From: Nikos Mavrogiannopoulos Date: Fri, 11 Oct 2002 12:06:38 +0000 (+0000) Subject: Improved the server name extension. Resumed sessions can now use it. X-Git-Tag: gnutls_0_5_x_before_int_fixes~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e27a26c5837e8b04bb28316f53267613dada6960;p=thirdparty%2Fgnutls.git Improved the server name extension. Resumed sessions can now use it. --- diff --git a/NEWS b/NEWS index 99574eb6ad..622b429fc4 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ Version 0.5.10 - Updated documentation. -- Added server name extension. +- Added server name extension. This allows clients to specify the + name of the server they connect to. Useful to HTTPS. Version 0.5.9 (10/10/2002) - Corrected some code which worked fine in gcc 3.2, but not with any diff --git a/lib/ext_server_name.c b/lib/ext_server_name.c index b6effe487d..8f02cb7572 100644 --- a/lib/ext_server_name.c +++ b/lib/ext_server_name.c @@ -67,11 +67,8 @@ int _gnutls_server_name_recv_params(gnutls_session session, if (server_names == 0) return 0; /* no names found */ - if (session->security_parameters.extensions.server_names) - free(session->security_parameters.extensions.server_names); - - session->security_parameters.extensions.server_names = - gnutls_malloc(server_names * sizeof(server_name_st)); + if ( server_names > MAX_SERVER_NAME_EXTENSIONS) + server_names = MAX_SERVER_NAME_EXTENSIONS; p = data + 2; for (i = 0; i < server_names; i++) { @@ -254,12 +251,8 @@ int gnutls_set_server_name(gnutls_session session, server_names = session->security_parameters.extensions.server_names_size + 1; - session->security_parameters.extensions.server_names = - gnutls_realloc(session->security_parameters.extensions.server_names, - server_names * sizeof(server_name_st)); - - if (session->security_parameters.extensions.server_names == NULL) - return GNUTLS_E_MEMORY_ERROR; + if (server_names > MAX_SERVER_NAME_EXTENSIONS) + server_names = MAX_SERVER_NAME_EXTENSIONS; session->security_parameters.extensions.server_names[server_names - 1].type = type; diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index 9fc7d3db29..5e39d81c75 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -64,8 +64,8 @@ typedef int gnutls_transport_ptr; #define MAX_X509_CERT_SIZE 10*1024 #define MAX_LOG_SIZE 1024 /* maximum number of log message */ -#define MAX_SRP_USERNAME 256 -#define MAX_SERVER_NAME_SIZE 256 +#define MAX_SRP_USERNAME 128 +#define MAX_SERVER_NAME_SIZE 128 /* we can receive up to MAX_EXT_TYPES extensions. */ @@ -294,8 +294,11 @@ typedef struct { gnutls_server_name_type type; } server_name_st; +#define MAX_SERVER_NAME_EXTENSIONS 3 + typedef struct { - server_name_st* server_names; + server_name_st server_names[MAX_SERVER_NAME_EXTENSIONS]; + /* limit server_name extensions */ int server_names_size; opaque srp_username[MAX_SRP_USERNAME]; } TLSExtensions; diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c index 1d8ea31623..d2d94b496f 100644 --- a/lib/gnutls_priority.c +++ b/lib/gnutls_priority.c @@ -260,8 +260,8 @@ int gnutls_certificate_type_set_priority(gnutls_session session, * - TLS1, SSL3 for protocols. * - GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA for key exchange algorithms. * - GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms. - * - GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_RIJNDAEL_128_CBC, GNUTLS_CIPHER_RIJNDAEL_256_CBC, - * GNUTLS_CIPHER_3DES_CBC for ciphers. + * - GNUTLS_CIPHER_RIJNDAEL_256_CBC, GNUTLS_CIPHER_RIJNDAEL_128_CBC, + * GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128 for ciphers. * **/ int gnutls_set_default_priority(gnutls_session session) @@ -270,9 +270,9 @@ int gnutls_set_default_priority(gnutls_session session) { GNUTLS_TLS1, GNUTLS_SSL3, 0 }; static const int kx_priority[16] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, 0 }; - static const int cipher_priority[16] = - { GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_RIJNDAEL_128_CBC, - GNUTLS_CIPHER_3DES_CBC, 0 + static const int cipher_priority[16] = { + GNUTLS_CIPHER_RIJNDAEL_256_CBC, GNUTLS_CIPHER_RIJNDAEL_128_CBC, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, 0 }; static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 }; static const int mac_priority[16] = @@ -298,20 +298,24 @@ int gnutls_set_default_priority(gnutls_session session) * - TLS1, SSL3 for protocols. * - GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_RSA_EXPORT for key exchange algorithms. * - GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms. - * - GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_RIJNDAEL_128_CBC, GNUTLS_CIPHER_RIJNDAEL_256_CBC, - * GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_40 for ciphers. + * - GNUTLS_CIPHER_RIJNDAEL_256_CBC, GNUTLS_CIPHER_RIJNDAEL_128_CBC, + * GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_ARCFOUR_40 + * for ciphers. * **/ int gnutls_set_default_export_priority(gnutls_session session) { - static const int protocol_priority[16] = - { GNUTLS_TLS1, GNUTLS_SSL3, 0 }; - static const int kx_priority[16] = - { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, -GNUTLS_KX_RSA_EXPORT, 0 }; - static const int cipher_priority[16] = - { GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_RIJNDAEL_128_CBC, - GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_40, 0 + static const int protocol_priority[16] = { + GNUTLS_TLS1, GNUTLS_SSL3, 0 + }; + static const int kx_priority[16] = { + GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, + GNUTLS_KX_RSA_EXPORT, 0 + }; + static const int cipher_priority[16] = { + GNUTLS_CIPHER_RIJNDAEL_256_CBC, GNUTLS_CIPHER_RIJNDAEL_128_CBC, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, + GNUTLS_CIPHER_ARCFOUR_40, 0 }; static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 }; static const int mac_priority[16] = diff --git a/src/serv.c b/src/serv.c index dd94451a81..adbb966296 100644 --- a/src/serv.c +++ b/src/serv.c @@ -1021,7 +1021,7 @@ void serv_version(void) { /* session resuming support */ #define SESSION_ID_SIZE 32 -#define SESSION_DATA_SIZE 512 +#define SESSION_DATA_SIZE 1024 typedef struct { char session_id[SESSION_ID_SIZE];