Botan 3.5.0
Crypto and TLS for C&
|
#include <tls_policy.h>
Public Member Functions | |
virtual bool | abort_connection_on_undesired_renegotiation () const |
virtual std::optional< std::vector< Signature_Scheme > > | acceptable_certificate_signature_schemes () const |
virtual bool | acceptable_ciphersuite (const Ciphersuite &suite) const |
virtual bool | acceptable_protocol_version (Protocol_Version version) const |
virtual std::vector< Signature_Scheme > | acceptable_signature_schemes () const |
virtual std::vector< Certificate_Type > | accepted_client_certificate_types () const |
virtual std::vector< Certificate_Type > | accepted_server_certificate_types () const |
virtual bool | allow_client_initiated_renegotiation () const |
virtual bool | allow_dtls12 () const |
virtual bool | allow_dtls_epoch0_restart () const |
virtual bool | allow_insecure_renegotiation () const |
virtual bool | allow_resumption_for_renegotiation () const |
virtual bool | allow_server_initiated_renegotiation () const |
virtual bool | allow_ssl_key_log_file () const |
virtual bool | allow_tls12 () const |
virtual bool | allow_tls13 () const |
virtual std::vector< std::string > | allowed_ciphers () const |
virtual std::vector< std::string > | allowed_key_exchange_methods () const |
virtual std::vector< std::string > | allowed_macs () const |
bool | allowed_signature_hash (std::string_view hash) const |
virtual std::vector< std::string > | allowed_signature_hashes () const |
bool | allowed_signature_method (std::string_view sig_method) const |
virtual std::vector< std::string > | allowed_signature_methods () const |
virtual std::vector< Signature_Scheme > | allowed_signature_schemes () const |
virtual void | check_peer_key_acceptable (const Public_Key &public_key) const |
virtual Group_Params | choose_key_exchange_group (const std::vector< Group_Params > &supported_by_peer, const std::vector< Group_Params > &offered_by_peer) const |
virtual std::vector< uint16_t > | ciphersuite_list (Protocol_Version version) const |
virtual Group_Params | default_dh_group () const |
virtual size_t | dtls_default_mtu () const |
virtual size_t | dtls_initial_timeout () const |
virtual size_t | dtls_maximum_timeout () const |
virtual bool | hash_hello_random () const |
virtual bool | hide_unknown_users () const |
virtual bool | include_time_in_hello_random () const |
virtual std::vector< Group_Params > | key_exchange_groups () const |
virtual std::vector< Group_Params > | key_exchange_groups_to_offer () const |
virtual Protocol_Version | latest_supported_version (bool datagram) const |
virtual size_t | maximum_certificate_chain_size () const |
virtual size_t | maximum_session_tickets_per_client_hello () const |
virtual size_t | minimum_dh_group_size () const |
virtual size_t | minimum_ecdh_group_size () const |
virtual size_t | minimum_ecdsa_group_size () const |
virtual size_t | minimum_rsa_bits () const |
virtual size_t | minimum_signature_strength () const |
virtual bool | negotiate_encrypt_then_mac () const |
virtual size_t | new_session_tickets_upon_handshake_success () const |
virtual bool | only_resume_with_exact_version () const |
virtual void | print (std::ostream &o) const |
virtual std::optional< uint16_t > | record_size_limit () const |
virtual bool | request_client_certificate_authentication () const |
virtual bool | require_cert_revocation_info () const |
virtual bool | require_client_certificate_authentication () const |
virtual bool | reuse_session_tickets () const |
virtual bool | server_uses_own_ciphersuite_preferences () const |
virtual std::chrono::seconds | session_ticket_lifetime () const |
virtual std::vector< uint16_t > | srtp_profiles () const |
virtual bool | support_cert_status_message () const |
virtual bool | tls_13_middlebox_compatibility_mode () const |
std::string | to_string () const |
virtual bool | use_ecc_point_compression () const |
virtual | ~Policy ()=default |
TLS Policy Base Class Inherit and overload as desired to suit local policy concerns
Definition at line 32 of file tls_policy.h.
|
virtualdefault |
|
virtual |
If true, a request to renegotiate will close the connection with a fatal alert. Otherwise, a warning alert is sent.
