OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
(...skipping 21 matching lines...) Expand all Loading... |
32 class QuicServerConfigProtobuf; | 32 class QuicServerConfigProtobuf; |
33 class StrikeRegister; | 33 class StrikeRegister; |
34 class StrikeRegisterClient; | 34 class StrikeRegisterClient; |
35 | 35 |
36 struct ClientHelloInfo; | 36 struct ClientHelloInfo; |
37 | 37 |
38 namespace test { | 38 namespace test { |
39 class QuicCryptoServerConfigPeer; | 39 class QuicCryptoServerConfigPeer; |
40 } // namespace test | 40 } // namespace test |
41 | 41 |
| 42 // Hook that allows application code to subscribe to primary config changes. |
| 43 class PrimaryConfigChangedCallback { |
| 44 public: |
| 45 PrimaryConfigChangedCallback(); |
| 46 virtual ~PrimaryConfigChangedCallback(); |
| 47 virtual void Run(const std::string& scid) = 0; |
| 48 }; |
| 49 |
42 // Callback used to accept the result of the |client_hello| validation step. | 50 // Callback used to accept the result of the |client_hello| validation step. |
43 class NET_EXPORT_PRIVATE ValidateClientHelloResultCallback { | 51 class NET_EXPORT_PRIVATE ValidateClientHelloResultCallback { |
44 public: | 52 public: |
45 // Opaque token that holds information about the client_hello and | 53 // Opaque token that holds information about the client_hello and |
46 // its validity. Can be interpreted by calling ProcessClientHello. | 54 // its validity. Can be interpreted by calling ProcessClientHello. |
47 struct Result; | 55 struct Result; |
48 | 56 |
49 ValidateClientHelloResultCallback(); | 57 ValidateClientHelloResultCallback(); |
50 virtual ~ValidateClientHelloResultCallback(); | 58 virtual ~ValidateClientHelloResultCallback(); |
51 void Run(const Result* result); | 59 void Run(const Result* result); |
(...skipping 75 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
127 // SetConfigs takes a vector of config protobufs and the current time. | 135 // SetConfigs takes a vector of config protobufs and the current time. |
128 // Configs are assumed to be uniquely identified by their server config ID. | 136 // Configs are assumed to be uniquely identified by their server config ID. |
129 // Previously unknown configs are added and possibly made the primary config | 137 // Previously unknown configs are added and possibly made the primary config |
130 // depending on their |primary_time| and the value of |now|. Configs that are | 138 // depending on their |primary_time| and the value of |now|. Configs that are |
131 // known, but are missing from the protobufs are deleted, unless they are | 139 // known, but are missing from the protobufs are deleted, unless they are |
132 // currently the primary config. SetConfigs returns false if any errors were | 140 // currently the primary config. SetConfigs returns false if any errors were |
133 // encountered and no changes to the QuicCryptoServerConfig will occur. | 141 // encountered and no changes to the QuicCryptoServerConfig will occur. |
134 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, | 142 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, |
135 QuicWallTime now); | 143 QuicWallTime now); |
136 | 144 |
| 145 // Get the server config ids for all known configs. |
| 146 void GetConfigIds(std::vector<std::string>* scids) const; |
| 147 |
137 // Checks |client_hello| for gross errors and determines whether it | 148 // Checks |client_hello| for gross errors and determines whether it |
138 // can be shown to be fresh (i.e. not a replay). The result of the | 149 // can be shown to be fresh (i.e. not a replay). The result of the |
139 // validation step must be interpreted by calling | 150 // validation step must be interpreted by calling |
140 // QuicCryptoServerConfig::ProcessClientHello from the done_cb. | 151 // QuicCryptoServerConfig::ProcessClientHello from the done_cb. |
141 // | 152 // |
142 // ValidateClientHello may invoke the done_cb before unrolling the | 153 // ValidateClientHello may invoke the done_cb before unrolling the |
143 // stack if it is able to assess the validity of the client_nonce | 154 // stack if it is able to assess the validity of the client_nonce |
144 // without asynchronous operations. | 155 // without asynchronous operations. |
145 // | 156 // |
146 // client_hello: the incoming client hello message. | 157 // client_hello: the incoming client hello message. |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
247 // the client and back. | 258 // the client and back. |
248 void set_server_nonce_strike_register_max_entries(uint32 max_entries); | 259 void set_server_nonce_strike_register_max_entries(uint32 max_entries); |
249 | 260 |
250 // set_server_nonce_strike_register_window_secs sets the number of seconds | 261 // set_server_nonce_strike_register_window_secs sets the number of seconds |
