| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/core/crypto/quic_crypto_server_config.h" | 5 #include "net/quic/core/crypto/quic_crypto_server_config.h" |
| 6 | 6 |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 | 8 |
| 9 #include <algorithm> | 9 #include <algorithm> |
| 10 #include <memory> | 10 #include <memory> |
| 11 | 11 |
| 12 #include "base/macros.h" | 12 #include "base/macros.h" |
| 13 #include "base/memory/ref_counted.h" | |
| 14 #include "crypto/hkdf.h" | 13 #include "crypto/hkdf.h" |
| 15 #include "crypto/secure_hash.h" | 14 #include "crypto/secure_hash.h" |
| 16 #include "net/base/ip_address.h" | 15 #include "net/base/ip_address.h" |
| 17 #include "net/quic/core/crypto/aes_128_gcm_12_decrypter.h" | 16 #include "net/quic/core/crypto/aes_128_gcm_12_decrypter.h" |
| 18 #include "net/quic/core/crypto/aes_128_gcm_12_encrypter.h" | 17 #include "net/quic/core/crypto/aes_128_gcm_12_encrypter.h" |
| 19 #include "net/quic/core/crypto/cert_compressor.h" | 18 #include "net/quic/core/crypto/cert_compressor.h" |
| 20 #include "net/quic/core/crypto/chacha20_poly1305_encrypter.h" | 19 #include "net/quic/core/crypto/chacha20_poly1305_encrypter.h" |
| 21 #include "net/quic/core/crypto/channel_id.h" | 20 #include "net/quic/core/crypto/channel_id.h" |
| 22 #include "net/quic/core/crypto/crypto_framer.h" | 21 #include "net/quic/core/crypto/crypto_framer.h" |
| 23 #include "net/quic/core/crypto/crypto_handshake_message.h" | 22 #include "net/quic/core/crypto/crypto_handshake_message.h" |
| 24 #include "net/quic/core/crypto/crypto_server_config_protobuf.h" | 23 #include "net/quic/core/crypto/crypto_server_config_protobuf.h" |
| 25 #include "net/quic/core/crypto/crypto_utils.h" | 24 #include "net/quic/core/crypto/crypto_utils.h" |
| 26 #include "net/quic/core/crypto/curve25519_key_exchange.h" | 25 #include "net/quic/core/crypto/curve25519_key_exchange.h" |
| 27 #include "net/quic/core/crypto/ephemeral_key_source.h" | 26 #include "net/quic/core/crypto/ephemeral_key_source.h" |
| 28 #include "net/quic/core/crypto/key_exchange.h" | 27 #include "net/quic/core/crypto/key_exchange.h" |
| 29 #include "net/quic/core/crypto/p256_key_exchange.h" | 28 #include "net/quic/core/crypto/p256_key_exchange.h" |
| 30 #include "net/quic/core/crypto/proof_source.h" | 29 #include "net/quic/core/crypto/proof_source.h" |
| 31 #include "net/quic/core/crypto/quic_decrypter.h" | 30 #include "net/quic/core/crypto/quic_decrypter.h" |
| 32 #include "net/quic/core/crypto/quic_encrypter.h" | 31 #include "net/quic/core/crypto/quic_encrypter.h" |
| 33 #include "net/quic/core/crypto/quic_random.h" | 32 #include "net/quic/core/crypto/quic_random.h" |
| 34 #include "net/quic/core/proto/source_address_token.pb.h" | 33 #include "net/quic/core/proto/source_address_token.pb.h" |
| 35 #include "net/quic/core/quic_bug_tracker.h" | 34 #include "net/quic/core/quic_bug_tracker.h" |
| 36 #include "net/quic/core/quic_flags.h" | 35 #include "net/quic/core/quic_flags.h" |
| 37 #include "net/quic/core/quic_packets.h" | 36 #include "net/quic/core/quic_packets.h" |
| 38 #include "net/quic/core/quic_socket_address_coder.h" | 37 #include "net/quic/core/quic_socket_address_coder.h" |
| 39 #include "net/quic/core/quic_utils.h" | 38 #include "net/quic/core/quic_utils.h" |
| 40 #include "net/quic/platform/api/quic_clock.h" | 39 #include "net/quic/platform/api/quic_clock.h" |
| 40 #include "net/quic/platform/api/quic_reference_counted.h" |
| 41 | 41 |
| 42 using base::StringPiece; | 42 using base::StringPiece; |
| 43 using crypto::SecureHash; | 43 using crypto::SecureHash; |
| 44 using std::string; | 44 using std::string; |
| 45 | 45 |
| 46 namespace net { | 46 namespace net { |
| 47 | 47 |
| 48 namespace { | 48 namespace { |
| 49 | 49 |
| 50 // kMultiplier is the multiple of the CHLO message size that a REJ message | 50 // kMultiplier is the multiple of the CHLO message size that a REJ message |
| (...skipping 12 matching lines...) Expand all Loading... |
| 63 return hkdf.server_write_key().as_string(); | 63 return hkdf.server_write_key().as_string(); |
| 64 } | 64 } |
| 65 | 65 |
| 66 } // namespace | 66 } // namespace |
| 67 | 67 |
| 68 class ValidateClientHelloHelper { | 68 class ValidateClientHelloHelper { |
| 69 public: | 69 public: |
| 70 // Note: stores a pointer to a unique_ptr, and std::moves the unique_ptr when | 70 // Note: stores a pointer to a unique_ptr, and std::moves the unique_ptr when |
| 71 // ValidationComplete is called. | 71 // ValidationComplete is called. |
| 72 ValidateClientHelloHelper( | 72 ValidateClientHelloHelper( |
| 73 scoped_refptr<ValidateClientHelloResultCallback::Result> result, | 73 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 74 result, |
| 74 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb) | 75 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb) |
| 75 : result_(std::move(result)), done_cb_(done_cb) {} | 76 : result_(std::move(result)), done_cb_(done_cb) {} |
| 76 | 77 |
| 77 ~ValidateClientHelloHelper() { | 78 ~ValidateClientHelloHelper() { |
| 78 QUIC_BUG_IF(done_cb_ != nullptr) | 79 QUIC_BUG_IF(done_cb_ != nullptr) |
| 79 << "Deleting ValidateClientHelloHelper with a pending callback."; | 80 << "Deleting ValidateClientHelloHelper with a pending callback."; |
| 80 } | 81 } |
| 81 | 82 |
| 82 void ValidationComplete( | 83 void ValidationComplete( |
| 83 QuicErrorCode error_code, | 84 QuicErrorCode error_code, |
| 84 const char* error_details, | 85 const char* error_details, |
| 85 std::unique_ptr<ProofSource::Details> proof_source_details) { | 86 std::unique_ptr<ProofSource::Details> proof_source_details) { |
| 86 result_->error_code = error_code; | 87 result_->error_code = error_code; |
| 87 result_->error_details = error_details; | 88 result_->error_details = error_details; |
| 88 (*done_cb_)->Run(std::move(result_), std::move(proof_source_details)); | 89 (*done_cb_)->Run(std::move(result_), std::move(proof_source_details)); |
| 89 DetachCallback(); | 90 DetachCallback(); |
| 90 } | 91 } |
| 91 | 92 |
| 92 void DetachCallback() { | 93 void DetachCallback() { |
| 93 QUIC_BUG_IF(done_cb_ == nullptr) << "Callback already detached."; | 94 QUIC_BUG_IF(done_cb_ == nullptr) << "Callback already detached."; |
| 94 done_cb_ = nullptr; | 95 done_cb_ = nullptr; |
| 95 } | 96 } |
| 96 | 97 |
| 97 private: | 98 private: |
| 98 scoped_refptr<ValidateClientHelloResultCallback::Result> result_; | 99 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 100 result_; |
| 99 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb_; | 101 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb_; |
| 100 | 102 |
| 101 DISALLOW_COPY_AND_ASSIGN(ValidateClientHelloHelper); | 103 DISALLOW_COPY_AND_ASSIGN(ValidateClientHelloHelper); |
| 102 }; | 104 }; |
| 103 | 105 |
| 104 // static | 106 // static |
| 105 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing"; | 107 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing"; |
| 106 | 108 |
| 107 ClientHelloInfo::ClientHelloInfo(const QuicIpAddress& in_client_ip, | 109 ClientHelloInfo::ClientHelloInfo(const QuicIpAddress& in_client_ip, |
| 108 QuicWallTime in_now) | 110 QuicWallTime in_now) |
| (...skipping 186 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 295 std::unique_ptr<QuicServerConfigProtobuf> protobuf, | 297 std::unique_ptr<QuicServerConfigProtobuf> protobuf, |
| 296 const QuicWallTime now) { | 298 const QuicWallTime now) { |
| 297 std::unique_ptr<CryptoHandshakeMessage> msg( | 299 std::unique_ptr<CryptoHandshakeMessage> msg( |
