Index: net/quic/crypto/quic_crypto_server_config.cc |
diff --git a/net/quic/crypto/quic_crypto_server_config.cc b/net/quic/crypto/quic_crypto_server_config.cc |
index 0a3c1ade1b611bdea15e07251fff498a744d2029..bfa239eb888d2eedff3eaa5e8020a732b4db4555 100644 |
--- a/net/quic/crypto/quic_crypto_server_config.cc |
+++ b/net/quic/crypto/quic_crypto_server_config.cc |
@@ -88,8 +88,7 @@ struct ValidateClientHelloResultCallback::Result { |
QuicWallTime in_now) |
: client_hello(in_client_hello), |
info(in_client_ip, in_now), |
- error_code(QUIC_NO_ERROR) { |
- } |
+ error_code(QUIC_NO_ERROR) {} |
CryptoHandshakeMessage client_hello; |
ClientHelloInfo info; |
@@ -101,8 +100,7 @@ class ValidateClientHelloHelper { |
public: |
ValidateClientHelloHelper(ValidateClientHelloResultCallback::Result* result, |
ValidateClientHelloResultCallback* done_cb) |
- : result_(result), done_cb_(done_cb) { |
- } |
+ : result_(result), done_cb_(done_cb) {} |
~ValidateClientHelloHelper() { |
LOG_IF(DFATAL, done_cb_ != NULL) |
@@ -116,9 +114,7 @@ class ValidateClientHelloHelper { |
DetachCallback(); |
} |
- void StartedAsyncCallback() { |
- DetachCallback(); |
- } |
+ void StartedAsyncCallback() { DetachCallback(); } |
private: |
void DetachCallback() { |
@@ -138,8 +134,7 @@ class VerifyNonceIsValidAndUniqueCallback |
VerifyNonceIsValidAndUniqueCallback( |
ValidateClientHelloResultCallback::Result* result, |
ValidateClientHelloResultCallback* done_cb) |
- : result_(result), done_cb_(done_cb) { |
- } |
+ : result_(result), done_cb_(done_cb) {} |
protected: |
virtual void RunImpl(bool nonce_is_valid_and_unique) OVERRIDE { |
@@ -179,7 +174,8 @@ void ValidateClientHelloResultCallback::Run(const Result* result) { |
QuicCryptoServerConfig::ConfigOptions::ConfigOptions() |
: expiry_time(QuicWallTime::Zero()), |
channel_id_enabled(false), |
- p256(false) {} |
+ p256(false) { |
+} |
QuicCryptoServerConfig::QuicCryptoServerConfig( |
StringPiece source_address_token_secret, |
@@ -369,7 +365,8 @@ bool QuicCryptoServerConfig::SetConfigs( |
bool ok = true; |
for (vector<QuicServerConfigProtobuf*>::const_iterator i = protobufs.begin(); |
- i != protobufs.end(); ++i) { |
+ i != protobufs.end(); |
+ ++i) { |
scoped_refptr<Config> config(ParseConfigProtobuf(*i)); |
if (!config.get()) { |
ok = false; |
@@ -394,31 +391,32 @@ bool QuicCryptoServerConfig::SetConfigs( |
for (vector<scoped_refptr<Config> >::const_iterator i = |
parsed_configs.begin(); |
- i != parsed_configs.end(); ++i) { |
+ i != parsed_configs.end(); |
+ ++i) { |
scoped_refptr<Config> config = *i; |
ConfigMap::iterator it = configs_.find(config->id); |
if (it != configs_.end()) { |
- VLOG(1) |
- << "Keeping scid: " << base::HexEncode( |
- config->id.data(), config->id.size()) |
- << " orbit: " << base::HexEncode( |
- reinterpret_cast<const char *>(config->orbit), kOrbitSize) |
- << " new primary_time " << config->primary_time.ToUNIXSeconds() |
- << " old primary_time " << it->second->primary_time.ToUNIXSeconds() |
- << " new priority " << config->priority |
- << " old priority " << it->second->priority; |
+ VLOG(1) << "Keeping scid: " |
+ << base::HexEncode(config->id.data(), config->id.size()) |
+ << " orbit: " |
+ << base::HexEncode(reinterpret_cast<const char*>(config->orbit), |
+ kOrbitSize) << " new primary_time " |
+ << config->primary_time.ToUNIXSeconds() << " old primary_time " |
+ << it->second->primary_time.ToUNIXSeconds() << " new priority " |
+ << config->priority << " old priority " << it->second->priority; |
// Update primary_time and priority. |
it->second->primary_time = config->primary_time; |
it->second->priority = config->priority; |
new_configs.insert(*it); |
} else { |
- VLOG(1) << "Adding scid: " << base::HexEncode( |
- config->id.data(), config->id.size()) |
