| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| 11 | 11 |
| 12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
| 13 #include "base/strings/string_piece.h" | 13 #include "base/strings/string_piece.h" |
| 14 #include "net/base/net_export.h" | 14 #include "net/base/net_export.h" |
| 15 #include "net/quic/crypto/crypto_handshake.h" | 15 #include "net/quic/crypto/crypto_handshake.h" |
| 16 #include "net/quic/quic_protocol.h" | 16 #include "net/quic/quic_protocol.h" |
| 17 | 17 |
| 18 namespace net { | 18 namespace net { |
| 19 | 19 |
| 20 class ChannelIDSigner; | 20 class ChannelIDSigner; |
| 21 class CryptoHandshakeMessage; | 21 class CryptoHandshakeMessage; |
| 22 class ProofVerifier; | 22 class ProofVerifier; |
| 23 class ProofVerifyDetails; | 23 class ProofVerifyDetails; |
| 24 class QuicRandom; | 24 class QuicRandom; |
| 25 class QuicServerInfo; | |
| 26 class QuicServerInfoFactory; | |
| 27 | 25 |
| 28 // QuicCryptoClientConfig contains crypto-related configuration settings for a | 26 // QuicCryptoClientConfig contains crypto-related configuration settings for a |
| 29 // client. Note that this object isn't thread-safe. It's designed to be used on | 27 // client. Note that this object isn't thread-safe. It's designed to be used on |
| 30 // a single thread at a time. | 28 // a single thread at a time. |
| 31 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { | 29 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { |
| 32 public: | 30 public: |
| 33 // A CachedState contains the information that the client needs in order to | 31 // A CachedState contains the information that the client needs in order to |
| 34 // perform a 0-RTT handshake with a server. This information can be reused | 32 // perform a 0-RTT handshake with a server. This information can be reused |
| 35 // over several connections to the same server. | 33 // over several connections to the same server. |
| 36 class NET_EXPORT_PRIVATE CachedState { | 34 class NET_EXPORT_PRIVATE CachedState { |
| 37 public: | 35 public: |
| 38 CachedState(); | 36 CachedState(); |
| 39 explicit CachedState(scoped_ptr<QuicServerInfo> quic_server_info); | |
| 40 ~CachedState(); | 37 ~CachedState(); |
| 41 | 38 |
| 42 // IsComplete returns true if this object contains enough information to | 39 // IsComplete returns true if this object contains enough information to |
| 43 // perform a handshake with the server. |now| is used to judge whether any | 40 // perform a handshake with the server. |now| is used to judge whether any |
| 44 // cached server config has expired. | 41 // cached server config has expired. |
| 45 bool IsComplete(QuicWallTime now) const; | 42 bool IsComplete(QuicWallTime now) const; |
| 46 | 43 |
| 47 // IsEmpty returns true if |server_config_| is empty. | 44 // IsEmpty returns true if |server_config_| is empty. |
| 48 bool IsEmpty() const; | 45 bool IsEmpty() const; |
| 49 | 46 |
| (...skipping 13 matching lines...) Expand all Loading... |
| 63 void InvalidateServerConfig(); | 60 void InvalidateServerConfig(); |
| 64 | 61 |
| 65 // SetProof stores a certificate chain and signature. | 62 // SetProof stores a certificate chain and signature. |
| 66 void SetProof(const std::vector<std::string>& certs, | 63 void SetProof(const std::vector<std::string>& certs, |
| 67 base::StringPiece signature); | 64 base::StringPiece signature); |
| 68 | 65 |
| 69 // Clears the certificate chain and signature and invalidates the proof. | 66 // Clears the certificate chain and signature and invalidates the proof. |
| 70 void ClearProof(); | 67 void ClearProof(); |
| 71 | 68 |
| 72 // SetProofValid records that the certificate chain and signature have been | 69 // SetProofValid records that the certificate chain and signature have been |
| 73 // validated and that it's safe to assume that the server is legitimate. It | 70 // validated and that it's safe to assume that the server is legitimate. |
| 74 // persists the server config information to disk cache. | |
| 75 // (Note: this does not check the chain or signature.) | 71 // (Note: this does not check the chain or signature.) |
| 76 void SetProofValid(); | 72 void SetProofValid(); |