Definition at line 394 of file tls_policy.cpp.
|
virtual |
Definition at line 47 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().
|
virtual |
Allows policy to reject any ciphersuites which are undesirable for whatever reason without having to reimplement ciphersuite_list
Definition at line 305 of file tls_policy.cpp.
References allowed_ciphers(), allowed_macs(), Botan::TLS::Ciphersuite::cipher_algo(), Botan::TLS::Ciphersuite::mac_algo(), and Botan::value_exists().
Referenced by ciphersuite_list().
|
virtual |
Definition at line 266 of file tls_policy.cpp.
References allow_dtls12(), allow_tls12(), and allow_tls13().
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::highest_supported_version(), and latest_supported_version().
|
virtual |
Return a list of schemes we are willing to accept
Definition at line 43 of file tls_policy.cpp.
References allowed_signature_schemes().
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().
|
virtual |
Returns a list of accepted certificate types for client authentication in order of preference. See RFC 7250 and RFC 8446 4.4.2 for details. Defaults to X509 only.
Note that it is the application's responsibility to provide public keys and/or certificates according to the specification in this list via the Credentials_Manager.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 398 of file tls_policy.cpp.
References Botan::TLS::X509.
Referenced by Botan::TLS::Text_Policy::accepted_client_certificate_types(), Botan::TLS::Client_Hello_13::Client_Hello_13(), and print().
|
virtual |
Returns a list of accepted certificate types for server authentication in order of preference. See RFC 7250 and RFC 8446 4.4.2 for details. Defaults to X509 only.
Note that it is the application's responsibility to provide public keys and/or certificates according to the specification in this list via the Credentials_Manager.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 402 of file tls_policy.cpp.
References Botan::TLS::X509.
Referenced by Botan::TLS::Text_Policy::accepted_server_certificate_types(), Botan::TLS::Client_Hello_13::Client_Hello_13(), and print().
|
virtual |
Consulted by server side. If true, allows clients to initiate a new handshake
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 310 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::allow_client_initiated_renegotiation().
|
virtual |
Allow DTLS v1.2
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::Datagram_Policy, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 338 of file tls_policy.cpp.
Referenced by acceptable_protocol_version(), Botan::TLS::Text_Policy::allow_dtls12(), Botan::TLS::make_hello_random(), print(), and Botan::TLS::Supported_Versions::Supported_Versions().
|
virtual |
If true, then allow a DTLS client to restart a connection to the same server association as described in section 4.2.8 of the DTLS RFC
Definition at line 406 of file tls_policy.cpp.
Referenced by Botan::TLS::Channel_Impl_12::from_peer().
|
virtual |
Allow renegotiation even if the counterparty doesn't support the secure renegotiation extension.
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 318 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::allow_insecure_renegotiation(), and print().
|
virtual |
Definition at line 370 of file tls_policy.cpp.
Referenced by Botan::TLS::Channel_Impl_12::renegotiate().
|
virtual |
Consulted by client side. If true, allows servers to initiate a new handshake
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 314 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::allow_server_initiated_renegotiation(), and print().
|
virtual |
Allow ssl key log file
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 24 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::allow_ssl_key_log_file(), and print().
|
virtual |
Allow TLS v1.2
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::Datagram_Policy, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 322 of file tls_policy.cpp.
Referenced by acceptable_protocol_version(), Botan::TLS::Text_Policy::allow_tls12(), Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Client_Impl_13::Client_Impl_13(), Botan::TLS::make_hello_random(), print(), Botan::TLS::Server_Impl_13::Server_Impl_13(), and Botan::TLS::Supported_Versions::Supported_Versions().
|
virtual |
Allow TLS v1.3
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::Datagram_Policy, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 330 of file tls_policy.cpp.
