Botan 2.19.1
Crypto and TLS for C&
Public Member Functions | Protected Member Functions | List of all members
Botan::TLS::Text_Policy Class Reference

#include <tls_policy.h>

Inheritance diagram for Botan::TLS::Text_Policy:
Botan::TLS::Policy

Public Member Functions

virtual bool abort_connection_on_undesired_renegotiation () const
 
virtual bool acceptable_ciphersuite (const Ciphersuite &suite) const
 
virtual bool acceptable_protocol_version (Protocol_Version version) const
 
bool allow_client_initiated_renegotiation () const override
 
bool allow_dtls10 () const override
 
bool allow_dtls12 () const override
 
virtual bool allow_dtls_epoch0_restart () const
 
bool allow_insecure_renegotiation () const override
 
virtual bool allow_resumption_for_renegotiation () const
 
bool allow_server_initiated_renegotiation () const override
 
bool allow_tls10 () const override
 
bool allow_tls11 () const override
 
bool allow_tls12 () const override
 
std::vector< std::string > allowed_ciphers () const override
 
std::vector< std::string > allowed_key_exchange_methods () const override
 
std::vector< std::string > allowed_macs () const override
 
bool allowed_signature_hash (const std::string &hash) const
 
std::vector< std::string > allowed_signature_hashes () const override
 
bool allowed_signature_method (const std::string &sig_method) const
 
std::vector< std::string > allowed_signature_methods () const override
 
virtual std::vector< Signature_Schemeallowed_signature_schemes () const
 
virtual void check_peer_key_acceptable (const Public_Key &public_key) const
 
virtual Group_Params choose_key_exchange_group (const std::vector< Group_Params > &peer_groups) const
 
virtual std::vector< uint16_t > ciphersuite_list (Protocol_Version version, bool have_srp) const
 
virtual Group_Params default_dh_group () const
 
size_t dtls_default_mtu () const override
 
size_t dtls_initial_timeout () const override
 
size_t dtls_maximum_timeout () const override
 
bool hide_unknown_users () const override
 
bool include_time_in_hello_random () const override
 
std::vector< Group_Paramskey_exchange_groups () const override
 
virtual Protocol_Version latest_supported_version (bool datagram) const
 
virtual size_t maximum_certificate_chain_size () const
 
size_t minimum_dh_group_size () const override
 
virtual size_t minimum_dsa_group_size () const
 
size_t minimum_ecdh_group_size () const override
 
size_t minimum_ecdsa_group_size () const override
 
size_t minimum_rsa_bits () const override
 
size_t minimum_signature_strength () const override
 
bool negotiate_encrypt_then_mac () const override
 
virtual bool only_resume_with_exact_version () const
 
virtual void print (std::ostream &o) const
 
virtual bool request_client_certificate_authentication () const
 
bool require_cert_revocation_info () const override
 
bool require_client_certificate_authentication () const override
 
bool send_fallback_scsv (Protocol_Version version) const override
 
bool server_uses_own_ciphersuite_preferences () const override
 
uint32_t session_ticket_lifetime () const override
 
void set (const std::string &k, const std::string &v)
 
std::vector< uint16_t > srtp_profiles () const override
 
bool support_cert_status_message () const override
 
 Text_Policy (const std::string &s)
 
 Text_Policy (std::istream &in)
 
std::string to_string () const
 
bool use_ecc_point_compression () const override
 

Protected Member Functions

bool get_bool (const std::string &key, bool def) const
 
size_t get_len (const std::string &key, size_t def) const
 
std::vector< std::string > get_list (const std::string &key, const std::vector< std::string > &def) const
 
std::string get_str (const std::string &key, const std::string &def="") const
 
bool set_value (const std::string &key, const std::string &val, bool overwrite)
 

Detailed Description

Definition at line 520 of file tls_policy.h.

Constructor & Destructor Documentation

◆ Text_Policy() [1/2]

Botan::TLS::Text_Policy::Text_Policy ( const std::string &  s)
explicit

Definition at line 237 of file tls_text_policy.cpp.

238 {
239 std::istringstream iss(s);
240 m_kv = read_cfg(iss);
241 }
std::map< std::string, std::string > read_cfg(std::istream &is)
Definition: read_cfg.cpp:28

References Botan::read_cfg().

◆ Text_Policy() [2/2]

Botan::TLS::Text_Policy::Text_Policy ( std::istream &  in)
explicit

Definition at line 243 of file tls_text_policy.cpp.

243 : m_kv(read_cfg(in))
244 {}

Member Function Documentation

◆ abort_connection_on_undesired_renegotiation()

bool Botan::TLS::Policy::abort_connection_on_undesired_renegotiation ( ) const
virtualinherited

If true, a request to renegotiate will close the connection with a fatal alert. Otherwise, a warning alert is sent.

Definition at line 349 of file tls_policy.cpp.

349{ return false; }

◆ acceptable_ciphersuite()

bool Botan::TLS::Policy::acceptable_ciphersuite ( const Ciphersuite suite) const
virtualinherited

Allows policy to reject any ciphersuites which are undesirable for whatever reason without having to reimplement ciphersuite_list

Definition at line 326 of file tls_policy.cpp.

327 {
328 return value_exists(allowed_ciphers(), ciphersuite.cipher_algo()) &&
329 value_exists(allowed_macs(), ciphersuite.mac_algo());
330 }
virtual std::vector< std::string > allowed_macs() const
Definition: tls_policy.cpp:77
virtual std::vector< std::string > allowed_ciphers() const
Definition: tls_policy.cpp:42
bool value_exists(const std::vector< T > &vec, const T &val)
Definition: stl_util.h:86

References Botan::TLS::Policy::allowed_ciphers(), Botan::TLS::Policy::allowed_macs(), Botan::TLS::Ciphersuite::cipher_algo(), Botan::TLS::Ciphersuite::mac_algo(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::ciphersuite_list().

◆ acceptable_protocol_version()

bool Botan::TLS::Policy::acceptable_protocol_version ( Protocol_Version  version) const
virtualinherited
Returns
true if and only if we are willing to accept this version Default accepts TLS v1.0 and later or DTLS v1.2 or later.

Definition at line 278 of file tls_policy.cpp.

