Botan  2.6.0
Crypto and TLS for C++11
tls_handshake_state.cpp
Go to the documentation of this file.
1 /*
2 * TLS Handshaking
3 * (C) 2004-2006,2011,2012,2015,2016 Jack Lloyd
4 * 2017 Harry Reimann, Rohde & Schwarz Cybersecurity
5 *
6 * Botan is released under the Simplified BSD License (see license.txt)
7 */
8 
9 #include <botan/internal/tls_handshake_state.h>
10 #include <botan/internal/tls_record.h>
11 #include <botan/tls_messages.h>
12 #include <botan/kdf.h>
13 #include <sstream>
14 
15 namespace Botan {
16 
17 namespace TLS {
18 
19 std::string Handshake_Message::type_string() const
20  {
22  }
23 
25  {
26  switch(type)
27  {
29  return "hello_verify_request";
30 
31  case HELLO_REQUEST:
32  return "hello_request";
33 
34  case CLIENT_HELLO:
35  return "client_hello";
36 
37  case SERVER_HELLO:
38  return "server_hello";
39 
40  case CERTIFICATE:
41  return "certificate";
42 
43  case CERTIFICATE_URL:
44  return "certificate_url";
45 
46  case CERTIFICATE_STATUS:
47  return "certificate_status";
48 
49  case SERVER_KEX:
50  return "server_key_exchange";
51 
53  return "certificate_request";
54 
55  case SERVER_HELLO_DONE:
56  return "server_hello_done";
57 
58  case CERTIFICATE_VERIFY:
59  return "certificate_verify";
60 
61  case CLIENT_KEX:
62  return "client_key_exchange";
63 
64  case NEW_SESSION_TICKET:
65  return "new_session_ticket";
66 
67  case HANDSHAKE_CCS:
68  return "change_cipher_spec";
69 
70  case FINISHED:
71  return "finished";
72 
73  case HANDSHAKE_NONE:
74  return "invalid";
75  }
76 
78  "Unknown TLS handshake message type " + std::to_string(type));
79  }
80 
81 namespace {
82 
83 uint32_t bitmask_for_handshake_type(Handshake_Type type)
84  {
85  switch(type)
86  {
88  return (1 << 0);
89 
90  case HELLO_REQUEST:
91  return (1 << 1);
92 
93  case CLIENT_HELLO:
94  return (1 << 2);
95 
96  case SERVER_HELLO:
97  return (1 << 3);
98 
99  case CERTIFICATE:
100  return (1 << 4);
101 
102  case CERTIFICATE_URL:
103  return (1 << 5);
104 
105  case CERTIFICATE_STATUS:
106  return (1 << 6);
107 
108  case SERVER_KEX:
109  return (1 << 7);
110 
111  case CERTIFICATE_REQUEST:
112  return (1 << 8);
113 
114  case SERVER_HELLO_DONE:
115  return (1 << 9);
116 
117  case CERTIFICATE_VERIFY:
118  return (1 << 10);
119 
120  case CLIENT_KEX:
121  return (1 << 11);
122 
123  case NEW_SESSION_TICKET:
124  return (1 << 12);
125 
126  case HANDSHAKE_CCS:
127  return (1 << 13);
128 
129  case FINISHED:
130  return (1 << 14);
131 
132  // allow explicitly disabling new handshakes
133  case HANDSHAKE_NONE:
134  return 0;
135  }
136 
137  throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
138  "Unknown TLS handshake message type " + std::to_string(type));
139  }
140 
141 std::string handshake_mask_to_string(uint32_t mask)
142  {
143  const Handshake_Type types[] = {
146  CLIENT_HELLO,
147  CERTIFICATE,
150  SERVER_KEX,
154  CLIENT_KEX,
157  FINISHED
158  };
159 
160  std::ostringstream o;
161  bool empty = true;
162 
163  for(auto&& t : types)
164  {
165  if(mask & bitmask_for_handshake_type(t))
166  {
167  if(!empty)
168  o << ",";
169  o << handshake_type_to_string(t);
170  empty = false;
171  }
172  }
173 
174  return o.str();
175  }
176 
177 }
178 
179 /*
180 * Initialize the SSL/TLS Handshake State
181 */
183  m_callbacks(cb),
184  m_handshake_io(io),
185  m_version(m_handshake_io->initial_record_version())
186  {
187  }
188 
190  {
191  m_callbacks.tls_inspect_handshake_msg(msg);
192  }
193 
195  {
196  note_message(hello_verify);
197 
198  m_client_hello->update_hello_cookie(hello_verify);
199  hash().reset();
200  hash().update(handshake_io().send(*m_client_hello));
201  note_message(*m_client_hello);
202  }
203 
205  {
206  m_client_hello.reset(client_hello);
207  note_message(*m_client_hello);