| 298 CryptoFramer::ParseMessage(protobuf->config())); | 300 CryptoFramer::ParseMessage(protobuf->config())); |
| 299 | 301 |
| 300 if (!msg.get()) { | 302 if (!msg.get()) { |
| 301 LOG(WARNING) << "Failed to parse server config message"; | 303 LOG(WARNING) << "Failed to parse server config message"; |
| 302 return nullptr; | 304 return nullptr; |
| 303 } | 305 } |
| 304 | 306 |
| 305 scoped_refptr<Config> config(ParseConfigProtobuf(protobuf)); | 307 QuicReferenceCountedPointer<Config> config(ParseConfigProtobuf(protobuf)); |
| 306 if (!config.get()) { | 308 if (!config.get()) { |
| 307 LOG(WARNING) << "Failed to parse server config message"; | 309 LOG(WARNING) << "Failed to parse server config message"; |
| 308 return nullptr; | 310 return nullptr; |
| 309 } | 311 } |
| 310 | 312 |
| 311 { | 313 { |
| 312 QuicWriterMutexLock locked(&configs_lock_); | 314 QuicWriterMutexLock locked(&configs_lock_); |
| 313 if (configs_.find(config->id) != configs_.end()) { | 315 if (configs_.find(config->id) != configs_.end()) { |
| 314 LOG(WARNING) << "Failed to add config because another with the same " | 316 LOG(WARNING) << "Failed to add config because another with the same " |
| 315 "server config id already exists: " | 317 "server config id already exists: " |
| (...skipping 14 matching lines...) Expand all Loading... |
| 330 CryptoHandshakeMessage* QuicCryptoServerConfig::AddDefaultConfig( | 332 CryptoHandshakeMessage* QuicCryptoServerConfig::AddDefaultConfig( |
| 331 QuicRandom* rand, | 333 QuicRandom* rand, |
| 332 const QuicClock* clock, | 334 const QuicClock* clock, |
| 333 const ConfigOptions& options) { | 335 const ConfigOptions& options) { |
| 334 return AddConfig(GenerateConfig(rand, clock, options), clock->WallNow()); | 336 return AddConfig(GenerateConfig(rand, clock, options), clock->WallNow()); |
| 335 } | 337 } |
| 336 | 338 |
| 337 bool QuicCryptoServerConfig::SetConfigs( | 339 bool QuicCryptoServerConfig::SetConfigs( |
| 338 const std::vector<std::unique_ptr<QuicServerConfigProtobuf>>& protobufs, | 340 const std::vector<std::unique_ptr<QuicServerConfigProtobuf>>& protobufs, |
| 339 const QuicWallTime now) { | 341 const QuicWallTime now) { |
| 340 std::vector<scoped_refptr<Config>> parsed_configs; | 342 std::vector<QuicReferenceCountedPointer<Config>> parsed_configs; |
| 341 bool ok = true; | 343 bool ok = true; |
| 342 | 344 |
| 343 for (auto& protobuf : protobufs) { | 345 for (auto& protobuf : protobufs) { |
| 344 scoped_refptr<Config> config(ParseConfigProtobuf(protobuf)); | 346 QuicReferenceCountedPointer<Config> config(ParseConfigProtobuf(protobuf)); |
| 345 if (!config.get()) { | 347 if (!config) { |
| 346 ok = false; | 348 ok = false; |
| 347 break; | 349 break; |
| 348 } | 350 } |
| 349 | 351 |
| 350 parsed_configs.push_back(config); | 352 parsed_configs.push_back(config); |
| 351 } | 353 } |
| 352 | 354 |
| 353 if (parsed_configs.empty()) { | 355 if (parsed_configs.empty()) { |
| 354 LOG(WARNING) << "New config list is empty."; | 356 LOG(WARNING) << "New config list is empty."; |
| 355 ok = false; | 357 ok = false; |
| 356 } | 358 } |
| 357 | 359 |
| 358 if (!ok) { | 360 if (!ok) { |
| 359 LOG(WARNING) << "Rejecting QUIC configs because of above errors"; | 361 LOG(WARNING) << "Rejecting QUIC configs because of above errors"; |
| 360 } else { | 362 } else { |
| 361 VLOG(1) << "Updating configs:"; | 363 VLOG(1) << "Updating configs:"; |
| 362 | 364 |
| 363 QuicWriterMutexLock locked(&configs_lock_); | 365 QuicWriterMutexLock locked(&configs_lock_); |
| 364 ConfigMap new_configs; | 366 ConfigMap new_configs; |
| 365 | 367 |
| 366 for (std::vector<scoped_refptr<Config>>::const_iterator i = | 368 for (std::vector<QuicReferenceCountedPointer<Config>>::const_iterator i = |
| 367 parsed_configs.begin(); | 369 parsed_configs.begin(); |
| 368 i != parsed_configs.end(); ++i) { | 370 i != parsed_configs.end(); ++i) { |
| 369 scoped_refptr<Config> config = *i; | 371 QuicReferenceCountedPointer<Config> config = *i; |
| 370 | 372 |
| 371 ConfigMap::iterator it = configs_.find(config->id); | 373 ConfigMap::iterator it = configs_.find(config->id); |
| 372 if (it != configs_.end()) { | 374 if (it != configs_.end()) { |
| 373 VLOG(1) << "Keeping scid: " << QuicUtils::HexEncode(config->id) | 375 VLOG(1) << "Keeping scid: " << QuicUtils::HexEncode(config->id) |
| 374 << " orbit: " | 376 << " orbit: " |
| 375 << QuicUtils::HexEncode( | 377 << QuicUtils::HexEncode( |
| 376 reinterpret_cast<const char*>(config->orbit), kOrbitSize) | 378 reinterpret_cast<const char*>(config->orbit), kOrbitSize) |
| 377 << " new primary_time " << config->primary_time.ToUNIXSeconds() | 379 << " new primary_time " << config->primary_time.ToUNIXSeconds() |
| 378 << " old primary_time " | 380 << " old primary_time " |
| 379 << it->second->primary_time.ToUNIXSeconds() << " new priority " | 381 << it->second->primary_time.ToUNIXSeconds() << " new priority " |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 415 scids->push_back(it->first); | 417 scids->push_back(it->first); |
| 416 } | 418 } |
| 417 } | 419 } |
| 418 | 420 |
| 419 void QuicCryptoServerConfig::ValidateClientHello( | 421 void QuicCryptoServerConfig::ValidateClientHello( |
| 420 const CryptoHandshakeMessage& client_hello, | 422 const CryptoHandshakeMessage& client_hello, |
| 421 const QuicIpAddress& client_ip, | 423 const QuicIpAddress& client_ip, |
| 422 const QuicSocketAddress& server_address, | 424 const QuicSocketAddress& server_address, |
| 423 QuicVersion version, | 425 QuicVersion version, |
| 424 const QuicClock* clock, | 426 const QuicClock* clock, |
| 425 scoped_refptr<QuicSignedServerConfig> signed_config, | 427 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 426 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 428 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 427 const QuicWallTime now(clock->WallNow()); | 429 const QuicWallTime now(clock->WallNow()); |
| 428 | 430 |
| 429 scoped_refptr<ValidateClientHelloResultCallback::Result> result( | 431 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> result( |
| 430 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, | 432 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, |
| 431 now)); | 433 now)); |
| 432 | 434 |
| 433 StringPiece requested_scid; | 435 StringPiece requested_scid; |
| 434 client_hello.GetStringPiece(kSCID, &requested_scid); | 436 client_hello.GetStringPiece(kSCID, &requested_scid); |
| 435 | 437 |
| 436 scoped_refptr<Config> requested_config; | 438 QuicReferenceCountedPointer<Config> requested_config; |
| 437 scoped_refptr<Config> primary_config; | 439 QuicReferenceCountedPointer<Config> primary_config; |
| 438 { | 440 { |
| 439 QuicReaderMutexLock locked(&configs_lock_); | 441 QuicReaderMutexLock locked(&configs_lock_); |
| 440 | 442 |
| 441 if (!primary_config_.get()) { | 443 if (!primary_config_.get()) { |
| 442 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; | 444 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; |
| 443 result->error_details = "No configurations loaded"; | 445 result->error_details = "No configurations loaded"; |
| 444 } else { | 446 } else { |
| 445 if (!next_config_promotion_time_.IsZero() && | 447 if (!next_config_promotion_time_.IsZero() && |
| 446 next_config_promotion_time_.IsAfter(now)) { | 448 next_config_promotion_time_.IsAfter(now)) { |
| 447 configs_lock_.ReaderUnlock(); | 449 configs_lock_.ReaderUnlock(); |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 505 | 507 |
