#include <tls_extensions.h>

Inheritance diagram for Botan::TLS::Server_Name_Indicator:

Public Member Functions
bool	empty () const override
std::string	host_name () const
virtual bool	is_implemented () const
std::vector< uint8_t >	serialize (Connection_Side whoami) const override
	Server_Name_Indicator (std::string_view host_name)
	Server_Name_Indicator (TLS_Data_Reader &reader, uint16_t extension_size, Connection_Side from)
Extension_Code	type () const override

Static Public Member Functions
static bool	hostname_acceptable_for_sni (std::string_view hostname)
static Extension_Code	static_type ()

Detailed Description

Server Name Indicator extension (RFC 3546)

Definition at line 103 of file tls_extensions.h.

Constructor & Destructor Documentation

◆ Server_Name_Indicator() [1/2]

Botan::TLS::Server_Name_Indicator::Server_Name_Indicator ( std::string_view host_name )

inlineexplicit

Definition at line 109 of file tls_extensions.h.

109: m_sni_host_name(host_name) {}

Botan::TLS::Server_Name_Indicator::host_name

std::string host_name() const

Definition tls_extensions.h:113

References host_name().

◆ Server_Name_Indicator() [2/2]

Botan::TLS::Server_Name_Indicator::Server_Name_Indicator	(	TLS_Data_Reader &	reader,
		uint16_t	extension_size,
		Connection_Side	from )

Definition at line 266 of file tls_extensions.cpp.

                                                                                                                   {
   /*
   RFC 6066 Section 3
 
      A server that receives a client hello containing the "server_name"
      extension MAY use the information contained in the extension to guide
      its selection of an appropriate certificate to return to the client,
      and/or other aspects of security policy.  In this event, the server
      SHALL include an extension of type "server_name" in the (extended)
      server hello.  The "extension_data" field of this extension SHALL be
      empty.
   */
   if(from == Connection_Side::Server) {
      if(extension_size != 0) {
         throw TLS_Exception(Alert::IllegalParameter, "Server sent non-empty SNI extension");
      }
   } else {
      // Clients are required to send at least one name in the SNI
      if(extension_size == 0) {
         throw TLS_Exception(Alert::IllegalParameter, "Client sent empty SNI extension");
      }
 
      const uint16_t name_bytes = reader.get_uint16_t();
 
      if(name_bytes + 2 != extension_size || name_bytes < 3) {
         throw Decoding_Error("Bad encoding of SNI extension");
      }
 
      BOTAN_ASSERT_NOMSG(reader.remaining_bytes() == name_bytes);
 
      while(reader.has_remaining()) {
         const uint8_t name_type = reader.get_byte();
 
         if(name_type == 0) {
            /*
            RFC 6066 Section 3
               The ServerNameList MUST NOT contain more than one name of the same name_type.
            */
            if(!m_sni_host_name.empty()) {
               throw Decoding_Error("TLS ServerNameIndicator contains more than one host_name");
            }
            m_sni_host_name = reader.get_string(2, 1, 65535);
         } else {
            /*
            Unknown name type - skip its length-prefixed value and continue
 
            RFC 6066 Section 3
               For backward compatibility, all future data structures associated
               with new NameTypes MUST begin with a 16-bit length field.
            */
            const uint16_t unknown_name_len = reader.get_uint16_t();
            reader.discard_next(unknown_name_len);
         }
      }
   }
}

References BOTAN_ASSERT_NOMSG, Botan::TLS::TLS_Data_Reader::discard_next(), Botan::TLS::TLS_Data_Reader::get_byte(), Botan::TLS::TLS_Data_Reader::get_string(), Botan::TLS::TLS_Data_Reader::get_uint16_t(), Botan::TLS::TLS_Data_Reader::has_remaining(), Botan::TLS::TLS_Data_Reader::remaining_bytes(), and Botan::TLS::Server.

Member Function Documentation

◆ empty()

bool Botan::TLS::Server_Name_Indicator::empty ( ) const

inlineoverridevirtual

Returns: if we should encode this extension or not

Implements Botan::TLS::Extension.

Definition at line 117 of file tls_extensions.h.

117{ return false; }

◆ host_name()

std::string Botan::TLS::Server_Name_Indicator::host_name ( ) const

inline

Definition at line 113 of file tls_extensions.h.

113{ return m_sni_host_name; }

Referenced by Server_Name_Indicator().

◆ hostname_acceptable_for_sni()

bool Botan::TLS::Server_Name_Indicator::hostname_acceptable_for_sni ( std::string_view hostname )

static

Definition at line 348 of file tls_extensions.cpp.

                                                                               {
   // Avoid sending an IPv4/IPv6 address in SNI as this is prohibited
 
   if(hostname.empty()) {
      return false;
   }
 
   if(string_to_ipv4(hostname).has_value()) {
      return false;
   }
 
   // IPv6? Anyway ':' is not valid in DNS
   if(hostname.find(':') != std::string_view::npos) {
      return false;
   }
 
   return true;
}

References Botan::string_to_ipv4().

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().

◆ is_implemented()

virtual bool Botan::TLS::Extension::is_implemented ( ) const

inlinevirtualinherited

Returns: true if this extension is known and implemented by Botan

Reimplemented in Botan::TLS::Unknown_Extension.

Definition at line 95 of file tls_extensions.h.

95{ return true; }

◆ serialize()

std::vector< uint8_t > Botan::TLS::Server_Name_Indicator::serialize ( Connection_Side whoami ) const

overridevirtual

Returns: serialized binary for the extension

Implements Botan::TLS::Extension.

Definition at line 323 of file tls_extensions.cpp.

                                                                                {
   // RFC 6066
   //    [...] the server SHALL include an extension of type "server_name" in
   //    the (extended) server hello. The "extension_data" field of this
   //    extension SHALL be empty.
   if(whoami == Connection_Side::Server) {
      return {};
   }
 
   std::vector<uint8_t> buf;
 
   const size_t name_len = m_sni_host_name.size();
 
   buf.push_back(get_byte<0>(static_cast<uint16_t>(name_len + 3)));
   buf.push_back(get_byte<1>(static_cast<uint16_t>(name_len + 3)));
   buf.push_back(0);  // DNS
 
   buf.push_back(get_byte<0>(static_cast<uint16_t>(name_len)));
   buf.push_back(get_byte<1>(static_cast<uint16_t>(name_len)));
 
   buf += as_span_of_bytes(m_sni_host_name);
 
   return buf;
}