|
Packit Service |
4684c1 |
/*
|
|
Packit Service |
4684c1 |
* Copyright (C) 2013 Nikos Mavrogiannopoulos
|
|
Packit Service |
4684c1 |
* Copyright (C) 2017 Red Hat, Inc.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This file is part of GnuTLS.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* The GnuTLS is free software; you can redistribute it and/or
|
|
Packit Service |
4684c1 |
* modify it under the terms of the GNU Lesser General Public License
|
|
Packit Service |
4684c1 |
* as published by the Free Software Foundation; either version 2.1 of
|
|
Packit Service |
4684c1 |
* the License, or (at your option) any later version.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This library is distributed in the hope that it will be useful, but
|
|
Packit Service |
4684c1 |
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit Service |
4684c1 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit Service |
4684c1 |
* Lesser General Public License for more details.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* You should have received a copy of the GNU Lesser General Public License
|
|
Packit Service |
4684c1 |
* along with this program. If not, see <https://www.gnu.org/licenses/>
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include "gnutls_int.h"
|
|
Packit Service |
4684c1 |
#include "auth.h"
|
|
Packit Service |
4684c1 |
#include "errors.h"
|
|
Packit Service |
4684c1 |
#include "num.h"
|
|
Packit Service |
4684c1 |
#include <ext/alpn.h>
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int _gnutls_alpn_recv_params(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
const uint8_t * data,
|
|
Packit Service |
4684c1 |
size_t data_size);
|
|
Packit Service |
4684c1 |
static int _gnutls_alpn_send_params(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
gnutls_buffer_st * extdata);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static void _gnutls_alpn_deinit_data(gnutls_ext_priv_data_t priv);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
const hello_ext_entry_st ext_mod_alpn = {
|
|
Packit Service |
4684c1 |
.name = "ALPN",
|
|
Packit Service |
4684c1 |
.tls_id = 16,
|
|
Packit Service |
4684c1 |
.gid = GNUTLS_EXTENSION_ALPN,
|
|
Packit Service |
4684c1 |
/* this extension must be parsed even on resumption */
|
|
Packit Service |
4684c1 |
.client_parse_point = GNUTLS_EXT_MANDATORY,
|
|
Packit Service |
4684c1 |
.server_parse_point = GNUTLS_EXT_MANDATORY,
|
|
Packit Service |
4684c1 |
.validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |
|
|
Packit Service |
4684c1 |
GNUTLS_EXT_FLAG_CLIENT_HELLO | GNUTLS_EXT_FLAG_EE |
|
|
Packit Service |
4684c1 |
GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO,
|
|
Packit Service |
4684c1 |
.recv_func = _gnutls_alpn_recv_params,
|
|
Packit Service |
4684c1 |
.send_func = _gnutls_alpn_send_params,
|
|
Packit Service |
4684c1 |
.deinit_func = _gnutls_alpn_deinit_data,
|
|
Packit Service |
4684c1 |
.cannot_be_overriden = 1
|
|
Packit Service |
4684c1 |
};
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_alpn_recv_params(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
const uint8_t * data, size_t data_size)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
unsigned int i;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
const uint8_t *p = data;
|
|
Packit Service |
4684c1 |
unsigned len1, len;
|
|
Packit Service |
4684c1 |
alpn_ext_st *priv;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
int selected_protocol_index;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_ALPN,
|
|
Packit Service |
4684c1 |
&epriv);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
DECR_LENGTH_RET(data_size, 2, GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
len = _gnutls_read_uint16(p);
|
|
Packit Service |
4684c1 |
p += 2;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (len == 0 || len > (size_t)data_size)
|
|
Packit Service |
4684c1 |
return
|
|
Packit Service |
4684c1 |
gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (session->security_parameters.entity == GNUTLS_SERVER) {
|
|
Packit Service |
4684c1 |
selected_protocol_index = MAX_ALPN_PROTOCOLS+1;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
while (data_size > 0) {
|
|
Packit Service |
4684c1 |
DECR_LENGTH_RET(data_size, 1, GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
len1 = *p;
|
|
Packit Service |
4684c1 |
p += 1;
|
|
Packit Service |
4684c1 |
DECR_LENGTH_RET(data_size, len1, GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (len1 == 0)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i = 0; i < priv->size; i++) {
|
|
Packit Service |
4684c1 |
if (priv->protocol_size[i] == len1
|
|
Packit Service |
