/src/gnutls/lib/ext/compress_certificate.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (C) 2022 Red Hat, Inc. |
3 | | * |
4 | | * Author: Zoltan Fridrich |
5 | | * |
6 | | * This file is part of GnuTLS. |
7 | | * |
8 | | * The GnuTLS is free software; you can redistribute it and/or |
9 | | * modify it under the terms of the GNU Lesser General Public License |
10 | | * as published by the Free Software Foundation; either version 2.1 of |
11 | | * the License, or (at your option) any later version. |
12 | | * |
13 | | * This library is distributed in the hope that it will be useful, but |
14 | | * WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
16 | | * Lesser General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/> |
20 | | * |
21 | | */ |
22 | | |
23 | | #include "compress.h" |
24 | | #include "errors.h" |
25 | | #include "gnutls_int.h" |
26 | | #include "hello_ext_lib.h" |
27 | | #include "num.h" |
28 | | #include "ext/compress_certificate.h" |
29 | | |
30 | | /* Converts compression algorithm number established in RFC8879 to internal compression method type |
31 | | */ |
32 | | gnutls_compression_method_t |
33 | | _gnutls_compress_certificate_num2method(uint16_t num) |
34 | 0 | { |
35 | 0 | switch (num) { |
36 | 0 | case 1: |
37 | 0 | return GNUTLS_COMP_ZLIB; |
38 | 0 | case 2: |
39 | 0 | return GNUTLS_COMP_BROTLI; |
40 | 0 | case 3: |
41 | 0 | return GNUTLS_COMP_ZSTD; |
42 | 0 | default: |
43 | 0 | return GNUTLS_COMP_UNKNOWN; |
44 | 0 | } |
45 | 0 | } |
46 | | |
47 | | /* Converts compression method type to compression algorithm number established in RFC8879 |
48 | | */ |
49 | | int _gnutls_compress_certificate_method2num(gnutls_compression_method_t method) |
50 | 0 | { |
51 | 0 | switch (method) { |
52 | 0 | case GNUTLS_COMP_ZLIB: |
53 | 0 | return 1; |
54 | 0 | case GNUTLS_COMP_BROTLI: |
55 | 0 | return 2; |
56 | 0 | case GNUTLS_COMP_ZSTD: |
57 | 0 | return 3; |
58 | 0 | default: |
59 | 0 | return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER; |
60 | 0 | } |
61 | 0 | } |
62 | | |
63 | | /* Returns 1 if the method is set as supported compression method for the session, |
64 | | * returns 0 otherwise |
65 | | */ |
66 | | bool _gnutls_compress_certificate_is_method_enabled( |
67 | | gnutls_session_t session, gnutls_compression_method_t method) |
68 | 0 | { |
69 | 0 | int ret; |
70 | 0 | unsigned i; |
71 | 0 | compress_certificate_ext_st *priv; |
72 | 0 | gnutls_ext_priv_data_t epriv; |
73 | |
|
74 | 0 | ret = _gnutls_hello_ext_get_priv( |
75 | 0 | session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv); |
76 | 0 | if (ret < 0) |
77 | 0 | return false; |
78 | 0 | priv = epriv; |
79 | |
|
80 | 0 | for (i = 0; i < priv->methods_len; ++i) |
81 | 0 | if (priv->methods[i] == method) |
82 | 0 | return true; |
83 | | |
84 | 0 | return false; |
85 | 0 | } |
86 | | |
87 | | /** |
88 | | * gnutls_compress_certificate_get_selected_method: |
89 | | * @session: is a #gnutls_session_t type. |
90 | | * |
91 | | * This function returns the certificate compression method that has been |
92 | | * selected to compress the certificate before sending it to the peer. |
93 | | * The selection is done based on the local list of supported compression |
94 | | * methods and the peer's requested compression methods. |
95 | | * |
96 | | * Returns: selected certificate compression method. |
97 | | * |
98 | | * Since 3.7.4 |
99 | | **/ |
100 | | gnutls_compression_method_t |
