Preserves the prior extension for backwards-compatibility on the wire,
requiring an API tweak for the application to dictate which version to
be compatible with.
Builds on the previous commit, and prepares for the ability to discard
unused key exchange algorithms at link-time.
This varies some server error handling -- the precise errors aren't
specified by the standard.
It is only used by the client, so it shouldn't be in `HandshakeDetails`, which
is shared between the client and the server. Further, it is only used for the
initial messages, so there's no need to store it for the whole handshake.
This refactoring enables further refactorings to clarify the state machine. In
particular, this allows us to clear up the unwrapping logic related to
`fill_in_psk_binder`, but this is also useful for other refactorings, including
the ECH implementation.
I don't know if it's me or everyone, but debugging TLS setup issues
is usually non-trivial.
For example, right now I'm fighting with this issue:
an `openssl s_client` works fine, but a client implemented with
rustls fails with an error:
```
Custom { kind: InvalidData, error: WebPKIError(UnknownIssuer) }
```
`WebPKIError` can be emitted for several reasons. This PR adds the
operation name to the error. I have identified five operations:
* validate server certificate
* validate client certificate
* validate certificate for DNS name
* parse the certificate
* verify message signature
The error can be expanded further later, but even this basic list
will provide some clue where to look.
Do the mapping to `SupportedCipherSuite` at the time `ClientSessionValue` is
constructed so that we don't have to look it up all the time. This eliminates
some unwrapping.
Simplify the implementation of `find_cipher_suite` to match what is done during
`ClientSessionValue` decoding.
This fixes the TLS13SessionID-TLS13 Bogo test, so enable it.
Inline `random_sessionid_for_ticket` into its caller so all the
session ID calculation is in one spot.
Clarify when the full `ServerCertDetails` and related inputs are available
*with their correct and complete values*. Now the point at which
`ServerCertDetails` is constructed is the earliest point in which the
validation could happen.
Drop the `ServerCertDetails` immediately after certificate validation to
free up memory. The TLS 1.3 state machine was holding onto the
`ServerCertDetails` for many messages longer than needed.
Avoid calling `get_suite_assert()` when the cipher suite is already known.
Pass the cipher suite as a paramter to other functions.
Call `get_suite_assert()` fewer times (at most once) in other functions,
to make further refactoring away of these calls easier.
This became unused in #505. It was originally added 4 years ago in
df361f832b, so it seems there was no
specific reason for making it public. In addition, we already have
some breaking API changes lined up, so might as well remove this.
If we're not going to send one of these, then drop it as early as
possible to reduce memory overhead, so that at the time of sending,
`CertifiedKey` will only contain it if it is to be sent. This makes
the boolean flags that previously controlled this redundant, so
remove them.
In the process, remove some unwrapping.
Only do the lookup of the session during the initial client hello.
Otherwise, if we do a session lookup during retries, the session cache
may have changed and we might get back a different session, e.g. because
a different connection modified the session cache in the interim.
- prefer aes to not-aes
- prefer ecdsa to rsa (in fact this doesn't make much of a difference,
unless your peer has both kinds of cert).
- prefer aes-256 to aes-128
Add a rationale section to the manual for this.
While playing around with rustls I broke the `client_cert_resolve` test and if the `ResolvesClientCert` implementation for `ClientCheckCertResolve` panics, then it will panic again in the `drop` call leading to an illegal instruction error.
It isn't clear whether the `pub_*` functions are intended to accept an output
buffer larger than needed, but they definitely don't work when the output
buffer is smaller than needed. Clarify this.
Instead of implementing big-endian encoding manually, use the standard library
implementations.
Removing the use of `try_into()` in these functions is deferred until later.
This is just making the panicking explicit instead of implicit.
Dirkjan Ochtman