| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| (...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 108 // server. | 108 // server. |
| 109 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, | 109 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, |
| 110 QuicRandom* server_nonce_entropy); | 110 QuicRandom* server_nonce_entropy); |
| 111 ~QuicCryptoServerConfig(); | 111 ~QuicCryptoServerConfig(); |
| 112 | 112 |
| 113 // TESTING is a magic parameter for passing to the constructor in tests. | 113 // TESTING is a magic parameter for passing to the constructor in tests. |
| 114 static const char TESTING[]; | 114 static const char TESTING[]; |
| 115 | 115 |
| 116 // Generates a QuicServerConfigProtobuf protobuf suitable for | 116 // Generates a QuicServerConfigProtobuf protobuf suitable for |
| 117 // AddConfig and SetConfigs. | 117 // AddConfig and SetConfigs. |
| 118 static QuicServerConfigProtobuf* GenerateConfig( | 118 static QuicServerConfigProtobuf* GenerateConfig(QuicRandom* rand, |
| 119 QuicRandom* rand, | 119 const QuicClock* clock, |
| 120 const QuicClock* clock, | 120 const ConfigOptions& options); |
| 121 const ConfigOptions& options); | |
| 122 | 121 |
| 123 // AddConfig adds a QuicServerConfigProtobuf to the availible configurations. | 122 // AddConfig adds a QuicServerConfigProtobuf to the availible configurations. |
| 124 // It returns the SCFG message from the config if successful. The caller | 123 // It returns the SCFG message from the config if successful. The caller |
| 125 // takes ownership of the CryptoHandshakeMessage. |now| is used in | 124 // takes ownership of the CryptoHandshakeMessage. |now| is used in |
| 126 // conjunction with |protobuf->primary_time()| to determine whether the | 125 // conjunction with |protobuf->primary_time()| to determine whether the |
| 127 // config should be made primary. | 126 // config should be made primary. |
| 128 CryptoHandshakeMessage* AddConfig(QuicServerConfigProtobuf* protobuf, | 127 CryptoHandshakeMessage* AddConfig(QuicServerConfigProtobuf* protobuf, |
| 129 QuicWallTime now); | 128 QuicWallTime now); |
| 130 | 129 |
| 131 // AddDefaultConfig calls DefaultConfig to create a config and then calls | 130 // AddDefaultConfig calls DefaultConfig to create a config and then calls |
| 132 // AddConfig to add it. See the comment for |DefaultConfig| for details of | 131 // AddConfig to add it. See the comment for |DefaultConfig| for details of |
| 133 // the arguments. | 132 // the arguments. |
| 134 CryptoHandshakeMessage* AddDefaultConfig( | 133 CryptoHandshakeMessage* AddDefaultConfig(QuicRandom* rand, |
| 135 QuicRandom* rand, | 134 const QuicClock* clock, |
| 136 const QuicClock* clock, | 135 const ConfigOptions& options); |
| 137 const ConfigOptions& options); | |
| 138 | 136 |
| 139 // SetConfigs takes a vector of config protobufs and the current time. | 137 // SetConfigs takes a vector of config protobufs and the current time. |
| 140 // Configs are assumed to be uniquely identified by their server config ID. | 138 // Configs are assumed to be uniquely identified by their server config ID. |
| 141 // Previously unknown configs are added and possibly made the primary config | 139 // Previously unknown configs are added and possibly made the primary config |
| 142 // depending on their |primary_time| and the value of |now|. Configs that are | 140 // depending on their |primary_time| and the value of |now|. Configs that are |
| 143 // known, but are missing from the protobufs are deleted, unless they are | 141 // known, but are missing from the protobufs are deleted, unless they are |
| 144 // currently the primary config. SetConfigs returns false if any errors were | 142 // currently the primary config. SetConfigs returns false if any errors were |
| 145 // encountered and no changes to the QuicCryptoServerConfig will occur. | 143 // encountered and no changes to the QuicCryptoServerConfig will occur. |
| 146 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, | 144 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, |
