OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
(...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
108 // server. | 108 // server. |
109 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, | 109 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, |
110 QuicRandom* server_nonce_entropy); | 110 QuicRandom* server_nonce_entropy); |
111 ~QuicCryptoServerConfig(); | 111 ~QuicCryptoServerConfig(); |
112 | 112 |
113 // TESTING is a magic parameter for passing to the constructor in tests. | 113 // TESTING is a magic parameter for passing to the constructor in tests. |
114 static const char TESTING[]; | 114 static const char TESTING[]; |
115 | 115 |
116 // Generates a QuicServerConfigProtobuf protobuf suitable for | 116 // Generates a QuicServerConfigProtobuf protobuf suitable for |
117 // AddConfig and SetConfigs. | 117 // AddConfig and SetConfigs. |
118 static QuicServerConfigProtobuf* GenerateConfig( | 118 static QuicServerConfigProtobuf* GenerateConfig(QuicRandom* rand, |
119 QuicRandom* rand, | 119 const QuicClock* clock, |
120 const QuicClock* clock, | 120 const ConfigOptions& options); |
121 const ConfigOptions& options); | |
122 | 121 |
123 // AddConfig adds a QuicServerConfigProtobuf to the availible configurations. | 122 // AddConfig adds a QuicServerConfigProtobuf to the availible configurations. |
124 // It returns the SCFG message from the config if successful. The caller | 123 // It returns the SCFG message from the config if successful. The caller |
125 // takes ownership of the CryptoHandshakeMessage. |now| is used in | 124 // takes ownership of the CryptoHandshakeMessage. |now| is used in |
126 // conjunction with |protobuf->primary_time()| to determine whether the | 125 // conjunction with |protobuf->primary_time()| to determine whether the |
127 // config should be made primary. | 126 // config should be made primary. |
128 CryptoHandshakeMessage* AddConfig(QuicServerConfigProtobuf* protobuf, | 127 CryptoHandshakeMessage* AddConfig(QuicServerConfigProtobuf* protobuf, |
129 QuicWallTime now); | 128 QuicWallTime now); |
130 | 129 |
131 // AddDefaultConfig calls DefaultConfig to create a config and then calls | 130 // AddDefaultConfig calls DefaultConfig to create a config and then calls |
132 // AddConfig to add it. See the comment for |DefaultConfig| for details of | 131 // AddConfig to add it. See the comment for |DefaultConfig| for details of |
133 // the arguments. | 132 // the arguments. |
134 CryptoHandshakeMessage* AddDefaultConfig( | 133 CryptoHandshakeMessage* AddDefaultConfig(QuicRandom* rand, |
135 QuicRandom* rand, | 134 const QuicClock* clock, |
136 const QuicClock* clock, | 135 const ConfigOptions& options); |
137 const ConfigOptions& options); | |
138 | 136 |
139 // SetConfigs takes a vector of config protobufs and the current time. | 137 // SetConfigs takes a vector of config protobufs and the current time. |
140 // Configs are assumed to be uniquely identified by their server config ID. | 138 // Configs are assumed to be uniquely identified by their server config ID. |
141 // Previously unknown configs are added and possibly made the primary config | 139 // Previously unknown configs are added and possibly made the primary config |
142 // depending on their |primary_time| and the value of |now|. Configs that are | 140 // depending on their |primary_time| and the value of |now|. Configs that are |
143 // known, but are missing from the protobufs are deleted, unless they are | 141 // known, but are missing from the protobufs are deleted, unless they are |
144 // currently the primary config. SetConfigs returns false if any errors were | 142 // currently the primary config. SetConfigs returns false if any errors were |
145 // encountered and no changes to the QuicCryptoServerConfig will occur. | 143 // encountered and no changes to the QuicCryptoServerConfig will occur. |
146 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, | 144 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, |
147 QuicWallTime now); | 145 QuicWallTime now); |
(...skipping 12 matching lines...) Expand all Loading... |
160 // | 158 // |
161 // client_hello: the incoming client hello message. | 159 // client_hello: the incoming client hello message. |
162 // client_ip: the IP address of the client, which is used to generate and | 160 // client_ip: the IP address of the client, which is used to generate and |
163 // validate source-address tokens. | 161 // validate source-address tokens. |
164 // clock: used to validate client nonces and ephemeral keys. | 162 // clock: used to validate client nonces and ephemeral keys. |
165 // done_cb: single-use callback that accepts an opaque | 163 // done_cb: single-use callback that accepts an opaque |
166 // ValidatedClientHelloMsg token that holds information about | 164 // ValidatedClientHelloMsg token that holds information about |
167 // the client hello. The callback will always be called exactly | 165 // the client hello. The callback will always be called exactly |
168 // once, either under the current call stack, or after the | 166 // once, either under the current call stack, or after the |
169 // completion of an asynchronous operation. | 167 // completion of an asynchronous operation. |
170 void ValidateClientHello( | 168 void ValidateClientHello(const CryptoHandshakeMessage& client_hello, |
171 const CryptoHandshakeMessage& client_hello, | 169 IPEndPoint client_ip, |
172 IPEndPoint client_ip, | 170 const QuicClock* clock, |
173 const QuicClock* clock, | 171 ValidateClientHelloResultCallback* done_cb) const; |
174 ValidateClientHelloResultCallback* done_cb) const; | |
175 | 172 |
176 // ProcessClientHello processes |client_hello| and decides whether to accept | 173 // ProcessClientHello processes |client_hello| and decides whether to accept |
177 // or reject the connection. If the connection is to be accepted, |out| is | 174 // or reject the connection. If the connection is to be accepted, |out| is |
