| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/core/crypto/quic_crypto_server_config.h" | 5 #include "net/quic/core/crypto/quic_crypto_server_config.h" |
| 6 | 6 |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 | 8 |
| 9 #include <algorithm> | 9 #include <algorithm> |
| 10 #include <memory> | 10 #include <memory> |
| (...skipping 497 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 508 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 508 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 509 const QuicWallTime now(clock->WallNow()); | 509 const QuicWallTime now(clock->WallNow()); |
| 510 | 510 |
| 511 scoped_refptr<ValidateClientHelloResultCallback::Result> result( | 511 scoped_refptr<ValidateClientHelloResultCallback::Result> result( |
| 512 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, | 512 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, |
| 513 now)); | 513 now)); |
| 514 | 514 |
| 515 StringPiece requested_scid; | 515 StringPiece requested_scid; |
| 516 client_hello.GetStringPiece(kSCID, &requested_scid); | 516 client_hello.GetStringPiece(kSCID, &requested_scid); |
| 517 | 517 |
| 518 uint8_t primary_orbit[kOrbitSize]; | |
| 519 scoped_refptr<Config> requested_config; | 518 scoped_refptr<Config> requested_config; |
| 520 scoped_refptr<Config> primary_config; | 519 scoped_refptr<Config> primary_config; |
| 521 { | 520 { |
| 522 base::AutoLock locked(configs_lock_); | 521 base::AutoLock locked(configs_lock_); |
| 523 | 522 |
| 524 if (!primary_config_.get()) { | 523 if (!primary_config_.get()) { |
| 525 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; | 524 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; |
| 526 result->error_details = "No configurations loaded"; | 525 result->error_details = "No configurations loaded"; |
| 527 } else { | 526 } else { |
| 528 if (!next_config_promotion_time_.IsZero() && | 527 if (!next_config_promotion_time_.IsZero() && |
| 529 next_config_promotion_time_.IsAfter(now)) { | 528 next_config_promotion_time_.IsAfter(now)) { |
| 530 SelectNewPrimaryConfig(now); | 529 SelectNewPrimaryConfig(now); |
| 531 DCHECK(primary_config_.get()); | 530 DCHECK(primary_config_.get()); |
| 532 DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_); | 531 DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_); |
| 533 } | 532 } |
| 534 | |
| 535 memcpy(primary_orbit, primary_config_->orbit, sizeof(primary_orbit)); | |
| 536 } | 533 } |
| 537 | 534 |
| 538 requested_config = GetConfigWithScid(requested_scid); | 535 requested_config = GetConfigWithScid(requested_scid); |
| 539 primary_config = primary_config_; | 536 primary_config = primary_config_; |
| 540 crypto_proof->config = primary_config_; | 537 crypto_proof->config = primary_config_; |
| 541 } | 538 } |
| 542 | 539 |
| 543 if (result->error_code == QUIC_NO_ERROR) { | 540 if (result->error_code == QUIC_NO_ERROR) { |
| 544 // QUIC requires a new proof for each CHLO so clear any existing proof. | 541 // QUIC requires a new proof for each CHLO so clear any existing proof. |
| 545 crypto_proof->chain = nullptr; | 542 crypto_proof->chain = nullptr; |
| 546 crypto_proof->signature = ""; | 543 crypto_proof->signature = ""; |
| 547 crypto_proof->cert_sct = ""; | 544 crypto_proof->cert_sct = ""; |
| 548 EvaluateClientHello(server_ip, version, primary_orbit, requested_config, | 545 EvaluateClientHello(server_ip, version, requested_config, primary_config, |
| 549 primary_config, crypto_proof, result, | 546 crypto_proof, result, std::move(done_cb)); |
| 550 std::move(done_cb)); | |
| 551 } else { | 547 } else { |
| 552 done_cb->Run(result, /* details = */ nullptr); | 548 done_cb->Run(result, /* details = */ nullptr); |
| 553 } | 549 } |
| 554 } | 550 } |
| 555 | 551 |
| 556 class ProcessClientHelloHelper { | 552 class ProcessClientHelloHelper { |