| 506 private: | 508 private: |
| 507 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb_; | 509 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb_; |
| 508 }; | 510 }; |
| 509 | 511 |
| 510 class QuicCryptoServerConfig::ProcessClientHelloCallback | 512 class QuicCryptoServerConfig::ProcessClientHelloCallback |
| 511 : public ProofSource::Callback { | 513 : public ProofSource::Callback { |
| 512 public: | 514 public: |
| 513 ProcessClientHelloCallback( | 515 ProcessClientHelloCallback( |
| 514 const QuicCryptoServerConfig* config, | 516 const QuicCryptoServerConfig* config, |
| 515 scoped_refptr<ValidateClientHelloResultCallback::Result> | 517 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 516 validate_chlo_result, | 518 validate_chlo_result, |
| 517 bool reject_only, | 519 bool reject_only, |
| 518 QuicConnectionId connection_id, | 520 QuicConnectionId connection_id, |
| 519 const QuicSocketAddress& client_address, | 521 const QuicSocketAddress& client_address, |
| 520 QuicVersion version, | 522 QuicVersion version, |
| 521 const QuicVersionVector& supported_versions, | 523 const QuicVersionVector& supported_versions, |
| 522 bool use_stateless_rejects, | 524 bool use_stateless_rejects, |
| 523 QuicConnectionId server_designated_connection_id, | 525 QuicConnectionId server_designated_connection_id, |
| 524 const QuicClock* clock, | 526 const QuicClock* clock, |
| 525 QuicRandom* rand, | 527 QuicRandom* rand, |
| 526 QuicCompressedCertsCache* compressed_certs_cache, | 528 QuicCompressedCertsCache* compressed_certs_cache, |
| 527 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 529 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
| 528 scoped_refptr<QuicSignedServerConfig> signed_config, | 530 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 529 QuicByteCount total_framing_overhead, | 531 QuicByteCount total_framing_overhead, |
| 530 QuicByteCount chlo_packet_size, | 532 QuicByteCount chlo_packet_size, |
| 531 const scoped_refptr<QuicCryptoServerConfig::Config>& requested_config, | 533 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config>& |
| 532 const scoped_refptr<QuicCryptoServerConfig::Config>& primary_config, | 534 requested_config, |
| 535 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config>& |
| 536 primary_config, |
| 533 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) | 537 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) |
| 534 : config_(config), | 538 : config_(config), |
| 535 validate_chlo_result_(std::move(validate_chlo_result)), | 539 validate_chlo_result_(std::move(validate_chlo_result)), |
| 536 reject_only_(reject_only), | 540 reject_only_(reject_only), |
| 537 connection_id_(connection_id), | 541 connection_id_(connection_id), |
| 538 client_address_(client_address), | 542 client_address_(client_address), |
| 539 version_(version), | 543 version_(version), |
| 540 supported_versions_(supported_versions), | 544 supported_versions_(supported_versions), |
| 541 use_stateless_rejects_(use_stateless_rejects), | 545 use_stateless_rejects_(use_stateless_rejects), |
| 542 server_designated_connection_id_(server_designated_connection_id), | 546 server_designated_connection_id_(server_designated_connection_id), |
| 543 clock_(clock), | 547 clock_(clock), |
| 544 rand_(rand), | 548 rand_(rand), |
| 545 compressed_certs_cache_(compressed_certs_cache), | 549 compressed_certs_cache_(compressed_certs_cache), |
| 546 params_(params), | 550 params_(params), |
| 547 signed_config_(signed_config), | 551 signed_config_(signed_config), |
| 548 total_framing_overhead_(total_framing_overhead), | 552 total_framing_overhead_(total_framing_overhead), |
| 549 chlo_packet_size_(chlo_packet_size), | 553 chlo_packet_size_(chlo_packet_size), |
| 550 requested_config_(requested_config), | 554 requested_config_(requested_config), |
| 551 primary_config_(primary_config), | 555 primary_config_(primary_config), |
| 552 done_cb_(std::move(done_cb)) {} | 556 done_cb_(std::move(done_cb)) {} |
| 553 | 557 |
| 554 void Run(bool ok, | 558 void Run(bool ok, |
| 555 const scoped_refptr<ProofSource::Chain>& chain, | 559 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
| 556 const QuicCryptoProof& proof, | 560 const QuicCryptoProof& proof, |
| 557 std::unique_ptr<ProofSource::Details> details) override { | 561 std::unique_ptr<ProofSource::Details> details) override { |
| 558 if (ok) { | 562 if (ok) { |
| 559 signed_config_->chain = chain; | 563 signed_config_->chain = chain; |
| 560 signed_config_->proof = proof; | 564 signed_config_->proof = proof; |
| 561 } | 565 } |
| 562 config_->ProcessClientHelloAfterGetProof( | 566 config_->ProcessClientHelloAfterGetProof( |
| 563 !ok, std::move(details), *validate_chlo_result_, reject_only_, | 567 !ok, std::move(details), *validate_chlo_result_, reject_only_, |
| 564 connection_id_, client_address_, version_, supported_versions_, | 568 connection_id_, client_address_, version_, supported_versions_, |
| 565 use_stateless_rejects_, server_designated_connection_id_, clock_, rand_, | 569 use_stateless_rejects_, server_designated_connection_id_, clock_, rand_, |
| 566 compressed_certs_cache_, params_, signed_config_, | 570 compressed_certs_cache_, params_, signed_config_, |
| 567 total_framing_overhead_, chlo_packet_size_, requested_config_, | 571 total_framing_overhead_, chlo_packet_size_, requested_config_, |
| 568 primary_config_, std::move(done_cb_)); | 572 primary_config_, std::move(done_cb_)); |
| 569 } | 573 } |
| 570 | 574 |
| 571 private: | 575 private: |
| 572 const QuicCryptoServerConfig* config_; | 576 const QuicCryptoServerConfig* config_; |
| 573 const scoped_refptr<ValidateClientHelloResultCallback::Result> | 577 const QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 574 validate_chlo_result_; | 578 validate_chlo_result_; |
| 575 const bool reject_only_; | 579 const bool reject_only_; |
| 576 const QuicConnectionId connection_id_; | 580 const QuicConnectionId connection_id_; |
| 577 const QuicSocketAddress client_address_; | 581 const QuicSocketAddress client_address_; |
| 578 const QuicVersion version_; | 582 const QuicVersion version_; |
| 579 const QuicVersionVector supported_versions_; | 583 const QuicVersionVector supported_versions_; |
| 580 const bool use_stateless_rejects_; | 584 const bool use_stateless_rejects_; |
| 581 const QuicConnectionId server_designated_connection_id_; | 585 const QuicConnectionId server_designated_connection_id_; |
| 582 const QuicClock* const clock_; | 586 const QuicClock* const clock_; |
| 583 QuicRandom* const rand_; | 587 QuicRandom* const rand_; |
| 584 QuicCompressedCertsCache* compressed_certs_cache_; | 588 QuicCompressedCertsCache* compressed_certs_cache_; |
| 585 scoped_refptr<QuicCryptoNegotiatedParameters> params_; | 589 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params_; |
| 586 scoped_refptr<QuicSignedServerConfig> signed_config_; | 590 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config_; |
| 587 const QuicByteCount total_framing_overhead_; | 591 const QuicByteCount total_framing_overhead_; |
| 588 const QuicByteCount chlo_packet_size_; | 592 const QuicByteCount chlo_packet_size_; |
| 589 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; | 593 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 590 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; | 594 requested_config_; |