| 77 | 73 |
| 78 // If the server config or the proof has changed then it needs to be | 74 // If the server config or the proof has changed then it needs to be |
| 79 // revalidated. Helper function to keep server_config_valid_ and | 75 // revalidated. Helper function to keep server_config_valid_ and |
| 80 // generation_counter_ in sync. | 76 // generation_counter_ in sync. |
| 81 void SetProofInvalid(); | 77 void SetProofInvalid(); |
| 82 | 78 |
| 79 bool Initialize(base::StringPiece server_config, |
| 80 base::StringPiece signature, |
| 81 base::StringPiece source_address_token, |
| 82 const std::vector<std::string>& certs, |
| 83 QuicWallTime now); |
| 84 |
| 83 const std::string& server_config() const; | 85 const std::string& server_config() const; |
| 84 const std::string& source_address_token() const; | 86 const std::string& source_address_token() const; |
| 85 const std::vector<std::string>& certs() const; | 87 const std::vector<std::string>& certs() const; |
| 86 const std::string& signature() const; | 88 const std::string& signature() const; |
| 87 bool proof_valid() const; | 89 bool proof_valid() const; |
| 88 uint64 generation_counter() const; | 90 uint64 generation_counter() const; |
| 89 const ProofVerifyDetails* proof_verify_details() const; | 91 const ProofVerifyDetails* proof_verify_details() const; |
| 90 QuicServerInfo* quic_server_info() const; | |
| 91 | 92 |
| 92 void set_source_address_token(base::StringPiece token); | 93 void set_source_address_token(base::StringPiece token); |
| 93 | 94 |
| 94 // SetProofVerifyDetails takes ownership of |details|. | 95 // SetProofVerifyDetails takes ownership of |details|. |
| 95 void SetProofVerifyDetails(ProofVerifyDetails* details); | 96 void SetProofVerifyDetails(ProofVerifyDetails* details); |
| 96 | 97 |
| 97 // Copy the |server_config_|, |source_address_token_|, |certs_| and | 98 // Copy the |server_config_|, |source_address_token_|, |certs_| and |
| 98 // |server_config_sig_| from the |other|. The remaining fields, | 99 // |server_config_sig_| from the |other|. The remaining fields, |
| 99 // |generation_counter_|, |proof_verify_details_|, and |scfg_| remain | 100 // |generation_counter_|, |proof_verify_details_|, and |scfg_| remain |
| 100 // unchanged. | 101 // unchanged. |
| 101 void InitializeFrom(const CachedState& other); | 102 void InitializeFrom(const CachedState& other); |
| 102 | 103 |
| 103 // Fill out the |server_config_|, |source_address_token_|, |certs_| and | |
| 104 // |server_config_sig_| fields from |quic_server_info_|. |quic_server_info_| | |
| 105 // reads this information from the disk cache. |now| is used to judge | |
| 106 // whether server config from disk cache has expired. Returns true if it has | |
| 107 // loaded the data from disk cache successfully. | |
| 108 bool LoadQuicServerInfo(QuicWallTime now); | |
| 109 | |
| 110 // Save the server config information so that we can perform 0-RTT handshake | |
| 111 // with a server. | |
| 112 void SaveQuicServerInfo(); | |
| 113 | |
| 114 private: | 104 private: |
| 115 std::string server_config_; // A serialized handshake message. | 105 std::string server_config_; // A serialized handshake message. |
| 116 std::string source_address_token_; // An opaque proof of IP ownership. | 106 std::string source_address_token_; // An opaque proof of IP ownership. |
| 117 std::vector<std::string> certs_; // A list of certificates in leaf-first | 107 std::vector<std::string> certs_; // A list of certificates in leaf-first |
| 118 // order. | 108 // order. |
| 119 std::string server_config_sig_; // A signature of |server_config_|. | 109 std::string server_config_sig_; // A signature of |server_config_|. |
| 120 bool server_config_valid_; // True if |server_config_| is correctly | 110 bool server_config_valid_; // True if |server_config_| is correctly |
| 121 // signed and |certs_| has been | 111 // signed and |certs_| has been |
| 122 // validated. | 112 // validated. |
| 123 bool need_to_persist_; // Persist to disk if True. | |
| 124 // Generation counter associated with the |server_config_|, |certs_| and | 113 // Generation counter associated with the |server_config_|, |certs_| and |
