12#ifndef BOTAN_TLS_EXTENSIONS_H_
13#define BOTAN_TLS_EXTENSIONS_H_
15#include <botan/tls_algos.h>
16#include <botan/tls_magic.h>
17#include <botan/tls_version.h>
18#include <botan/secmem.h>
19#include <botan/pkix_types.h>
20#include <botan/tls_signature_scheme.h>
21#include <botan/tls_session.h>
33class RandomNumberGenerator;
37#if defined(BOTAN_HAS_TLS_13)
42class Transcript_Hash_State;
44enum class PSK_Key_Exchange_Mode : uint8_t {
74#if defined(BOTAN_HAS_TLS_13)
79 PskKeyExchangeModes = 45,
80 CertificateAuthorities = 47,
125 {
return Extension_Code::ServerNameIndication; }
130 m_sni_host_name(host_name) {}
133 uint16_t extension_size);
135 std::string
host_name()
const {
return m_sni_host_name; }
139 bool empty()
const override {
return false; }
142 std::string m_sni_host_name;
152 {
return Extension_Code::SafeRenegotiation; }
159 m_reneg_data(bits) {}
162 uint16_t extension_size);
165 {
return m_reneg_data; }
169 bool empty()
const override {
return false; }
171 std::vector<uint8_t> m_reneg_data;
181 {
return Extension_Code::ApplicationLayerProtocolNegotiation; }
185 const std::vector<std::string>&
protocols()
const {
return m_protocols; }
187 std::string single_protocol()
const;
193 m_protocols(1,
std::string(protocol)) {}
199 m_protocols(protocols) {}
202 uint16_t extension_size,
207 bool empty()
const override {
return m_protocols.empty(); }
209 std::vector<std::string> m_protocols;
219 {
return Extension_Code::SessionTicket; }
237 m_ticket(
std::move(session_ticket)) {}
246 bool empty()
const override {
return false; }
259 {
return Extension_Code::SupportedGroups; }
263 const std::vector<Group_Params>& groups()
const;
264 std::vector<Group_Params> ec_groups()
const;
265 std::vector<Group_Params> dh_groups()
const;
272 uint16_t extension_size);
274 bool empty()
const override {
return m_groups.empty(); }
276 std::vector<Group_Params> m_groups;
290 ANSIX962_COMPRESSED_PRIME = 1,
291 ANSIX962_COMPRESSED_CHAR2 = 2,
295 {
return Extension_Code::EcPointFormats; }
302 m_prefers_compressed(prefer_compressed) {}
305 uint16_t extension_size);
307 bool empty()
const override {
return false; }
312 bool m_prefers_compressed =
false;
322 {
return Extension_Code::SignatureAlgorithms; }
330 bool empty()
const override {
return m_schemes.empty(); }
333 m_schemes(
std::move(schemes)) {}
336 uint16_t extension_size);
338 std::vector<Signature_Scheme> m_schemes;
358 {
return Extension_Code::CertSignatureAlgorithms; }
366 bool empty()
const override {
return m_schemes.empty(); }
369 : m_schemes(
std::move(schemes)) {}
374 std::vector<Signature_Scheme> m_schemes;
384 {
return Extension_Code::UseSrtp; }
388 const std::vector<uint16_t>&
profiles()
const {
return m_pp; }
392 bool empty()
const override {
return m_pp.empty(); }
400 std::vector<uint16_t> m_pp;
410 {
return Extension_Code::ExtendedMasterSecret; }
416 bool empty()
const override {
return false; }
430 {
return Extension_Code::EncryptThenMac; }
436 bool empty()
const override {
return false; }
443class Certificate_Status_Request_Internal;
452 {
return Extension_Code::CertificateStatusRequest; }
458 bool empty()
const override {
return false; }
462 const std::vector<uint8_t>& get_ocsp_response()
const;
469 std::vector<std::vector<uint8_t>> ocsp_key_ids);
475 uint16_t extension_size,
482 std::unique_ptr<Certificate_Status_Request_Internal> m_impl;
492 {
return Extension_Code::SupportedVersions; }
498 bool empty()
const override {
return m_versions.empty(); }
504 m_versions.push_back(version);
508 uint16_t extension_size,
513 const std::vector<Protocol_Version>&
versions()
const {
return m_versions; }
515 std::vector<Protocol_Version> m_versions;
529 {
return Extension_Code::RecordSizeLimit; }
537 uint16_t
limit()
const {
return m_limit; }
541 bool empty()
const override {
return m_limit == 0; }
549#if defined(BOTAN_HAS_TLS_13)
556 static Extension_Code static_type()
557 {
return Extension_Code::Cookie; }
559 Extension_Code type()
const override {
return static_type(); }
561 std::vector<uint8_t> serialize(Connection_Side whoami)
const override;
563 bool empty()
const override {
return m_cookie.empty(); }
565 const std::vector<uint8_t>& get_cookie()
const {
return m_cookie; }
567 explicit Cookie(
const std::vector<uint8_t>& cookie);
