Add GNUTLS_E_RECEIVED_DISALLOWED_NAME for illegal SNI names

An illegal/disallowed SNI server name previously generated
the misleading message "An illegal parameter has been received.".

This commit changes it to
  "A disallowed SNI server name has been received.".

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

diff --git a/lib/alert.c b/lib/alert.c
index 15f518343040021e1eeb2cdbcf597ca34d0f67ce..a2d1725e6bb60a7b488bc137967a0b1f7b6d1561 100644 (file)
--- a/lib/alert.c
+++ b/lib/alert.c
@@ -224,6 +224,7 @@ int gnutls_error_to_alert(int err, int *level)
        case GNUTLS_E_ILLEGAL_SRP_USERNAME:
        case GNUTLS_E_PK_INVALID_PUBKEY:
        case GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM:
+       case GNUTLS_E_RECEIVED_DISALLOWED_NAME:
                ret = GNUTLS_A_ILLEGAL_PARAMETER;
                _level = GNUTLS_AL_FATAL;
                break;

diff --git a/lib/errors.c b/lib/errors.c
index a1bdf9b873b16c51b77cc707eecded015bcd85e9..520958b70c2cef4e2a1623514c6df194541c39c1 100644 (file)
--- a/lib/errors.c
+++ b/lib/errors.c
@@ -206,6 +206,8 @@ static const gnutls_error_entry error_entries[] = {
        ERROR_ENTRY(N_("An illegal parameter was found."),
                    GNUTLS_E_ILLEGAL_PARAMETER),
        ERROR_ENTRY(N_("Error while reading file."), GNUTLS_E_FILE_ERROR),
+       ERROR_ENTRY(N_("A disallowed SNI server name has been received."),
+                   GNUTLS_E_RECEIVED_DISALLOWED_NAME),
 
        ERROR_ENTRY(N_("ASN1 parser: Element was not found."),
                    GNUTLS_E_ASN1_ELEMENT_NOT_FOUND),
@@ -462,14 +464,14 @@ static const gnutls_error_entry non_fatal_error_entries[] = {
  *
  * If a GnuTLS function returns a negative error code you may feed that
  * value to this function to see if the error condition is fatal to
- * a TLS session (i.e., must be terminated). 
+ * a TLS session (i.e., must be terminated).
  *
  * Note that you may also want to check the error code manually, since some
  * non-fatal errors to the protocol (such as a warning alert or
  * a rehandshake request) may be fatal for your program.
  *
  * This function is only useful if you are dealing with errors from
- * functions that relate to a TLS session (e.g., record layer or handshake 
+ * functions that relate to a TLS session (e.g., record layer or handshake
  * layer handling functions).
  *
  * Returns: Non-zero value on fatal errors or zero on non-fatal.

diff --git a/lib/ext/server_name.c b/lib/ext/server_name.c
index 1f9f3814f1bdb8f63133484e2953bdfd1c1ce35e..9c8c5334905e30bfa7810dba8b3d48f0b544186c 100644 (file)
--- a/lib/ext/server_name.c
+++ b/lib/ext/server_name.c
@@ -105,8 +105,12 @@ _gnutls_server_name_recv_params(gnutls_session_t session,
                        DECR_LEN(data_size, len);
 
                        if (type == 0) { /* NAME_DNS */
-                               if (!_gnutls_dnsname_is_valid((char*)p, len))
-                                       return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
+                               if (!_gnutls_dnsname_is_valid((char*)p, len)) {
+                                       _gnutls_handshake_log
+                                           ("HSK[%p]: Server name is not acceptable: '%.*s'\n",
+                                            session, (int) len, p);
+                                       return gnutls_assert_val(GNUTLS_E_RECEIVED_DISALLOWED_NAME);
+                               }
 
                                name.data = (void*)p;
                                name.size = len;

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 7e6a592447924d39880fd78fd88917f520cda4bb..8359fe2ea57f208bce9caeff84dcd11f3d7795b9 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -3141,6 +3141,7 @@ void gnutls_fips140_set_mode(gnutls_fips_mode_t mode, unsigned flags);
 #define GNUTLS_E_TOO_MANY_EMPTY_PACKETS -78
 #define GNUTLS_E_UNKNOWN_PK_ALGORITHM -80
 #define GNUTLS_E_TOO_MANY_HANDSHAKE_PACKETS -81
+#define GNUTLS_E_RECEIVED_DISALLOWED_NAME -82 /* GNUTLS_A_ILLEGAL_PARAMETER */
 
   /* returned if you need to generate temporary RSA
    * parameters. These are needed for export cipher suites.