| 147 QuicWallTime now); | 145 QuicWallTime now); |
| (...skipping 12 matching lines...) Expand all Loading... |
| 160 // | 158 // |
| 161 // client_hello: the incoming client hello message. | 159 // client_hello: the incoming client hello message. |
| 162 // client_ip: the IP address of the client, which is used to generate and | 160 // client_ip: the IP address of the client, which is used to generate and |
| 163 // validate source-address tokens. | 161 // validate source-address tokens. |
| 164 // clock: used to validate client nonces and ephemeral keys. | 162 // clock: used to validate client nonces and ephemeral keys. |
| 165 // done_cb: single-use callback that accepts an opaque | 163 // done_cb: single-use callback that accepts an opaque |
| 166 // ValidatedClientHelloMsg token that holds information about | 164 // ValidatedClientHelloMsg token that holds information about |
| 167 // the client hello. The callback will always be called exactly | 165 // the client hello. The callback will always be called exactly |
| 168 // once, either under the current call stack, or after the | 166 // once, either under the current call stack, or after the |
| 169 // completion of an asynchronous operation. | 167 // completion of an asynchronous operation. |
| 170 void ValidateClientHello( | 168 void ValidateClientHello(const CryptoHandshakeMessage& client_hello, |
| 171 const CryptoHandshakeMessage& client_hello, | 169 IPEndPoint client_ip, |
| 172 IPEndPoint client_ip, | 170 const QuicClock* clock, |
| 173 const QuicClock* clock, | 171 ValidateClientHelloResultCallback* done_cb) const; |
| 174 ValidateClientHelloResultCallback* done_cb) const; | |
| 175 | 172 |
| 176 // ProcessClientHello processes |client_hello| and decides whether to accept | 173 // ProcessClientHello processes |client_hello| and decides whether to accept |
| 177 // or reject the connection. If the connection is to be accepted, |out| is | 174 // or reject the connection. If the connection is to be accepted, |out| is |
| 178 // set to the contents of the ServerHello, |out_params| is completed and | 175 // set to the contents of the ServerHello, |out_params| is completed and |
| 179 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and | 176 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and |
| 180 // an error code is returned. | 177 // an error code is returned. |
| 181 // | 178 // |
| 182 // validate_chlo_result: Output from the asynchronous call to | 179 // validate_chlo_result: Output from the asynchronous call to |
| 183 // ValidateClientHello. Contains the client hello message and | 180 // ValidateClientHello. Contains the client hello message and |
| 184 // information about it. | 181 // information about it. |
| (...skipping 175 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 360 // EvaluateClientHello checks |client_hello| for gross errors and determines | 357 // EvaluateClientHello checks |client_hello| for gross errors and determines |
| 361 // whether it can be shown to be fresh (i.e. not a replay). The results are | 358 // whether it can be shown to be fresh (i.e. not a replay). The results are |
| 362 // written to |info|. | 359 // written to |info|. |
| 363 void EvaluateClientHello( | 360 void EvaluateClientHello( |
| 364 const uint8* primary_orbit, | 361 const uint8* primary_orbit, |
| 365 scoped_refptr<Config> requested_config, | 362 scoped_refptr<Config> requested_config, |
| 366 ValidateClientHelloResultCallback::Result* client_hello_state, | 363 ValidateClientHelloResultCallback::Result* client_hello_state, |
| 367 ValidateClientHelloResultCallback* done_cb) const; | 364 ValidateClientHelloResultCallback* done_cb) const; |
| 368 | 365 |
| 369 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. | 366 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. |
| 370 void BuildRejection( | 367 void BuildRejection(const Config& config, |
| 371 const Config& config, | 368 const CryptoHandshakeMessage& client_hello, |
