lib/ext/server_name.c

   1 /*
   2  * Copyright (C) 2002-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 #include "gnutls_int.h"
  24 #include "gnutls_auth.h"
  25 #include "gnutls_errors.h"
  26 #include "gnutls_num.h"
  27 #include <ext/server_name.h>
  28
  29 static int _gnutls_server_name_recv_params (gnutls_session_t session,
  30                                             const uint8_t * data,
  31                                             size_t data_size);
  32 static int _gnutls_server_name_send_params (gnutls_session_t session,
  33                                             gnutls_buffer_st* extdata);
  34
  35 static int _gnutls_server_name_unpack (gnutls_buffer_st * ps,
  36                                        extension_priv_data_t * _priv);
  37 static int _gnutls_server_name_pack (extension_priv_data_t _priv,
  38                                      gnutls_buffer_st * ps);
  39 static void _gnutls_server_name_deinit_data (extension_priv_data_t priv);
  40
  41
  42 extension_entry_st ext_mod_server_name = {
  43   .name = "SERVER NAME",
  44   .type = GNUTLS_EXTENSION_SERVER_NAME,
  45   .parse_type = GNUTLS_EXT_APPLICATION,
  46
  47   .recv_func = _gnutls_server_name_recv_params,
  48   .send_func = _gnutls_server_name_send_params,
  49   .pack_func = _gnutls_server_name_pack,
  50   .unpack_func = _gnutls_server_name_unpack,
  51   .deinit_func = _gnutls_server_name_deinit_data,
  52 };
  53
  54 /*
  55  * In case of a server: if a NAME_DNS extension type is received then
  56  * it stores into the session the value of NAME_DNS. The server may
  57  * use gnutls_ext_get_server_name(), in order to access it.
  58  *
  59  * In case of a client: If a proper NAME_DNS extension type is found
  60  * in the session then it sends the extension to the peer.
  61  *
  62  */
  63 static int
  64 _gnutls_server_name_recv_params (gnutls_session_t session,
  65                                  const uint8_t * data, size_t _data_size)
  66 {
  67   int i;
  68   const unsigned char *p;
  69   uint16_t len, type;
  70   ssize_t data_size = _data_size;
  71   int server_names = 0;
  72   server_name_ext_st *priv;
  73   extension_priv_data_t epriv;
  74
  75   if (session->security_parameters.entity == GNUTLS_SERVER)
  76     {
  77       DECR_LENGTH_RET (data_size, 2, 0);
  78       len = _gnutls_read_uint16 (data);
  79
  80       if (len != data_size)
  81         {
  82           /* This is unexpected packet length, but
  83            * just ignore it, for now.
  84            */
  85           gnutls_assert ();
  86           return 0;
  87         }
  88
  89       p = data + 2;
  90
  91       /* Count all server_names in the packet. */
  92       while (data_size > 0)
  93         {
  94           DECR_LENGTH_RET (data_size, 1, 0);
  95           p++;
  96
  97           DECR_LEN (data_size, 2);
  98           len = _gnutls_read_uint16 (p);
  99           p += 2;
 100
 101           if (len > 0)
 102             {
 103               DECR_LENGTH_RET (data_size, len, 0);
 104               server_names++;
 105               p += len;
 106             }
 107           else
 108             _gnutls_handshake_log
 109               ("HSK[%p]: Received (0) size server name (under attack?)\n",
 110                session);
 111
 112         }
 113
 114       /* we cannot accept more server names.
 115        */
 116       if (server_names > MAX_SERVER_NAME_EXTENSIONS)
 117         {
 118           _gnutls_handshake_log
 119             ("HSK[%p]: Too many server names received (under attack?)\n",
 120              session);
 121           server_names = MAX_SERVER_NAME_EXTENSIONS;
 122         }
 123
 124       if (server_names == 0)
 125         return 0;               /* no names found */
 126
 127       priv = gnutls_calloc (1, sizeof (*priv));
 128       if (priv == NULL)
 129         {
 130           gnutls_assert ();
 131           return GNUTLS_E_MEMORY_ERROR;
 132         }
 133
 134       priv->server_names_size = server_names;
 135
 136       p = data + 2;
 137       for (i = 0; i < server_names; i++)
 138         {
 139           type = *p;
 140           p++;
 141
 142           len = _gnutls_read_uint16 (p);
 143           p += 2;
 144
 145           switch (type)
 146             {
 147             case 0:            /* NAME_DNS */
 148               if (len <= MAX_SERVER_NAME_SIZE)
 149                 {
 150                   memcpy (priv->server_names[i].name, p, len);
 151                   priv->server_names[i].name_length = len;
 152                   priv->server_names[i].type = GNUTLS_NAME_DNS;
 153                   break;
 154                 }
 155             }
 156
 157           /* move to next record */
 158           p += len;
 159         }
 160
 161       epriv.ptr = priv;
 162       _gnutls_ext_set_session_data (session, GNUTLS_EXTENSION_SERVER_NAME,
 163                                     epriv);
 164
 165     }
 166
 167   return 0;
 168 }
 169
 170 /* returns data_size or a negative number on failure
 171  */
 172 static int
 173 _gnutls_server_name_send_params (gnutls_session_t session,
 174                                  gnutls_buffer_st* extdata)
 175 {
 176   uint16_t len;