diff --git a/tests/cert_verify_inv_utf8.c b/tests/cert_verify_inv_utf8.c
index 4afd52311d8c64434f194883cab0bad5d972dde2..095a55f3df7254bb663cd96ff9e1ce8ed55e6bcb 100644 (file)
--- a/tests/cert_verify_inv_utf8.c
+++ b/tests/cert_verify_inv_utf8.c
@@ -137,7 +137,7 @@ static void auto_parse(void)
        test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "localhost", 0, 0);
        test_cli_serv_vf(x509_cred, clicred, "NORMAL", "www.νίκοσ.com");
        test_cli_serv_vf(x509_cred, clicred, "NORMAL", "www.νίκος.com");
-       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:www.νίκος.com", GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER, GNUTLS_E_AGAIN);
+       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:www.νίκος.com", GNUTLS_E_RECEIVED_DISALLOWED_NAME, GNUTLS_E_AGAIN);
 
        gnutls_certificate_free_credentials(x509_cred);
        gnutls_certificate_free_credentials(clicred);

diff --git a/tests/mini-server-name.c b/tests/mini-server-name.c
index 0da27cc3e19b267facf2dddd1730194af05bea0f..e18dcfc1500ed7475c85f425a9614eaef1ae4407 100644 (file)
--- a/tests/mini-server-name.c
+++ b/tests/mini-server-name.c
@@ -310,21 +310,21 @@ void doit(void)
        start("tls1.2 test.example.com", PRIO_TLS12, 0, "test.example.com", strlen("test.example.com"), "test.example.com", strlen("test.example.com"), 0);
        start("tls1.2 longtest.example.com", PRIO_TLS12, 0, "longtest.example.com.", strlen("longtest.example.com"), "longtest.example.com.", strlen("longtest.example.com"), 0);
        /* test embedded NULL */
-       start("tls1.2 embedded-NULL", PRIO_TLS12, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
+       start("tls1.2 embedded-NULL", PRIO_TLS12, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_DISALLOWED_NAME);
 
        start("tls1.3 NULL", PRIO_TLS13, 0, NULL, 0, NULL, 0, 0);
        start("tls1.3 empty", PRIO_TLS13, 0, "", 0, "", 0, 0);
        start("tls1.3 test.example.com", PRIO_TLS13, 0, "test.example.com", strlen("test.example.com"), "test.example.com", strlen("test.example.com"), 0);
        start("tls1.3 longtest.example.com", PRIO_TLS13, 0, "longtest.example.com.", strlen("longtest.example.com"), "longtest.example.com.", strlen("longtest.example.com"), 0);
        /* test embedded NULL */
-       start("tls1.3 embedded-NULL", PRIO_TLS13, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
+       start("tls1.3 embedded-NULL", PRIO_TLS13, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_DISALLOWED_NAME);
 
        start("NULL", PRIO_NORMAL, 0, NULL, 0, NULL, 0, 0);
        start("empty", PRIO_NORMAL, 0, "", 0, "", 0, 0);
        start("test.example.com", PRIO_NORMAL, 0, "test.example.com", strlen("test.example.com"), "test.example.com", strlen("test.example.com"), 0);
        start("longtest.example.com", PRIO_NORMAL, 0, "longtest.example.com.", strlen("longtest.example.com"), "longtest.example.com.", strlen("longtest.example.com"), 0);
        /* test embedded NULL */
-       start("embedded-NULL", PRIO_NORMAL, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
+       start("embedded-NULL", PRIO_NORMAL, 1, "invalid\x00.example.com.", sizeof("invalid\x00.example.com")-1, NULL, 0, GNUTLS_E_RECEIVED_DISALLOWED_NAME);
 }
 
 #endif                         /* _WIN32 */

diff --git a/tests/set_key_utf8.c b/tests/set_key_utf8.c
index 7a02e45618d3a106b7d65dc637a0938225195818..81d5ef2c05bfd9019bc44579e40c5f1672acd0cb 100644 (file)
--- a/tests/set_key_utf8.c
+++ b/tests/set_key_utf8.c
@@ -140,7 +140,7 @@ static void auto_parse(void)
 
        /* the raw DNS should result to verification failure as the advertized name should
         * not be considered and the first cert should be provided */
-       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:简体中文.εξτρα.com", GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER, GNUTLS_E_AGAIN);
+       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:简体中文.εξτρα.com", GNUTLS_E_RECEIVED_DISALLOWED_NAME, GNUTLS_E_AGAIN);
 
        gnutls_certificate_free_credentials(x509_cred);
        gnutls_certificate_free_credentials(clicred);

diff --git a/tests/set_x509_key_utf8.c b/tests/set_x509_key_utf8.c
index 7cc5b99ea849f02baedf8ce073cc3ac8243c3956..7753c7f4c917398d1ca17542bd81fdf3f31048bc 100644 (file)
--- a/tests/set_x509_key_utf8.c
+++ b/tests/set_x509_key_utf8.c
@@ -177,7 +177,7 @@ void doit(void)
        test_cli_serv(x509_cred, clicred, "NORMAL", "简体中文.εξτρα.com", NULL, NULL, NULL); /* the second DNS name of cert */
        test_cli_serv(x509_cred, clicred, "NORMAL", "xn--fiqu1az03c18t.xn--mxah1amo.com", NULL, NULL, NULL); /* its IDNA equivalent */
 
-       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:简体中文.εξτρα.com", GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER, GNUTLS_E_AGAIN);
+       test_cli_serv_expect(x509_cred, clicred, "NORMAL", "NORMAL", "raw:简体中文.εξτρα.com", GNUTLS_E_RECEIVED_DISALLOWED_NAME, GNUTLS_E_AGAIN);
 
        gnutls_certificate_free_credentials(x509_cred);
        gnutls_certificate_free_credentials(clicred);