OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/core/crypto/quic_crypto_server_config.h" | 5 #include "net/quic/core/crypto/quic_crypto_server_config.h" |
6 | 6 |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 | 8 |
9 #include <algorithm> | 9 #include <algorithm> |
10 #include <memory> | 10 #include <memory> |
11 | 11 |
12 #include "base/macros.h" | 12 #include "base/macros.h" |
13 #include "base/memory/ref_counted.h" | |
14 #include "crypto/hkdf.h" | 13 #include "crypto/hkdf.h" |
15 #include "crypto/secure_hash.h" | 14 #include "crypto/secure_hash.h" |
16 #include "net/base/ip_address.h" | 15 #include "net/base/ip_address.h" |
17 #include "net/quic/core/crypto/aes_128_gcm_12_decrypter.h" | 16 #include "net/quic/core/crypto/aes_128_gcm_12_decrypter.h" |
18 #include "net/quic/core/crypto/aes_128_gcm_12_encrypter.h" | 17 #include "net/quic/core/crypto/aes_128_gcm_12_encrypter.h" |
19 #include "net/quic/core/crypto/cert_compressor.h" | 18 #include "net/quic/core/crypto/cert_compressor.h" |
20 #include "net/quic/core/crypto/chacha20_poly1305_encrypter.h" | 19 #include "net/quic/core/crypto/chacha20_poly1305_encrypter.h" |
21 #include "net/quic/core/crypto/channel_id.h" | 20 #include "net/quic/core/crypto/channel_id.h" |
22 #include "net/quic/core/crypto/crypto_framer.h" | 21 #include "net/quic/core/crypto/crypto_framer.h" |
23 #include "net/quic/core/crypto/crypto_handshake_message.h" | 22 #include "net/quic/core/crypto/crypto_handshake_message.h" |
24 #include "net/quic/core/crypto/crypto_server_config_protobuf.h" | 23 #include "net/quic/core/crypto/crypto_server_config_protobuf.h" |
25 #include "net/quic/core/crypto/crypto_utils.h" | 24 #include "net/quic/core/crypto/crypto_utils.h" |
26 #include "net/quic/core/crypto/curve25519_key_exchange.h" | 25 #include "net/quic/core/crypto/curve25519_key_exchange.h" |
27 #include "net/quic/core/crypto/ephemeral_key_source.h" | 26 #include "net/quic/core/crypto/ephemeral_key_source.h" |
28 #include "net/quic/core/crypto/key_exchange.h" | 27 #include "net/quic/core/crypto/key_exchange.h" |
29 #include "net/quic/core/crypto/p256_key_exchange.h" | 28 #include "net/quic/core/crypto/p256_key_exchange.h" |
30 #include "net/quic/core/crypto/proof_source.h" | 29 #include "net/quic/core/crypto/proof_source.h" |
31 #include "net/quic/core/crypto/quic_decrypter.h" | 30 #include "net/quic/core/crypto/quic_decrypter.h" |
32 #include "net/quic/core/crypto/quic_encrypter.h" | 31 #include "net/quic/core/crypto/quic_encrypter.h" |
33 #include "net/quic/core/crypto/quic_random.h" | 32 #include "net/quic/core/crypto/quic_random.h" |
34 #include "net/quic/core/proto/source_address_token.pb.h" | 33 #include "net/quic/core/proto/source_address_token.pb.h" |
35 #include "net/quic/core/quic_bug_tracker.h" | 34 #include "net/quic/core/quic_bug_tracker.h" |
36 #include "net/quic/core/quic_flags.h" | 35 #include "net/quic/core/quic_flags.h" |
37 #include "net/quic/core/quic_packets.h" | 36 #include "net/quic/core/quic_packets.h" |
38 #include "net/quic/core/quic_socket_address_coder.h" | 37 #include "net/quic/core/quic_socket_address_coder.h" |
39 #include "net/quic/core/quic_utils.h" | 38 #include "net/quic/core/quic_utils.h" |
40 #include "net/quic/platform/api/quic_clock.h" | 39 #include "net/quic/platform/api/quic_clock.h" |
| 40 #include "net/quic/platform/api/quic_reference_counted.h" |
41 | 41 |
42 using base::StringPiece; | 42 using base::StringPiece; |
43 using crypto::SecureHash; | 43 using crypto::SecureHash; |
44 using std::string; | 44 using std::string; |
45 | 45 |
46 namespace net { | 46 namespace net { |
47 | 47 |
48 namespace { | 48 namespace { |
49 | 49 |
50 // kMultiplier is the multiple of the CHLO message size that a REJ message | 50 // kMultiplier is the multiple of the CHLO message size that a REJ message |
(...skipping 12 matching lines...) Expand all Loading... |
63 return hkdf.server_write_key().as_string(); | 63 return hkdf.server_write_key().as_string(); |
64 } | 64 } |
65 | 65 |
66 } // namespace | 66 } // namespace |
67 | 67 |
68 class ValidateClientHelloHelper { | 68 class ValidateClientHelloHelper { |
69 public: | 69 public: |
70 // Note: stores a pointer to a unique_ptr, and std::moves the unique_ptr when | 70 // Note: stores a pointer to a unique_ptr, and std::moves the unique_ptr when |
71 // ValidationComplete is called. | 71 // ValidationComplete is called. |
72 ValidateClientHelloHelper( | 72 ValidateClientHelloHelper( |
73 scoped_refptr<ValidateClientHelloResultCallback::Result> result, | 73 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 74 result, |
74 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb) | 75 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb) |
75 : result_(std::move(result)), done_cb_(done_cb) {} | 76 : result_(std::move(result)), done_cb_(done_cb) {} |
76 | 77 |
77 ~ValidateClientHelloHelper() { | 78 ~ValidateClientHelloHelper() { |
78 QUIC_BUG_IF(done_cb_ != nullptr) | 79 QUIC_BUG_IF(done_cb_ != nullptr) |
79 << "Deleting ValidateClientHelloHelper with a pending callback."; | 80 << "Deleting ValidateClientHelloHelper with a pending callback."; |
80 } | 81 } |
81 | 82 |
82 void ValidationComplete( | 83 void ValidationComplete( |
83 QuicErrorCode error_code, | 84 QuicErrorCode error_code, |
84 const char* error_details, | 85 const char* error_details, |
85 std::unique_ptr<ProofSource::Details> proof_source_details) { | 86 std::unique_ptr<ProofSource::Details> proof_source_details) { |
86 result_->error_code = error_code; | 87 result_->error_code = error_code; |
87 result_->error_details = error_details; | 88 result_->error_details = error_details; |
88 (*done_cb_)->Run(std::move(result_), std::move(proof_source_details)); | 89 (*done_cb_)->Run(std::move(result_), std::move(proof_source_details)); |
89 DetachCallback(); | 90 DetachCallback(); |
90 } | 91 } |
91 | 92 |
92 void DetachCallback() { | 93 void DetachCallback() { |
93 QUIC_BUG_IF(done_cb_ == nullptr) << "Callback already detached."; | 94 QUIC_BUG_IF(done_cb_ == nullptr) << "Callback already detached."; |
94 done_cb_ = nullptr; | 95 done_cb_ = nullptr; |
95 } | 96 } |
96 | 97 |
97 private: | 98 private: |
98 scoped_refptr<ValidateClientHelloResultCallback::Result> result_; | 99 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 100 result_; |
99 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb_; | 101 std::unique_ptr<ValidateClientHelloResultCallback>* done_cb_; |
100 | 102 |
101 DISALLOW_COPY_AND_ASSIGN(ValidateClientHelloHelper); | 103 DISALLOW_COPY_AND_ASSIGN(ValidateClientHelloHelper); |
102 }; | 104 }; |
103 | 105 |
104 // static | 106 // static |
105 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing"; | 107 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing"; |
106 | 108 |
107 ClientHelloInfo::ClientHelloInfo(const QuicIpAddress& in_client_ip, | 109 ClientHelloInfo::ClientHelloInfo(const QuicIpAddress& in_client_ip, |
108 QuicWallTime in_now) | 110 QuicWallTime in_now) |
(...skipping 186 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
295 std::unique_ptr<QuicServerConfigProtobuf> protobuf, | 297 std::unique_ptr<QuicServerConfigProtobuf> protobuf, |
296 const QuicWallTime now) { | 298 const QuicWallTime now) { |
297 std::unique_ptr<CryptoHandshakeMessage> msg( | 299 std::unique_ptr<CryptoHandshakeMessage> msg( |
