Botan  2.10.0
Crypto and TLS for C++11
tls_handshake_state.cpp
Go to the documentation of this file.
1 /*
2 * TLS Handshaking
3 * (C) 2004-2006,2011,2012,2015,2016 Jack Lloyd
4 * 2017 Harry Reimann, Rohde & Schwarz Cybersecurity
5 *
6 * Botan is released under the Simplified BSD License (see license.txt)
7 */
8 
9 #include <botan/internal/tls_handshake_state.h>
10 #include <botan/internal/tls_record.h>
11 #include <botan/tls_messages.h>
12 #include <botan/kdf.h>
13 #include <sstream>
14 
15 namespace Botan {
16 
17 namespace TLS {
18 
19 std::string Handshake_Message::type_string() const
20  {
22  }
23 
25  {
26  switch(type)
27  {
29  return "hello_verify_request";
30 
31  case HELLO_REQUEST:
32  return "hello_request";
33 
34  case CLIENT_HELLO:
35  return "client_hello";
36 
37  case SERVER_HELLO:
38  return "server_hello";
39 
40  case CERTIFICATE:
41  return "certificate";
42 
43  case CERTIFICATE_URL:
44  return "certificate_url";
45 
46  case CERTIFICATE_STATUS:
47  return "certificate_status";
48 
49  case SERVER_KEX:
50  return "server_key_exchange";
51 
53  return "certificate_request";
54 
55  case SERVER_HELLO_DONE:
56  return "server_hello_done";
57 
58  case CERTIFICATE_VERIFY:
59  return "certificate_verify";
60 
61  case CLIENT_KEX:
62  return "client_key_exchange";
63 
64  case NEW_SESSION_TICKET:
65  return "new_session_ticket";
66 
67  case HANDSHAKE_CCS:
68  return "change_cipher_spec";
69 
70  case FINISHED:
71  return "finished";
72 
73  case HANDSHAKE_NONE:
74  return "invalid";
75  }
76 
78  "Unknown TLS handshake message type " + std::to_string(type));
79  }
80 
81 namespace {
82 
83 uint32_t bitmask_for_handshake_type(Handshake_Type type)
84  {
85  switch(type)
86  {
88  return (1 << 0);
89 
90  case HELLO_REQUEST:
91  return (1 << 1);
92 
93  case CLIENT_HELLO:
94  return (1 << 2);
95 
96  case SERVER_HELLO:
97  return (1 << 3);
98 
99  case CERTIFICATE:
100  return (1 << 4);
101 
102  case CERTIFICATE_URL:
103  return (1 << 5);
104 
105  case CERTIFICATE_STATUS:
106  return (1 << 6);
107 
108  case SERVER_KEX:
109  return (1 << 7);
110 
111  case CERTIFICATE_REQUEST:
112  return (1 << 8);
113 
114  case SERVER_HELLO_DONE:
115  return (1 << 9);
116 
117  case CERTIFICATE_VERIFY:
118  return (1 << 10);
119 
120  case CLIENT_KEX:
121  return (1 << 11);
122 
123  case NEW_SESSION_TICKET:
124  return (1 << 12);
125 
126  case HANDSHAKE_CCS:
127  return (1 << 13);
128 
129  case FINISHED:
130  return (1 << 14);
131 
132  // allow explicitly disabling new handshakes
133  case HANDSHAKE_NONE:
134  return 0;
135  }
136 
138  "Unknown TLS handshake message type " + std::to_string(type));
139  }
140 
141 std::string handshake_mask_to_string(uint32_t mask)
142  {
143  const Handshake_Type types[] = {
146  CLIENT_HELLO,
147  CERTIFICATE,
150  SERVER_KEX,
154  CLIENT_KEX,
157  FINISHED
158  };
159 
160  std::ostringstream o;
161  bool empty = true;
162 
163  for(auto&& t : types)
164  {
165  if(mask & bitmask_for_handshake_type(t))
166  {
167  if(!empty)
168  o << ",";
169  o << handshake_type_to_string(t);
170  empty = false;
171  }
172  }
173 
174  return o.str();
175  }
176 
177 }
178 
179 /*
180 * Initialize the SSL/TLS Handshake State
181 */
183  m_callbacks(cb),
184  m_handshake_io(io),
185  m_version(m_handshake_io->initial_record_version())
186  {
187  }
188 
190  {
191  m_callbacks.tls_inspect_handshake_msg(msg);
192  }
193 
195  {
196  note_message(hello_verify);
197 
198  m_client_hello->update_hello_cookie(hello_verify);
199  hash().reset();
200  hash().update(handshake_io().send(*m_client_hello));
201  note_message(*m_client_hello);
202  }
203 
205  {
206  m_client_hello.reset(client_hello);
207  note_message(*m_client_hello);
208  }
209 
211  {
212  m_server_hello.reset(server_hello);