 177   unsigned i;
 178   int total_size = 0, ret;
 179   server_name_ext_st *priv;
 180   extension_priv_data_t epriv;
 181
 182   ret =
 183     _gnutls_ext_get_session_data (session, GNUTLS_EXTENSION_SERVER_NAME,
 184                                   &epriv);
 185   if (ret < 0)
 186     return 0;
 187
 188
 189   /* this function sends the client extension data (dnsname)
 190    */
 191   if (session->security_parameters.entity == GNUTLS_CLIENT)
 192     {
 193       priv = epriv.ptr;
 194
 195       if (priv->server_names_size == 0)
 196         return 0;
 197
 198       /* uint16_t
 199        */
 200       total_size = 2;
 201       for (i = 0; i < priv->server_names_size; i++)
 202         {
 203           /* count the total size
 204            */
 205           len = priv->server_names[i].name_length;
 206
 207           /* uint8_t + uint16_t + size
 208            */
 209           total_size += 1 + 2 + len;
 210         }
 211
 212       /* UINT16: write total size of all names
 213        */
 214       ret = _gnutls_buffer_append_prefix(extdata, 16, total_size - 2);
 215       if (ret < 0)
 216         return gnutls_assert_val(ret);
 217
 218       for (i = 0; i < priv->server_names_size; i++)
 219         {
 220
 221           switch (priv->server_names[i].type)
 222             {
 223             case GNUTLS_NAME_DNS:
 224               len = priv->server_names[i].name_length;
 225               if (len == 0)
 226                 break;
 227
 228               /* UINT8: type of this extension
 229                * UINT16: size of the first name
 230                * LEN: the actual server name.
 231                */
 232               ret = _gnutls_buffer_append_prefix(extdata, 8, 0);
 233               if (ret < 0)
 234                 return gnutls_assert_val(ret);
 235
 236               ret = _gnutls_buffer_append_data_prefix(extdata, 16, priv->server_names[i].name, len);
 237               if (ret < 0)
 238                 return gnutls_assert_val(ret);
 239
 240               break;
 241             default:
 242               gnutls_assert ();
 243               return GNUTLS_E_INTERNAL_ERROR;
 244             }
 245         }
 246     }
 247
 248   return total_size;
 249 }
 250
 251 /**
 252  * gnutls_server_name_get:
 253  * @session: is a #gnutls_session_t structure.
 254  * @data: will hold the data
 255  * @data_length: will hold the data length. Must hold the maximum size of data.
 256  * @type: will hold the server name indicator type
 257  * @indx: is the index of the server_name
 258  *
 259  * This function will allow you to get the name indication (if any), a
 260  * client has sent.  The name indication may be any of the enumeration
 261  * gnutls_server_name_type_t.
 262  *
 263  * If @type is GNUTLS_NAME_DNS, then this function is to be used by
 264  * servers that support virtual hosting, and the data will be a null
 265  * terminated UTF-8 string.
 266  *
 267  * If @data has not enough size to hold the server name
 268  * GNUTLS_E_SHORT_MEMORY_BUFFER is returned, and @data_length will
 269  * hold the required size.
 270  *
 271  * @index is used to retrieve more than one server names (if sent by
 272  * the client).  The first server name has an index of 0, the second 1
 273  * and so on.  If no name with the given index exists
 274  * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.
 275  *
 276  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
 277  *   otherwise a negative error code is returned.
 278  **/
 279 int
 280 gnutls_server_name_get (gnutls_session_t session, void *data,
 281                         size_t * data_length,
 282                         unsigned int *type, unsigned int indx)
 283 {
 284   char *_data = data;
 285   server_name_ext_st *priv;
 286   int ret;
 287   extension_priv_data_t epriv;
 288
 289   if (session->security_parameters.entity == GNUTLS_CLIENT)
 290     {
 291       gnutls_assert ();
 292       return GNUTLS_E_INVALID_REQUEST;
 293     }
 294
 295   ret =
 296     _gnutls_ext_get_session_data (session, GNUTLS_EXTENSION_SERVER_NAME,
 297                                   &epriv);
 298   if (ret < 0)
 299     {
 300       gnutls_assert ();
 301       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 302     }
 303
 304   priv = epriv.ptr;
 305
 306   if (indx + 1 > priv->server_names_size)
 307     {
 308       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 309     }
 310
 311   *type = priv->server_names[indx].type;
 312
 313   if (*data_length >            /* greater since we need one extra byte for the null */
 314       priv->server_names[indx].name_length)
 315     {
 316       *data_length = priv->server_names[indx].name_length;
 317       memcpy (data, priv->server_names[indx].name, *data_length);
 318
 319       if (*type == GNUTLS_NAME_DNS)     /* null terminate */
 320         _data[(*data_length)] = 0;
 321
 322     }
 323   else
 324     {
 325       *data_length = priv->server_names[indx].name_length + 1;
 326       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 327     }
 328
 329   return 0;
 330 }
 331
 332 /**
 333  * gnutls_server_name_set:
 334  * @session: is a #gnutls_session_t structure.