178 // set to the contents of the ServerHello, |out_params| is completed and | 175 // set to the contents of the ServerHello, |out_params| is completed and |
179 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and | 176 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and |
180 // an error code is returned. | 177 // an error code is returned. |
181 // | 178 // |
182 // validate_chlo_result: Output from the asynchronous call to | 179 // validate_chlo_result: Output from the asynchronous call to |
183 // ValidateClientHello. Contains the client hello message and | 180 // ValidateClientHello. Contains the client hello message and |
184 // information about it. | 181 // information about it. |
(...skipping 175 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
360 // EvaluateClientHello checks |client_hello| for gross errors and determines | 357 // EvaluateClientHello checks |client_hello| for gross errors and determines |
361 // whether it can be shown to be fresh (i.e. not a replay). The results are | 358 // whether it can be shown to be fresh (i.e. not a replay). The results are |
362 // written to |info|. | 359 // written to |info|. |
363 void EvaluateClientHello( | 360 void EvaluateClientHello( |
364 const uint8* primary_orbit, | 361 const uint8* primary_orbit, |
365 scoped_refptr<Config> requested_config, | 362 scoped_refptr<Config> requested_config, |
366 ValidateClientHelloResultCallback::Result* client_hello_state, | 363 ValidateClientHelloResultCallback::Result* client_hello_state, |
367 ValidateClientHelloResultCallback* done_cb) const; | 364 ValidateClientHelloResultCallback* done_cb) const; |
368 | 365 |
369 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. | 366 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. |
370 void BuildRejection( | 367 void BuildRejection(const Config& config, |
371 const Config& config, | 368 const CryptoHandshakeMessage& client_hello, |
372 const CryptoHandshakeMessage& client_hello, | 369 const ClientHelloInfo& info, |
373 const ClientHelloInfo& info, | 370 QuicRandom* rand, |
374 QuicRandom* rand, | 371 CryptoHandshakeMessage* out) const; |
375 CryptoHandshakeMessage* out) const; | |
376 | 372 |
377 // ParseConfigProtobuf parses the given config protobuf and returns a | 373 // ParseConfigProtobuf parses the given config protobuf and returns a |
378 // scoped_refptr<Config> if successful. The caller adopts the reference to the | 374 // scoped_refptr<Config> if successful. The caller adopts the reference to the |
379 // Config. On error, ParseConfigProtobuf returns NULL. | 375 // Config. On error, ParseConfigProtobuf returns NULL. |
380 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); | 376 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); |
381 | 377 |
382 // NewSourceAddressToken returns a fresh source address token for the given | 378 // NewSourceAddressToken returns a fresh source address token for the given |
383 // IP address. | 379 // IP address. |
384 std::string NewSourceAddressToken( | 380 std::string NewSourceAddressToken(const Config& config, |
385 const Config& config, | 381 const IPEndPoint& ip, |
386 const IPEndPoint& ip, | 382 QuicRandom* rand, |
387 QuicRandom* rand, | 383 QuicWallTime now) const; |
388 QuicWallTime now) const; | |
389 | 384 |
390 // ValidateSourceAddressToken returns true if the source address token in | 385 // ValidateSourceAddressToken returns true if the source address token in |
391 // |token| is a valid and timely token for the IP address |ip| given that the | 386 // |token| is a valid and timely token for the IP address |ip| given that the |
392 // current time is |now|. | 387 // current time is |now|. |
393 bool ValidateSourceAddressToken( | 388 bool ValidateSourceAddressToken(const Config& config, |
394 const Config& config, | 389 base::StringPiece token, |
395 base::StringPiece token, | 390 const IPEndPoint& ip, |
396 const IPEndPoint& ip, | 391 QuicWallTime now) const; |
397 QuicWallTime now) const; | |
398 | 392 |
399 // NewServerNonce generates and encrypts a random nonce. | 393 // NewServerNonce generates and encrypts a random nonce. |
400 std::string NewServerNonce(QuicRandom* rand, QuicWallTime now) const; | 394 std::string NewServerNonce(QuicRandom* rand, QuicWallTime now) const; |
401 | 395 |
402 // ValidateServerNonce decrypts |token| and verifies that it hasn't been | 396 // ValidateServerNonce decrypts |token| and verifies that it hasn't been |
403 // previously used and is recent enough that it is plausible that it was part | 397 // previously used and is recent enough that it is plausible that it was part |
404 // of a very recently provided rejection ("recent" will be on the order of | 398 // of a very recently provided rejection ("recent" will be on the order of |
405 // 10-30 seconds). If so, it records that it has been used and returns true. | 399 // 10-30 seconds). If so, it records that it has been used and returns true. |
406 // Otherwise it returns false. | 400 // Otherwise it returns false. |
407 bool ValidateServerNonce(base::StringPiece echoed_server_nonce, | 401 bool ValidateServerNonce(base::StringPiece echoed_server_nonce, |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
471 uint32 source_address_token_lifetime_secs_; | 465 uint32 source_address_token_lifetime_secs_; |
472 uint32 server_nonce_strike_register_max_entries_; | 466 uint32 server_nonce_strike_register_max_entries_; |
473 uint32 server_nonce_strike_register_window_secs_; | 467 uint32 server_nonce_strike_register_window_secs_; |
474 | 468 |
475 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); | 469 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); |
476 }; | 470 }; |
477 | 471 |
478 } // namespace net | 472 } // namespace net |
479 | 473 |
480 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 474 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
OLD | NEW |