298 CryptoFramer::ParseMessage(protobuf->config())); | 300 CryptoFramer::ParseMessage(protobuf->config())); |
299 | 301 |
300 if (!msg.get()) { | 302 if (!msg.get()) { |
301 LOG(WARNING) << "Failed to parse server config message"; | 303 LOG(WARNING) << "Failed to parse server config message"; |
302 return nullptr; | 304 return nullptr; |
303 } | 305 } |
304 | 306 |
305 scoped_refptr<Config> config(ParseConfigProtobuf(protobuf)); | 307 QuicReferenceCountedPointer<Config> config(ParseConfigProtobuf(protobuf)); |
306 if (!config.get()) { | 308 if (!config.get()) { |
307 LOG(WARNING) << "Failed to parse server config message"; | 309 LOG(WARNING) << "Failed to parse server config message"; |
308 return nullptr; | 310 return nullptr; |
309 } | 311 } |
310 | 312 |
311 { | 313 { |
312 QuicWriterMutexLock locked(&configs_lock_); | 314 QuicWriterMutexLock locked(&configs_lock_); |
313 if (configs_.find(config->id) != configs_.end()) { | 315 if (configs_.find(config->id) != configs_.end()) { |
314 LOG(WARNING) << "Failed to add config because another with the same " | 316 LOG(WARNING) << "Failed to add config because another with the same " |
315 "server config id already exists: " | 317 "server config id already exists: " |
(...skipping 14 matching lines...) Expand all Loading... |
330 CryptoHandshakeMessage* QuicCryptoServerConfig::AddDefaultConfig( | 332 CryptoHandshakeMessage* QuicCryptoServerConfig::AddDefaultConfig( |
331 QuicRandom* rand, | 333 QuicRandom* rand, |
332 const QuicClock* clock, | 334 const QuicClock* clock, |
333 const ConfigOptions& options) { | 335 const ConfigOptions& options) { |
334 return AddConfig(GenerateConfig(rand, clock, options), clock->WallNow()); | 336 return AddConfig(GenerateConfig(rand, clock, options), clock->WallNow()); |
335 } | 337 } |
336 | 338 |
337 bool QuicCryptoServerConfig::SetConfigs( | 339 bool QuicCryptoServerConfig::SetConfigs( |
338 const std::vector<std::unique_ptr<QuicServerConfigProtobuf>>& protobufs, | 340 const std::vector<std::unique_ptr<QuicServerConfigProtobuf>>& protobufs, |
339 const QuicWallTime now) { | 341 const QuicWallTime now) { |
340 std::vector<scoped_refptr<Config>> parsed_configs; | 342 std::vector<QuicReferenceCountedPointer<Config>> parsed_configs; |
341 bool ok = true; | 343 bool ok = true; |
342 | 344 |
343 for (auto& protobuf : protobufs) { | 345 for (auto& protobuf : protobufs) { |
344 scoped_refptr<Config> config(ParseConfigProtobuf(protobuf)); | 346 QuicReferenceCountedPointer<Config> config(ParseConfigProtobuf(protobuf)); |
345 if (!config.get()) { | 347 if (!config) { |
346 ok = false; | 348 ok = false; |
347 break; | 349 break; |
348 } | 350 } |
349 | 351 |
350 parsed_configs.push_back(config); | 352 parsed_configs.push_back(config); |
351 } | 353 } |
352 | 354 |
353 if (parsed_configs.empty()) { | 355 if (parsed_configs.empty()) { |
354 LOG(WARNING) << "New config list is empty."; | 356 LOG(WARNING) << "New config list is empty."; |
355 ok = false; | 357 ok = false; |
356 } | 358 } |
357 | 359 |
358 if (!ok) { | 360 if (!ok) { |
359 LOG(WARNING) << "Rejecting QUIC configs because of above errors"; | 361 LOG(WARNING) << "Rejecting QUIC configs because of above errors"; |
360 } else { | 362 } else { |
361 VLOG(1) << "Updating configs:"; | 363 VLOG(1) << "Updating configs:"; |
362 | 364 |
363 QuicWriterMutexLock locked(&configs_lock_); | 365 QuicWriterMutexLock locked(&configs_lock_); |
364 ConfigMap new_configs; | 366 ConfigMap new_configs; |
365 | 367 |
366 for (std::vector<scoped_refptr<Config>>::const_iterator i = | 368 for (std::vector<QuicReferenceCountedPointer<Config>>::const_iterator i = |
367 parsed_configs.begin(); | 369 parsed_configs.begin(); |
368 i != parsed_configs.end(); ++i) { | 370 i != parsed_configs.end(); ++i) { |
369 scoped_refptr<Config> config = *i; | 371 QuicReferenceCountedPointer<Config> config = *i; |
370 | 372 |
371 ConfigMap::iterator it = configs_.find(config->id); | 373 ConfigMap::iterator it = configs_.find(config->id); |
372 if (it != configs_.end()) { | 374 if (it != configs_.end()) { |
373 VLOG(1) << "Keeping scid: " << QuicUtils::HexEncode(config->id) | 375 VLOG(1) << "Keeping scid: " << QuicUtils::HexEncode(config->id) |
374 << " orbit: " | 376 << " orbit: " |
375 << QuicUtils::HexEncode( | 377 << QuicUtils::HexEncode( |
376 reinterpret_cast<const char*>(config->orbit), kOrbitSize) | 378 reinterpret_cast<const char*>(config->orbit), kOrbitSize) |
377 << " new primary_time " << config->primary_time.ToUNIXSeconds() | 379 << " new primary_time " << config->primary_time.ToUNIXSeconds() |
378 << " old primary_time " | 380 << " old primary_time " |
379 << it->second->primary_time.ToUNIXSeconds() << " new priority " | 381 << it->second->primary_time.ToUNIXSeconds() << " new priority " |
(...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
415 scids->push_back(it->first); | 417 scids->push_back(it->first); |
416 } | 418 } |
417 } | 419 } |
418 | 420 |
419 void QuicCryptoServerConfig::ValidateClientHello( | 421 void QuicCryptoServerConfig::ValidateClientHello( |
420 const CryptoHandshakeMessage& client_hello, | 422 const CryptoHandshakeMessage& client_hello, |
421 const QuicIpAddress& client_ip, | 423 const QuicIpAddress& client_ip, |
422 const QuicSocketAddress& server_address, | 424 const QuicSocketAddress& server_address, |
423 QuicVersion version, | 425 QuicVersion version, |
424 const QuicClock* clock, | 426 const QuicClock* clock, |
425 scoped_refptr<QuicSignedServerConfig> signed_config, | 427 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
426 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 428 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
427 const QuicWallTime now(clock->WallNow()); | 429 const QuicWallTime now(clock->WallNow()); |
428 | 430 |
429 scoped_refptr<ValidateClientHelloResultCallback::Result> result( | 431 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> result( |
430 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, | 432 new ValidateClientHelloResultCallback::Result(client_hello, client_ip, |
431 now)); | 433 now)); |
432 | 434 |
433 StringPiece requested_scid; | 435 StringPiece requested_scid; |
434 client_hello.GetStringPiece(kSCID, &requested_scid); | 436 client_hello.GetStringPiece(kSCID, &requested_scid); |
435 | 437 |
436 scoped_refptr<Config> requested_config; | 438 QuicReferenceCountedPointer<Config> requested_config; |
437 scoped_refptr<Config> primary_config; | 439 QuicReferenceCountedPointer<Config> primary_config; |
438 { | 440 { |
439 QuicReaderMutexLock locked(&configs_lock_); | 441 QuicReaderMutexLock locked(&configs_lock_); |
440 | 442 |
441 if (!primary_config_.get()) { | 443 if (!primary_config_.get()) { |
442 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; | 444 result->error_code = QUIC_CRYPTO_INTERNAL_ERROR; |
443 result->error_details = "No configurations loaded"; | 445 result->error_details = "No configurations loaded"; |
444 } else { | 446 } else { |
445 if (!next_config_promotion_time_.IsZero() && | 447 if (!next_config_promotion_time_.IsZero() && |
446 next_config_promotion_time_.IsAfter(now)) { | 448 next_config_promotion_time_.IsAfter(now)) { |
447 configs_lock_.ReaderUnlock(); | 449 configs_lock_.ReaderUnlock(); |
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
505 | 507 |