| 125 // |server_config_sig_| combination. It is incremented whenever we set | 114 // |server_config_sig_| combination. It is incremented whenever we set |
| 126 // server_config_valid_ to false. | 115 // server_config_valid_ to false. |
| 127 uint64 generation_counter_; | 116 uint64 generation_counter_; |
| 128 | 117 |
| 129 scoped_ptr<ProofVerifyDetails> proof_verify_details_; | 118 scoped_ptr<ProofVerifyDetails> proof_verify_details_; |
| 130 | 119 |
| 131 // scfg contains the cached, parsed value of |server_config|. | 120 // scfg contains the cached, parsed value of |server_config|. |
| 132 mutable scoped_ptr<CryptoHandshakeMessage> scfg_; | 121 mutable scoped_ptr<CryptoHandshakeMessage> scfg_; |
| 133 | 122 |
| 134 // |quic_server_info_| is used to fetch crypto config information from disk. | |
| 135 scoped_ptr<QuicServerInfo> quic_server_info_; | |
| 136 | |
| 137 DISALLOW_COPY_AND_ASSIGN(CachedState); | 123 DISALLOW_COPY_AND_ASSIGN(CachedState); |
| 138 }; | 124 }; |
| 139 | 125 |
| 140 QuicCryptoClientConfig(); | 126 QuicCryptoClientConfig(); |
| 141 ~QuicCryptoClientConfig(); | 127 ~QuicCryptoClientConfig(); |
| 142 | 128 |
| 143 // Sets the members to reasonable, default values. | 129 // Sets the members to reasonable, default values. |
| 144 void SetDefaults(); | 130 void SetDefaults(); |
| 145 | 131 |
| 146 // Create returns a CachedState for the given hostname. It creates a | |
| 147 // CachedState and caches it. If |quic_server_info_factory| is not NULL, then | |
| 148 // it is used to create QuicServerInfo which is used to fetch crypto config | |
| 149 // information from disk for the given hostname. | |
| 150 CachedState* Create(const std::string& server_hostname, | |
| 151 QuicServerInfoFactory* quic_server_info_factory); | |
| 152 | |
| 153 // LookupOrCreate returns a CachedState for the given hostname. If no such | 132 // LookupOrCreate returns a CachedState for the given hostname. If no such |
| 154 // CachedState currently exists, it will be created and cached. | 133 // CachedState currently exists, it will be created and cached. |
| 155 // TODO(rtenneti): fix the server code and pass QuicServerInfoFactory as | |
| 156 // argument. | |
| 157 CachedState* LookupOrCreate(const std::string& server_hostname); | 134 CachedState* LookupOrCreate(const std::string& server_hostname); |
| 158 | 135 |
| 159 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a | 136 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a |
| 160 // source-address token or SCFG from a server. If |cached| is non-NULL, the | 137 // source-address token or SCFG from a server. If |cached| is non-NULL, the |
| 161 // source-address token will be taken from it. |out_params| is used in order | 138 // source-address token will be taken from it. |out_params| is used in order |
| 162 // to store the cached certs that were sent as hints to the server in | 139 // to store the cached certs that were sent as hints to the server in |
| 163 // |out_params->cached_certs|. |preferred_version| is the version of the | 140 // |out_params->cached_certs|. |preferred_version| is the version of the |
| 164 // QUIC protocol that this client chose to use initially. This allows the | 141 // QUIC protocol that this client chose to use initially. This allows the |
| 165 // server to detect downgrade attacks. | 142 // server to detect downgrade attacks. |
| 166 void FillInchoateClientHello(const std::string& server_hostname, | 143 void FillInchoateClientHello(const std::string& server_hostname, |
| (...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 246 | 223 |
| 247 scoped_ptr<ProofVerifier> proof_verifier_; | 224 scoped_ptr<ProofVerifier> proof_verifier_; |
| 248 scoped_ptr<ChannelIDSigner> channel_id_signer_; | 225 scoped_ptr<ChannelIDSigner> channel_id_signer_; |
| 249 | 226 |
| 250 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); | 227 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); |
| 251 }; | 228 }; |
| 252 | 229 |
| 253 } // namespace net | 230 } // namespace net |
| 254 | 231 |
| 255 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 232 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| OLD | NEW |