279 {
280 if(version == Protocol_Version::TLS_V12 && allow_tls12())
281 return true;
282
283 if(version == Protocol_Version::DTLS_V12 && allow_dtls12())
284 return true;
285
286#if defined(BOTAN_HAS_TLS_V10)
287
288 if(version == Protocol_Version::TLS_V11 && allow_tls11())
289 return true;
290 if(version == Protocol_Version::TLS_V10 && allow_tls10())
291 return true;
292 if(version == Protocol_Version::DTLS_V10 && allow_dtls10())
293 return true;
294
295#endif
296
297 return false;
298 }
virtual bool allow_tls12() const
Definition: tls_policy.cpp:337
virtual bool allow_dtls10() const
Definition: tls_policy.cpp:338
virtual bool allow_tls10() const
Definition: tls_policy.cpp:335
virtual bool allow_tls11() const
Definition: tls_policy.cpp:336
virtual bool allow_dtls12() const
Definition: tls_policy.cpp:339

References Botan::TLS::Policy::allow_dtls10(), Botan::TLS::Policy::allow_dtls12(), Botan::TLS::Policy::allow_tls10(), Botan::TLS::Policy::allow_tls11(), Botan::TLS::Policy::allow_tls12(), Botan::TLS::Protocol_Version::DTLS_V10, Botan::TLS::Protocol_Version::DTLS_V12, Botan::TLS::Protocol_Version::TLS_V10, Botan::TLS::Protocol_Version::TLS_V11, and Botan::TLS::Protocol_Version::TLS_V12.

Referenced by Botan::TLS::Client_Hello::Client_Hello(), and Botan::TLS::Policy::latest_supported_version().

◆ allow_client_initiated_renegotiation()

bool Botan::TLS::Text_Policy::allow_client_initiated_renegotiation ( ) const
overridevirtual

Consulted by server side. If true, allows clients to initiate a new handshake

Reimplemented from Botan::TLS::Policy.

Definition at line 88 of file tls_text_policy.cpp.

89 {
90 return get_bool("allow_client_initiated_renegotiation", Policy::allow_client_initiated_renegotiation());
91 }
virtual bool allow_client_initiated_renegotiation() const
Definition: tls_policy.cpp:332
bool get_bool(const std::string &key, bool def) const

References Botan::TLS::Policy::allow_client_initiated_renegotiation(), and get_bool().

◆ allow_dtls10()

bool Botan::TLS::Text_Policy::allow_dtls10 ( ) const
overridevirtual

Allow DTLS v1.0

Reimplemented from Botan::TLS::Policy.

Definition at line 63 of file tls_text_policy.cpp.

64 {
65 return get_bool("allow_dtls10", Policy::allow_dtls10());
66 }

References Botan::TLS::Policy::allow_dtls10(), and get_bool().

◆ allow_dtls12()

bool Botan::TLS::Text_Policy::allow_dtls12 ( ) const
overridevirtual

Allow DTLS v1.2

Reimplemented from Botan::TLS::Policy.

Definition at line 68 of file tls_text_policy.cpp.

69 {
70 return get_bool("allow_dtls12", Policy::allow_dtls12());
71 }

References Botan::TLS::Policy::allow_dtls12(), and get_bool().

◆ allow_dtls_epoch0_restart()

bool Botan::TLS::Policy::allow_dtls_epoch0_restart ( ) const
virtualinherited

If true, then allow a DTLS client to restart a connection to the same server association as described in section 4.2.8 of the DTLS RFC

Definition at line 350 of file tls_policy.cpp.

350{ return false; }

Referenced by Botan::TLS::Channel::received_data().

◆ allow_insecure_renegotiation()

bool Botan::TLS::Text_Policy::allow_insecure_renegotiation ( ) const
overridevirtual

Allow renegotiation even if the counterparty doesn't support the secure renegotiation extension.

Warning
Changing this to true exposes you to injected plaintext attacks. Read RFC 5746 for background.

Reimplemented from Botan::TLS::Policy.

Definition at line 73 of file tls_text_policy.cpp.

74 {
75 return get_bool("allow_insecure_renegotiation", Policy::allow_insecure_renegotiation());
76 }
virtual bool allow_insecure_renegotiation() const
Definition: tls_policy.cpp:334

References Botan::TLS::Policy::allow_insecure_renegotiation(), and get_bool().

◆ allow_resumption_for_renegotiation()

bool Botan::TLS::Policy::allow_resumption_for_renegotiation ( ) const
virtualinherited

Definition at line 345 of file tls_policy.cpp.

345{ return true; }

Referenced by Botan::TLS::Channel::renegotiate().

◆ allow_server_initiated_renegotiation()

bool Botan::TLS::Text_Policy::allow_server_initiated_renegotiation ( ) const
overridevirtual

Consulted by client side. If true, allows servers to initiate a new handshake

Reimplemented from Botan::TLS::Policy.

Definition at line 93 of file tls_text_policy.cpp.

94 {
95 return get_bool("allow_server_initiated_renegotiation", Policy::allow_server_initiated_renegotiation());
96 }
virtual bool allow_server_initiated_renegotiation() const
Definition: tls_policy.cpp:333

References Botan::TLS::Policy::allow_server_initiated_renegotiation(), and get_bool().

◆ allow_tls10()

bool Botan::TLS::Text_Policy::allow_tls10 ( ) const
overridevirtual

Allow TLS v1.0

Reimplemented from Botan::TLS::Policy.

Definition at line 48 of file tls_text_policy.cpp.

49 {
50 return get_bool("allow_tls10", Policy::allow_tls10());
51 }

References Botan::TLS::Policy::allow_tls10(), and get_bool().

◆ allow_tls11()

bool Botan::TLS::Text_Policy::allow_tls11 ( ) const
overridevirtual

Allow TLS v1.1

Reimplemented from Botan::TLS::Policy.

Definition at line 53 of file tls_text_policy.cpp.

54 {
55 return get_bool("allow_tls11", Policy::allow_tls11());
56 }

References Botan::TLS::Policy::allow_tls11(), and get_bool().

◆ allow_tls12()

bool Botan::TLS::Text_Policy::allow_tls12 ( ) const
overridevirtual

Allow TLS v1.2

Reimplemented from Botan::TLS::Policy.

Definition at line 58 of file tls_text_policy.cpp.

