diff options
Diffstat (limited to 'lib/ext/max_record.c')
-rw-r--r-- | lib/ext/max_record.c | 127 |
1 files changed, 43 insertions, 84 deletions
diff --git a/lib/ext/max_record.c b/lib/ext/max_record.c index 8314d16193..2a7a9d3496 100644 --- a/lib/ext/max_record.c +++ b/lib/ext/max_record.c @@ -35,11 +35,6 @@ static int _gnutls_max_record_recv_params(gnutls_session_t session, static int _gnutls_max_record_send_params(gnutls_session_t session, gnutls_buffer_st * extdata); -static int _gnutls_max_record_unpack(gnutls_buffer_st * ps, - gnutls_ext_priv_data_t * _priv); -static int _gnutls_max_record_pack(gnutls_ext_priv_data_t _priv, - gnutls_buffer_st * ps); - /* Maps record size to numbers according to the * extensions draft. */ @@ -55,11 +50,7 @@ const hello_ext_entry_st ext_mod_max_record_size = { .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS | GNUTLS_EXT_FLAG_CLIENT_HELLO | GNUTLS_EXT_FLAG_EE | GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO, .recv_func = _gnutls_max_record_recv_params, - .send_func = _gnutls_max_record_send_params, - .pack_func = _gnutls_max_record_pack, - .unpack_func = _gnutls_max_record_unpack, - .deinit_func = NULL, - .cannot_be_overriden = 0 + .send_func = _gnutls_max_record_send_params }; /* @@ -78,8 +69,9 @@ _gnutls_max_record_recv_params(gnutls_session_t session, { ssize_t new_size; ssize_t data_size = _data_size; - gnutls_ext_priv_data_t epriv; - int ret; + + if (session->internals.hsk_flags & HSK_RECORD_SIZE_LIMIT_NEGOTIATED) + return 0; if (session->security_parameters.entity == GNUTLS_SERVER) { if (data_size > 0) { @@ -100,14 +92,6 @@ _gnutls_max_record_recv_params(gnutls_session_t session, } else { /* CLIENT SIDE - we must check if the sent record size is the right one */ if (data_size > 0) { - ret = _gnutls_hello_ext_get_priv(session, - GNUTLS_EXTENSION_MAX_RECORD_SIZE, - &epriv); - if (ret < 0) { - gnutls_assert(); - return GNUTLS_E_INTERNAL_ERROR; - } - if (data_size != 1) { gnutls_assert(); return GNUTLS_E_UNEXPECTED_PACKET_LENGTH; @@ -115,13 +99,18 @@ _gnutls_max_record_recv_params(gnutls_session_t session, new_size = _gnutls_mre_num2record(data[0]); - if (new_size < 0 - || new_size != (intptr_t) epriv) { + if (new_size < 0) { + gnutls_assert(); + return new_size; + } + + if (new_size != session->security_parameters. + max_record_send_size) { gnutls_assert(); return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER; } else { session->security_parameters. - max_record_recv_size = (intptr_t)epriv; + max_record_recv_size = new_size; } } @@ -143,17 +132,18 @@ _gnutls_max_record_send_params(gnutls_session_t session, /* this function sends the client extension data (dnsname) */ if (session->security_parameters.entity == GNUTLS_CLIENT) { - gnutls_ext_priv_data_t epriv; + if (session->security_parameters.max_record_send_size != + DEFAULT_MAX_RECORD_SIZE) { + ret = _gnutls_mre_record2num + (session->security_parameters. + max_record_send_size); - ret = _gnutls_hello_ext_get_priv(session, - GNUTLS_EXTENSION_MAX_RECORD_SIZE, - &epriv); - if (ret < 0) { /* it is ok not to have it */ - return 0; - } + /* it's not an error, as long as we send the + * record_size_limit extension with that value */ + if (ret < 0) + return 0; - if ((intptr_t)epriv != DEFAULT_MAX_RECORD_SIZE) { - p = (uint8_t) _gnutls_mre_record2num((intptr_t)epriv); + p = (uint8_t) ret; ret = _gnutls_buffer_append_data(extdata, &p, 1); if (ret < 0) return gnutls_assert_val(ret); @@ -165,11 +155,16 @@ _gnutls_max_record_send_params(gnutls_session_t session, if (session->security_parameters.max_record_recv_size != DEFAULT_MAX_RECORD_SIZE) { - p = (uint8_t) - _gnutls_mre_record2num - (session->security_parameters. - max_record_recv_size); + ret = _gnutls_mre_record2num + (session->security_parameters. + max_record_recv_size); + + /* it's not an error, as long as we send the + * record_size_limit extension with that value */ + if (ret < 0) + return 0; + p = (uint8_t) ret; ret = _gnutls_buffer_append_data(extdata, &p, 1); if (ret < 0) return gnutls_assert_val(ret); @@ -182,34 +177,6 @@ _gnutls_max_record_send_params(gnutls_session_t session, } -static int -_gnutls_max_record_pack(gnutls_ext_priv_data_t epriv, gnutls_buffer_st * ps) -{ - int ret; - - BUFFER_APPEND_NUM(ps, (intptr_t)epriv); - - return 0; - -} - -static int -_gnutls_max_record_unpack(gnutls_buffer_st * ps, - gnutls_ext_priv_data_t * _priv) -{ - gnutls_ext_priv_data_t epriv; - int ret; - - BUFFER_POP_CAST_NUM(ps, epriv); - - *_priv = epriv; - - ret = 0; - error: - return ret; -} - - /* Maps numbers to record sizes according to the * extensions draft. */ @@ -276,38 +243,30 @@ size_t gnutls_record_get_max_size(gnutls_session_t session) * connection. This property can only be set to clients. The server * may choose not to accept the requested size. * - * Acceptable values are 512(=2^9), 1024(=2^10), 2048(=2^11) and - * 4096(=2^12). The requested record size does get in effect - * immediately only while sending data. The receive part will take - * effect after a successful handshake. + * The requested record size does get in effect immediately only while + * sending data. The receive part will take effect after a successful + * handshake. * - * This function uses a TLS extension called 'max record size'. Not - * all TLS implementations use or even understand this extension. + * Prior to 3.6.4, this function was implemented using a TLS extension + * called 'max record size', which limits the acceptable values to + * 512(=2^9), 1024(=2^10), 2048(=2^11) and 4096(=2^12). Since 3.6.4, + * it uses another TLS extension called 'record size limit', which + * doesn't have the limitation, as long as the value ranges between + * 512 and 16384. Note that not all TLS implementations use or even + * understand those extension. * * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, * otherwise a negative error code is returned. **/ ssize_t gnutls_record_set_max_size(gnutls_session_t session, size_t size) { - ssize_t new_size; - gnutls_ext_priv_data_t epriv; - if (session->security_parameters.entity == GNUTLS_SERVER) return GNUTLS_E_INVALID_REQUEST; - new_size = _gnutls_mre_record2num(size); - - if (new_size < 0) { - gnutls_assert(); - return new_size; - } + if (size < MIN_RECORD_SIZE || size > DEFAULT_MAX_RECORD_SIZE) + return GNUTLS_E_INVALID_REQUEST; session->security_parameters.max_record_send_size = size; - epriv = (void *)(intptr_t)size; - - _gnutls_hello_ext_set_priv(session, - GNUTLS_EXTENSION_MAX_RECORD_SIZE, - epriv); return 0; } |