| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| 11 | 11 |
| 12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
| 13 #include "base/strings/string_piece.h" | 13 #include "base/strings/string_piece.h" |
| 14 #include "net/base/net_export.h" | 14 #include "net/base/net_export.h" |
| 15 #include "net/quic/crypto/crypto_handshake.h" | 15 #include "net/quic/crypto/crypto_handshake.h" |
| 16 #include "net/quic/quic_protocol.h" | 16 #include "net/quic/quic_protocol.h" |
| 17 #include "net/quic/quic_server_id.h" |
| 17 | 18 |
| 18 namespace net { | 19 namespace net { |
| 19 | 20 |
| 20 class ChannelIDSigner; | 21 class ChannelIDSigner; |
| 21 class CryptoHandshakeMessage; | 22 class CryptoHandshakeMessage; |
| 22 class ProofVerifier; | 23 class ProofVerifier; |
| 23 class ProofVerifyDetails; | 24 class ProofVerifyDetails; |
| 24 class QuicRandom; | 25 class QuicRandom; |
| 25 class QuicSessionKey; | |
| 26 | 26 |
| 27 // QuicCryptoClientConfig contains crypto-related configuration settings for a | 27 // QuicCryptoClientConfig contains crypto-related configuration settings for a |
| 28 // client. Note that this object isn't thread-safe. It's designed to be used on | 28 // client. Note that this object isn't thread-safe. It's designed to be used on |
| 29 // a single thread at a time. | 29 // a single thread at a time. |
| 30 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { | 30 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { |
| 31 public: | 31 public: |
| 32 // A CachedState contains the information that the client needs in order to | 32 // A CachedState contains the information that the client needs in order to |
| 33 // perform a 0-RTT handshake with a server. This information can be reused | 33 // perform a 0-RTT handshake with a server. This information can be reused |
| 34 // over several connections to the same server. | 34 // over several connections to the same server. |
| 35 class NET_EXPORT_PRIVATE CachedState { | 35 class NET_EXPORT_PRIVATE CachedState { |
| (...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 125 | 125 |
| 126 DISALLOW_COPY_AND_ASSIGN(CachedState); | 126 DISALLOW_COPY_AND_ASSIGN(CachedState); |
| 127 }; | 127 }; |
| 128 | 128 |
| 129 QuicCryptoClientConfig(); | 129 QuicCryptoClientConfig(); |
| 130 ~QuicCryptoClientConfig(); | 130 ~QuicCryptoClientConfig(); |
| 131 | 131 |
| 132 // Sets the members to reasonable, default values. | 132 // Sets the members to reasonable, default values. |
| 133 void SetDefaults(); | 133 void SetDefaults(); |
| 134 | 134 |
| 135 // LookupOrCreate returns a CachedState for the given |server_key|. If no such | 135 // LookupOrCreate returns a CachedState for the given |server_id|. If no such |
| 136 // CachedState currently exists, it will be created and cached. | 136 // CachedState currently exists, it will be created and cached. |
| 137 CachedState* LookupOrCreate(const QuicSessionKey& server_key); | 137 CachedState* LookupOrCreate(const QuicServerId& server_id); |
| 138 | 138 |
| 139 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a | 139 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a |
| 140 // source-address token or SCFG from a server. If |cached| is non-NULL, the | 140 // source-address token or SCFG from a server. If |cached| is non-NULL, the |
| 141 // source-address token will be taken from it. |out_params| is used in order | 141 // source-address token will be taken from it. |out_params| is used in order |
| 142 // to store the cached certs that were sent as hints to the server in | 142 // to store the cached certs that were sent as hints to the server in |
| 143 // |out_params->cached_certs|. |preferred_version| is the version of the | 143 // |out_params->cached_certs|. |preferred_version| is the version of the |
| 144 // QUIC protocol that this client chose to use initially. This allows the | 144 // QUIC protocol that this client chose to use initially. This allows the |
| 145 // server to detect downgrade attacks. | 145 // server to detect downgrade attacks. |
| 146 void FillInchoateClientHello(const QuicSessionKey& server_key, | 146 void FillInchoateClientHello(const QuicServerId& server_id, |
| 147 const QuicVersion preferred_version, | 147 const QuicVersion preferred_version, |