506 private: | 508 private: |
507 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb_; | 509 std::unique_ptr<ProcessClientHelloResultCallback>* done_cb_; |
508 }; | 510 }; |
509 | 511 |
510 class QuicCryptoServerConfig::ProcessClientHelloCallback | 512 class QuicCryptoServerConfig::ProcessClientHelloCallback |
511 : public ProofSource::Callback { | 513 : public ProofSource::Callback { |
512 public: | 514 public: |
513 ProcessClientHelloCallback( | 515 ProcessClientHelloCallback( |
514 const QuicCryptoServerConfig* config, | 516 const QuicCryptoServerConfig* config, |
515 scoped_refptr<ValidateClientHelloResultCallback::Result> | 517 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
516 validate_chlo_result, | 518 validate_chlo_result, |
517 bool reject_only, | 519 bool reject_only, |
518 QuicConnectionId connection_id, | 520 QuicConnectionId connection_id, |
519 const QuicSocketAddress& client_address, | 521 const QuicSocketAddress& client_address, |
520 QuicVersion version, | 522 QuicVersion version, |
521 const QuicVersionVector& supported_versions, | 523 const QuicVersionVector& supported_versions, |
522 bool use_stateless_rejects, | 524 bool use_stateless_rejects, |
523 QuicConnectionId server_designated_connection_id, | 525 QuicConnectionId server_designated_connection_id, |
524 const QuicClock* clock, | 526 const QuicClock* clock, |
525 QuicRandom* rand, | 527 QuicRandom* rand, |
526 QuicCompressedCertsCache* compressed_certs_cache, | 528 QuicCompressedCertsCache* compressed_certs_cache, |
527 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 529 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
528 scoped_refptr<QuicSignedServerConfig> signed_config, | 530 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
529 QuicByteCount total_framing_overhead, | 531 QuicByteCount total_framing_overhead, |
530 QuicByteCount chlo_packet_size, | 532 QuicByteCount chlo_packet_size, |
531 const scoped_refptr<QuicCryptoServerConfig::Config>& requested_config, | 533 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config>& |
532 const scoped_refptr<QuicCryptoServerConfig::Config>& primary_config, | 534 requested_config, |
| 535 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config>& |
| 536 primary_config, |
533 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) | 537 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) |
534 : config_(config), | 538 : config_(config), |
535 validate_chlo_result_(std::move(validate_chlo_result)), | 539 validate_chlo_result_(std::move(validate_chlo_result)), |
536 reject_only_(reject_only), | 540 reject_only_(reject_only), |
537 connection_id_(connection_id), | 541 connection_id_(connection_id), |
538 client_address_(client_address), | 542 client_address_(client_address), |
539 version_(version), | 543 version_(version), |
540 supported_versions_(supported_versions), | 544 supported_versions_(supported_versions), |
541 use_stateless_rejects_(use_stateless_rejects), | 545 use_stateless_rejects_(use_stateless_rejects), |
542 server_designated_connection_id_(server_designated_connection_id), | 546 server_designated_connection_id_(server_designated_connection_id), |
543 clock_(clock), | 547 clock_(clock), |
544 rand_(rand), | 548 rand_(rand), |
545 compressed_certs_cache_(compressed_certs_cache), | 549 compressed_certs_cache_(compressed_certs_cache), |
546 params_(params), | 550 params_(params), |
547 signed_config_(signed_config), | 551 signed_config_(signed_config), |
548 total_framing_overhead_(total_framing_overhead), | 552 total_framing_overhead_(total_framing_overhead), |
549 chlo_packet_size_(chlo_packet_size), | 553 chlo_packet_size_(chlo_packet_size), |
550 requested_config_(requested_config), | 554 requested_config_(requested_config), |
551 primary_config_(primary_config), | 555 primary_config_(primary_config), |
552 done_cb_(std::move(done_cb)) {} | 556 done_cb_(std::move(done_cb)) {} |
553 | 557 |
554 void Run(bool ok, | 558 void Run(bool ok, |
555 const scoped_refptr<ProofSource::Chain>& chain, | 559 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
556 const QuicCryptoProof& proof, | 560 const QuicCryptoProof& proof, |
557 std::unique_ptr<ProofSource::Details> details) override { | 561 std::unique_ptr<ProofSource::Details> details) override { |
558 if (ok) { | 562 if (ok) { |
559 signed_config_->chain = chain; | 563 signed_config_->chain = chain; |
560 signed_config_->proof = proof; | 564 signed_config_->proof = proof; |
561 } | 565 } |
562 config_->ProcessClientHelloAfterGetProof( | 566 config_->ProcessClientHelloAfterGetProof( |
563 !ok, std::move(details), *validate_chlo_result_, reject_only_, | 567 !ok, std::move(details), *validate_chlo_result_, reject_only_, |
564 connection_id_, client_address_, version_, supported_versions_, | 568 connection_id_, client_address_, version_, supported_versions_, |
565 use_stateless_rejects_, server_designated_connection_id_, clock_, rand_, | 569 use_stateless_rejects_, server_designated_connection_id_, clock_, rand_, |
566 compressed_certs_cache_, params_, signed_config_, | 570 compressed_certs_cache_, params_, signed_config_, |
567 total_framing_overhead_, chlo_packet_size_, requested_config_, | 571 total_framing_overhead_, chlo_packet_size_, requested_config_, |
568 primary_config_, std::move(done_cb_)); | 572 primary_config_, std::move(done_cb_)); |
569 } | 573 } |
570 | 574 |
571 private: | 575 private: |
572 const QuicCryptoServerConfig* config_; | 576 const QuicCryptoServerConfig* config_; |
573 const scoped_refptr<ValidateClientHelloResultCallback::Result> | 577 const QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
574 validate_chlo_result_; | 578 validate_chlo_result_; |
575 const bool reject_only_; | 579 const bool reject_only_; |
576 const QuicConnectionId connection_id_; | 580 const QuicConnectionId connection_id_; |
577 const QuicSocketAddress client_address_; | 581 const QuicSocketAddress client_address_; |
578 const QuicVersion version_; | 582 const QuicVersion version_; |
579 const QuicVersionVector supported_versions_; | 583 const QuicVersionVector supported_versions_; |
580 const bool use_stateless_rejects_; | 584 const bool use_stateless_rejects_; |
581 const QuicConnectionId server_designated_connection_id_; | 585 const QuicConnectionId server_designated_connection_id_; |
582 const QuicClock* const clock_; | 586 const QuicClock* const clock_; |
583 QuicRandom* const rand_; | 587 QuicRandom* const rand_; |
584 QuicCompressedCertsCache* compressed_certs_cache_; | 588 QuicCompressedCertsCache* compressed_certs_cache_; |
585 scoped_refptr<QuicCryptoNegotiatedParameters> params_; | 589 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params_; |
586 scoped_refptr<QuicSignedServerConfig> signed_config_; | 590 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config_; |
587 const QuicByteCount total_framing_overhead_; | 591 const QuicByteCount total_framing_overhead_; |
588 const QuicByteCount chlo_packet_size_; | 592 const QuicByteCount chlo_packet_size_; |
589 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; | 593 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
590 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; | 594 requested_config_; |
| 595 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
| 596 primary_config_; |
