OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
13 #include "base/strings/string_piece.h" | 13 #include "base/strings/string_piece.h" |
14 #include "net/base/net_export.h" | 14 #include "net/base/net_export.h" |
15 #include "net/quic/crypto/crypto_handshake.h" | 15 #include "net/quic/crypto/crypto_handshake.h" |
16 #include "net/quic/quic_protocol.h" | 16 #include "net/quic/quic_protocol.h" |
| 17 #include "net/quic/quic_server_id.h" |
17 | 18 |
18 namespace net { | 19 namespace net { |
19 | 20 |
20 class ChannelIDSigner; | 21 class ChannelIDSigner; |
21 class CryptoHandshakeMessage; | 22 class CryptoHandshakeMessage; |
22 class ProofVerifier; | 23 class ProofVerifier; |
23 class ProofVerifyDetails; | 24 class ProofVerifyDetails; |
24 class QuicRandom; | 25 class QuicRandom; |
25 class QuicSessionKey; | |
26 | 26 |
27 // QuicCryptoClientConfig contains crypto-related configuration settings for a | 27 // QuicCryptoClientConfig contains crypto-related configuration settings for a |
28 // client. Note that this object isn't thread-safe. It's designed to be used on | 28 // client. Note that this object isn't thread-safe. It's designed to be used on |
29 // a single thread at a time. | 29 // a single thread at a time. |
30 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { | 30 class NET_EXPORT_PRIVATE QuicCryptoClientConfig : public QuicCryptoConfig { |
31 public: | 31 public: |
32 // A CachedState contains the information that the client needs in order to | 32 // A CachedState contains the information that the client needs in order to |
33 // perform a 0-RTT handshake with a server. This information can be reused | 33 // perform a 0-RTT handshake with a server. This information can be reused |
34 // over several connections to the same server. | 34 // over several connections to the same server. |
35 class NET_EXPORT_PRIVATE CachedState { | 35 class NET_EXPORT_PRIVATE CachedState { |
(...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
125 | 125 |
126 DISALLOW_COPY_AND_ASSIGN(CachedState); | 126 DISALLOW_COPY_AND_ASSIGN(CachedState); |
127 }; | 127 }; |
128 | 128 |
129 QuicCryptoClientConfig(); | 129 QuicCryptoClientConfig(); |
130 ~QuicCryptoClientConfig(); | 130 ~QuicCryptoClientConfig(); |
131 | 131 |
132 // Sets the members to reasonable, default values. | 132 // Sets the members to reasonable, default values. |
133 void SetDefaults(); | 133 void SetDefaults(); |
134 | 134 |
135 // LookupOrCreate returns a CachedState for the given |server_key|. If no such | 135 // LookupOrCreate returns a CachedState for the given |server_id|. If no such |
136 // CachedState currently exists, it will be created and cached. | 136 // CachedState currently exists, it will be created and cached. |
137 CachedState* LookupOrCreate(const QuicSessionKey& server_key); | 137 CachedState* LookupOrCreate(const QuicServerId& server_id); |
138 | 138 |
139 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a | 139 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a |
140 // source-address token or SCFG from a server. If |cached| is non-NULL, the | 140 // source-address token or SCFG from a server. If |cached| is non-NULL, the |
141 // source-address token will be taken from it. |out_params| is used in order | 141 // source-address token will be taken from it. |out_params| is used in order |
142 // to store the cached certs that were sent as hints to the server in | 142 // to store the cached certs that were sent as hints to the server in |
143 // |out_params->cached_certs|. |preferred_version| is the version of the | 143 // |out_params->cached_certs|. |preferred_version| is the version of the |
144 // QUIC protocol that this client chose to use initially. This allows the | 144 // QUIC protocol that this client chose to use initially. This allows the |
145 // server to detect downgrade attacks. | 145 // server to detect downgrade attacks. |
146 void FillInchoateClientHello(const QuicSessionKey& server_key, | 146 void FillInchoateClientHello(const QuicServerId& server_id, |
147 const QuicVersion preferred_version, | 147 const QuicVersion preferred_version, |