213  m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite());
214  note_message(*m_server_hello);
215  }
216 
218  {
219  m_server_certs.reset(server_certs);
220  note_message(*m_server_certs);
221  }
222 
224  {
225  m_server_cert_status.reset(server_cert_status);
226  note_message(*m_server_cert_status);
227  }
228 
230  {
231  m_server_kex.reset(server_kex);
232  note_message(*m_server_kex);
233  }
234 
236  {
237  m_cert_req.reset(cert_req);
238  note_message(*m_cert_req);
239  }
240 
242  {
243  m_server_hello_done.reset(server_hello_done);
244  note_message(*m_server_hello_done);
245  }
246 
248  {
249  m_client_certs.reset(client_certs);
250  note_message(*m_client_certs);
251  }
252 
254  {
255  m_client_kex.reset(client_kex);
256  note_message(*m_client_kex);
257  }
258 
260  {
261  m_client_verify.reset(client_verify);
262  note_message(*m_client_verify);
263  }
264 
266  {
267  m_new_session_ticket.reset(new_session_ticket);
268  note_message(*m_new_session_ticket);
269  }
270 
272  {
273  m_server_finished.reset(server_finished);
274  note_message(*m_server_finished);
275  }
276 
278  {
279  m_client_finished.reset(client_finished);
280  note_message(*m_client_finished);
281  }
282 
284  {
285  m_version = version;
286  }
287 
289  {
290  m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false);
291  }
292 
294  {
295  m_session_keys = Session_Keys(this, resume_master_secret, true);
296  }
297 
299  {
300  const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
301 
302  m_hand_received_mask |= mask;
303 
304  const bool ok = (m_hand_expecting_mask & mask) != 0; // overlap?
305 
306  if(!ok)
307  throw Unexpected_Message("Unexpected state transition in handshake, got type " +
308  std::to_string(handshake_msg) +
309  " expected " + handshake_mask_to_string(m_hand_expecting_mask) +
310  " received " + handshake_mask_to_string(m_hand_received_mask));
311 
312  /* We don't know what to expect next, so force a call to
313  set_expected_next; if it doesn't happen, the next transition
314  check will always fail which is what we want.
315  */
316  m_hand_expecting_mask = 0;
317  }
318 
320  {
321  m_hand_expecting_mask |= bitmask_for_handshake_type(handshake_msg);
322  }
323 
325  {
326  const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
327 
328  return (m_hand_received_mask & mask) != 0;
329  }
330 
331 std::pair<Handshake_Type, std::vector<uint8_t>>
333  {
334  const bool expecting_ccs =
335  (bitmask_for_handshake_type(HANDSHAKE_CCS) & m_hand_expecting_mask) != 0;
336 
337  return m_handshake_io->get_next_record(expecting_ccs);
338  }
339 
341  {
342 #if defined(BOTAN_HAS_SRP6)
343  // Authenticated via the successful key exchange
344  if(ciphersuite().valid() && ciphersuite().kex_method() == Kex_Algo::SRP_SHA)
345  return client_hello()->srp_identifier();
346 #endif
347 
348  return "";
349  }
350 
351 
352 std::vector<uint8_t> Handshake_State::session_ticket() const
353  {
354  if(new_session_ticket() && !new_session_ticket()->ticket().empty())
355  return new_session_ticket()->ticket();
356 
357  return client_hello()->session_ticket();
358  }
359 
361  {
362  if(version().supports_ciphersuite_specific_prf())
363  {
364  const std::string prf_algo = ciphersuite().prf_algo();
365 
366  if(prf_algo == "MD5" || prf_algo == "SHA-1")
367  return get_kdf("TLS-12-PRF(SHA-256)");
368 
369  return get_kdf("TLS-12-PRF(" + prf_algo + ")");
370  }
371 
372  // Old PRF used in TLS v1.0, v1.1 and DTLS v1.0
373  return get_kdf("TLS-PRF");
374  }
375 
376 std::pair<std::string, Signature_Format>
378  Signature_Scheme& chosen_scheme,
379  bool for_client_auth,
380  const Policy& policy) const
381  {
382  const std::string sig_algo = key.algo_name();
383 
384  if(this->version().supports_negotiable_signature_algorithms())