591 std::unique_ptr<ProcessClientHelloResultCallback> done_cb_; | 597 std::unique_ptr<ProcessClientHelloResultCallback> done_cb_; |
592 }; | 598 }; |
593 | 599 |
594 void QuicCryptoServerConfig::ProcessClientHello( | 600 void QuicCryptoServerConfig::ProcessClientHello( |
595 scoped_refptr<ValidateClientHelloResultCallback::Result> | 601 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
596 validate_chlo_result, | 602 validate_chlo_result, |
597 bool reject_only, | 603 bool reject_only, |
598 QuicConnectionId connection_id, | 604 QuicConnectionId connection_id, |
599 const QuicSocketAddress& server_address, | 605 const QuicSocketAddress& server_address, |
600 const QuicSocketAddress& client_address, | 606 const QuicSocketAddress& client_address, |
601 QuicVersion version, | 607 QuicVersion version, |
602 const QuicVersionVector& supported_versions, | 608 const QuicVersionVector& supported_versions, |
603 bool use_stateless_rejects, | 609 bool use_stateless_rejects, |
604 QuicConnectionId server_designated_connection_id, | 610 QuicConnectionId server_designated_connection_id, |
605 const QuicClock* clock, | 611 const QuicClock* clock, |
606 QuicRandom* rand, | 612 QuicRandom* rand, |
607 QuicCompressedCertsCache* compressed_certs_cache, | 613 QuicCompressedCertsCache* compressed_certs_cache, |
608 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 614 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
609 scoped_refptr<QuicSignedServerConfig> signed_config, | 615 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
610 QuicByteCount total_framing_overhead, | 616 QuicByteCount total_framing_overhead, |
611 QuicByteCount chlo_packet_size, | 617 QuicByteCount chlo_packet_size, |
612 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { | 618 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { |
613 DCHECK(done_cb); | 619 DCHECK(done_cb); |
614 | 620 |
615 ProcessClientHelloHelper helper(&done_cb); | 621 ProcessClientHelloHelper helper(&done_cb); |
616 | 622 |
617 const CryptoHandshakeMessage& client_hello = | 623 const CryptoHandshakeMessage& client_hello = |
618 validate_chlo_result->client_hello; | 624 validate_chlo_result->client_hello; |
619 const ClientHelloInfo& info = validate_chlo_result->info; | 625 const ClientHelloInfo& info = validate_chlo_result->info; |
620 | 626 |
621 string error_details; | 627 string error_details; |
622 QuicErrorCode valid = CryptoUtils::ValidateClientHello( | 628 QuicErrorCode valid = CryptoUtils::ValidateClientHello( |
623 client_hello, version, supported_versions, &error_details); | 629 client_hello, version, supported_versions, &error_details); |
624 if (valid != QUIC_NO_ERROR) { | 630 if (valid != QUIC_NO_ERROR) { |
625 helper.Fail(valid, error_details); | 631 helper.Fail(valid, error_details); |
626 return; | 632 return; |
627 } | 633 } |
628 | 634 |
629 StringPiece requested_scid; | 635 StringPiece requested_scid; |
630 client_hello.GetStringPiece(kSCID, &requested_scid); | 636 client_hello.GetStringPiece(kSCID, &requested_scid); |
631 const QuicWallTime now(clock->WallNow()); | 637 const QuicWallTime now(clock->WallNow()); |
632 | 638 |
633 scoped_refptr<Config> requested_config; | 639 QuicReferenceCountedPointer<Config> requested_config; |
634 scoped_refptr<Config> primary_config; | 640 QuicReferenceCountedPointer<Config> primary_config; |
635 bool no_primary_config = false; | 641 bool no_primary_config = false; |
636 { | 642 { |
637 QuicReaderMutexLock locked(&configs_lock_); | 643 QuicReaderMutexLock locked(&configs_lock_); |
638 | 644 |
639 if (!primary_config_) { | 645 if (!primary_config_) { |
640 no_primary_config = true; | 646 no_primary_config = true; |
641 } else { | 647 } else { |
642 if (!next_config_promotion_time_.IsZero() && | 648 if (!next_config_promotion_time_.IsZero() && |
643 next_config_promotion_time_.IsAfter(now)) { | 649 next_config_promotion_time_.IsAfter(now)) { |
644 configs_lock_.ReaderUnlock(); | 650 configs_lock_.ReaderUnlock(); |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
728 bool reject_only, | 734 bool reject_only, |
729 QuicConnectionId connection_id, | 735 QuicConnectionId connection_id, |
730 const QuicSocketAddress& client_address, | 736 const QuicSocketAddress& client_address, |
731 QuicVersion version, | 737 QuicVersion version, |
732 const QuicVersionVector& supported_versions, | 738 const QuicVersionVector& supported_versions, |
733 bool use_stateless_rejects, | 739 bool use_stateless_rejects, |
734 QuicConnectionId server_designated_connection_id, | 740 QuicConnectionId server_designated_connection_id, |
735 const QuicClock* clock, | 741 const QuicClock* clock, |
736 QuicRandom* rand, | 742 QuicRandom* rand, |
737 QuicCompressedCertsCache* compressed_certs_cache, | 743 QuicCompressedCertsCache* compressed_certs_cache, |
738 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 744 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
739 scoped_refptr<QuicSignedServerConfig> signed_config, | 745 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
740 QuicByteCount total_framing_overhead, | 746 QuicByteCount total_framing_overhead, |
741 QuicByteCount chlo_packet_size, | 747 QuicByteCount chlo_packet_size, |
742 const scoped_refptr<Config>& requested_config, | 748 const QuicReferenceCountedPointer<Config>& requested_config, |
743 const scoped_refptr<Config>& primary_config, | 749 const QuicReferenceCountedPointer<Config>& primary_config, |
744 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { | 750 std::unique_ptr<ProcessClientHelloResultCallback> done_cb) const { |
745 ProcessClientHelloHelper helper(&done_cb); | 751 ProcessClientHelloHelper helper(&done_cb); |
746 | 752 |
747 if (found_error) { | 753 if (found_error) { |
748 helper.Fail(QUIC_HANDSHAKE_FAILED, "Failed to get proof"); | 754 helper.Fail(QUIC_HANDSHAKE_FAILED, "Failed to get proof"); |
749 return; | 755 return; |
750 } | 756 } |
751 | 757 |
752 const CryptoHandshakeMessage& client_hello = | 758 const CryptoHandshakeMessage& client_hello = |
753 validate_chlo_result.client_hello; | 759 validate_chlo_result.client_hello; |
(...skipping 242 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
996 NewSourceAddressToken(*requested_config.get(), info.source_address_tokens, | 1002 NewSourceAddressToken(*requested_config.get(), info.source_address_tokens, |
997 client_address.host(), rand, info.now, nullptr)); | 1003 client_address.host(), rand, info.now, nullptr)); |
998 QuicSocketAddressCoder address_coder(client_address); | 1004 QuicSocketAddressCoder address_coder(client_address); |
999 out->SetStringPiece(kCADR, address_coder.Encode()); | 1005 out->SetStringPiece(kCADR, address_coder.Encode()); |
1000 out->SetStringPiece(kPUBS, forward_secure_public_value); | 1006 out->SetStringPiece(kPUBS, forward_secure_public_value); |
1001 | 1007 |
1002 helper.Succeed(std::move(out), std::move(out_diversification_nonce), | 1008 helper.Succeed(std::move(out), std::move(out_diversification_nonce), |
1003 std::move(proof_source_details)); | 1009 std::move(proof_source_details)); |
1004 } | 1010 } |
1005 | 1011 |
1006 scoped_refptr<QuicCryptoServerConfig::Config> | 1012 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1007 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const { | 1013 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const { |