101 | | gnutls_compress_certificate_get_selected_method(gnutls_session_t session) |
102 | 0 | { |
103 | 0 | return session->internals.compress_certificate_method; |
104 | 0 | } |
105 | | |
106 | | /** |
107 | | * gnutls_compress_certificate_set_methods: |
108 | | * @session: is a #gnutls_session_t type. |
109 | | * @methods: is a list of supported compression methods. |
110 | | * @methods_len: number of compression methods in @methods |
111 | | * |
112 | | * This function sets the supported compression methods for certificate compression |
113 | | * for the given session. The list of supported compression methods will be used |
114 | | * for a) requesting the compression of peer's certificate and b) selecting the |
115 | | * method to compress the local certificate before sending it to the peer. |
116 | | * The order of compression methods inside the list does matter as the method |
117 | | * that appears earlier in the list will be preferred before the later ones. |
118 | | * Note that even if you set the list of supported compression methods, the |
119 | | * compression might not be used if the peer does not support any of your chosen |
120 | | * compression methods. |
121 | | * |
122 | | * The list of supported compression methods must meet the following criteria: |
123 | | * Argument @methods must be an array of valid compression methods of type |
124 | | * #gnutls_compression_method_t. Argument @methods_len must contain the number of |
125 | | * compression methods stored in the @methods array and must be within range <1, 127>. |
126 | | * The length constraints are defined by %MIN_COMPRESS_CERTIFICATE_METHODS |
127 | | * and %MAX_COMPRESS_CERTIFICATE_METHODS macros located in the header file |
128 | | * compress_certificate.h. |
129 | | * |
130 | | * If either @methods or @methods_len is equal to 0, current list of supported |
131 | | * compression methods will be unset. |
132 | | * |
133 | | * Returns: %GNUTLS_E_SUCCESS on success, otherwise a negative error code. |
134 | | * |
135 | | * Since 3.7.4 |
136 | | **/ |
137 | | int gnutls_compress_certificate_set_methods( |
138 | | gnutls_session_t session, const gnutls_compression_method_t *methods, |
139 | | size_t methods_len) |
140 | 0 | { |
141 | 0 | int ret; |
142 | 0 | unsigned i; |
143 | 0 | compress_certificate_ext_st *priv; |
144 | |
|
145 | 0 | if (methods == NULL || methods_len == 0) { |
146 | 0 | _gnutls_hello_ext_unset_priv( |
147 | 0 | session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE); |
148 | 0 | return 0; |
149 | 0 | } |
150 | | |
151 | 0 | if (methods_len > MAX_COMPRESS_CERTIFICATE_METHODS) |
152 | 0 | return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); |
153 | | |
154 | 0 | for (i = 0; i < methods_len; ++i) |
155 | 0 | if ((ret = _gnutls_compression_init_method(methods[i])) < 0) |
156 | 0 | return gnutls_assert_val(ret); |
157 | | |
158 | 0 | priv = gnutls_malloc(sizeof(*priv)); |
159 | 0 | if (priv == NULL) |
160 | 0 | return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); |
161 | | |
162 | 0 | priv->methods_len = methods_len; |
163 | 0 | memcpy(priv->methods, methods, methods_len * sizeof(*methods)); |
164 | 0 | _gnutls_hello_ext_set_priv(session, |
165 | 0 | GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, priv); |
166 | |
|
167 | 0 | return 0; |
168 | 0 | } |
169 | | |
170 | | int _gnutls_compress_certificate_recv_params(gnutls_session_t session, |
171 | | const uint8_t *data, |
172 | | size_t data_size) |