| 148 const CachedState* cached, | 148 const CachedState* cached, |
| 149 QuicCryptoNegotiatedParameters* out_params, | 149 QuicCryptoNegotiatedParameters* out_params, |
| 150 CryptoHandshakeMessage* out) const; | 150 CryptoHandshakeMessage* out) const; |
| 151 | 151 |
| 152 // FillClientHello sets |out| to be a CHLO message based on the configuration | 152 // FillClientHello sets |out| to be a CHLO message based on the configuration |
| 153 // of this object. This object must have cached enough information about | 153 // of this object. This object must have cached enough information about |
| 154 // the server's hostname in order to perform a handshake. This can be checked | 154 // the server's hostname in order to perform a handshake. This can be checked |
| 155 // with the |IsComplete| member of |CachedState|. | 155 // with the |IsComplete| member of |CachedState|. |
| 156 // | 156 // |
| 157 // |initial_flow_control_window_bytes| is the size of the initial flow | 157 // |initial_flow_control_window_bytes| is the size of the initial flow |
| 158 // control window this client will use for new streams. | 158 // control window this client will use for new streams. |
| 159 // | 159 // |
| 160 // |clock| and |rand| are used to generate the nonce and |out_params| is | 160 // |clock| and |rand| are used to generate the nonce and |out_params| is |
| 161 // filled with the results of the handshake that the server is expected to | 161 // filled with the results of the handshake that the server is expected to |
| 162 // accept. |preferred_version| is the version of the QUIC protocol that this | 162 // accept. |preferred_version| is the version of the QUIC protocol that this |
| 163 // client chose to use initially. This allows the server to detect downgrade | 163 // client chose to use initially. This allows the server to detect downgrade |
| 164 // attacks. | 164 // attacks. |
| 165 QuicErrorCode FillClientHello(const QuicSessionKey& server_key, | 165 QuicErrorCode FillClientHello(const QuicServerId& server_id, |
| 166 QuicConnectionId connection_id, | 166 QuicConnectionId connection_id, |
| 167 const QuicVersion preferred_version, | 167 const QuicVersion preferred_version, |
| 168 uint32 initial_flow_control_window_bytes, | 168 uint32 initial_flow_control_window_bytes, |
| 169 const CachedState* cached, | 169 const CachedState* cached, |
| 170 QuicWallTime now, | 170 QuicWallTime now, |
| 171 QuicRandom* rand, | 171 QuicRandom* rand, |
| 172 QuicCryptoNegotiatedParameters* out_params, | 172 QuicCryptoNegotiatedParameters* out_params, |
| 173 CryptoHandshakeMessage* out, | 173 CryptoHandshakeMessage* out, |
| 174 std::string* error_details) const; | 174 std::string* error_details) const; |
| 175 | 175 |
| (...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 209 void SetProofVerifier(ProofVerifier* verifier); | 209 void SetProofVerifier(ProofVerifier* verifier); |
| 210 | 210 |
| 211 ChannelIDSigner* channel_id_signer() const; | 211 ChannelIDSigner* channel_id_signer() const; |
| 212 | 212 |
| 213 // SetChannelIDSigner sets a ChannelIDSigner that will be called when the | 213 // SetChannelIDSigner sets a ChannelIDSigner that will be called when the |
| 214 // server supports channel IDs to sign a message proving possession of the | 214 // server supports channel IDs to sign a message proving possession of the |
| 215 // given ChannelID. This object takes ownership of |signer|. | 215 // given ChannelID. This object takes ownership of |signer|. |
| 216 void SetChannelIDSigner(ChannelIDSigner* signer); | 216 void SetChannelIDSigner(ChannelIDSigner* signer); |
| 217 | 217 |
| 218 // Initialize the CachedState from |canonical_crypto_config| for the | 218 // Initialize the CachedState from |canonical_crypto_config| for the |
| 219 // |canonical_server_key| as the initial CachedState for |server_key|. We will | 219 // |canonical_server_id| as the initial CachedState for |server_id|. We will |
| 220 // copy config data only if |canonical_crypto_config| has valid proof. | 220 // copy config data only if |canonical_crypto_config| has valid proof. |
| 221 void InitializeFrom(const QuicSessionKey& server_key, | 221 void InitializeFrom(const QuicServerId& server_id, |