385  {
386  const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();
387 
388  std::vector<Signature_Scheme> schemes =
389  (for_client_auth) ? cert_req()->signature_schemes() : client_hello()->signature_schemes();
390 
391  if(schemes.empty())
392  {
393  // Implicit SHA-1
394  schemes.push_back(Signature_Scheme::RSA_PKCS1_SHA1);
395  schemes.push_back(Signature_Scheme::ECDSA_SHA1);
396  schemes.push_back(Signature_Scheme::DSA_SHA1);
397  }
398 
399  for(Signature_Scheme scheme : schemes)
400  {
401  if(signature_scheme_is_known(scheme) == false)
402  {
403  continue;
404  }
405 
406  if(signature_algorithm_of_scheme(scheme) == sig_algo)
407  {
408  if(std::find(allowed.begin(), allowed.end(), scheme) != allowed.end())
409  {
410  chosen_scheme = scheme;
411  break;
412  }
413  }
414  }
415 
416  const std::string hash = hash_function_of_scheme(chosen_scheme);
417 
418  if(!policy.allowed_signature_hash(hash))
419  {
421  "Policy refuses to accept signing with any hash supported by peer");
422  }
423 
424  if(sig_algo == "RSA")
425  {
426  return std::make_pair(padding_string_for_scheme(chosen_scheme), IEEE_1363);
427  }
428  else if(sig_algo == "DSA" || sig_algo == "ECDSA")
429  {
430  return std::make_pair(padding_string_for_scheme(chosen_scheme), DER_SEQUENCE);
431  }
432  }
433  else
434  {
435  if(sig_algo == "RSA")
436  {
437  const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
438  return std::make_pair(padding, IEEE_1363);
439  }
440  else if(sig_algo == "DSA" || sig_algo == "ECDSA")
441  {
442  const std::string padding = "EMSA1(SHA-1)";
443  return std::make_pair(padding, DER_SEQUENCE);
444  }
445  }
446 
447  throw Invalid_Argument(sig_algo + " is invalid/unknown for TLS signatures");
448  }
449 
450 namespace {
451 
452 bool supported_algos_include(
453  const std::vector<Signature_Scheme>& schemes,
454  const std::string& key_type,
455  const std::string& hash_type)
456  {
457  for(Signature_Scheme scheme : schemes)
458  {
459  if(signature_scheme_is_known(scheme) &&
460  hash_function_of_scheme(scheme) == hash_type &&
461  signature_algorithm_of_scheme(scheme) == key_type)
462  {
463  return true;
464  }
465  }
466 
467  return false;
468  }
469 
470 }
471 
472 std::pair<std::string, Signature_Format>
474  Signature_Scheme scheme,
475  bool for_client_auth,
476  const Policy& policy) const
477  {
478  const std::string key_type = key.algo_name();
479 
480  if(!policy.allowed_signature_method(key_type))
481  {
483  "Rejecting " + key_type + " signature");
484  }
485 
486  if(this->version().supports_negotiable_signature_algorithms() == false)
487  {
488  if(scheme != Signature_Scheme::NONE)
489  throw Decoding_Error("Counterparty sent hash/sig IDs with old version");
490 
491  /*
492  There is no check on the acceptability of a v1.0/v1.1 hash type,
493  since it's implicit with use of the protocol
494  */
495 
496  if(key_type == "RSA")
497  {
498  const std::string padding = "PKCS1v15(Parallel(MD5,SHA-160))";
499  return std::make_pair(padding, IEEE_1363);
500  }
501  else if(key_type == "DSA" || key_type == "ECDSA")
502  {
503  const std::string padding = "EMSA1(SHA-1)";
504  return std::make_pair(padding, DER_SEQUENCE);
505  }
506  else
507  throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
508  }
509 
510  if(scheme == Signature_Scheme::NONE)
511  throw Decoding_Error("Counterparty did not send hash/sig IDS");
512 
513  if(key_type != signature_algorithm_of_scheme(scheme))
514  throw Decoding_Error("Counterparty sent inconsistent key and sig types");
515 
516  if(for_client_auth && !cert_req())
517  {
519  "No certificate verify set");
520  }
521 
522  /*
523  Confirm the signature type we just received against the
524  supported_algos list that we sent; it better be there.
