Revision control
Copy as Markdown
Other Tools
/*
* TLS Hello Request and Client Hello Messages
* (C) 2022 Jack Lloyd
* 2022 René Meusel, Hannes Rantzsch - neXenio GmbH
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/tls_messages.h>
#include <botan/tls_callbacks.h>
#include <botan/tls_exceptn.h>
#include <botan/internal/tls_reader.h>
namespace Botan::TLS {
Encrypted_Extensions::Encrypted_Extensions(const Client_Hello_13& client_hello, const Policy& policy, Callbacks& cb) {
const auto& exts = client_hello.extensions();
// RFC 8446 4.2.7
// As of TLS 1.3, servers are permitted to send the "supported_groups"
// extension to the client. Clients [...] MAY use the information
// learned from a successfully completed handshake to change what groups
// they use in their "key_share" extension in subsequent connections.
if(exts.has<Supported_Groups>()) {
m_extensions.add(new Supported_Groups(policy.key_exchange_groups()));
}
const auto record_size_limit = policy.record_size_limit();
const auto max_record_size = MAX_PLAINTEXT_SIZE + 1 /* encrypted content type byte */;
if(exts.has<Record_Size_Limit>()) {
// RFC 8449 4
// Endpoints SHOULD advertise the "record_size_limit" extension, even
// if they have no need to limit the size of records. [...] For
// servers, this allows clients to know that their limit will be
// respected.
m_extensions.add(new Record_Size_Limit(record_size_limit.value_or(max_record_size)));
} else if(record_size_limit.has_value() && record_size_limit.value() < max_record_size) {
// RFC 8449 4
// Endpoints SHOULD advertise the "record_size_limit" extension, even if
// they have no need to limit the size of records. For clients, this
// allows servers to advertise a limit at their discretion.
throw TLS_Exception(Alert::MissingExtension,
"Server cannot enforce record size limit without the client supporting it");
}
// RFC 7250 4.2
// If the TLS server wants to request a certificate from the client
// (via the certificate_request message), it MUST include the
// client_certificate_type extension in the server hello.
// [...]
// If the server does not send a certificate_request payload [...],
// then the client_certificate_type payload in the server hello MUST be
// omitted.
if(auto ch_client_cert_types = exts.get<Client_Certificate_Type>();
ch_client_cert_types && policy.request_client_certificate_authentication()) {
m_extensions.add(new Client_Certificate_Type(*ch_client_cert_types, policy));
}
// RFC 7250 4.2
// The server_certificate_type extension in the client hello indicates the
// types of certificates the client is able to process when provided by
// the server in a subsequent certificate payload. [...] With the
// server_certificate_type extension in the server hello, the TLS server
// indicates the certificate type carried in the Certificate payload.
if(auto ch_server_cert_types = exts.get<Server_Certificate_Type>()) {
m_extensions.add(new Server_Certificate_Type(*ch_server_cert_types, policy));
}
// RFC 6066 3
// A server that receives a client hello containing the "server_name"
// extension [...] SHALL include an extension of type "server_name" in the
// (extended) server hello. The "extension_data" field of this extension
// SHALL be empty.
if(exts.has<Server_Name_Indicator>()) {
m_extensions.add(new Server_Name_Indicator(""));
}
if(auto alpn_ext = exts.get<Application_Layer_Protocol_Notification>()) {
const auto next_protocol = cb.tls_server_choose_app_protocol(alpn_ext->protocols());
if(!next_protocol.empty()) {
m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
}
}
// TODO: Implement handling for (at least)
// * SRTP
cb.tls_modify_extensions(m_extensions, Connection_Side::Server, type());
}
Encrypted_Extensions::Encrypted_Extensions(const std::vector<uint8_t>& buf) {
TLS_Data_Reader reader("encrypted extensions reader", buf);
// Encrypted Extensions contains a list of extensions. This list may legally
// be empty. However, in that case we should at least see a two-byte length
// field that reads 0x00 0x00.
if(buf.size() < 2) {
throw TLS_Exception(Alert::DecodeError, "Server sent an empty Encrypted Extensions message");
}
m_extensions.deserialize(reader, Connection_Side::Server, type());
// RFC 8446 4.2
// If an implementation receives an extension which it recognizes and
// which is not specified for the message in which it appears, it MUST
// abort the handshake with an "illegal_parameter" alert.
//
// Note that we cannot encounter any extensions that we don't recognize here,
// since only extensions we previously offered are allowed in EE.
const auto allowed_exts = std::set<Extension_Code>{
// Allowed extensions listed in RFC 8446 and implemented in Botan
Extension_Code::ServerNameIndication,
// MAX_FRAGMENT_LENGTH
Extension_Code::SupportedGroups,
Extension_Code::UseSrtp,
// HEARTBEAT
Extension_Code::ApplicationLayerProtocolNegotiation,
// RFC 7250
Extension_Code::ClientCertificateType,
Extension_Code::ServerCertificateType,
// EARLY_DATA
// Allowed extensions not listed in RFC 8446 but acceptable as Botan implements them
Extension_Code::RecordSizeLimit,
};
if(m_extensions.contains_implemented_extensions_other_than(allowed_exts)) {
throw TLS_Exception(Alert::IllegalParameter, "Encrypted Extensions contained an extension that is not allowed");
}
}
std::vector<uint8_t> Encrypted_Extensions::serialize() const {
return m_extensions.serialize(Connection_Side::Server);
}
} // namespace Botan::TLS