| 222 const QuicSessionKey& canonical_server_key, | 222 const QuicServerId& canonical_server_id, |
| 223 QuicCryptoClientConfig* canonical_crypto_config); | 223 QuicCryptoClientConfig* canonical_crypto_config); |
| 224 | 224 |
| 225 // Adds |suffix| as a domain suffix for which the server's crypto config | 225 // Adds |suffix| as a domain suffix for which the server's crypto config |
| 226 // is expected to be shared among servers with the domain suffix. If a server | 226 // is expected to be shared among servers with the domain suffix. If a server |
| 227 // matches this suffix, then the server config from another server with the | 227 // matches this suffix, then the server config from another server with the |
| 228 // suffix will be used to initialize the cached state for this server. | 228 // suffix will be used to initialize the cached state for this server. |
| 229 void AddCanonicalSuffix(const std::string& suffix); | 229 void AddCanonicalSuffix(const std::string& suffix); |
| 230 | 230 |
| 231 // Prefers AES-GCM (kAESG) over other AEAD algorithms. Call this method if | 231 // Prefers AES-GCM (kAESG) over other AEAD algorithms. Call this method if |
| 232 // the CPU has hardware acceleration for AES-GCM. This method can only be | 232 // the CPU has hardware acceleration for AES-GCM. This method can only be |
| 233 // called after SetDefaults(). | 233 // called after SetDefaults(). |
| 234 void PreferAesGcm(); | 234 void PreferAesGcm(); |
| 235 | 235 |
| 236 private: | 236 private: |
| 237 typedef std::map<QuicSessionKey, CachedState*> CachedStateMap; | 237 typedef std::map<QuicServerId, CachedState*> CachedStateMap; |
| 238 | 238 |
| 239 // If the suffix of the hostname in |server_key| is in |canoncial_suffixes_|, | 239 // If the suffix of the hostname in |server_id| is in |canoncial_suffixes_|, |
| 240 // then populate |cached| with the canonical cached state from | 240 // then populate |cached| with the canonical cached state from |
| 241 // |canonical_server_map_| for that suffix. | 241 // |canonical_server_map_| for that suffix. |
| 242 void PopulateFromCanonicalConfig(const QuicSessionKey& server_key, | 242 void PopulateFromCanonicalConfig(const QuicServerId& server_id, |
| 243 CachedState* cached); | 243 CachedState* cached); |
| 244 | 244 |
| 245 // cached_states_ maps from the server_key to the cached information about | 245 // cached_states_ maps from the server_id to the cached information about |
| 246 // that server. | 246 // that server. |
| 247 CachedStateMap cached_states_; | 247 CachedStateMap cached_states_; |
| 248 | 248 |
| 249 // Contains a map of servers which could share the same server config. Map | 249 // Contains a map of servers which could share the same server config. Map |
| 250 // from a canonical host suffix/port/scheme to a representative server with | 250 // from a canonical host suffix/port/scheme to a representative server with |
| 251 // the canonical suffix, which has a plausible set of initial certificates | 251 // the canonical suffix, which has a plausible set of initial certificates |
| 252 // (or at least server public key). | 252 // (or at least server public key). |
| 253 std::map<QuicSessionKey, QuicSessionKey> canonical_server_map_; | 253 std::map<QuicServerId, QuicServerId> canonical_server_map_; |
| 254 | 254 |
| 255 // Contains list of suffixes (for exmaple ".c.youtube.com", | 255 // Contains list of suffixes (for exmaple ".c.youtube.com", |
| 256 // ".googlevideo.com") of canoncial hostnames. | 256 // ".googlevideo.com") of canoncial hostnames. |
| 257 std::vector<std::string> canoncial_suffixes_; | 257 std::vector<std::string> canoncial_suffixes_; |
| 258 | 258 |
| 259 scoped_ptr<ProofVerifier> proof_verifier_; | 259 scoped_ptr<ProofVerifier> proof_verifier_; |
| 260 scoped_ptr<ChannelIDSigner> channel_id_signer_; | 260 scoped_ptr<ChannelIDSigner> channel_id_signer_; |
| 261 | 261 |
| 262 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); | 262 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); |
| 263 }; | 263 }; |
| 264 | 264 |
| 265 } // namespace net | 265 } // namespace net |
| 266 | 266 |
| 267 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 267 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
| OLD | NEW |