525  */
526 
527  const std::vector<Signature_Scheme> supported_algos =
528  for_client_auth ? cert_req()->signature_schemes() :
530 
531  const std::string hash_algo = hash_function_of_scheme(scheme);
532 
533  if(!supported_algos_include(supported_algos, key_type, hash_algo))
534  {
536  "TLS signature extension did not allow for " +
537  key_type + "/" + hash_algo + " signature");
538  }
539 
540  if(key_type == "RSA")
541  {
542  return std::make_pair(padding_string_for_scheme(scheme), IEEE_1363);
543  }
544  else if(key_type == "DSA" || key_type == "ECDSA")
545  {
546  return std::make_pair(padding_string_for_scheme(scheme), DER_SEQUENCE);
547  }
548 
549  throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
550  }
551 
552 }
553 
554 }
std::string padding_string_for_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:379
std::string hash_function_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:191
const Client_Key_Exchange * client_kex() const
std::pair< std::string, Signature_Format > parse_sig_format(const Public_Key &key, Signature_Scheme scheme, bool for_client_auth, const Policy &policy) const
std::vector< uint8_t > session_ticket() const
std::vector< uint8_t > session_ticket() const
std::string prf_algo() const
Signature_Scheme
Definition: tls_algos.h:84
std::pair< std::string, Signature_Format > choose_sig_format(const Private_Key &key, Signature_Scheme &scheme, bool for_client_auth, const Policy &policy) const
const Server_Hello * server_hello() const
virtual std::string algo_name() const =0
const Certificate * server_certs() const
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:210
Handshake_State(Handshake_IO *io, Callbacks &callbacks)
const Finished * server_finished() const
const Server_Key_Exchange * server_kex() const
const Ciphersuite & ciphersuite() const
void set_version(const Protocol_Version &version)
const Certificate_Req * cert_req() const
const Certificate_Verify * client_verify() const
const Certificate_Status * server_cert_status() const
std::pair< Handshake_Type, std::vector< uint8_t > > get_next_handshake_msg()
const Finished * client_finished() const
bool allowed_signature_method(const std::string &sig_method) const
Definition: tls_policy.cpp:115
void update(const uint8_t in[], size_t length)
std::vector< Signature_Scheme > signature_schemes() const
const Certificate * client_certs() const
KDF * get_kdf(const std::string &algo_spec)
Definition: kdf.cpp:237
bool allowed_signature_hash(const std::string &hash) const
Definition: tls_policy.cpp:120
Definition: alg_id.cpp:13
bool received_handshake_msg(Handshake_Type msg_type) const
void confirm_transition_to(Handshake_Type msg_type)
secure_vector< uint8_t > resume_master_secret
Definition: tls_client.cpp:41
AlgorithmIdentifier hash_algo
Definition: x509_obj.cpp:23
virtual Handshake_Type type() const =0
void note_message(const Handshake_Message &msg)
Definition: kdf.h:20
const std::vector< uint8_t > & ticket() const
Definition: tls_messages.h:600
const New_Session_Ticket * new_session_ticket() const
std::string signature_algorithm_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:291
const Server_Hello_Done * server_hello_done() const
bool signature_scheme_is_known(Signature_Scheme scheme)
Definition: tls_algos.cpp:262
static Ciphersuite by_id(uint16_t suite)
void hello_verify_request(const Hello_Verify_Request &hello_verify)
Protocol_Version version() const
std::vector< T, secure_allocator< T > > secure_vector
Definition: secmem.h:65
virtual void tls_inspect_handshake_msg(const Handshake_Message &message)
const Client_Hello * client_hello() const
const std::vector< Signature_Scheme > & signature_schemes() const
Definition: tls_messages.h:416
const char * handshake_type_to_string(Handshake_Type type)
void set_expected_next(Handshake_Type msg_type)
virtual std::vector< Signature_Scheme > allowed_signature_schemes() const
Definition: tls_policy.cpp:22