denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libtls: Implement TLS 1.3 handshake on client-side

Browse Source 
The code is a minimal handshake with the HelloRetryRequest message
implementation missing.
Can be tested with an OpenSSL server running TLS 1.3. The server must
be at least version 1.1.1 (September 2018).

Co-authored-by: ryru <[email protected]>
This commit is contained in:
bytinbit
2021-02-12 11:45:44 +01:00
committed by Tobias Brunner
co-authored by ryru
parent 02d7405512
commit 7a2b02667c
11 changed files with 1398 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls.h
+54 -6
View File
@@ -52,6 +52,7 @@ enum tls_version_t {
TLS_1_0 = 0x0301,
TLS_1_1 = 0x0302,
TLS_1_2 = 0x0303,
TLS_1_3 = 0x0304,
};
/**
@@ -81,6 +82,11 @@ enum tls_handshake_type_t {
TLS_HELLO_REQUEST = 0,
TLS_CLIENT_HELLO = 1,
TLS_SERVER_HELLO = 2,
TLS_HELLO_VERIFY_REQUEST = 3,
TLS_NEW_SESSION_TICKET = 4,
TLS_END_OF_EARLY_DATA = 5,
TLS_HELLO_RETRY_REQUEST = 6,
TLS_ENCRYPTED_EXTENSIONS = 8,
TLS_CERTIFICATE = 11,
TLS_SERVER_KEY_EXCHANGE = 12,
TLS_CERTIFICATE_REQUEST = 13,
@@ -88,6 +94,11 @@ enum tls_handshake_type_t {
TLS_CERTIFICATE_VERIFY = 15,
TLS_CLIENT_KEY_EXCHANGE = 16,
TLS_FINISHED = 20,
TLS_CERTIFICATE_URL = 21,
TLS_CERTIFICATE_STATUS = 22,
TLS_SUPPLEMENTAL_DATA = 23,
TLS_KEY_UPDATE = 24,
TLS_MESSAGE_HASH = 254,
};
/**
@@ -114,7 +125,7 @@ enum tls_purpose_t {
};
/**
* TLS Hello extension types.
* TLS Handshake extension types.
*/
enum tls_extension_t {
/** Server name the client wants to talk to */
@@ -129,12 +140,42 @@ enum tls_extension_t {
TLS_EXT_TRUNCATED_HMAC = 4,
/** list of OCSP responders the client trusts */
TLS_EXT_STATUS_REQUEST = 5,
/** list of supported elliptic curves */
TLS_EXT_ELLIPTIC_CURVES = 10,
/** list of supported groups, in legacy tls: elliptic curves */
TLS_EXT_SUPPORTED_GROUPS = 10,
/** supported point formats */
TLS_EXT_EC_POINT_FORMATS = 11,
/** list supported signature algorithms */
TLS_EXT_SIGNATURE_ALGORITHMS = 13,
/** indicate usage of Datagram Transport Layer Security (DTLS) */
TLS_EXT_USE_SRTP = 14,
/** indicate usage of heartbeat */
TLS_EXT_HEARTBEAT = 15,
/** indicate usage of application-layer protocol negotiation */
TLS_EXT_APPLICATION_LAYER_PROTOCOL_NEGOTIATION = 16,
/** exchange raw public key, client side*/
TLS_CLIENT_CERTIFICATE_TYPE = 19,
/** exchange raw public key, server side*/
TLS_SERVER_CERTIFICATE_TYPE = 20,
/** negotiate identity of the psk **/
TLS_EXT_PRE_SHARED_KEY = 41,
/** send data in 0-RTT when psk is used and early data is allowed **/
TLS_EXT_EARLY_DATA = 42,
/** negotiate supported tls versions **/
TLS_EXT_SUPPORTED_VERSIONS = 43,
/** identify client **/
TLS_EXT_COOKIE = 44,
/** psk modes supported by the client **/
TLS_EXT_PSK_KEY_EXCHANGE_MODES = 45,
/** indicate supported ca's by endpoint **/
TLS_EXT_CERTIFICATE_AUTHORITIES = 47,
/** provide oid/value pairs to match client's certificate **/
TLS_EXT_OID_FILTERS = 48,
/** willing to perform post-handshake authentication **/
TLS_EXT_POST_HANDSHAKE_AUTH = 49,
/** list supported signature algorithms to verify certificates **/
TLS_EXT_SIGNATURE_ALGORITHMS_CERT = 50,
/** list endpoint's cryptographic parameters **/
TLS_EXT_KEY_SHARE = 51,
/** cryptographic binding for RFC 5746 renegotiation indication */
TLS_EXT_RENEGOTIATION_INFO = 65281,
};
@@ -216,11 +257,18 @@ struct tls_t {
identification_t* (*get_peer_id)(tls_t *this);
/**
* Get the negotiated TLS/SSL version.
* Get the maximum and negotiated TLS/SSL version.
*
* @return negotiated TLS version
* @return max and negotiated TLS version
*/
tls_version_t (*get_version)(tls_t *this);
tls_version_t (*get_version_max)(tls_t *this);
/**
* Get the minimum TLS/SSL version.
*
* @return min TLS version
*/
tls_version_t (*get_version_min)(tls_t *this);
/**
* Set the negotiated TLS/SSL version.