251 // around the current time that the server-nonce strike-register will accept | 262 // around the current time that the server-nonce strike-register will accept |
252 // nonces from. Setting a larger value allows for clients to delay follow-up | 263 // nonces from. Setting a larger value allows for clients to delay follow-up |
253 // client hellos for longer and still use server nonces as proofs of | 264 // client hellos for longer and still use server nonces as proofs of |
254 // uniqueness. | 265 // uniqueness. |
255 void set_server_nonce_strike_register_window_secs(uint32 window_secs); | 266 void set_server_nonce_strike_register_window_secs(uint32 window_secs); |
256 | 267 |
| 268 // Set and take ownership of the callback to invoke on primary config changes. |
| 269 void AcquirePrimaryConfigChangedCb(PrimaryConfigChangedCallback* cb); |
| 270 |
257 private: | 271 private: |
258 friend class test::QuicCryptoServerConfigPeer; | 272 friend class test::QuicCryptoServerConfigPeer; |
259 | 273 |
260 // Config represents a server config: a collection of preferences and | 274 // Config represents a server config: a collection of preferences and |
261 // Diffie-Hellman public values. | 275 // Diffie-Hellman public values. |
262 class NET_EXPORT_PRIVATE Config : public QuicCryptoConfig, | 276 class NET_EXPORT_PRIVATE Config : public QuicCryptoConfig, |
263 public base::RefCounted<Config> { | 277 public base::RefCounted<Config> { |
264 public: | 278 public: |
265 Config(); | 279 Config(); |
266 | 280 |
(...skipping 108 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
375 mutable base::Lock configs_lock_; | 389 mutable base::Lock configs_lock_; |
376 // configs_ contains all active server configs. It's expected that there are | 390 // configs_ contains all active server configs. It's expected that there are |
377 // about half-a-dozen configs active at any one time. | 391 // about half-a-dozen configs active at any one time. |
378 ConfigMap configs_; | 392 ConfigMap configs_; |
379 // primary_config_ points to a Config (which is also in |configs_|) which is | 393 // primary_config_ points to a Config (which is also in |configs_|) which is |
380 // the primary config - i.e. the one that we'll give out to new clients. | 394 // the primary config - i.e. the one that we'll give out to new clients. |
381 mutable scoped_refptr<Config> primary_config_; | 395 mutable scoped_refptr<Config> primary_config_; |
382 // next_config_promotion_time_ contains the nearest, future time when an | 396 // next_config_promotion_time_ contains the nearest, future time when an |
383 // active config will be promoted to primary. | 397 // active config will be promoted to primary. |
384 mutable QuicWallTime next_config_promotion_time_; | 398 mutable QuicWallTime next_config_promotion_time_; |
| 399 // Callback to invoke when the primary config changes. |
| 400 scoped_ptr<PrimaryConfigChangedCallback> primary_config_changed_cb_; |
385 | 401 |
386 // Protects access to the pointer held by strike_register_client_. | 402 // Protects access to the pointer held by strike_register_client_. |
387 mutable base::Lock strike_register_client_lock_; | 403 mutable base::Lock strike_register_client_lock_; |
388 // strike_register_ contains a data structure that keeps track of previously | 404 // strike_register_ contains a data structure that keeps track of previously |
389 // observed client nonces in order to prevent replay attacks. | 405 // observed client nonces in order to prevent replay attacks. |
390 mutable scoped_ptr<StrikeRegisterClient> strike_register_client_; | 406 mutable scoped_ptr<StrikeRegisterClient> strike_register_client_; |
391 | 407 |
392 // source_address_token_boxer_ is used to protect the source-address tokens | 408 // source_address_token_boxer_ is used to protect the source-address tokens |
393 // that are given to clients. | 409 // that are given to clients. |
394 CryptoSecretBoxer source_address_token_boxer_; | 410 CryptoSecretBoxer source_address_token_boxer_; |
(...skipping 28 matching lines...) Expand all Loading... |
423 uint32 strike_register_window_secs_; | 439 uint32 strike_register_window_secs_; |
424 uint32 source_address_token_future_secs_; | 440 uint32 source_address_token_future_secs_; |
425 uint32 source_address_token_lifetime_secs_; | 441 uint32 source_address_token_lifetime_secs_; |
426 uint32 server_nonce_strike_register_max_entries_; | 442 uint32 server_nonce_strike_register_max_entries_; |
427 uint32 server_nonce_strike_register_window_secs_; | 443 uint32 server_nonce_strike_register_window_secs_; |
428 }; | 444 }; |
429 | 445 |
430 } // namespace net | 446 } // namespace net |
431 | 447 |
432 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 448 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
OLD | NEW |