Referenced by acceptable_protocol_version(), Botan::TLS::Text_Policy::allow_tls13(), print(), and Botan::TLS::Supported_Versions::Supported_Versions().
|
virtual |
Returns a list of ciphers we are willing to negotiate, in order of preference.
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, Botan::TLS::Strict_Policy, and Botan::TLS::Text_Policy.
Definition at line 52 of file tls_policy.cpp.
Referenced by acceptable_ciphersuite(), Botan::TLS::Text_Policy::allowed_ciphers(), ciphersuite_list(), and print().
|
virtual |
Returns a list of key exchange algorithms we are willing to use, in order of preference. Allowed values: DH, empty string (representing RSA using server certificate key)
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, Botan::TLS::Strict_Policy, and Botan::TLS::Text_Policy.
Definition at line 94 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::allowed_key_exchange_methods(), ciphersuite_list(), and print().
|
virtual |
Returns a list of MAC algorithms we are willing to use.
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::Datagram_Policy, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, Botan::TLS::Strict_Policy, and Botan::TLS::Text_Policy.
Definition at line 80 of file tls_policy.cpp.
Referenced by acceptable_ciphersuite(), Botan::TLS::Text_Policy::allowed_macs(), ciphersuite_list(), and print().
bool Botan::TLS::Policy::allowed_signature_hash | ( | std::string_view | hash | ) | const |
Definition at line 115 of file tls_policy.cpp.
References allowed_signature_hashes(), and Botan::value_exists().
Referenced by allowed_signature_schemes(), and Botan::TLS::Handshake_State::choose_sig_format().
|
virtual |
Returns a list of hash algorithms we are willing to use for signatures, in order of preference.
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, Botan::TLS::Strict_Policy, and Botan::TLS::Text_Policy.
Definition at line 72 of file tls_policy.cpp.
Referenced by allowed_signature_hash(), Botan::TLS::Text_Policy::allowed_signature_hashes(), and print().
bool Botan::TLS::Policy::allowed_signature_method | ( | std::string_view | sig_method | ) | const |
Definition at line 111 of file tls_policy.cpp.
References allowed_signature_methods(), and Botan::value_exists().
Referenced by allowed_signature_schemes(), Botan::TLS::Certificate_13::Certificate_13(), and Botan::TLS::Handshake_State::parse_sig_format().
|
virtual |
Returns a list of signature algorithms we are willing to use, in order of preference.
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 104 of file tls_policy.cpp.
Referenced by allowed_signature_method(), Botan::TLS::Text_Policy::allowed_signature_methods(), ciphersuite_list(), and print().
|
virtual |
Definition at line 28 of file tls_policy.cpp.
References Botan::TLS::Signature_Scheme::all_available_schemes(), allowed_signature_hash(), and allowed_signature_method().
Referenced by acceptable_signature_schemes(), Botan::TLS::Certificate_Verify_13::Certificate_Verify_13(), and Botan::TLS::Handshake_State::choose_sig_format().
|
virtual |
Throw an exception if you don't like the peer's key. Default impl checks the key size against minimum_rsa_bits, minimum_ecdsa_group_size, or minimum_ecdh_group_size depending on the key's type. Override if you'd like to perform some other kind of test on (or logging of) the peer's keys.
Definition at line 224 of file tls_policy.cpp.
References Botan::Asymmetric_Key::algo_name(), Botan::Public_Key::key_length(), minimum_dh_group_size(), minimum_ecdh_group_size(), minimum_ecdsa_group_size(), and minimum_rsa_bits().
Referenced by Botan::TLS::Certificate_13::Certificate_13(), Botan::TLS::Callbacks::tls_ephemeral_key_agreement(), Botan::TLS::Certificate_Verify_12::verify(), and Botan::TLS::Server_Key_Exchange::verify().
|
virtual |
Select a key exchange group to use, from the list of groups sent by the peer. In TLS 1.3 handshakes the peer might have provided cryptographic material for a subset of its available groups. Choosing a group for which no share was provided will result in an additional round trip. If none are acceptable, return Group_Params::NONE.