59 {
60 return get_bool("allow_tls12", Policy::allow_tls12());
61 }

References Botan::TLS::Policy::allow_tls12(), and get_bool().

◆ allowed_ciphers()

std::vector< std::string > Botan::TLS::Text_Policy::allowed_ciphers ( ) const
overridevirtual

Returns a list of ciphers we are willing to negotiate, in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 18 of file tls_text_policy.cpp.

19 {
20 return get_list("ciphers", Policy::allowed_ciphers());
21 }
std::vector< std::string > get_list(const std::string &key, const std::vector< std::string > &def) const

References Botan::TLS::Policy::allowed_ciphers(), and get_list().

◆ allowed_key_exchange_methods()

std::vector< std::string > Botan::TLS::Text_Policy::allowed_key_exchange_methods ( ) const
overridevirtual

Returns a list of key exchange algorithms we are willing to use, in order of preference. Allowed values: DH, empty string (representing RSA using server certificate key)

Reimplemented from Botan::TLS::Policy.

Definition at line 33 of file tls_text_policy.cpp.

34 {
35 return get_list("key_exchange_methods", Policy::allowed_key_exchange_methods());
36 }
virtual std::vector< std::string > allowed_key_exchange_methods() const
Definition: tls_policy.cpp:92

References Botan::TLS::Policy::allowed_key_exchange_methods(), and get_list().

◆ allowed_macs()

std::vector< std::string > Botan::TLS::Text_Policy::allowed_macs ( ) const
overridevirtual

Returns a list of MAC algorithms we are willing to use.

Reimplemented from Botan::TLS::Policy.

Definition at line 28 of file tls_text_policy.cpp.

29 {
30 return get_list("macs", Policy::allowed_macs());
31 }

References Botan::TLS::Policy::allowed_macs(), and get_list().

◆ allowed_signature_hash()

bool Botan::TLS::Policy::allowed_signature_hash ( const std::string &  hash) const
inherited

Definition at line 122 of file tls_policy.cpp.

123 {
124 return value_exists(allowed_signature_hashes(), sig_hash);
125 }
virtual std::vector< std::string > allowed_signature_hashes() const
Definition: tls_policy.cpp:67

References Botan::TLS::Policy::allowed_signature_hashes(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::allowed_signature_schemes(), and Botan::TLS::Handshake_State::choose_sig_format().

◆ allowed_signature_hashes()

std::vector< std::string > Botan::TLS::Text_Policy::allowed_signature_hashes ( ) const
overridevirtual

Returns a list of hash algorithms we are willing to use for signatures, in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 23 of file tls_text_policy.cpp.

24 {
25 return get_list("signature_hashes", Policy::allowed_signature_hashes());
26 }

References Botan::TLS::Policy::allowed_signature_hashes(), and get_list().

◆ allowed_signature_method()

bool Botan::TLS::Policy::allowed_signature_method ( const std::string &  sig_method) const
inherited

Definition at line 117 of file tls_policy.cpp.

118 {
119 return value_exists(allowed_signature_methods(), sig_method);
120 }
virtual std::vector< std::string > allowed_signature_methods() const
Definition: tls_policy.cpp:106

References Botan::TLS::Policy::allowed_signature_methods(), and Botan::value_exists().

Referenced by Botan::TLS::Policy::allowed_signature_schemes(), and Botan::TLS::Handshake_State::parse_sig_format().

◆ allowed_signature_methods()

std::vector< std::string > Botan::TLS::Text_Policy::allowed_signature_methods ( ) const
overridevirtual

Returns a list of signature algorithms we are willing to use, in order of preference. Allowed values RSA and DSA.

Reimplemented from Botan::TLS::Policy.

Definition at line 38 of file tls_text_policy.cpp.

39 {
40 return get_list("signature_methods", Policy::allowed_signature_methods());
41 }

References Botan::TLS::Policy::allowed_signature_methods(), and get_list().

◆ allowed_signature_schemes()

std::vector< Signature_Scheme > Botan::TLS::Policy::allowed_signature_schemes ( ) const
virtualinherited

Definition at line 22 of file tls_policy.cpp.

23 {
24 std::vector<Signature_Scheme> schemes;
25
27 {
28 if(signature_scheme_is_known(scheme) == false)
29 continue;
30 const bool sig_allowed = allowed_signature_method(signature_algorithm_of_scheme(scheme));
31 const bool hash_allowed = allowed_signature_hash(hash_function_of_scheme(scheme));
32
33 if(sig_allowed && hash_allowed)
34 {
35 schemes.push_back(scheme);
36 }
37 }
38
39 return schemes;
40 }
bool allowed_signature_method(const std::string &sig_method) const
Definition: tls_policy.cpp:117
bool allowed_signature_hash(const std::string &hash) const
Definition: tls_policy.cpp:122
const std::vector< Signature_Scheme > & all_signature_schemes()
Definition: tls_algos.cpp:229
bool signature_scheme_is_known(Signature_Scheme scheme)
Definition: tls_algos.cpp:262
Signature_Scheme
Definition: tls_algos.h:86
std::string hash_function_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:191
std::string signature_algorithm_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:291

References Botan::TLS::all_signature_schemes(), Botan::TLS::Policy::allowed_signature_hash(), Botan::TLS::Policy::allowed_signature_method(), Botan::TLS::hash_function_of_scheme(), Botan::TLS::signature_algorithm_of_scheme(), and Botan::TLS::signature_scheme_is_known().

Referenced by Botan::TLS::Handshake_State::choose_sig_format(), and Botan::TLS::Client_Hello::Client_Hello().

◆ check_peer_key_acceptable()

void Botan::TLS::Policy::check_peer_key_acceptable ( const Public_Key public_key) const
virtualinherited

Throw an exception if you don't like the peer's key. Default impl checks the key size against minimum_rsa_bits, minimum_ecdsa_group_size, or minimum_ecdh_group_size depending on the key's type. Override if you'd like to perform some other kind of test on (or logging of) the peer's keys.

Definition at line 231 of file tls_policy.cpp.