1008 configs_lock_.AssertReaderHeld(); | 1014 configs_lock_.AssertReaderHeld(); |
1009 | 1015 |
1010 if (!requested_scid.empty()) { | 1016 if (!requested_scid.empty()) { |
1011 ConfigMap::const_iterator it = configs_.find(requested_scid.as_string()); | 1017 ConfigMap::const_iterator it = configs_.find(requested_scid.as_string()); |
1012 if (it != configs_.end()) { | 1018 if (it != configs_.end()) { |
1013 // We'll use the config that the client requested in order to do | 1019 // We'll use the config that the client requested in order to do |
1014 // key-agreement. | 1020 // key-agreement. |
1015 return scoped_refptr<Config>(it->second); | 1021 return QuicReferenceCountedPointer<Config>(it->second); |
1016 } | 1022 } |
1017 } | 1023 } |
1018 | 1024 |
1019 return scoped_refptr<Config>(); | 1025 return QuicReferenceCountedPointer<Config>(); |
1020 } | 1026 } |
1021 | 1027 |
1022 // ConfigPrimaryTimeLessThan is a comparator that implements "less than" for | 1028 // ConfigPrimaryTimeLessThan is a comparator that implements "less than" for |
1023 // Config's based on their primary_time. | 1029 // Config's based on their primary_time. |
1024 // static | 1030 // static |
1025 bool QuicCryptoServerConfig::ConfigPrimaryTimeLessThan( | 1031 bool QuicCryptoServerConfig::ConfigPrimaryTimeLessThan( |
1026 const scoped_refptr<Config>& a, | 1032 const QuicReferenceCountedPointer<Config>& a, |
1027 const scoped_refptr<Config>& b) { | 1033 const QuicReferenceCountedPointer<Config>& b) { |
1028 if (a->primary_time.IsBefore(b->primary_time) || | 1034 if (a->primary_time.IsBefore(b->primary_time) || |
1029 b->primary_time.IsBefore(a->primary_time)) { | 1035 b->primary_time.IsBefore(a->primary_time)) { |
1030 // Primary times differ. | 1036 // Primary times differ. |
1031 return a->primary_time.IsBefore(b->primary_time); | 1037 return a->primary_time.IsBefore(b->primary_time); |
1032 } else if (a->priority != b->priority) { | 1038 } else if (a->priority != b->priority) { |
1033 // Primary times are equal, sort backwards by priority. | 1039 // Primary times are equal, sort backwards by priority. |
1034 return a->priority < b->priority; | 1040 return a->priority < b->priority; |
1035 } else { | 1041 } else { |
1036 // Primary times and priorities are equal, sort by config id. | 1042 // Primary times and priorities are equal, sort by config id. |
1037 return a->id < b->id; | 1043 return a->id < b->id; |
1038 } | 1044 } |
1039 } | 1045 } |
1040 | 1046 |
1041 void QuicCryptoServerConfig::SelectNewPrimaryConfig( | 1047 void QuicCryptoServerConfig::SelectNewPrimaryConfig( |
1042 const QuicWallTime now) const { | 1048 const QuicWallTime now) const { |
1043 std::vector<scoped_refptr<Config>> configs; | 1049 std::vector<QuicReferenceCountedPointer<Config>> configs; |
1044 configs.reserve(configs_.size()); | 1050 configs.reserve(configs_.size()); |
1045 | 1051 |
1046 for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); | 1052 for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); |
1047 ++it) { | 1053 ++it) { |
1048 // TODO(avd) Exclude expired configs? | 1054 // TODO(avd) Exclude expired configs? |
1049 configs.push_back(it->second); | 1055 configs.push_back(it->second); |
1050 } | 1056 } |
1051 | 1057 |
1052 if (configs.empty()) { | 1058 if (configs.empty()) { |
1053 if (primary_config_.get()) { | 1059 if (primary_config_.get()) { |
1054 QUIC_BUG << "No valid QUIC server config. Keeping the current config."; | 1060 QUIC_BUG << "No valid QUIC server config. Keeping the current config."; |
1055 } else { | 1061 } else { |
1056 QUIC_BUG << "No valid QUIC server config."; | 1062 QUIC_BUG << "No valid QUIC server config."; |
1057 } | 1063 } |
1058 return; | 1064 return; |
1059 } | 1065 } |
1060 | 1066 |
1061 std::sort(configs.begin(), configs.end(), ConfigPrimaryTimeLessThan); | 1067 std::sort(configs.begin(), configs.end(), ConfigPrimaryTimeLessThan); |
1062 | 1068 |
1063 scoped_refptr<Config> best_candidate = configs[0]; | 1069 QuicReferenceCountedPointer<Config> best_candidate = configs[0]; |
1064 | 1070 |
1065 for (size_t i = 0; i < configs.size(); ++i) { | 1071 for (size_t i = 0; i < configs.size(); ++i) { |
1066 const scoped_refptr<Config> config(configs[i]); | 1072 const QuicReferenceCountedPointer<Config> config(configs[i]); |
1067 if (!config->primary_time.IsAfter(now)) { | 1073 if (!config->primary_time.IsAfter(now)) { |
1068 if (config->primary_time.IsAfter(best_candidate->primary_time)) { | 1074 if (config->primary_time.IsAfter(best_candidate->primary_time)) { |
1069 best_candidate = config; | 1075 best_candidate = config; |
1070 } | 1076 } |
1071 continue; | 1077 continue; |
1072 } | 1078 } |
1073 | 1079 |
1074 // This is the first config with a primary_time in the future. Thus the | 1080 // This is the first config with a primary_time in the future. Thus the |
1075 // previous Config should be the primary and this one should determine the | 1081 // previous Config should be the primary and this one should determine the |
1076 // next_config_promotion_time_. | 1082 // next_config_promotion_time_. |
1077 scoped_refptr<Config> new_primary = best_candidate; | 1083 QuicReferenceCountedPointer<Config> new_primary = best_candidate; |
1078 if (i == 0) { | 1084 if (i == 0) { |
1079 // We need the primary_time of the next config. | 1085 // We need the primary_time of the next config. |
1080 if (configs.size() > 1) { | 1086 if (configs.size() > 1) { |
1081 next_config_promotion_time_ = configs[1]->primary_time; | 1087 next_config_promotion_time_ = configs[1]->primary_time; |
1082 } else { | 1088 } else { |
1083 next_config_promotion_time_ = QuicWallTime::Zero(); | 1089 next_config_promotion_time_ = QuicWallTime::Zero(); |
1084 } | 1090 } |
1085 } else { | 1091 } else { |
1086 next_config_promotion_time_ = config->primary_time; | 1092 next_config_promotion_time_ = config->primary_time; |
1087 } | 1093 } |
1088 | 1094 |
1089 if (primary_config_) { | 1095 if (primary_config_) { |
1090 primary_config_->is_primary = false; | 1096 primary_config_->is_primary = false; |
1091 } | 1097 } |
1092 primary_config_ = new_primary; | 1098 primary_config_ = new_primary; |
1093 new_primary->is_primary = true; | 1099 new_primary->is_primary = true; |
1094 DVLOG(1) << "New primary config. orbit: " | 1100 DVLOG(1) << "New primary config. orbit: " |
1095 << QuicUtils::HexEncode( | 1101 << QuicUtils::HexEncode( |
1096 reinterpret_cast<const char*>(primary_config_->orbit), | 1102 reinterpret_cast<const char*>(primary_config_->orbit), |
1097 kOrbitSize); | 1103 kOrbitSize); |
1098 if (primary_config_changed_cb_.get() != nullptr) { | 1104 if (primary_config_changed_cb_.get() != nullptr) { |
1099 primary_config_changed_cb_->Run(primary_config_->id); | 1105 primary_config_changed_cb_->Run(primary_config_->id); |
1100 } | 1106 } |
1101 | 1107 |
1102 return; | 1108 return; |
1103 } | 1109 } |
1104 | 1110 |
1105 // All config's primary times are in the past. We should make the most recent | 1111 // All config's primary times are in the past. We should make the most recent |
1106 // and highest priority candidate primary. | 1112 // and highest priority candidate primary. |
1107 scoped_refptr<Config> new_primary = best_candidate; | 1113 QuicReferenceCountedPointer<Config> new_primary = best_candidate; |
