials_mgr.choose_preshared_key(host, Connection_Side::Server, psk_ids, cipher.prf_algo())) {
      auto& psk = selected_psk.value();
 
      // RFC 8446 4.2.11
      //    Each PSK is associated with a single Hash algorithm. [...]
      //    The server MUST ensure that it selects a compatible PSK (if any)
      //    and cipher suite.
      if(psk.prf_algo() != cipher.prf_algo()) {
         throw TLS_Exception(Alert::InternalError,
                             "Application chose a PSK that is not compatible with the negotiated ciphersuite");
      }
 
      const auto selected_itr =
         std::find_if(psk_identities.begin(), psk_identities.end(), [&](const auto& offered_psk) {
            return offered_psk.identity_as_string() == psk.identity();
         });
      if(selected_itr == psk_identities.end()) {
         throw TLS_Exception(Alert::InternalError,
                             "Application provided a PSK with an identity that was not offered by the client");
      }
 
      // When implementing a server that works with PSKs exclusively, we might
      // want to take TLS::Policy::hide_unknown_users() into account and
      // obfuscate malicious "identity guesses" by generating a random PSK and
      // letting the handshake continue.
      //
      // Currently, we do not have a notion of "a server that solely supports
      // PSK handshakes". However, such applications are free to implement such
      // a mitigation in their override of Credentials_Manager::choose_preshared_key().
      //
      // TODO: Take RFC 8446 Appendix E.6 into account, especially when
      //       implementing PSK_KE (aka. PSK-only mode).
      return std::unique_ptr<PSK>(
         new PSK(std::move(psk), static_cast<uint16_t>(std::distance(psk_identities.begin(), selected_itr))));
   }
 
   return nullptr;
}

References BOTAN_STATE_CHECK, Botan::TLS::Session_Manager::choose_from_offered_tickets(), Botan::Credentials_Manager::choose_preshared_key(), Botan::TLS::Ciphersuite::prf_algo(), PSK(), and Botan::TLS::Server.

serialize()

std::vector< uint8_t > Botan::TLS::PSK::serialize ( Connection_Side whoami ) const

overridevirtual

Returns

serialized binary for the extension

Implements Botan::TLS::Extension.

Definition at line 396 of file tls_extensions_psk.cpp.

                                                            {
   std::vector<uint8_t> result;
 
   std::visit(overloaded{
                 [&](const Server_PSK& psk) {
                    BOTAN_STATE_CHECK(side == Connection_Side::Server);
                    result.reserve(2);
                    const uint16_t id = psk.selected_identity();
                    result.push_back(get_byte<0>(id));
                    result.push_back(get_byte<1>(id));
                 },
                 [&](const std::vector<Client_PSK>& psks) {
                    BOTAN_STATE_CHECK(side == Connection_Side::Client);
 
                    std::vector<uint8_t> identities;
                    std::vector<uint8_t> binders;
                    for(const auto& psk : psks) {
                       const auto& psk_identity = psk.identity();
                       append_tls_length_value(identities, psk_identity.identity(), 2);
 
                       const uint32_t obfuscated_ticket_age = psk_identity.obfuscated_age();
                       identities.push_back(get_byte<0>(obfuscated_ticket_age));
                       identities.push_back(get_byte<1>(obfuscated_ticket_age));
                       identities.push_back(get_byte<2>(obfuscated_ticket_age));
                       identities.push_back(get_byte<3>(obfuscated_ticket_age));
 
                       append_tls_length_value(binders, psk.binder(), 1);
                    }
 
                    append_tls_length_value(result, identities, 2);
                    append_tls_length_value(result, binders, 2);
                 },
              },
              m_impl->psk);
 
   return result;
}

References Botan::TLS::append_tls_length_value(), BOTAN_STATE_CHECK, Botan::TLS::Client, Botan::get_byte(), and Botan::TLS::Server.

static_type()

Extension_Code Botan::TLS::PSK::static_type ( )

inlinestatic

Definition at line 112 of file tls_extensions_13.h.

{ return Extension_Code::PresharedKey; }

References Botan::TLS::PresharedKey.

Referenced by type().

take_selected_psk_info()

std::pair< std::optional< std::string >, std::unique_ptr< Cipher_State > > Botan::TLS::PSK::take_selected_psk_info	(	const PSK &	server_psk,
		const Ciphersuite &	cipher )

Returns the PSK identity (in case of an externally provided PSK) and the cipher state representing the PSK selected by the server. Note that this destructs the list of offered PSKs and its cipher states and must therefore not be called more than once.