232 {
233 const std::string algo_name = public_key.algo_name();
234
235 const size_t keylength = public_key.key_length();
236 size_t expected_keylength = 0;
237
238 if(algo_name == "RSA")
239 {
240 expected_keylength = minimum_rsa_bits();
241 }
242 else if(algo_name == "DH")
243 {
244 expected_keylength = minimum_dh_group_size();
245 }
246 else if(algo_name == "DSA")
247 {
248 expected_keylength = minimum_dsa_group_size();
249 }
250 else if(algo_name == "ECDH" || algo_name == "Curve25519")
251 {
252 expected_keylength = minimum_ecdh_group_size();
253 }
254 else if(algo_name == "ECDSA")
255 {
256 expected_keylength = minimum_ecdsa_group_size();
257 }
258 // else some other algo, so leave expected_keylength as zero and the check is a no-op
259
260 if(keylength < expected_keylength)
261 throw TLS_Exception(Alert::INSUFFICIENT_SECURITY,
262 "Peer sent " +
263 std::to_string(keylength) + " bit " + algo_name + " key"
264 ", policy requires at least " +
265 std::to_string(expected_keylength));
266 }
virtual size_t minimum_ecdh_group_size() const
Definition: tls_policy.cpp:197
virtual size_t minimum_rsa_bits() const
Definition: tls_policy.cpp:213
virtual size_t minimum_dsa_group_size() const
Definition: tls_policy.cpp:225
virtual size_t minimum_dh_group_size() const
Definition: tls_policy.cpp:186
virtual size_t minimum_ecdsa_group_size() const
Definition: tls_policy.cpp:191
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213

References Botan::Public_Key::algo_name(), Botan::TLS::Alert::INSUFFICIENT_SECURITY, Botan::Public_Key::key_length(), Botan::TLS::Policy::minimum_dh_group_size(), Botan::TLS::Policy::minimum_dsa_group_size(), Botan::TLS::Policy::minimum_ecdh_group_size(), Botan::TLS::Policy::minimum_ecdsa_group_size(), Botan::TLS::Policy::minimum_rsa_bits(), and Botan::ASN1::to_string().

Referenced by Botan::TLS::Callbacks::tls_dh_agree(), Botan::TLS::Callbacks::tls_ecdh_agree(), Botan::TLS::Server_Key_Exchange::verify(), and Botan::TLS::Certificate_Verify::verify().

◆ choose_key_exchange_group()

Group_Params Botan::TLS::Policy::choose_key_exchange_group ( const std::vector< Group_Params > &  peer_groups) const
virtualinherited

Select a key exchange group to use, from the list of groups sent by the peer. If none are acceptable, return Group_Params::NONE

Definition at line 132 of file tls_policy.cpp.

133 {
134 if(peer_groups.empty())
135 return Group_Params::NONE;
136
137 const std::vector<Group_Params> our_groups = key_exchange_groups();
138
139 for(auto g : our_groups)
140 {
141 if(value_exists(peer_groups, g))
142 return g;
143 }
144
145 return Group_Params::NONE;
146 }
virtual std::vector< Group_Params > key_exchange_groups() const
Definition: tls_policy.cpp:162

References Botan::TLS::Policy::key_exchange_groups(), Botan::TLS::NONE, and Botan::value_exists().

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), and Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

◆ ciphersuite_list()

std::vector< uint16_t > Botan::TLS::Policy::ciphersuite_list ( Protocol_Version  version,
bool  have_srp 
) const
virtualinherited

Return allowed ciphersuites, in order of preference

Definition at line 442 of file tls_policy.cpp.

444 {
445 const std::vector<std::string> ciphers = allowed_ciphers();
446 const std::vector<std::string> macs = allowed_macs();
447 const std::vector<std::string> kex = allowed_key_exchange_methods();
448 const std::vector<std::string> sigs = allowed_signature_methods();
449
450 std::vector<Ciphersuite> ciphersuites;
451
452 for(auto&& suite : Ciphersuite::all_known_ciphersuites())
453 {
454 // Can we use it?
455 if(!suite.valid())
456 continue;
457
458 // Can we use it in this version?
459 if(!suite.usable_in_version(version))
460 continue;
461
462 // Is it acceptable to the policy?
463 if(!this->acceptable_ciphersuite(suite))
464 continue;
465
466 // Are we doing SRP?
467 if(!have_srp && suite.kex_method() == Kex_Algo::SRP_SHA)
468 continue;
469
470 if(!value_exists(kex, suite.kex_algo()))
471 continue; // unsupported key exchange
472
473 if(!value_exists(ciphers, suite.cipher_algo()))
474 continue; // unsupported cipher
475
476 if(!value_exists(macs, suite.mac_algo()))
477 continue; // unsupported MAC algo
478
479 if(!value_exists(sigs, suite.sig_algo()))
480 {
481 // allow if it's an empty sig algo and we want to use PSK
482 if(suite.auth_method() != Auth_Method::IMPLICIT || !suite.psk_ciphersuite())
483 continue;
484 }
485
486 /*
487 CECPQ1 always uses x25519 for ECDH, so treat the applications
488 removal of x25519 from the ECC curve list as equivalent to
489 saying they do not trust CECPQ1
490 */
491 if(suite.kex_method() == Kex_Algo::CECPQ1)
492 {
494 continue;
495 }
496
497 // OK, consider it
498 ciphersuites.push_back(suite);
499 }
500
501 if(ciphersuites.empty())
502 {
503 throw Invalid_State("Policy does not allow any available cipher suite");
504 }
505
506 Ciphersuite_Preference_Ordering order(ciphers, macs, kex, sigs);
507 std::sort(ciphersuites.begin(), ciphersuites.end(), order);
508
509 std::vector<uint16_t> ciphersuite_codes;
510 for(auto i : ciphersuites)
511 ciphersuite_codes.push_back(i.ciphersuite_code());
512 return ciphersuite_codes;
513 }
static const std::vector< Ciphersuite > & all_known_ciphersuites()
virtual bool acceptable_ciphersuite(const Ciphersuite &suite) const
Definition: tls_policy.cpp:326

References Botan::TLS::Policy::acceptable_ciphersuite(), Botan::TLS::Ciphersuite::all_known_ciphersuites(), Botan::TLS::Policy::allowed_ciphers(), Botan::TLS::Policy::allowed_key_exchange_methods(), Botan::TLS::Policy::allowed_macs(), Botan::TLS::Policy::allowed_signature_methods(), Botan::TLS::CECPQ1, Botan::TLS::IMPLICIT, Botan::TLS::Policy::key_exchange_groups(), Botan::TLS::SRP_SHA, Botan::value_exists(), and Botan::TLS::X25519.