1108 if (primary_config_.get()) { | 1114 if (primary_config_) { |
1109 primary_config_->is_primary = false; | 1115 primary_config_->is_primary = false; |
1110 } | 1116 } |
1111 primary_config_ = new_primary; | 1117 primary_config_ = new_primary; |
1112 new_primary->is_primary = true; | 1118 new_primary->is_primary = true; |
1113 DVLOG(1) << "New primary config. orbit: " | 1119 DVLOG(1) << "New primary config. orbit: " |
1114 << QuicUtils::HexEncode( | 1120 << QuicUtils::HexEncode( |
1115 reinterpret_cast<const char*>(primary_config_->orbit), | 1121 reinterpret_cast<const char*>(primary_config_->orbit), |
1116 kOrbitSize) | 1122 kOrbitSize) |
1117 << " scid: " << QuicUtils::HexEncode(primary_config_->id); | 1123 << " scid: " << QuicUtils::HexEncode(primary_config_->id); |
1118 next_config_promotion_time_ = QuicWallTime::Zero(); | 1124 next_config_promotion_time_ = QuicWallTime::Zero(); |
1119 if (primary_config_changed_cb_.get() != nullptr) { | 1125 if (primary_config_changed_cb_.get() != nullptr) { |
1120 primary_config_changed_cb_->Run(primary_config_->id); | 1126 primary_config_changed_cb_->Run(primary_config_->id); |
1121 } | 1127 } |
1122 } | 1128 } |
1123 | 1129 |
1124 class QuicCryptoServerConfig::EvaluateClientHelloCallback | 1130 class QuicCryptoServerConfig::EvaluateClientHelloCallback |
1125 : public ProofSource::Callback { | 1131 : public ProofSource::Callback { |
1126 public: | 1132 public: |
1127 EvaluateClientHelloCallback( | 1133 EvaluateClientHelloCallback( |
1128 const QuicCryptoServerConfig& config, | 1134 const QuicCryptoServerConfig& config, |
1129 bool found_error, | 1135 bool found_error, |
1130 const QuicIpAddress& server_ip, | 1136 const QuicIpAddress& server_ip, |
1131 QuicVersion version, | 1137 QuicVersion version, |
1132 scoped_refptr<QuicCryptoServerConfig::Config> requested_config, | 1138 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1133 scoped_refptr<QuicCryptoServerConfig::Config> primary_config, | 1139 requested_config, |
1134 scoped_refptr<QuicSignedServerConfig> signed_config, | 1140 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1135 scoped_refptr<ValidateClientHelloResultCallback::Result> | 1141 primary_config, |
| 1142 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
| 1143 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
1136 client_hello_state, | 1144 client_hello_state, |
1137 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) | 1145 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) |
1138 : config_(config), | 1146 : config_(config), |
1139 found_error_(found_error), | 1147 found_error_(found_error), |
1140 server_ip_(server_ip), | 1148 server_ip_(server_ip), |
1141 version_(version), | 1149 version_(version), |
1142 requested_config_(std::move(requested_config)), | 1150 requested_config_(std::move(requested_config)), |
1143 primary_config_(std::move(primary_config)), | 1151 primary_config_(std::move(primary_config)), |
1144 signed_config_(signed_config), | 1152 signed_config_(signed_config), |
1145 client_hello_state_(std::move(client_hello_state)), | 1153 client_hello_state_(std::move(client_hello_state)), |
1146 done_cb_(std::move(done_cb)) {} | 1154 done_cb_(std::move(done_cb)) {} |
1147 | 1155 |
1148 void Run(bool ok, | 1156 void Run(bool ok, |
1149 const scoped_refptr<ProofSource::Chain>& chain, | 1157 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
1150 const QuicCryptoProof& proof, | 1158 const QuicCryptoProof& proof, |
1151 std::unique_ptr<ProofSource::Details> details) override { | 1159 std::unique_ptr<ProofSource::Details> details) override { |
1152 if (ok) { | 1160 if (ok) { |
1153 signed_config_->chain = chain; | 1161 signed_config_->chain = chain; |
1154 signed_config_->proof = proof; | 1162 signed_config_->proof = proof; |
1155 } | 1163 } |
1156 config_.EvaluateClientHelloAfterGetProof( | 1164 config_.EvaluateClientHelloAfterGetProof( |
1157 found_error_, server_ip_, version_, requested_config_, primary_config_, | 1165 found_error_, server_ip_, version_, requested_config_, primary_config_, |
1158 signed_config_, std::move(details), !ok, client_hello_state_, | 1166 signed_config_, std::move(details), !ok, client_hello_state_, |
1159 std::move(done_cb_)); | 1167 std::move(done_cb_)); |
1160 } | 1168 } |
1161 | 1169 |
1162 private: | 1170 private: |
1163 const QuicCryptoServerConfig& config_; | 1171 const QuicCryptoServerConfig& config_; |
1164 const bool found_error_; | 1172 const bool found_error_; |
1165 const QuicIpAddress& server_ip_; | 1173 const QuicIpAddress& server_ip_; |
1166 const QuicVersion version_; | 1174 const QuicVersion version_; |
1167 const scoped_refptr<QuicCryptoServerConfig::Config> requested_config_; | 1175 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1168 const scoped_refptr<QuicCryptoServerConfig::Config> primary_config_; | 1176 requested_config_; |
1169 scoped_refptr<QuicSignedServerConfig> signed_config_; | 1177 const QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1170 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state_; | 1178 primary_config_; |
| 1179 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config_; |
| 1180 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1181 client_hello_state_; |
1171 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; | 1182 std::unique_ptr<ValidateClientHelloResultCallback> done_cb_; |
1172 }; | 1183 }; |
1173 | 1184 |
1174 void QuicCryptoServerConfig::EvaluateClientHello( | 1185 void QuicCryptoServerConfig::EvaluateClientHello( |
1175 const QuicSocketAddress& server_address, | 1186 const QuicSocketAddress& server_address, |
1176 QuicVersion version, | 1187 QuicVersion version, |
1177 scoped_refptr<Config> requested_config, | 1188 QuicReferenceCountedPointer<Config> requested_config, |
1178 scoped_refptr<Config> primary_config, | 1189 QuicReferenceCountedPointer<Config> primary_config, |
1179 scoped_refptr<QuicSignedServerConfig> signed_config, | 1190 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
1180 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1191 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1192 client_hello_state, |
1181 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1193 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
1182 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1194 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
1183 | 1195 |
1184 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1196 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
1185 ClientHelloInfo* info = &(client_hello_state->info); | 1197 ClientHelloInfo* info = &(client_hello_state->info); |
1186 | 1198 |
1187 if (client_hello.size() < kClientHelloMinimumSize) { | 1199 if (client_hello.size() < kClientHelloMinimumSize) { |
1188 helper.ValidationComplete(QUIC_CRYPTO_INVALID_VALUE_LENGTH, | 1200 helper.ValidationComplete(QUIC_CRYPTO_INVALID_VALUE_LENGTH, |
1189 "Client hello too small", nullptr); | 1201 "Client hello too small", nullptr); |
1190 return; | 1202 return; |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1291 found_error, server_address.host(), version, requested_config, | 1303 found_error, server_address.host(), version, requested_config, |
1292 primary_config, signed_config, nullptr /* proof_source_details */, | 1304 primary_config, signed_config, nullptr /* proof_source_details */, |
