OLD | NEW |
---|---|
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
13 #include "base/strings/string_piece.h" | 13 #include "base/strings/string_piece.h" |
14 #include "net/base/net_export.h" | 14 #include "net/base/net_export.h" |
15 #include "net/quic/crypto/crypto_handshake.h" | 15 #include "net/quic/crypto/crypto_handshake.h" |
16 #include "net/quic/quic_protocol.h" | 16 #include "net/quic/quic_protocol.h" |
17 | 17 |
18 namespace net { | 18 namespace net { |
19 | 19 |
20 class ChannelIDSigner; | 20 class ChannelIDSigner; |
21 class CryptoHandshakeMessage; | 21 class CryptoHandshakeMessage; |
22 class ProofVerifier; | 22 class ProofVerifier; |
23 class ProofVerifyDetails; | 23 class ProofVerifyDetails; |
24 class QuicRandom; | 24 class QuicRandom; |
25 class QuicServerInfo; | |
26 class QuicServerInfoFactory; | |
27 | 25 |
28 // QuicCryptoClientConfig contains crypto-related configuration settings for a | 26 // QuicCryptoClientConfig contains crypto-related configuration settings for a |
29 // client. Note that this object isn't thread-safe. It's designed to be used on | 27 // client. Note that this object isn't thread-safe. It's designed to be used on |
30 // a single thread at a time. | 28 // a single thread at a time. |
31 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { | 29 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { |
32 public: | 30 public: |
33 // A CachedState contains the information that the client needs in order to | 31 // A CachedState contains the information that the client needs in order to |
34 // perform a 0-RTT handshake with a server. This information can be reused | 32 // perform a 0-RTT handshake with a server. This information can be reused |
35 // over several connections to the same server. | 33 // over several connections to the same server. |
36 class NET_EXPORT_PRIVATE CachedState { | 34 class NET_EXPORT_PRIVATE CachedState { |
37 public: | 35 public: |
38 CachedState(); | 36 CachedState(); |
39 explicit CachedState(scoped_ptr<QuicServerInfo> quic_server_info); | |
40 ~CachedState(); | 37 ~CachedState(); |
41 | 38 |
42 // IsComplete returns true if this object contains enough information to | 39 // IsComplete returns true if this object contains enough information to |
43 // perform a handshake with the server. |now| is used to judge whether any | 40 // perform a handshake with the server. |now| is used to judge whether any |
44 // cached server config has expired. | 41 // cached server config has expired. |
45 bool IsComplete(QuicWallTime now) const; | 42 bool IsComplete(QuicWallTime now) const; |
46 | 43 |
47 // IsEmpty returns true if |server_config_| is empty. | 44 // IsEmpty returns true if |server_config_| is empty. |
48 bool IsEmpty() const; | 45 bool IsEmpty() const; |
49 | 46 |
(...skipping 13 matching lines...) Expand all Loading... | |
63 void InvalidateServerConfig(); | 60 void InvalidateServerConfig(); |
64 | 61 |
65 // SetProof stores a certificate chain and signature. | 62 // SetProof stores a certificate chain and signature. |
66 void SetProof(const std::vector<std::string>& certs, | 63 void SetProof(const std::vector<std::string>& certs, |
67 base::StringPiece signature); | 64 base::StringPiece signature); |
68 | 65 |
69 // Clears the certificate chain and signature and invalidates the proof. | 66 // Clears the certificate chain and signature and invalidates the proof. |
70 void ClearProof(); | 67 void ClearProof(); |
71 | 68 |
72 // SetProofValid records that the certificate chain and signature have been | 69 // SetProofValid records that the certificate chain and signature have been |
73 // validated and that it's safe to assume that the server is legitimate. It | 70 // validated and that it's safe to assume that the server is legitimate. |
74 // persists the server config information to disk cache. | |
75 // (Note: this does not check the chain or signature.) | 71 // (Note: this does not check the chain or signature.) |
76 void SetProofValid(); | 72 void SetProofValid(); |
77 | 73 |
78 // If the server config or the proof has changed then it needs to be | 74 // If the server config or the proof has changed then it needs to be |
79 // revalidated. Helper function to keep server_config_valid_ and | 75 // revalidated. Helper function to keep server_config_valid_ and |
80 // generation_counter_ in sync. | 76 // generation_counter_ in sync. |
81 void SetProofInvalid(); | 77 void SetProofInvalid(); |
82 | 78 |
79 bool Initialize(base::StringPiece server_config, | |
wtc
2014/03/12 23:13:20
Nit: if the Initialize method is similar to Initia
Ryan Hamilton
2014/03/13 16:38:07
Done.