 335  * @type: specifies the indicator type
 336  * @name: is a string that contains the server name.
 337  * @name_length: holds the length of name
 338  *
 339  * This function is to be used by clients that want to inform (via a
 340  * TLS extension mechanism) the server of the name they connected to.
 341  * This should be used by clients that connect to servers that do
 342  * virtual hosting.
 343  *
 344  * The value of @name depends on the @type type.  In case of
 345  * %GNUTLS_NAME_DNS, an ASCII (0)-terminated domain name string,
 346  * without the trailing dot, is expected.  IPv4 or IPv6 addresses are
 347  * not permitted.
 348  *
 349  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
 350  *   otherwise a negative error code is returned.
 351  **/
 352 int
 353 gnutls_server_name_set (gnutls_session_t session,
 354                         gnutls_server_name_type_t type,
 355                         const void *name, size_t name_length)
 356 {
 357   int server_names, ret;
 358   server_name_ext_st *priv;
 359   extension_priv_data_t epriv;
 360   int set = 0;
 361
 362   if (session->security_parameters.entity == GNUTLS_SERVER)
 363     {
 364       gnutls_assert ();
 365       return GNUTLS_E_INVALID_REQUEST;
 366     }
 367
 368   if (name_length > MAX_SERVER_NAME_SIZE)
 369     return GNUTLS_E_SHORT_MEMORY_BUFFER;
 370
 371   ret =
 372     _gnutls_ext_get_session_data (session, GNUTLS_EXTENSION_SERVER_NAME,
 373                                   &epriv);
 374   if (ret < 0)
 375     {
 376       set = 1;
 377     }
 378
 379   if (set != 0)
 380     {
 381       priv = gnutls_calloc (1, sizeof (*priv));
 382       if (priv == NULL)
 383         {
 384           gnutls_assert ();
 385           return GNUTLS_E_MEMORY_ERROR;
 386         }
 387       epriv.ptr = priv;
 388     }
 389   else
 390     priv = epriv.ptr;
 391
 392   server_names = priv->server_names_size + 1;
 393
 394   if (server_names > MAX_SERVER_NAME_EXTENSIONS)
 395     server_names = MAX_SERVER_NAME_EXTENSIONS;
 396
 397   priv->server_names[server_names - 1].type = type;
 398   memcpy (priv->server_names[server_names - 1].name, name, name_length);
 399   priv->server_names[server_names - 1].name_length = name_length;
 400
 401   priv->server_names_size = server_names;
 402
 403   if (set != 0)
 404     _gnutls_ext_set_session_data (session, GNUTLS_EXTENSION_SERVER_NAME,
 405                                   epriv);
 406
 407   return 0;
 408 }
 409
 410 static void
 411 _gnutls_server_name_deinit_data (extension_priv_data_t priv)
 412 {
 413   gnutls_free (priv.ptr);
 414 }
 415
 416 static int
 417 _gnutls_server_name_pack (extension_priv_data_t epriv, gnutls_buffer_st * ps)
 418 {
 419   server_name_ext_st *priv = epriv.ptr;
 420   unsigned int i;
 421   int ret;
 422
 423   BUFFER_APPEND_NUM (ps, priv->server_names_size);
 424   for (i = 0; i < priv->server_names_size; i++)
 425     {
 426       BUFFER_APPEND_NUM (ps, priv->server_names[i].type);
 427       BUFFER_APPEND_PFX4 (ps, priv->server_names[i].name,
 428                          priv->server_names[i].name_length);
 429     }
 430   return 0;
 431 }
 432
 433 static int
 434 _gnutls_server_name_unpack (gnutls_buffer_st * ps,
 435                             extension_priv_data_t * _priv)
 436 {
 437   server_name_ext_st *priv;
 438   unsigned int i;
 439   int ret;
 440   extension_priv_data_t epriv;
 441
 442   priv = gnutls_calloc (1, sizeof (*priv));
 443   if (priv == NULL)
 444     {
 445       gnutls_assert ();
 446       return GNUTLS_E_MEMORY_ERROR;
 447     }
 448
 449   BUFFER_POP_NUM (ps, priv->server_names_size);
 450   for (i = 0; i < priv->server_names_size; i++)
 451     {
 452       BUFFER_POP_NUM (ps, priv->server_names[i].type);
 453       BUFFER_POP_NUM (ps, priv->server_names[i].name_length);
 454       if (priv->server_names[i].name_length >
 455           sizeof (priv->server_names[i].name))
 456         {
 457           gnutls_assert ();
 458           return GNUTLS_E_PARSING_ERROR;
 459         }
 460       BUFFER_POP (ps, priv->server_names[i].name,
 461                   priv->server_names[i].name_length);
 462     }
 463
 464   epriv.ptr = priv;
 465   *_priv = epriv;
 466
 467   return 0;
 468
 469 error:
 470   gnutls_free (priv);
 471   return ret;
 472 }