1293 get_proof_failed, client_hello_state, std::move(done_cb)); | 1305 get_proof_failed, client_hello_state, std::move(done_cb)); |
1294 helper.DetachCallback(); | 1306 helper.DetachCallback(); |
1295 } | 1307 } |
1296 | 1308 |
1297 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( | 1309 void QuicCryptoServerConfig::EvaluateClientHelloAfterGetProof( |
1298 bool found_error, | 1310 bool found_error, |
1299 const QuicIpAddress& server_ip, | 1311 const QuicIpAddress& server_ip, |
1300 QuicVersion version, | 1312 QuicVersion version, |
1301 scoped_refptr<Config> requested_config, | 1313 QuicReferenceCountedPointer<Config> requested_config, |
1302 scoped_refptr<Config> primary_config, | 1314 QuicReferenceCountedPointer<Config> primary_config, |
1303 scoped_refptr<QuicSignedServerConfig> signed_config, | 1315 QuicReferenceCountedPointer<QuicSignedServerConfig> signed_config, |
1304 std::unique_ptr<ProofSource::Details> proof_source_details, | 1316 std::unique_ptr<ProofSource::Details> proof_source_details, |
1305 bool get_proof_failed, | 1317 bool get_proof_failed, |
1306 scoped_refptr<ValidateClientHelloResultCallback::Result> client_hello_state, | 1318 QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result> |
| 1319 client_hello_state, |
1307 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { | 1320 std::unique_ptr<ValidateClientHelloResultCallback> done_cb) const { |
1308 ValidateClientHelloHelper helper(client_hello_state, &done_cb); | 1321 ValidateClientHelloHelper helper(client_hello_state, &done_cb); |
1309 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; | 1322 const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
1310 ClientHelloInfo* info = &(client_hello_state->info); | 1323 ClientHelloInfo* info = &(client_hello_state->info); |
1311 | 1324 |
1312 if (get_proof_failed) { | 1325 if (get_proof_failed) { |
1313 info->reject_reasons.push_back(SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE); | 1326 info->reject_reasons.push_back(SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE); |
1314 } | 1327 } |
1315 | 1328 |
1316 if (!ValidateExpectedLeafCertificate(client_hello, *signed_config)) { | 1329 if (!ValidateExpectedLeafCertificate(client_hello, *signed_config)) { |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1362 *primary_config_, previous_source_address_tokens, client_ip, rand, | 1375 *primary_config_, previous_source_address_tokens, client_ip, rand, |
1363 clock->WallNow(), cached_network_params); | 1376 clock->WallNow(), cached_network_params); |
1364 } | 1377 } |
1365 | 1378 |
1366 out->set_tag(kSCUP); | 1379 out->set_tag(kSCUP); |
1367 out->SetStringPiece(kSCFG, serialized); | 1380 out->SetStringPiece(kSCFG, serialized); |
1368 out->SetStringPiece(kSourceAddressTokenTag, source_address_token); | 1381 out->SetStringPiece(kSourceAddressTokenTag, source_address_token); |
1369 out->SetValue(kSTTL, | 1382 out->SetValue(kSTTL, |
1370 expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds()); | 1383 expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds()); |
1371 | 1384 |
1372 scoped_refptr<ProofSource::Chain> chain; | 1385 QuicReferenceCountedPointer<ProofSource::Chain> chain; |
1373 QuicCryptoProof proof; | 1386 QuicCryptoProof proof; |
1374 if (!proof_source_->GetProof(server_address, params.sni, serialized, version, | 1387 if (!proof_source_->GetProof(server_address, params.sni, serialized, version, |
1375 chlo_hash, connection_options, &chain, &proof)) { | 1388 chlo_hash, connection_options, &chain, &proof)) { |
1376 DVLOG(1) << "Server: failed to get proof."; | 1389 DVLOG(1) << "Server: failed to get proof."; |
1377 return false; | 1390 return false; |
1378 } | 1391 } |
1379 | 1392 |
1380 const string compressed = CompressChain( | 1393 const string compressed = CompressChain( |
1381 compressed_certs_cache, chain, params.client_common_set_hashes, | 1394 compressed_certs_cache, chain, params.client_common_set_hashes, |
1382 params.client_cached_cert_hashes, common_cert_sets); | 1395 params.client_cached_cert_hashes, common_cert_sets); |
(...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1457 compressed_certs_cache_(compressed_certs_cache), | 1470 compressed_certs_cache_(compressed_certs_cache), |
1458 common_cert_sets_(common_cert_sets), | 1471 common_cert_sets_(common_cert_sets), |
1459 client_common_set_hashes_(params.client_common_set_hashes), | 1472 client_common_set_hashes_(params.client_common_set_hashes), |
1460 client_cached_cert_hashes_(params.client_cached_cert_hashes), | 1473 client_cached_cert_hashes_(params.client_cached_cert_hashes), |
1461 sct_supported_by_client_(params.sct_supported_by_client), | 1474 sct_supported_by_client_(params.sct_supported_by_client), |
1462 message_(std::move(message)), | 1475 message_(std::move(message)), |
1463 cb_(std::move(cb)) {} | 1476 cb_(std::move(cb)) {} |
1464 | 1477 |
1465 void QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback:: | 1478 void QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback:: |
1466 Run(bool ok, | 1479 Run(bool ok, |
1467 const scoped_refptr<ProofSource::Chain>& chain, | 1480 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
1468 const QuicCryptoProof& proof, | 1481 const QuicCryptoProof& proof, |
1469 std::unique_ptr<ProofSource::Details> details) { | 1482 std::unique_ptr<ProofSource::Details> details) { |
1470 config_->FinishBuildServerConfigUpdateMessage( | 1483 config_->FinishBuildServerConfigUpdateMessage( |
1471 version_, compressed_certs_cache_, common_cert_sets_, | 1484 version_, compressed_certs_cache_, common_cert_sets_, |
1472 client_common_set_hashes_, client_cached_cert_hashes_, | 1485 client_common_set_hashes_, client_cached_cert_hashes_, |
1473 sct_supported_by_client_, ok, chain, proof.signature, | 1486 sct_supported_by_client_, ok, chain, proof.signature, |
1474 proof.leaf_cert_scts, std::move(details), std::move(message_), | 1487 proof.leaf_cert_scts, std::move(details), std::move(message_), |
1475 std::move(cb_)); | 1488 std::move(cb_)); |
1476 } | 1489 } |
1477 | 1490 |
1478 void QuicCryptoServerConfig::FinishBuildServerConfigUpdateMessage( | 1491 void QuicCryptoServerConfig::FinishBuildServerConfigUpdateMessage( |
1479 QuicVersion version, | 1492 QuicVersion version, |
1480 QuicCompressedCertsCache* compressed_certs_cache, | 1493 QuicCompressedCertsCache* compressed_certs_cache, |
1481 const CommonCertSets* common_cert_sets, | 1494 const CommonCertSets* common_cert_sets, |
1482 const string& client_common_set_hashes, | 1495 const string& client_common_set_hashes, |
1483 const string& client_cached_cert_hashes, | 1496 const string& client_cached_cert_hashes, |
1484 bool sct_supported_by_client, | 1497 bool sct_supported_by_client, |
1485 bool ok, | 1498 bool ok, |
1486 const scoped_refptr<ProofSource::Chain>& chain, | 1499 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
1487 const string& signature, | 1500 const string& signature, |
1488 const string& leaf_cert_sct, | 1501 const string& leaf_cert_sct, |
1489 std::unique_ptr<ProofSource::Details> details, | 1502 std::unique_ptr<ProofSource::Details> details, |
1490 CryptoHandshakeMessage message, | 1503 CryptoHandshakeMessage message, |
1491 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const { | 1504 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const { |