148 const CachedState* cached, | 148 const CachedState* cached, |
149 QuicCryptoNegotiatedParameters* out_params, | 149 QuicCryptoNegotiatedParameters* out_params, |
150 CryptoHandshakeMessage* out) const; | 150 CryptoHandshakeMessage* out) const; |
151 | 151 |
152 // FillClientHello sets |out| to be a CHLO message based on the configuration | 152 // FillClientHello sets |out| to be a CHLO message based on the configuration |
153 // of this object. This object must have cached enough information about | 153 // of this object. This object must have cached enough information about |
154 // the server's hostname in order to perform a handshake. This can be checked | 154 // the server's hostname in order to perform a handshake. This can be checked |
155 // with the |IsComplete| member of |CachedState|. | 155 // with the |IsComplete| member of |CachedState|. |
156 // | 156 // |
157 // |initial_flow_control_window_bytes| is the size of the initial flow | 157 // |initial_flow_control_window_bytes| is the size of the initial flow |
158 // control window this client will use for new streams. | 158 // control window this client will use for new streams. |
159 // | 159 // |
160 // |clock| and |rand| are used to generate the nonce and |out_params| is | 160 // |clock| and |rand| are used to generate the nonce and |out_params| is |
161 // filled with the results of the handshake that the server is expected to | 161 // filled with the results of the handshake that the server is expected to |
162 // accept. |preferred_version| is the version of the QUIC protocol that this | 162 // accept. |preferred_version| is the version of the QUIC protocol that this |
163 // client chose to use initially. This allows the server to detect downgrade | 163 // client chose to use initially. This allows the server to detect downgrade |
164 // attacks. | 164 // attacks. |
165 QuicErrorCode FillClientHello(const QuicSessionKey& server_key, | 165 QuicErrorCode FillClientHello(const QuicServerId& server_id, |
166 QuicConnectionId connection_id, | 166 QuicConnectionId connection_id, |
167 const QuicVersion preferred_version, | 167 const QuicVersion preferred_version, |
168 uint32 initial_flow_control_window_bytes, | 168 uint32 initial_flow_control_window_bytes, |
169 const CachedState* cached, | 169 const CachedState* cached, |
170 QuicWallTime now, | 170 QuicWallTime now, |
171 QuicRandom* rand, | 171 QuicRandom* rand, |
172 QuicCryptoNegotiatedParameters* out_params, | 172 QuicCryptoNegotiatedParameters* out_params, |
173 CryptoHandshakeMessage* out, | 173 CryptoHandshakeMessage* out, |
174 std::string* error_details) const; | 174 std::string* error_details) const; |
175 | 175 |
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
209 void SetProofVerifier(ProofVerifier* verifier); | 209 void SetProofVerifier(ProofVerifier* verifier); |
210 | 210 |
211 ChannelIDSigner* channel_id_signer() const; | 211 ChannelIDSigner* channel_id_signer() const; |
212 | 212 |
213 // SetChannelIDSigner sets a ChannelIDSigner that will be called when the | 213 // SetChannelIDSigner sets a ChannelIDSigner that will be called when the |
214 // server supports channel IDs to sign a message proving possession of the | 214 // server supports channel IDs to sign a message proving possession of the |
215 // given ChannelID. This object takes ownership of |signer|. | 215 // given ChannelID. This object takes ownership of |signer|. |
216 void SetChannelIDSigner(ChannelIDSigner* signer); | 216 void SetChannelIDSigner(ChannelIDSigner* signer); |
217 | 217 |
218 // Initialize the CachedState from |canonical_crypto_config| for the | 218 // Initialize the CachedState from |canonical_crypto_config| for the |
219 // |canonical_server_key| as the initial CachedState for |server_key|. We will | 219 // |canonical_server_id| as the initial CachedState for |server_id|. We will |
220 // copy config data only if |canonical_crypto_config| has valid proof. | 220 // copy config data only if |canonical_crypto_config| has valid proof. |
221 void InitializeFrom(const QuicSessionKey& server_key, | 221 void InitializeFrom(const QuicServerId& server_id, |