| 372 const CryptoHandshakeMessage& client_hello, | 369 const ClientHelloInfo& info, |
| 373 const ClientHelloInfo& info, | 370 QuicRandom* rand, |
| 374 QuicRandom* rand, | 371 CryptoHandshakeMessage* out) const; |
| 375 CryptoHandshakeMessage* out) const; | |
| 376 | 372 |
| 377 // ParseConfigProtobuf parses the given config protobuf and returns a | 373 // ParseConfigProtobuf parses the given config protobuf and returns a |
| 378 // scoped_refptr<Config> if successful. The caller adopts the reference to the | 374 // scoped_refptr<Config> if successful. The caller adopts the reference to the |
| 379 // Config. On error, ParseConfigProtobuf returns NULL. | 375 // Config. On error, ParseConfigProtobuf returns NULL. |
| 380 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); | 376 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); |
| 381 | 377 |
| 382 // NewSourceAddressToken returns a fresh source address token for the given | 378 // NewSourceAddressToken returns a fresh source address token for the given |
| 383 // IP address. | 379 // IP address. |
| 384 std::string NewSourceAddressToken( | 380 std::string NewSourceAddressToken(const Config& config, |
| 385 const Config& config, | 381 const IPEndPoint& ip, |
| 386 const IPEndPoint& ip, | 382 QuicRandom* rand, |
| 387 QuicRandom* rand, | 383 QuicWallTime now) const; |
| 388 QuicWallTime now) const; | |
| 389 | 384 |
| 390 // ValidateSourceAddressToken returns true if the source address token in | 385 // ValidateSourceAddressToken returns true if the source address token in |
| 391 // |token| is a valid and timely token for the IP address |ip| given that the | 386 // |token| is a valid and timely token for the IP address |ip| given that the |
| 392 // current time is |now|. | 387 // current time is |now|. |
| 393 bool ValidateSourceAddressToken( | 388 bool ValidateSourceAddressToken(const Config& config, |
| 394 const Config& config, | 389 base::StringPiece token, |
| 395 base::StringPiece token, | 390 const IPEndPoint& ip, |
| 396 const IPEndPoint& ip, | 391 QuicWallTime now) const; |
| 397 QuicWallTime now) const; | |
| 398 | 392 |
| 399 // NewServerNonce generates and encrypts a random nonce. | 393 // NewServerNonce generates and encrypts a random nonce. |
| 400 std::string NewServerNonce(QuicRandom* rand, QuicWallTime now) const; | 394 std::string NewServerNonce(QuicRandom* rand, QuicWallTime now) const; |
| 401 | 395 |
| 402 // ValidateServerNonce decrypts |token| and verifies that it hasn't been | 396 // ValidateServerNonce decrypts |token| and verifies that it hasn't been |
| 403 // previously used and is recent enough that it is plausible that it was part | 397 // previously used and is recent enough that it is plausible that it was part |
| 404 // of a very recently provided rejection ("recent" will be on the order of | 398 // of a very recently provided rejection ("recent" will be on the order of |
| 405 // 10-30 seconds). If so, it records that it has been used and returns true. | 399 // 10-30 seconds). If so, it records that it has been used and returns true. |
| 406 // Otherwise it returns false. | 400 // Otherwise it returns false. |
| 407 bool ValidateServerNonce(base::StringPiece echoed_server_nonce, | 401 bool ValidateServerNonce(base::StringPiece echoed_server_nonce, |
| (...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 471 uint32 source_address_token_lifetime_secs_; | 465 uint32 source_address_token_lifetime_secs_; |
| 472 uint32 server_nonce_strike_register_max_entries_; | 466 uint32 server_nonce_strike_register_max_entries_; |
| 473 uint32 server_nonce_strike_register_window_secs_; | 467 uint32 server_nonce_strike_register_window_secs_; |
| 474 | 468 |
| 475 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); | 469 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); |
| 476 }; | 470 }; |
| 477 | 471 |
| 478 } // namespace net | 472 } // namespace net |
| 479 | 473 |
| 480 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 474 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| OLD | NEW |