#include <tls_extensions.h>

Inheritance diagram for Botan::TLS::Server_Name_Indicator:

Public Member Functions
bool	empty () const override
std::string	host_name () const
virtual bool	is_implemented () const
std::vector< uint8_t >	serialize (Connection_Side whoami) const override
	Server_Name_Indicator (std::string_view host_name)
	Server_Name_Indicator (TLS_Data_Reader &reader, uint16_t extension_size, Connection_Side from)
Extension_Code	type () const override

Static Public Member Functions
static bool	hostname_acceptable_for_sni (std::string_view hostname)
static Extension_Code	static_type ()

Detailed Description

Server Name Indicator extension (RFC 3546)

Definition at line 121 of file tls_extensions.h.

Constructor & Destructor Documentation

◆ Server_Name_Indicator() [1/2]

Botan::TLS::Server_Name_Indicator::Server_Name_Indicator ( std::string_view host_name )

inlineexplicit

Definition at line 127 of file tls_extensions.h.

127: m_sni_host_name(host_name) {}

Botan::TLS::Server_Name_Indicator::host_name

std::string host_name() const

Definition tls_extensions.h:131

References host_name().

◆ Server_Name_Indicator() [2/2]

Botan::TLS::Server_Name_Indicator::Server_Name_Indicator	(	TLS_Data_Reader &	reader,
		uint16_t	extension_size,
		Connection_Side	from )

Definition at line 320 of file tls_extensions.cpp.

                                                                                                                   {
   /*
   RFC 6066 Section 3
 
      A server that receives a client hello containing the "server_name"
      extension MAY use the information contained in the extension to guide
      its selection of an appropriate certificate to return to the client,
      and/or other aspects of security policy.  In this event, the server
      SHALL include an extension of type "server_name" in the (extended)
      server hello.  The "extension_data" field of this extension SHALL be
      empty.
   */
   if(from == Connection_Side::Server) {
      if(extension_size != 0) {
         throw TLS_Exception(Alert::IllegalParameter, "Server sent non-empty SNI extension");
      }
   } else {
      // Clients are required to send at least one name in the SNI
      if(extension_size == 0) {
         throw TLS_Exception(Alert::IllegalParameter, "Client sent empty SNI extension");
      }
 
      const uint16_t name_bytes = reader.get_uint16_t();
 
      // RFC 6066 3: a ServerName carrying a host_name (the only NameType
      // currently defined and the only one this implementation acts on)
      // requires at least 1 byte name_type + 2 byte length + 1 byte HostName.
      if(name_bytes + 2 != extension_size || name_bytes < 4) {
         throw Decoding_Error("Bad encoding of SNI extension");
      }
 
      BOTAN_ASSERT_NOMSG(reader.remaining_bytes() == name_bytes);
 
      while(reader.has_remaining()) {
         const uint8_t name_type = reader.get_byte();
 
         if(name_type == 0) {
            /*
            RFC 6066 Section 3
               The ServerNameList MUST NOT contain more than one name of the same name_type.
            */
            if(!m_sni_host_name.empty()) {
               throw Decoding_Error("TLS ServerNameIndicator contains more than one host_name");
            }
            m_sni_host_name = reader.get_string(2, 1, 65535);
         } else {
            /*
            Unknown name type - skip its length-prefixed value and continue
 
            RFC 6066 Section 3
               For backward compatibility, all future data structures associated
               with new NameTypes MUST begin with a 16-bit length field.
            */
            const uint16_t unknown_name_len = reader.get_uint16_t();
            reader.discard_next(unknown_name_len);
         }
      }
   }
}

References BOTAN_ASSERT_NOMSG, Botan::TLS::TLS_Data_Reader::discard_next(), Botan::TLS::TLS_Data_Reader::get_byte(), Botan::TLS::TLS_Data_Reader::get_string(), Botan::TLS::TLS_Data_Reader::get_uint16_t(), Botan::TLS::TLS_Data_Reader::has_remaining(), Botan::TLS::TLS_Data_Reader::remaining_bytes(), and Botan::TLS::Server.

Member Function Documentation

◆ empty()

bool Botan::TLS::Server_Name_Indicator::empty ( ) const

inlineoverridevirtual

Predicate if a TLS extension should be included or not

Returns: true if this extension should be encoded, otherwise false

Implements Botan::TLS::Extension.

Definition at line 135 of file tls_extensions.h.

135{ return false; }

◆ host_name()

std::string Botan::TLS::Server_Name_Indicator::host_name ( ) const

inline

Definition at line 131 of file tls_extensions.h.

131{ return m_sni_host_name; }

Referenced by Server_Name_Indicator().

◆ hostname_acceptable_for_sni()

bool Botan::TLS::Server_Name_Indicator::hostname_acceptable_for_sni ( std::string_view hostname )

static

Definition at line 410 of file tls_extensions.cpp.

                                                                               {
   // Avoid sending an IPv4/IPv6 address in SNI as this is prohibited
 
   if(hostname.empty() || hostname.size() > 255) {
      return false;
   }
 
   if(auto ipv4 = IPv4Address::from_string(hostname)) {
      return false;
   }
 
   if(auto ipv6 = IPv6Address::from_string(hostname)) {
      return false;
   }
 
   if(auto dns = DNSName::from_string(hostname)) {
      return true;
   } else {
      return false;
   }
}

References Botan::DNSName::from_string(), Botan::IPv4Address::from_string(), and Botan::IPv6Address::from_string().

Referenced by Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Client_Hello_12::Client_Hello_12(), and Botan::TLS::Client_Hello_13::Client_Hello_13().

◆ is_implemented()

virtual bool Botan::TLS::Extension::is_implemented ( ) const

inlinevirtualinherited

Predicate if the extension is known/implemented

Note: this exists primarily to support unknown extension handling and doesn't need to be overridden even in the custom extension case.

Returns: true if this extension is known

Reimplemented in Botan::TLS::Unknown_Extension.

Definition at line 113 of file tls_extensions.h.

113{ return true; }

◆ serialize()

std::vector< uint8_t > Botan::TLS::Server_Name_Indicator::serialize ( Connection_Side whoami ) const

overridevirtual

Serialize a TLS extension

Parameters

whoami which peer we are acting as in the protocol

Returns: serialized binary for the extension

Implements Botan::TLS::Extension.

Definition at line 380 of file tls_extensions.cpp.

                                                                                {
   // RFC 6066
   //    [...] the server SHALL include an extension of type "server_name" in
   //    the (extended) server hello. The "extension_data" field of this
   //    extension SHALL be empty.
   if(whoami == Connection_Side::Server) {
      return {};
   }
 
   std::vector<uint8_t> buf;
 
   const size_t name_len = m_sni_host_name.size();
 
   // RFC 6066 3: HostName<1..2^16-1>; the outer ServerNameList wraps a
   // 1-byte name_type and a 2-byte length so the whole entry must fit in
   // a uint16_t too.
   BOTAN_ASSERT_NOMSG(name_len + 3 <= 0xFFFF);
 
   buf.push_back(get_byte<0>(static_cast<uint16_t>(name_len + 3)));
   buf.push_back(get_byte<1>(static_cast<uint16_t>(name_len + 3)));
   buf.push_back(0);  // DNS
 
   buf.push_back(get_byte<0>(static_cast<uint16_t>(name_len)));
   buf.push_back(get_byte<1>(static_cast<uint16_t>(name_len)));
 
   buf += as_span_of_bytes(m_sni_host_name);
 
   return buf;
}