| 557 public: | 553 public: |
| 558 explicit ProcessClientHelloHelper( | 554 explicit ProcessClientHelloHelper( |
| 559 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb) | 555 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb) |
| 560 : done_cb_(done_cb) {} | 556 : done_cb_(done_cb) {} |
| (...skipping 632 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1193 } | 1189 } |
| 1194 | 1190 |
| 1195 class QuicCryptoServerConfig::EvaluateClientHelloCallback | 1191 class QuicCryptoServerConfig::EvaluateClientHelloCallback |
| 1196 : public ProofSource::Callback { | 1192 : public ProofSource::Callback { |
| 1197 public: | 1193 public: |
| 1198 EvaluateClientHelloCallback( | 1194 EvaluateClientHelloCallback( |
| 1199 const QuicCryptoServerConfig& config, | 1195 const QuicCryptoServerConfig& config, |
| 1200 bool found_error, | 1196 bool found_error, |
| 1201 const IPAddress& server_ip, | 1197 const IPAddress& server_ip, |
| 1202 QuicVersion version, | 1198 QuicVersion version, |
| 1203 const uint8_t* primary_orbit, | |
| 1204 scoped_refptr<QuicCryptoServerConfig::Config> requested_config, | 1199 scoped_refptr<QuicCryptoServerConfig::Config> requested_config, |
| 1205 scoped_refptr<QuicCryptoServerConfig::Config> primary_config, | 1200 scoped_refptr<QuicCryptoServerConfig::Config> primary_config, |
| 1206 QuicCryptoProof* crypto_proof, | 1201 QuicCryptoProof* crypto_proof, |
| 1207 scoped_refptr<ValidateClientHelloResultCallback::Result> | 1202 scoped_refptr<ValidateClientHelloResultCallback::Result> |
| 1208 client_hello_state, | 1203 client_hello_state, |
| 1209 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) | 1204 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) |
| 1210 : config_(config), | 1205 : config_(config), |
| 1211 found_error_(found_error), | 1206 found_error_(found_error), |
| 1212 server_ip_(server_ip), | 1207 server_ip_(server_ip), |
| 1213 version_(version), | 1208 version_(version), |
| 1214 primary_orbit_(primary_orbit), | |
| 1215 requested_config_(std::move(requested_config)), | 1209 requested_config_(std::move(requested_config)), |
| 1216 primary_config_(std::move(primary_config)), | 1210 primary_config_(std::move(primary_config)), |
| 1217 crypto_proof_(crypto_proof), | 1211 crypto_proof_(crypto_proof), |
| 1218 client_hello_state_(std::move(client_hello_state)), | 1212 client_hello_state_(std::move(client_hello_state)), |
| 1219 done_cb_(std::move(done_cb)) {} | 1213 done_cb_(std::move(done_cb)) {} |
| 1220 | 1214 |
| 1221 void Run(bool ok, | 1215 void Run(bool ok, |
| 1222 const scoped_refptr<ProofSource::Chain>& chain, | 1216 const scoped_refptr<ProofSource::Chain>& chain, |
| 1223 const string& signature, | 1217 const string& signature, |
| 1224 const string& leaf_cert_sct, | 1218 const string& leaf_cert_sct, |
| 1225 std::unique_ptr<ProofSource::Details> details) override { | 1219 std::unique_ptr<ProofSource::Details> details) override { |
| 1226 if (ok) { | 1220 if (ok) { |
| 1227 crypto_proof_->chain = chain; | 1221 crypto_proof_->chain = chain; |
| 1228 crypto_proof_->signature = signature; | 1222 crypto_proof_->signature = signature; |
| 1229 crypto_proof_->cert_sct = leaf_cert_sct; | 1223 crypto_proof_->cert_sct = leaf_cert_sct; |
| 1230 } | 1224 } |
| 1231 config_.EvaluateClientHelloAfterGetProof( | 1225 config_.EvaluateClientHelloAfterGetProof( |
| 1232 found_error_, server_ip_, version_, primary_orbit_, requested_config_, | 1226 found_error_, server_ip_, version_, requested_config_, primary_config_, |
| 1233 primary_config_, crypto_proof_, std::move(details), !ok, | 1227 crypto_proof_, std::move(details), !ok, client_hello_state_, |
| 1234 client_hello_state_, std::move(done_cb_)); | 1228 std::move(done_cb_)); |
| 1235 } | 1229 } |
| 1236 | 1230 |
| 1237 private: | 1231 private: |