- << " orbit: " << base::HexEncode( |
- reinterpret_cast<const char *>(config->orbit), kOrbitSize) |
- << " primary_time " << config->primary_time.ToUNIXSeconds() |
- << " priority " << config->priority; |
+ VLOG(1) << "Adding scid: " |
+ << base::HexEncode(config->id.data(), config->id.size()) |
+ << " orbit: " |
+ << base::HexEncode(reinterpret_cast<const char*>(config->orbit), |
+ kOrbitSize) << " primary_time " |
+ << config->primary_time.ToUNIXSeconds() << " priority " |
+ << config->priority; |
new_configs.insert(make_pair(config->id, config)); |
} |
} |
@@ -434,8 +432,8 @@ bool QuicCryptoServerConfig::SetConfigs( |
void QuicCryptoServerConfig::GetConfigIds(vector<string>* scids) const { |
base::AutoLock locked(configs_lock_); |
- for (ConfigMap::const_iterator it = configs_.begin(); |
- it != configs_.end(); ++it) { |
+ for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); |
+ ++it) { |
scids->push_back(it->first); |
} |
} |
@@ -492,7 +490,7 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
uint32 initial_flow_control_window_bytes, |
const QuicClock* clock, |
QuicRandom* rand, |
- QuicCryptoNegotiatedParameters *params, |
+ QuicCryptoNegotiatedParameters* params, |
CryptoHandshakeMessage* out, |
string* error_details) const { |
DCHECK(error_details); |
@@ -559,10 +557,8 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
out->Clear(); |
- if (!info.valid_source_address_token || |
- !info.client_nonce_well_formed || |
- !info.unique || |
- !requested_config.get()) { |
+ if (!info.valid_source_address_token || !info.client_nonce_well_formed || |
+ !info.unique || !requested_config.get()) { |
BuildRejection(*primary_config, client_hello, info, rand, out); |
return QUIC_NO_ERROR; |
} |
@@ -570,24 +566,29 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
const QuicTag* their_aeads; |
const QuicTag* their_key_exchanges; |
size_t num_their_aeads, num_their_key_exchanges; |
- if (client_hello.GetTaglist(kAEAD, &their_aeads, |
- &num_their_aeads) != QUIC_NO_ERROR || |
- client_hello.GetTaglist(kKEXS, &their_key_exchanges, |
+ if (client_hello.GetTaglist(kAEAD, &their_aeads, &num_their_aeads) != |
+ QUIC_NO_ERROR || |
+ client_hello.GetTaglist(kKEXS, |
+ &their_key_exchanges, |
&num_their_key_exchanges) != QUIC_NO_ERROR || |
- num_their_aeads != 1 || |
- num_their_key_exchanges != 1) { |
+ num_their_aeads != 1 || num_their_key_exchanges != 1) { |
*error_details = "Missing or invalid AEAD or KEXS"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
} |
size_t key_exchange_index; |
- if (!QuicUtils::FindMutualTag(requested_config->aead, their_aeads, |
- num_their_aeads, QuicUtils::LOCAL_PRIORITY, |
- ¶ms->aead, NULL) || |
- !QuicUtils::FindMutualTag( |
- requested_config->kexs, their_key_exchanges, num_their_key_exchanges, |
- QuicUtils::LOCAL_PRIORITY, ¶ms->key_exchange, |
- &key_exchange_index)) { |
+ if (!QuicUtils::FindMutualTag(requested_config->aead, |
+ their_aeads, |
+ num_their_aeads, |
+ QuicUtils::LOCAL_PRIORITY, |
+ ¶ms->aead, |
+ NULL) || |
+ !QuicUtils::FindMutualTag(requested_config->kexs, |
+ their_key_exchanges, |
+ num_their_key_exchanges, |
+ QuicUtils::LOCAL_PRIORITY, |
+ ¶ms->key_exchange, |
+ &key_exchange_index)) { |
*error_details = "Unsupported AEAD or KEXS"; |
return QUIC_CRYPTO_NO_SUPPORT; |
} |
@@ -641,23 +642,28 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
hkdf_input.append(requested_config->serialized); |
CrypterPair crypters; |
- if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, params->aead, |
- info.client_nonce, info.server_nonce, |
- hkdf_input, CryptoUtils::SERVER, &crypters)) { |
+ if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, |
+ params->aead, |
+ info.client_nonce, |
+ info.server_nonce, |
+ hkdf_input, |
+ CryptoUtils::SERVER, |
+ &crypters)) { |