Note

Technically, PSKs used for resumption also carry an identity. Though, typically, this is an opaque value meaningful only to the peer and of no authoritative value for the user. We therefore report the identity of externally provided PSKs only.

Definition at line 242 of file tls_extensions_psk.cpp.

                                                     {
   BOTAN_STATE_CHECK(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
   BOTAN_STATE_CHECK(std::holds_alternative<Server_PSK>(server_psk.m_impl->psk));
 
   const auto id = std::get<Server_PSK>(server_psk.m_impl->psk).selected_identity();
   auto& ids = std::get<std::vector<Client_PSK>>(m_impl->psk);
 
   // RFC 8446 4.2.11
   //    Clients MUST verify that the server's selected_identity is within the
   //    range supplied by the client, [...].  If these values are not
   //    consistent, the client MUST abort the handshake with an
   //    "illegal_parameter" alert.
   if(id >= ids.size()) {
      throw TLS_Exception(Alert::IllegalParameter, "PSK identity selected by server is out of bounds");
   }
 
   auto& selected_psk = ids.at(id);
   auto cipher_state = selected_psk.take_cipher_state();
 
   BOTAN_ASSERT_NONNULL(cipher_state);
 
   auto psk_id = [&]() -> std::optional<std::string> {
      if(selected_psk.is_resumption()) {
         return std::nullopt;
      }
      return selected_psk.identity().identity_as_string();
   }();
 
   // destroy cipher states and PSKs that were not selected by the server
   ids.clear();
 
   // RFC 8446 4.2.11
   //    Clients MUST verify that [...] the server selected a cipher suite
   //    indicating a Hash associated with the PSK [...].  If these values
   //    are not consistent, the client MUST abort the handshake with an
   //   "illegal_parameter" alert.
   if(!cipher_state->is_compatible_with(cipher)) {
      throw TLS_Exception(Alert::IllegalParameter, "PSK and ciphersuite selected by server are not compatible");
   }
 
   return {std::move(psk_id), std::move(cipher_state)};
}

References BOTAN_ASSERT_NONNULL, BOTAN_STATE_CHECK, and PSK().

take_session_to_resume_or_psk()

std::variant< Session, ExternalPSK > Botan::TLS::PSK::take_session_to_resume_or_psk

(

)

Pulls the preshared key or the Session to resume from a PSK extension in Server Hello.

Definition at line 382 of file tls_extensions_psk.cpp.

                                                                    {
   BOTAN_STATE_CHECK(std::holds_alternative<Server_PSK>(m_impl->psk));
 
   return std::visit(
      [](auto out) -> std::variant<Session, ExternalPSK> {
         if constexpr(std::is_same_v<decltype(out), std::monostate>) {
            throw TLS_Exception(AlertType::InternalError, "cannot extract an empty PSK");
         } else {
            return out;
         }
      },
      std::get<Server_PSK>(m_impl->psk).take_session_to_resume_or_psk());
}

References BOTAN_STATE_CHECK, and Botan::TLS::InternalError.

type()

Extension_Code Botan::TLS::PSK::type ( ) const

inlineoverridevirtual

Returns

code number of the extension

Implements Botan::TLS::Extension.

Definition at line 114 of file tls_extensions_13.h.

{ return static_type(); }

References static_type().

validate_binder()

bool Botan::TLS::PSK::validate_binder	(	const PSK &	server_psk,
		const std::vector< uint8_t > &	binder ) const

Definition at line 445 of file tls_extensions_psk.cpp.

                                                                                       {
   BOTAN_STATE_CHECK(std::holds_alternative<std::vector<Client_PSK>>(m_impl->psk));
   BOTAN_STATE_CHECK(std::holds_alternative<Server_PSK>(server_psk.m_impl->psk));
 
   const uint16_t index = std::get<Server_PSK>(server_psk.m_impl->psk).selected_identity();
   const auto& psks = std::get<std::vector<Client_PSK>>(m_impl->psk);
 
   BOTAN_STATE_CHECK(index < psks.size());
   const auto& expected_binder = psks[index].binder();
   return CT::is_equal<uint8_t>(binder, expected_binder).as_bool();
}

References BOTAN_STATE_CHECK, Botan::CT::is_equal(), and PSK().

Referenced by ~PSK().

---

The documentation for this class was generated from the following files:

• src/lib/tls/tls13/tls_extensions_13.h
• src/lib/tls/tls13/tls_extensions_psk.cpp