| |
80 base::StringPiece signature, | |
81 base::StringPiece source_address_token, | |
82 const std::vector<std::string>& certs, | |
wtc
2014/03/12 23:13:20
I suggest listing the first four arguments in the
Ryan Hamilton
2014/03/13 16:38:07
Done. However, the certs class member is actually
| |
83 QuicWallTime now); | |
84 | |
83 const std::string& server_config() const; | 85 const std::string& server_config() const; |
84 const std::string& source_address_token() const; | 86 const std::string& source_address_token() const; |
85 const std::vector<std::string>& certs() const; | 87 const std::vector<std::string>& certs() const; |
86 const std::string& signature() const; | 88 const std::string& signature() const; |
87 bool proof_valid() const; | 89 bool proof_valid() const; |
88 uint64 generation_counter() const; | 90 uint64 generation_counter() const; |
89 const ProofVerifyDetails* proof_verify_details() const; | 91 const ProofVerifyDetails* proof_verify_details() const; |
90 QuicServerInfo* quic_server_info() const; | |
91 | 92 |
92 void set_source_address_token(base::StringPiece token); | 93 void set_source_address_token(base::StringPiece token); |
93 | 94 |
94 // SetProofVerifyDetails takes ownership of |details|. | 95 // SetProofVerifyDetails takes ownership of |details|. |
95 void SetProofVerifyDetails(ProofVerifyDetails* details); | 96 void SetProofVerifyDetails(ProofVerifyDetails* details); |
96 | 97 |
97 // Copy the |server_config_|, |source_address_token_|, |certs_| and | 98 // Copy the |server_config_|, |source_address_token_|, |certs_| and |
98 // |server_config_sig_| from the |other|. The remaining fields, | 99 // |server_config_sig_| from the |other|. The remaining fields, |
99 // |generation_counter_|, |proof_verify_details_|, and |scfg_| remain | 100 // |generation_counter_|, |proof_verify_details_|, and |scfg_| remain |
100 // unchanged. | 101 // unchanged. |
101 void InitializeFrom(const CachedState& other); | 102 void InitializeFrom(const CachedState& other); |
102 | 103 |
103 // Fill out the |server_config_|, |source_address_token_|, |certs_| and | |
104 // |server_config_sig_| fields from |quic_server_info_|. |quic_server_info_| | |
105 // reads this information from the disk cache. |now| is used to judge | |
106 // whether server config from disk cache has expired. Returns true if it has | |
107 // loaded the data from disk cache successfully. | |
108 bool LoadQuicServerInfo(QuicWallTime now); | |
109 | |
110 // Save the server config information so that we can perform 0-RTT handshake | |
111 // with a server. | |
112 void SaveQuicServerInfo(); | |
113 | |
114 private: | 104 private: |
115 std::string server_config_; // A serialized handshake message. | 105 std::string server_config_; // A serialized handshake message. |
116 std::string source_address_token_; // An opaque proof of IP ownership. | 106 std::string source_address_token_; // An opaque proof of IP ownership. |
117 std::vector<std::string> certs_; // A list of certificates in leaf-first | 107 std::vector<std::string> certs_; // A list of certificates in leaf-first |
118 // order. | 108 // order. |
119 std::string server_config_sig_; // A signature of |server_config_|. | 109 std::string server_config_sig_; // A signature of |server_config_|. |
120 bool server_config_valid_; // True if |server_config_| is correctly | 110 bool server_config_valid_; // True if |server_config_| is correctly |
121 // signed and |certs_| has been | 111 // signed and |certs_| has been |
122 // validated. | 112 // validated. |
123 bool need_to_persist_; // Persist to disk if True. | |
124 // Generation counter associated with the |server_config_|, |certs_| and | 113 // Generation counter associated with the |server_config_|, |certs_| and |
125 // |server_config_sig_| combination. It is incremented whenever we set | 114 // |server_config_sig_| combination. It is incremented whenever we set |