208  }
209 
211  {
212  m_server_hello.reset(server_hello);
213  m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite());
214  note_message(*m_server_hello);
215  }
216 
218  {
219  m_server_certs.reset(server_certs);
220  note_message(*m_server_certs);
221  }
222 
224  {
225  m_server_cert_status.reset(server_cert_status);
226  note_message(*m_server_cert_status);
227  }
228 
230  {
231  m_server_kex.reset(server_kex);
232  note_message(*m_server_kex);
233  }
234 
236  {
237  m_cert_req.reset(cert_req);
238  note_message(*m_cert_req);
239  }
240 
242  {
243  m_server_hello_done.reset(server_hello_done);
244  note_message(*m_server_hello_done);
245  }
246 
248  {
249  m_client_certs.reset(client_certs);
250  note_message(*m_client_certs);
251  }
252 
254  {
255  m_client_kex.reset(client_kex);
256  note_message(*m_client_kex);
257  }
258 
260  {
261  m_client_verify.reset(client_verify);
262  note_message(*m_client_verify);
263  }
264 
266  {
267  m_new_session_ticket.reset(new_session_ticket);
268  note_message(*m_new_session_ticket);
269  }
270 
272  {
273  m_server_finished.reset(server_finished);
274  note_message(*m_server_finished);
275  }
276 
278  {
279  m_client_finished.reset(client_finished);
280  note_message(*m_client_finished);
281  }
282 
284  {
285  m_version = version;
286  }
287 
289  {
290  m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false);
291  }
292 
294  {
295  m_session_keys = Session_Keys(this, resume_master_secret, true);
296  }
297 
299  {
300  const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
301 
302  m_hand_received_mask |= mask;
303 
304  const bool ok = (m_hand_expecting_mask & mask) != 0; // overlap?
305 
306  if(!ok)
307  throw Unexpected_Message("Unexpected state transition in handshake, got type " +
308  std::to_string(handshake_msg) +
309  " expected " + handshake_mask_to_string(m_hand_expecting_mask) +
310  " received " + handshake_mask_to_string(m_hand_received_mask));
311 
312  /* We don't know what to expect next, so force a call to
313  set_expected_next; if it doesn't happen, the next transition
314  check will always fail which is what we want.
315  */
316  m_hand_expecting_mask = 0;
317  }
318 
320  {
321  m_hand_expecting_mask |= bitmask_for_handshake_type(handshake_msg);
322  }
323 
325  {
326  const uint32_t mask = bitmask_for_handshake_type(handshake_msg);
327 
328  return (m_hand_received_mask & mask) != 0;
329  }
330 
331 std::pair<Handshake_Type, std::vector<uint8_t>>
333  {
334  const bool expecting_ccs =
335  (bitmask_for_handshake_type(HANDSHAKE_CCS) & m_hand_expecting_mask) != 0;
336 
337  return m_handshake_io->get_next_record(expecting_ccs);
338  }
339 
341  {
342 #if defined(BOTAN_HAS_SRP6)
343  // Authenticated via the successful key exchange
344  if(ciphersuite().valid() && ciphersuite().kex_method() == Kex_Algo::SRP_SHA)
345  return client_hello()->srp_identifier();
346 #endif
347 
348  return "";
349  }
350 
351 
352 std::vector<uint8_t> Handshake_State::session_ticket() const
353  {
354  if(new_session_ticket() && !new_session_ticket()->ticket().empty())
355  return new_session_ticket()->ticket();
356 
357  return client_hello()->session_ticket();
358  }
359 
361  {
362  if(version().supports_ciphersuite_specific_prf())
363  {
364  const std::string prf_algo = ciphersuite().prf_algo();
365 
366  if(prf_algo == "MD5" || prf_algo == "SHA-1")
367  return get_kdf("TLS-12-PRF(SHA-256)");
368 
369  return get_kdf("TLS-12-PRF(" + prf_algo + ")");
370  }
371 
372  // Old PRF used in TLS v1.0, v1.1 and DTLS v1.0
373  return get_kdf("TLS-PRF");
374  }
375 
376 std::pair<std::string, Signature_Format>
378  Signature_Scheme& chosen_scheme,
379  bool for_client_auth,
380  const Policy& policy) const
381  {