| 1238 const QuicCryptoServerConfig& config_; | 1232 const QuicCryptoServerConfig& config_; |
| 1239 const bool found_error_; | 1233 const bool found_error_; |
| 1240 const IPAddress& server_ip_; | 1234 const IPAddress& server_ip_; |
| 1241 const QuicVersion version_; | 1235 const QuicVersion version_; |
| 1242 const uint8_t* primary_orbit_; | |
| 1243 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; | 1236 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; |
| 1244 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; | 1237 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; |
| 1245 QuicCryptoProof* crypto_proof_; | 1238 QuicCryptoProof* crypto_proof_; |
| 1246 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state_; | 1239 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state_; |
| 1247 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; | 1240 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; |
| 1248 }; | 1241 }; |
| 1249 | 1242 |
| 1250 void QuicCryptoServerConfig::EvaluateClientHello( | 1243 void QuicCryptoServerConfig::EvaluateClientHello( |
| 1251 const IPAddress& server_ip, | 1244 const IPAddress& server_ip, |
| 1252 QuicVersion version, | 1245 QuicVersion version, |
| 1253 const uint8_t* primary_orbit, | |
| 1254 scoped_refptr<Config> requested_config, | 1246 scoped_refptr<Config> requested_config, |
| 1255 scoped_refptr<Config> primary_config, | 1247 scoped_refptr<Config> primary_config, |
| 1256 QuicCryptoProof* crypto_proof, | 1248 QuicCryptoProof* crypto_proof, |
| 1257 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1249 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, |
| 1258 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1250 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 1259 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1251 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
| 1260 | 1252 |
| 1261 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1253 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
| 1262 ClientHelloInfo* info = &(client_hello_state->info); | 1254 ClientHelloInfo* info = &(client_hello_state->info); |
| 1263 | 1255 |
| (...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1325 string chlo_hash; | 1317 string chlo_hash; |
| 1326 CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash); | 1318 CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash); |
| 1327 bool need_proof = true; | 1319 bool need_proof = true; |
| 1328 need_proof = !crypto_proof->chain; | 1320 need_proof = !crypto_proof->chain; |
| 1329 if (FLAGS_enable_async_get_proof) { | 1321 if (FLAGS_enable_async_get_proof) { |
| 1330 if (need_proof) { | 1322 if (need_proof) { |
| 1331 // Make an async call to GetProof and setup the callback to trampoline | 1323 // Make an async call to GetProof and setup the callback to trampoline |
| 1332 // back into EvaluateClientHelloAfterGetProof | 1324 // back into EvaluateClientHelloAfterGetProof |
| 1333 std::unique_ptr<EvaluateClientHelloCallback> cb( | 1325 std::unique_ptr<EvaluateClientHelloCallback> cb( |
| 1334 new EvaluateClientHelloCallback( | 1326 new EvaluateClientHelloCallback( |
| 1335 *this, found_error, server_ip, version, primary_orbit, | 1327 *this, found_error, server_ip, version, requested_config, |
| 1336 requested_config, primary_config, crypto_proof, | 1328 primary_config, crypto_proof, client_hello_state, |
| 1337 client_hello_state, std::move(done_cb))); | 1329 std::move(done_cb))); |
| 1338 proof_source_->GetProof(server_ip, info->sni.as_string(), | 1330 proof_source_->GetProof(server_ip, info->sni.as_string(), |
| 1339 serialized_config, version, chlo_hash, | 1331 serialized_config, version, chlo_hash, |
| 1340 std::move(cb)); | 1332 std::move(cb)); |
| 1341 helper.DetachCallback(); | 1333 helper.DetachCallback(); |
| 1342 return; | 1334 return; |