*error_details = "Symmetric key setup failed"; |
return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED; |
} |
- scoped_ptr<QuicData> cetv_plaintext(crypters.decrypter->DecryptPacket( |
- 0 /* sequence number */, StringPiece() /* associated data */, |
- cetv_ciphertext)); |
+ scoped_ptr<QuicData> cetv_plaintext( |
+ crypters.decrypter->DecryptPacket(0 /* sequence number */, |
+ StringPiece() /* associated data */, |
+ cetv_ciphertext)); |
if (!cetv_plaintext.get()) { |
*error_details = "CETV decryption failure"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
} |
- scoped_ptr<CryptoHandshakeMessage> cetv(CryptoFramer::ParseMessage( |
- cetv_plaintext->AsStringPiece())); |
+ scoped_ptr<CryptoHandshakeMessage> cetv( |
+ CryptoFramer::ParseMessage(cetv_plaintext->AsStringPiece())); |
if (!cetv.get()) { |
*error_details = "CETV parse error"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
@@ -681,8 +687,11 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
hkdf_input.append(QuicCryptoConfig::kInitialLabel, label_len); |
hkdf_input.append(hkdf_suffix); |
- if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, params->aead, |
- info.client_nonce, info.server_nonce, hkdf_input, |
+ if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, |
+ params->aead, |
+ info.client_nonce, |
+ info.server_nonce, |
+ hkdf_input, |
CryptoUtils::SERVER, |
¶ms->initial_crypters)) { |
*error_details = "Symmetric key setup failed"; |
@@ -693,7 +702,10 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
if (ephemeral_key_source_.get()) { |
params->forward_secure_premaster_secret = |
ephemeral_key_source_->CalculateForwardSecureKey( |
- key_exchange, rand, clock->ApproximateNow(), public_value, |
+ key_exchange, |
+ rand, |
+ clock->ApproximateNow(), |
+ public_value, |
&forward_secure_public_value); |
} else { |
scoped_ptr<KeyExchange> forward_secure_key_exchange( |
@@ -714,10 +726,13 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
label_len); |
forward_secure_hkdf_input.append(hkdf_suffix); |
- if (!CryptoUtils::DeriveKeys( |
- params->forward_secure_premaster_secret, params->aead, |
- info.client_nonce, info.server_nonce, forward_secure_hkdf_input, |
- CryptoUtils::SERVER, ¶ms->forward_secure_crypters)) { |
+ if (!CryptoUtils::DeriveKeys(params->forward_secure_premaster_secret, |
+ params->aead, |
+ info.client_nonce, |
+ info.server_nonce, |
+ forward_secure_hkdf_input, |
+ CryptoUtils::SERVER, |
+ ¶ms->forward_secure_crypters)) { |
*error_details = "Symmetric key setup failed"; |
return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED; |
} |
@@ -725,15 +740,13 @@ QuicErrorCode QuicCryptoServerConfig::ProcessClientHello( |
out->set_tag(kSHLO); |
QuicTagVector supported_version_tags; |
for (size_t i = 0; i < supported_versions.size(); ++i) { |
- supported_version_tags.push_back |
- (QuicVersionToQuicTag(supported_versions[i])); |
+ supported_version_tags.push_back( |
+ QuicVersionToQuicTag(supported_versions[i])); |
} |
out->SetVector(kVER, supported_version_tags); |
- out->SetStringPiece(kSourceAddressTokenTag, |
- NewSourceAddressToken( |
- *requested_config, |
- client_address, rand, |
- info.now)); |
+ out->SetStringPiece( |
+ kSourceAddressTokenTag, |
+ NewSourceAddressToken(*requested_config, client_address, rand, info.now)); |
QuicSocketAddressCoder address_coder(client_address); |
out->SetStringPiece(kCADR, address_coder.Encode()); |
out->SetStringPiece(kPUBS, forward_secure_public_value); |
@@ -786,8 +799,8 @@ void QuicCryptoServerConfig::SelectNewPrimaryConfig( |
vector<scoped_refptr<Config> > configs; |
configs.reserve(configs_.size()); |
- for (ConfigMap::const_iterator it = configs_.begin(); |
- it != configs_.end(); ++it) { |
+ for (ConfigMap::const_iterator it = configs_.begin(); it != configs_.end(); |