126 // server_config_valid_ to false. | 115 // server_config_valid_ to false. |
127 uint64 generation_counter_; | 116 uint64 generation_counter_; |
128 | 117 |
129 scoped_ptr<ProofVerifyDetails> proof_verify_details_; | 118 scoped_ptr<ProofVerifyDetails> proof_verify_details_; |
130 | 119 |
131 // scfg contains the cached, parsed value of |server_config|. | 120 // scfg contains the cached, parsed value of |server_config|. |
132 mutable scoped_ptr<CryptoHandshakeMessage> scfg_; | 121 mutable scoped_ptr<CryptoHandshakeMessage> scfg_; |
133 | 122 |
134 // |quic_server_info_| is used to fetch crypto config information from disk. | |
135 scoped_ptr<QuicServerInfo> quic_server_info_; | |
136 | |
137 DISALLOW_COPY_AND_ASSIGN(CachedState); | 123 DISALLOW_COPY_AND_ASSIGN(CachedState); |
138 }; | 124 }; |
139 | 125 |
140 QuicCryptoClientConfig(); | 126 QuicCryptoClientConfig(); |
141 ~QuicCryptoClientConfig(); | 127 ~QuicCryptoClientConfig(); |
142 | 128 |
143 // Sets the members to reasonable, default values. | 129 // Sets the members to reasonable, default values. |
144 void SetDefaults(); | 130 void SetDefaults(); |
145 | 131 |
146 // Create returns a CachedState for the given hostname. It creates a | |
147 // CachedState and caches it. If |quic_server_info_factory| is not NULL, then | |
148 // it is used to create QuicServerInfo which is used to fetch crypto config | |
149 // information from disk for the given hostname. | |
150 CachedState* Create(const std::string& server_hostname, | |
151 QuicServerInfoFactory* quic_server_info_factory); | |
152 | |
153 // LookupOrCreate returns a CachedState for the given hostname. If no such | 132 // LookupOrCreate returns a CachedState for the given hostname. If no such |
154 // CachedState currently exists, it will be created and cached. | 133 // CachedState currently exists, it will be created and cached. |
155 // TODO(rtenneti): fix the server code and pass QuicServerInfoFactory as | |
156 // argument. | |
157 CachedState* LookupOrCreate(const std::string& server_hostname); | 134 CachedState* LookupOrCreate(const std::string& server_hostname); |
158 | 135 |
159 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a | 136 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a |
160 // source-address token or SCFG from a server. If |cached| is non-NULL, the | 137 // source-address token or SCFG from a server. If |cached| is non-NULL, the |
161 // source-address token will be taken from it. |out_params| is used in order | 138 // source-address token will be taken from it. |out_params| is used in order |
162 // to store the cached certs that were sent as hints to the server in | 139 // to store the cached certs that were sent as hints to the server in |
163 // |out_params->cached_certs|. |preferred_version| is the version of the | 140 // |out_params->cached_certs|. |preferred_version| is the version of the |
164 // QUIC protocol that this client chose to use initially. This allows the | 141 // QUIC protocol that this client chose to use initially. This allows the |
165 // server to detect downgrade attacks. | 142 // server to detect downgrade attacks. |
166 void FillInchoateClientHello(const std::string& server_hostname, | 143 void FillInchoateClientHello(const std::string& server_hostname, |
(...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
246 | 223 |
247 scoped_ptr<ProofVerifier> proof_verifier_; | 224 scoped_ptr<ProofVerifier> proof_verifier_; |
248 scoped_ptr<ChannelIDSigner> channel_id_signer_; | 225 scoped_ptr<ChannelIDSigner> channel_id_signer_; |
249 | 226 |
250 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); | 227 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); |
251 }; | 228 }; |
252 | 229 |
253 } // namespace net | 230 } // namespace net |
254 | 231 |
255 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 232 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
OLD | NEW |