569 explicit Cookie(TLS_Data_Reader& reader,
570 uint16_t extension_size);
573 std::vector<uint8_t> m_cookie;
583 {
return Extension_Code::PskKeyExchangeModes; }
587 std::vector<uint8_t> serialize(Connection_Side whoami)
const override;
589 bool empty()
const override {
return m_modes.empty(); }
591 const std::vector<PSK_Key_Exchange_Mode>& modes()
const {
return m_modes; }
593 explicit PSK_Key_Exchange_Modes(std::vector<PSK_Key_Exchange_Mode> modes)
594 : m_modes(
std::move(modes)) {}
596 explicit PSK_Key_Exchange_Modes(TLS_Data_Reader& reader, uint16_t extension_size);
599 std::vector<PSK_Key_Exchange_Mode> m_modes;
610 {
return Extension_Code::CertificateAuthorities; }
614 std::vector<uint8_t> serialize(Connection_Side whoami)
const override;
616 bool empty()
const override {
return m_distinguished_names.empty(); }
618 const std::vector<X509_DN>& distinguished_names()
const
619 {
return m_distinguished_names; }
621 Certificate_Authorities(TLS_Data_Reader& reader, uint16_t extension_size);
622 explicit Certificate_Authorities(std::vector<X509_DN> acceptable_DNs);
625 std::vector<X509_DN> m_distinguished_names;
634 static Extension_Code static_type() {
return Extension_Code::PresharedKey; }
637 std::vector<uint8_t> serialize(Connection_Side side)
const override;
644 std::unique_ptr<Cipher_State> select_cipher_state(
const PSK& server_psk,
645 const Ciphersuite& cipher);
652 std::unique_ptr<PSK> select_offered_psk(
const Ciphersuite& cipher,
653 Session_Manager& session_mgr,
654 Callbacks& callbacks,
655 const Policy& policy);
662 void filter(
const Ciphersuite& cipher);
667 Session take_session_to_resume();
669 bool empty()
const override;
671 PSK(TLS_Data_Reader& reader, uint16_t extension_size, Handshake_Type message_type);
683 PSK(Session_with_Handle& session_to_resume, Callbacks& callbacks);
687 void calculate_binders(
const Transcript_Hash_State& truncated_transcript_hash);
688 bool validate_binder(
const PSK& server_psk,
const std::vector<uint8_t>& binder)
const;
701 PSK(Session session_to_resume,
const uint16_t psk_index);
705 std::unique_ptr<PSK_Internal> m_impl;
715 {
return Extension_Code::KeyShare; }
719 std::vector<uint8_t> serialize(Connection_Side whoami)
const override;
721 bool empty()
const override;
727 secure_vector<uint8_t> exchange(
const Key_Share& peer_keyshare,
const Policy& policy, Callbacks& cb, RandomNumberGenerator& rng)
const;
734 void retry_offer(
const Key_Share& retry_request_keyshare,
const std::vector<Named_Group>& supported_groups, Callbacks& cb, RandomNumberGenerator& rng);
739 std::vector<Named_Group> offered_groups()
const;
751 Key_Share(TLS_Data_Reader& reader,
752 uint16_t extension_size,
753 Handshake_Type message_type);
756 Key_Share(
const Policy& policy, Callbacks& cb, RandomNumberGenerator& rng);
759 Key_Share(Named_Group group, Callbacks& cb, RandomNumberGenerator& rng);
762 explicit Key_Share(Named_Group selected_group);
768 class Key_Share_Impl;
769 std::unique_ptr<Key_Share_Impl> m_impl;
779 {
return Extension_Code::EarlyData; }
782 std::vector<uint8_t> serialize(Connection_Side whoami)
const override;
784 bool empty()
const override;
786 std::optional<uint32_t> max_early_data_size()
const
787 {
return m_max_early_data_size; }
789 EarlyDataIndication(TLS_Data_Reader& reader,
790 uint16_t extension_size,
791 Handshake_Type message_type);
798 EarlyDataIndication(std::optional<uint32_t> max_early_data_size = std::nullopt)
799 : m_max_early_data_size(
std::move(max_early_data_size)) {}
802 std::optional<uint32_t> m_max_early_data_size;
815 uint16_t extension_size);
819 const std::vector<uint8_t>&
value() {
return m_value; }
821 bool empty()
const override {
return false; }
829 std::vector<uint8_t> m_value;
838 std::set<Extension_Code> extension_types()
const;
840 const std::vector<std::unique_ptr<Extension>>&
all()
const
848 return dynamic_cast<T*
>(get(T::static_type()));
854 return get<T>() !=
nullptr;
859 return get(type) !=
nullptr;
864 return m_extensions.size();
867 void add(std::unique_ptr<Extension> extn);
871 add(std::unique_ptr<Extension>(extn));
876 const auto i = std::find_if(m_extensions.cbegin(), m_extensions.cend(),
877 [type](
const auto &ext) {
878 return ext->type() == type;