By default this will try to optimize for less round trips even if this results in the usage of a less preferred group.
Definition at line 123 of file tls_policy.cpp.
References key_exchange_groups(), and Botan::value_exists().
Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::TLS::Server_Hello_13::create(), and Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().
|
virtual |
Return allowed ciphersuites, in order of preference for the provided protocol version.
version | the exact protocol version to select supported and allowed ciphersuites for |
Definition at line 505 of file tls_policy.cpp.
References acceptable_ciphersuite(), Botan::TLS::Ciphersuite::all_known_ciphersuites(), allowed_ciphers(), allowed_key_exchange_methods(), allowed_macs(), allowed_signature_methods(), Botan::TLS::IMPLICIT, Botan::TLS::Protocol_Version::is_pre_tls_13(), and Botan::value_exists().
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().
|
virtual |
Definition at line 150 of file tls_policy.cpp.
References key_exchange_groups().
Referenced by Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().
|
virtual |
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 423 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::dtls_default_mtu().
|
virtual |
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 415 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::dtls_initial_timeout().
|
virtual |
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 419 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::dtls_maximum_timeout().
|
virtual |
Hash the RNG output for the client/server hello random. This is a pre-caution to avoid writing "raw" RNG output to the wire.
There's not normally a reason to disable this, except when deterministic output is required for testing.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 378 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::hash_hello_random(), Botan::TLS::make_hello_random(), and print().
|
virtual |
If this function returns false, unknown PSK identifiers will be rejected with an unknown_psk_identifier alert as soon as the non-existence is identified. Otherwise, a false identifier value will be used and the protocol allowed to proceed, causing the handshake to eventually fail without revealing that the username does not exist on this system.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 350 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::TLS::Text_Policy::hide_unknown_users(), and print().
|
virtual |
The protocol dictates that the first 32 bits of the random field are the current time in seconds. However this allows client fingerprinting attacks. Set to false to disable, in which case random bytes will be used instead.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 346 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::include_time_in_hello_random(), Botan::TLS::make_hello_random(), and print().
|
virtual |
Return list of ECC curves and FFDHE groups we are willing to use in order of preference.
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 163 of file tls_policy.cpp.
Referenced by choose_key_exchange_group(), Botan::TLS::Client_Hello_13::Client_Hello_13(), default_dh_group(), Botan::TLS::Encrypted_Extensions::Encrypted_Extensions(), Botan::TLS::Text_Policy::key_exchange_groups(), key_exchange_groups_to_offer(), and print().
|
virtual |
Return a list of groups to provide prepared key share offers in the initial client hello for. Groups in this list must be reflected in key_exchange_groups() and in the same order. By default this returns the most preferred group from key_exchange_groups(). If an empty list is returned, no prepared key share offers are sent and the decision of the group to use is left to the server.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 181 of file tls_policy.cpp.
References key_exchange_groups().
Referenced by Botan::TLS::Text_Policy::key_exchange_groups_to_offer(), and print().
|
virtual |
Returns the most recent protocol version we are willing to use, for either TLS or DTLS depending on datagram param. Shouldn't ever need to override this unless you want to allow a user to disable specific TLS versions.
Definition at line 286 of file tls_policy.cpp.
References acceptable_protocol_version().
|
virtual |
Definition at line 410 of file tls_policy.cpp.
Referenced by Botan::TLS::Certificate_12::Certificate_12(), and Botan::TLS::Certificate_13::Certificate_13().
|
virtual |
Defines the maximum number of session tickets a client might offer in a single resumption attempt. Must be greater than 0.
TODO: Currently, the TLS 1.3 client implementation supports exactly one ticket per handshake. RFC 8446 allows for an arbitrary amount, though.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 250 of file tls_policy.cpp.
Referenced by Botan::TLS::Session_Manager::find(), Botan::TLS::Text_Policy::maximum_session_tickets_per_client_hello(), and print().
|
virtual |
Return the minimum DH group size we're willing to use Default is currently 1024 (insecure), should be 2048
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 191 of file tls_policy.cpp.