+ ++it) { |
// TODO(avd) Exclude expired configs? |
configs.push_back(it->second); |
} |
@@ -836,8 +849,8 @@ void QuicCryptoServerConfig::SelectNewPrimaryConfig( |
new_primary->is_primary = true; |
DVLOG(1) << "New primary config. orbit: " |
<< base::HexEncode( |
- reinterpret_cast<const char*>(primary_config_->orbit), |
- kOrbitSize); |
+ reinterpret_cast<const char*>(primary_config_->orbit), |
+ kOrbitSize); |
if (primary_config_changed_cb_.get() != NULL) { |
primary_config_changed_cb_->Run(primary_config_->id); |
} |
@@ -855,8 +868,8 @@ void QuicCryptoServerConfig::SelectNewPrimaryConfig( |
new_primary->is_primary = true; |
DVLOG(1) << "New primary config. orbit: " |
<< base::HexEncode( |
- reinterpret_cast<const char*>(primary_config_->orbit), |
- kOrbitSize) |
+ reinterpret_cast<const char*>(primary_config_->orbit), |
+ kOrbitSize) |
<< " scid: " << base::HexEncode(primary_config_->id.data(), |
primary_config_->id.size()); |
next_config_promotion_time_ = QuicWallTime::Zero(); |
@@ -872,8 +885,7 @@ void QuicCryptoServerConfig::EvaluateClientHello( |
ValidateClientHelloResultCallback* done_cb) const { |
ValidateClientHelloHelper helper(client_hello_state, done_cb); |
- const CryptoHandshakeMessage& client_hello = |
- client_hello_state->client_hello; |
+ const CryptoHandshakeMessage& client_hello = client_hello_state->client_hello; |
ClientHelloInfo* info = &(client_hello_state->info); |
if (client_hello.size() < kClientHelloMinimumSize) { |
@@ -892,10 +904,8 @@ void QuicCryptoServerConfig::EvaluateClientHello( |
StringPiece srct; |
if (requested_config.get() != NULL && |
client_hello.GetStringPiece(kSourceAddressTokenTag, &srct) && |
- ValidateSourceAddressToken(*requested_config, |
- srct, |
- info->client_ip, |
- info->now)) { |
+ ValidateSourceAddressToken( |
+ *requested_config, srct, info->client_ip, info->now)) { |
info->valid_source_address_token = true; |
} else { |
// No server config with the requested ID, or no valid source address token. |
@@ -940,9 +950,9 @@ void QuicCryptoServerConfig::EvaluateClientHello( |
static_cast<uint32>(info->now.ToUNIXSeconds()), |
strike_register_window_secs_, |
primary_orbit, |
- strike_register_no_startup_period_ ? |
- StrikeRegister::NO_STARTUP_PERIOD_NEEDED : |
- StrikeRegister::DENY_REQUESTS_AT_STARTUP)); |
+ strike_register_no_startup_period_ |
+ ? StrikeRegister::NO_STARTUP_PERIOD_NEEDED |
+ : StrikeRegister::DENY_REQUESTS_AT_STARTUP)); |
} |
strike_register_client = strike_register_client_.get(); |
} |
@@ -962,12 +972,9 @@ void QuicCryptoServerConfig::BuildRejection( |
CryptoHandshakeMessage* out) const { |
out->set_tag(kREJ); |
out->SetStringPiece(kSCFG, config.serialized); |
- out->SetStringPiece(kSourceAddressTokenTag, |
- NewSourceAddressToken( |
- config, |
- info.client_ip, |
- rand, |
- info.now)); |
+ out->SetStringPiece( |
+ kSourceAddressTokenTag, |
+ NewSourceAddressToken(config, info.client_ip, rand, info.now)); |
if (replay_protection_) { |
out->SetStringPiece(kServerNonceTag, NewServerNonce(rand, info.now)); |
} |
@@ -977,9 +984,9 @@ void QuicCryptoServerConfig::BuildRejection( |
size_t num_their_proof_demands; |
if (proof_source_.get() == NULL || |
- client_hello.GetTaglist(kPDMD, &their_proof_demands, |
- &num_their_proof_demands) != |
- QUIC_NO_ERROR) { |
+ client_hello.GetTaglist(kPDMD, |
+ &their_proof_demands, |
+ &num_their_proof_demands) != QUIC_NO_ERROR) { |
return; |
} |
@@ -1002,8 +1009,11 @@ void QuicCryptoServerConfig::BuildRejection( |
const vector<string>* certs; |
string signature; |
- if (!proof_source_->GetProof(info.sni.as_string(), config.serialized, |
- x509_ecdsa_supported, &certs, &signature)) { |
+ if (!proof_source_->GetProof(info.sni.as_string(), |
+ config.serialized, |
+ x509_ecdsa_supported, |