◆ default_dh_group()

Group_Params Botan::TLS::Policy::default_dh_group ( ) const
virtualinherited

Definition at line 148 of file tls_policy.cpp.

149 {
150 /*
151 * Return the first listed or just default to 2048
152 */
153 for(auto g : key_exchange_groups())
154 {
155 if(group_param_is_dh(g))
156 return g;
157 }
158
160 }
bool group_param_is_dh(Group_Params group)
Definition: tls_algos.cpp:118

References Botan::TLS::FFDHE_2048, Botan::TLS::group_param_is_dh(), and Botan::TLS::Policy::key_exchange_groups().

Referenced by Botan::TLS::Server_Key_Exchange::Server_Key_Exchange().

◆ dtls_default_mtu()

size_t Botan::TLS::Text_Policy::dtls_default_mtu ( ) const
overridevirtual
Returns
the default MTU for DTLS

Reimplemented from Botan::TLS::Policy.

Definition at line 187 of file tls_text_policy.cpp.

188 {
189 return get_len("dtls_default_mtu", Policy::dtls_default_mtu());
190 }
virtual size_t dtls_default_mtu() const
Definition: tls_policy.cpp:358
size_t get_len(const std::string &key, size_t def) const

References Botan::TLS::Policy::dtls_default_mtu(), and get_len().

◆ dtls_initial_timeout()

size_t Botan::TLS::Text_Policy::dtls_initial_timeout ( ) const
overridevirtual
Returns
the initial timeout for DTLS

Reimplemented from Botan::TLS::Policy.

Definition at line 192 of file tls_text_policy.cpp.

193 {
194 return get_len("dtls_initial_timeout", Policy::dtls_initial_timeout());
195 }
virtual size_t dtls_initial_timeout() const
Definition: tls_policy.cpp:355

References Botan::TLS::Policy::dtls_initial_timeout(), and get_len().

◆ dtls_maximum_timeout()

size_t Botan::TLS::Text_Policy::dtls_maximum_timeout ( ) const
overridevirtual
Returns
the maximum timeout for DTLS

Reimplemented from Botan::TLS::Policy.

Definition at line 197 of file tls_text_policy.cpp.

198 {
199 return get_len("dtls_maximum_timeout", Policy::dtls_maximum_timeout());
200 }
virtual size_t dtls_maximum_timeout() const
Definition: tls_policy.cpp:356

References Botan::TLS::Policy::dtls_maximum_timeout(), and get_len().

◆ get_bool()

bool Botan::TLS::Text_Policy::get_bool ( const std::string &  key,
bool  def 
) const
protected

Definition at line 272 of file tls_text_policy.cpp.

273 {
274 const std::string v = get_str(key);
275
276 if(v.empty())
277 {
278 return def;
279 }
280
281 if(v == "true" || v == "True")
282 {
283 return true;
284 }
285 else if(v == "false" || v == "False")
286 {
287 return false;
288 }
289 else
290 {
291 throw Decoding_Error("Invalid boolean '" + v + "'");
292 }
293 }
std::string get_str(const std::string &key, const std::string &def="") const

References get_str().

Referenced by allow_client_initiated_renegotiation(), allow_dtls10(), allow_dtls12(), allow_insecure_renegotiation(), allow_server_initiated_renegotiation(), allow_tls10(), allow_tls11(), allow_tls12(), hide_unknown_users(), include_time_in_hello_random(), negotiate_encrypt_then_mac(), require_cert_revocation_info(), require_client_certificate_authentication(), send_fallback_scsv(), server_uses_own_ciphersuite_preferences(), support_cert_status_message(), and use_ecc_point_compression().

◆ get_len()

size_t Botan::TLS::Text_Policy::get_len ( const std::string &  key,
size_t  def 
) const
protected

Definition at line 260 of file tls_text_policy.cpp.

261 {
262 const std::string v = get_str(key);
263
264 if(v.empty())
265 {
266 return def;
267 }
268
269 return to_u32bit(v);
270 }
uint32_t to_u32bit(const std::string &str)
Definition: parsing.cpp:35

References get_str(), and Botan::to_u32bit().

Referenced by dtls_default_mtu(), dtls_initial_timeout(), dtls_maximum_timeout(), minimum_dh_group_size(), minimum_ecdh_group_size(), minimum_ecdsa_group_size(), minimum_rsa_bits(), minimum_signature_strength(), and session_ticket_lifetime().

◆ get_list()

std::vector< std::string > Botan::TLS::Text_Policy::get_list ( const std::string &  key,
const std::vector< std::string > &  def 
) const
protected

Definition at line 247 of file tls_text_policy.cpp.

249 {
250 const std::string v = get_str(key);
251
252 if(v.empty())
253 {
254 return def;
255 }
256
257 return split_on(v, ' ');
258 }
std::vector< std::string > split_on(const std::string &str, char delim)
Definition: parsing.cpp:148

References get_str(), and Botan::split_on().

Referenced by allowed_ciphers(), allowed_key_exchange_methods(), allowed_macs(), allowed_signature_hashes(), allowed_signature_methods(), and srtp_profiles().

◆ get_str()

std::string Botan::TLS::Text_Policy::get_str ( const std::string &  key,
const std::string &  def = "" 
) const
protected

Definition at line 295 of file tls_text_policy.cpp.

296 {
297 auto i = m_kv.find(key);
298 if(i == m_kv.end())
299 {
300 return def;
301 }
302
303 return i->second;
304 }

Referenced by get_bool(), get_len(), get_list(), and key_exchange_groups().

◆ hide_unknown_users()

bool Botan::TLS::Text_Policy::hide_unknown_users ( ) const
overridevirtual

If this function returns false, unknown SRP/PSK identifiers will be rejected with an unknown_psk_identifier alert as soon as the non-existence is identified. Otherwise, a false identifier value will be used and the protocol allowed to proceed, causing the handshake to eventually fail without revealing that the username does not exist on this system.

Reimplemented from Botan::TLS::Policy.

Definition at line 207 of file tls_text_policy.cpp.

208 {
209 return get_bool("hide_unknown_users", Policy::hide_unknown_users());
210 }
virtual bool hide_unknown_users() const
Definition: tls_policy.cpp:341

References get_bool(), and Botan::TLS::Policy::hide_unknown_users().