382  const std::string sig_algo = key.algo_name();
383 
384  if(this->version().supports_negotiable_signature_algorithms())
385  {
386  const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();
387 
388  std::vector<Signature_Scheme> schemes =
389  (for_client_auth) ? cert_req()->signature_schemes() : client_hello()->signature_schemes();
390 
391  if(schemes.empty())
392  {
393  // Implicit SHA-1
394  schemes.push_back(Signature_Scheme::RSA_PKCS1_SHA1);
395  schemes.push_back(Signature_Scheme::ECDSA_SHA1);
396  schemes.push_back(Signature_Scheme::DSA_SHA1);
397  }
398 
399  for(Signature_Scheme scheme : schemes)
400  {
401  if(signature_algorithm_of_scheme(scheme) == sig_algo)
402  {
403  if(std::find(allowed.begin(), allowed.end(), scheme) != allowed.end())
404  {
405  chosen_scheme = scheme;
406  break;
407  }
408  }
409  }
410 
411  const std::string hash = hash_function_of_scheme(chosen_scheme);
412 
413  if(!policy.allowed_signature_hash(hash))
414  {
416  "Policy refuses to accept signing with any hash supported by peer");
417  }
418 
419  if(sig_algo == "RSA")
420  {
421  return std::make_pair(padding_string_for_scheme(chosen_scheme), IEEE_1363);
422  }
423  else if(sig_algo == "DSA" || sig_algo == "ECDSA")
424  {
425  return std::make_pair(padding_string_for_scheme(chosen_scheme), DER_SEQUENCE);
426  }
427  }
428  else
429  {
430  if(sig_algo == "RSA")
431  {
432  const std::string padding = "EMSA3(Parallel(MD5,SHA-160))";
433  return std::make_pair(padding, IEEE_1363);
434  }
435  else if(sig_algo == "DSA" || sig_algo == "ECDSA")
436  {
437  const std::string padding = "EMSA1(SHA-1)";
438  return std::make_pair(padding, DER_SEQUENCE);
439  }
440  }
441 
442  throw Invalid_Argument(sig_algo + " is invalid/unknown for TLS signatures");
443  }
444 
445 namespace {
446 
447 bool supported_algos_include(
448  const std::vector<Signature_Scheme>& schemes,
449  const std::string& key_type,
450  const std::string& hash_type)
451  {
452  for(Signature_Scheme scheme : schemes)
453  {
454  if(hash_function_of_scheme(scheme) == hash_type &&
455  signature_algorithm_of_scheme(scheme) == key_type)
456  {
457  return true;
458  }
459  }
460 
461  return false;
462  }
463 
464 }
465 
466 std::pair<std::string, Signature_Format>
468  Signature_Scheme scheme,
469  bool for_client_auth,
470  const Policy& policy) const
471  {
472  const std::string key_type = key.algo_name();
473 
474  if(!policy.allowed_signature_method(key_type))
475  {
477  "Rejecting " + key_type + " signature");
478  }
479 
480  if(this->version().supports_negotiable_signature_algorithms() == false)
481  {
482  if(scheme != Signature_Scheme::NONE)
483  throw Decoding_Error("Counterparty sent hash/sig IDs with old version");
484 
485  /*
486  There is no check on the acceptability of a v1.0/v1.1 hash type,
487  since it's implicit with use of the protocol
488  */
489 
490  if(key_type == "RSA")
491  {
492  const std::string padding = "EMSA3(Parallel(MD5,SHA-160))";
493  return std::make_pair(padding, IEEE_1363);
494  }
495  else if(key_type == "DSA" || key_type == "ECDSA")
496  {
497  const std::string padding = "EMSA1(SHA-1)";
498  return std::make_pair(padding, DER_SEQUENCE);
499  }
500  else
501  throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
502  }
503 
504  if(scheme == Signature_Scheme::NONE)
505  throw Decoding_Error("Counterparty did not send hash/sig IDS");
506 
507  if(key_type != signature_algorithm_of_scheme(scheme))
508  throw Decoding_Error("Counterparty sent inconsistent key and sig types");
509 
510  if(for_client_auth && !cert_req())
511  {
513  "No certificate verify set");
514  }
515 
516  /*
517  Confirm the signature type we just received against the
518  supported_algos list that we sent; it better be there.