+ &certs, |
+ &signature)) { |
return; |
} |
@@ -1012,9 +1022,11 @@ void QuicCryptoServerConfig::BuildRejection( |
client_hello.GetStringPiece(kCCS, &their_common_set_hashes); |
client_hello.GetStringPiece(kCCRT, &their_cached_cert_hashes); |
- const string compressed = CertCompressor::CompressChain( |
- *certs, their_common_set_hashes, their_cached_cert_hashes, |
- config.common_cert_sets); |
+ const string compressed = |
+ CertCompressor::CompressChain(*certs, |
+ their_common_set_hashes, |
+ their_cached_cert_hashes, |
+ config.common_cert_sets); |
// kREJOverheadBytes is a very rough estimate of how much of a REJ |
// message is taken up by things other than the certificates. |
@@ -1123,7 +1135,7 @@ QuicCryptoServerConfig::ParseConfigProtobuf( |
!strike_register_client->IsKnownOrbit(orbit)) { |
LOG(WARNING) |
<< "Rejecting server config with orbit that the strike register " |
- "client doesn't know about."; |
+ "client doesn't know about."; |
return NULL; |
} |
} |
@@ -1192,7 +1204,8 @@ QuicCryptoServerConfig::ParseConfigProtobuf( |
} |
for (vector<KeyExchange*>::const_iterator i = config->key_exchanges.begin(); |
- i != config->key_exchanges.end(); ++i) { |
+ i != config->key_exchanges.end(); |
+ ++i) { |
if ((*i)->tag() == tag) { |
LOG(WARNING) << "Duplicate key exchange in config: " << tag; |
return NULL; |
@@ -1273,11 +1286,10 @@ void QuicCryptoServerConfig::AcquirePrimaryConfigChangedCb( |
primary_config_changed_cb_.reset(cb); |
} |
-string QuicCryptoServerConfig::NewSourceAddressToken( |
- const Config& config, |
- const IPEndPoint& ip, |
- QuicRandom* rand, |
- QuicWallTime now) const { |
+string QuicCryptoServerConfig::NewSourceAddressToken(const Config& config, |
+ const IPEndPoint& ip, |
+ QuicRandom* rand, |
+ QuicWallTime now) const { |
SourceAddressToken source_address_token; |
source_address_token.set_ip(IPAddressToPackedString(ip.address())); |
source_address_token.set_timestamp(now.ToUNIXSeconds()); |
@@ -1369,8 +1381,8 @@ bool QuicCryptoServerConfig::ValidateServerNonce(StringPiece token, |
uint8 server_nonce[32]; |
memcpy(server_nonce, plaintext.data(), 4); |
memcpy(server_nonce + 4, server_nonce_orbit_, sizeof(server_nonce_orbit_)); |
- memcpy(server_nonce + 4 + sizeof(server_nonce_orbit_), plaintext.data() + 4, |
- 20); |
+ memcpy( |
+ server_nonce + 4 + sizeof(server_nonce_orbit_), plaintext.data() + 4, 20); |
COMPILE_ASSERT(4 + sizeof(server_nonce_orbit_) + 20 == sizeof(server_nonce), |
bad_nonce_buffer_length); |
@@ -1378,11 +1390,12 @@ bool QuicCryptoServerConfig::ValidateServerNonce(StringPiece token, |
{ |
base::AutoLock auto_lock(server_nonce_strike_register_lock_); |
if (server_nonce_strike_register_.get() == NULL) { |
- server_nonce_strike_register_.reset(new StrikeRegister( |
- server_nonce_strike_register_max_entries_, |
- static_cast<uint32>(now.ToUNIXSeconds()), |
- server_nonce_strike_register_window_secs_, server_nonce_orbit_, |
- StrikeRegister::NO_STARTUP_PERIOD_NEEDED)); |
+ server_nonce_strike_register_.reset( |
+ new StrikeRegister(server_nonce_strike_register_max_entries_, |
+ static_cast<uint32>(now.ToUNIXSeconds()), |
+ server_nonce_strike_register_window_secs_, |
+ server_nonce_orbit_, |
+ StrikeRegister::NO_STARTUP_PERIOD_NEEDED)); |
} |
is_unique = server_nonce_strike_register_->Insert( |
server_nonce, static_cast<uint32>(now.ToUNIXSeconds())); |
@@ -1396,8 +1409,11 @@ QuicCryptoServerConfig::Config::Config() |
is_primary(false), |
primary_time(QuicWallTime::Zero()), |
priority(0), |
- source_address_token_boxer(NULL) {} |
+ source_address_token_boxer(NULL) { |
+} |
-QuicCryptoServerConfig::Config::~Config() { STLDeleteElements(&key_exchanges); } |
+QuicCryptoServerConfig::Config::~Config() { |
+ STLDeleteElements(&key_exchanges); |
+} |
} // namespace net |