| 595 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 596 primary_config_; |
| 591 std::unique_ptr<ProcessClientHelloResultCallback> done_cb_; | 597 std::unique_ptr<ProcessClientHelloResultCallback> done_cb_; |
| 592 }; | 598 }; |
| 593 | 599 |
| 594 void QuicCryptoServerConfig::ProcessClientHello( | 600 void QuicCryptoServerConfig::ProcessClientHello( |
| 595 scoped_refptr<ValidateClientHelloResultCallback::Result> | 601 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 596 validate_chlo_result, | 602 validate_chlo_result, |
| 597 bool reject_only, | 603 bool reject_only, |
| 598 QuicConnectionId connection_id, | 604 QuicConnectionId connection_id, |
| 599 const QuicSocketAddress& server_address, | 605 const QuicSocketAddress& server_address, |
| 600 const QuicSocketAddress& client_address, | 606 const QuicSocketAddress& client_address, |
| 601 QuicVersion version, | 607 QuicVersion version, |
| 602 const QuicVersionVector& supported_versions, | 608 const QuicVersionVector& supported_versions, |
| 603 bool use_stateless_rejects, | 609 bool use_stateless_rejects, |
| 604 QuicConnectionId server_designated_connection_id, | 610 QuicConnectionId server_designated_connection_id, |
| 605 const QuicClock* clock, | 611 const QuicClock* clock, |
| 606 QuicRandom* rand, | 612 QuicRandom* rand, |
| 607 QuicCompressedCertsCache* compressed_certs_cache, | 613 QuicCompressedCertsCache* compressed_certs_cache, |
| 608 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 614 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
| 609 scoped_refptr<QuicSignedServerConfig> signed_config, | 615 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 610 QuicByteCount total_framing_overhead, | 616 QuicByteCount total_framing_overhead, |
| 611 QuicByteCount chlo_packet_size, | 617 QuicByteCount chlo_packet_size, |
| 612 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { | 618 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { |
| 613 DCHECK(done_cb); | 619 DCHECK(done_cb); |
| 614 | 620 |
| 615 ProcessClientHelloHelper helper(&done_cb); | 621 ProcessClientHelloHelper helper(&done_cb); |
| 616 | 622 |
| 617 const CryptoHandshakeMessage& client_hello = | 623 const CryptoHandshakeMessage& client_hello = |
| 618 validate_chlo_result->client_hello; | 624 validate_chlo_result->client_hello; |
| 619 const ClientHelloInfo& info = validate_chlo_result->info; | 625 const ClientHelloInfo& info = validate_chlo_result->info; |
| 620 | 626 |
| 621 string error_details; | 627 string error_details; |
| 622 QuicErrorCode valid = CryptoUtils::ValidateClientHello( | 628 QuicErrorCode valid = CryptoUtils::ValidateClientHello( |
| 623 client_hello, version, supported_versions, &error_details); | 629 client_hello, version, supported_versions, &error_details); |
| 624 if (valid != QUIC_NO_ERROR) { | 630 if (valid != QUIC_NO_ERROR) { |
| 625 helper.Fail(valid, error_details); | 631 helper.Fail(valid, error_details); |
| 626 return; | 632 return; |
| 627 } | 633 } |
| 628 | 634 |
| 629 StringPiece requested_scid; | 635 StringPiece requested_scid; |
| 630 client_hello.GetStringPiece(kSCID, &requested_scid); | 636 client_hello.GetStringPiece(kSCID, &requested_scid); |
| 631 const QuicWallTime now(clock->WallNow()); | 637 const QuicWallTime now(clock->WallNow()); |
| 632 | 638 |
| 633 scoped_refptr<Config> requested_config; | 639 QuicReferenceCountedPointer<Config> requested_config; |
| 634 scoped_refptr<Config> primary_config; | 640 QuicReferenceCountedPointer<Config> primary_config; |
| 635 bool no_primary_config = false; | 641 bool no_primary_config = false; |
| 636 { | 642 { |
| 637 QuicReaderMutexLock locked(&configs_lock_); | 643 QuicReaderMutexLock locked(&configs_lock_); |
| 638 | 644 |
| 639 if (!primary_config_) { | 645 if (!primary_config_) { |
| 640 no_primary_config = true; | 646 no_primary_config = true; |
| 641 } else { | 647 } else { |
| 642 if (!next_config_promotion_time_.IsZero() && | 648 if (!next_config_promotion_time_.IsZero() && |
| 643 next_config_promotion_time_.IsAfter(now)) { | 649 next_config_promotion_time_.IsAfter(now)) { |
| 644 configs_lock_.ReaderUnlock(); | 650 configs_lock_.ReaderUnlock(); |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 728 bool reject_only, | 734 bool reject_only, |
| 729 QuicConnectionId connection_id, | 735 QuicConnectionId connection_id, |
| 730 const QuicSocketAddress& client_address, | 736 const QuicSocketAddress& client_address, |
| 731 QuicVersion version, | 737 QuicVersion version, |
| 732 const QuicVersionVector& supported_versions, | 738 const QuicVersionVector& supported_versions, |
| 733 bool use_stateless_rejects, | 739 bool use_stateless_rejects, |
| 734 QuicConnectionId server_designated_connection_id, | 740 QuicConnectionId server_designated_connection_id, |
| 735 const QuicClock* clock, | 741 const QuicClock* clock, |
| 736 QuicRandom* rand, | 742 QuicRandom* rand, |
| 737 QuicCompressedCertsCache* compressed_certs_cache, | 743 QuicCompressedCertsCache* compressed_certs_cache, |
| 738 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 744 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
| 739 scoped_refptr<QuicSignedServerConfig> signed_config, | 745 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 740 QuicByteCount total_framing_overhead, | 746 QuicByteCount total_framing_overhead, |
| 741 QuicByteCount chlo_packet_size, | 747 QuicByteCount chlo_packet_size, |
| 742 const scoped_refptr<Config>& requested_config, | 748 const QuicReferenceCountedPointer<Config>& requested_config, |
| 743 const scoped_refptr<Config>& primary_config, | 749 const QuicReferenceCountedPointer<Config>& primary_config, |
| 744 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { | 750 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { |
| 745 ProcessClientHelloHelper helper(&done_cb); | 751 ProcessClientHelloHelper helper(&done_cb); |
| 746 | 752 |
| 747 if (found_error) { | 753 if (found_error) { |
| 748 helper.Fail(QUIC_HANDSHAKE_FAILED, "Failed to get proof"); | 754 helper.Fail(QUIC_HANDSHAKE_FAILED, "Failed to get proof"); |
| 749 return; | 755 return; |
| 750 } | 756 } |
| 751 | 757 |
| 752 const CryptoHandshakeMessage& client_hello = | 758 const CryptoHandshakeMessage& client_hello = |
| 753 validate_chlo_result.client_hello; | 759 validate_chlo_result.client_hello; |
| (...skipping 242 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 996 NewSourceAddressToken(*requested_config.get(), info.source_address_tokens, | 1002 NewSourceAddressToken(*requested_config.get(), info.source_address_tokens, |
| 997 client_address.host(), rand, info.now, nullptr)); | 1003 client_address.host(), rand, info.now, nullptr)); |
| 998 QuicSocketAddressCoder address_coder(client_address); | 1004 QuicSocketAddressCoder address_coder(client_address); |
| 999 out->SetStringPiece(kCADR, address_coder.Encode()); | 1005 out->SetStringPiece(kCADR, address_coder.Encode()); |
| 1000 out->SetStringPiece(kPUBS, forward_secure_public_value); | 1006 out->SetStringPiece(kPUBS, forward_secure_public_value); |
| 1001 | 1007 |
| 1002 helper.Succeed(std::move(out), std::move(out_diversification_nonce), | 1008 helper.Succeed(std::move(out), std::move(out_diversification_nonce), |
| 1003 std::move(proof_source_details)); | 1009 std::move(proof_source_details)); |
| 1004 } | 1010 } |
| 1005 | 1011 |
| 1006 scoped_refptr<QuicCryptoServerConfig::Config> | 1012 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1007 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const { | 1013 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const { |
