QUIC: obtain source address token keys from internal key server.

net/quic/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 
@@ skipping 207 matching lines @@
       proof_source_(proof_source),
       strike_register_no_startup_period_(false),
       strike_register_max_entries_(1 << 10),
       strike_register_window_secs_(600),
       source_address_token_future_secs_(3600),
       source_address_token_lifetime_secs_(86400),
       server_nonce_strike_register_max_entries_(1 << 10),
       server_nonce_strike_register_window_secs_(120),
       enable_serving_sct_(false) {
   DCHECK(proof_source_.get());
-  default_source_address_token_boxer_.SetKey(
-      DeriveSourceAddressTokenKey(source_address_token_secret));
+  default_source_address_token_boxer_.SetKeys(
+      {DeriveSourceAddressTokenKey(source_address_token_secret)});
 
   // Generate a random key and orbit for server nonces.
   server_nonce_entropy->RandBytes(server_nonce_orbit_,
                                   sizeof(server_nonce_orbit_));
   const size_t key_size = server_nonce_boxer_.GetKeySize();
   scoped_ptr<uint8_t[]> key_bytes(new uint8_t[key_size]);
   server_nonce_entropy->RandBytes(key_bytes.get(), key_size);
 
-  server_nonce_boxer_.SetKey(
-      StringPiece(reinterpret_cast<char*>(key_bytes.get()), key_size));
+  server_nonce_boxer_.SetKeys(
+      {string(reinterpret_cast<char*>(key_bytes.get()), key_size)});
 }
 
 QuicCryptoServerConfig::~QuicCryptoServerConfig() {
   primary_config_ = nullptr;
 }
 
 // static
 QuicServerConfigProtobuf* QuicCryptoServerConfig::GenerateConfig(
     QuicRandom* rand,
     const QuicClock* clock,
@@ skipping 223 matching lines @@
 
     configs_.swap(new_configs);
     SelectNewPrimaryConfig(now);
     DCHECK(primary_config_.get());
     DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_);
   }
 
   return ok;
 }
 
+void QuicCryptoServerConfig::SetDefaultSourceAddressTokenKeys(
+    const vector<string>& keys) {
+  default_source_address_token_boxer_.SetKeys(keys);
+}
+
 void QuicCryptoServerConfig::GetConfigIds(vector<string>* scids) const {
   base::AutoLock locked(configs_lock_);
   for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end();
        ++it) {
     scids->push_back(it->first);
   }
 }
 
 void QuicCryptoServerConfig::ValidateClientHello(
     const CryptoHandshakeMessage& client_hello,
@@ skipping 835 matching lines @@
 
   scoped_refptr<Config> config(new Config);
   config->serialized = protobuf->config();
 
   if (!protobuf->has_source_address_token_secret_override()) {
     // Use the default boxer.
     config->source_address_token_boxer = &default_source_address_token_boxer_;
   } else {
     // Create override boxer instance.
     CryptoSecretBoxer* boxer = new CryptoSecretBoxer;
-    boxer->SetKey(DeriveSourceAddressTokenKey(
-        protobuf->source_address_token_secret_override()));
+    boxer->SetKeys({DeriveSourceAddressTokenKey(
+        protobuf->source_address_token_secret_override())});
     config->source_address_token_boxer_storage.reset(boxer);
     config->source_address_token_boxer = boxer;
   }
 
   if (protobuf->has_primary_time()) {
     config->primary_time =
         QuicWallTime::FromUNIXSeconds(protobuf->primary_time());
   }
 
   config->priority = protobuf->priority();
@@ skipping 465 matching lines @@
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {
   STLDeleteElements(&key_exchanges);
 }
 
 QuicCryptoProof::QuicCryptoProof() {}
 QuicCryptoProof::~QuicCryptoProof() {}
 }  // namespace net