Referenced by check_peer_key_acceptable(), Botan::TLS::Text_Policy::minimum_dh_group_size(), and print().
|
virtual |
Return the minimum ECDH group size we're willing to use for key exchange
Default 255, allowing x25519 and larger x25519 is the smallest curve we will negotiate P-521 is the largest
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 200 of file tls_policy.cpp.
Referenced by check_peer_key_acceptable(), Botan::TLS::Text_Policy::minimum_ecdh_group_size(), and print().
|
virtual |
For ECDSA authenticated ciphersuites, the smallest key size the client will accept. This policy is currently only enforced on the server by the client.
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 195 of file tls_policy.cpp.
Referenced by check_peer_key_acceptable(), and Botan::TLS::Text_Policy::minimum_ecdsa_group_size().
|
virtual |
Return the minimum bit size we're willing to accept for RSA key exchange or server signatures.
It does not place any requirements on the size of any RSA signature(s) which were used to check the server certificate. This is only concerned with the server's public key.
Default is 2048 which is smallest RSA key size still secure for medium term security.
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 213 of file tls_policy.cpp.
Referenced by check_peer_key_acceptable(), Botan::TLS::Text_Policy::minimum_rsa_bits(), and print().
|
virtual |
The minimum signature strength we will accept Returning 80 allows RSA 1024 and SHA-1. Values larger than 80 disable SHA-1 support. Returning 110 allows RSA 2048. Return 128 to force ECC (P-256) or large (~3000 bit) RSA keys. Default is 110
Reimplemented in Botan::TLS::BSI_TR_02102_2, Botan::TLS::NSA_Suite_B_128, Botan::TLS::NSA_Suite_B_192, and Botan::TLS::Text_Policy.
Definition at line 205 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::minimum_signature_strength(), print(), and Botan::TLS::Callbacks::tls_verify_cert_chain().
|
virtual |
Indicates whether the encrypt-then-MAC extension should be negotiated (RFC 7366)
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 358 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Text_Policy::negotiate_encrypt_then_mac(), print(), Botan::TLS::Server_Hello_12::Server_Hello_12(), and Botan::TLS::Server_Hello_12::Server_Hello_12().
|
virtual |
Return the number of new session tickets a TLS 1.3 server should issue automatically upon a successful handshake. Note that applications can use TLS::Server::send_new_session_tickets()
regardless of this policy.
For convenience (and compatibility with the TLS 1.2 behaviour), this returns '1' by default.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 262 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::new_session_tickets_upon_handshake_success(), and print().
|
virtual |
Definition at line 382 of file tls_policy.cpp.
|
virtual |
Convert this policy to a printable format.
o | stream to be printed to |
Definition at line 621 of file tls_policy.cpp.
References accepted_client_certificate_types(), accepted_server_certificate_types(), allow_dtls12(), allow_insecure_renegotiation(), allow_server_initiated_renegotiation(), allow_ssl_key_log_file(), allow_tls12(), allow_tls13(), allowed_ciphers(), allowed_key_exchange_methods(), allowed_macs(), allowed_signature_hashes(), allowed_signature_methods(), hash_hello_random(), hide_unknown_users(), include_time_in_hello_random(), key_exchange_groups(), key_exchange_groups_to_offer(), maximum_session_tickets_per_client_hello(), minimum_dh_group_size(), minimum_ecdh_group_size(), minimum_rsa_bits(), minimum_signature_strength(), negotiate_encrypt_then_mac(), new_session_tickets_upon_handshake_success(), record_size_limit(), reuse_session_tickets(), server_uses_own_ciphersuite_preferences(), session_ticket_lifetime(), support_cert_status_message(), and tls_13_middlebox_compatibility_mode().
Referenced by to_string().
|
virtual |
Defines the maximum TLS record length for TLS connections. This is based on the Record Size Limit extension described in RFC 8449. By default (i.e. if std::nullopt is returned), TLS clients will omit this extension altogether.