| 1008 configs_lock_.AssertReaderHeld(); | 1014 configs_lock_.AssertReaderHeld(); |
| 1009 | 1015 |
| 1010 if (!requested_scid.empty()) { | 1016 if (!requested_scid.empty()) { |
| 1011 ConfigMap::const_iterator it = configs_.find(requested_scid.as_string()); | 1017 ConfigMap::const_iterator it = configs_.find(requested_scid.as_string()); |
| 1012 if (it != configs_.end()) { | 1018 if (it != configs_.end()) { |
| 1013 // We'll use the config that the client requested in order to do | 1019 // We'll use the config that the client requested in order to do |
| 1014 // key-agreement. | 1020 // key-agreement. |
| 1015 return scoped_refptr<Config>(it->second); | 1021 return QuicReferenceCountedPointer<Config>(it->second); |
| 1016 } | 1022 } |
| 1017 } | 1023 } |
| 1018 | 1024 |
| 1019 return scoped_refptr<Config>(); | 1025 return QuicReferenceCountedPointer<Config>(); |
| 1020 } | 1026 } |
| 1021 | 1027 |
| 1022 // ConfigPrimaryTimeLessThan is a comparator that implements "less than" for | 1028 // ConfigPrimaryTimeLessThan is a comparator that implements "less than" for |
| 1023 // Config's based on their primary_time. | 1029 // Config's based on their primary_time. |
| 1024 // static | 1030 // static |
| 1025 bool QuicCryptoServerConfig::ConfigPrimaryTimeLessThan( | 1031 bool QuicCryptoServerConfig::ConfigPrimaryTimeLessThan( |
| 1026 const scoped_refptr<Config>& a, | 1032 const QuicReferenceCountedPointer<Config>& a, |
| 1027 const scoped_refptr<Config>& b) { | 1033 const QuicReferenceCountedPointer<Config>& b) { |
| 1028 if (a->primary_time.IsBefore(b->primary_time) || | 1034 if (a->primary_time.IsBefore(b->primary_time) || |
| 1029 b->primary_time.IsBefore(a->primary_time)) { | 1035 b->primary_time.IsBefore(a->primary_time)) { |
| 1030 // Primary times differ. | 1036 // Primary times differ. |
| 1031 return a->primary_time.IsBefore(b->primary_time); | 1037 return a->primary_time.IsBefore(b->primary_time); |
| 1032 } else if (a->priority != b->priority) { | 1038 } else if (a->priority != b->priority) { |
| 1033 // Primary times are equal, sort backwards by priority. | 1039 // Primary times are equal, sort backwards by priority. |
| 1034 return a->priority < b->priority; | 1040 return a->priority < b->priority; |
| 1035 } else { | 1041 } else { |
| 1036 // Primary times and priorities are equal, sort by config id. | 1042 // Primary times and priorities are equal, sort by config id. |
| 1037 return a->id < b->id; | 1043 return a->id < b->id; |
| 1038 } | 1044 } |
| 1039 } | 1045 } |
| 1040 | 1046 |
| 1041 void QuicCryptoServerConfig::SelectNewPrimaryConfig( | 1047 void QuicCryptoServerConfig::SelectNewPrimaryConfig( |
| 1042 const QuicWallTime now) const { | 1048 const QuicWallTime now) const { |
| 1043 std::vector<scoped_refptr<Config>> configs; | 1049 std::vector<QuicReferenceCountedPointer<Config>> configs; |
| 1044 configs.reserve(configs_.size()); | 1050 configs.reserve(configs_.size()); |
| 1045 | 1051 |
| 1046 for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); | 1052 for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); |
| 1047 ++it) { | 1053 ++it) { |
| 1048 // TODO(avd) Exclude expired configs? | 1054 // TODO(avd) Exclude expired configs? |
| 1049 configs.push_back(it->second); | 1055 configs.push_back(it->second); |
| 1050 } | 1056 } |
| 1051 | 1057 |
| 1052 if (configs.empty()) { | 1058 if (configs.empty()) { |
| 1053 if (primary_config_.get()) { | 1059 if (primary_config_.get()) { |
| 1054 QUIC_BUG << "No valid QUIC server config. Keeping the current config."; | 1060 QUIC_BUG << "No valid QUIC server config. Keeping the current config."; |
| 1055 } else { | 1061 } else { |
| 1056 QUIC_BUG << "No valid QUIC server config."; | 1062 QUIC_BUG << "No valid QUIC server config."; |
| 1057 } | 1063 } |
| 1058 return; | 1064 return; |
| 1059 } | 1065 } |
| 1060 | 1066 |
| 1061 std::sort(configs.begin(), configs.end(), ConfigPrimaryTimeLessThan); | 1067 std::sort(configs.begin(), configs.end(), ConfigPrimaryTimeLessThan); |
| 1062 | 1068 |
| 1063 scoped_refptr<Config> best_candidate = configs[0]; | 1069 QuicReferenceCountedPointer<Config> best_candidate = configs[0]; |
| 1064 | 1070 |
| 1065 for (size_t i = 0; i < configs.size(); ++i) { | 1071 for (size_t i = 0; i < configs.size(); ++i) { |
| 1066 const scoped_refptr<Config> config(configs[i]); | 1072 const QuicReferenceCountedPointer<Config> config(configs[i]); |
| 1067 if (!config->primary_time.IsAfter(now)) { | 1073 if (!config->primary_time.IsAfter(now)) { |
| 1068 if (config->primary_time.IsAfter(best_candidate->primary_time)) { | 1074 if (config->primary_time.IsAfter(best_candidate->primary_time)) { |
| 1069 best_candidate = config; | 1075 best_candidate = config; |
| 1070 } | 1076 } |
| 1071 continue; | 1077 continue; |
| 1072 } | 1078 } |
| 1073 | 1079 |
| 1074 // This is the first config with a primary_time in the future. Thus the | 1080 // This is the first config with a primary_time in the future. Thus the |
| 1075 // previous Config should be the primary and this one should determine the | 1081 // previous Config should be the primary and this one should determine the |
| 1076 // next_config_promotion_time_. | 1082 // next_config_promotion_time_. |
| 1077 scoped_refptr<Config> new_primary = best_candidate; | 1083 QuicReferenceCountedPointer<Config> new_primary = best_candidate; |
| 1078 if (i == 0) { | 1084 if (i == 0) { |
| 1079 // We need the primary_time of the next config. | 1085 // We need the primary_time of the next config. |
| 1080 if (configs.size() > 1) { | 1086 if (configs.size() > 1) { |
| 1081 next_config_promotion_time_ = configs[1]->primary_time; | 1087 next_config_promotion_time_ = configs[1]->primary_time; |
| 1082 } else { | 1088 } else { |
| 1083 next_config_promotion_time_ = QuicWallTime::Zero(); | 1089 next_config_promotion_time_ = QuicWallTime::Zero(); |
| 1084 } | 1090 } |
| 1085 } else { | 1091 } else { |
| 1086 next_config_promotion_time_ = config->primary_time; | 1092 next_config_promotion_time_ = config->primary_time; |
| 1087 } | 1093 } |
| 1088 | 1094 |
| 1089 if (primary_config_) { | 1095 if (primary_config_) { |
| 1090 primary_config_->is_primary = false; | 1096 primary_config_->is_primary = false; |
| 1091 } | 1097 } |
| 1092 primary_config_ = new_primary; | 1098 primary_config_ = new_primary; |
| 1093 new_primary->is_primary = true; | 1099 new_primary->is_primary = true; |
| 1094 DVLOG(1) << "New primary config. orbit: " | 1100 DVLOG(1) << "New primary config. orbit: " |
| 1095 << QuicUtils::HexEncode( | 1101 << QuicUtils::HexEncode( |
| 1096 reinterpret_cast<const char*>(primary_config_->orbit), | 1102 reinterpret_cast<const char*>(primary_config_->orbit), |
| 1097 kOrbitSize); | 1103 kOrbitSize); |
| 1098 if (primary_config_changed_cb_.get() != nullptr) { | 1104 if (primary_config_changed_cb_.get() != nullptr) { |
| 1099 primary_config_changed_cb_->Run(primary_config_->id); | 1105 primary_config_changed_cb_->Run(primary_config_->id); |
| 1100 } | 1106 } |
| 1101 | 1107 |
| 1102 return; | 1108 return; |
| 1103 } | 1109 } |
| 1104 | 1110 |
| 1105 // All config's primary times are in the past. We should make the most recent | 1111 // All config's primary times are in the past. We should make the most recent |
| 1106 // and highest priority candidate primary. | 1112 // and highest priority candidate primary. |