◆ include_time_in_hello_random()

bool Botan::TLS::Text_Policy::include_time_in_hello_random ( ) const
overridevirtual

The protocol dictates that the first 32 bits of the random field are the current time in seconds. However this allows client fingerprinting attacks. Set to false to disable, in which case random bytes will be used instead.

Reimplemented from Botan::TLS::Policy.

Definition at line 78 of file tls_text_policy.cpp.

79 {
80 return get_bool("include_time_in_hello_random", Policy::include_time_in_hello_random());
81 }
virtual bool include_time_in_hello_random() const
Definition: tls_policy.cpp:340

References get_bool(), and Botan::TLS::Policy::include_time_in_hello_random().

◆ key_exchange_groups()

std::vector< Group_Params > Botan::TLS::Text_Policy::key_exchange_groups ( ) const
overridevirtual

Return list of ECC curves and FFDHE groups we are willing to use in order of preference.

Reimplemented from Botan::TLS::Policy.

Definition at line 113 of file tls_text_policy.cpp.

114 {
115 std::string group_str = get_str("key_exchange_groups");
116
117 if(group_str.empty())
118 {
119 // fall back to previously used name
120 group_str = get_str("groups");
121 }
122
123 if(group_str.empty())
124 {
126 }
127
128 std::vector<Group_Params> groups;
129 for(std::string group_name : split_on(group_str, ' '))
130 {
131 Group_Params group_id = group_param_from_string(group_name);
132
133 if(group_id == Group_Params::NONE)
134 {
135 try
136 {
137 size_t consumed = 0;
138 unsigned long ll_id = std::stoul(group_name, &consumed, 0);
139 if(consumed != group_name.size())
140 continue; // some other cruft
141
142 const uint16_t id = static_cast<uint16_t>(ll_id);
143
144 if(id != ll_id)
145 continue; // integer too large
146
147 group_id = static_cast<Group_Params>(id);
148 }
149 catch(...)
150 {
151 continue;
152 }
153 }
154
155 if(group_id != Group_Params::NONE)
156 groups.push_back(group_id);
157 }
158
159 return groups;
160 }
Group_Params group_param_from_string(const std::string &group_name)
Definition: tls_algos.cpp:124

References get_str(), Botan::TLS::group_param_from_string(), Botan::TLS::Policy::key_exchange_groups(), Botan::TLS::NONE, and Botan::split_on().

◆ latest_supported_version()

Protocol_Version Botan::TLS::Policy::latest_supported_version ( bool  datagram) const
virtualinherited

Returns the more recent protocol version we are willing to use, for either TLS or DTLS depending on datagram param. Shouldn't ever need to override this unless you want to allow a user to disable use of TLS v1.2 (which is not recommended)

Definition at line 300 of file tls_policy.cpp.

301 {
302 if(datagram)
303 {
306#if defined(BOTAN_HAS_TLS_V10)
309#endif
310 throw Invalid_State("Policy forbids all available DTLS version");
311 }
312 else
313 {
316#if defined(BOTAN_HAS_TLS_V10)
321#endif
322 throw Invalid_State("Policy forbids all available TLS version");
323 }
324 }
virtual bool acceptable_protocol_version(Protocol_Version version) const
Definition: tls_policy.cpp:278

References Botan::TLS::Policy::acceptable_protocol_version(), Botan::TLS::Protocol_Version::DTLS_V10, Botan::TLS::Protocol_Version::DTLS_V12, Botan::TLS::Protocol_Version::TLS_V10, Botan::TLS::Protocol_Version::TLS_V11, and Botan::TLS::Protocol_Version::TLS_V12.

Referenced by Botan::TLS::Policy::send_fallback_scsv().

◆ maximum_certificate_chain_size()

size_t Botan::TLS::Policy::maximum_certificate_chain_size ( ) const
virtualinherited
Returns
the maximum size of the certificate chain, in bytes. Return 0 to disable this and accept any size.

Definition at line 352 of file tls_policy.cpp.

352{ return 0; }

Referenced by Botan::TLS::Certificate::Certificate().

◆ minimum_dh_group_size()

size_t Botan::TLS::Text_Policy::minimum_dh_group_size ( ) const
overridevirtual

Return the minimum DH group size we're willing to use Default is currently 1024 (insecure), should be 2048

Reimplemented from Botan::TLS::Policy.

Definition at line 172 of file tls_text_policy.cpp.

173 {
174 return get_len("minimum_dh_group_size", Policy::minimum_dh_group_size());
175 }

References get_len(), and Botan::TLS::Policy::minimum_dh_group_size().

◆ minimum_dsa_group_size()

size_t Botan::TLS::Policy::minimum_dsa_group_size ( ) const
virtualinherited

Minimum DSA group size, default 2048 bits

Reimplemented in Botan::TLS::BSI_TR_02102_2.

Definition at line 225 of file tls_policy.cpp.

226 {
227 // FIPS 186-3
228 return 2048;
229 }

Referenced by Botan::TLS::Policy::check_peer_key_acceptable().

◆ minimum_ecdh_group_size()

size_t Botan::TLS::Text_Policy::minimum_ecdh_group_size ( ) const
overridevirtual

Return the minimum ECDH group size we're willing to use for key exchange

Default 255, allowing x25519 and larger x25519 is the smallest curve we will negotiate P-521 is the largest

Reimplemented from Botan::TLS::Policy.

Definition at line 162 of file tls_text_policy.cpp.

163 {
164 return get_len("minimum_ecdh_group_size", Policy::minimum_ecdh_group_size());
165 }

References get_len(), and Botan::TLS::Policy::minimum_ecdh_group_size().

◆ minimum_ecdsa_group_size()

size_t Botan::TLS::Text_Policy::minimum_ecdsa_group_size ( ) const
overridevirtual

For ECDSA authenticated ciphersuites, the smallest key size the client will accept. This policy is currently only enforced on the server by the client.

Reimplemented from Botan::TLS::Policy.

Definition at line 167 of file tls_text_policy.cpp.

168 {
169 return get_len("minimum_ecdsa_group_size", Policy::minimum_ecdsa_group_size());
170 }

References get_len(), and Botan::TLS::Policy::minimum_ecdsa_group_size().

