Coverage Report

Created: 2025-03-06 07:58

/src/gnutls/lib/ext/compress_certificate.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (C) 2022 Red Hat, Inc.
3
 *
4
 * Author: Zoltan Fridrich
5
 *
6
 * This file is part of GnuTLS.
7
 *
8
 * The GnuTLS is free software; you can redistribute it and/or
9
 * modify it under the terms of the GNU Lesser General Public License
10
 * as published by the Free Software Foundation; either version 2.1 of
11
 * the License, or (at your option) any later version.
12
 *
13
 * This library is distributed in the hope that it will be useful, but
14
 * WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16
 * Lesser General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU Lesser General Public License
19
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
20
 *
21
 */
22
23
#include "compress.h"
24
#include "errors.h"
25
#include "gnutls_int.h"
26
#include "hello_ext_lib.h"
27
#include "num.h"
28
#include "ext/compress_certificate.h"
29
30
/* Converts compression algorithm number established in RFC8879 to internal compression method type
31
 */
32
gnutls_compression_method_t
33
_gnutls_compress_certificate_num2method(uint16_t num)
34
0
{
35
0
  switch (num) {
36
0
  case 1:
37
0
    return GNUTLS_COMP_ZLIB;
38
0
  case 2:
39
0
    return GNUTLS_COMP_BROTLI;
40
0
  case 3:
41
0
    return GNUTLS_COMP_ZSTD;
42
0
  default:
43
0
    return GNUTLS_COMP_UNKNOWN;
44
0
  }
45
0
}
46
47
/* Converts compression method type to compression algorithm number established in RFC8879
48
 */
49
int _gnutls_compress_certificate_method2num(gnutls_compression_method_t method)
50
0
{
51
0
  switch (method) {
52
0
  case GNUTLS_COMP_ZLIB:
53
0
    return 1;
54
0
  case GNUTLS_COMP_BROTLI:
55
0
    return 2;
56
0
  case GNUTLS_COMP_ZSTD:
57
0
    return 3;
58
0
  default:
59
0
    return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
60
0
  }
61
0
}
62
63
/* Returns 1 if the method is set as supported compression method for the session,
64
 * returns 0 otherwise
65
 */
66
bool _gnutls_compress_certificate_is_method_enabled(
67
  gnutls_session_t session, gnutls_compression_method_t method)
68
0
{
69
0
  int ret;
70
0
  unsigned i;
71
0
  compress_certificate_ext_st *priv;
72
0
  gnutls_ext_priv_data_t epriv;
73
74
0
  ret = _gnutls_hello_ext_get_priv(
75
0
    session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv);
76
0
  if (ret < 0)
77
0
    return false;
78
0
  priv = epriv;
79
80
0
  for (i = 0; i < priv->methods_len; ++i)
81
0
    if (priv->methods[i] == method)
82
0
      return true;
83
84
0
  return false;
85
0
}
86
87
/**
88
 * gnutls_compress_certificate_get_selected_method:
89
 * @session: is a #gnutls_session_t type.
90
 *
91
 * This function returns the certificate compression method that has been
92
 * selected to compress the certificate before sending it to the peer.
93
 * The selection is done based on the local list of supported compression
94
 * methods and the peer's requested compression methods.
95
 *
96
 * Returns: selected certificate compression method.
97
 *
98
 * Since 3.7.4
99
 **/
100
gnutls_compression_method_t
101
gnutls_compress_certificate_get_selected_method(gnutls_session_t session)
102
0
{
103
0
  return session->internals.compress_certificate_method;
104
0
}
105
106
/**
107
 * gnutls_compress_certificate_set_methods:
108
 * @session: is a #gnutls_session_t type.
109
 * @methods: is a list of supported compression methods.
110
 * @methods_len: number of compression methods in @methods
111
 *
112
 * This function sets the supported compression methods for certificate compression
113
 * for the given session. The list of supported compression methods will be used
114
 * for a) requesting the compression of peer's certificate and b) selecting the
115
 * method to compress the local certificate before sending it to the peer.
116
 * The order of compression methods inside the list does matter as the method
117
 * that appears earlier in the list will be preferred before the later ones.
118
 * Note that even if you set the list of supported compression methods, the
119
 * compression might not be used if the peer does not support any of your chosen
120
 * compression methods.
121
 *
122
 * The list of supported compression methods must meet the following criteria:
123
 * Argument @methods must be an array of valid compression methods of type
124
 * #gnutls_compression_method_t. Argument @methods_len must contain the number of
125
 * compression methods stored in the @methods array and must be within range <1, 127>.
126
 * The length constraints are defined by %MIN_COMPRESS_CERTIFICATE_METHODS
127
 * and %MAX_COMPRESS_CERTIFICATE_METHODS macros located in the header file
128
 * compress_certificate.h.
129
 *
130
 * If either @methods or @methods_len is equal to 0, current list of supported
131
 * compression methods will be unset.
132
 *
133
 * Returns: %GNUTLS_E_SUCCESS on success, otherwise a negative error code.
134
 *
135
 * Since 3.7.4
136
 **/
137
int gnutls_compress_certificate_set_methods(
138
  gnutls_session_t session, const gnutls_compression_method_t *methods,
139
  size_t methods_len)
140
0
{
141
0
  int ret;
142
0
  unsigned i;
143
0
  compress_certificate_ext_st *priv;
144
145
0
  if (methods == NULL || methods_len == 0) {
146
0
    _gnutls_hello_ext_unset_priv(
147
0
      session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE);
148
0
    return 0;
149
0
  }
150
151
0
  if (methods_len > MAX_COMPRESS_CERTIFICATE_METHODS)
152
0
    return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
153
154
0
  for (i = 0; i < methods_len; ++i)
155
0
    if ((ret = _gnutls_compression_init_method(methods[i])) < 0)
156
0
      return gnutls_assert_val(ret);
157
158
0
  priv = gnutls_malloc(sizeof(*priv));
159
0
  if (priv == NULL)
160
0
    return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
161
162
0
  priv->methods_len = methods_len;
163
0
  memcpy(priv->methods, methods, methods_len * sizeof(*methods));
164
0
  _gnutls_hello_ext_set_priv(session,
165
0
           GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, priv);
166
167
0
  return 0;
168
0
}
169
170
int _gnutls_compress_certificate_recv_params(gnutls_session_t session,
171
               const uint8_t *data,
172
               size_t data_size)
173
0
{
174
0
  int ret;
175
0
  unsigned i, j;
176
0
  uint16_t num;
177
0
  uint8_t bytes_len;
178
0
  size_t methods_len;
179
0
  gnutls_compression_method_t methods[MAX_COMPRESS_CERTIFICATE_METHODS];
180
0
  gnutls_compression_method_t method;
181
0
  compress_certificate_ext_st *priv;
182
0
  gnutls_ext_priv_data_t epriv;
183
184
0
  ret = _gnutls_hello_ext_get_priv(
185
0
    session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv);
186
0
  if (ret < 0)
187
0
    return 0;
188
0
  priv = epriv;
189
190
0
  DECR_LEN(data_size, 1);
191
0
  bytes_len = *data;
192
193
0
  if (bytes_len < 2 || bytes_len > 254 || bytes_len % 2 == 1)
194
0
    return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
195
196
0
  DECR_LEN(data_size, bytes_len);
197
0
  if (data_size > 0)
198
0
    return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
199
200
0
  methods_len = 0;
201
0
  for (i = 0; i < bytes_len / 2; ++i) {
202
0
    num = _gnutls_read_uint16(data + i + i + 1);
203
0
    method = _gnutls_compress_certificate_num2method(num);
204
0
    if (method != GNUTLS_COMP_UNKNOWN)
205
0
      methods[methods_len++] = method;
206
0
  }
207
208
0
  method = GNUTLS_COMP_UNKNOWN;
209
0
  for (i = 0; i < methods_len; ++i)
210
0
    for (j = 0; j < priv->methods_len; ++j)
211
0
      if (methods[i] == priv->methods[j]) {
212
0
        method = methods[i];
213
0
        goto endloop;
214
0
      }
215
0
endloop:
216
0
  session->internals.compress_certificate_method = method;
217
218
0
  return 0;
219
0
}
220
221
int _gnutls_compress_certificate_send_params(gnutls_session_t session,
222
               gnutls_buffer_st *data)
223
0
{
224
0
  int ret, num;
225
0
  unsigned i;
226
0
  uint8_t bytes_len;
227
0
  uint8_t bytes[2 * MAX_COMPRESS_CERTIFICATE_METHODS];
228
0
  compress_certificate_ext_st *priv;
229
0
  gnutls_ext_priv_data_t epriv;
230
231
0
  ret = _gnutls_hello_ext_get_priv(
232
0
    session, GNUTLS_EXTENSION_COMPRESS_CERTIFICATE, &epriv);
233
0
  if (ret < 0)
234
0
    return 0;
235
0
  priv = epriv;
236
237
0
  bytes_len = 2 * priv->methods_len;
238
0
  for (i = 0; i < priv->methods_len; ++i) {
239
0
    num = _gnutls_compress_certificate_method2num(priv->methods[i]);
240
0
    _gnutls_write_uint16(num, bytes + i + i);
241
0
  }
242
243
0
  ret = _gnutls_buffer_append_data_prefix(data, 8, bytes, bytes_len);
244
0
  if (ret < 0)
245
0
    return gnutls_assert_val(ret);
246
247
0
  session->internals.hsk_flags |= HSK_COMP_CRT_REQ_SENT;
248
249
0
  return bytes_len + 1;
250
0
}
251
252
const hello_ext_entry_st ext_mod_compress_certificate = {
253
  .name = "Compress Certificate",
254
  .tls_id = 27,
255
  .gid = GNUTLS_EXTENSION_COMPRESS_CERTIFICATE,
256
  .client_parse_point = GNUTLS_EXT_TLS,
257
  .server_parse_point = GNUTLS_EXT_TLS,
258
  .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |
259
        GNUTLS_EXT_FLAG_CLIENT_HELLO,
260
  .recv_func = _gnutls_compress_certificate_recv_params,
261
  .send_func = _gnutls_compress_certificate_send_params,
262
  .deinit_func = _gnutls_hello_ext_default_deinit
263
};