881 return (i != m_extensions.end()) ? i->get() :
nullptr;
895 bool contains_other_than(
const std::set<Extension_Code>& allowed_extensions,
896 const bool allow_unknown_extensions =
false)
const;
905 return contains_other_than(allowed_extensions,
true);
915 std::unique_ptr<T> out_ptr;
917 auto ext = take(T::static_type());
918 if (ext !=
nullptr) {
919 out_ptr.reset(
dynamic_cast<T*
>(ext.get()));
942 return take(type) !=
nullptr;
951 deserialize(reader, side, message_type);
958 std::vector<std::unique_ptr<Extension>> m_extensions;
#define BOTAN_ASSERT_NOMSG(expr)
Application_Layer_Protocol_Notification(std::string_view protocol)
const std::vector< std::string > & protocols() const
Application_Layer_Protocol_Notification(const std::vector< std::string > &protocols)
Extension_Code type() const override
bool empty() const override
static Extension_Code static_type()
const std::vector< uint8_t > & get_request_extensions() const
~Certificate_Status_Request() override
const std::vector< uint8_t > & get_responder_id_list() const
static Extension_Code static_type()
Extension_Code type() const override
bool empty() const override
Extension_Code type() const override
Encrypt_then_MAC()=default
static Extension_Code static_type()
bool empty() const override
static Extension_Code static_type()
Extension_Code type() const override
Extended_Master_Secret()=default
bool empty() const override
virtual std::vector< uint8_t > serialize(Connection_Side whoami) const =0
virtual bool is_implemented() const
virtual Extension_Code type() const =0
virtual bool empty() const =0
virtual ~Extension()=default
Extensions(Extensions &&)=default
void add(Extension *extn)
Extension * get(Extension_Code type) const
bool contains_implemented_extensions_other_than(const std::set< Extension_Code > &allowed_extensions) const
Extensions(TLS_Data_Reader &reader, Connection_Side side, Handshake_Type message_type)
Extensions & operator=(Extensions &&)=default
bool remove_extension(Extension_Code type)
bool has(Extension_Code type) const
const std::vector< std::unique_ptr< Extension > > & all() const
Extension_Code type() const override
static Extension_Code static_type()
bool empty() const override
static Extension_Code static_type()
Renegotiation_Extension(const std::vector< uint8_t > &bits)
bool empty() const override
Extension_Code type() const override
Renegotiation_Extension()=default
const std::vector< uint8_t > & renegotiation_info() const
Extension_Code type() const override
SRTP_Protection_Profiles(uint16_t pp)
bool empty() const override
SRTP_Protection_Profiles(const std::vector< uint16_t > &pp)
const std::vector< uint16_t > & profiles() const
static Extension_Code static_type()
static Extension_Code static_type()
Extension_Code type() const override
std::string host_name() const
bool empty() const override
Server_Name_Indicator(std::string_view host_name)
Session_Ticket_Extension()=default
static Extension_Code static_type()
Extension_Code type() const override
Session_Ticket_Extension(Session_Ticket session_ticket)
std::vector< uint8_t > serialize(Connection_Side) const override
bool empty() const override
const Session_Ticket & contents() const
static Extension_Code static_type()
bool empty() const override
Signature_Algorithms_Cert(std::vector< Signature_Scheme > schemes)
const std::vector< Signature_Scheme > & supported_schemes() const
Extension_Code type() const override
Signature_Algorithms(std::vector< Signature_Scheme > schemes)
const std::vector< Signature_Scheme > & supported_schemes() const
bool empty() const override
static Extension_Code static_type()
Extension_Code type() const override
bool empty() const override
Extension_Code type() const override
static Extension_Code static_type()
static Extension_Code static_type()
const std::vector< Protocol_Version > & versions() const
bool empty() const override
Supported_Versions(Protocol_Version version)
Extension_Code type() const override
bool empty() const override
const std::vector< uint8_t > & value()
bool is_implemented() const override
Extension_Code type() const override
int(* final)(unsigned char *, CTX *)
#define BOTAN_UNSTABLE_API
@ CertSignatureAlgorithms
@ ApplicationLayerProtocolNegotiation
@ CertificateStatusRequest