◆ minimum_rsa_bits()

size_t Botan::TLS::Text_Policy::minimum_rsa_bits ( ) const
overridevirtual

Return the minimum bit size we're willing to accept for RSA key exchange or server signatures.

It does not place any requirements on the size of any RSA signature(s) which were used to check the server certificate. This is only concerned with the server's public key.

Default is 2048 which is smallest RSA key size still secure for medium term security.

Reimplemented from Botan::TLS::Policy.

Definition at line 177 of file tls_text_policy.cpp.

178 {
179 return get_len("minimum_rsa_bits", Policy::minimum_rsa_bits());
180 }

References get_len(), and Botan::TLS::Policy::minimum_rsa_bits().

◆ minimum_signature_strength()

size_t Botan::TLS::Text_Policy::minimum_signature_strength ( ) const
overridevirtual

The minimum signature strength we will accept Returning 80 allows RSA 1024 and SHA-1. Values larger than 80 disable SHA-1 support. Returning 110 allows RSA 2048. Return 128 to force ECC (P-256) or large (~3000 bit) RSA keys. Default is 110

Reimplemented from Botan::TLS::Policy.

Definition at line 182 of file tls_text_policy.cpp.

183 {
184 return get_len("minimum_signature_strength", Policy::minimum_signature_strength());
185 }
virtual size_t minimum_signature_strength() const
Definition: tls_policy.cpp:203

References get_len(), and Botan::TLS::Policy::minimum_signature_strength().

◆ negotiate_encrypt_then_mac()

bool Botan::TLS::Text_Policy::negotiate_encrypt_then_mac ( ) const
overridevirtual

Indicates whether the encrypt-then-MAC extension should be negotiated (RFC 7366)

Reimplemented from Botan::TLS::Policy.

Definition at line 103 of file tls_text_policy.cpp.

104 {
105 return get_bool("negotiate_encrypt_then_mac", Policy::negotiate_encrypt_then_mac());
106 }
virtual bool negotiate_encrypt_then_mac() const
Definition: tls_policy.cpp:343

References get_bool(), and Botan::TLS::Policy::negotiate_encrypt_then_mac().

◆ only_resume_with_exact_version()

bool Botan::TLS::Policy::only_resume_with_exact_version ( ) const
virtualinherited

Definition at line 346 of file tls_policy.cpp.

346{ return true; }

◆ print()

void Botan::TLS::Policy::print ( std::ostream &  o) const
virtualinherited

Convert this policy to a printable format.

Parameters
ostream to be printed to

Definition at line 553 of file tls_policy.cpp.

554 {
555 print_bool(o, "allow_tls10", allow_tls10());
556 print_bool(o, "allow_tls11", allow_tls11());
557 print_bool(o, "allow_tls12", allow_tls12());
558 print_bool(o, "allow_dtls10", allow_dtls10());
559 print_bool(o, "allow_dtls12", allow_dtls12());
560 print_vec(o, "ciphers", allowed_ciphers());
561 print_vec(o, "macs", allowed_macs());
562 print_vec(o, "signature_hashes", allowed_signature_hashes());
563 print_vec(o, "signature_methods", allowed_signature_methods());
564 print_vec(o, "key_exchange_methods", allowed_key_exchange_methods());
565 print_vec(o, "key_exchange_groups", key_exchange_groups());
566
567 print_bool(o, "allow_insecure_renegotiation", allow_insecure_renegotiation());
568 print_bool(o, "include_time_in_hello_random", include_time_in_hello_random());
569 print_bool(o, "allow_server_initiated_renegotiation", allow_server_initiated_renegotiation());
570 print_bool(o, "hide_unknown_users", hide_unknown_users());
571 print_bool(o, "server_uses_own_ciphersuite_preferences", server_uses_own_ciphersuite_preferences());
572 print_bool(o, "negotiate_encrypt_then_mac", negotiate_encrypt_then_mac());
573 print_bool(o, "support_cert_status_message", support_cert_status_message());
574 o << "session_ticket_lifetime = " << session_ticket_lifetime() << '\n';
575 o << "minimum_dh_group_size = " << minimum_dh_group_size() << '\n';
576 o << "minimum_ecdh_group_size = " << minimum_ecdh_group_size() << '\n';
577 o << "minimum_rsa_bits = " << minimum_rsa_bits() << '\n';
578 o << "minimum_signature_strength = " << minimum_signature_strength() << '\n';
579 }
virtual bool server_uses_own_ciphersuite_preferences() const
Definition: tls_policy.cpp:342
virtual uint32_t session_ticket_lifetime() const
Definition: tls_policy.cpp:268
virtual bool support_cert_status_message() const
Definition: tls_policy.cpp:344

References Botan::TLS::Policy::allow_dtls10(), Botan::TLS::Policy::allow_dtls12(), Botan::TLS::Policy::allow_insecure_renegotiation(), Botan::TLS::Policy::allow_server_initiated_renegotiation(), Botan::TLS::Policy::allow_tls10(), Botan::TLS::Policy::allow_tls11(), Botan::TLS::Policy::allow_tls12(), Botan::TLS::Policy::allowed_ciphers(), Botan::TLS::Policy::allowed_key_exchange_methods(), Botan::TLS::Policy::allowed_macs(), Botan::TLS::Policy::allowed_signature_hashes(), Botan::TLS::Policy::allowed_signature_methods(), Botan::TLS::Policy::hide_unknown_users(), Botan::TLS::Policy::include_time_in_hello_random(), Botan::TLS::Policy::key_exchange_groups(), Botan::TLS::Policy::minimum_dh_group_size(), Botan::TLS::Policy::minimum_ecdh_group_size(), Botan::TLS::Policy::minimum_rsa_bits(), Botan::TLS::Policy::minimum_signature_strength(), Botan::TLS::Policy::negotiate_encrypt_then_mac(), Botan::TLS::Policy::server_uses_own_ciphersuite_preferences(), Botan::TLS::Policy::session_ticket_lifetime(), and Botan::TLS::Policy::support_cert_status_message().

Referenced by Botan::TLS::Policy::to_string().

◆ request_client_certificate_authentication()

bool Botan::TLS::Policy::request_client_certificate_authentication ( ) const
virtualinherited

Indicate if client certificate authentication is requested. If true, then a cert will be requested.