173 | 0 | { |
174 | 0 | int ret; |
175 | 0 | unsigned i, j; |
176 | 0 | uint16_t num; |
177 | 0 | uint8_t bytes_len; |
178 | 0 | size_t methods_len; |
179 | 0 | gnutls_compression_method_t methods[MAX_COMPRESS_CERTIFICATE_METHODS]; |
180 | 0 | gnutls_compression_method_t method; |
181 | 0 | compress_certificate_ext_st *priv; |
182 | 0 | gnutls_ext_priv_data_t epriv; |
183 | |
|
184 | 0 | ret = _gnutls_hello_ext_get_priv( |
185 | 0 | session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv); |
186 | 0 | if (ret < 0) |
187 | 0 | return 0; |
188 | 0 | priv = epriv; |
189 | |
|
190 | 0 | DECR_LEN(data_size, 1); |
191 | 0 | bytes_len = *data; |
192 | |
|
193 | 0 | if (bytes_len < 2 || bytes_len > 254 || bytes_len % 2 == 1) |
194 | 0 | return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH); |
195 | | |
196 | 0 | DECR_LEN(data_size, bytes_len); |
197 | 0 | if (data_size > 0) |
198 | 0 | return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH); |
199 | | |
200 | 0 | methods_len = 0; |
201 | 0 | for (i = 0; i < bytes_len / 2; ++i) { |
202 | 0 | num = _gnutls_read_uint16(data + i + i + 1); |
203 | 0 | method = _gnutls_compress_certificate_num2method(num); |
204 | 0 | if (method != GNUTLS_COMP_UNKNOWN) |
205 | 0 | methods[methods_len++] = method; |
206 | 0 | } |
207 | |
|
208 | 0 | method = GNUTLS_COMP_UNKNOWN; |
209 | 0 | for (i = 0; i < methods_len; ++i) |
210 | 0 | for (j = 0; j < priv->methods_len; ++j) |
211 | 0 | if (methods[i] == priv->methods[j]) { |
212 | 0 | method = methods[i]; |
213 | 0 | goto endloop; |
214 | 0 | } |
215 | 0 | endloop: |
216 | 0 | session->internals.compress_certificate_method = method; |
217 | |
|
218 | 0 | return 0; |
219 | 0 | } |
220 | | |
221 | | int _gnutls_compress_certificate_send_params(gnutls_session_t session, |
222 | | gnutls_buffer_st *data) |
223 | 0 | { |
224 | 0 | int ret, num; |
225 | 0 | unsigned i; |
226 | 0 | uint8_t bytes_len; |
227 | 0 | uint8_t bytes[2 * MAX_COMPRESS_CERTIFICATE_METHODS]; |
228 | 0 | compress_certificate_ext_st *priv; |
229 | 0 | gnutls_ext_priv_data_t epriv; |
230 | |
|
231 | 0 | ret = _gnutls_hello_ext_get_priv( |
232 | 0 | session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv); |
233 | 0 | if (ret < 0) |
234 | 0 | return 0; |
235 | 0 | priv = epriv; |
236 | |
|
237 | 0 | bytes_len = 2 * priv->methods_len; |
238 | 0 | for (i = 0; i < priv->methods_len; ++i) { |
239 | 0 | num = _gnutls_compress_certificate_method2num(priv->methods[i]); |
240 | 0 | _gnutls_write_uint16(num, bytes + i + i); |
241 | 0 | } |
242 | |
|
243 | 0 | ret = _gnutls_buffer_append_data_prefix(data, 8, bytes, bytes_len); |
244 | 0 | if (ret < 0) |
245 | 0 | return gnutls_assert_val(ret); |
246 | | |
247 | 0 | session->internals.hsk_flags |= HSK_COMP_CRT_REQ_SENT; |
248 | |
|
249 | 0 | return bytes_len + 1; |
250 | 0 | } |
251 | | |
252 | | const hello_ext_entry_st ext_mod_compress_certificate = { |
253 | | .name = "Compress Certificate", |
254 | | .tls_id = 27, |
255 | | .gid = GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, |
256 | | .client_parse_point = GNUTLS_EXT_TLS, |
257 | | .server_parse_point = GNUTLS_EXT_TLS, |
258 | | .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS | |
259 | | GNUTLS_EXT_FLAG_CLIENT_HELLO, |
260 | | .recv_func = _gnutls_compress_certificate_recv_params, |
261 | | .send_func = _gnutls_compress_certificate_send_params, |
262 | | .deinit_func = _gnutls_hello_ext_default_deinit |
263 | | }; |