| 1107 scoped_refptr<Config> new_primary = best_candidate; | 1113 QuicReferenceCountedPointer<Config> new_primary = best_candidate; |
| 1108 if (primary_config_.get()) { | 1114 if (primary_config_) { |
| 1109 primary_config_->is_primary = false; | 1115 primary_config_->is_primary = false; |
| 1110 } | 1116 } |
| 1111 primary_config_ = new_primary; | 1117 primary_config_ = new_primary; |
| 1112 new_primary->is_primary = true; | 1118 new_primary->is_primary = true; |
| 1113 DVLOG(1) << "New primary config. orbit: " | 1119 DVLOG(1) << "New primary config. orbit: " |
| 1114 << QuicUtils::HexEncode( | 1120 << QuicUtils::HexEncode( |
| 1115 reinterpret_cast<const char*>(primary_config_->orbit), | 1121 reinterpret_cast<const char*>(primary_config_->orbit), |
| 1116 kOrbitSize) | 1122 kOrbitSize) |
| 1117 << " scid: " << QuicUtils::HexEncode(primary_config_->id); | 1123 << " scid: " << QuicUtils::HexEncode(primary_config_->id); |
| 1118 next_config_promotion_time_ = QuicWallTime::Zero(); | 1124 next_config_promotion_time_ = QuicWallTime::Zero(); |
| 1119 if (primary_config_changed_cb_.get() != nullptr) { | 1125 if (primary_config_changed_cb_.get() != nullptr) { |
| 1120 primary_config_changed_cb_->Run(primary_config_->id); | 1126 primary_config_changed_cb_->Run(primary_config_->id); |
| 1121 } | 1127 } |
| 1122 } | 1128 } |
| 1123 | 1129 |
| 1124 class QuicCryptoServerConfig::EvaluateClientHelloCallback | 1130 class QuicCryptoServerConfig::EvaluateClientHelloCallback |
| 1125 : public ProofSource::Callback { | 1131 : public ProofSource::Callback { |
| 1126 public: | 1132 public: |
| 1127 EvaluateClientHelloCallback( | 1133 EvaluateClientHelloCallback( |
| 1128 const QuicCryptoServerConfig& config, | 1134 const QuicCryptoServerConfig& config, |
| 1129 bool found_error, | 1135 bool found_error, |
| 1130 const QuicIpAddress& server_ip, | 1136 const QuicIpAddress& server_ip, |
| 1131 QuicVersion version, | 1137 QuicVersion version, |
| 1132 scoped_refptr<QuicCryptoServerConfig::Config> requested_config, | 1138 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1133 scoped_refptr<QuicCryptoServerConfig::Config> primary_config, | 1139 requested_config, |
| 1134 scoped_refptr<QuicSignedServerConfig> signed_config, | 1140 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1135 scoped_refptr<ValidateClientHelloResultCallback::Result> | 1141 primary_config, |
| 1142 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 1143 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1136 client_hello_state, | 1144 client_hello_state, |
| 1137 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) | 1145 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) |
| 1138 : config_(config), | 1146 : config_(config), |
| 1139 found_error_(found_error), | 1147 found_error_(found_error), |
| 1140 server_ip_(server_ip), | 1148 server_ip_(server_ip), |
| 1141 version_(version), | 1149 version_(version), |
| 1142 requested_config_(std::move(requested_config)), | 1150 requested_config_(std::move(requested_config)), |
| 1143 primary_config_(std::move(primary_config)), | 1151 primary_config_(std::move(primary_config)), |
| 1144 signed_config_(signed_config), | 1152 signed_config_(signed_config), |
| 1145 client_hello_state_(std::move(client_hello_state)), | 1153 client_hello_state_(std::move(client_hello_state)), |
| 1146 done_cb_(std::move(done_cb)) {} | 1154 done_cb_(std::move(done_cb)) {} |
| 1147 | 1155 |
| 1148 void Run(bool ok, | 1156 void Run(bool ok, |
| 1149 const scoped_refptr<ProofSource::Chain>& chain, | 1157 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
| 1150 const QuicCryptoProof& proof, | 1158 const QuicCryptoProof& proof, |
| 1151 std::unique_ptr<ProofSource::Details> details) override { | 1159 std::unique_ptr<ProofSource::Details> details) override { |
| 1152 if (ok) { | 1160 if (ok) { |
| 1153 signed_config_->chain = chain; | 1161 signed_config_->chain = chain; |
| 1154 signed_config_->proof = proof; | 1162 signed_config_->proof = proof; |
| 1155 } | 1163 } |
| 1156 config_.EvaluateClientHelloAfterGetProof( | 1164 config_.EvaluateClientHelloAfterGetProof( |
| 1157 found_error_, server_ip_, version_, requested_config_, primary_config_, | 1165 found_error_, server_ip_, version_, requested_config_, primary_config_, |
| 1158 signed_config_, std::move(details), !ok, client_hello_state_, | 1166 signed_config_, std::move(details), !ok, client_hello_state_, |
| 1159 std::move(done_cb_)); | 1167 std::move(done_cb_)); |
| 1160 } | 1168 } |
| 1161 | 1169 |
| 1162 private: | 1170 private: |
| 1163 const QuicCryptoServerConfig& config_; | 1171 const QuicCryptoServerConfig& config_; |
| 1164 const bool found_error_; | 1172 const bool found_error_; |
| 1165 const QuicIpAddress& server_ip_; | 1173 const QuicIpAddress& server_ip_; |
| 1166 const QuicVersion version_; | 1174 const QuicVersion version_; |
| 1167 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; | 1175 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1168 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; | 1176 requested_config_; |
| 1169 scoped_refptr<QuicSignedServerConfig> signed_config_; | 1177 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1170 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state_; | 1178 primary_config_; |
| 1179 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config_; |
| 1180 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1181 client_hello_state_; |
| 1171 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; | 1182 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; |
| 1172 }; | 1183 }; |
| 1173 | 1184 |
| 1174 void QuicCryptoServerConfig::EvaluateClientHello( | 1185 void QuicCryptoServerConfig::EvaluateClientHello( |
| 1175 const QuicSocketAddress& server_address, | 1186 const QuicSocketAddress& server_address, |
| 1176 QuicVersion version, | 1187 QuicVersion version, |
| 1177 scoped_refptr<Config> requested_config, | 1188 QuicReferenceCountedPointer<Config> requested_config, |
| 1178 scoped_refptr<Config> primary_config, | 1189 QuicReferenceCountedPointer<Config> primary_config, |
| 1179 scoped_refptr<QuicSignedServerConfig> signed_config, | 1190 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 1180 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1191 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1192 client_hello_state, |
| 1181 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1193 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 1182 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1194 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
| 1183 | 1195 |
| 1184 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1196 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
| 1185 ClientHelloInfo* info = &(client_hello_state->info); | 1197 ClientHelloInfo* info = &(client_hello_state->info); |
| 1186 | 1198 |
| 1187 if (client_hello.size() < kClientHelloMinimumSize) { | 1199 if (client_hello.size() < kClientHelloMinimumSize) { |
| 1188 helper.ValidationComplete(QUIC_CRYPTO_INVALID_VALUE_LENGTH, | 1200 helper.ValidationComplete(QUIC_CRYPTO_INVALID_VALUE_LENGTH, |
| 1189 "Client hello too small", nullptr); | 1201 "Client hello too small", nullptr); |
| 1190 return; | 1202 return; |
| (...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1291 found_error, server_address.host(), version, requested_config, | 1303 found_error, server_address.host(), version, requested_config, |