Definition at line 348 of file tls_policy.cpp.

virtual bool require_client_certificate_authentication() const
Definition: tls_policy.cpp:347

References Botan::TLS::Policy::require_client_certificate_authentication().

◆ require_cert_revocation_info()

bool Botan::TLS::Text_Policy::require_cert_revocation_info ( ) const
overridevirtual

Return if cert revocation info (CRL/OCSP) is required If true, validation will fail unless a valid CRL or OCSP response was examined.

Reimplemented from Botan::TLS::Policy.

Definition at line 202 of file tls_text_policy.cpp.

203 {
204 return get_bool("require_cert_revocation_info", Policy::require_cert_revocation_info());
205 }
virtual bool require_cert_revocation_info() const
Definition: tls_policy.cpp:208

References get_bool(), and Botan::TLS::Policy::require_cert_revocation_info().

◆ require_client_certificate_authentication()

bool Botan::TLS::Text_Policy::require_client_certificate_authentication ( ) const
overridevirtual

Indicate if client certificate authentication is required. If true, then a cert will be requested and if the client does not send a certificate the connection will be closed.

Reimplemented from Botan::TLS::Policy.

Definition at line 83 of file tls_text_policy.cpp.

84 {
85 return get_bool("require_client_certificate_authentication", Policy::require_client_certificate_authentication());
86 }

References get_bool(), and Botan::TLS::Policy::require_client_certificate_authentication().

◆ send_fallback_scsv()

bool Botan::TLS::Text_Policy::send_fallback_scsv ( Protocol_Version  version) const
overridevirtual

When offering this version, should we send a fallback SCSV? Default returns true iff version is not the latest version the policy allows, exists to allow override in case of interop problems.

Reimplemented from Botan::TLS::Policy.

Definition at line 217 of file tls_text_policy.cpp.

218 {
219 return get_bool("send_fallback_scsv", false) ? Policy::send_fallback_scsv(version) : false;
220 }
virtual bool send_fallback_scsv(Protocol_Version version) const
Definition: tls_policy.cpp:273

References get_bool(), and Botan::TLS::Policy::send_fallback_scsv().

◆ server_uses_own_ciphersuite_preferences()

bool Botan::TLS::Text_Policy::server_uses_own_ciphersuite_preferences ( ) const
overridevirtual
Returns
true if servers should choose the ciphersuite matching their highest preference, rather than the clients. Has no effect on client side.

Reimplemented from Botan::TLS::Policy.

Definition at line 98 of file tls_text_policy.cpp.

99 {
100 return get_bool("server_uses_own_ciphersuite_preferences", Policy::server_uses_own_ciphersuite_preferences());
101 }

References get_bool(), and Botan::TLS::Policy::server_uses_own_ciphersuite_preferences().

◆ session_ticket_lifetime()

uint32_t Botan::TLS::Text_Policy::session_ticket_lifetime ( ) const
overridevirtual

Return the allowed lifetime of a session ticket. If 0, session tickets do not expire until the session ticket key rolls over. Expired session tickets cannot be used to resume a session.

Reimplemented from Botan::TLS::Policy.

Definition at line 212 of file tls_text_policy.cpp.

213 {
214 return static_cast<uint32_t>(get_len("session_ticket_lifetime", Policy::session_ticket_lifetime()));
215 }

References get_len(), and Botan::TLS::Policy::session_ticket_lifetime().

◆ set()

void Botan::TLS::Text_Policy::set ( const std::string &  k,
const std::string &  v 
)

Definition at line 232 of file tls_text_policy.cpp.

233 {
234 m_kv[k] = v;
235 }

◆ set_value()

bool Botan::TLS::Text_Policy::set_value ( const std::string &  key,
const std::string &  val,
bool  overwrite 
)
protected

Definition at line 306 of file tls_text_policy.cpp.

307 {
308 auto i = m_kv.find(key);
309
310 if(overwrite == false && i != m_kv.end())
311 return false;
312
313 m_kv.insert(i, std::make_pair(key, val));
314 return true;
315 }

◆ srtp_profiles()

std::vector< uint16_t > Botan::TLS::Text_Policy::srtp_profiles ( ) const
overridevirtual

If this returns a non-empty vector, and DTLS is negotiated, then we will also attempt to negotiate the SRTP extension from RFC 5764 using the returned values as the profile ids.

Reimplemented from Botan::TLS::Policy.

Definition at line 222 of file tls_text_policy.cpp.

223 {
224 std::vector<uint16_t> r;
225 for(std::string p : get_list("srtp_profiles", std::vector<std::string>()))
226 {
227 r.push_back(to_uint16(p));
228 }
229 return r;
230 }
uint16_t to_uint16(const std::string &str)
Definition: parsing.cpp:25

References get_list(), and Botan::to_uint16().

◆ support_cert_status_message()

bool Botan::TLS::Text_Policy::support_cert_status_message ( ) const
overridevirtual

Indicates whether certificate status messages should be supported

Reimplemented from Botan::TLS::Policy.

Definition at line 108 of file tls_text_policy.cpp.

109 {
110 return get_bool("support_cert_status_message", Policy::support_cert_status_message());
111 }

References get_bool(), and Botan::TLS::Policy::support_cert_status_message().

◆ to_string()

std::string Botan::TLS::Policy::to_string ( ) const
inherited

Convert this policy to a printable format. Same as calling print on a ostringstream and reading o.str()

Definition at line 581 of file tls_policy.cpp.

582 {
583 std::ostringstream oss;
584 this->print(oss);
585 return oss.str();
586 }
virtual void print(std::ostream &o) const
Definition: tls_policy.cpp:553

References Botan::TLS::Policy::print().

◆ use_ecc_point_compression()

bool Botan::TLS::Text_Policy::use_ecc_point_compression ( ) const
overridevirtual

Request that ECC curve points are sent compressed

Reimplemented from Botan::TLS::Policy.

Definition at line 43 of file tls_text_policy.cpp.

44 {
45 return get_bool("use_ecc_point_compression", Policy::use_ecc_point_compression());
46 }
virtual bool use_ecc_point_compression() const
Definition: tls_policy.cpp:127

References get_bool(), and Botan::TLS::Policy::use_ecc_point_compression().


The documentation for this class was generated from the following files: