/*

 * Copyright (C) 2002-2012 Free Software Foundation, Inc.

 * Copyright (C) 2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "auth.h"

#include "errors.h"

#include "num.h"

#include "str.h"

#include "ext/server_name.h"

#include "hello_ext_lib.h"

static int _gnutls_server_name_recv_params(gnutls_session_t session,

             const uint8_t *data,

             size_t data_size);

static int _gnutls_server_name_send_params(gnutls_session_t session,

             gnutls_buffer_st *extdata);

int _gnutls_server_name_set_raw(gnutls_session_t session,

        gnutls_server_name_type_t type,

        const void *name, size_t name_length);

const hello_ext_entry_st ext_mod_server_name = {

  .name = "Server Name Indication",

  .tls_id = 0,

  .gid = GNUTLS_EXTENSION_SERVER_NAME,

  .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |

        GNUTLS_EXT_FLAG_CLIENT_HELLO | GNUTLS_EXT_FLAG_EE |

        GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO,

  .client_parse_point = GNUTLS_EXT_MANDATORY,

  .server_parse_point = GNUTLS_EXT_MANDATORY,

  .recv_func = _gnutls_server_name_recv_params,

  .send_func = _gnutls_server_name_send_params,

  .pack_func = _gnutls_hello_ext_default_pack,

  .unpack_func = _gnutls_hello_ext_default_unpack,

  .deinit_func = _gnutls_hello_ext_default_deinit,

  .cannot_be_overriden = 1

};

/*

 * In case of a server: if a NAME_DNS extension type is received then

 * it stores into the session the value of NAME_DNS. The server may

 * use gnutls_ext_get_server_name(), in order to access it.

 *

 * In case of a client: If a proper NAME_DNS extension type is found

 * in the session then it sends the extension to the peer.

 *

 */

static int _gnutls_server_name_recv_params(gnutls_session_t session,

             const uint8_t *data,

             size_t data_size)

{

  const unsigned char *p;

  uint16_t len, type;

  gnutls_datum_t name;

  if (session->security_parameters.entity == GNUTLS_SERVER) {

    DECR_LENGTH_RET(data_size, 2,

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    len = _gnutls_read_uint16(data);

    if (len == 0)

      return gnutls_assert_val(

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    if (len != data_size) {

      gnutls_assert();

      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;

    }

    p = data + 2;

    while (data_size > 0) {

      DECR_LEN(data_size, 1);

      type = *p;

      p++;

      DECR_LEN(data_size, 2);

      len = _gnutls_read_uint16(p);

      p += 2;

      if (len == 0) {

        _gnutls_handshake_log(

          "HSK[%p]: Received server name size of zero\n",

          session);

        return gnutls_assert_val(

          GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

      }

      DECR_LEN(data_size, len);

      if (type == 0) { /* NAME_DNS */

        if (!_gnutls_dnsname_is_valid((char *)p, len)) {

          _gnutls_handshake_log(

            "HSK[%p]: Server name is not acceptable: '%.*s'\n",

            session, (int)len, p);

          return gnutls_assert_val(

            GNUTLS_E_RECEIVED_DISALLOWED_NAME);

        }

        name.data = (void *)p;

        name.size = len;

        _gnutls_hello_ext_unset_priv(

          session, GNUTLS_EXTENSION_SERVER_NAME);

        return _gnutls_hello_ext_set_datum(

          session, GNUTLS_EXTENSION_SERVER_NAME,

          &name);

      }

      p += len;

    }

  }

  return 0;

}

/* returns data_size or a negative number on failure

 */

static int _gnutls_server_name_send_params(gnutls_session_t session,

             gnutls_buffer_st *extdata)

{

  int total_size = 0, ret;

  gnutls_datum_t name;

  ret = _gnutls_hello_ext_get_datum(session, GNUTLS_EXTENSION_SERVER_NAME,

            &name);

  if (ret < 0)

    return 0;

  /* this function sends the client extension data (dnsname)

   */

  if (session->security_parameters.entity == GNUTLS_CLIENT) {

    if (name.size == 0)

      return 0;

    /* uint8_t + uint16_t + size

     */

    total_size = 2 + 1 + 2 + name.size;

    /* UINT16: write total size of all names

     */

    ret = _gnutls_buffer_append_prefix(extdata, 16, total_size - 2);

    if (ret < 0)

      return gnutls_assert_val(ret);

    /* UINT8: type of this extension

     * UINT16: size of the first name

     * LEN: the actual server name.

     */

    ret = _gnutls_buffer_append_prefix(extdata, 8, 0);

    if (ret < 0)

      return gnutls_assert_val(ret);

    _gnutls_debug_log("HSK[%p]: sent server name: '%.*s'\n",

          session, name.size, name.data);

    ret = _gnutls_buffer_append_data_prefix(extdata, 16, name.data,

              name.size);

    if (ret < 0)

      return gnutls_assert_val(ret);

  } else {

    return 0;

  }

  return total_size;

}

/**

 * gnutls_server_name_get:

 * @session: is a #gnutls_session_t type.

 * @data: will hold the data

 * @data_length: will hold the data length. Must hold the maximum size of data.

 * @type: will hold the server name indicator type

 * @indx: is the index of the server_name

 *

 * This function will allow you to get the name indication (if any), a

 * client has sent.  The name indication may be any of the enumeration

 * gnutls_server_name_type_t.

 *

 * If @type is GNUTLS_NAME_DNS, then this function is to be used by

 * servers that support virtual hosting, and the data will be a null

 * terminated IDNA ACE string (prior to GnuTLS 3.4.0 it was a UTF-8 string).

 *

 * If @data has not enough size to hold the server name

 * GNUTLS_E_SHORT_MEMORY_BUFFER is returned, and @data_length will

 * hold the required size.

 *

 * @indx is used to retrieve more than one server names (if sent by

 * the client).  The first server name has an index of 0, the second 1

 * and so on.  If no name with the given index exists

 * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, on UTF-8

 *  decoding error %GNUTLS_E_IDNA_ERROR is returned, otherwise a negative

 *  error code is returned.

 **/

int gnutls_server_name_get(gnutls_session_t session, void *data,

         size_t *data_length, unsigned int *type,

         unsigned int indx)

{

  char *_data = data;

  gnutls_datum_t name;

  int ret;

  if (session->security_parameters.entity == GNUTLS_CLIENT) {

    gnutls_assert();

    return GNUTLS_E_INVALID_REQUEST;

  }

  if (indx != 0)

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  ret = _gnutls_hello_ext_get_datum(session, GNUTLS_EXTENSION_SERVER_NAME,

            &name);

  if (ret < 0) {

    gnutls_assert();

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  }

  if (name.size == 0) {

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  }

  *type = GNUTLS_NAME_DNS;

  if (*data_length >

      name.size) { /* greater since we need one extra byte for the null */

    *data_length = name.size;

    memcpy(data, name.data, *data_length);

    /* null terminate */

    _data[(*data_length)] = 0;

  } else {

    *data_length = name.size + 1;

    ret = GNUTLS_E_SHORT_MEMORY_BUFFER;

    goto cleanup;

  }

  ret = 0;

cleanup:

  return ret;

}

/* This does not do any conversion not perform any check */

int _gnutls_server_name_set_raw(gnutls_session_t session,

        gnutls_server_name_type_t type,

        const void *name, size_t name_length)

{

  int ret;

  gnutls_datum_t dname;

  if (name_length >= MAX_SERVER_NAME_SIZE) {

    return GNUTLS_E_INVALID_REQUEST;

  }

  _gnutls_hello_ext_unset_priv(session, GNUTLS_EXTENSION_SERVER_NAME);

  dname.data = (void *)name;

  dname.size = name_length;

  ret = _gnutls_hello_ext_set_datum(session, GNUTLS_EXTENSION_SERVER_NAME,

            &dname);

  if (ret < 0)

    return gnutls_assert_val(ret);

  return 0;

}

/**

 * gnutls_server_name_set:

 * @session: is a #gnutls_session_t type.

 * @type: specifies the indicator type

 * @name: is a string that contains the server name.

 * @name_length: holds the length of name excluding the terminating null byte

 *

 * This function is to be used by clients that want to inform (via a

 * TLS extension mechanism) the server of the name they connected to.

 * This should be used by clients that connect to servers that do

 * virtual hosting.

 *

 * The value of @name depends on the @type type.  In case of

 * %GNUTLS_NAME_DNS, a UTF-8 null-terminated domain name string,

 * without the trailing dot, is expected.

 *

 * IPv4 or IPv6 addresses are not permitted to be set by this function.

 * If the function is called with a name of @name_length zero it will clear

 * all server names set.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 **/

int gnutls_server_name_set(gnutls_session_t session,

         gnutls_server_name_type_t type, const void *name,

         size_t name_length)

{

  int ret;

  gnutls_datum_t idn_name = { NULL, 0 };

  if (session->security_parameters.entity == GNUTLS_SERVER) {

    gnutls_assert();

    return GNUTLS_E_INVALID_REQUEST;

  }

  if (name_length == 0) { /* unset extension */

    _gnutls_hello_ext_unset_priv(session,

               GNUTLS_EXTENSION_SERVER_NAME);

    return 0;

  }

  ret = gnutls_idna_map(name, name_length, &idn_name, 0);

  if (ret < 0) {

    _gnutls_debug_log(

      "unable to convert name %s to IDNA2008 format\n",

      (char *)name);

    return ret;

  }

  name = idn_name.data;

  name_length = idn_name.size;

  ret = _gnutls_server_name_set_raw(session, type, name, name_length);

  gnutls_free(idn_name.data);

  return ret;

}

unsigned _gnutls_server_name_matches_resumed(gnutls_session_t session)

{

  gnutls_datum_t name1, name2;

  int ret;

  ret = _gnutls_hello_ext_get_datum(session, GNUTLS_EXTENSION_SERVER_NAME,

            &name1);

  if (ret < 0) { /* no server name in this session */

    name1.data = NULL;

    name1.size = 0;

  }

  ret = _gnutls_hello_ext_get_resumed_datum(

    session, GNUTLS_EXTENSION_SERVER_NAME, &name2);

  if (ret < 0) { /* no server name in this session */

    name2.data = NULL;

    name2.size = 0;

  }

  if (name1.data == NULL || name2.data == NULL) {

    if (name1.data == name2.data)

      return 1;

    else

      return 0;

  }

  if (name1.size != name2.size)

    return 0;

  if (memcmp(name1.data, name2.data, name1.size) != 0)

    return 0;

  return 1;

}