| 1292 primary_config, signed_config, nullptr /* proof_source_details */, | 1304 primary_config, signed_config, nullptr /* proof_source_details */, |
| 1293 get_proof_failed, client_hello_state, std::move(done_cb)); | 1305 get_proof_failed, client_hello_state, std::move(done_cb)); |
| 1294 helper.DetachCallback(); | 1306 helper.DetachCallback(); |
| 1295 } | 1307 } |
| 1296 | 1308 |
| 1297 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( | 1309 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( |
| 1298 bool found_error, | 1310 bool found_error, |
| 1299 const QuicIpAddress& server_ip, | 1311 const QuicIpAddress& server_ip, |
| 1300 QuicVersion version, | 1312 QuicVersion version, |
| 1301 scoped_refptr<Config> requested_config, | 1313 QuicReferenceCountedPointer<Config> requested_config, |
| 1302 scoped_refptr<Config> primary_config, | 1314 QuicReferenceCountedPointer<Config> primary_config, |
| 1303 scoped_refptr<QuicSignedServerConfig> signed_config, | 1315 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 1304 std::unique_ptr<ProofSource::Details> proof_source_details, | 1316 std::unique_ptr<ProofSource::Details> proof_source_details, |
| 1305 bool get_proof_failed, | 1317 bool get_proof_failed, |
| 1306 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1318 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1319 client_hello_state, |
| 1307 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1320 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
| 1308 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1321 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
| 1309 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1322 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
| 1310 ClientHelloInfo* info = &(client_hello_state->info); | 1323 ClientHelloInfo* info = &(client_hello_state->info); |
| 1311 | 1324 |
| 1312 if (get_proof_failed) { | 1325 if (get_proof_failed) { |
| 1313 info->reject_reasons.push_back(SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE); | 1326 info->reject_reasons.push_back(SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE); |
| 1314 } | 1327 } |
| 1315 | 1328 |
| 1316 if (!ValidateExpectedLeafCertificate(client_hello, *signed_config)) { | 1329 if (!ValidateExpectedLeafCertificate(client_hello, *signed_config)) { |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1362 *primary_config_, previous_source_address_tokens, client_ip, rand, | 1375 *primary_config_, previous_source_address_tokens, client_ip, rand, |
| 1363 clock->WallNow(), cached_network_params); | 1376 clock->WallNow(), cached_network_params); |
| 1364 } | 1377 } |
| 1365 | 1378 |
| 1366 out->set_tag(kSCUP); | 1379 out->set_tag(kSCUP); |
| 1367 out->SetStringPiece(kSCFG, serialized); | 1380 out->SetStringPiece(kSCFG, serialized); |
| 1368 out->SetStringPiece(kSourceAddressTokenTag, source_address_token); | 1381 out->SetStringPiece(kSourceAddressTokenTag, source_address_token); |
| 1369 out->SetValue(kSTTL, | 1382 out->SetValue(kSTTL, |
| 1370 expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds()); | 1383 expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds()); |
| 1371 | 1384 |
| 1372 scoped_refptr<ProofSource::Chain> chain; | 1385 QuicReferenceCountedPointer<ProofSource::Chain> chain; |
| 1373 QuicCryptoProof proof; | 1386 QuicCryptoProof proof; |
| 1374 if (!proof_source_->GetProof(server_address, params.sni, serialized, version, | 1387 if (!proof_source_->GetProof(server_address, params.sni, serialized, version, |
| 1375 chlo_hash, connection_options, &chain, &proof)) { | 1388 chlo_hash, connection_options, &chain, &proof)) { |
| 1376 DVLOG(1) << "Server: failed to get proof."; | 1389 DVLOG(1) << "Server: failed to get proof."; |
| 1377 return false; | 1390 return false; |
| 1378 } | 1391 } |
| 1379 | 1392 |
| 1380 const string compressed = CompressChain( | 1393 const string compressed = CompressChain( |
| 1381 compressed_certs_cache, chain, params.client_common_set_hashes, | 1394 compressed_certs_cache, chain, params.client_common_set_hashes, |
| 1382 params.client_cached_cert_hashes, common_cert_sets); | 1395 params.client_cached_cert_hashes, common_cert_sets); |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1457 compressed_certs_cache_(compressed_certs_cache), | 1470 compressed_certs_cache_(compressed_certs_cache), |
| 1458 common_cert_sets_(common_cert_sets), | 1471 common_cert_sets_(common_cert_sets), |
| 1459 client_common_set_hashes_(params.client_common_set_hashes), | 1472 client_common_set_hashes_(params.client_common_set_hashes), |
| 1460 client_cached_cert_hashes_(params.client_cached_cert_hashes), | 1473 client_cached_cert_hashes_(params.client_cached_cert_hashes), |
| 1461 sct_supported_by_client_(params.sct_supported_by_client), | 1474 sct_supported_by_client_(params.sct_supported_by_client), |
| 1462 message_(std::move(message)), | 1475 message_(std::move(message)), |
| 1463 cb_(std::move(cb)) {} | 1476 cb_(std::move(cb)) {} |
| 1464 | 1477 |
| 1465 void QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback:: | 1478 void QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback:: |
| 1466 Run(bool ok, | 1479 Run(bool ok, |
| 1467 const scoped_refptr<ProofSource::Chain>& chain, | 1480 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
| 1468 const QuicCryptoProof& proof, | 1481 const QuicCryptoProof& proof, |
| 1469 std::unique_ptr<ProofSource::Details> details) { | 1482 std::unique_ptr<ProofSource::Details> details) { |
| 1470 config_->FinishBuildServerConfigUpdateMessage( | 1483 config_->FinishBuildServerConfigUpdateMessage( |
| 1471 version_, compressed_certs_cache_, common_cert_sets_, | 1484 version_, compressed_certs_cache_, common_cert_sets_, |
| 1472 client_common_set_hashes_, client_cached_cert_hashes_, | 1485 client_common_set_hashes_, client_cached_cert_hashes_, |
| 1473 sct_supported_by_client_, ok, chain, proof.signature, | 1486 sct_supported_by_client_, ok, chain, proof.signature, |
| 1474 proof.leaf_cert_scts, std::move(details), std::move(message_), | 1487 proof.leaf_cert_scts, std::move(details), std::move(message_), |
| 1475 std::move(cb_)); | 1488 std::move(cb_)); |
| 1476 } | 1489 } |
| 1477 | 1490 |
| 1478 void QuicCryptoServerConfig::FinishBuildServerConfigUpdateMessage( | 1491 void QuicCryptoServerConfig::FinishBuildServerConfigUpdateMessage( |
| 1479 QuicVersion version, | 1492 QuicVersion version, |
| 1480 QuicCompressedCertsCache* compressed_certs_cache, | 1493 QuicCompressedCertsCache* compressed_certs_cache, |
| 1481 const CommonCertSets* common_cert_sets, | 1494 const CommonCertSets* common_cert_sets, |
| 1482 const string& client_common_set_hashes, | 1495 const string& client_common_set_hashes, |
| 1483 const string& client_cached_cert_hashes, | 1496 const string& client_cached_cert_hashes, |
| 1484 bool sct_supported_by_client, | 1497 bool sct_supported_by_client, |
| 1485 bool ok, | 1498 bool ok, |
| 1486 const scoped_refptr<ProofSource::Chain>& chain, | 1499 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
| 1487 const string& signature, | 1500 const string& signature, |
| 1488 const string& leaf_cert_sct, | 1501 const string& leaf_cert_sct, |
| 1489 std::unique_ptr<ProofSource::Details> details, | 1502 std::unique_ptr<ProofSource::Details> details, |
| 1490 CryptoHandshakeMessage message, | 1503 CryptoHandshakeMessage message, |
| 1491 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const { | 1504 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const { |
