mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

Implement certificate compression (#95)

Browse source 
Certificate compression is defined in RFC 8879:
https://datatracker.ietf.org/doc/html/rfc8879

This implementation is client-side only, for server certificates.

- Fixes #104.
This commit is contained in:
hwh33 2022-07-19 19:12:30 -06:00 • committed by GitHub
parent 9d36ce3658
commit 7344e34650
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
11 changed files with 276 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

83
u_tls_extensions.go
View file

@ -513,6 +513,51 @@ func (e *UtlsPaddingExtension) Read(b []byte) (int, error) {
return e.Len(), io.EOF
}
// UtlsCompressCertExtension is only implemented client-side, for server certificates. Alternate
// certificate message formats (https://datatracker.ietf.org/doc/html/rfc7250) are not supported.
//
// See https://datatracker.ietf.org/doc/html/rfc8879#section-3
type UtlsCompressCertExtension struct {
Algorithms []CertCompressionAlgo
}
func (e *UtlsCompressCertExtension) writeToUConn(uc *UConn) error {
uc.certCompressionAlgs = e.Algorithms
return nil
}
func (e *UtlsCompressCertExtension) Len() int {
return 4 + 1 + (2 * len(e.Algorithms))
}
func (e *UtlsCompressCertExtension) Read(b []byte) (int, error) {
if len(b) < e.Len() {
return 0, io.ErrShortBuffer
}
b[0] = byte(utlsExtensionCompressCertificate >> 8)
b[1] = byte(utlsExtensionCompressCertificate & 0xff)
extLen := 2 * len(e.Algorithms)
if extLen > 255 {
return 0, errors.New("too many certificate compression methods")
}
// Extension data length.
b[2] = byte((extLen + 1) >> 8)
b[3] = byte((extLen + 1) & 0xff)
// Methods length.
b[4] = byte(extLen)
i := 5
for _, compMethod := range e.Algorithms {
b[i] = byte(compMethod >> 8)
b[i+1] = byte(compMethod)
i += 2
}
return e.Len(), io.EOF
}
// https://github.com/google/boringssl/blob/7d7554b6b3c79e707e25521e61e066ce2b996e4c/ssl/t1_lib.c#L2803
func BoringPaddingStyle(unpaddedLen int) (int, bool) {
if unpaddedLen > 0xff && unpaddedLen < 0x200 {
@ -703,44 +748,6 @@ func (e *FakeChannelIDExtension) Read(b []byte) (int, error) {
return e.Len(), io.EOF
}
type FakeCertCompressionAlgsExtension struct {
Methods []CertCompressionAlgo
}
func (e *FakeCertCompressionAlgsExtension) writeToUConn(uc *UConn) error {
return nil
}
func (e *FakeCertCompressionAlgsExtension) Len() int {
return 4 + 1 + (2 * len(e.Methods))
}
func (e *FakeCertCompressionAlgsExtension) Read(b []byte) (int, error) {
if len(b) < e.Len() {
return 0, io.ErrShortBuffer
}
// https://tools.ietf.org/html/draft-balfanz-tls-channelid-00
b[0] = byte(fakeCertCompressionAlgs >> 8)
b[1] = byte(fakeCertCompressionAlgs & 0xff)
extLen := 2 * len(e.Methods)
if extLen > 255 {
return 0, errors.New("too many certificate compression methods")
}
b[2] = byte((extLen + 1) >> 8)
b[3] = byte((extLen + 1) & 0xff)
b[4] = byte(extLen)
i := 5
for _, compMethod := range e.Methods {
b[i] = byte(compMethod >> 8)
b[i+1] = byte(compMethod)
i += 2
}
return e.Len(), io.EOF
}
type FakeRecordSizeLimitExtension struct {
Limit uint16
}