| 1343 } | 1335 } |
| 1344 } | 1336 } |
| 1345 | 1337 |
| 1346 // No need to get a new proof if one was already generated. | 1338 // No need to get a new proof if one was already generated. |
| 1347 if (need_proof && | 1339 if (need_proof && |
| 1348 !proof_source_->GetProof(server_ip, info->sni.as_string(), | 1340 !proof_source_->GetProof(server_ip, info->sni.as_string(), |
| 1349 serialized_config, version, chlo_hash, | 1341 serialized_config, version, chlo_hash, |
| 1350 &crypto_proof->chain, &crypto_proof->signature, | 1342 &crypto_proof->chain, &crypto_proof->signature, |
| 1351 &crypto_proof->cert_sct)) { | 1343 &crypto_proof->cert_sct)) { |
| 1352 get_proof_failed = true; | 1344 get_proof_failed = true; |
| 1353 } | 1345 } |
| 1354 | 1346 |
| 1355 // Details are null because the synchronous version of GetProof does not | 1347 // Details are null because the synchronous version of GetProof does not |
| 1356 // return any stats. Eventually the synchronous codepath will be eliminated. | 1348 // return any stats. Eventually the synchronous codepath will be eliminated. |
| 1357 EvaluateClientHelloAfterGetProof( | 1349 EvaluateClientHelloAfterGetProof( |
| 1358 found_error, server_ip, version, primary_orbit, requested_config, | 1350 found_error, server_ip, version, requested_config, primary_config, |
| 1359 primary_config, crypto_proof, nullptr /* proof_source_details */, | 1351 crypto_proof, nullptr /* proof_source_details */, get_proof_failed, |
| 1360 get_proof_failed, client_hello_state, std::move(done_cb)); | 1352 client_hello_state, std::move(done_cb)); |
| 1361 helper.DetachCallback(); | 1353 helper.DetachCallback(); |
| 1362 } | 1354 } |
| 1363 | 1355 |
| 1364 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( | 1356 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( |
| 1365 bool found_error, | 1357 bool found_error, |
| 1366 const IPAddress& server_ip, | 1358 const IPAddress& server_ip, |
| 1367 QuicVersion version, | 1359 QuicVersion version, |
| 1368 const uint8_t* primary_orbit, | |
| 1369 scoped_refptr<Config> requested_config, | 1360 scoped_refptr<Config> requested_config, |
| 1370 scoped_refptr<Config> primary_config, | 1361 scoped_refptr<Config> primary_config, |
| 1371 QuicCryptoProof* crypto_proof, | 1362 QuicCryptoProof* crypto_proof, |
| 1372 std::unique_ptr<ProofSource::Details> proof_source_details, | 1363 std::unique_ptr<ProofSource::Details> proof_source_details, |
| 1373 bool get_proof_failed, | 1364 bool get_proof_failed, |
| 1374 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1365 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, |
| 1375 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1366 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 1376 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1367 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
| 1377 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1368 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
| 1378 ClientHelloInfo* info = &(client_hello_state->info); | 1369 ClientHelloInfo* info = &(client_hello_state->info); |
| (...skipping 879 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2258 priority(0), | 2249 priority(0), |
| 2259 source_address_token_boxer(nullptr) {} | 2250 source_address_token_boxer(nullptr) {} |
| 2260 | 2251 |
| 2261 QuicCryptoServerConfig::Config::~Config() { | 2252 QuicCryptoServerConfig::Config::~Config() { |
| 2262 base::STLDeleteElements(&key_exchanges); | 2253 base::STLDeleteElements(&key_exchanges); |
| 2263 } | 2254 } |
| 2264 | 2255 |
| 2265 QuicCryptoProof::QuicCryptoProof() {} | 2256 QuicCryptoProof::QuicCryptoProof() {} |
| 2266 QuicCryptoProof::~QuicCryptoProof() {} | 2257 QuicCryptoProof::~QuicCryptoProof() {} |
| 2267 } // namespace net | 2258 } // namespace net |
| OLD | NEW |