OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
7 | 7 |
8 #include <stdint.h> | 8 #include <stdint.h> |
9 | 9 |
10 #include <map> | 10 #include <map> |
(...skipping 208 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
219 | 219 |
220 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a | 220 // FillInchoateClientHello sets |out| to be a CHLO message that elicits a |
221 // source-address token or SCFG from a server. If |cached| is non-nullptr, the | 221 // source-address token or SCFG from a server. If |cached| is non-nullptr, the |
222 // source-address token will be taken from it. |out_params| is used in order | 222 // source-address token will be taken from it. |out_params| is used in order |
223 // to store the cached certs that were sent as hints to the server in | 223 // to store the cached certs that were sent as hints to the server in |
224 // |out_params->cached_certs|. |preferred_version| is the version of the | 224 // |out_params->cached_certs|. |preferred_version| is the version of the |
225 // QUIC protocol that this client chose to use initially. This allows the | 225 // QUIC protocol that this client chose to use initially. This allows the |
226 // server to detect downgrade attacks. If |demand_x509_proof| is true, | 226 // server to detect downgrade attacks. If |demand_x509_proof| is true, |
227 // then |out| will include an X509 proof demand, and the associated | 227 // then |out| will include an X509 proof demand, and the associated |
228 // certificate related fields. | 228 // certificate related fields. |
229 void FillInchoateClientHello(const QuicServerId& server_id, | 229 void FillInchoateClientHello( |
230 const QuicVersion preferred_version, | 230 const QuicServerId& server_id, |
231 const CachedState* cached, | 231 const QuicVersion preferred_version, |
232 QuicRandom* rand, | 232 const CachedState* cached, |
233 bool demand_x509_proof, | 233 QuicRandom* rand, |
234 QuicCryptoNegotiatedParameters* out_params, | 234 bool demand_x509_proof, |
235 CryptoHandshakeMessage* out) const; | 235 scoped_refptr<QuicCryptoNegotiatedParameters> out_params, |
| 236 CryptoHandshakeMessage* out) const; |
236 | 237 |
237 // FillClientHello sets |out| to be a CHLO message based on the configuration | 238 // FillClientHello sets |out| to be a CHLO message based on the configuration |
238 // of this object. This object must have cached enough information about | 239 // of this object. This object must have cached enough information about |
239 // the server's hostname in order to perform a handshake. This can be checked | 240 // the server's hostname in order to perform a handshake. This can be checked |
240 // with the |IsComplete| member of |CachedState|. | 241 // with the |IsComplete| member of |CachedState|. |
241 // | 242 // |
242 // |now| and |rand| are used to generate the nonce and |out_params| is | 243 // |now| and |rand| are used to generate the nonce and |out_params| is |
243 // filled with the results of the handshake that the server is expected to | 244 // filled with the results of the handshake that the server is expected to |
244 // accept. |preferred_version| is the version of the QUIC protocol that this | 245 // accept. |preferred_version| is the version of the QUIC protocol that this |
245 // client chose to use initially. This allows the server to detect downgrade | 246 // client chose to use initially. This allows the server to detect downgrade |
246 // attacks. | 247 // attacks. |
247 // | 248 // |
248 // If |channel_id_key| is not null, it is used to sign a secret value derived | 249 // If |channel_id_key| is not null, it is used to sign a secret value derived |
249 // from the client and server's keys, and the Channel ID public key and the | 250 // from the client and server's keys, and the Channel ID public key and the |
250 // signature are placed in the CETV value of the CHLO. | 251 // signature are placed in the CETV value of the CHLO. |
251 QuicErrorCode FillClientHello(const QuicServerId& server_id, | 252 QuicErrorCode FillClientHello( |
252 QuicConnectionId connection_id, | 253 const QuicServerId& server_id, |
253 const QuicVersion actual_version, | 254 QuicConnectionId connection_id, |
254 const QuicVersion preferred_version, | 255 const QuicVersion actual_version, |
255 const CachedState* cached, | 256 const QuicVersion preferred_version, |
256 QuicWallTime now, | 257 const CachedState* cached, |
257 QuicRandom* rand, | 258 QuicWallTime now, |
258 const ChannelIDKey* channel_id_key, | 259 QuicRandom* rand, |
259 QuicCryptoNegotiatedParameters* out_params, | 260 const ChannelIDKey* channel_id_key, |
260 CryptoHandshakeMessage* out, | 261 scoped_refptr<QuicCryptoNegotiatedParameters> out_params, |
261 std::string* error_details) const; | 262 CryptoHandshakeMessage* out, |
| 263 std::string* error_details) const; |
262 | 264 |
263 // ProcessRejection processes a REJ message from a server and updates the | 265 // ProcessRejection processes a REJ message from a server and updates the |
264 // cached information about that server. After this, |IsComplete| may return | 266 // cached information about that server. After this, |IsComplete| may return |
265 // true for that server's CachedState. If the rejection message contains state | 267 // true for that server's CachedState. If the rejection message contains state |
266 // about a future handshake (i.e. an nonce value from the server), then it | 268 // about a future handshake (i.e. an nonce value from the server), then it |