This value may be between 64 and 16385 (TLS 1.3) or 16384 (TLS 1.2).
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 362 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Encrypted_Extensions::Encrypted_Extensions(), and print().
|
virtual |
Indicate if client certificate authentication is requested. If true, then a cert will be requested.
Definition at line 390 of file tls_policy.cpp.
References require_client_certificate_authentication().
Referenced by Botan::TLS::Encrypted_Extensions::Encrypted_Extensions(), and Botan::TLS::Certificate_Request_13::maybe_create().
|
virtual |
Return if cert revocation info (CRL/OCSP) is required If true, validation will fail unless a valid CRL or OCSP response was examined.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 209 of file tls_policy.cpp.
Referenced by Botan::TLS::Text_Policy::require_cert_revocation_info(), and Botan::TLS::Callbacks::tls_verify_cert_chain().
|
virtual |
Indicate if client certificate authentication is required. If true, then a cert will be requested and if the client does not send a certificate the connection will be closed.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 386 of file tls_policy.cpp.
Referenced by request_client_certificate_authentication(), and Botan::TLS::Text_Policy::require_client_certificate_authentication().
|
virtual |
Decides whether stored session tickets should be used multiple times (until their lifetime runs out). This might allow passive observers to correlate connections (RFC 8446 Appendix C.4). This has no effect on TLS 1.2 resumptions based on session IDs as those are negotiated in the clear anyway.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 258 of file tls_policy.cpp.
Referenced by Botan::TLS::Session_Manager::find(), print(), and Botan::TLS::Text_Policy::reuse_session_tickets().
|
virtual |
Reimplemented in Botan::TLS::BSI_TR_02102_2, and Botan::TLS::Text_Policy.
Definition at line 354 of file tls_policy.cpp.
Referenced by print(), and Botan::TLS::Text_Policy::server_uses_own_ciphersuite_preferences().
|
virtual |
Return the allowed lifetime of a session ticket. If 0, session tickets do not expire until the session ticket key rolls over. For TLS 1.3 session tickets the lifetime must not be longer than seven days. Expired session tickets cannot be used to resume a session.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 254 of file tls_policy.cpp.
Referenced by print(), Botan::TLS::Session_Manager::retrieve(), and Botan::TLS::Text_Policy::session_ticket_lifetime().
|
virtual |
If this returns a non-empty vector, and DTLS is negotiated, then we will also attempt to negotiate the SRTP extension from RFC 5764 using the returned values as the profile ids.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 428 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Server_Hello_12::Server_Hello_12().
|
virtual |
Indicates whether certificate status messages should be supported
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 366 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_13::Client_Hello_13(), print(), Botan::TLS::Server_Hello_12::Server_Hello_12(), and Botan::TLS::Text_Policy::support_cert_status_message().
|
virtual |
Defines whether or not the middlebox compatibility mode should be used. Enabled by default.
RFC 8446 Appendix D.4 [This makes] the TLS 1.3 handshake resemble TLS 1.2 session resumption, which improves the chance of successfully connecting through middleboxes.
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 374 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Client_Impl_13::Client_Impl_13(), print(), and Botan::TLS::Text_Policy::tls_13_middlebox_compatibility_mode().
std::string Botan::TLS::Policy::to_string | ( | ) | const |
Convert this policy to a printable format. Same as calling print
on a ostringstream and reading o.str()
Definition at line 662 of file tls_policy.cpp.
References print().
|
virtual |
Request that ECC curve points are sent compressed
Reimplemented in Botan::TLS::Text_Policy.
Definition at line 119 of file tls_policy.cpp.
Referenced by Botan::TLS::Client_Hello_13::Client_Hello_13(), Botan::TLS::Server_Hello_12::Server_Hello_12(), Botan::TLS::Server_Hello_12::Server_Hello_12(), and Botan::TLS::Text_Policy::use_ecc_point_compression().