519  */
520 
521  const std::vector<Signature_Scheme> supported_algos =
522  for_client_auth ? cert_req()->signature_schemes() :
524 
525  const std::string hash_algo = hash_function_of_scheme(scheme);
526 
527  if(!supported_algos_include(supported_algos, key_type, hash_algo))
528  {
530  "TLS signature extension did not allow for " +
531  key_type + "/" + hash_algo + " signature");
532  }
533 
534  if(key_type == "RSA")
535  {
536  return std::make_pair(padding_string_for_scheme(scheme), IEEE_1363);
537  }
538  else if(key_type == "DSA" || key_type == "ECDSA")
539  {
540  return std::make_pair(padding_string_for_scheme(scheme), DER_SEQUENCE);
541  }
542 
543  throw Invalid_Argument(key_type + " is invalid/unknown for TLS signatures");
544  }
545 
546 }
547 
548 }
std::string padding_string_for_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:379
std::string hash_function_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:191
const Client_Key_Exchange * client_kex() const
std::pair< std::string, Signature_Format > parse_sig_format(const Public_Key &key, Signature_Scheme scheme, bool for_client_auth, const Policy &policy) const
std::vector< uint8_t > session_ticket() const
std::vector< uint8_t > session_ticket() const
std::string prf_algo() const
Signature_Scheme
Definition: tls_algos.h:84
std::pair< std::string, Signature_Format > choose_sig_format(const Private_Key &key, Signature_Scheme &scheme, bool for_client_auth, const Policy &policy) const
const Server_Hello * server_hello() const
virtual std::string algo_name() const =0
const Certificate * server_certs() const
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:145
Handshake_State(Handshake_IO *io, Callbacks &callbacks)
const Finished * server_finished() const
MechanismType type
const Server_Key_Exchange * server_kex() const
const Ciphersuite & ciphersuite() const
void set_version(const Protocol_Version &version)
const Certificate_Req * cert_req() const
const Certificate_Verify * client_verify() const
const Certificate_Status * server_cert_status() const
std::pair< Handshake_Type, std::vector< uint8_t > > get_next_handshake_msg()
const Finished * client_finished() const
bool allowed_signature_method(const std::string &sig_method) const
Definition: tls_policy.cpp:115
void update(const uint8_t in[], size_t length)
std::vector< Signature_Scheme > signature_schemes() const
const Certificate * client_certs() const
KDF * get_kdf(const std::string &algo_spec)
Definition: kdf.cpp:237
bool allowed_signature_hash(const std::string &hash) const
Definition: tls_policy.cpp:120
Definition: alg_id.cpp:13
bool received_handshake_msg(Handshake_Type msg_type) const
void confirm_transition_to(Handshake_Type msg_type)
secure_vector< uint8_t > resume_master_secret
Definition: tls_client.cpp:41
AlgorithmIdentifier hash_algo
Definition: x509_obj.cpp:23
virtual Handshake_Type type() const =0
void note_message(const Handshake_Message &msg)
Definition: kdf.h:20
const std::vector< uint8_t > & ticket() const
Definition: tls_messages.h:600
const New_Session_Ticket * new_session_ticket() const
std::string signature_algorithm_of_scheme(Signature_Scheme scheme)
Definition: tls_algos.cpp:291
const Server_Hello_Done * server_hello_done() const
static Ciphersuite by_id(uint16_t suite)
void hello_verify_request(const Hello_Verify_Request &hello_verify)
Protocol_Version version() const
std::vector< T, secure_allocator< T > > secure_vector
Definition: secmem.h:88
virtual void tls_inspect_handshake_msg(const Handshake_Message &message)
const Client_Hello * client_hello() const
const std::vector< Signature_Scheme > & signature_schemes() const
Definition: tls_messages.h:416
const char * handshake_type_to_string(Handshake_Type type)
void set_expected_next(Handshake_Type msg_type)
virtual std::vector< Signature_Scheme > allowed_signature_schemes() const
Definition: tls_policy.cpp:22