4684c1 |
&& memcmp(p, priv->protocols[i],
|
|
Packit Service |
4684c1 |
len1) == 0) {
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->flags & GNUTLS_ALPN_SERVER_PRECEDENCE) {
|
|
Packit Service |
4684c1 |
if (selected_protocol_index > (int)i) {
|
|
Packit Service |
4684c1 |
selected_protocol_index = i;
|
|
Packit Service |
4684c1 |
priv->selected_protocol =
|
|
Packit Service |
4684c1 |
priv->protocols[i];
|
|
Packit Service |
4684c1 |
priv->selected_protocol_size =
|
|
Packit Service |
4684c1 |
priv->protocol_size[i];
|
|
Packit Service |
4684c1 |
break;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
} else {
|
|
Packit Service |
4684c1 |
priv->selected_protocol =
|
|
Packit Service |
4684c1 |
priv->protocols[i];
|
|
Packit Service |
4684c1 |
priv->selected_protocol_size =
|
|
Packit Service |
4684c1 |
priv->protocol_size[i];
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
p += len1;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
} else {
|
|
Packit Service |
4684c1 |
DECR_LENGTH_RET(data_size, 1, GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
len1 = *p;
|
|
Packit Service |
4684c1 |
p += 1;
|
|
Packit Service |
4684c1 |
DECR_LENGTH_RET(data_size, len1, GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i = 0; i < priv->size; i++) {
|
|
Packit Service |
4684c1 |
if (priv->protocol_size[i] == len1
|
|
Packit Service |
4684c1 |
&& memcmp(p, priv->protocols[i], len1) == 0) {
|
|
Packit Service |
4684c1 |
priv->selected_protocol =
|
|
Packit Service |
4684c1 |
priv->protocols[i];
|
|
Packit Service |
4684c1 |
priv->selected_protocol_size =
|
|
Packit Service |
4684c1 |
priv->protocol_size[i];
|
|
Packit Service |
4684c1 |
break;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
/*p += len1;*/
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->selected_protocol == NULL
|
|
Packit Service |
4684c1 |
&& (priv->flags & GNUTLS_ALPN_MAND))
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(GNUTLS_E_NO_APPLICATION_PROTOCOL);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_alpn_send_params(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
gnutls_buffer_st * extdata)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
unsigned i;
|
|
Packit Service |
4684c1 |
int total_size = 0, ret;
|
|
Packit Service |
4684c1 |
alpn_ext_st *priv;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_ALPN,
|
|
Packit Service |
4684c1 |
&epriv);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->size == 0)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (session->security_parameters.entity == GNUTLS_SERVER) {
|
|
Packit Service |
4684c1 |
if (priv->selected_protocol_size == 0)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_buffer_append_prefix(extdata, 16,
|
|
Packit Service |
4684c1 |
priv->
|
|
Packit Service |
4684c1 |
selected_protocol_size +
|
|
Packit Service |
4684c1 |
1);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(ret);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
total_size += 2;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_buffer_append_data_prefix(extdata, 8,
|
|
Packit Service |
4684c1 |
priv->
|
|
Packit Service |
4684c1 |
selected_protocol,
|
|
Packit Service |
4684c1 |
priv->
|
|
Packit Service |
4684c1 |
selected_protocol_size);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(ret);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
total_size += 1 + priv->selected_protocol_size;
|
|
Packit Service |
4684c1 |
} else {
|
|
Packit Service |
4684c1 |
int t = 0;
|
|
Packit Service |
4684c1 |
for (i = 0; i < priv->size; i++)
|
|
Packit Service |
4684c1 |
t += priv->protocol_size[i] + 1;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = _gnutls_buffer_append_prefix(extdata, 16, t);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(ret);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
total_size += 2;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i = 0; i < priv->size; i++) {
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_buffer_append_data_prefix(extdata, 8,
|
|
Packit Service |
4684c1 |
priv->
|
|
Packit Service |
4684c1 |
protocols[i],
|
|
Packit Service |
4684c1 |
priv->
|
|
Packit Service |
4684c1 |
protocol_size
|
|
Packit Service |
4684c1 |
[i]);
|
|
Packit Service |
4684c1 |
if (ret < 0)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(ret);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
total_size += 1 + priv->protocol_size[i];
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return total_size;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/**
|
|
Packit Service |
4684c1 |
* gnutls_alpn_get_selected_protocol:
|
|
Packit Service |
4684c1 |
* @session: is a #gnutls_session_t type.
