Revision control
Copy as Markdown
Other Tools
/*
* TLS Server Hello and Server Hello Done
* (C) 2004-2011,2015,2016,2019 Jack Lloyd
* 2016 Matthias Gierlings
* 2017 Harry Reimann, Rohde & Schwarz Cybersecurity
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/tls_messages.h>
#include <botan/tls_extensions.h>
#include <botan/tls_callbacks.h>
#include <botan/internal/tls_reader.h>
#include <botan/internal/tls_session_key.h>
#include <botan/internal/tls_handshake_io.h>
#include <botan/internal/tls_handshake_hash.h>
#include <botan/internal/stl_util.h>
namespace Botan {
namespace TLS {
namespace {
const uint64_t DOWNGRADE_TLS11 = 0x444F574E47524400;
//const uint64_t DOWNGRADE_TLS12 = 0x444F574E47524401;
std::vector<uint8_t>
make_server_hello_random(RandomNumberGenerator& rng,
Protocol_Version offered_version,
const Policy& policy)
{
auto random = make_hello_random(rng, policy);
if((offered_version == Protocol_Version::TLS_V10 ||
offered_version == Protocol_Version::TLS_V11) &&
policy.allow_tls12())
{
store_be(DOWNGRADE_TLS11, &random[24]);
}
if(offered_version == Protocol_Version::DTLS_V10 && policy.allow_dtls12())
{
store_be(DOWNGRADE_TLS11, &random[24]);
}
return random;
}
}
// New session case
Server_Hello::Server_Hello(Handshake_IO& io,
Handshake_Hash& hash,
const Policy& policy,
Callbacks& cb,
RandomNumberGenerator& rng,
const std::vector<uint8_t>& reneg_info,
const Client_Hello& client_hello,
const Server_Hello::Settings& server_settings,
const std::string next_protocol) :
m_version(server_settings.protocol_version()),
m_session_id(server_settings.session_id()),
m_random(make_server_hello_random(rng, m_version, policy)),
m_ciphersuite(server_settings.ciphersuite()),
m_comp_method(0)
{
if(client_hello.supports_extended_master_secret())
m_extensions.add(new Extended_Master_Secret);
// Sending the extension back does not commit us to sending a stapled response
if(client_hello.supports_cert_status_message() && policy.support_cert_status_message())
m_extensions.add(new Certificate_Status_Request);
Ciphersuite c = Ciphersuite::by_id(m_ciphersuite);
if(c.cbc_ciphersuite() && client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac())
{
m_extensions.add(new Encrypt_then_MAC);
}
if(c.ecc_ciphersuite() && client_hello.extension_types().count(TLSEXT_EC_POINT_FORMATS))
{
m_extensions.add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
}
if(client_hello.secure_renegotiation())
m_extensions.add(new Renegotiation_Extension(reneg_info));
if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket())
m_extensions.add(new Session_Ticket());
if(!next_protocol.empty() && client_hello.supports_alpn())
m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
if(m_version.is_datagram_protocol())
{
const std::vector<uint16_t> server_srtp = policy.srtp_profiles();
const std::vector<uint16_t> client_srtp = client_hello.srtp_profiles();
if(!server_srtp.empty() && !client_srtp.empty())
{
uint16_t shared = 0;
// always using server preferences for now
for(auto s_srtp : server_srtp)
for(auto c_srtp : client_srtp)
{
if(shared == 0 && s_srtp == c_srtp)
shared = s_srtp;
}
if(shared)
m_extensions.add(new SRTP_Protection_Profiles(shared));
}
}
cb.tls_modify_extensions(m_extensions, SERVER);
hash.update(io.send(*this));
}
// Resuming
Server_Hello::Server_Hello(Handshake_IO& io,
Handshake_Hash& hash,
const Policy& policy,
Callbacks& cb,
RandomNumberGenerator& rng,
const std::vector<uint8_t>& reneg_info,
const Client_Hello& client_hello,
Session& resumed_session,
bool offer_session_ticket,
const std::string& next_protocol) :
m_version(resumed_session.version()),
m_session_id(client_hello.session_id()),
m_random(make_hello_random(rng, policy)),
m_ciphersuite(resumed_session.ciphersuite_code()),
m_comp_method(0)
{
if(client_hello.supports_extended_master_secret())
m_extensions.add(new Extended_Master_Secret);
if(client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac())
{
Ciphersuite c = resumed_session.ciphersuite();
if(c.cbc_ciphersuite())
m_extensions.add(new Encrypt_then_MAC);
}
if(resumed_session.ciphersuite().ecc_ciphersuite() && client_hello.extension_types().count(TLSEXT_EC_POINT_FORMATS))
{
m_extensions.add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
}
if(client_hello.secure_renegotiation())
m_extensions.add(new Renegotiation_Extension(reneg_info));
if(client_hello.supports_session_ticket() && offer_session_ticket)
m_extensions.add(new Session_Ticket());
if(!next_protocol.empty() && client_hello.supports_alpn())
m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
cb.tls_modify_extensions(m_extensions, SERVER);
hash.update(io.send(*this));
}
/*
* Deserialize a Server Hello message
*/
Server_Hello::Server_Hello(const std::vector<uint8_t>& buf)
{
if(buf.size() < 38)
throw Decoding_Error("Server_Hello: Packet corrupted");
TLS_Data_Reader reader("ServerHello", buf);
const uint8_t major_version = reader.get_byte();
const uint8_t minor_version = reader.get_byte();
m_version = Protocol_Version(major_version, minor_version);
m_random = reader.get_fixed<uint8_t>(32);
m_session_id = reader.get_range<uint8_t>(1, 0, 32);
m_ciphersuite = reader.get_uint16_t();
m_comp_method = reader.get_byte();
m_extensions.deserialize(reader, Connection_Side::SERVER);
}
/*
* Serialize a Server Hello message
*/
std::vector<uint8_t> Server_Hello::serialize() const
{
std::vector<uint8_t> buf;
buf.push_back(m_version.major_version());
buf.push_back(m_version.minor_version());
buf += m_random;
append_tls_length_value(buf, m_session_id, 1);
buf.push_back(get_byte(0, m_ciphersuite));
buf.push_back(get_byte(1, m_ciphersuite));
buf.push_back(m_comp_method);
buf += m_extensions.serialize(Connection_Side::SERVER);
return buf;
}
bool Server_Hello::random_signals_downgrade() const
{
const uint64_t last8 = load_be<uint64_t>(m_random.data(), 3);
return (last8 == DOWNGRADE_TLS11);
}
/*
* Create a new Server Hello Done message
*/
Server_Hello_Done::Server_Hello_Done(Handshake_IO& io,
Handshake_Hash& hash)
{
hash.update(io.send(*this));
}
/*
* Deserialize a Server Hello Done message
*/
Server_Hello_Done::Server_Hello_Done(const std::vector<uint8_t>& buf)
{
if(buf.size())
throw Decoding_Error("Server_Hello_Done: Must be empty, and is not");
}
/*
* Serialize a Server Hello Done message
*/
std::vector<uint8_t> Server_Hello_Done::serialize() const
{
return std::vector<uint8_t>();
}
}
}