267 // will be saved in |out_params|. |now| is used to judge whether the server | 269 // will be saved in |out_params|. |now| is used to judge whether the server |
268 // config in the rejection message has expired. | 270 // config in the rejection message has expired. |
269 QuicErrorCode ProcessRejection(const CryptoHandshakeMessage& rej, | 271 QuicErrorCode ProcessRejection( |
270 QuicWallTime now, | 272 const CryptoHandshakeMessage& rej, |
271 QuicVersion version, | 273 QuicWallTime now, |
272 base::StringPiece chlo_hash, | 274 QuicVersion version, |
273 CachedState* cached, | 275 base::StringPiece chlo_hash, |
274 QuicCryptoNegotiatedParameters* out_params, | 276 CachedState* cached, |
275 std::string* error_details); | 277 scoped_refptr<QuicCryptoNegotiatedParameters> out_params, |
| 278 std::string* error_details); |
276 | 279 |
277 // ProcessServerHello processes the message in |server_hello|, updates the | 280 // ProcessServerHello processes the message in |server_hello|, updates the |
278 // cached information about that server, writes the negotiated parameters to | 281 // cached information about that server, writes the negotiated parameters to |
279 // |out_params| and returns QUIC_NO_ERROR. If |server_hello| is unacceptable | 282 // |out_params| and returns QUIC_NO_ERROR. If |server_hello| is unacceptable |
280 // then it puts an error message in |error_details| and returns an error | 283 // then it puts an error message in |error_details| and returns an error |
281 // code. |version| is the QUIC version for the current connection. | 284 // code. |version| is the QUIC version for the current connection. |
282 // |negotiated_versions| contains the list of version, if any, that were | 285 // |negotiated_versions| contains the list of version, if any, that were |
283 // present in a version negotiation packet previously recevied from the | 286 // present in a version negotiation packet previously recevied from the |
284 // server. The contents of this list will be compared against the list of | 287 // server. The contents of this list will be compared against the list of |
285 // versions provided in the VER tag of the server hello. | 288 // versions provided in the VER tag of the server hello. |
286 QuicErrorCode ProcessServerHello(const CryptoHandshakeMessage& server_hello, | 289 QuicErrorCode ProcessServerHello( |
287 QuicConnectionId connection_id, | 290 const CryptoHandshakeMessage& server_hello, |
288 QuicVersion version, | 291 QuicConnectionId connection_id, |
289 const QuicVersionVector& negotiated_versions, | 292 QuicVersion version, |
290 CachedState* cached, | 293 const QuicVersionVector& negotiated_versions, |
291 QuicCryptoNegotiatedParameters* out_params, | 294 CachedState* cached, |
292 std::string* error_details); | 295 scoped_refptr<QuicCryptoNegotiatedParameters> out_params, |
| 296 std::string* error_details); |
293 | 297 |
294 // Processes the message in |server_update|, updating the cached source | 298 // Processes the message in |server_update|, updating the cached source |
295 // address token, and server config. | 299 // address token, and server config. |
296 // If |server_update| is invalid then |error_details| will contain an error | 300 // If |server_update| is invalid then |error_details| will contain an error |
297 // message, and an error code will be returned. If all has gone well | 301 // message, and an error code will be returned. If all has gone well |
298 // QUIC_NO_ERROR is returned. | 302 // QUIC_NO_ERROR is returned. |
299 QuicErrorCode ProcessServerConfigUpdate( | 303 QuicErrorCode ProcessServerConfigUpdate( |
300 const CryptoHandshakeMessage& server_update, | 304 const CryptoHandshakeMessage& server_update, |
301 QuicWallTime now, | 305 QuicWallTime now, |
302 const QuicVersion version, | 306 const QuicVersion version, |
303 base::StringPiece chlo_hash, | 307 base::StringPiece chlo_hash, |
304 CachedState* cached, | 308 CachedState* cached, |
305 QuicCryptoNegotiatedParameters* out_params, | 309 scoped_refptr<QuicCryptoNegotiatedParameters> out_params, |
306 std::string* error_details); | 310 std::string* error_details); |
307 | 311 |
308 ProofVerifier* proof_verifier() const; | 312 ProofVerifier* proof_verifier() const; |
309 | 313 |
310 ChannelIDSource* channel_id_source() const; | 314 ChannelIDSource* channel_id_source() const; |
311 | 315 |
312 // SetChannelIDSource sets a ChannelIDSource that will be called, when the | 316 // SetChannelIDSource sets a ChannelIDSource that will be called, when the |
313 // server supports channel IDs, to obtain a channel ID for signing a message | 317 // server supports channel IDs, to obtain a channel ID for signing a message |
314 // proving possession of the channel ID. This object takes ownership of | 318 // proving possession of the channel ID. This object takes ownership of |
315 // |source|. | 319 // |source|. |
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
381 | 385 |
382 // The |user_agent_id_| passed in QUIC's CHLO message. | 386 // The |user_agent_id_| passed in QUIC's CHLO message. |
383 std::string user_agent_id_; | 387 std::string user_agent_id_; |
384 | 388 |
385 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); | 389 DISALLOW_COPY_AND_ASSIGN(QuicCryptoClientConfig); |
386 }; | 390 }; |
387 | 391 |
388 } // namespace net | 392 } // namespace net |
389 | 393 |
390 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ | 394 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_CLIENT_CONFIG_H_ |
OLD | NEW |