|
|
Packit Service |
4684c1 |
* @protocol: will hold the protocol name
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This function allows you to get the negotiated protocol name. The
|
|
Packit Service |
4684c1 |
* returned protocol should be treated as opaque, constant value and
|
|
Packit Service |
4684c1 |
* only valid during the session life.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* The selected protocol is the first supported by the list sent
|
|
Packit Service |
4684c1 |
* by the client.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
|
|
Packit Service |
4684c1 |
* otherwise a negative error code is returned.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Since 3.2.0
|
|
Packit Service |
4684c1 |
**/
|
|
Packit Service |
4684c1 |
int
|
|
Packit Service |
4684c1 |
gnutls_alpn_get_selected_protocol(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
gnutls_datum_t * protocol)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
alpn_ext_st *priv;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_ALPN,
|
|
Packit Service |
4684c1 |
&epriv);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->selected_protocol_size == 0)
|
|
Packit Service |
4684c1 |
return
|
|
Packit Service |
4684c1 |
gnutls_assert_val
|
|
Packit Service |
4684c1 |
(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
protocol->data = priv->selected_protocol;
|
|
Packit Service |
4684c1 |
protocol->size = priv->selected_protocol_size;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/**
|
|
Packit Service |
4684c1 |
* gnutls_alpn_set_protocols:
|
|
Packit Service |
4684c1 |
* @session: is a #gnutls_session_t type.
|
|
Packit Service |
4684c1 |
* @protocols: is the protocol names to add.
|
|
Packit Service |
4684c1 |
* @protocols_size: the number of protocols to add.
|
|
Packit Service |
4684c1 |
* @flags: zero or a sequence of %gnutls_alpn_flags_t
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This function is to be used by both clients and servers, to declare
|
|
Packit Service |
4684c1 |
* the supported ALPN protocols, which are used during negotiation with peer.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* See %gnutls_alpn_flags_t description for the documentation of available
|
|
Packit Service |
4684c1 |
* flags.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
|
|
Packit Service |
4684c1 |
* otherwise a negative error code is returned.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Since 3.2.0
|
|
Packit Service |
4684c1 |
**/
|
|
Packit Service |
4684c1 |
int
|
|
Packit Service |
4684c1 |
gnutls_alpn_set_protocols(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
const gnutls_datum_t * protocols,
|
|
Packit Service |
4684c1 |
unsigned protocols_size, unsigned int flags)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
alpn_ext_st *priv;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
unsigned i;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_ALPN,
|
|
Packit Service |
4684c1 |
&epriv);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
priv = gnutls_calloc(1, sizeof(*priv));
|
|
Packit Service |
4684c1 |
if (priv == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_MEMORY_ERROR;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
epriv = priv;
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_set_priv(session,
|
|
Packit Service |
4684c1 |
GNUTLS_EXTENSION_ALPN, epriv);
|
|
Packit Service |
4684c1 |
} else
|
|
Packit Service |
4684c1 |
priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (protocols_size > MAX_ALPN_PROTOCOLS)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i = 0; i < protocols_size; i++) {
|
|
Packit Service |
4684c1 |
if (protocols[i].size >= MAX_ALPN_PROTOCOL_NAME)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
memcpy(priv->protocols[i], protocols[i].data,
|
|
Packit Service |
4684c1 |
protocols[i].size);
|
|
Packit Service |
4684c1 |
priv->protocol_size[i] = protocols[i].size;
|
|
Packit Service |
4684c1 |
priv->size++;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
priv->flags = flags;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static void _gnutls_alpn_deinit_data(gnutls_ext_priv_data_t priv)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
gnutls_free(priv);
|
|
Packit Service |
4684c1 |
}
|