1492 if (!ok) { | 1505 if (!ok) { |
1493 cb->Run(false, message); | 1506 cb->Run(false, message); |
1494 return; | 1507 return; |
1495 } | 1508 } |
1496 | 1509 |
(...skipping 18 matching lines...) Expand all Loading... |
1515 QuicVersion version, | 1528 QuicVersion version, |
1516 QuicWallTime now, | 1529 QuicWallTime now, |
1517 const Config& config, | 1530 const Config& config, |
1518 const CryptoHandshakeMessage& client_hello, | 1531 const CryptoHandshakeMessage& client_hello, |
1519 const ClientHelloInfo& info, | 1532 const ClientHelloInfo& info, |
1520 const CachedNetworkParameters& cached_network_params, | 1533 const CachedNetworkParameters& cached_network_params, |
1521 bool use_stateless_rejects, | 1534 bool use_stateless_rejects, |
1522 QuicConnectionId server_designated_connection_id, | 1535 QuicConnectionId server_designated_connection_id, |
1523 QuicRandom* rand, | 1536 QuicRandom* rand, |
1524 QuicCompressedCertsCache* compressed_certs_cache, | 1537 QuicCompressedCertsCache* compressed_certs_cache, |
1525 scoped_refptr<QuicCryptoNegotiatedParameters> params, | 1538 QuicReferenceCountedPointer<QuicCryptoNegotiatedParameters> params, |
1526 const QuicSignedServerConfig& signed_config, | 1539 const QuicSignedServerConfig& signed_config, |
1527 QuicByteCount total_framing_overhead, | 1540 QuicByteCount total_framing_overhead, |
1528 QuicByteCount chlo_packet_size, | 1541 QuicByteCount chlo_packet_size, |
1529 CryptoHandshakeMessage* out) const { | 1542 CryptoHandshakeMessage* out) const { |
1530 if (FLAGS_enable_quic_stateless_reject_support && use_stateless_rejects) { | 1543 if (FLAGS_enable_quic_stateless_reject_support && use_stateless_rejects) { |
1531 DVLOG(1) << "QUIC Crypto server config returning stateless reject " | 1544 DVLOG(1) << "QUIC Crypto server config returning stateless reject " |
1532 << "with server-designated connection ID " | 1545 << "with server-designated connection ID " |
1533 << server_designated_connection_id; | 1546 << server_designated_connection_id; |
1534 out->set_tag(kSREJ); | 1547 out->set_tag(kSREJ); |
1535 out->SetValue(kRCID, server_designated_connection_id); | 1548 out->SetValue(kRCID, server_designated_connection_id); |
(...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1608 DLOG(WARNING) << "Sending inchoate REJ for hostname: " << info.sni | 1621 DLOG(WARNING) << "Sending inchoate REJ for hostname: " << info.sni |
1609 << " signature: " << signed_config.proof.signature.size() | 1622 << " signature: " << signed_config.proof.signature.size() |
1610 << " cert: " << compressed.size() << " sct:" << sct_size | 1623 << " cert: " << compressed.size() << " sct:" << sct_size |
1611 << " total: " << total_size | 1624 << " total: " << total_size |
1612 << " max: " << max_unverified_size; | 1625 << " max: " << max_unverified_size; |
1613 } | 1626 } |
1614 } | 1627 } |
1615 | 1628 |
1616 string QuicCryptoServerConfig::CompressChain( | 1629 string QuicCryptoServerConfig::CompressChain( |
1617 QuicCompressedCertsCache* compressed_certs_cache, | 1630 QuicCompressedCertsCache* compressed_certs_cache, |
1618 const scoped_refptr<ProofSource::Chain>& chain, | 1631 const QuicReferenceCountedPointer<ProofSource::Chain>& chain, |
1619 const string& client_common_set_hashes, | 1632 const string& client_common_set_hashes, |
1620 const string& client_cached_cert_hashes, | 1633 const string& client_cached_cert_hashes, |
1621 const CommonCertSets* common_sets) { | 1634 const CommonCertSets* common_sets) { |
1622 // Check whether the compressed certs is available in the cache. | 1635 // Check whether the compressed certs is available in the cache. |
1623 DCHECK(compressed_certs_cache); | 1636 DCHECK(compressed_certs_cache); |
1624 const string* cached_value = compressed_certs_cache->GetCompressedCert( | 1637 const string* cached_value = compressed_certs_cache->GetCompressedCert( |
1625 chain, client_common_set_hashes, client_cached_cert_hashes); | 1638 chain, client_common_set_hashes, client_cached_cert_hashes); |
1626 if (cached_value) { | 1639 if (cached_value) { |
1627 return *cached_value; | 1640 return *cached_value; |
1628 } | 1641 } |
1629 | 1642 |
1630 const string compressed = | 1643 const string compressed = |
1631 CertCompressor::CompressChain(chain->certs, client_common_set_hashes, | 1644 CertCompressor::CompressChain(chain->certs, client_common_set_hashes, |
1632 client_common_set_hashes, common_sets); | 1645 client_common_set_hashes, common_sets); |
1633 | 1646 |
1634 // Insert the newly compressed cert to cache. | 1647 // Insert the newly compressed cert to cache. |
1635 compressed_certs_cache->Insert(chain, client_common_set_hashes, | 1648 compressed_certs_cache->Insert(chain, client_common_set_hashes, |
1636 client_cached_cert_hashes, compressed); | 1649 client_cached_cert_hashes, compressed); |
1637 return compressed; | 1650 return compressed; |
1638 } | 1651 } |
1639 | 1652 |
1640 scoped_refptr<QuicCryptoServerConfig::Config> | 1653 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> |
1641 QuicCryptoServerConfig::ParseConfigProtobuf( | 1654 QuicCryptoServerConfig::ParseConfigProtobuf( |
1642 const std::unique_ptr<QuicServerConfigProtobuf>& protobuf) { | 1655 const std::unique_ptr<QuicServerConfigProtobuf>& protobuf) { |
1643 std::unique_ptr<CryptoHandshakeMessage> msg( | 1656 std::unique_ptr<CryptoHandshakeMessage> msg( |
1644 CryptoFramer::ParseMessage(protobuf->config())); | 1657 CryptoFramer::ParseMessage(protobuf->config())); |
1645 | 1658 |
1646 if (msg->tag() != kSCFG) { | 1659 if (msg->tag() != kSCFG) { |
1647 LOG(WARNING) << "Server config message has tag " << msg->tag() | 1660 LOG(WARNING) << "Server config message has tag " << msg->tag() |
1648 << " expected " << kSCFG; | 1661 << " expected " << kSCFG; |
1649 return nullptr; | 1662 return nullptr; |
1650 } | 1663 } |
1651 | 1664 |
1652 scoped_refptr<Config> config(new Config); | 1665 QuicReferenceCountedPointer<Config> config(new Config); |
1653 config->serialized = protobuf->config(); | 1666 config->serialized = protobuf->config(); |
1654 config->source_address_token_boxer = &source_address_token_boxer_; | 1667 config->source_address_token_boxer = &source_address_token_boxer_; |
1655 | 1668 |
1656 if (protobuf->has_primary_time()) { | 1669 if (protobuf->has_primary_time()) { |
1657 config->primary_time = | 1670 config->primary_time = |
1658 QuicWallTime::FromUNIXSeconds(protobuf->primary_time()); | 1671 QuicWallTime::FromUNIXSeconds(protobuf->primary_time()); |
1659 } | 1672 } |
1660 | 1673 |
1661 config->priority = protobuf->priority(); | 1674 config->priority = protobuf->priority(); |
1662 | 1675 |
(...skipping 349 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2012 priority(0), | 2025 priority(0), |
2013 source_address_token_boxer(nullptr) {} | 2026 source_address_token_boxer(nullptr) {} |
2014 | 2027 |
2015 QuicCryptoServerConfig::Config::~Config() { | 2028 QuicCryptoServerConfig::Config::~Config() { |
2016 } | 2029 } |
2017 | 2030 |
2018 QuicSignedServerConfig::QuicSignedServerConfig() {} | 2031 QuicSignedServerConfig::QuicSignedServerConfig() {} |
2019 QuicSignedServerConfig::~QuicSignedServerConfig() {} | 2032 QuicSignedServerConfig::~QuicSignedServerConfig() {} |
2020 | 2033 |
2021 } // namespace net | 2034 } // namespace net |
OLD | NEW |