222 const QuicSessionKey& canonical_server_key, | 222 const QuicServerId& canonical_server_id, |
223 QuicCryptoClientConfig* canonical_crypto_config); | 223 QuicCryptoClientConfig* canonical_crypto_config); |
224 | 224 |
225 // Adds |suffix| as a domain suffix for which the server's crypto config | 225 // Adds |suffix| as a domain suffix for which the server's crypto config |
226 // is expected to be shared among servers with the domain suffix. If a server | 226 // is expected to be shared among servers with the domain suffix. If a server |
227 // matches this suffix, then the server config from another server with the | 227 // matches this suffix, then the server config from another server with the |
228 // suffix will be used to initialize the cached state for this server. | 228 // suffix will be used to initialize the cached state for this server. |
229 void AddCanonicalSuffix(const std::string& suffix); | 229 void AddCanonicalSuffix(const std::string& suffix); |
230 | 230 |
231 // Prefers AES-GCM (kAESG) over other AEAD algorithms. Call this method if | 231 // Prefers AES-GCM (kAESG) over other AEAD algorithms. Call this method if |
232 // the CPU has hardware acceleration for AES-GCM. This method can only be | 232 // the CPU has hardware acceleration for AES-GCM. This method can only be |
233 // called after SetDefaults(). | 233 // called after SetDefaults(). |
234 void PreferAesGcm(); | 234 void PreferAesGcm(); |
235 | 235 |
236 private: | 236 private: |
237 typedef std::map<QuicSessionKey, CachedState*> CachedStateMap; | 237 typedef std::map<QuicServerId, CachedState*> CachedStateMap; |
238 | 238 |
239 // If the suffix of the hostname in |server_key| is in |canoncial_suffixes_|, | 239 // If the suffix of the hostname in |server_id| is in |canoncial_suffixes_|, |
240 // then populate |cached| with the canonical cached state from | 240 // then populate |cached| with the canonical cached state from |
241 // |canonical_server_map_| for that suffix. | 241 // |canonical_server_map_| for that suffix. |
242 void PopulateFromCanonicalConfig(const QuicSessionKey& server_key, | 242 void PopulateFromCanonicalConfig(const QuicServerId& server_id, |
243 CachedState* cached); | 243 CachedState* cached); |
244 | 244 |
245 // cached_states_ maps from the server_key to the cached information about | 245 // cached_states_ maps from the server_id to the cached information about |
246 // that server. | 246 // that server. |
247 CachedStateMap cached_states_; | 247 CachedStateMap cached_states_; |
248 | 248 |
249 // Contains a map of servers which could share the same server config. Map | 249 // Contains a map of servers which could share the same server config. Map |
250 // from a canonical host suffix/port/scheme to a representative server with | 250 // from a canonical host suffix/port/scheme to a representative server with |
251 // the canonical suffix, which has a plausible set of initial certificates | 251 // the canonical suffix, which has a plausible set of initial certificates |
252 // (or at least server public key). | 252 // (or at least server public key). |
253 std::map<QuicSessionKey, QuicSessionKey> canonical_server_map_; | 253 std::map<QuicServerId, QuicServerId> canonical_server_map_; |
254 | 254 |
255 // Contains list of suffixes (for exmaple ".c.youtube.com", | 255 // Contains list of suffixes (for exmaple ".c.youtube.com", |
256 // ".googlevideo.com") of canoncial hostnames. | 256 // ".googlevideo.com") of canoncial hostnames. |
257 std::vector<std::string> canoncial_suffixes_; | 257 std::vector<std::string> canoncial_suffixes_; |
258 | 258 |
259 scoped_ptr<ProofVerifier> proof_verifier_; | 259 scoped_ptr<ProofVerifier> proof_verifier_; |
260 scoped_ptr<ChannelIDSigner> channel_id_signer_; | 260 scoped_ptr<ChannelIDSigner> channel_id_signer_; |
261 | 261 |
262 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); | 262 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); |
263 }; | 263 }; |
264 | 264 |
265 } // namespace net | 265 } // namespace net |
266 | 266 |
267 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 267 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
OLD | NEW |