| 1492 if (!ok) { | 1505 if (!ok) { |
| 1493 cb->Run(false, message); | 1506 cb->Run(false, message); |
| 1494 return; | 1507 return; |
| 1495 } | 1508 } |
| 1496 | 1509 |
| (...skipping 18 matching lines...) Expand all Loading... |
| 1515 QuicVersion version, | 1528 QuicVersion version, |
| 1516 QuicWallTime now, | 1529 QuicWallTime now, |
| 1517 const Config& config, | 1530 const Config& config, |
| 1518 const CryptoHandshakeMessage& client_hello, | 1531 const CryptoHandshakeMessage& client_hello, |
| 1519 const ClientHelloInfo& info, | 1532 const ClientHelloInfo& info, |
| 1520 const CachedNetworkParameters& cached_network_params, | 1533 const CachedNetworkParameters& cached_network_params, |
| 1521 bool use_stateless_rejects, | 1534 bool use_stateless_rejects, |
| 1522 QuicConnectionId server_designated_connection_id, | 1535 QuicConnectionId server_designated_connection_id, |
| 1523 QuicRandom* rand, | 1536 QuicRandom* rand, |
| 1524 QuicCompressedCertsCache* compressed_certs_cache, | 1537 QuicCompressedCertsCache* compressed_certs_cache, |
| 1525 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 1538 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
| 1526 const QuicSignedServerConfig& signed_config, | 1539 const QuicSignedServerConfig& signed_config, |
| 1527 QuicByteCount total_framing_overhead, | 1540 QuicByteCount total_framing_overhead, |
| 1528 QuicByteCount chlo_packet_size, | 1541 QuicByteCount chlo_packet_size, |
| 1529 CryptoHandshakeMessage* out) const { | 1542 CryptoHandshakeMessage* out) const { |
| 1530 if (FLAGS_enable_quic_stateless_reject_support && use_stateless_rejects) { | 1543 if (FLAGS_enable_quic_stateless_reject_support && use_stateless_rejects) { |
| 1531 DVLOG(1) << "QUIC Crypto server config returning stateless reject " | 1544 DVLOG(1) << "QUIC Crypto server config returning stateless reject " |
| 1532 << "with server-designated connection ID " | 1545 << "with server-designated connection ID " |
| 1533 << server_designated_connection_id; | 1546 << server_designated_connection_id; |
| 1534 out->set_tag(kSREJ); | 1547 out->set_tag(kSREJ); |
| 1535 out->SetValue(kRCID, server_designated_connection_id); | 1548 out->SetValue(kRCID, server_designated_connection_id); |
| (...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1608 DLOG(WARNING) << "Sending inchoate REJ for hostname: " << info.sni | 1621 DLOG(WARNING) << "Sending inchoate REJ for hostname: " << info.sni |
| 1609 << " signature: " << signed_config.proof.signature.size() | 1622 << " signature: " << signed_config.proof.signature.size() |
| 1610 << " cert: " << compressed.size() << " sct:" << sct_size | 1623 << " cert: " << compressed.size() << " sct:" << sct_size |
| 1611 << " total: " << total_size | 1624 << " total: " << total_size |
| 1612 << " max: " << max_unverified_size; | 1625 << " max: " << max_unverified_size; |
| 1613 } | 1626 } |
| 1614 } | 1627 } |
| 1615 | 1628 |
| 1616 string QuicCryptoServerConfig::CompressChain( | 1629 string QuicCryptoServerConfig::CompressChain( |
| 1617 QuicCompressedCertsCache* compressed_certs_cache, | 1630 QuicCompressedCertsCache* compressed_certs_cache, |
| 1618 const scoped_refptr<ProofSource::Chain>& chain, | 1631 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
| 1619 const string& client_common_set_hashes, | 1632 const string& client_common_set_hashes, |
| 1620 const string& client_cached_cert_hashes, | 1633 const string& client_cached_cert_hashes, |
| 1621 const CommonCertSets* common_sets) { | 1634 const CommonCertSets* common_sets) { |
| 1622 // Check whether the compressed certs is available in the cache. | 1635 // Check whether the compressed certs is available in the cache. |
| 1623 DCHECK(compressed_certs_cache); | 1636 DCHECK(compressed_certs_cache); |
| 1624 const string* cached_value = compressed_certs_cache->GetCompressedCert( | 1637 const string* cached_value = compressed_certs_cache->GetCompressedCert( |
| 1625 chain, client_common_set_hashes, client_cached_cert_hashes); | 1638 chain, client_common_set_hashes, client_cached_cert_hashes); |
| 1626 if (cached_value) { | 1639 if (cached_value) { |
| 1627 return *cached_value; | 1640 return *cached_value; |
| 1628 } | 1641 } |
| 1629 | 1642 |
| 1630 const string compressed = | 1643 const string compressed = |
| 1631 CertCompressor::CompressChain(chain->certs, client_common_set_hashes, | 1644 CertCompressor::CompressChain(chain->certs, client_common_set_hashes, |
| 1632 client_common_set_hashes, common_sets); | 1645 client_common_set_hashes, common_sets); |
| 1633 | 1646 |
| 1634 // Insert the newly compressed cert to cache. | 1647 // Insert the newly compressed cert to cache. |
| 1635 compressed_certs_cache->Insert(chain, client_common_set_hashes, | 1648 compressed_certs_cache->Insert(chain, client_common_set_hashes, |
| 1636 client_cached_cert_hashes, compressed); | 1649 client_cached_cert_hashes, compressed); |
| 1637 return compressed; | 1650 return compressed; |
| 1638 } | 1651 } |
| 1639 | 1652 |
| 1640 scoped_refptr<QuicCryptoServerConfig::Config> | 1653 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 1641 QuicCryptoServerConfig::ParseConfigProtobuf( | 1654 QuicCryptoServerConfig::ParseConfigProtobuf( |
| 1642 const std::unique_ptr<QuicServerConfigProtobuf>& protobuf) { | 1655 const std::unique_ptr<QuicServerConfigProtobuf>& protobuf) { |
| 1643 std::unique_ptr<CryptoHandshakeMessage> msg( | 1656 std::unique_ptr<CryptoHandshakeMessage> msg( |
| 1644 CryptoFramer::ParseMessage(protobuf->config())); | 1657 CryptoFramer::ParseMessage(protobuf->config())); |
| 1645 | 1658 |
| 1646 if (msg->tag() != kSCFG) { | 1659 if (msg->tag() != kSCFG) { |
| 1647 LOG(WARNING) << "Server config message has tag " << msg->tag() | 1660 LOG(WARNING) << "Server config message has tag " << msg->tag() |
| 1648 << " expected " << kSCFG; | 1661 << " expected " << kSCFG; |
| 1649 return nullptr; | 1662 return nullptr; |
| 1650 } | 1663 } |
| 1651 | 1664 |
| 1652 scoped_refptr<Config> config(new Config); | 1665 QuicReferenceCountedPointer<Config> config(new Config); |
| 1653 config->serialized = protobuf->config(); | 1666 config->serialized = protobuf->config(); |
| 1654 config->source_address_token_boxer = &source_address_token_boxer_; | 1667 config->source_address_token_boxer = &source_address_token_boxer_; |
| 1655 | 1668 |
| 1656 if (protobuf->has_primary_time()) { | 1669 if (protobuf->has_primary_time()) { |
| 1657 config->primary_time = | 1670 config->primary_time = |
| 1658 QuicWallTime::FromUNIXSeconds(protobuf->primary_time()); | 1671 QuicWallTime::FromUNIXSeconds(protobuf->primary_time()); |
| 1659 } | 1672 } |
| 1660 | 1673 |
| 1661 config->priority = protobuf->priority(); | 1674 config->priority = protobuf->priority(); |
| 1662 | 1675 |
| (...skipping 349 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2012 priority(0), | 2025 priority(0), |
| 2013 source_address_token_boxer(nullptr) {} | 2026 source_address_token_boxer(nullptr) {} |
| 2014 | 2027 |
| 2015 QuicCryptoServerConfig::Config::~Config() { | 2028 QuicCryptoServerConfig::Config::~Config() { |
| 2016 } | 2029 } |
| 2017 | 2030 |
| 2018 QuicSignedServerConfig::QuicSignedServerConfig() {} | 2031 QuicSignedServerConfig::QuicSignedServerConfig() {} |
| 2019 QuicSignedServerConfig::~QuicSignedServerConfig() {} | 2032 QuicSignedServerConfig::~QuicSignedServerConfig() {} |
| 2020 | 2033 |
| 2021 } // namespace net | 2034 } // namespace net |
| OLD | NEW |